Patrick Quirk

Everything Routes Through a Data Center. Nobody Was Asking How They Are Secured.

I mapped all 18,110 because they are critical infrastructure and were being ignored as such. Now there are 300 bills and $130 billion in cancelled projects, and the argument is about something else.

Patrick Quirk's avatar
Patrick Quirk
Aug 06, 2026
∙ Paid

When I built this, nobody cared about data centers. That was the problem I was pointing at.

Everything routes through one. Every service you use, every transaction, every message, every page load terminates in a building full of servers, cooling and redundant power. They are the hub. Pull one and things stop working for people who have never heard of it.

That is the textbook definition of critical infrastructure. And at the time it was getting almost none of the attention that label is supposed to carry. Nobody was asking the obvious questions in public. How are these facilities secured? What happens when one goes down? Where are the single points of failure? Which regions sit one building away from being cut off? For something carrying that much load, the silence was strange.

So I mapped them. All of them. Not as a hobby and not as an argument, but because you cannot ask a serious question about the resilience of a system whose components nobody has bothered to enumerate. A commercial geospatial intelligence project needed data center locations for its own reasons and I built the tool that got them. The reason I kept going, cleaned it, and eventually published it was that the gap in public discussion seemed worth closing.

Nobody objected. Nobody asked what it was for. It was infrastructure trivia.

That was not even two years ago.

What changed

Everything, and fast, but not in the direction I expected.

The money arrived first. US data center construction starts went from $14.9 billion in 2023 to $26.9 billion in 2024 to $77.7 billion in 2025, a 190 percent jump in a single year (American Industrial Magazine). The five largest hyperscalers are putting between $660 billion and $725 billion into AI infrastructure this year alone, close to double 2025 (Intellectia). More than 23 gigawatts of capacity is physically under construction (BloombergNEF).

Then the pushback. In 2026 so far, lawmakers in more than 30 states have introduced over 300 bills touching data centers: moratoriums, tax incentives, energy policy (MultiState). Bans and pauses are under discussion in more than 20 states, and over $130 billion in projects was delayed or abandoned in the first quarter of 2026 alone (EESI).

It is not only a statehouse story. Nearly a third of Indiana counties have moved to restrict data centers (WFYI). Farmville commissioners voted unanimously this month for a twelve month moratorium after residents turned out against a proposal (WITN). In Lysander, New York, more than 350 residents came to a board meeting over a proposed 300 megawatt campus on 120 acres, and a six month moratorium passed unanimously (Rockefeller Institute of Government). In Tonawanda, hundreds showed up citing pollution, utility costs, property values and noise (Rockefeller Institute of Government).

The two arguments underneath it are electricity and water.

On electricity, the honest answer is that it is contested. One analysis puts $23 billion in higher costs already pushed onto the public (Fortune). A study from NC State, Carnegie Mellon and others projects demand weighted wholesale prices rising 6 to 29 percent nationally by 2030, and as much as 57 percent in the worst hit regions (Forbes). But a March 2026 study found the correlation between data center count and current prices statistically insignificant (Independent Institute), and in some regions large industrial load lowered residential rates between 2019 and 2024 before reversing where slack ran out (Marketplace). Anyone telling you this is settled in either direction is selling something.

On water it is less ambiguous, because the impact is local rather than national. Nationally, data centers are a small share of consumption. Locally they are not. A facility in Newton County, Georgia uses 500,000 gallons a day, roughly 10 percent of the entire county’s water (Consumer Reports). Facilities across Arizona, Colorado, Nevada, New Mexico and Utah could draw 7 billion gallons a year by 2035, enough for up to 194,000 people (Quartz). As of early May 2026, roughly 51 percent of the US and Puerto Rico was in drought (Quartz).

So data centers finally made the news. Just not for the reason I was asking about.

Where I stand

I am not on a side, and I want to be precise about what that means, because it is not indifference.

I am not an advocate for the industry. I am not an activist against it. I have no position on whether the facility proposed near you should be built, and if your county’s water table cannot support one, that is a real objection that deserves a real hearing.

But I will say this much, because it is the reason I built the map.

Data centers have always existed. They have been running the internet for decades, quietly, in buildings nobody protested because nobody knew they were there. The category is not new and the category is not the problem. What is new is the scale and speed of the hyperscale AI buildout, and that is a legitimate and separate discussion about power procurement, water rights, siting and who absorbs the cost.

Collapsing those two things into one is where the current fight goes wrong. Data centers did not arrive in 2025. Treating the whole category as the villain aims at the wrong target, and worse, it crowds out the question that actually needed asking and is still unanswered: this is critical infrastructure, so how is it secured, how resilient is it, and what happens when a node fails.

That question got no oxygen when data centers were invisible. It is getting no oxygen now that they are political, because the argument moved to electricity bills and zoning before anyone finished the first conversation.

What I have is the list, the methodology, and an honest account of where it is weak. Use it for whichever argument you are having. I would rather it get used for the one about resilience.

How I actually got it

I scraped the hell out of the people selling it.

Not their internal systems. Their open APIs and their public facing websites. The endpoints their own front ends call to render pages any visitor can load. Five sources, driven with Playwright, pulling facility names, operators, street addresses, cities, countries and coordinates.

That is what makes this explicitly OSINT and not something else. No credentials. No API abuse. No authentication bypass. No proprietary access. Every record came from information those companies chose to publish on the open internet, retrieved the same way your browser retrieves it, just systematically.

Which gets to the thing worth understanding about this industry.

The business being run on public information

The commercial data center marketplaces have run the same play since the mid 2000s. Their model is a commission on colocation deals brokered through their platforms, typically around 10 percent. Sign a $10,000 a month contract through one of their quote services and they take roughly $1,000 a month for the initial term. On top of that, operators pay for premium listings, banner placement, sponsorships and enhanced memberships. All of it priced behind a “contact us” wall.

They list tens of thousands of facilities. You can browse them. Download the data? Get coordinates in bulk? Export to your own tools? No. That restriction is the product.

Here is the part that matters: none of the underlying information is secret. These are commercial buildings. Many advertise their own addresses. They appear in property records and business filings. Nothing is being revealed here that the operators themselves have not already published.

The scarcity is manufactured. The gate is the business.

The part that took the actual time

Scraping was the easy half. The cleaning consumed more hours than everything else combined, and it is the real reason this data gets sold rather than shared.

  • 970 records had no country field at all. I recovered 707 through address parsing.

  • 1,708 US records had no state. I mapped 1,434 via ZIP code geocoding.

  • Only 36.6 percent had usable coordinates. Batch geocoding pushed that past 70 percent.

  • 261 Southern Hemisphere facilities had inverted latitude signs, putting them in the wrong hemisphere entirely. Three Australian facilities had geocoded into Europe.

That is the moat. Not secrecy. The unglamorous work of making public information usable. I did that part, so nobody has to pay for it.

What the data says

18,110 facilities. 116 countries. 4,181 operators.

The United States holds nearly half of everything. 8,818 of 18,110 facilities, 48.7 percent. A handful of metros, Northern Virginia, Dallas, Chicago, Los Angeles, the New York and New Jersey corridor, hold more capacity than entire continents.

The Netherlands has more mapped facilities than India. 444 against 342. Seventeen million people against 1.4 billion. Density follows capital, connectivity and regulation. Never population.

Africa has fewer than the Netherlands. Roughly 240 facilities for 1.4 billion people, and South Africa holds 67 of them. That is not a hole in my scraper. It is a real gap, and it sets latency, data sovereignty and digital autonomy for a quarter of the world.

Brazil is South America. 141 of the continent’s roughly 217 facilities. Sao Paulo is a single point of failure for a continent.

The physical layer is centralized even where the protocol layer is not. Amazon AWS runs 533 facilities. Equinix 482. Lumen 403. China Telecom 316. Zenlayer 309. Digital Realty 299. The top six alone exceed 2,300. When people call the internet decentralized, they mean the protocols. The buildings are not.

Those were interesting numbers when this was trivia. They are load bearing now, because every argument in that moratorium map is fundamentally an argument about geography, and most of it is being conducted without one.

Read this before you use it for anything that matters

This is the section nobody publishes, and it decides whether your conclusion is real.

The coordinates are not uniformly precise. Roughly 6,131 of 18,110 records carry city level coordinates. The rest fall through a chain: city where available, then US state centroid, then country centroid.

A dot on this map is therefore often not a building. It is frequently a city. Sometimes it is the geometric middle of an entire country, which is to say nowhere at all.

For seeing the shape of global infrastructure, fine. For anything where a specific location matters, it is worse than useless, because it will hand you a confident looking coordinate pointing at a field.

So if you are computing exposure to a water basin, a heat threshold, a grid region or a floodplain: filter on coordinate provenance first. If you skip that, you will produce a number that looks rigorous and means nothing.

And if you are pointing at a dot and saying that building, right there, you are very likely wrong. I am telling you so in the dataset’s own license file.

Why it is free now

I released it under All Rights Reserved. Read that phrase next to the words released it and you will spot the problem.

Then the emails started. A ratings agency wanted it for a white paper on water stress and heat stress exposure across industrial sectors. A satellite communications company wanted it as a layer in an internal planning tool. Others after that. Every one of them careful, every one having read the license and decided to ask rather than simply take the files, which they could have done in about four seconds, because the repository is public.

Every time, I typed the same reply: yes, go ahead, just credit me.

A permission system whose only function is to make honest people wait for my email is not protection. It never stopped anyone willing to ignore it. It only taxed the people who were going to credit me anyway. And there is an irony I would rather name myself than have someone else name for me: my whole argument against the marketplaces is that they put a gate in front of public information. Then I did the same thing. A gate with no lock and no guard, but a gate.

So it is attribution only now. Use it, copy it, publish it, build a product on it, cite it, argue with it. You do not need to ask and you do not owe me an email, though I would like to hear what you make. I would not have guessed the first serious use would be climate risk modeling.

Take it

18,110 facilities in twelve formats: CSV, XLSX, JSON, GeoJSON, KML, TSV, XML, SQLite, Parquet, SQL dump, YAML, and a Markdown table you can read without downloading anything. GeoJSON imports straight into QGIS, Mapbox, ArcGIS and Kepler.gl. KML opens in Google Earth. The SQLite build is queryable with no server.

The live map carries search, country and operator filters, clustering, heatmaps, radius search, distance measurement, proximity analysis and export. There is a 3D globe and a Robinson projection as well, because Mercator lies about area and area is the entire argument when you are looking at where infrastructure concentrates.

Data: https://github.com/Ringmast4r/Global-Data-Center-Map
Map: https://data-center-map.com

No account. No commission. No quote form. No sales team.

I mapped these buildings when they were boring. Everyone has since decided they are the most important buildings in the country, and both sides of that argument have turned up wanting the numbers.

I am not going to tell you what to conclude. I did the scraping, I did the cleaning, I have shown my methodology, and I have told you exactly where the data is weak so you cannot honestly overstate it.

The research is yours now.

User's avatar

Continue reading this post for free, courtesy of Patrick Quirk.

Or purchase a paid subscription.
© 2026 Ringmast4r · Privacy ∙ Terms ∙ Collection notice
Start your SubstackGet the app
Substack is the home for great culture