Finland faces blind spot in data centre oversight, security agency warns

Finland’s Security Intelligence Service (Supo) has warned municipalities to consult the agency before signing agreements with foreign data centre operators, citing risks tied to authoritarian states.

Over 100 data centres are planned in Finland, drawn by cheap electricity and a cool climate. But Supo’s senior investigator Veli-Pekka Kivimäki told Yle that local governments may be prioritising economic gains over security concerns.

“In some cases, the national security risks may not be fully recognised,” Kivimäki said.

He declined to comment on specific projects but urged municipalities to contact Supo early—ideally before contracts are signed. Currently, authorities often learn of projects too late due to a legal loophole: if a foreign company leases land rather than buys it, the project may evade oversight entirely.

“At present, there is no legislation in force that requires notification of such data centre projects,” Kivimäki noted. Land purchase security reviews apply only to sales, not leases, and the same gap exists for foreign entities renting space in existing facilities.

With no legal obligation to report projects to the state, responsibility for assessing security risks often falls to individual municipalities. Kivimäki said lawmakers are addressing the issue, with a new investment screening law under review and potentially in force by spring 2027.

Supo’s concerns centre on operators from authoritarian states like Russia and China. Kivimäki highlighted risks including hidden ownership structures, data ending up in the wrong hands, and the potential for data centres to be used for sanctions evasion or “bulletproof hosting”—where operators deliberately avoid identifying clients, enabling criminal or state-sponsored intelligence activities.

China’s laws, for example, can compel companies to cooperate with state authorities, raising the risk of data being accessed by unwanted actors. Similarly, Russia and China may use Finnish data centres to bypass export restrictions on advanced chips needed for AI computing.