1. Strikes on Russian Data Centres
In recent days, Ukraine dramatically altered the landscape of modern warfare by launching drone strikes against Sberbank’s largest data centre in Russia, following a series of attacks on three data centres owned by Yandex, the technology giant often described as “Russia’s Google.” The strikes were not merely symbolic; they caused immediate and severe disruption across the Russian digital ecosystem. Yandex’s traffic reportedly dropped by 94 percent, and millions of users lost access to essential services including email, search, navigation, music, ride hailing, online marketplace, and financial products. For a society deeply integrated into digital platforms, the impact was comparable to a sudden blackout of the internet itself. Ukrainian President Volodymyr Zelensky welcomed the attacks, saying they had made it “easier to breathe on many social media platforms” by reducing Russian disinformation and bot activity. Later reports, however, have cast doubt on whether the strikes actually diminished bot operations or simply displaced them. Regardless of the immediate tactical outcome, the incident has drawn attention to a fundamental but often overlooked truth: the digital world is anchored in physical infrastructure. It has also reignited debate about what “digital sovereignty” truly means in an era of globalised data flows and interconnected systems, and it has suggested a radical new approach to countering disinformation: attacking the hardware that carries it.
2. Data Centres as Strategic Military Targets
Data centres have traditionally been considered unconventional military targets, but that calculation is changing as their strategic importance grows. They now host not only civilian applications but also military logistics, communications, intelligence, and financial systems. By striking such facilities, an adversary can disrupt an enemy’s military operations while simultaneously degrading ordinary services on which the civilian population depends. In Russia, these disruptions may have long-term economic consequences, slowing productivity and undermining the state’s ability to sustain a prolonged war. Ukraine’s strikes did not occur in a vacuum. They followed Russian attacks on Ukrainian data centres and internet service providers, which had already established a precedent for treating digital infrastructure as a legitimate target. There is also an international precedent: earlier this year, Iran struck data centres in the United Arab Emirates and Bahrain in response to American attacks. Those data centres were operated by Amazon Web Services, the world’s largest cloud computing company, with facilities around the globe. Under normal circumstances, data centres are designed with redundancy and backups to ensure that losing a single facility does not cause permanent damage. Yet the Iranian strikes resulted in long-term service degradation and irrecoverable loss of some data. Russian data centres, by contrast, may have far fewer options for international redundancy. This is due in large part to Moscow’s aggressive pursuit of “digital sovereignty,” which has isolated Russian infrastructure from global networks and made it more vulnerable to precisely this kind of physical attack.
3. Russia’s Digital Sovereignty and Its Costs
The concept of digital sovereignty is not inherently problematic. The idea that nations should have autonomy and control over their own digital data and infrastructures is a sound one, particularly for developing countries that fear exploitation by larger powers. However, Russia’s interpretation of sovereignty has been used to justify censorship, surveillance, and the isolation of Russian users from global internet services. In 2015, Moscow passed laws requiring certain data to be stored locally, and it has since built an elaborate domestic internet ecosystem designed to function independently of the outside world. These measures were intended to shield the country from foreign influence and cyberattacks, but they also created a closed and centralised system. When international sanctions were imposed after Russia’s full-scale invasion of Ukraine in 2022, the country’s ability to maintain backup infrastructure abroad was severely limited. Sanctions restricted access to Western cloud providers, semiconductors, and other critical technologies. As a result, Russian data centres now operate with fewer safety nets. The concentration of digital services in a relatively small number of physical sites—such as the Sberbank and Yandex facilities—creates a single point of failure. Once this infrastructure is damaged, rebuilding is slow and difficult, especially because Russia is now reliant on China for advanced semiconductors, a supply chain that is itself subject to pressure and disruption. The recent strikes exposed this vulnerability in stark terms, demonstrating that the pursuit of digital sovereignty through isolation can produce exactly the opposite of resilience.
4. Disinformation and Influence Operations
Disinformation and influence operations are central to understanding why these attacks matter. Disinformation is often defined as the strategic spreading of deliberate falsehoods, and governments have traditionally tried to fight it by removing or debunking false content on the platforms where it circulates. But influence operations work in many different ways. Not all of them propagate falsehoods; in fact, many of the most effective ones aim to undermine public trust and delegitimise democratic processes and institutions. In Australia’s 2023 referendum on an Indigenous Voice to Parliament, for example, campaigners generated plausible competing narratives to exacerbate political polarisation, making it harder for citizens to reach a reasoned consensus. In New Zealand, influence operations have involved avalanches of misogynistic abuse intended to derail public support for policy initiatives. Russia is well known for its orchestrated interventions in democratic politics around the world, often seeking to sow dissent, distrust, and dismay, and sometimes supporting candidates with pro-Russian stances. Civil society and activist communities have developed creative approaches to tackling this problem, including debunking, prebunking—pre-emptively countering false claims—reporting misleading content to platforms, and strategically using humour and memes. But the data centre strikes suggest a more direct, physical approach. Because Russian internet services, including influence operations, depend on physical infrastructure, targeting that infrastructure may be an effective way to contain disinformation at its source, even if the immediate effects are difficult to measure. The recent attacks on Sberbank and Yandex could therefore be seen as a form of pre-emptive self-defence by Ukraine, aimed at degrading Russia’s offensive cyber capabilities.
5. A Vulnerable Digital Ecosystem
The vulnerability of Russia’s digital infrastructure is broader than the recent headlines suggest. There are over 100 data centres operating on Russian territory, and few of them have robust backups and resilience plans in place. The very policies designed to ensure digital sovereignty have made the country more fragile, not less. Concentrating all digital operations in a relatively small number of physical sites means that a single well-aimed strike can knock out services used by millions of people. Rebuilding requires not only time and money, but also access to technology that sanctions have restricted. This has implications for the Kremlin’s ability to project influence abroad. If Russian platforms are repeatedly disrupted, their capacity to coordinate bot networks, spread propaganda, and manipulate foreign audiences may be significantly reduced. Whether or not Zelensky’s claim about reduced bot activity is accurate, the strikes have demonstrated that the infrastructure of disinformation is not invulnerable. They have also prompted discussions about additional measures, such as imposing physical or regulatory limits—including sanctions—on Russian-based platforms and services such as Telegram. International cooperation will be essential to undermine Russia’s capability to inflict harm in the digital environment, and this may include supporting Ukraine’s efforts on the battlefront through bilateral security agreements. The data centre attacks are a reminder that Russian internet services, including influence operations, depend on physical infrastructure, and that targeting the physical sources of disinformation may still be an effective way to contain it.
6. Lessons for Democracies
The lessons for democracies are profound. The recent events have shown that Russia’s digital influence relies extensively on physical infrastructure: data centres, scarce semiconductor materials, and a domestic platform ecosystem that has been splintered from the worldwide web. As the Kremlin continues to isolate itself in the name of sovereignty, it is also becoming more vulnerable to attacks and disruptions. This is a paradox that authoritarian regimes often fail to recognise: walls meant to keep threats out also trap threats inside. Democracies, by contrast, can draw a different lesson. Digital sovereignty is not achieved through isolation and vertical control over digital infrastructures. Instead, it is constantly negotiated through geographically distributed backups, frameworks for risk and governance, and strategic alliances that keep critical systems running and make them resilient to attacks. The Ukrainian strikes on Russian data centres were a military operation, but they were also a demonstration of the physical nature of the internet. In the years to come, nations will need to rethink how to protect their own digital infrastructure while also holding adversaries accountable for weaponising the digital domain. The answer is not to build higher walls, but to build more robust, redundant, and cooperative systems. The events in Russia have made clear that the online world cannot be separated from the physical world, and that any strategy for digital defence must account for the vulnerability of the machines and cables that carry our data. This is a lesson not only for Moscow, but for every government, company, and citizen that depends on the internet.