In “We’re all thinking about AI wrong” last month, I wrote about how AI continues to befuddle us with its jagged brilliance, where it can be phenomenal at some things yet absolutely dismal at others.

What's more, even within a single field, the results can vary wildly. For instance, AI can craft great headlines or passable press releases but fall completely flat when it comes to a good opinion piece. And where a commercial lawyer might sing praises about how AI could replace the work of multiple legal assistants, a veteran criminal defense lawyer would avoid it like the plague, given the devastating consequences of a single hallucination.

This week, two contrasting developments in cybersecurity put this into sharp relief. If nothing else, they underscored that rapid AI-driven transitions are becoming the new normal, and no industry or role will be spared the upheaval.

When AI is both the problem and the solution

Earlier this week, a man tinkering with Claude Code to hack his own DJI Romo robot vacuum (he wanted to control it using his PS5 controller) inadvertently stumbled upon a serious security flaw. How bad? The bug gave him control over thousands of other robot vacuums using nothing more than his personal login credentials.

Think about it. If even a commercial product from a well-known manufacturer could contain such security oversights, what about vibe-coded apps created by non-technical users with little regard for best practices? That’s a perennial concern of mine. The average code out there is already insecure, and that's what AI systems are being trained on. Are we heading towards a vibe-coded security apocalypse?

Don’t just take my word for it. A study by Escape Research published in October 2025 analysed over 5,600 publicly available vibe-coded apps (think Lovable, Base44, Vibe Studio, Create.xyz, and Bolt.new) and found over 60% were vulnerable, with 98 highly critical issues identified.

Stop all AI use in code, then? It isn’t that simple. Jagged brilliance, remember? Just yesterday, Anthropic unveiled Claude Code Security, a new capability built into Claude Code for the web that scans codebases for vulnerabilities and suggests targeted patches.

And the results speak for themselves. Anthropic said its internal team has already found over 500 vulnerabilities in production open-source codebases using its latest AI model, Opus 4.6. These are bugs in mature, well-established products that had gone undetected for decades, overlooked despite multiple rounds of expert review.

Brace for a protracted period of upheaval

It’s worth noting that cyber stocks promptly tumbled after the Anthropic announcement. This seems misplaced, as the static application security testing (SAST) that Claude Code Security offers is quite different from cybersecurity offerings such as endpoint security, threat intelligence, identity management, or secure connectivity, to name just a few.

Yet markets rarely parse such distinctions in the heat of the moment. The sell-off likely reflects a broader anxiety that AI could eventually encroach on any segment of the cybersecurity value chain, regardless of where it starts. Today it's SAST. Tomorrow it might be threat detection or identity management.

Perhaps we all know intuitively that AI is set to reshape the way we work and do business, even though most organisations are still struggling to generate meaningful returns from their AI initiatives. For investors, the uncertainty alone is enough to trigger a knee-jerk reaction.

Here's what I think: as AI capabilities continue to evolve, they will throw an increasing number of industries into disarray. My current hypothesis is that we can expect years of transitions, even if AI stops getting better today. Of course, there's no sign of it stopping, let alone slowing down. And that's precisely the point.

If there's one certainty, it's that we are still far, far away from understanding what AI will ultimately mean for the sector. And if that's true of cybersecurity, it's true of just about every other industry AI touches.

My advice? Stop waiting for the dust to settle. Love AI or hate AI, these transitions are the new normal, and those who adapt to operating in a state of constant flux will be better positioned for what's ahead. Buckle up.

A version of this first appeared in the commentary of my free Tech Stories newsletter that goes out every Sunday. This newsletter comes with a digest of other stories that I wrote in the preceding week. To get it in your inbox, sign up here.

The introduction of AI threatens to upend how we work and learn. In a Substack piece titled “We’re all thinking about AI wrong” last month, I argued that we are all approaching AI from different perspectives. Like the classic blind men and the elephant parable, each person touches a different part of the animal and draws wildly different conclusions.

Just last week, a new study published by Anthropic shed new light on the impact of AI on how software engineers work. The researchers manually annotated screen recordings to identify how participants approached their assigned tasks, yielding fresh insights into different ways of using AI and the outcomes in terms of mastering new skills.

I found the report highly relevant beyond coding, particularly in how to optimally apply generative AI in our work. The catch is that using it the “right way” runs against our instinct to take the easy route. In other words, AI doesn’t just change how we work, it tests whether we still want to learn.

The illusion of competence

We already know that AI can help people do their jobs faster. But does this come with trade-offs? Well, new research from Anthropic has confirmed what many of us had long suspected: overreliance on AI can hinder the acquisition of new skills.

A group of 52 software engineers were asked to perform a 30-minute coding assignment in Python, a language they were familiar with. In the study, they were required to write the code for a relatively advanced task using a Python library that was new to them. A 25-minute quiz was administered immediately after to test for mastery of the concepts from the assignment.

Unsurprisingly, those who made use of AI fared significantly worse in the quiz. What’s worth noting is that AI use didn’t automatically mean a lower score - how individuals used AI did. Put simply, those who scored well made the effort to understand the code produced by AI, either by asking for explanations or solving bugs manually.

In short, the higher scorers used AI to speed up their understanding of the unfamiliar library and to code better, not merely to complete the task. They took the extra effort to grapple with the underlying concepts, asynchronous programming in this case, even as they used AI, gaining both productivity and new coding skills.

The concern, as noted by the study’s authors, is the potential for AI to stunt the skill development of junior engineers. They wrote: “[To] accommodate skill development in the presence of AI, we need a more expansive view of the impacts of AI on workers... productivity gains matter, but so does the long-term development of the expertise those gains depend on.”

Writing is thinking

The Anthropic study also underscored my realisation that there are many ways to apply generative AI to writing. Yet even from this sprawl, they can be broadly categorised into two distinct camps: approaches that deepen our expertise, and those that offer little more than one-off productivity boosts.

The danger of leaning too heavily on the latter is that we stay stuck with mediocre skills. And because writing is thinking, AI becomes a crutch that ensures we never learn to stand on our own two feet when it comes to sparking fresh ideas and sharpening our judgement.

When I first tried ChatGPT, I was as fascinated with the idea of learning advanced prompting techniques as everyone else was back then. Remember the tricks? Emulating the style of a favoured author, chain-of-thought prompting, storytelling frameworks?

My problem was I could see the flaws in AI-generated copy as clear as day, regardless of every technique I tried. Moreover, the compulsive overuse of prose techniques by large-language models (LLMs) grated on my taste. Thankfully, this meant I kept writing practically everything manually, though I never stopped experimenting with AI.

What changed was my approach. Rather than trying to get AI to write for me, I shifted towards using it to become a better writer instead. I now write considerably faster than I ever have, while producing pieces with stronger insights. It doesn’t end with writing though. The practice itself sharpened my thinking as I examined issues critically. Often, what I set out to write would morph into something else as the arguments shaped themselves.

The era of synthetic coherence

This wouldn't be possible leaning heavily on AI. Yet the temptation to do exactly that has never been greater. It used to be that being able to put words on a page took effort, which meant any published content broadcast a signal about competence and value. No longer. AI can generate copious coherent-looking text in seconds, complete with beautifully illustrated infographics.

The deeper issue is that AI doesn’t just produce passable text. It excels at something I’d describe as synthetic coherence: the ability to make even erroneous arguments read well. Social media platforms are now inundated with this kind of AI slop: content that looks good at first blush but falls apart on closer inspection by anyone with even a rudimentary knowledge of the subject matter.

This brings us back to the core problem: the human tendency to choose the path of least resistance. This flood of mediocre content isn’t a technology problem. It is what you get when thousands of people choose the shortcut rather than the struggle of thinking.

The internet democratised the sharing of knowledge, allowing thinkers and experts to easily share their opinions and works. AI, on the other hand, is rebuilding the wall the internet tore down, allowing anyone to swamp online spaces with an unending firehose of content, burying everything under a layer of mediocrity.

But where does it leave writers? With a choice to make.

For those who see writing as self-actualisation, it remains one of the most powerful tools: the act of putting thoughts into words forces a rigour that no amount of AI prompting can replicate. We write not just to be read, but to become sharper versions of ourselves.

The problem with AI is human. And the only way to solve it lies within each of us.

A version of this first appeared in the commentary of my free Tech Stories newsletter that goes out every Sunday. This newsletter comes with a digest of other stories that I wrote in the preceding week. To get it in your inbox, sign up here.

AI is the topic we all like to talk about, mainly because it continues to befuddle us with its jagged brilliance. I mean, it can be phenomenal at some things, yet so terrible at others. And let’s not get started with the hallucinations that some experts say will never be completely eradicated.

Moreover, each time we think we have it figured out, someone comes up with innovative new ways to use it, or another wave of models is released that demonstrate new capabilities or emergent properties.

But perhaps we are all getting it wrong. Maybe what really matters is not what AI can or cannot do. It isn’t about taking a stance between entrusting it with everything or vilifying it and refusing to go anywhere near a chat prompt. Instead of putting AI into a box, we need to see it for what it is: a digital shed packed with a plethora of tools, ready to be shaped by how we choose to use it - or misuse it.

The blind men and AI

In the classic blind men and the elephant parable, each person touches a different part of the animal and draws wildly different conclusions. None of them are wrong, yet they all completely miss the bigger picture.

Each time I write about the use of generative AI in writing, I’ve received wildly different responses. There are some who condemn its use with gusto, while others assert that good AI outcomes lie with the thought process or the presence of original ideas.

A third group would challenge me on what they perceive as a personal attack on how they use AI. What does it matter, they ask, as long as they take ownership of the final output? It is worth noting that these respondents are seasoned professionals, some of whom are successful business leaders with regional or country-level remits.

I’ll be honest. It took me a long time to figure this out. Now I will say: none of them are wrong. But everyone is also missing something. Those who condemn AI outright are closing themselves off to new tools. Those who emphasize the thought process have a point, but it doesn’t explain why so much AI-written content is still so bad. And those in the ownership camp ignore that owning mediocre output is still mediocre.

And it’s not even our fault. After all, AI is so inherently groundbreaking, so radically different, and continually improving - that we really have no frame of reference and are all still trying to make sense of it.

The linguistic camouflage

Before I go on, I want to say that I believe generative AI will change the world as we know it. However, if you read my posts regularly, you would surely have known about my frustration with AI-generated content on social media. My beef isn’t with the large language model (LLM) itself. It is with the use of AI to effectively beautify poor or shallow writing, making it appear insightful until you actually read it.

But read closely and the cracks show up quickly. What’s worse is how AI excels at synthetic coherence that makes even erroneous arguments read well. I do loathe wasting precious time on a piece of content, only to discover upon finishing it that it’s nothing more than AI slop.

This is the antithesis of why I write, which is to craft compelling, easy-to-understand stories that offer genuine insights. Is it possible to generate exceptional content using AI? I don’t doubt it. But doing that takes significant effort and skill in working with AI, from my personal experience.

This is because today’s AI has a tendency to skew towards the most common patterns, making everything sound the same. A strong writer can make it work with enough effort, though at some point one wonders if they’d be better off just writing it by hand. It is for this reason that I think the best content will continue to be human written for a long time to come. I’m not arguing against using AI. I’m merely saying that its use can’t replace the craftsmanship and discernment needed to frame and write a good story.

The practical path

When we look beyond the grandiose and frankly unrealistic claims being made about AI, I genuinely feel that the technology will help improve work. In my own ongoing journey since the public release of ChatGPT in November 2022, I’ve stumbled on various ways that work for me.

Here are some examples of how AI has helped me.

• Last week, I was invited to a media briefing at Cloudflare’s Singapore office. With my handwritten notes on my Remarkable and the audio transcript with help from AI (Otter), I was able to quickly locate relevant pointers for my post. This cut the usual writing time by a third - allowing me to post it in time to attend a second event that afternoon.

• I have relied on various leading AI models such as Gemini Pro and Claude Opus to critique some of my long-form content that I write online or for clients. I don’t accept every recommendation, but I dare say it’s allowed me to produce significantly better outputs without the benefit of a human copyeditor.

• AI has also proved invaluable in copywriting. When crafting a messaging framework, for instance, getting key descriptions and headers right are absolutely vital. This is where AI services such as ChatGPT and Perplexity have helped me save a tremendous amount of time as I craft and fine-tune them.

Which leads me to my point for today’s piece. I believe there is a segment of people who are quietly dabbling with AI to improve and enhance their work. They are not looking for prompt packs or quick-to-obsolete techniques but are surgically using AI to amplify the quality and volume of their output.

A calculator doesn’t make someone a mathematician; a spell-checker doesn’t make someone a writer. AI amplifies existing capability rather than replacing it. When it comes to writing, the question isn’t whether to use AI. It’s whether you have something to say.

A version of this first appeared in the commentary of my free Tech Stories newsletter that goes out every Sunday. This newsletter comes with a digest of other stories that I wrote in the preceding week. To get it in your inbox, sign up here.

But as I rested during my year-end break and talked to industry leaders throughout December, I heard developments that incline me towards a supercycle scenario in Southeast Asia. On one hand, an Eastern hyperscale operator is doubling down with plans to build significantly more data centre capacity here. On the other, I’ve also had coffee with a senior executive of a large regional operator who admitted having more demand in their order books than they could fulfil.

That got me thinking. What would a sustained data centre boom in Southeast Asia look like? Unlike similar growth surges in Western markets, the markets here differ significantly from each other, with arious intricacies to consider across the region. With that in mind, let’s take a closer look at some hard truths behind Southeast Asia’s digital infrastructure race.

Growth has physical limits

Reading the headlines these days, one might think that data centres are sponging up every iota of our resources. The situation is more nuanced, and the best way to illustrate this is to look at Malaysia, which has experienced an unprecedented surge of data centre construction that could see it overtake every data centre market in Asia Pacific, other than China, in the next four years.

Let’s start with water. Recent government data shows that data centres in Selangor, Kuala Lumpur, and Putrajaya now consume 0.47 million litres (0.012% of total water use), while those in Johor consume 9.07 million litres (0.6% of the state's total). So no, Malaysia’s data centres won’t trigger a drought by a long stretch. However, the surge in demand can certainly scramble carefully laid plans. Already, it has led to a water moratorium for data centre operators amid urgent work to divert surplus water to places that need it, as well as to complete the construction of new water treatment plants.

To cope, hyperscale operators there are building water treatment plants and wastewater treatment plants, such as the Bridge Data Centres Water Reclamation Plant, the very first data centre-operated facility of its kind in Southeast Asia. I had the opportunity to visit it, which you can read about here. Elsewhere, it was revealed that an upcoming Google data centre at Port Dickson will have a new water treatment plant with a capacity of 65 million litres per day, as well as an off-river storage facility for a "steady water supply."

Power is another consideration. At the heart of data centres is access to power, which gives operators an advantage in negotiations. This has resulted in spurious or overly optimistic applications for electricity, which is a problem for power plants and government planners. To curb this, Malaysia has just announced that it will prevent speculative power applications for data centres by applying a penalty per kilowatt for unused capacity if they fail to utilize at least 85% of their requested power.

My point? Every market faces a hard ceiling. Whether it’s access to electricity and water in Malaysia, limited carbon footprint in Singapore, or investor confidence in other regions, they all serve to add friction even in the face of surging demand.

Location is defined by connectivity

Speaking of Singapore, the country had previously imposed a moratorium on new data centres before moving to a strategy of controlled growth. In December 2025, the DC-CFA2 was announced, which will offer at least 200MW of data centre capacity to an unspecified number of operators based on proposals to be submitted. Given the slower growth, how will Singapore maintain its hub position?

Turns out the geography works in its favour. Over the last decade, it has positioned itself as a literal hub for connectivity, with one of the highest numbers of subsea cable landings in the region. In a conversation with an industry veteran a year ago, I was told that Singapore has 10 times the international bandwidth of Malaysia at the time.

And Singapore has announced plans to double its capacity for cable landings over the next decade. The strategic importance comes into sharp relief when you consider its very limited shoreline amid the massive maritime traffic and sheer number of subsea cables already landing - 28 as of end-2025. So while data centres are typically built in locations with access to power and water, location matters insofar as access to subsea cables is concerned.

Construction is only the beginning

Just like data halls are more than just a safe room to place servers, modern data centres don’t exist in a vacuum. An entire ecosystem is required to make them work; even the largest hyperscale operator won’t be able to do everything alone.

For instance, there is the general contractor for the structural works, then the mechanical, electrical, and plumbing (MEP), and plant and equipment installation. This is followed by the deployment of control and monitoring systems, white space fit-out, and finally testing and commissioning. Each of these requires its own set of vendors and specialists.

And as rack density continues its inexorable increase, there is a need to deploy liquid cooling. Inexperience can cost dearly here, especially when you consider how a cooling leak in September last year damaged millions of dollars’ worth of GPUs. Finally, there is the trained and experienced manpower required to keep the data centre operational.

Whether we're at the start of a supercycle or heading for a correction, the fundamentals remain the same. Data centres need water, power, connectivity, and an ecosystem of skilled people. Southeast Asia has room to grow, but the shape and speed of this growth are inextricably tied to each market’s ability to navigate the hard truths outlined above.

A section of this first appeared in the commentary of my free Tech Stories newsletter that goes out every Sunday. This newsletter is a digest of other stories that I wrote in the preceding week. To get it in your inbox, sign up here.

After all, this is the reason why memory makers such as Samsung, SK hynix, and Micron have redirected fab capacity from commodity PC DRAM to high-margin AI memory (HBM). And I’ve heard of at least two hyperscalers ramping up their data centre investments.

Without overthinking it, here are my thoughts about where I see things heading with AI and data centres in 2026.

The rise of AI inference

The day before Christmas, Nvidia pulled a surprise acquisition of Groq, in what is the company’s largest recorded deal ever. According to some reports I read, it was closed “very quickly.” Did Nvidia offer a “take it now or forget it” deal to force Groq’s hand after the latter sharply cut its 2025 revenue forecast? And did the delay of its major supply deal with Saudi Arabia play a part? I have a sneaking suspicion they all did.

​What is Nvidia doing by acquiring Groq? Some would argue that Nvidia just bought out its most promising competitor. But hearing it from Nvidia CEO Jensen Huang, it is all about AI inference, which apparently already accounts for more than 40% of Nvidia's AI-related revenue and which he predicts will rise sharply.

From this vantage point, it is easy to see why Nvidia is working hard to further strengthen its already formidable stack by co-opting promising AI inference technology, ensuring that it gets its hands on all parts of the market. No matter that enterprises are still struggling with AI use cases; market leader Nvidia has clearly voted with its money.

AI data centres pull further ahead

For w.media’s magazine titled “The race to 600kW” that was just published, I had to read up on Nvidia's Vera Rubin platform, which will be released in three broad implementation phases starting this year. The first phase will see NVL72-style systems that will serve as a direct successor to today's cutting-edge GB300 NVL72. Vera Rubin NVL144 will push rack IT power to the 300kW range, while the Rubin Ultra NVL576 will eliminate fans entirely and run at 600kW per rack.

What is my point here? Nvidia’s GB300 NVL72 system today consumes up to 140kW of power per rack and requires data centres designed from the ground up for high-density liquid cooling. But just when operators are finally getting their act together and vendors are rolling parts such as CDUs, Vera Rubin pulls the rug from under everyone’s feet.

Supporting 600kW will necessitate a complete rethinking of power delivery, cooling systems, and physical infrastructure. This includes reinforced floors, the use of DC busways, and powerful new cooling systems that might exist only as prototypes. Crucially, it pulls even further ahead of data centres designed for traditional workloads, essentially forcing operators to build for one or the other. Not both.

When the race comes down to power

Finally, data centres are increasingly devolving into a race for resources. Think about it: assuming practically unlimited access to funds and a determination to outbuild rivals, the only constraint to data centre buildouts is power. And this is how it has played out in the United States, where technology giants have embarked on a race to build ever-larger data centres.

Initially, this meant activating decommissioned nuclear power plants, snapping up choice sites with access to spare power, or building at the boundary of two or more states for greater speed to market. Of late, it is about hoovering up pockets of excess grid capacity and connecting remote AI data centre campuses into an “AI superfactory.”

The situation is more nuanced in the Asia Pacific, given the varying maturity of data centre markets and how data centre investments are a couple of steps behind. But there is a similar pattern of speculative bets and a rush to secure sites with access to energy. In a growing number of cases, this is also driving investments in renewables, based on informal chats I’ve had. I plan to explore this topic more this year.

AI inference is rising. Data centres are diverging. And power is the prize. Whether the circular financing and controversial GPU depreciation signal a bubble or the start of a supercycle, these are the forces that will shape data centres in 2026. It's going to be an interesting year.

A section of this first appeared in the commentary of my free Tech Stories newsletter that goes out every Sunday. This newsletter is a digest of other stories that I wrote in the preceding week. To get it in your inbox, sign up here.

Johor had just one 10MW data centre in 2021. Today, the state at Malaysia’s southern edge has operational data centres in the hundreds of megawatts, with gigawatts more under construction. How is a state of four million people coping with this influx, particularly when it comes to water? Last month, I visited a facility that offers one answer.

For today, let’s take a look at the water situation in Johor, the insides of an operational water reclamation plant, and why one data centre operator is doing things differently.

Thirsty data centres

Data centres require a massive amount of water for two reasons: for use in evaporative cooling and to replenish water as it accumulates minerals and other contaminants over time. You can read a short explanation I wrote on my Tech Stories blog here. In practically every market, the challenge around water can be attributed to the sharp growth of data centres and the corresponding rise in demand.

No wonder Johor will stop approving applications for Tier 1 and Tier 2 data centres*, as reported by The Straits Times last month. Another report by the South China Morning Post noted how investors in Johor have been asked to postpone water-cooled expansion projects for at least 18 months.

To be clear, multiple schemes are underway to increase the supply of treated water. As I wrote last month, an infrastructure programme has been initiated to divert surplus water southwards from central and eastern regions, which have abundant water. Johor is also urgently building two water treatment plants: the Semanggar Plant with 50 million litres per day (MLD), and Layang 2 Phase 2 Plant with 160 MLD.

What the reports do confirm, though, is how the breakneck pace of data centre growth is straining existing resources. This is hardly unique to Johor. But for investors and data centre operators, any delays in accessing water could potentially disrupt carefully laid plans.

*This appears to be an internal classification according to economic contributions.

Inside the water reclamation plant

When Suntar offered to arrange a visit to the Bridge Data Centres Water Reclamation Plant, I jumped at the opportunity. The state-of-the-art facility is built within the compound of Bridge Data Centres’ 200MW MY07 data centre campus. It is currently the only operational water reclamation plant run by a data centre operator in Southeast Asia and underscores the evolving role of data centres.

What does it do? Well, the facility reclaims non-potable treated effluent from sewage treatment plants (STPs). By further cleaning it up, the effluent is reclaimed into high-grade water suitable for use by data centres. This means MY07 can potentially be completely “water neutral” by reusing effluent water that would have been discarded anyway.

In this case, effluent comes from nearby STPs operated by Johor Special Water Sdn Bhd (JSW). Here are the multiple processes that the water goes through before it is ready for use in the data centre.

Description of the above photos from left to right, top to bottom:

1. Incoming treated wastewater from sewage treatment plants.

2. Metal screens designed to trap and remove larger sediments.

3. Oxidation tank (top); anoxic tank under trapdoor (bottom). They use bacteria to break down organic matter and removes nitrogen from water, respectively.

4. Membrane Bioreactor (MBR) uses ultra-fine membrane filtration to remove suspended solids, bacteria, and even some pathogens.

5. Fibre filter to remove fine impurities that remain.

6. Reverse osmosis (RO) uses high pressure to force water through an extremely fine membrane to remove dissolved and microscopic contaminants.

7. Bridge Data Centres’ water reclamation plant uses up to three passes of RO.

8. Resulting high-grade water.

9. Temporary storage tank for the water.

I also learned that there are processes to clean both MBR and RO membranes to extend their lifespans, which I understand to be measured in years. This is quite different from my previous flawed understanding that they must be discarded regularly.

The below chart below, mounted on the wall of the operations room, sums up the multi-step process.

Here are a couple of videos of processes that I could observe. The top video shows the flow of treated wastewater into the oxidation tank. The bottom video shows the membrane bioreactor in action.

More than just water savings

The water treatment process was far more complicated than I initially thought. But through my conversation and subsequent research, it was also clear that the technology is mature and widely deployed in various industries. In fact, the head of the water reclamation plant has extensive experience working in the semiconductor industry - where water quality standards are far higher.

A few things struck me: The beauty of this setup is how wastewater treatment plants offer more options to data centre operators, allowing them to improve power usage efficiency (PUE) and water usage efficiency (WUE). Moreover, the process is fully automated and can switch seamlessly to handle different water sources: wastewater effluent, rainwater, or surface water.

I was also told that reclaimed water generally has lower conductivity, which helps to increase the cycle of concentration (COC) for cooling towers, thereby increasing water efficiency. In fact, depending on how the plant is set up, it is possible to process blowdown water for reuse to improve COC further.

The Bridge Data Centres Water Reclamation Plant uses both MBR and RO, which gives it a water recovery rate of over 85%. This means less than 15% of incoming treated wastewater is discarded. In comparison, a simple UF system would have a much lower recovery rate of around 40-50%.

Other benefits of a water reclamation plant:

• Repurpose effluent from sewage treatment plant that would otherwise be discharged into water bodies.

• Avoid conflict with potable water demand and water stressed areas.

• Achieve redundancy by eliminating dependence on a single water source.

• Allow data centre operators to meet their sustainability and ESG goals.

As I understand it, the Bridge Data Centres water reclamation plant at MY07 uses automated systems for minimal supervision and lower operational overheads. The modular design also offers greater flexibility for forward-looking expansion.

The 20-year view

But why would Bridge Data Centres invest in a water reclamation plant, which would presumably incur hefty capital expenditure? When I posed this question, Eric Fan, CEO of Bridge Data Centres, explained that this is simply how Bridge Data Centres does business.

While others make “green pledges,” his firm simply walks the talk. But what struck me about Bridge Data Centres is how extraordinarily far ahead it thinks. Fan wrote in an emailed response:

“At Bridge Data Centres, we build for what is next. Designing for a 20-year lifecycle means every decision, from energy sourcing to water systems and building materials, is made with future-readiness in mind. We plan from day one for technology evolution, higher-density workloads, and stricter environmental standards; ensuring our infrastructure remains both high-performing and sustainable as the industry advances.”

The long lifecycle translates into a greater willingness to invest in technologies that increase sustainability. This includes working with technology partners and the public sector to make projects such as its water reclamation plant a reality.

“Our work with Suntar, JSW, and local regulators shows that when private and public sectors collaborate, we can balance data growth with environmental responsibility. We are building towards such a future.”

And Johor is just the beginning. According to Fan, Bridge Data Centres plans to scale its green energy adoption and water recycling practices across every market it is currently in: Malaysia, India, Thailand, and beyond.

What else is Bridge Data Centres exploring right now? Fan says the company is “actively exploring” clean energy in areas such as hydrogen-ready power and other renewable fuels. It is also deploying smarter cooling systems including immersion cooling, energy-storage-enabled power stacks, solar integration, and AI-managed energy systems.

I guess I’m going to have to see if I can visit one of its data centres.

What comes next

Of course, Bridge Data Centres isn’t the only data centre operator to turn to treated wastewater, but merely the first of several to go live with its water reclamation plant. Earlier this year, both AirTrunk and DayOne made similar announcements.

What is clear to me is how the role of data centre operators has evolved. As data centres grow in scale, operators must now consider a growing list of factors including sustainability. Beyond increasing the efficiency of mechanical and electrical systems, this means building capabilities around energy generation and water treatment. The data centre industry is growing up. And in Johor, that means learning to treat its own water.

From the outside, DC-CFA2 with just 200MW of capacity offered seems barely worthy of coverage. But Singapore is a mature and significant data centre hub. Despite massive growth by regional rivals over the last 24 months, it maintains a substantial connectivity lead with over two dozen active subsea cables. Coupled with an extremely low data centre vacancy, the Singapore data centre market is one that is closely watched.

An extremely high bar

What do the requirements in the DC-CFA2 tell us? For one, it sets an extremely high bar for data centre operators hoping to get some of the 200MW of promised capacity. This means smaller operators without substantial financial reserves, and operators without data centres in at least one or two other nearby countries, won’t stand a chance at all.

Part of the reason the bar is so high is due to its requirement for at least 50% green energy use. This is a lot, and as far as I am aware, has no precedent as a national policy anywhere else without an abundance of renewables. The requirement for data centre operators to utilise so much green energy will substantially increase costs. And Singapore is already one of the priciest data centre markets in the world. Does it even make sense?

Yes, but only if one looks beyond data centres and at what Singapore is trying to do as a nation. Consider how nations are running up against resource constraints, whether around water in Johor or electricity in parts of Thailand. Perhaps Singapore is merely thinking three steps ahead. Because at its core, this is a game of resources. And in this case, that means renewables.

I’ve written a deeper, 1,800-word analysis on Substack as a paid piece. It’s part of an experiment about potential demand for deeper, insightful pieces. Read “Singapore’s audacious bet on sustainable data centres” here.

A challenge not unique to Singapore

I clearly remember the unveiling of the Green Data Centre Roadmap on 30 May 2024, which sent a strong signal that Singapore is serious about building sustainable data centres - and is willing to incentivise the creation of a vibrant ecosystem to do things differently. But why go to such lengths? The short answer: to keep its climate commitments and to build new capabilities and innovation in the sector.

Or as I wrote previously, Singapore is seeking to create a virtuous cycle of data centre efficiency by moving beyond tired and limited approaches such as the use of NEWater and installing solar panels on the rooftops. Instead, it seeks a reinvigorated approach by building an ecosystem biased towards incorporating efficiency across the entire digital stack.

Encapsulated within this strategy is a clear understanding: while Singapore, given its small size, is running up against resource constraints much earlier than others, it is a challenge that all nations will eventually face.

As Senior Minister of State Dr Janil Puthucheary said at the launch of Google’s fourth data centre in Singapore last year: “This challenge [of sustainability] is not unique to Singapore; eventually, all of us, wherever we are in the world, are going to be faced with these constraints.”

Ample room for growth

Asia, and Southeast Asia in particular, has incredible room for growth. To be clear, I don’t believe we will do the kind of multi-gigawatt AI training like what we are seeing in certain parts of the world. Instead, our growth will be fuelled by organic demand and AI inference workloads.

Think about it. Even if AI models never get any better than what we have right now, they’re already good enough to reshape industries for years, even decades. And this will happen through AI inference, which we will want to deploy locally or at least within a regional data centre.

Whether for on-premises systems, public cloud, or AI workloads – Asia needs many more data centres given its population and digitalisation. Now, you might have heard talk of an AI bubble and an impending crash. Others say there’s no bubble; that we’re at the start of a supercycle unlike anything before.

Here’s how I see it. In the worst case, organic demand in Asia could be our backstop against a global crash. In the best case, the growth in other markets will ripple out to us soon.

But supporting more data centres ultimately boils down to energy. And in a world where we actually care about the future of the planet, that means renewables. Singapore simply appears to have recognised this earlier than most.

A version of this first appeared in the commentary of my free Tech Stories newsletter that goes out every Sunday. This newsletter is a digest of other stories that I wrote in the preceding week. To get it in your inbox, sign up here.

It’s been a week since IMDA and EDB announced Singapore’s DC-CFA2. In my defence, I was away with my family. Given what I already know, and the timelines involved (three months for submissions), I figured I’d keep holidaying and only read the release when I’m home and ready to write something meaningful.

Well, I finally looked at it and let’s just say it gave me goosebumps. Not in a bad way. It dawned on me that once again Singapore is moving to do something that nobody has done before, or where many would have given up. And if the plan succeeds, it’ll completely change what it means to build a sustainable data centre.

What is the DC-CFA?

But first, what is the DC-CFA? It stands for Data Centre-Call for Application, and it has emerged as the Singapore government’s primary mechanism to allocate new data centre capacity. There is one other pathway that I know of, but the DC-CFA shall be our focus today. The idea behind the DC-CFA is controlled data centre growth, which really began as far back as 2019 with the imposition of an “implicit” moratorium for almost three years. That’s an eternity even in the pre-AI data centre era.

The moratorium was eventually lifted and immediately followed by the pilot Data Centre-Call for Application, which offered data centre capacity to operators who can meet a bunch of criteria designed to benefit Singapore and advanced sustainability. The very first DC-CFA saw 80MW of capacity for new data centres allocated to four winners in 2023. You can see the timelines in the screenshot from a DC Byte report above.

Why the focus for sustainability? There is a lot I could write here, but let’s just say Singapore is determined to meet its climate commitments and that it currently has the highest density of data centres in the world. As I wrote last year, the island nation has more data centres relative to its GDP compared to countries like China and Japan. And that holds even when I swap GDP with land mass and population size.

The second Data Centre-Call for Application, or DC-CFA2, was announced on 1 December 2025. This time, it offers “at least” 200MW of data centre capacity, a huge jump from the 80MW allocated in the first round. It appears Singapore has decided to keep things lowkey this time. Only a handful of publications have reported on it to date, and only in cursory terms with no special briefings or media interviews.

Let’s take a deeper look.

Setting a high bar

A casual read of the press release quickly underscores the requirements of participating in the DC-CFA2: It sets an extremely high bar with multiple requirements around strengthening Singapore as a data centre hub, economic contributions, and sustainability.

As usual, let’s strip away the fluff and focus on the components that truly matter:

• Obtain BCA-IMDA Green Mark for Data Centres 2024 Platinum certification.

• Achieve a PUE of 1.25 at 100% IT load.

• Demonstrate optimisation of IT energy efficiency as outlined in the Singapore Standard on Energy Efficiency of Data Centre IT Equipment (SS 715:2025).

• At least 50% green energy use.

I don’t profess familiarity with data centre markets and standards everywhere. But I believe it is fair to say that the DC-CFA2 probably contains the most stringent sustainability guidelines in the Asia Pacific, including other advanced economies and mature data centre markets in this part of the world.

Unpacking the requirements

These requirements are stringent, more so when you actually dive into the details. I’ll take more time to study them, but here are a couple of things that jumped out at me. I also share some thoughts on whether Singapore’s approach is even viable, considering the already high cost of data centres here.

Green Mark for Data Centres 2024 Platinum certification

Read more

Even as I’ve occasionally expressed skepticism about this incredible growth, month after month, it continues to belie expectations. After attending the w.media Malaysia Cloud & Datacenter Convention (CDC) at the Connexion Conference & Event Centre on Thursday, I’ve been reflecting on the conversations I had and the road ahead.

How is Malaysia attempting to turn its fortuitous data centre boom into a lasting legacy?

The Johor phenomenon

First, let’s look at what’s happening with data centre growth in Malaysia. As I shared on Thursday’s opening panel, JLL data indicates Malaysia will overtake Singapore and South Korea in data centre capacity by 2027, and every other major Asia Pacific (APAC) market by 2029. China has more data centres, but it also has 1.4 billion people.

Is this phenomenal growth a bubble, like the AI bubble in Western nations? As of the first half of 2025, Knight Frank says Johor has a vacancy rate of just 1.1 per cent. That’s lower than Singapore’s, which few would disagree is severely constrained and running at saturation.

As my panellists observed, today’s astounding growth isn’t luck or magic, but the result of more than a decade of work championing data centre investments in Malaysia. When opportunity knocked after the COVID pandemic, spurred by generative AI, the solid base of existing data centres and the knowhow of serving this niche industry became the catalyst for hypergrowth.

Of course, conditions have changed. The competitive environment that catalysed today’s growth no longer exists. Land prices have increased substantially, electricity and water tariffs have risen, and many tax exemptions are being rolled back.

These sharp cost increases have led several data centre operators to look further afield to places like Thailand. But at least some have since decided to return to Malaysia, driven by market economics. And from several off-the-record conversations, I learned many of the developments I caught wind of last year have moved forward. So yes, even more data centres are coming.

The infrastructure squeeze

Of course, you can’t build thousands of megawatts of data centres within years and expect nothing to change.

A lightning strike last week at a Melaka power plant triggered an automatic shutdown of the 2,242MW facility, causing localised outages across Peninsular Malaysia. Though rectified within hours, the incident underscored grid stress. According to The Edge Malaysia, a concurrent unplanned outage at the 1,000MW Tanjung Bin Energy coal plant in Johor exacerbated the situation by stressing the transmission and distribution network.

What struck me during further digging was how Peninsular Malaysia’s power reserve margin has shrunk from 38.6% at end-2022 to 24% as of December 2024. While still considered healthy, it explains the urgency to boost generation capacity.

But it’s not just about building more plants. Malaysia faces a resource challenge. At current extraction rates, Malaysia’s oil reserves could last another 10 to 15 years, potentially declining around 2035. Gas reserves could sustain production beyond 2040, due to new offshore developments. But growing demand means that Malaysia, currently the world’s fifth-largest LNG exporter, could start importing it within four to five years, according to Petronas’s head at the Energy Asia conference in June.

Indeed, the country is set to build 50% more gas-fired power by 2030, adding 6-8GW of generation capacity to address growing electricity consumption driven by data centres, according to TNB’s CEO. Overall, total power consumption in Malaysia is on track to increase 30% by 2030. Depending on who you ask, that’s an additional 14 - 15 GW of generation capacity needed over the next five years, with a big chunk of demand coming from data centres.

Beyond the data halls

Perhaps what struck me most was Malaysia’s efforts to leverage this opportunity to build a robust ecosystem beyond digital infrastructure. MDEC’s Wan Murdani alluded to this during my panel discussion.

Here’s what surprised me: reviewing my notes from his July 2024 presentation in Singapore, I realized he was already outlining this vision - growing renewables and supply chain ecosystems, including semiconductors and data centre equipment manufacturing. I wrote about it then but didn’t grasp its full significance.

Now, a year later, I’m seeing it materialise. I met at least two born-in-Malaysia data centre equipment suppliers that have successfully ridden this growth wave. One was recently acquired by a Fortune 500 European firm, while the other is expanding beyond Malaysia.

Since then, the Johor-Singapore Special Economic Zone was signed on 6 January 2025, envisioned to strengthen cross-border economic integration in various sectors including the digital economy - potentially spurring even more data centres in Johor by strengthening the supply chain.

Many countries have tried to leverage a boom to build lasting industrial capability. Few succeed. The difference always comes down to execution - the unglamorous work of skills training, supply chain development, and creating genuine competitive advantages beyond cost.

Can Malaysia transform this data centre boom into lasting industrial capability before the window closes? The vision is there. The momentum is there. But between vision and reality lies the hardest part: execution at scale. That’s what will determine whether this becomes a lasting legacy or just another boom that faded.

A version of this first appeared in the commentary of my free Tech Stories newsletter that goes out every Sunday. This includes a digest of other stories that I wrote this week. To get it in your inbox, sign up here.

Meanwhile, Singapore, Southeast Asia’s original data centre hub and current champ with 1,400MW of live data centre capacity - appears to be sitting on the sidelines. Beyond announcing 300MW of additional capacity in the Green Data Centre Roadmap last May, things have been quiet.

But Singapore isn’t playing the data centre capacity game. It’s playing a different game entirely - one that sits above the infrastructure itself.

Singapore’s long game: Building a green energy hub

Singapore is quietly recasting itself as a sustainability leader. This week brought news of a conditional approval to import 1GW of low-carbon electricity from Sarawak, Malaysia. Separately, an agreement was announced on Friday to study a second 2GW electricity interconnection with Johor by 2030.

This is just one piece of a much larger puzzle. For years now, Singapore has been building hydrogen-compatible power plants and keeping the nuclear option open. It’s exploring geothermal energy in the north, awarded grants to develop ammonia as marine fuel, and is actively studying carbon capture technologies with a pilot launching by 2026. In a nutshell, Singapore’s long game is to build itself into a regonal leader in green energy.

How does a resource-scarce island nation pull this off? Consider the precedent: Singapore became Asia’s undisputed oil hub - with massive refining, storage, and trading operations - despite having no indigenous oil reserves. Now, as the energy landscape shifts, Singapore is applying the same playbook to sustainability.

Here’s why Singapore has resisted jumping into the AI data centre race. It knows it can’t have its cake and eat it too. But cracking the puzzle of importing renewable energy at scale and competitive prices will open the floodgates to a new generation of green data centres. And when that happens, it already has a floating, sustainable data centre park ready to scale to 1GW.

Greener data centres today

While that vision unfolds, Singapore isn’t standing still. The masterplan to achieve sustainability leadership will take years, perhaps decades. In the meantime, Singapore is working to ensure its data centres meet every other green standard.

As outlined in the Green Data Centre Roadmap, Singapore is tackling energy efficiency at both facility and IT equipment levels. At the facility level, this means upgrading M&E equipment, adopting alternative cooling technologies including liquid cooling, and running data centres at higher temperatures.

The IT equipment challenge is arguably harder, as it requires reducing consumption at its source. This involves optimising equipment utilisation and adopting green software techniques such as application modernisation and computational offload.

Singapore is also steering data centres towards novel renewable fuels, which are alternative energy sources that are renewable. The upcoming DC-CFA2 application for new data centres is expected to specify much tougher requirements on this front. Winners will likely establish their facilities on Jurong Island, the future home of Singapore’s hydrogen hub.

Ultimately, this hard-won expertise could be exported as knowledge or low-carbon energy exports from Singapore’s green energy ports. The following paragraph I wrote for GovInsider last year reflects the Singapore government’s strategic thinking:

This strategy of turning constraints into exportable knowledge is precisely why Singapore views regional growth not as a zero-sum game, but as a mutual opportunity.

Win-win for Southeast Asia

Is the sharp rise of data centres in Johor bad for Singapore? Only if viewed as a zero-sum game. But what if the pie is large enough for everyone? What if we need so much data centre capacity that no single location can reasonably bear the burden of hosting the lion’s share of digital infrastructure?

At a pre-launch event by BW Digital last month, EDB’s Herman Loh spoke of SIJORI, a region including Singapore, Johor, and Batam in Indonesia, which he described as a 50-kilometre availability zone around Singapore. A data cluster around Singapore benefits everyone, he said: “The digital pie is growing quickly, there’s enough for everyone, and it’s not a zero-sum game.”

The race is now on to achieve energy efficiency in Singapore data centres over the next decade. As I wrote previously, this cannot happen through regulation alone but requires a skilful combination of policies, accreditation programmes, and incentive schemes spanning multiple government agencies.

The goal is to move beyond tired, limited approaches like recycled wastewater and rooftop solar panels. Instead, Singapore aims to create an ecosystem that drives efficiency across the entire digital stack, establishing a virtuous cycle of sustainability.

While it appears at first blush that Singapore has foregone the crown, the reality is it has embarked on an entirely different game. Singapore is building green energy infrastructure first, then unlocking sustainable data centre growth. And here’s the thing: in a world increasingly constrained by power and carbon, whoever owns the ecosystem - the green energy supply, the efficiency standards, the operational expertise - holds the real cards.

The spark for this came from the commentary I wrote for my free Tech Stories newsletter that went out earlier today. It includes a digest of other stories I wrote this week. To get it in your inbox, sign up here.

Like a magnifying glass revealing intricate patterns in seemingly simple objects, a closer look at some of the largest data centre developments can offer insights about what is truly important and where the industry is heading.

This was the position I found myself this week, as I went on a tour of the single largest data centre campus and operator in Malaysia, maybe even Southeast Asia. What I saw made me rethink my assumptions about what actually matters when you’re building at scale.

The largest data centre in Malaysia

YTL's Green Data Center Park in Kulai, Johor sits on 2,000 acres of land. Of this, some 300 acres are carved out for seven data centres in the current phase, of which 188MW of IT capacity is already handed over or under construction. YTL got into Johor early, breaking ground in August 2022, months before the launch of ChatGPT triggered the current global frenzy for massive data centres.

In my view, this meant planners had time to properly design the campus - and it shows in the clean layout and plans for an on-site solar farm. When fully built, the campus will deliver 600MW, putting it ahead of other hyperscale data centres by rivals such as Vantage and AirTrunk.

Less than a decade ago, I worked with YTL's CEO Heng Wai Mun on various marketing materials including this brochure (pdf) for Singtel's DC West, which he was building then. DC West was Singapore's largest data centre at the time; today, it would be the second smallest facility in YTL's campus.

As I sped down the main road in a buggy at full tilt, I couldn't help but reflect on what these massive facilities really represent. The entire stretch on the opposite side - already levelled for future builds - sits empty. So there’s room for further expansion. You can watch the full 5-minute buggy ride on this blog post here.

We tend to romanticise data centres: their cutting-edge cooling, their massive scale, their role in the AI revolution. Strip away the narrative though, and it's clear that these facilities exist for one reason: to serve businesses with digital infrastructure needs. Walking through YTL's campus, three pragmatic truths stood out.

Scale’s diminishing returns

Conventional wisdom tells us that economies of scale make resource use more efficient as we scale up, which should help data centres given their massive energy and water consumption. However, scale is a double-edged sword. It amplifies both efficiencies and waste, while exposing problems that smaller operations can simply ignore.

Take water quality as an example. A separate conversation I had with the CEO of a water treatment company highlighted how this plays out across Southeast Asia. He explained how poorer water quality in some cities means data centres there have very low cycles of concentration (CoC) - a metric showing how many times water is reused before discharge. Some data centres manage only single-digit CoC, while others exceed 10. That's a world of difference in operational efficiency.

Finally, scale means significantly greater impact when something breaks. Protecting against that requires exponentially more complexity, redundancy, and management overhead. For example, the five water reservoirs at YTL aren't about efficiency - they're absolute requirements when operating at a scale where even brief disruptions can have unthinkable repercussions.

No two data centres are alike

One thing that stood out was how there was no uniformity across data centres. Of the few cooling towers I saw perched on rooftops, some were evaporative while others were dry coolers, from various manufacturers. The DCIM system I saw also showed two setups for different data halls. The reason is obvious on reflection: customers have differing priorities and workloads, which drives the design and equipment choices.

This reality contrasts sharply with headlines and social media commentary from those with vested interests, who often push for liquid cooling and high-density deployments as if they're universal solutions. But a bank's requirements differ vastly from a consumer firm's, which in turn differ from an e-commerce platform's needs.

This customisation inevitably complicates design and operations. There's no one-size-fits-all template when every major customer essentially gets a bespoke solution. Yet this is the pragmatic truth of data centres today - they are designed for individual customers with unique requirements.

Economics beats engineering

(Video: This isn’t a data centre, but the site office for the YTL campus)

We build data centres for different reasons. Some enterprises need infrastructure to support business operations and customers. Cloud providers build to offer digital services. Others are racing to build because they believe AGI will reshape the world order - and they must be there first.

Yet at its core, the data centre is just another business. There are investors expecting returns, operators managing margins, and customers comparing costs. The most sophisticated liquid cooling system means nothing if customers won't pay the premium. The highest power density racks are worthless if clients only need 10kW.

It’s worth remembering that customers don't spend unless they must. But when they do, they will choose technologies and systems that best meet their needs - not more, not less. This ruthless pragmatism is what actually drives data centre evolution, not vendor promises or technologist dreams.

The view from the ground

The future of data centres won't be determined by loud voices at trade conferences or breathless headlines. It will be shaped by mundane realities: operational costs, customer requirements, and of course, local regulations.

The evolution of the data centre won’t come from chasing the theoretical limits of power density or the latest cooling breakthroughs. It's about finding the intersection between what's technically possible, what's economically viable, and what customers actually need.

That's the pragmatic truth the headlines miss: data centres succeed not by being the most advanced, but by being exactly what their customers need them to be.

A version of this first appeared in the commentary of my free Tech Stories newsletter that goes out every Sunday. This includes a digest of other stories that I wrote this week. To get it in your inbox, sign up here.

But developments within data centres aren't as cut and dried as they appear from the outside. As I observed during my fireside chat with Oracle's Dan Madrigal in July, the sheer rate of change means that even those building cutting-edge data centres have to make educated guesses and green-light unproven systems fresh from the factories.

With today's data centres already struggling to keep pace with change, what will tomorrow's facilities need to handle? This week's announcement of Nvidia’s Rubin CPX might offer some clues about where data centres are headed.

The Rubin CPX and the inference play

Modern data centres are heavily influenced by the infrastructure needed for the latest AI models. From Hopper GPUs requiring up to 50kW per rack, to Blackwell GPUs at 130kW, and even the proposed Rubin Ultra GPUs at 600kW per rack, data centre design has evolved at breakneck speed over the last three years.

Yet AI inference hasn't received much attention. Yes, we know AI inference will overtake AI training at some point – every chart I've seen over the last two years shows this trajectory. Sure, companies like Groq have launched specialised inferencing chips at 20kW per rack and are making steady inroads in the enterprise. But the focus has never been on inferencing.

This changed this week when Nvidia unveiled its upcoming Rubin CPX chip, scheduled to ship by end-2026. The CPX represents a completely new class of GPU designed specifically for post-training workloads. And it does this in a way that leverages Nvidia's strengths while achieving further lock-in to its already tightly coupled ecosystem.

What's clever here is Nvidia's new disaggregated inference architecture. The Rubin CPX handles the prefill and context phases of generative AI, reducing the load on more expensive, full-fledged GPUs which can then focus on the actual generation phase.

It also aims to reduce costs. The chip uses much cheaper GDDR7 RAM, albeit in higher quantities, features a monolithic die to lower manufacturing costs, and maintains the 130kW-rack energy footprint of existing Blackwell GPUs, making deployment possible in racks designed for Blackwell.

One could argue that Nvidia is moving decisively to capture a growing market before competitors entrench themselves. I believe that's true, but as I thought about it, I realised there's more to it. But more on that later.

Not everyone needs an AI data centre

I've previously written that data centres are diverging into AI data centres and enterprise data centres, and that this split is accelerating. We're witnessing the emergence of two fundamentally different types of data centre, each with radically different power, cooling, and infrastructure requirements.

Since last year, I've made a concerted effort to enquire about rack densities. I've asked CEOs with new data centres, country leaders overseeing multiple facilities, and vendors selling GPU servers. Despite expecting high double-digit or even triple-digit kW deployments, it turns out high-density racks are still a rarity.

One country leader told me about low take-up for optional liquid cooling systems capable of handling up to 40kW at an existing facility. The reason? Customers simply don't need it. This paints quite a different picture from the one promoted by certain vendors with liquid cooling systems to sell.

To be clear, I'm not saying high-density workloads aren't required; the reality is just more nuanced for data centres not used by tech giants for AI training. Just across the causeway, many data centre operators have liquid cooling and high-density deployments. But look closer and you'll notice most have allocated substantial capacity for non-liquid cooled workloads.

What the Rubin CPX shows us is that even within AI data centres, workloads will be segmented into multiple power tiers. Put another way, 600kW racks are probably further off than we think, or will only be deployed in even smaller sections of data centres than today's Blackwell GPUs occupy.

Welcome to the multi-density data centre

This reality isn't lost on Nvidia. Here's what I think: Nvidia isn't confident the data centre industry will be ready for Rubin Ultra GPUs with their 600kW rack requirements by 2027. Beyond capturing a slice of the inference market, Nvidia is setting the stage for data centres with multiple power tiers.

This makes sense when you consider what needs to change for 600kW racks. Dedicated transformers for every pair of racks. Complete elimination of air cooling. Redesigned structural support. Switching from copper bus bars to alternative materials. The list goes on.

Most data centres haven't even reached 50kW racks, and cutting-edge deployments are just getting comfortable with 130kW. Expecting another radical transformation within three years seems optimistic at best. The Rubin CPX allows operators to standardise on 130kW racks whilst accommodating spot deployments of 600kW racks where absolutely necessary.

At worst, users could simply space out their GPUs across more racks. Remember Meta’s recently unveiled "Catalina" Open Compute rack with two NVL36 racks supported by four racks of air-to-liquid CDUs - Meta calls them air-assisted liquid cooling (AALC) sidecars? That's pragmatism to me.

What will the data centre of the future look like? Not the monolithic, one-size-fits-all facility we've known. I think we're heading toward mixed-density environments where different workloads occupy purpose-built zones.

In that sense, Nvidia's Rubin CPX is a recognition that the future of AI demands flexibility. It is about building systems that actually work with the infrastructure that we (will) have, in data centres designed to accommodate diverse computational needs without forcing everything into the same infrastructure mould.

And that's probably exactly what Nvidia is counting on.

A version of this first appeared in my free Tech Stories newsletter that went out earlier today. This includes a digest of other stories that I wrote this week. To get it in your inbox, sign up here.

As I endured the exhausting 15-hour flight back to Singapore, unable to sleep, a thought struck me: What if the world is splitting between those who use AI and those who don't? Are we witnessing the start of a new kind of digital divide?

Do you AI?

First of all, are you even using AI? I believe many do, albeit with differing levels of frequency and competency. If you belong to the camp who opts not to use AI due to its inferior output, I know where you're coming from. Used poorly, AI will flatten your unique voice into polished but soulless words.

I've previously argued that AI won't save bad writers. It's a tool that merely amplifies our thoughts. Disjointed ideas, muddled thinking, and poor skills will never guide AI to produce heights the user themselves cannot reach.

And yes, AI has made some things worse. Just look at LinkedIn, now full of users relying on AI tools to generate scores of comments a day just to rank better. But it's equally true that AI can greatly amplify both your productivity and the quality of your output when used well.

And there are levels beyond that which could completely change your workflows, as I learned this week in San Francisco. But if you never get started, you'll never get to the next phase.

Going 10x with AI

I'm no newbie and have paid versions of ChatGPT, Claude, Gemini and Perplexity. Yet some of the techniques I heard simply blew my socks off. As you can see in the above slide, AI has completely changed the rules of the game, making it possible for very small teams to produce outsized outcomes impossible just five years ago.

But when it comes to AI, practically all of us operate at a base level of competency. This basic use often produces mediocre results, also known as "AI slop." Why? Because large language models are the sum of their training. When you average out the good and the exceptional, you're left with mediocre outputs. People then take one look and throw in the towel.

Better prompts, examples, and iterations help. But this takes time and often isn't replicable across chat sessions. In his talk "40-min AI sprint: branded AI training and take-home playbook," marketing agency founder Kevin Barber was candid: he wouldn't want to pay an employee to spend hours a day "prompting AI."

We need to advance through to higher levels of competency. Getting to the next level involves incorporating context to an extreme degree, with five distinct layers that Kevin shared. If I were to summarise: effective AI use combines systems thinking, structures that inject empathy, and extreme contextual detail. In short, contextual engineering delivers next-level output.

The highest level involves AI agents executing step-by-step workflows. The idea is that you can step away for an hour and come back to see a complete project ready. Kevin uses this for full-stack marketing, so your mileage might vary for other tasks. But there's no reason why similar workflows can't be adapted for your specific needs.

AI is disrupting every industry

And while we're struggling with basic prompts, entire industries are being reshaped. Even if you don't care about leveraging AI, know this: AI is changing established industries, whether you like it or not. At Inbound, one topic that attracted loads of attention was AI engine optimisation (AEO) – ensuring that brands are mentioned when users query AI search engines.

Why the big deal? Because 60% of searches now end without a click, courtesy of users searching with AI and features like Google's AI Overviews. No wonder marketers are panicking.

It doesn't help that the "Awareness" portion of the funnel has fragmented. Today, buyers are on scores of disparate platforms: TikTok, YouTube, Reddit, or listening to their favourite podcasts. With web traffic tanking and the link from search to company blog broken, how will marketers bring in leads, much less convert them?

This is where AEO comes in. And if you're a marketer, you need to start looking into this whether you like it or not. And you know what, I suspect scenarios like this are playing out across dozens of industries right now.

Back to AEO. This isn't a singular strategy, but a constantly evolving list of best practices and techniques to get picked up by AI search engines. Confusingly, some of what works contradicts traditional SEO. For example, content freshness matters more for AEO (one year or less) while SEO favours established content.

Check out various tips for AEO here.

Easier and harder than you think

Getting better at AI is actually easier than you think. You just need to get started. Don't peck at the chat interface for 5 minutes and give up when it doesn't immediately produce magic. Persist and vary your approach, iterate and try again. Most people fail because they ask AI one question, get a mediocre response, and conclude AI is overhyped. That's like judging a piano after playing one note.

Also, experiment with the various AI models if you can, as each have differing strengths. ChatGPT excels at a wide array of tasks, Claude is exceptional at writing and coding, while Perplexity shines at quick research. Using just one is like having a toolbox but only ever using the hammer.

But true mastery demands more. To get to the point of 10x productivity with AI won't be easy. It would probably require you to unlearn old skills or mindsets that are hindering your progress. You'll need to stop thinking of AI as a search engine that gives you answers and start thinking of brand-new ways to leverage it. You will need to experiment - a lot.

You will also need to think both systematically and creatively to tackle new problem statements. The systematic part is about building workflows and templates that make AI outputs consistent and reliable. The creative part is figuring out how to break down complex tasks into segments that AI can actually handle.

My question to you is: Where are you going with AI? Because standing still isn't an option anymore.

A version of this first appeared in my free Tech Stories newsletter that went out earlier today. This includes a digest of other stories that I wrote this week. To get it in your inbox, sign up here.

With nearly 700 million people and rapid digitalisation driving demand, Southeast Asia offers valuable lessons for other regions. Let's examine three countries at different points in this evolution: Singapore's mature market, Malaysia's explosive growth, and Thailand's emerging opportunity.

Singapore's unwavering mandate

Without fanfare, Singapore last Friday launched a new standard for energy-efficient IT equipment, part of its drive towards sustainable data centres. ​According to IMDA, the new "SS 715:2025: Energy Efficiency of Data Centre IT Equipment" standard is geared towards helping data centre users improve their energy efficiency.

I'll leave you to read about it, but broadly speaking, it focuses on encouraging organisations to deploy energy-efficient systems, deployment best practices for IT systems, and running their data halls at a higher temperature to save energy.

This comes 6 months after the latest Green Mark for Data Centre 2024 (GMDC:2024) took effect in March, imposing tighter requirements on PUE measurements and adding new considerations such as WUE, or Water Usage Efficiency, into consideration.

My point is this: Singapore has an unwavering green mandate since the data centre moratorium of 2019. Despite pressure to soften its stance over data centre growth, it fully believes sustainable data centres will eventually matter to everyone. And the groundwork being laid today positions Singapore to lead when sustainability shifts from differentiator to baseline requirement.

Is Singapore onto something here? Setting data centre standards today that everyone will scramble to mirror tomorrow? Or is this rigid commitment to sustainability a strategic miscalculation that will cost Singapore its hard-won position as Southeast Asia's premier data centre hub?

Bubbling anxiety in Johor

This week has been an anxious one for those with stakes in Johor's data centres. At the time of writing, there have been six earthquakes of varying intensity. All have registered at around 4.0-magnitude or lower. These are noticeable with minor indoor shaking but unlikely to cause significant damage.

Here's the thing though: Johor isn't classified as an earthquake zone, which means the huge data centre hub there wasn't built with seismic activity in mind. Given that it's too late to retrofit existing facilities or those under construction, the only option is to wait and see what develops.

This is one more worry adding to unhappy murmurings on the ground over multiple cost increases. New electricity tariffs came into effect in July, water tariff hikes are coming, and new regulations prohibit data centres from using 100% potable water in their cooling operations - compelling operators to build water reclamation plants. Taken together, the cumulative cost increases would dampen anyone's enthusiasm for Johor's data centre boom.

Realistically, is Malaysia trying to limit new data centre investments? I don’t think so. Johor approved another 42 new data centres projects in Q2. My sense is that Malaysia is simply maturing as a data centre market, moving from "growth at any cost" to "sustainable growth."

Thailand's incipient opportunity

Finally, is Thailand the next Johor? According to DC Byte, Thailand is entering a breakout phase with off-the-charts growth. Multiple major players have entered Thailand over the last 12 months, including well-established operators and cloud giants. Today, Thailand’s 2,587MW of IT capacity in the pipeline now outpaces regional heavyweights, trailing only Malaysia in Southeast Asia.

Of course, 2,072MW of this pipeline consists of "early stage" builds - preliminary constructions that might never materialise. But here's the parallel: we said the same about Johor a year ago. And many of those early-stage projects are now under active construction or already operational.

I've watched multiple waves of data centre optimism crash against Thailand's shores over the years, which kept me sceptical as recently as late last year. But this round feels different. The momentum, the players involved, the scale of facilities - it's all pointing to something more substantial.

Looking at these three markets together reveals something interesting about the evolution of data centre hubs.

The road to sustainable data centres

What if what's happening in Singapore, Malaysia and Thailand are not individual markets growing in isolation, but a picture of what happens as data centre markets mature? Today, we are more aware of the need for sustainability than before, notwithstanding a rush towards AI data centres in certain parts of the world.

Consider the progression: Thailand is just beginning its data centre journey, with massive planned capacity but limited operational facilities. Malaysia is in full expansion mode, but starting to implement sustainability requirements through higher tariffs and water regulations. Singapore, the most mature market, maintains the strictest sustainability standards despite enormous demand, refusing to compromise even as neighbours offer easier paths.

During an address made at the launch of Google’s fourth data centre in Singapore last year, Singapore Senior Minister of State of Sustainability and the Environment, Janil Puthucheary elaborated on Singapore’s stance.

He said: “This challenge [of sustainability] is not unique to Singapore; eventually, all of us, wherever we are in the world, are going to be faced with these constraints. Because of who we are, we are determined to turn these constraints into an opportunity to innovate and capture value from the growth of sustainable data centres.”

As I wrote last year, the limitations faced by mature data centre markets such as Singapore aren't unique. Increasingly, other markets and regions will encounter these constraints. Indeed, some communities have even started pushing back against data centres in the face of water stress and overstretched power grids.

The message is clear: sustainability is now part of everything we do, and data centres can't be the exception. The industry must innovate and adopt more sustainable practices. We need the infrastructure, but it has to work for everyone.

What do you think?

A version of this editor’s note first appeared in my free TechStories newsletter that went out earlier today. To get this in your inbox alongside other stories I wrote this week, sign up here.

In Southeast Asia, however, nations are taking very different approaches. Singapore continues to push sustainable data centres. Even Malaysia, which is in the midst of a once-in-a-generation surge of data centre growth, is tapping the brakes with new guidelines, higher electricity pricing (power is heavily state-subsidised), and new regulations regarding water usage.

This week, we had news of a stop-work order issued for the first time against a data centre project in Johor, Malaysia. Meanwhile, AirTrunk revealed it's building a new 70MW data centre in Singapore - the largest since the 2019 moratorium. Let's explore what these developments mean. I'll also share thoughts on the very human problem with AI.

The data centres next door

A data centre project in Johor earned the dubious distinction of becoming the first to receive a stop-work order this week. I wrote about it on Friday and was surprised by the responses - including from people who'd normally avoid commenting on sensitive topics.

Dirty roads, construction at ungodly hours, and missing safety hoardings six months into construction. Clearly, this struck a nerve.

So, what happened? From what I can piece together, Johor's state housing and local government committee chairman Datuk Mohd Jafni Md Shukor decided to go nuclear on Thursday. He called the media, filmed himself issuing the order on-site, then held a press briefing. For good measure, the 30-minute video was uploaded to Facebook, where it promptly went viral.

While he carefully avoided naming Chinese data centre operator ZData - and mainstream media followed suit - glimpses of personnel in ZData attire gave the game away. Which means the data centre community is already aware.

There is a lot to unpack here. Why go public so dramatically, considering the importance of “face” to the Chinese. Why burn all bridges instead of issuing a private warning first? And is ZData the only offender here? I'll leave you to connect the dots and draw your own conclusions.

Looking at this situation, ZData could certainly benefit from professional crisis communications help at this point.

Finally, how many data centres are under construction in Johor right now? I don’t know for certain, but we can add up the numbers. 15 under construction (official), 42 new projects approved in Q2 2025 (official), and 13 operational (a substantial number, if not the majority are probably still constructing additional phases). You do the math.

AirTrunk's 70MW Singapore play

On Monday, AirTrunk confirmed that it is building a new data centre in Singapore. At 70MW, AirTrunk SGP2 is the largest data centre approved since the 2019 moratorium. (Nxera's 58MW DC Tuas doesn't count because it was technically approved before the moratorium.)

I wrote about what little details we know about SGP2 here. Unfortunately, AirTrunk wasn't in a position to take questions. Yes, I asked the moment I saw the announcement under embargo on Friday. Still, how did AirTrunk secure the go-ahead for such a large data centre when the pilot DC-CFA only offered 20MW to each winner?

The answer, as I wrote last year, is that the DC-CFA is just one the pathways to secure data centre capacity in Singapore. That became clear when I clarified with IMDA how the 300MW will be allocated. What I know for certain: DC-CFA isn't the only pathway.

There are several pathways: data centres powered by renewables, those supporting highly strategic initiatives, and of course, the DC-CFA.

And if you mull over the requirements of modern data centres, it is evident that the era of small data centre operators is effectively over. The capital demands, access to talent, ecosystem play, and in Singapore at least, the clout needed to deploy novel fuel, are simply out of reach for smaller operators today. They either need to raise substantial funds quickly or position themselves for acquisition. There's no middle ground anymore.

The human problem with AI

What will the future of AI bring? This is a topic I've often written about. As an AI realist, I've explored both the opportunities and the risks to evaluate AI without the fluff and hyperbole.

This week, I was at "Future proof with AI" organised by AI Singapore and Elastic, which I wrote about here.

It was a rich session that I'm still thinking over. But perhaps the most impactful was the final session where Elastic's senior customer architect Han Xiang Choong shared his generative AI journey and how it solved a particularly daunting problem at his previous organisation.

His team was tasked with solving long servicing times at the customer service centre. They explored multiple approaches including traditional AI/ML and even building an LLM from scratch. Many months went by. Nothing worked.

Then came the revelation: the problem was completely human. Long training times for new agents, undocumented best practices, and poor knowledge transfer were the real culprits.

So instead of creating an impossibly good AI solution, they built a co-pilot tool that helped existing personnel quickly access the answers they needed. Rather than building something novel, they focused on using generative AI and data management to do help agents find the answers they need really, really well.

And it worked. Call handling time dropped by 20% and accuracy shot up to 95%.

Sometimes the best AI solution is recognising that the problem was never about AI in the first place.

A version of this editor’s note first appeared in my free TechStories newsletter that went out earlier today. To get this in your inbox alongside other stories I wrote this week, sign up here.

Leave a comment

It's been a week since National Day here in Singapore, and the city is settling back into its rhythm. Meanwhile, the tech world never paused - especially in data centres, cybersecurity, and AI.

While we were watching fireworks and fighter jets, data centre operators were scrambling for expertise they never knew they'd need, new BitLocker vulnerabilities were found, and OpenAI was defending GPT-5's cost-cutting measures.

Let's dig into what this all means.

The data centre complexity crisis

Ask an industry insider ten years ago about what a data centre is, and chances are fair that you'll get a dismissive "it's just plumbing" practitioner who insists it's just four walls, cooling and electricity.

This changed as digitalisation took over the world. Before you knew it, data centres weren't just designed for reliable operations but had to be secured from physical threats, protected against cybersecurity threats, and run in a resource-efficient way.

Then AI and growing sustainability considerations entered the picture. Think new generation of high-density equipment for AI workloads, large-scale water reclamation, building renewable energy infrastructure, or experimenting with novel fuel. And that's just the start.

My point is this: data centres are getting more complex than before, and operators are scrambling for expertise they never knew they'd need. Anyone still calling it 'just plumbing' today is clearly out of their depth.

Your laptop's dirty secret

Did you know: You can remove the storage drives of PCs and most laptops to make a copy of the data?

So yes, a stolen or misplaced laptop could have its data extracted in short order. Even an unattended laptop left in a hotel room could have its storage drive cloned by a hotel employee with malicious intent and the right tools.

That's why business laptops like the Lenovo X1 Carbon have an anti-temper switch on the motherboard that triggers when the bottom chassis is removed. Or more commonly, enterprises turn to encryption like Windows' built-in BitLocker to encrypt the entire storage drive.

Of course, this assumes that BitLocker-protected drives are inaccessible without the password. But what if there's vulnerabilities in the implementation that let hackers get to the decrypted data? Or as reader Serge pointed out when he DM'ed me a YouTube video, there are other ways to break in.

Is it true? Does BitLocker have more holes than Swiss cheese?

Of course, when it comes time to decommission it, the only way to ensure your data is gone for good is to... physically destroy the storage drive, like what Google does for decommissioned storage drives here (video).

Not everyone has the resources of Google; if you live in Singapore, I once spoke with Donald Wee of Data Terminator who specialises in ensuring proper disposal of retired storage drives for enterprises and government agencies.

Are we seeing the start of the end of AI?

It increasingly looks like GPT-5 is partly a cost-cutting exercise for OpenAI. The approach? A router model that acts as a "load balancer," directing queries to either lightweight or heavyweight LLMs based on complexity. This lets OpenAI optimize for cost by default.

The evidence? The dramatically lower cost of the GPT-5 API and the abrupt removal of all other models from ChatGPT. GPT-4o access users has since been restored for paying users, but the picture is clear.

Which brings me to the real question: While GPT-5 undoubtedly shows improvements, are we witnessing the beginning of a slowdown in AI advancement or a tipping point cost-wise? Have we hit the ceiling - meaning some of us might actually keep our jobs through the decade?

But here's the thing: even if AI never gets better than today, we're still looking at a decade of disruption as businesses figure out what to do with what we've already built. And if you're wondering how I navigate this myself, you can read about how I use AI to write without compromising my voice here.

You have a great Sunday ahead!

A version of this editor’s note first appeared in my free TechStories newsletter that went out earlier today. To get this in your inbox alongside other stories I wrote this week, sign up here.

Leave a comment

In May, I wrote about how technology giants and AI startups are gunning for our data, methodically strip-mining all the available data on the Internet to feed the insatiable appetite for new AI models.

Today, I want to highlight a new observation: How content providers are fighting back by thwarting rampant web-scraping and setting up walled gardens to protect their data from unscrupulous AI firms.

Unfortunately, this battle being fought in the high places could have an unintended outcome that affects all of us, even if we care nothing about AI or copyright. When the dust settles, the Internet that remains could well be radically different from what most of us grew up with.

A nod and a wink

Despite valiant – and sometimes even comical – efforts by AI firms to avoid talking about the provenance of their data, the reality of AI is an open secret to everyone involved in AI training. AI models need copious amounts of data, and we know that most get it primarily by taking them without asking.

Indeed, a 404 Media investigation published this week found that AI video generator Runway used hundreds of YouTube videos to train its latest Gen-3 model. A leaked internal document from an ex-employee listed thousands of YouTube videos and even pirated movies used as training data.

Ethical AI training is possible. AI Singapore created its Sea-Lion AI model by rejecting data brokers with data sourced from dubious or unknown sources, opting instead to forge partnerships with various organisations and institutions across the region to create Southeast Asia's first large language model.

Raising the drawbridges

In the meantime, drawbridges are being raised across the Internet. Reddit has started blocking major search engines and AI bots unless they pay – it currently has a partnership with OpenAI for an undisclosed sum and a US$60 million deal with Google.

Of course, the limiting of content was already happening before ChatGPT crashed the party, as publications pushed subscription services to stay financially viable. There is no question that AI greatly accelerated this trend, however, forcing media firms and online services to rethink their content monetisation and data strategies even more aggressively.

But surely individual websites are unlikely to stop AI bots from accessing their data? Not so, according to Cloudflare, a content distribution network giant. After an initial trial, it concluded that website owners don't like the idea of AI bots scraping their data. With that in mind, Cloudflare earlier this month made its automated blocking of website scrapping bots available for free.

Growing cracks and fissures

I remembered how the bulletin board systems (BBS) and online forums of my youth fascinated me. It was possible to spend hours exploring content spanning multiple topics and engaging in discussions with individuals from different walks of life.

The Internet eventually superseded that as it evolved into the enormous planet-spanning network we know today, offering an incredible array of democratised information and diverse insights from people from all corners of the globe.

Unfortunately, it might already have plateaued as the digital knowledge repository it grew into. Today, cracks are spreading along the entire edifice as it fragments into disparate silos of information, a rising tide of paywalls, and members-only communities. Where will it end?

The post-AI Internet

In the meantime, what will happen with generative AI? Make no mistake. The next generation of AI models will require an unimaginable amount of fresh data. And nascent efforts at creating "synthetic" data to meet the voracious appetite of AI models might be doomed to failure.

A new report published this week on Nature found that AI trained on AI outputs churns out gibberish. This finding isn't new, but it is the latest study that shows how using the outputs of AI models for training quickly devolves into a phenomenon pegged as model collapse.

It is somewhat ironic that the very rise of AI might well lead to its decline, as data sources shrivel or get locked away. After all, one of the core strengths of AI is its ability to aggregate existing information pools and generate new content birthed from human creativity and ingenuity. But with scant new sources of input, surely it will struggle to maintain its relevance and accuracy over time.

Or maybe not. Tech giants are using the tens of billions in their war chests to sign deals with publishers and content providers at a frenetic pace to gain access to new content created by humans. Because there can be no AI without it.

Yet no matter how it plays out, the Internet of tomorrow will probably be a radically different place for the rest of us.

It would be hard to miss CrowdStrike in the news lately. From downed check-in counters at airports to hospitals admitting patients manually, and even frozen car park gantry systems in Singapore, the impact was widespread.

As hundreds chime in and competitors issue statements that further cloud the issue, here's a deeper look at this black swan event from a technical and cybersecurity perspective. What actually happened, could this have been prevented, and what are the long-term repercussions for the IT industry?

What happened: One file, outsized repercussions

I first wrote about the CrowdStrike outage in a post yesterday. I noted how the issue was triggered by a faulty file in the Falcon Sensor component of its highly regarded Falcon platform.

The problematic file was pushed out as part of an automated update to customers globally, where it crashed millions of systems. Restarting the computer crashes it again, effectively causing a continuous restart loop.

Here are some details about Falcon Sensor and the fault:

• Falcon Sensor does fairly basic data collection, packages it up, and uploads it to the CrowdStrike cloud (~5-8 MB/day). The passive, data-collection nature of this module means crashes are unlikely to be caused by the mistaken identification of innocuous files as malware.

• Despite its name, CrowdStrike has confirmed that the *.sys file is not kernel-mode software but is used to provide channel updates. It is no malware definition file, but instructions on the monitoring of named pipes for possible abuse, which is used in Windows for interprocess communication.

• Sensational headlines aside, it doesn't appear that every Windows PC with Falson Sensor installed is affected. There is anecdotal evidence from users who went at the office expecting to tidy up their desks to find their PCs working just fine... and having to go back to work.

We can draw some conclusions from the above. For a start, CrowdStrike likely did the usual tests before releasing the update to its customers. There was no overt negligence, and everything was done according to established procedures with no indications that it would cause computers to crash.

Why can't it be fixed quickly?

The fix is relatively simple, and entails replacing the problem file. It is laborious, however.

- Sit down at PC and tap F4 on bootup to go into safe mode.
- Key in unique 48-digit BitLocker key*.
- Log in and replace offending file.
- Reboot and verify that it works.
- Repeat for each and every PC.

There are multiple solutions to reboot/manage PCs remotely. But they are pricey and must be set up ahead of time.

So almost everyone is fixing this manually.

*BitLocker is a Windows disk encryption feature used by businesses to protect onboard data. The decryption key is unique for every PC.

Could this have been prevented?

So how could a simple definition file have crashed everything? While CrowdStrike has yet to offer the detailed explanation for this unfortunate incident, technical experts have rolled up their sleeves and fired up their code debugging tools to dissect the Falcon Sensor software.

Below is one such analysis by Zach Vorhies, a former senior software engineer at Google. Vorhies attributes the crash to poor coding practices. Essentially, the program tried to read an invalid memory region, resulting in the process being killed by Windows.

https://x.com/Perpetualmaniac/status/1814376668095754753

Similar analyses by others have also pointed to poorly written software as the culprit. In essence, weak application security practices led to the software accessing memory it shouldn't have by accident, likely after encountering unexpected inputs from the file. The result is Windows stepping in to terminate the software as it was designed to.

But because the CrowdStrike software is likely running as kernel-level code and tightly integrated with the underlying operating system, Windows ended up performing digital fratricide on itself, triggering a BSOD, or blue screen of death. Upon rebooting, Falcon Sensor loads early as a privileged process, reads the accursed file, attempts to access memory it shouldn't and is promptly killed again. And so on.

This offers the likeliest explanation as to why the problem affected only Windows desktops and Windows server systems, but not other operating systems such as the macOS or Linux. It is at this point that we can probably discount the work of malicious insiders or any external cyberattack as the root cause of this incident.

Of course, this does lead to an uncomfortable question: What else could have been poorly implemented?

What now? Looking ahead

So what now? Will customers drop CrowdStrike and shift en masse to competing products? I personally consider this scenario extremely unlikely, though customers who are about to sign on the dotted line might ask harder questions now.

Existing customers might also question the wisdom of pushing out updates globally instead of doing a staggered release – even though most if not all cybersecurity vendors utilise the same strategy for non-executable file updates – and demand the ability to block or install them later.

Ultimately, CrowdStrike offers a comprehensive suite of offerings that compete successfully across multiple niches. Replacing it with equivalent solutions won't be easy or even possible in some cases, on top of the fact that cybersecurity products are known to be extremely difficult to switch.

What the incident revealed is the innate dangers of relying on the same cybersecurity platform for everything. After all, the debacle barely caused a ripple in China where few use CrowdStrike (or Windows for that matter) or firms that apparently are still on Windows 95.

According to a long-time cybersecurity executive who leads a team specialising in implementing cybersecurity strategies, such an error could have happened with any EDR (Endpoint Detection and Response) vendor.

Properly addressing these calls for the management of concentration risks, such as using different cybersecurity solutions to prevent a single flaw or vulnerability from bringing down the entire organisation. There is a cost here, and the onus is on cybersecurity leaders to find the right balance between resilience, operational overheads, and the budget.

For now, I would expect governments to start taking a greater regulatory oversight into the concentration of such risks, and forward-looking businesses to make a more conscious decision about the solutions that they deploy. There is no model response, except one that is informed and tailored to the specific needs and risk profiles of their organisations.

Life goes on, though the lessons learned from this incident will undoubtedly shape the future of cybersecurity strategies.

At least half a dozen data-centric studies from the last 12 months now confirm it: Freelance jobs that require basic writing, coding or translation are disappearing, reports The Wall Street Journal.

Specifically, the number of freelance jobs posted on Fiverr, and related platforms, has dropped as much as 21% in areas where generative AI excels. And data from Upwork show that pay from many of them has dipped precipitously to boot.

Job loss is a given

AI experts don't agree on much, including whether generative AI will lead to artificial general intelligence (AGI) or if the scaling law will keep working forever. But there's one that they all agree on: Jobs will be lost to AI.

Indeed, AI researcher and Stanford professor Fei-Fei Li said as much at the NetApp Insight conference in October last year. Some have called her the "godmother of AI" due to her groundbreaking research that advanced our understanding of deep learning – and which eventually led to ChatGPT.

Jobs will be impacted, Li conceded in a fireside chat with NetApp CEO George Kurian. She cautioned against the irresponsible use of AI and argued that AI should be used to augment humans, not replace them.

"I know jobs will change. Every profound technology has changed jobs; there will be pain. If we're not careful, we'll have social unrest. If we're not careful, we harm the most vulnerable people, whether they're women, children, people of colour, or people from different backgrounds," she said.

Canary in the coal mine

The WSJ piece cited a freelance copywriter who lost her financial adviser clients not long after ChatGPT made its debut. While all denied using AI, some did come back later with an unusual request: Could she help improve the copy they'd using AI to generate?

The impact is not just felt by writers. A freelance concept artist for TV and movies interviewed said his income in 2023 was less than half of his average year. According to him, jobs are drying up for artists, they are often given AI reference material to work from, or if they get jobs, are offered pay rates far below what is typical.

But surely freelancers don't represent the wider workforce? Well, according to the labour report published by the Singapore government in 2022, there are 257K freelancers in Singapore. This puts freelancers at slightly more than 10% of the resident labour force.

Moreover, freelancers matter for the simple reason that successful freelancers are specialists in niche domains. While most full-time positions are an amalgamation of multiple roles less easily replaced by AI, the technology will likely weaken the value of any given full-time role over time.

In that sense, the job prospects of freelancers represent the canary in the coal mine for the broader economy.

Time to start preparing

Proponents of AI are fond of saying that it's not AI that will replace jobs, but someone using AI. While it sounds reassuring at first blush, I don't expect semantics will matter much when entire industries are decimated or flipped on its head.

It's not all gloom and doom though: Some freelancers have reported that demand for their work is up for more demanding and specialised tasks.

I'm a realist. The generative AI genie is out of the box and there's no putting it back. Neither am I going to hide my head in the ground and wish everything away, though this might perhaps be influenced by the fact that retirement isn't an option for me now.

In my view, the only sane strategy is to read the tea leaves and act early to stay ahead of the curve. My plan consists of the following:

• Work with AI: We need to get better with AI, and the way to do that is to use AI extensively. Grab AI by its horns and plumbing its depths to work faster and smarter. Get to know its strengths and weaknesses; don't ignore AI or dabble with it for 5 minutes and call it a day.

• Plan ahead: The fact that high-value work remains should serve as an encouragement. We need to be extremely strategic and focus our efforts on high-value tasks and avoid those that are repetitive and mundane.

• Get even better: Make time to develop competencies beyond what AI can do. For me, this means writing every day, on top of my paying workloads. In a world of fast-food joints that can produce all sorts of burgers at the tap of a button, I want to be one of the few restaurants serving Michelin-level food.

The future of work will undoubtedly be shaped by AI. The key is to prepare for it now by continuously adapting and learning.

How are you preparing today?

Last week, I wrote that we are witnessing an unprecedented race for AI supremacy as tech giants rush to train ever larger, more powerful AI models. To win that race, they are deploying gargantuan clusters of AI systems and pouring billions into new power-intensive data centres.

There's a lot of pomp and spectacle for sure. But beyond increasingly strident warnings of impending environmental catastrophe, I imagine that most of us are simply wringing our arms and continuing with our lives.

Yet far from the maddening clamour at the frontlines of AI research (or fundraising), another battle of titanic proportions is happening. And this one should give you pause.

The hidden battle for your data

If GPUs are the modern-day equivalents of pickaxes and shovels in the current craze around generative artificial intelligence, then data is undoubtedly the fuel needed to power the engines. And the technology giants have just about finished strip mining all the available data on the Internet.

Actually, that's not an accurate statement, so let's try again. They have just about finished strip mining all available data on the Internet, including copyrighted media such as published books and online articles, YouTube videos protected by terms of service, and a plethora of other high-quality sources.

According to a report in the New York Times, companies like OpenAI, Meta, and Google had cut corners in their quest to harvest enough data for their AI models. Indeed, OpenAI's Whisper AI model, an automatic speech recognition service, was purportedly created to pilfer YouTube videos. (I highlighted key details from the Times report here.)

In case there is any doubt left, Mira Murati, the CTO of OpenAI was earlier this year caught in an awkward moment with The Wall Street Journal over Sora, OpenAI's jaw-dropping, unreleased text-to-video model. When asked about the source of Sora’s training data in a video interview, Murati replied: "We used publicly available data and licensed data.”

But when pressed if that included videos on YouTube, she fumbled and made a remark that many saw as a confession: "You know, if they were publicly available, publicly available to use... but I'm not sure. I'm not confident about it.” She then backpaddled: "I'm actually not sure about that."

Feeding the insatiable appetite of AI

The reality of AI is an open secret to everyone involved in AI training: Generative AI models need a vast amount of data. The more diverse and accurate the data, the better the performance of the resulting AI models. And guess where the best, highest-quality data are? Hint: It's probably not your midnight Facebook ramblings but the copyrighted works of the world.

Unsurprisingly, the conglomerates and multi-billion-dollar AI startups have been locked in a constant hunt for more data since ChatGPT burst onto the scene. And while Twitter (Now "X") was among the first to shut off free access to its API in February 2023, every online service has been tightening its service terms or shutting down the spigot of free access to data via API. Not that the former matters when Internet data is often scrapped without asking.

It's easier to beg for forgiveness than to ask for permission, right? I mean, just ask Scarlett Johansson and her feelings towards OpenAI right now.

When I spoke with Dr Leslie Teo, senior director of AI Products at AI Singapore, in April this year about the rampant misuse of data, he told me his team was not unaware of "what others are doing." And he should know: He helms the project to train SEA-LION, an AI model designed for the Southeast Asian region.

Instead, the AI Singapore team took great pains to source their data ethically. Dr Teo had personally turned away data brokers offering to sell high-quality data sourced from dubious or unknown sources. I can only imagine these data brokers are selling because there are people on the market who are buying.

There is a cost for setting the bar high, however. "We pay a price... our models will not be as good," he said.

The end of data naivety

If we believe estimates by research institute Epoch, tech companies could run through the high-quality data on the Internet as soon as 2026. That's barely 18 months from today.

For now, the tech giants are signing deals with publishers left, right, and centre to gain access to more content, or quality data. For instance, OpenAI earlier this week signed a deal with News Corp to access new and achieved material from its portfolio of companies such as The Wall Street Journal, The New York Post, MarketWatch and Barron’s.

Beyond the niceties in the press statements over each deal, there is a nuanced strategy around putting past infringements to rest, access to fresh content, and gaining a leg up over rival AI firms. For publishers, money in their bank accounts today is infinitely better than a costly, protracted court battle and an uncertain outcome. Honestly, how does an outsider prove that an AI firm has stolen its content anyway?

Elsewhere, Google, and now OpenAI have signed a deal to access real-time content from Reddit’s data API. And numerous deals are happening right now as the scramble for gated quality content heats up.

What next? Will they come for your personal data? As of May 2024, this sounds implausible. However, there are some troubling signs. For instance, Google has already apparently broadened its terms of service to let it tap publicly available Google Docs for its AI products, though it denies having done that. (Read: "Yet")

Just the other day, I noticed that ChatGPT now offers a handy interface on my Plus account to connect Google Drive and OneDrive accounts to help me manage my information in ChatGPT. What a potentially useful feature...

You know what they say these days: If you are not paying for an online service, then you are the product. In 2026, you might have to pay to ensure your data stay unmolested.