By Robert Hammer, Emeritus Faculty, Security Executive Council
In July 2026, activists threw water balloons filled with hydrogen peroxide, acetic acid, and salt over the fence of a data center under construction in Amsterdam, onto foundations poured the night before. The group claimed the mixture would corrode the reinforcing steel. The developer said it had not tested the substances and reported no impact. Neither claim has been verified.
Now move it to your site. Your phone wakes you up. Something was thrown over the fence overnight, there is residue on last night’s pour, and a group has already posted photos online describing what it will supposedly do. Who does your superintendent call? Does your security charter even cover a site that has no building on it yet? For most companies, the honest answer is that somebody would have to go find out. That is the finding.
Why the Gap Exists
Corporate security charters typically begin when a building is commissioned. Everything before that, land, entitlement, design, and construction, sits with other functions, and site security is usually a line item in the contractor’s general conditions, one of the first things cut for savings. On leased and build to suit projects it is worse: the developer owns the site, the contractor, and the insurance, while your brand owns the grievance the moment something goes wrong. In Amsterdam, the foundations belonged to the developer. The tenant was Microsoft, and the activists were targeting the tenant.
What Gets Tested
After an incident, a program is judged the way any duty is judged: on what was known, what was done, and what can be proven. Foreseeability is no longer in question. There is now a real incident history behind this kind of attack. Whether security requirements were ever written into the construction contract is a fair question for a board to ask. And whether the company can produce a dated record of what that structure looked like before anyone touched it is where most programs actually fail.
None of this is about a building falling down. A surface application of acid and salt on a foundation is very unlikely to compromise structural capacity, but the owner cannot simply say so. It has to be proven, and proving it is slow. That is the point. Doubt, delay, and disclosure are the objective, not a side effect. These groups are not trying to bring a building down. They are trying to make it late and expensive enough that it never gets built, and a schedule is far easier to damage than a structure.
The Shift Worth Making
A generation ago, physical security requirements moved out of the punch list and into the design phase. That fight was won, but it still starts with a building. The next shift is earlier. Security cannot wait for a design, let alone a certificate of occupancy. It has to begin when someone options the land. Companies that miss this will not lose buildings. They will lose schedules, capital, and community trust years before anything is commissioned, and when the loss shows up in a quarterly review, nobody will be able to say whose it was.
A readiness checklist and a first 72-hour incident protocol built from this same research are available to Security Executive Council Tier 1 Security Leader clients.
Robert Hammer is an Emeritus Faculty member of the Security Executive Council. He served more than twenty-five years in federal law enforcement, culminating as Deputy Director and Acting Director of Homeland Security Investigations, where he ran the agency’s business enterprise alongside its investigative mission. He holds a BBA in Computer Information Systems from Georgia State.
