On the evening of July 10, 2024, a lightning arrestor failed on a 230 kV transmission line in northern Virginia. The grid corrected itself in milliseconds. Sixty data centers in Fairfax County did not wait. Their internal protection systems read the voltage flicker as a threat and switched in unison to backup generators, dropping 1,500 MW of demand off the PJM Interconnection grid within seconds, per the post-event report from the North American Electric Reliability Corporation. PJM operators manually shed roughly 900 MW of generation to absorb the surplus before frequency could cascade.
Between May and July 2025, the Trump administration moved to pull commercial AI data centers under the Federal Power Act’s grid security framework, the same framework Congress wrote in 2015 to harden the electric supply to nuclear weapons facilities, military command centers, and missile defense sites. The mechanism is statutory. The consequences are largely invisible. The mapping of what it unlocks has barely begun.
That single piece of equipment failure exposed the physical pattern. Dozens of hyperscale facilities sitting on a shared transmission backbone with synchronized protection logic is now the spine of American AI capacity, and the administration has built the legal mechanism to change its status. Every downstream question, transformer supply, fuel sourcing, substation hardening, allied parallel buildouts, hangs from it.
The Statute
Section 215A of the Federal Power Act, codified at 16 USC 824o-1, was added by the Fixing America’s Surface Transportation Act of 2015. The provision created two interlocking categories. A Critical Defense Facility is any facility the Secretary of Energy designates as critical to the defense of the United States and vulnerable to a disruption of electric supply from an external provider. Defense Critical Electric Infrastructure is the electric infrastructure within the lower 48 states or DC that serves a designated facility but is not owned by the facility operator. The data center receives one designation. The substations, transmission lines, gas pipelines, and generation supplying it receive a separate one. In practice, the data center is the protected node. The grid feeding it becomes the protected system.
The statute hands DOE three categories of authority over designated assets. The first is emergency power. Once the President identifies a grid security emergency in writing, the Secretary may issue orders for emergency measures with or without notice, hearing, or report. Compliance with those orders does not count as a violation of any other Federal Power Act reliability standard. The second is information protection. Critical Electric Infrastructure Information is exempt from FOIA and from any state, local, or tribal disclosure law. The third is cost allocation: when DOE orders emergency measures to protect a designated facility, the operator of that facility bears the full incremental cost.
The statute does not list any specific facilities, and DOE does not publish the list. The roster of designated Critical Defense Facilities is itself protected information. DOE’s 2018 implementing rulemaking confirmed the program’s information protections track its lead Sector-Specific Agency role under Presidential Policy Directive 21, the framework historically applied to military and weapons complex sites.
What the Executive Orders Did
On May 23, 2025, the President signed Executive Order 14299, Deploying Advanced Nuclear Reactor Technologies for National Security. Section 4(a) directs the Secretary of Energy to initiate the process of designating AI data centers within the 48 contiguous states that are located at or operated in coordination with Department of Energy facilities, including as support for national security missions, as critical defense facilities. The same section deems the electrical infrastructure powering them, both nuclear and non-nuclear, as defense-critical electric infrastructure. The background paragraph cites 16 USC 824o-1(c) as the legal basis.
Three companion orders signed the same day, EOs 14300, 14301, and 14302, directed the Nuclear Regulatory Commission to compress licensing, instructed DOE to fast-track reactor testing, and ordered a quadrupling of US nuclear capacity to 400 GW by 2050. EO 14299 also directed the Secretary of the Army to commence operation of a nuclear reactor at a domestic military installation no later than September 30, 2028.
Two months later, on July 23, 2025, the President signed Executive Order 14318, Accelerating Federal Permitting of Data Center Infrastructure. EO 14318 created a category called Qualifying Projects: data center projects with at least 100 MW of new electric load, at least $500 million in capital expenditures, a national security nexus, or a discretionary designation by the Secretary of Defense, Commerce, Interior, or Energy. Qualifying Projects receive categorical exclusions under the National Environmental Policy Act, expedited Clean Air Act and Clean Water Act review, FAST-41 transparency designation, financial support through the Commerce Department, and access to federal land. EO 14318 revoked the Biden administration’s January 2025 EO 14141 in the same document.
The two orders are designed to operate together. EO 14299 establishes the legal designation. EO 14318 strips the permitting friction. The combined effect is that a class of privately owned hyperscale computing facilities can be brought inside a defense framework while simultaneously being moved through environmental review on an accelerated track.
The Sites in Motion
In April 2025, DOE published a Request for Information identifying 16 federal sites for potential AI data center development. Responses closed May 7. The day after EO 14318 was signed, on July 24, 2025, DOE announced four sites selected to move forward with private sector partner solicitations.
The four sites are Idaho National Laboratory, Oak Ridge Reservation, the Paducah Gaseous Diffusion Plant, and the Savannah River Site. Idaho National Laboratory sits on roughly 62,000 acres of an 890-square-mile federal reservation and has historical experience operating dozens of nuclear reactors. Oak Ridge is the original Manhattan Project site and houses the Y-12 National Security Complex, which still handles enriched uranium for the active nuclear weapons stockpile. Paducah is a 3,500-acre former uranium enrichment plant under remediation, sitting in the MISO market with up to 3 GW of available capacity. Savannah River is a 310-square-mile former plutonium and tritium production site, with active National Nuclear Security Administration tritium operations on the same campus as the proposed data center buildout.
Energy Secretary Chris Wright described the announcement as accelerating the next Manhattan Project. The framing is not incidental. DOE is co-locating commercial AI compute on the United States nuclear weapons complex. The sites have existing classified-handling capacity, mature security perimeters, and pre-existing infrastructure designations. The same logic collapses the line between commercial computing and the weapons enterprise.
The first solicitation, an Idaho National Laboratory Request for Applications issued September 9, 2025, closed November 7. Oak Ridge and Savannah River proposals closed in early December. The Paducah Request for Offers closed January 30, 2026. As of this writing, DOE has not publicly confirmed which specific commercial data centers, if any, have been formally designated under section 215A. The executive order directs the Secretary to initiate the process. The statute makes the resulting list non-public. That distinction matters.
What the Designation Unlocks
The information protection is the most immediate effect. Under 16 USC 824o-1(d), Critical Electric Infrastructure Information is exempt from FOIA and from any state, local, or tribal disclosure regime. Substation locations, transmission paths, fuel sources, capacity figures, and vulnerability assessments tied to a designated facility can all be sealed. State public records laws are preempted on this point by federal statute. The same data ratepayer advocates, journalists, and reliability researchers have used to document grid stress and rate-recovery decisions becomes legally unavailable.
The emergency authority is the most consequential. Once the President identifies a grid security emergency, the Secretary can issue orders to protect or restore reliability at designated facilities with no notice, no hearing, and no report, and the orders are insulated from the normal Federal Power Act compliance regime. The statutory definition of grid security emergency is broad enough to cover cyberattacks, electromagnetic pulse events, geomagnetic storms, and direct physical attacks. The Secretary’s discretion in declaring those conditions is wide.
The cost-shifting is the least visible. The statute requires the operator of a designated Critical Defense Facility to bear the full incremental cost of any emergency measures DOE orders. Read one way, this is a constraint on the operator. Read the other way, it is a guarantee: DOE has statutory authority to keep generation running for that facility specifically, even when the supplying plant would otherwise be retired. The companion EO 14318 layers categorical NEPA exclusions, Army Corps streamlining, and FAST-41 designation on top. The statute also directs DOE to expedite security clearances for key personnel of designated facilities and to provide them temporary access to classified threat information.
The Threat Surface Inverts
Read against the original statutory intent, the traditional logic of Critical Defense Facility designation rested on three assumptions. The list was small. The facilities were already hardened. The value of attacking them was high but the operational difficulty was higher. AI data centers invert all three.
There are dozens of hyperscale campuses already standing or under construction. Most sit in rural or suburban areas with limited physical security beyond perimeter fencing. Many draw on a single substation. The July 2024 Virginia event demonstrated that 60 facilities can drop simultaneously off a shared transmission backbone in response to a localized fault. A coordinated physical or cyber attack against a designated AI data center substation could produce comparable or worse effects, and the target now carries a national-security designation that raises its visibility to adversaries.
GRU Unit 29155 has been linked to physical sabotage of European critical infrastructure. Iranian cyber actors have repeatedly demonstrated interest in US water and energy systems. Chinese state-sponsored actors operate networks of compromised devices targeting US infrastructure, per joint US-UK advisories. The designation does not by itself harden the facility. It changes the legal status without changing the engineering.
The Supply Chain Inherits the Designation
Defense Critical Electric Infrastructure is not just a label on the data center. The statutory definition extends to the substations, transmission lines, gas pipelines, and generation that serve the designated facility. By designating commercial AI data centers, the executive branch implicitly designates the entire supply chain feeding them.
That supply chain has known foreign exposure. Large power transformer lead times in the United States run multiple years, and grain-oriented electrical steel, the core input, is produced principally outside North America. High-voltage circuit breakers and turbine components face multi-year backlogs at GE Vernova, Siemens, and Mitsubishi. The High-Assay Low-Enriched Uranium intended to fuel the small modular reactors planned for these sites is a market historically dominated by Russia, with Centrus Energy and the DOE fuel bank only beginning to scale a domestic alternative.
The legal architecture has not been matched by the industrial capacity to support it. That gap is the next thread to trace.
The State Preemption Question
Power plant siting and retail rate regulation are reserved to states under the Federal Power Act. More than 300 data center bills have been filed across more than 30 state legislatures in the first six weeks of 2026, per tallies from MultiState and ArentFox Schiff. Maine came closest to a statewide pause: LD 307 would have imposed an 18-month moratorium on data centers consuming more than 20 MW. Governor Janet Mills vetoed the bill on April 24, 2026, citing the absence of a carveout for a specific project in Jay, and the legislature failed to override. Moratorium bills remain pending in New York, Oklahoma, South Dakota, and Wisconsin. Maryland, California, and others are pursuing rate-class and cost-allocation regimes designed to keep data center load costs off residential bills.
The Critical Defense Facility designation does not give the federal government direct siting authority over a commercial data center. What it does is create a federal national-security justification that may, in subsequent litigation, be used to override state environmental, reliability, or rate-recovery decisions on the supporting infrastructure. That fight has not happened yet. The first major lawsuit pitting a state moratorium against a federal CDF designation will be a significant moment in the architecture’s working life.
The Michigan Attorney General has already mounted a parallel challenge under a different authority. Four DOE emergency orders under Federal Power Act section 202(c), a separate provision from the section 215A regime, have kept Consumers Energy’s J.H. Campbell coal plant operating past its planned May 2025 retirement, with the most recent order extending operations to May 18, 2026. Consumers Energy has reported at least $135 million in costs associated with the post-retirement extension, costs allocated to MISO ratepayers across an 11-state region. Campbell is not the same statute. It is the rehearsal.
The Question
The 2015 statute is real, and Congress wrote the language broadly. The story is that the language was written to harden the electric supply to a small set of nuclear and military facilities, and it is now being applied to a class of privately owned, foreign-vendor-dependent, rapidly proliferating hyperscale campuses. The mechanism designed to protect classified sites is being repurposed to cover an industrial buildout that may not be hardenable on the same logic.
The hardest question is not whether the architecture is in place. It is. The hardest question is what happens the first time it is tested, and whether the people the law was written to protect are the ones it ends up protecting.