Request for Comments on Bolstering Data Center Growth, Resilience, and Security, 71890-71893 [2024-19524]

Download as PDF 71890 Federal Register / Vol. 89, No. 171 / Wednesday, September 4, 2024 / Notices DEPARTMENT OF COMMERCE National Telecommunications and Information Administration [Docket No. 240823–0225] RIN 0660–XC062 Request for Comments on Bolstering Data Center Growth, Resilience, and Security National Telecommunications and Information Administration, Department of Commerce. ACTION: Notice, request for comment. AGENCY: The National Telecommunications and Information Administration (NTIA) hereby requests comments on the challenges surrounding data center growth, resilience and security in the United States amidst a surge of computing power demand due to the development of critical and emerging technologies. This request focuses on identifying opportunities for the U.S. government to improve data centers’ market development, supply chain resilience, and data security. NTIA will rely on these comments, along with other public engagements on this topic, to draft and issue a public report capturing economic and security policy considerations and policy recommendations for fostering safe, secure, and sustainable data center growth. DATES: Written comments must be received on or before November 4, 2024. ADDRESSES: All electronic public comments on this action, identified by Regulations.gov docket number NTIA– 2024–0002, may be submitted through the Federal e-Rulemaking Portal at www.regulations.gov. The docket established for this request for comment can be found at www.regulations.gov, NTIA–2024–0002. Click the ‘‘Comment Now!’’ icon, complete the required fields, and enter or attach your comments. Additional instructions can be found in the ‘‘Instructions’’ section below after SUPPLEMENTARY INFORMATION. All comments received are a part of the public record and will generally be posted to Regulations.gov without change. All personal identifying information (e.g., name, address) voluntarily submitted by the commenter may be publicly accessible. If you would like to submit business confidential information, please clearly identify any business confidential portion of a comment at the time of submission, file a statement justifying nondisclosure and referring to the ddrumheller on DSK120RN23PROD with NOTICES1 SUMMARY: VerDate Sep<11>2014 21:26 Sep 03, 2024 Jkt 262001 specific legal authority claimed, and provide a non-confidential version of the submission. For comments submitted electronically containing business confidential information, the file name of the business confidential version should begin with the characters ‘‘BC.’’ Any page containing business confidential information must be clearly marked ‘‘BUSINESS CONFIDENTIAL’’ on the top of that page. The corresponding non-confidential version of those comments must be clearly marked ‘‘PUBLIC.’’ The file name of the non-confidential version should begin with the character ‘‘P.’’ Any submissions with file names that do not begin with either a ‘‘BC’’ or a ‘‘P’’ will be assumed to be public and will be made publicly available through https:// www.regulations.gov. FOR FURTHER INFORMATION CONTACT: Please direct questions regarding this Request for Comment to Travis Hall at thall@ntia.gov with ‘‘Bolstering Data Center Resilience and Security Request for Comment’’ in the subject line, or if by mail, addressed to Travis Hall, National Telecommunications and Information Administration, U.S. Department of Commerce, 1401 Constitution Avenue NW, Room 4725, Washington, DC 20230; telephone: (202) 482–3522. Please direct media inquiries to NTIA’s Office of Public Affairs, telephone: (202) 482–7002; email: press@ntia.gov. SUPPLEMENTARY INFORMATION: Background and Authority Critical and emerging technologies like artificial intelligence (AI) have accelerated demands for more computing infrastructure. Powering these transformative technologies are data centers—facilities that house computing machines and related hardware components that process, store, and transmit large amounts of data—and the telecommunication infrastructure enabling information processing.1 Data centers are important enablers for economic growth and technological development. Their capabilities for data processing, ubiquitous connectivity, secure storage, cost-efficiency, and economy-wide job creation, among others, yield substantial benefits. There are approximately 5,000 data centers in the United States, and data center demand is projected to grow domestically by roughly nine percent year over year through 2030.2 3 Driven 1 42 U.S.C. 17112(b). ‘‘Data Centers in the United States’’ (March 2024) https://cloudscene.com/market/data2 Cloudscene, PO 00000 Frm 00013 Fmt 4703 Sfmt 4703 primarily by hyperscalers,4 the total capacity of all data centers, including on-premise and colocation, is expected to rise steadily.5 The expected growth in computing demand, and resulting demand for data centers, present challenges and opportunities for data center operators in balancing market growth, supply chain resilience, and data security. For example, energy supply, restrictive permitting, skilled workforce shortages, and land unavailability may present localized growth challenges in certain domestic markets.6 However, the increase in compute demand may also present opportunities to collaborate on public and private sector measures (e.g., infrastructure investments, workforce development programs) to catalyze data center growth, enable innovation, and foster economic development and global market leadership. The continued growth of the U.S. data center industry hinges on resilient supply chains, access to power, trusted Information and Communications Technology and Services (ICTS) equipment, and a skilled workforce, among other factors. Powering and cooling data centers is energy-intensive: data centers physically located in the United States consumed more than four percent of the country’s total electricity in 2022, with projections suggesting the share may increase up to nine 7 percent by 2030.8 The increase in demand is centers-in-united-states/all?trk=public_post_ comment-text. 3 McKinsey, ‘‘Investing in the rising data center economy’’ (January 2023). Demand is measured by power consumption to reflect the number of servers a data center can house. Demand includes megawatts for storage, servers, and networks. https://www.mckinsey.com/industries/technologymedia-and-telecommunications/our-insights/ investing-in-the-rising-data-center-economy. 4 The term ‘‘hyperscale’’ data centers refer to data centers facilities comprising of 10,000 square foot/ 5,000-server facilities to colossal campuses with individual buildings over one million square feet, each containing hundreds of thousands of servers. See In-Q-Tel, ‘‘Workshop on Cloud, Data Centers, and Great Power Competition,’’ (November 2023). https://assets.iqt.org/pdfs/Workshop-Report_DataCenters_Nov-2023.pdf/web/viewer.html. 5 Synergy Research Group, ‘‘On Premise Data Center Capacity Being Increasingly Dwarfed by Hyperscalers and Colocation Companies,’’ (July 2023). https://www.srgresearch.com/articles/onpremise-data-center-capacity-being-increasinglydwarfed-by-hyperscalers-and-colocationcompanies. 6 Global Data Center Trends 2023. (2023, July 14). https://www.cbre.com/insights/reports/global-datacenter-trends-2023; CBRE. https://www.cbre.com/ insights/reports/global-data-center-trends-2023. 7 SemiAnalysis, ‘‘AI Datacenter Energy Dilemma—Race for AI Datacenter Space,’’ (March 2024). https://www.semianalysis.com/p/aidatacenter-energy-dilemma-race. 8 Aljbour, Jordan, Tom Wilson, and Poorvi Patel. ‘‘Powering Intelligence: Analyzing Artificial Intelligence and Data Center Energy Consumption.’’ E:\FR\FM\04SEN1.SGM 04SEN1 Federal Register / Vol. 89, No. 171 / Wednesday, September 4, 2024 / Notices ddrumheller on DSK120RN23PROD with NOTICES1 incentivizing data center developers and utilities to maximize utilization of existing power grid infrastructure and water usage, with some data center operators pursuing alternatives to the grid, such as on-site energy generation and power grid infrastructure.9 Outfitting new and existing data centers also requires a range of critical information technology (IT) and operational technology (OT) components—semiconductors, chips, fiber optic cables, networking equipment, and more.10 Lack of access to trusted equipment and skilled workforce shortages could limit both cyber and physical security functions necessary to protecting critical infrastructure operations.11 As the adoption of critical and emerging technologies like AI grows, with data centers playing a pivotal role in training and deploying AI models, there may be an amplified need to fortify security measures within these facilities. Heightened safeguards and robust security protocols may be necessary to protect the large volumes of data being processed and analyzed in support of cutting-edge applications.12 Understanding current data security practices and gaps will be necessary in continuing to promote and maintain an open, inclusive, secure, and resilient digital ecosystem. As part of the Department of Commerce’s mission to create the conditions for economic growth and opportunity, and in line with its statutory role as the President’s principal advisor on telecommunication and information policy, the National Telecommunications and Information Administration (NTIA) seeks input on the potential risks, benefits, and White Paper. EPRI, May 2024. https:// restservice.epri.com/publicdownload/00000000 3002028905/0/Product. 9 Mondal, S., Fashat, B. F., Rajbongshi, D., Mohammad Masum, K. E., & Islam, M. M. (2023). GEECO: Green data centers for energy optimization and carbon footprint reduction. Sustainability, 15(21), 15249. doi: https://doi.org/10.3390/ su152115249. 10 U.S. Department of Commerce and Department of Homeland Security, ‘‘Assessment of the Critical Supply Chains Supporting the U.S. Information and Communications Technology Industry,’’ (February 2022). https://www.dhs.gov/sites/default/files/202202/ICT%20Supply%20Chain%20Report_0.pdf. 11 U.S. Department of Homeland Security, ‘‘Advisory Memorandum on Ensuring Essential Critical Infrastructure Workers’ Ability to Work During the Covid-19 Response,’’ (August 2021). https://www.cisa.gov/sites/default/files/ publications/essential_critical_infrastructure_ workforce-guidance_v4.1_508.pdf. 12 See Tim Fist, Michael Depp, and Caleb Withers ‘‘Response to OSTP ‘‘National Priorities for Artificial Intelligence Request for Information.’’ Center for New American Security (July 20, 2023). https://www.cnas.org/publications/commentary/ ostp-national-priorities-for-artificial-intelligence. VerDate Sep<11>2014 21:26 Sep 03, 2024 Jkt 262001 implications of the anticipated growth in the data center sector, and the appropriate policy and regulatory approaches to foster sustainable, resilient and secure data center growth. The responses to this request will help inform a report that will address the hurdles and opportunities for this vital industry sector and will provide policy recommendations for actions the federal government can take to help foster the sector’s growth in a manner that is safe, sustainable, secure, and in service of the American people. NTIA is issuing the Request for Comment in coordination with the Department of Energy (DOE), given DOE’s mission to ensure American’s security and prosperity through addressing energy challenges with science and technology solutions. Given the significant energy needs of data centers, DOE has a strong interest in understanding and supporting growth in the data center sector (See https:// www.energy.gov/policy/articles/cleanenergy-resources-meet-data-centerelectricity-demand). DOE may use the responses from the request to inform the development of strategies, programs, and other actions to support deployment of technologies and solutions to address data center energy needs. Instructions for Commenters Through this Request for Comment, we hope to gather information on the following questions. These are not exhaustive, and commenters are invited to provide input on relevant questions not asked below. Commenters are not required to respond to all questions. When responding to one or more of the questions below, please note in the text of your response the number of the question to which you are responding. Commenters should include a page number on each page of their submissions. Commenters are welcome to provide specific actionable proposals, rationales, and relevant facts. Questions 1. What current and future challenges and opportunities do commercially owned or operated data centers in the United States face in supplying computing power required by critical and emerging technologies, such as AI? 2. What are critical market considerations for the data center industry seeking to modernize or expand their footprint? a. Please describe key considerations such as: access to key markets, customer demand, access to renewable energy, data residency requirements, available high-speed broadband PO 00000 Frm 00014 Fmt 4703 Sfmt 4703 71891 telecommunications infrastructure, access to workforce, government incentives, land or water availability, power grid connectivity, low power costs, or any other key considerations. b. What role does competition between hyperscalers play in the modernization or expansion of the data center industry? Are there barriers for new hyperscalers entering the marketplace? Can those barriers be reduced to promote competition? What are the barriers for customers to switching data centers service providers? c. What key regulatory barriers exist at the federal, state, local, tribal, and territorial level? d. What existing private or public programs, initiatives, or incentives effectively drive data center modernization or investment within the United States? e. What role or actions, if any, should be taken by the private sector, civil society or the U.S. government to mitigate potential barriers to, or foster opportunities for, data center market entry, growth and modernization? f. What are the causes of foreign, exogenous forces, if any, pulling data center market opportunity away from the United States? g. How might data centers’ modernization or investment affect other markets and industries? h. What role or actions, if any, should be taken by the private sector, civil society or the U.S. government to address any inefficiencies due to market externalities or market failures? 3. As demand for computing power and data processing increases, what are the potential societal impacts (e.g., communities, environment, customers)—both positive and negative—of data center modernization or investment? a. How might rising demand for data centers affect operational costs (i.e., through increases in land, energy, water, and equipment costs)? Is an imbalance between demand and supply expected? How might changes to operational costs disproportionately affect small and medium-sized businesses compared to larger enterprises? b. How might growth in the U.S. data center industry result in increases in energy demand? How might it impact the environment? How can data centerrelated greenhouse gas emissions be managed to address concerns related to climate change? c. How might data centers’ modernization or investment affect disadvantaged communities or groups, including rural communities, in their sites of operation? E:\FR\FM\04SEN1.SGM 04SEN1 ddrumheller on DSK120RN23PROD with NOTICES1 71892 Federal Register / Vol. 89, No. 171 / Wednesday, September 4, 2024 / Notices d. What role or actions, if any, should be taken by the private sector, civil society or the U.S. government to address any outcomes stemming from data center modernization or investment in disadvantaged communities or small and medium-sized businesses? 4. What are the supply chain risks, vulnerabilities, and threats to data center modernization, investment, growth or continuity? a. What supply chain interdependencies are critical to ensuring availability of the critical IT/ OT components within data centers? What IT/OT equipment supply chain shortages, if any, might hinder the development of data centers in the United States? b. Are data centers experiencing shortages of fiber optic cable, chips, or any other equipment that may hinder data center development in the United States? c. How are data centers approaching and planning for the transition to modern data center models and architectures (e.g., edge computing, AIenabled, software-defined infrastructure, or digital coherent optics)? d. How prevalent is the use of opensource software in critical IT/OT systems in data centers in the United States? What steps or processes are undertaken by data center operators to ensure the quality and security of the open-source software? e. Who are the major suppliers (both foreign and domestic) of data center hardware, software, and services? What can the U.S. government do to bolster smaller suppliers? f. Do any suppliers based outside of the United States or with relevant manufacturing operations occurring outside of the United States play systemic roles in providing components utilized in U.S. data centers? 5. What requirements, standards, and supply chain risk management best practices do data centers operators or customers have in place? a. How do data centers operators or customers ensure that untrusted or counterfeit IT/OT components do not make their way into U.S. data center facilities? b. What auditing processes for IT/OT equipment are used by data center operators or customers (i.e., software bill of materials)? Are there barriers to performing IT/OT equipment audits? c. How do data center operators or customers vet IT/OT equipment suppliers, providers or vendors? d. What controls do data centers operators or customers have in place to VerDate Sep<11>2014 21:26 Sep 03, 2024 Jkt 262001 monitor vulnerabilities in legacy equipment? e. How do data centers perform contingency planning to ensure supply chain resiliency in the face of disruption? How do data center operators select diverse geographical areas of operation to ensure business continuity? How do data centers integrate alternative power sources in case of disruption, including backup generators that can power the data center up to 30 days? 6. Are there workforce challenges inhibiting growth in the data center industry? Is the data center industry experiencing a shortage of network engineers, cybersecurity professionals, construction workers, or any other types of professionals? a. What opportunities exist for partnering or collaborating with the U.S. government, including federally funded research and development centers (FFRDC) and University Affiliated Research Centers (UARCs), to help address data center challenges to accessing skilled workforce? 7. What challenges do data centers face in accessing power for their facilities? What novel solutions are data center operators exploring or implementing to ensure access to power? a. Can data centers get sufficiently reliable power from utilities? How do data centers decide whether to install backup power, and how do they design and size backup power sources? b. What initiatives are data centers exploring as alternatives to grid connected power and traditional cooling solutions in their facilities? Are data centers facing obstacles in these efforts? c. What initiatives are data centers exploring (e.g., net zero efforts) to mitigate greenhouse gas emissions from energy use? Are data centers facing obstacles in these efforts? d. What are the most effective innovations in data center cooling/ reduction in power usage effectiveness (e.g., networking innovations, silicon photonics)? e. Can data center backup power generation be used to participate in utility demand response programs? f. Are there opportunities for new tariff structures to help connect large loads to the grid while mitigating the risk of cost shifts to other electricity customers? 8. What voluntary guidelines, domestic regulations, or frameworks are currently in place or should be implemented to help manage data security risks in data centers while also maximizing the benefits of secure data processing and storage? PO 00000 Frm 00015 Fmt 4703 Sfmt 4703 a. What security controls do data center operators have in place to protect customer data? What governance mechanisms do data centers use to oversee compliance? How could data center operators or customers improve security controls? b. What are the key obstacles for data center operators to improve security? Are factors like competitive pressure, lack of demand, lack of cybersecurity professionals, or lack of security frameworks or regulations obstacles to improving security? c. Data center operators and cloud service providers often rely on a shared responsibility model to outline security responsibilities between the customer and the data center or cloud service provider.13 How could data center operators, cloud service providers or customers improve the shared responsibility model? d. How do data center operators address cyber incidents and breaches? Are there any cybersecurity incident reporting measures that would help increase data center security? What governmental support would help operators and developers achieve greater security? e. What tools are data center operators using or experimenting with to ensure next generation data security practices are scalable? f. What kind of entities should take a leadership role in sharing information about data security risks to data centers and solutions to addressing them? Should the type of entity vary by sector, and, if so, how? 9. What are the security considerations for data centers running or training frontier AI models 14 or integrating AI capabilities within existing infrastructure? a. Have data centers implemented any novel physical or cybersecurity measures in data centers’ running or training frontier AI models that they have not implemented for other data center applications? b. What cybersecurity requirements, technical controls, or risk assessments should be implemented to ensure adequate data security practices in data centers that run and train frontier AI models? Should these requirements 13 See NIST Special Publication 500–292 ‘‘NIST Cloud Computing Reference Architecture,’’ (2011) https://nvlpubs.nist.gov/nistpubs/Legacy/SP/ nistspecialpublication500-292.pdf. 14 The term ‘‘frontier AI models’’ refers to models that are overall more powerful than any currently released models (e.g., GPT–4, Claude 2, PaLM 2, Titan and, in the case of image generation, DALL– E 2). See White House, ‘‘Ensuring Safe Secure and Trustworthy AI,’’ (July 2023). https:// www.whitehouse.gov/wp-content/uploads/2023/07/ Ensuring-Safe-Secure-and-Trustworthy-AI.pdf. E:\FR\FM\04SEN1.SGM 04SEN1 Federal Register / Vol. 89, No. 171 / Wednesday, September 4, 2024 / Notices scale for less powerful versus more powerful AI models, and if so, how? c. How economically feasible is it for data center operators to maintain physical separation between infrastructure used for frontier AI training or for inference and other applications? What effects, if any, would this achieve beyond logical separation? d. Are there any economic or technical reasons not to keep highly sensitive data, or frontier AI model weights, encrypted at rest, in use and in transit? Are there economical or technological barriers that would hinder the deployment of other data security measures that would protect highly sensitive data, such as frontier AI model weights? e. What data security measures are data centers implementing as they integrate AI applications and capabilities within their existing infrastructure (e.g., power management, energy efficiency)? 10. What training tools and exercises do data centers use to train personnel and validate the efficacy of their data security posture? a. What forms of on-the-job data security training do data centers provide to their staff? b. How do data centers evaluate their employees’ data security competencies? Describe any industry certifications that data center operators prioritize to indicate competence in data security. c. Describe how data centers work with third parties in red-teaming efforts to simulate outside attacks. How often do data centers provide third parties’ access? What level of access do data centers provide to third parties? 11. What role or actions, if any, should be taken by the Department of Commerce and, more generally, the federal government, to address the challenges to and opportunities for fostering the development of data centers? ddrumheller on DSK120RN23PROD with NOTICES1 Stephanie Weiner, Chief Counsel, National Telecommunications and Information Administration. [FR Doc. 2024–19524 Filed 9–3–24; 8:45 am] BILLING CODE 3510–60–P VerDate Sep<11>2014 21:26 Sep 03, 2024 Jkt 262001 CORPORATION FOR NATIONAL AND COMMUNITY SERVICE Agency Information Collection Activities; Submission to the Office of Management and Budget for Review and Approval; Comment Request; Applicant Operational and Financial Survey Corporation for National and Community Service. ACTION: Notice of information collection; request for comment. AGENCY: The Corporation for National and Community Service, operating as AmeriCorps, has submitted a public information collection request (ICR) entitled Applicant Operational and Financial Survey for review and approval in accordance with the Paperwork Reduction Act. DATES: Written comments must be submitted to the individual and office listed in the ADDRESSES section by October 4, 2024. ADDRESSES: Written comments and recommendations for the proposed information collection should be sent within 30 days of publication of this notice to www.reginfo.gov/public/do/ PRAMain. Find this particular information collection by selecting ‘‘Currently under 30-day Review—Open for Public Comments’’ or by using the search function. FOR FURTHER INFORMATION CONTACT: Copies of this ICR, with applicable supporting documentation, may be obtained by calling AmeriCorps, Alex Delaney, at 202–528–2705, or by email at ADelaney@americorps.gov. SUPPLEMENTARY INFORMATION: The OMB is particularly interested in comments which: • Evaluate whether the proposed collection of information is necessary for the proper performance of the functions of CNCS, including whether the information will have practical utility; • Evaluate the accuracy of the agency’s estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions; • Propose ways to enhance the quality, utility, and clarity of the information to be collected; and • Propose ways to minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology. SUMMARY: PO 00000 Frm 00016 Fmt 4703 Sfmt 4703 71893 Comments A 60-day Notice requesting public comment was published in the Federal Register on May 9, 2024 at 89 FR 39604. The comment period ended July 8, 2024. No public comments were received from that notice. Title of Collection: Applicant Operational and Financial Survey. OMB Control Number: 3045–0102. Type of Review: Renewal. Respondents/Affected Public: Businesses and Organizations. Total Estimated Number of Annual Responses: 1,500. Total Estimated Number of Annual Burden Hours: 3,000. Abstract: This information collection consists of the questions applicants answer related to operational and financial management when applying for grant funding for a new project or performance period. It is not required for grant continuation or renewal applicants. Applicants respond to the questions included in these instructions when applying for funding in certain grant competitions. AmeriCorps will use the information collection to support pre-award risk assessment of applicants for grant funding. AmeriCorps also seeks to continue using the currently approved information collection until the revised information collection is approved by OMB. The currently approved information collection is due to expire on September 30, 2024. Caroline Fernandez, Acting Director, Office of Monitoring. [FR Doc. 2024–19841 Filed 9–3–24; 8:45 am] BILLING CODE 6050–28–P DEPARTMENT OF EDUCATION Free Application for Federal Student Aid (FAFSA®) Information To Be Verified for the 2025–2026 Award Year Office of Postsecondary Education, Department of Education. ACTION: Notice. AGENCY: For each award year, the Secretary publishes in the Federal Register a notice announcing the FAFSA information that an institution and an applicant may be required to verify, as well as the acceptable documentation for verifying FAFSA information. This is the notice for the 2025–2026 award year, Assistance Listing Numbers 84.007, 84.033, 84.063, and 84.268. FOR FURTHER INFORMATION CONTACT: Vanessa Gomez. Telephone: (202) 453– 6708. Email: Vanessa.Gomez@ed.gov. SUMMARY: E:\FR\FM\04SEN1.SGM 04SEN1

Agencies

[Federal Register Volume 89, Number 171 (Wednesday, September 4, 2024)]
[Notices]
[Pages 71890-71893]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-19524]



[[Page 71890]]

-----------------------------------------------------------------------

DEPARTMENT OF COMMERCE

National Telecommunications and Information Administration

[Docket No. 240823-0225]
RIN 0660-XC062


Request for Comments on Bolstering Data Center Growth, 
Resilience, and Security

AGENCY: National Telecommunications and Information Administration, 
Department of Commerce.

ACTION: Notice, request for comment.

-----------------------------------------------------------------------

SUMMARY: The National Telecommunications and Information Administration 
(NTIA) hereby requests comments on the challenges surrounding data 
center growth, resilience and security in the United States amidst a 
surge of computing power demand due to the development of critical and 
emerging technologies. This request focuses on identifying 
opportunities for the U.S. government to improve data centers' market 
development, supply chain resilience, and data security. NTIA will rely 
on these comments, along with other public engagements on this topic, 
to draft and issue a public report capturing economic and security 
policy considerations and policy recommendations for fostering safe, 
secure, and sustainable data center growth.

DATES: Written comments must be received on or before November 4, 2024.

ADDRESSES: All electronic public comments on this action, identified by 
Regulations.gov docket number NTIA-2024-0002, may be submitted through 
the Federal e-Rulemaking Portal at www.regulations.gov. The docket 
established for this request for comment can be found at 
www.regulations.gov, NTIA-2024-0002. Click the ``Comment Now!'' icon, 
complete the required fields, and enter or attach your comments. 
Additional instructions can be found in the ``Instructions'' section 
below after SUPPLEMENTARY INFORMATION.
    All comments received are a part of the public record and will 
generally be posted to Regulations.gov without change. All personal 
identifying information (e.g., name, address) voluntarily submitted by 
the commenter may be publicly accessible.
    If you would like to submit business confidential information, 
please clearly identify any business confidential portion of a comment 
at the time of submission, file a statement justifying nondisclosure 
and referring to the specific legal authority claimed, and provide a 
non-confidential version of the submission.
    For comments submitted electronically containing business 
confidential information, the file name of the business confidential 
version should begin with the characters ``BC.'' Any page containing 
business confidential information must be clearly marked ``BUSINESS 
CONFIDENTIAL'' on the top of that page. The corresponding non-
confidential version of those comments must be clearly marked 
``PUBLIC.'' The file name of the non-confidential version should begin 
with the character ``P.'' Any submissions with file names that do not 
begin with either a ``BC'' or a ``P'' will be assumed to be public and 
will be made publicly available through https://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: Please direct questions regarding this 
Request for Comment to Travis Hall at [email protected] with ``Bolstering 
Data Center Resilience and Security Request for Comment'' in the 
subject line, or if by mail, addressed to Travis Hall, National 
Telecommunications and Information Administration, U.S. Department of 
Commerce, 1401 Constitution Avenue NW, Room 4725, Washington, DC 20230; 
telephone: (202) 482-3522. Please direct media inquiries to NTIA's 
Office of Public Affairs, telephone: (202) 482-7002; email: 
[email protected].

SUPPLEMENTARY INFORMATION:

Background and Authority

    Critical and emerging technologies like artificial intelligence 
(AI) have accelerated demands for more computing infrastructure. 
Powering these transformative technologies are data centers--facilities 
that house computing machines and related hardware components that 
process, store, and transmit large amounts of data--and the 
telecommunication infrastructure enabling information processing.\1\
---------------------------------------------------------------------------

    \1\ 42 U.S.C. 17112(b).
---------------------------------------------------------------------------

    Data centers are important enablers for economic growth and 
technological development. Their capabilities for data processing, 
ubiquitous connectivity, secure storage, cost-efficiency, and economy-
wide job creation, among others, yield substantial benefits.
    There are approximately 5,000 data centers in the United States, 
and data center demand is projected to grow domestically by roughly 
nine percent year over year through 2030.2 3 Driven 
primarily by hyperscalers,\4\ the total capacity of all data centers, 
including on-premise and colocation, is expected to rise steadily.\5\ 
The expected growth in computing demand, and resulting demand for data 
centers, present challenges and opportunities for data center operators 
in balancing market growth, supply chain resilience, and data security. 
For example, energy supply, restrictive permitting, skilled workforce 
shortages, and land unavailability may present localized growth 
challenges in certain domestic markets.\6\ However, the increase in 
compute demand may also present opportunities to collaborate on public 
and private sector measures (e.g., infrastructure investments, 
workforce development programs) to catalyze data center growth, enable 
innovation, and foster economic development and global market 
leadership.
---------------------------------------------------------------------------

    \2\ Cloudscene, ``Data Centers in the United States'' (March 
2024) https://cloudscene.com/market/data-centers-in-united-states/all?trk=public_post_comment-text.
    \3\ McKinsey, ``Investing in the rising data center economy'' 
(January 2023). Demand is measured by power consumption to reflect 
the number of servers a data center can house. Demand includes 
megawatts for storage, servers, and networks. https://www.mckinsey.com/industries/technology-media-and-telecommunications/our-insights/investing-in-the-rising-data-center-economy.
    \4\ The term ``hyperscale'' data centers refer to data centers 
facilities comprising of 10,000 square foot/5,000-server facilities 
to colossal campuses with individual buildings over one million 
square feet, each containing hundreds of thousands of servers. See 
In-Q-Tel, ``Workshop on Cloud, Data Centers, and Great Power 
Competition,'' (November 2023). https://assets.iqt.org/pdfs/Workshop-Report_Data-Centers_Nov-2023.pdf/web/viewer.html.
    \5\ Synergy Research Group, ``On Premise Data Center Capacity 
Being Increasingly Dwarfed by Hyperscalers and Colocation 
Companies,'' (July 2023). https://www.srgresearch.com/articles/on-premise-data-center-capacity-being-increasingly-dwarfed-by-hyperscalers-and-colocation-companies.
    \6\ Global Data Center Trends 2023. (2023, July 14). https://www.cbre.com/insights/reports/global-data-center-trends-2023; CBRE. 
https://www.cbre.com/insights/reports/global-data-center-trends-2023.
---------------------------------------------------------------------------

    The continued growth of the U.S. data center industry hinges on 
resilient supply chains, access to power, trusted Information and 
Communications Technology and Services (ICTS) equipment, and a skilled 
workforce, among other factors. Powering and cooling data centers is 
energy-intensive: data centers physically located in the United States 
consumed more than four percent of the country's total electricity in 
2022, with projections suggesting the share may increase up to nine \7\ 
percent by 2030.\8\ The increase in demand is

[[Page 71891]]

incentivizing data center developers and utilities to maximize 
utilization of existing power grid infrastructure and water usage, with 
some data center operators pursuing alternatives to the grid, such as 
on-site energy generation and power grid infrastructure.\9\ Outfitting 
new and existing data centers also requires a range of critical 
information technology (IT) and operational technology (OT) 
components--semiconductors, chips, fiber optic cables, networking 
equipment, and more.\10\ Lack of access to trusted equipment and 
skilled workforce shortages could limit both cyber and physical 
security functions necessary to protecting critical infrastructure 
operations.\11\
---------------------------------------------------------------------------

    \7\ SemiAnalysis, ``AI Datacenter Energy Dilemma--Race for AI 
Datacenter Space,'' (March 2024). https://www.semianalysis.com/p/ai-datacenter-energy-dilemma-race.
    \8\ Aljbour, Jordan, Tom Wilson, and Poorvi Patel. ``Powering 
Intelligence: Analyzing Artificial Intelligence and Data Center 
Energy Consumption.'' White Paper. EPRI, May 2024. https://restservice.epri.com/publicdownload/000000003002028905/0/Product.
    \9\ Mondal, S., Fashat, B. F., Rajbongshi, D., Mohammad Masum, 
K. E., & Islam, M. M. (2023). GEECO: Green data centers for energy 
optimization and carbon footprint reduction. Sustainability, 15(21), 
15249. doi: https://doi.org/10.3390/su152115249.
    \10\ U.S. Department of Commerce and Department of Homeland 
Security, ``Assessment of the Critical Supply Chains Supporting the 
U.S. Information and Communications Technology Industry,'' (February 
2022). https://www.dhs.gov/sites/default/files/2022-02/ICT%20Supply%20Chain%20Report_0.pdf.
    \11\ U.S. Department of Homeland Security, ``Advisory Memorandum 
on Ensuring Essential Critical Infrastructure Workers' Ability to 
Work During the Covid-19 Response,'' (August 2021). https://www.cisa.gov/sites/default/files/publications/essential_critical_infrastructure_workforce-guidance_v4.1_508.pdf.
---------------------------------------------------------------------------

    As the adoption of critical and emerging technologies like AI 
grows, with data centers playing a pivotal role in training and 
deploying AI models, there may be an amplified need to fortify security 
measures within these facilities. Heightened safeguards and robust 
security protocols may be necessary to protect the large volumes of 
data being processed and analyzed in support of cutting-edge 
applications.\12\ Understanding current data security practices and 
gaps will be necessary in continuing to promote and maintain an open, 
inclusive, secure, and resilient digital ecosystem.
---------------------------------------------------------------------------

    \12\ See Tim Fist, Michael Depp, and Caleb Withers ``Response to 
OSTP ``National Priorities for Artificial Intelligence Request for 
Information.'' Center for New American Security (July 20, 2023). 
https://www.cnas.org/publications/commentary/ostp-national-priorities-for-artificial-intelligence.
---------------------------------------------------------------------------

    As part of the Department of Commerce's mission to create the 
conditions for economic growth and opportunity, and in line with its 
statutory role as the President's principal advisor on 
telecommunication and information policy, the National 
Telecommunications and Information Administration (NTIA) seeks input on 
the potential risks, benefits, and implications of the anticipated 
growth in the data center sector, and the appropriate policy and 
regulatory approaches to foster sustainable, resilient and secure data 
center growth. The responses to this request will help inform a report 
that will address the hurdles and opportunities for this vital industry 
sector and will provide policy recommendations for actions the federal 
government can take to help foster the sector's growth in a manner that 
is safe, sustainable, secure, and in service of the American people.
    NTIA is issuing the Request for Comment in coordination with the 
Department of Energy (DOE), given DOE's mission to ensure American's 
security and prosperity through addressing energy challenges with 
science and technology solutions. Given the significant energy needs of 
data centers, DOE has a strong interest in understanding and supporting 
growth in the data center sector (See https://www.energy.gov/policy/articles/clean-energy-resources-meet-data-center-electricity-demand). 
DOE may use the responses from the request to inform the development of 
strategies, programs, and other actions to support deployment of 
technologies and solutions to address data center energy needs.

Instructions for Commenters

    Through this Request for Comment, we hope to gather information on 
the following questions. These are not exhaustive, and commenters are 
invited to provide input on relevant questions not asked below. 
Commenters are not required to respond to all questions. When 
responding to one or more of the questions below, please note in the 
text of your response the number of the question to which you are 
responding. Commenters should include a page number on each page of 
their submissions. Commenters are welcome to provide specific 
actionable proposals, rationales, and relevant facts.

Questions

    1. What current and future challenges and opportunities do 
commercially owned or operated data centers in the United States face 
in supplying computing power required by critical and emerging 
technologies, such as AI?
    2. What are critical market considerations for the data center 
industry seeking to modernize or expand their footprint?
    a. Please describe key considerations such as: access to key 
markets, customer demand, access to renewable energy, data residency 
requirements, available high-speed broadband telecommunications 
infrastructure, access to workforce, government incentives, land or 
water availability, power grid connectivity, low power costs, or any 
other key considerations.
    b. What role does competition between hyperscalers play in the 
modernization or expansion of the data center industry? Are there 
barriers for new hyperscalers entering the marketplace? Can those 
barriers be reduced to promote competition? What are the barriers for 
customers to switching data centers service providers?
    c. What key regulatory barriers exist at the federal, state, local, 
tribal, and territorial level?
    d. What existing private or public programs, initiatives, or 
incentives effectively drive data center modernization or investment 
within the United States?
    e. What role or actions, if any, should be taken by the private 
sector, civil society or the U.S. government to mitigate potential 
barriers to, or foster opportunities for, data center market entry, 
growth and modernization?
    f. What are the causes of foreign, exogenous forces, if any, 
pulling data center market opportunity away from the United States?
    g. How might data centers' modernization or investment affect other 
markets and industries?
    h. What role or actions, if any, should be taken by the private 
sector, civil society or the U.S. government to address any 
inefficiencies due to market externalities or market failures?
    3. As demand for computing power and data processing increases, 
what are the potential societal impacts (e.g., communities, 
environment, customers)--both positive and negative--of data center 
modernization or investment?
    a. How might rising demand for data centers affect operational 
costs (i.e., through increases in land, energy, water, and equipment 
costs)? Is an imbalance between demand and supply expected? How might 
changes to operational costs disproportionately affect small and 
medium-sized businesses compared to larger enterprises?
    b. How might growth in the U.S. data center industry result in 
increases in energy demand? How might it impact the environment? How 
can data center-related greenhouse gas emissions be managed to address 
concerns related to climate change?
    c. How might data centers' modernization or investment affect 
disadvantaged communities or groups, including rural communities, in 
their sites of operation?

[[Page 71892]]

    d. What role or actions, if any, should be taken by the private 
sector, civil society or the U.S. government to address any outcomes 
stemming from data center modernization or investment in disadvantaged 
communities or small and medium-sized businesses?
    4. What are the supply chain risks, vulnerabilities, and threats to 
data center modernization, investment, growth or continuity?
    a. What supply chain interdependencies are critical to ensuring 
availability of the critical IT/OT components within data centers? What 
IT/OT equipment supply chain shortages, if any, might hinder the 
development of data centers in the United States?
    b. Are data centers experiencing shortages of fiber optic cable, 
chips, or any other equipment that may hinder data center development 
in the United States?
    c. How are data centers approaching and planning for the transition 
to modern data center models and architectures (e.g., edge computing, 
AI-enabled, software-defined infrastructure, or digital coherent 
optics)?
    d. How prevalent is the use of open-source software in critical IT/
OT systems in data centers in the United States? What steps or 
processes are undertaken by data center operators to ensure the quality 
and security of the open-source software?
    e. Who are the major suppliers (both foreign and domestic) of data 
center hardware, software, and services? What can the U.S. government 
do to bolster smaller suppliers?
    f. Do any suppliers based outside of the United States or with 
relevant manufacturing operations occurring outside of the United 
States play systemic roles in providing components utilized in U.S. 
data centers?
    5. What requirements, standards, and supply chain risk management 
best practices do data centers operators or customers have in place?
    a. How do data centers operators or customers ensure that untrusted 
or counterfeit IT/OT components do not make their way into U.S. data 
center facilities?
    b. What auditing processes for IT/OT equipment are used by data 
center operators or customers (i.e., software bill of materials)? Are 
there barriers to performing IT/OT equipment audits?
    c. How do data center operators or customers vet IT/OT equipment 
suppliers, providers or vendors?
    d. What controls do data centers operators or customers have in 
place to monitor vulnerabilities in legacy equipment?
    e. How do data centers perform contingency planning to ensure 
supply chain resiliency in the face of disruption? How do data center 
operators select diverse geographical areas of operation to ensure 
business continuity? How do data centers integrate alternative power 
sources in case of disruption, including backup generators that can 
power the data center up to 30 days?
    6. Are there workforce challenges inhibiting growth in the data 
center industry? Is the data center industry experiencing a shortage of 
network engineers, cybersecurity professionals, construction workers, 
or any other types of professionals?
    a. What opportunities exist for partnering or collaborating with 
the U.S. government, including federally funded research and 
development centers (FFRDC) and University Affiliated Research Centers 
(UARCs), to help address data center challenges to accessing skilled 
workforce?
    7. What challenges do data centers face in accessing power for 
their facilities? What novel solutions are data center operators 
exploring or implementing to ensure access to power?
    a. Can data centers get sufficiently reliable power from utilities? 
How do data centers decide whether to install backup power, and how do 
they design and size backup power sources?
    b. What initiatives are data centers exploring as alternatives to 
grid connected power and traditional cooling solutions in their 
facilities? Are data centers facing obstacles in these efforts?
    c. What initiatives are data centers exploring (e.g., net zero 
efforts) to mitigate greenhouse gas emissions from energy use? Are data 
centers facing obstacles in these efforts?
    d. What are the most effective innovations in data center cooling/
reduction in power usage effectiveness (e.g., networking innovations, 
silicon photonics)?
    e. Can data center backup power generation be used to participate 
in utility demand response programs?
    f. Are there opportunities for new tariff structures to help 
connect large loads to the grid while mitigating the risk of cost 
shifts to other electricity customers?
    8. What voluntary guidelines, domestic regulations, or frameworks 
are currently in place or should be implemented to help manage data 
security risks in data centers while also maximizing the benefits of 
secure data processing and storage?
    a. What security controls do data center operators have in place to 
protect customer data? What governance mechanisms do data centers use 
to oversee compliance? How could data center operators or customers 
improve security controls?
    b. What are the key obstacles for data center operators to improve 
security? Are factors like competitive pressure, lack of demand, lack 
of cybersecurity professionals, or lack of security frameworks or 
regulations obstacles to improving security?
    c. Data center operators and cloud service providers often rely on 
a shared responsibility model to outline security responsibilities 
between the customer and the data center or cloud service provider.\13\ 
How could data center operators, cloud service providers or customers 
improve the shared responsibility model?
---------------------------------------------------------------------------

    \13\ See NIST Special Publication 500-292 ``NIST Cloud Computing 
Reference Architecture,'' (2011) https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication500-292.pdf.
---------------------------------------------------------------------------

    d. How do data center operators address cyber incidents and 
breaches? Are there any cybersecurity incident reporting measures that 
would help increase data center security? What governmental support 
would help operators and developers achieve greater security?
    e. What tools are data center operators using or experimenting with 
to ensure next generation data security practices are scalable?
    f. What kind of entities should take a leadership role in sharing 
information about data security risks to data centers and solutions to 
addressing them? Should the type of entity vary by sector, and, if so, 
how?
    9. What are the security considerations for data centers running or 
training frontier AI models \14\ or integrating AI capabilities within 
existing infrastructure?
---------------------------------------------------------------------------

    \14\ The term ``frontier AI models'' refers to models that are 
overall more powerful than any currently released models (e.g., GPT-
4, Claude 2, PaLM 2, Titan and, in the case of image generation, 
DALL-E 2). See White House, ``Ensuring Safe Secure and Trustworthy 
AI,'' (July 2023). https://www.whitehouse.gov/wp-content/uploads/2023/07/Ensuring-Safe-Secure-and-Trustworthy-AI.pdf.
---------------------------------------------------------------------------

    a. Have data centers implemented any novel physical or 
cybersecurity measures in data centers' running or training frontier AI 
models that they have not implemented for other data center 
applications?
    b. What cybersecurity requirements, technical controls, or risk 
assessments should be implemented to ensure adequate data security 
practices in data centers that run and train frontier AI models? Should 
these requirements

[[Page 71893]]

scale for less powerful versus more powerful AI models, and if so, how?
    c. How economically feasible is it for data center operators to 
maintain physical separation between infrastructure used for frontier 
AI training or for inference and other applications? What effects, if 
any, would this achieve beyond logical separation?
    d. Are there any economic or technical reasons not to keep highly 
sensitive data, or frontier AI model weights, encrypted at rest, in use 
and in transit? Are there economical or technological barriers that 
would hinder the deployment of other data security measures that would 
protect highly sensitive data, such as frontier AI model weights?
    e. What data security measures are data centers implementing as 
they integrate AI applications and capabilities within their existing 
infrastructure (e.g., power management, energy efficiency)?
    10. What training tools and exercises do data centers use to train 
personnel and validate the efficacy of their data security posture?
    a. What forms of on-the-job data security training do data centers 
provide to their staff?
    b. How do data centers evaluate their employees' data security 
competencies? Describe any industry certifications that data center 
operators prioritize to indicate competence in data security.
    c. Describe how data centers work with third parties in red-teaming 
efforts to simulate outside attacks. How often do data centers provide 
third parties' access? What level of access do data centers provide to 
third parties?
    11. What role or actions, if any, should be taken by the Department 
of Commerce and, more generally, the federal government, to address the 
challenges to and opportunities for fostering the development of data 
centers?

Stephanie Weiner,
Chief Counsel, National Telecommunications and Information 
Administration.
[FR Doc. 2024-19524 Filed 9-3-24; 8:45 am]
BILLING CODE 3510-60-P
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.