~Technology

Why Artists Are Running Their Own Data Centers

In Linz, a cultural association runs servers the way printmakers run presses. A new browser attack called FROST, which reads your activity through SSD timing, shows why that matters: when artists configure the stack themselves, privacy becomes a design question they can answer.

Photo by Tyler (unsplash), Edited/Rendered by gpt-image-2

There is a server humming in Linz, Austria, that has quietly hosted net art, free software experiments, and community broadcasts since the mid-1990s. It belongs to servus.at, a cultural association that treats infrastructure the way other artist collectives treat darkrooms or kilns: as a medium. In 2024 they published a small book, Artists Running Data Centers, edited by Davide Bevilacqua: 96 pages, English, ISBN 978-3950420036. The book documents a conviction gathering momentum at the edges of digital culture: the rack, the VM, and the cooling fan can be studio space.

That premise sounds modest until you sit with it. Most of what we call “the cloud” is a handful of hyperscale facilities owned by four or five corporations, optimized for advertising telemetry and machine learning workloads. To say artists should run their own data centers is to say the substrate of digital life, the place where bits live, deserves the same scrutiny, care, and aesthetic attention we give to museums, theaters, and printing presses.

From Artist-Run Centers to Artist-Run Racks

The artist-run center is a well-established institution. An ARCA video hosted on Vithèque, the Quebec moving-image platform, describes such centers as “an essential part of the wider arts system,” a professional network supporting artists at every career stage. Eastern Bloc in Montreal has done this for digital art specifically since the late 2000s. Icebox Project Space in Philadelphia stretches the model into industrial-scale rooms where film, sound, and performance can coexist without the white-cube grammar.

Servus.at and its collaborators propose the next logical extrusion of this lineage. Their ARDC#0 program defines an Artist Run Data Center as “a series of virtual machines (VMs) within the server cluster that artists and collectives use as an experimental production space.” The VM becomes the studio. The hypervisor becomes the building superintendent. The terms of service become the lease, and, crucially, the artists write the lease themselves.

This matters because almost every other surface of online creative life now runs on infrastructure whose incentives diverge sharply from the artist’s. When your work lives on a platform, the platform makes the logging, fingerprinting, and monetization choices for you. When your work lives on a server you operate with peers, those choices become design questions you can answer.

FROST and the Politics of the Drive

To understand why this autonomy is more than symbolic, consider a piece of news from late May 2026. Researchers at Graz University of Technology unveiled a browser-based side-channel attack they called FROST: Fingerprinting Remotely using OPFS-based SSD Timing. The technique, covered in detail by sources you'll find in the links below, lets a website infer what other websites and applications a visitor is running by measuring how long an SSD takes to respond to reads issued through the Origin Private File System, a standard browser API.

The mechanism is elegant in the way all good side-channel work is elegant. Beneath the featureless rectangle of its marketing, an SSD carries controllers, garbage collection, wear-leveling routines, and caches, each producing subtle, measurable latency signatures depending on what else the drive is doing. A few lines of JavaScript, no special permissions required, can read those signatures and reconstruct a partial profile of your machine’s activity. As HotHardware put it, “no moving parts does not mean no security vulnerabilities.”

FROST joins a longer history of storage-as-surveillance concerns. TechTarget has written about decommissioning hazards in SSDs since 2018, and more recently about vendors embedding AI directly into drive controllers for performance and security telemetry. Researchers have also explored baking malware detection into SSD firmware itself. The drive, in other words, is becoming an active observer of the system it serves: sometimes on your behalf, sometimes not.

Why Infrastructure Needs Authors

This is where the artist-run data center stops being a curatorial conceit and starts being a privacy argument. If a standard web API can coax behavioral data out of the storage layer, the question of who configures the stack becomes the work itself.

A commercial host has little reason to disable OPFS, to deploy unusual scheduler settings, or to publish exactly which mitigations run against which side channels. A collective running its own cluster does. Servus.at and its peers can choose filesystems, kernel parameters, and browser policies as deliberately as a printmaker chooses paper. They can document those choices in a 96-page book. They can invite other artists to fork the configuration. The infrastructure becomes legible, and legibility is the precondition for critique and care alike.

There is a creative dividend here too. When the substrate is editable, artists begin making work about the substrate. Performances scheduled around the thermal cycles of a particular rack. Generative pieces that sonify garbage collection events. Net art that refuses to load on any browser running the OPFS attack surface. The medium and the message converge in a way a hyperscaler tenant rarely permits.

The Commons Has Hardware

The phrase “creative commons” has drifted, over two decades, into meaning mostly a set of copyright licenses. The original ambition was larger: a shared cultural infrastructure the public could use, modify, and steward. Artist-run data centers attempt to drag this ambition back down to the metal. They insist a commons without hardware is a commons that rents its existence from landlords with different priorities.

None of this scales to replace AWS, and nobody involved pretends otherwise. The ARDC model is closer in spirit to a community darkroom or a maker space than to a competitor. It offers proof, in working code and humming fans, that another configuration is possible: storage, compute, and network arranged around artistic and civic values.

Browser vendors will patch FROST. Researchers will discover another side channel. The drives in our laptops will keep getting smarter, more opinionated, more entangled with the software stacks above them. Infrastructure has always had politics. The useful question is whether people whose first instinct is to make something beautiful, legible, and shareable are shaping any of it. In a few server rooms in Austria, Montreal, and Philadelphia, they are. A small fact, and an encouraging one.