The ongoing Russo-Ukrainian war has mixed the digital and the kinetic in unprecedented and often terrifying ways, including widespread use of suicide drones, software orchestration of the front lines, and the weaponization of commercial ad data. So it’s hardly surprising that Ukraine has struck data centers run by Russia-based tech giant Yandex (sort of a Facebook/Google/Uber hybrid) three times in the last few days. The most recent strike, on Oct. 11, reportedly completely disabled a facility in the Vladimir region east of Moscow.
The result was widespread outages of Russian internet services, both within and outside the country. According to Ukrainian President Volodymyr Zelenskyy, the result was also to near-instantly silence armies of pro-Russian troll bots on social media.
“When we started responding to Russia’s operation against our data centers and when our strikes reached Yandex data centers, it suddenly became a little easier to breathe on many social media platforms,” Zelenskyy told attendees at the Warsaw Security Forum by video link, according to Euronews.
“A lot of people, a lot of people noticed it, and there was less hate, less division and fewer provocations because there were fewer bots,” he added. “And it’s pretty clear where those bots were coming from… If they disappeared when Yandex went offline, this proves again and again that Europe is not the source of the problems.”
Euronews noted that Cloudflare data did appear to show a huge decrease (94%) in automated traffic originating from Yandex on Sunday compared to the average throughout the second half of September. That said, automated traffic is a huge umbrella that includes everything from search crawlers to uptime-monitoring tools.
Euronews also noted that social media users in other countries, like Germany, the UK, and US, also claimed to witness a decrease in bots; this was apparently based on vibes. Online “prediction market” Polymarket also tweeted that “Activity on several major U.S. political subreddits plunges following attacks on Russian data centers,” though that assertion didn’t come with evidence.
Insisting that online rivals are secretly bots is a time-honored posting tactic, one of the few bipartisan ones left—it’s pretty hard to find a front-page Reddit thread that doesn’t have at least a couple comments insisting that “the bots are really out today.” Radio Free Europe/Radio Liberty (RFE/RL), a U.S. government-funded broadcaster that primarily serves foreign audiences, noted that technical experts have pointed out the supposed drop in automated traffic is from Yandex’s own search crawler hitting websites with AS13238 HTTP requests. As a result, it does not indicate anything about the broader volume of Russian internet traffic or what it contains.
Finally, that stat only accounts for Russian web traffic that’s already been categorized as automated. Russian cyber adversaries would presumably make at least some kind of cursory effort to obfuscate their traffic, including by locating hosts in other countries where the traffic is less likely to be recognized as Russian in the first place.
Some of the claims appear to conflate data centers with Russian “troll farms” such as the Internet Research Agency (IRA), which became well-known following a 2015 expose. The IRA operated out of a St. Petersburg office building, not a datacenter operated by Yandex. Nor does there appear to be any particular reason the IRA would require an inordinate amount of network resources.
In reality, facilities like the IRA’s or scammer compounds in Myanmar are usually described as operating more like clickbait factories or digital sweatshops than sophisticated, high-tech operations. In other words: cheap labor and automation. One Latvian influence operation that specializes in MAGA content for U.S. conservatives reportedly pays subcontractors in poor countries across the world to clip videos.
That said, the wide range of Russian services forced offline by the strikes (video streaming, banking, apps, and various websites, according to Ars Technica) presumably hobbled all kinds of activities, including posting. Yandex Go, a taxi-hailing and delivery app, was still having disruptions in “Armenia, Belarus, Kazakhstan, Kyrgyzstan, and Uzbekistan” into Monday, according to RFE/RL.
“Following a drone attack, the infrastructure of the Vladimir data centre was damaged,” Yandex said in a statement on Telegram, according to Euronews. “Operations at the data centre have been completely suspended. The remaining infrastructure resources are unstable and the platform is down.”
