Ukrainian drones hit Russia’s largest data center on Wednesday. This was Ukraine’s fourth strike on Russian data centers in the past week and confirmation of a new reality of war: data centers are valuable enemy assets and they will be targeted.
In 2006, British economist Clive Humby declared “data is the new oil,” and big tech adopted the metaphor. Twenty years later, a dark side of the truism has been revealed. If the places where oil is refined are valuable targets in a war then so, too, are the places where data is refined. We’ve seen this not just in the Russia-Ukraine war, but also with Iran hitting Amazon Web Services data centers in Dubai in retaliation for America’s strikes on the country.
Ukrainian President Volodymyr Zelenskyy confirmed strikes on Russian data centers and oil refineries in a post on X and called them a “symmetrical response” to Russian aggression. Here we have oil and data together again, not as a metaphor in an economics lecture, but in the pronouncement of a world leader defending his country. conducting a war.
Three of Ukraine’s strikes hit data centers that belonged to Yandex, Russia’s Google-equivalent, and damaged the company’s supercomputers that housed some of its AI models. The latest attack hit a data center operated by Sberbank, Russia’s largest bank. It’s too early to tell what the effects of the strike on the Sberbank data center will be, but the three strikes on Yandex have disrupted internet and communications across Russia.
An online rumor said that the strikes on Yandex had the effect of taking down Russian bot farms, but this wasn’t true. The effects of the strikes on the civilian population were much more severe. Yandex is ubiquitous in Russia — it has its own app store, payment services, dating services, taxi and bus apps, and email services. The company operates six data centers in Russia and the strikes knocked two of them offline completely. People in Russia have lost access to their email, some of their data is seemingly gone, and taxi and bus apps only work intermittently.
ChrisO_wiki, an anonymous researcher who translates Russian social media posts for the western web, chronicled how the Yandex outages are hitting everyday Russians. “A taxi driver from Yekaterinburg says that after the service disruptions, he can no longer view his order history, and the status of trips is updated with a delay,” ChrisO_wiki said in a post on X and Bluesky.
“The loss of Yandex’s cloud services is also having severe impacts on Russian commercial logistics. Those who work with electronic document management are unable to register incoming goods, severely affecting manufacturers and distributors,” they said in another post.
These attacks are just the latest in a long line of strikes on data centers this year. Russia has been targeting Ukrainian data centers for months and Iran hit AWS data centers in Dubai in March, knocking out digital infrastructure in the Middle East.
Klaudia Klonowska, a researcher who studies the effects of emerging technologies on international law, told 404 Media that attacks on data centers are so new that international law around them is still developing. “You have very limited situations in which they would actually qualify as lawful targets when they’re used by the military, and even then, it’s very difficult for the attackers to know whether that’s happening or not,” Klonowska said.
If the data centers are purely processing military data, then they could be legitimate targets, according to Klonowska. But many, if not most, data centers are dual-use, meaning they house both civilian and military data. In many cases, disrupting daily life seems to be part of the point.
When Russia struck data centers in Ukraine in September, state-backed news agencies claimed it hosted data for Palantir that supported Ukrainian intelligence efforts and was a lawful target. Ukraine denied the allegation. “So you see how difficult, because of the nature of these centers, it’s really to pinpoint what is happening with them and who is using them and for what means,” Klonowska said. “Sometimes [Ukraine] mentions that these data centers contribute to Moscow’s revenues that then fuel the war machine. But that’s not enough to make them lawful targets. Retaliation is not enough under law.”
Klonowska noted that it is civilians who suffer most, not the military, when data centers go offline. “There are questions about proportionality given how widespread the attacks are,” she said. “A lack of internet access for very prolonged periods affects everything. It’s all of the civilian services that are being disrupted, which you can imagine also includes things like hospitals, traffic, judicial services, etc. etc.” It’s worth noting that Russia has repeatedly attacked civilian targets in Ukraine, including apartment buildings, public transportation, and hospitals.
According to Klonowska, international and humanitarian law needs to catch up with the issue and that scholars like herself are only just starting to understand the ramifications. “I think there’s also another bigger question behind all of this,” she said. “Why have we gotten to the point where we have permitted militaries of various states to use civilian commercial data centers for their military purposes? By potentially using them and relying on them, they have opened them up to the possibility of becoming military targets.”
Disentangling civilian and military data probably won’t take data centers off the target list, but it will make international law more clear on which buildings are legitimate targets. It may also change how data centers processing military data are built.
“France has recently announced that they have unveiled their underground data center on the outskirts of Paris that will be exclusively for military use,” Klonowska said. “Just as we expect them not to use schools or hospitals or other civilian residential areas to host weapons or other military equipment, we would, I think, increasingly need to mention this in the case of data centers.”
The idea that a data center might be a military target is not lost on the American communities facing construction of them in their backyards. America’s nuclear weapons scientists at Los Alamos National Laboratories (LANL) have partnered with the University of Michigan in an attempt to build a data center in Ypsilanti Township, Michigan. The people and government of the Township aren’t thrilled about it for a number of reasons and the city attorney has said that the data center would be a “high value target” in wars of the future. Los Alamos pushed back on this in a letter to the community in September, around the same time Russia was striking data centers in Ukraine. LANL accused the township attorney of creating “that terminology without basis. It should not be interpreted as evidence of a known, specific, or imminent threat to the facility or the surrounding community,” the letter said.
“Like other major research facilities, the center would employ appropriate security measures, including controlled access, cameras, and on-site security personnel,” it said. “Los Alamos and U-M would coordinate with local, state, and federal partners on matters related to safety and security.”
It’s easy to see where the people of Ypsilanti Township are coming from. When Ukraine struck three Yandex data centers in Russia over the weekend, its drones slipped past Russia’s air defenses. The idea that a town next to a data center, especially one with ties to America’s nuclear weapons programs, could sustain damage if the data center was ever attacked isn’t unfounded. The data centers smoldering in the world’s war zones proved that the township’s fears aren’t theoretical.
