Drone strikes on data centres mark a shift in disinformation warfare

A physical address for an abstract enemy

Disinformation has always felt untouchable. It lives in the air between servers, in algorithms too opaque to dissect, in networks of bots that appear everywhere and nowhere. You could ban a troll factory, remove a fake account, or sanction a disinformation outlet — but the phenomenon itself resisted conventional targeting.

Ukraine’s recent drone strikes against Russian data centres suggest that disinformation has a physical address after all. The strikes on facilities belonging to Sberbank, Russia’s largest bank, and Yandex — the country’s closest analogue to Google — represent something structurally new: the deliberate targeting of the hardware that powers an adversary’s information ecosystem.

Whether or not Yandex’s subsequent 94 percent traffic collapse meaningfully reduced Russian disinformation, as President Volodymyr Zelensky claimed, is secondary. The precedent matters more than the outcome. Disinformation infrastructure is now visible enough to bomb.

What actually broke

Yandex operates email, search, navigation, music, ride-hailing, marketplace, and financial services. When its data centres were struck, much of that vanished simultaneously. Users in Russia experienced extended outages across multiple platforms at once. This was not a surgical cut to a single disinformation network — it was a blunt strike against a digital ecosystem that millions rely on daily.

Zelensky framed the impact in political terms, saying the strikes made it “easier to breathe on many social media platforms” by reducing bot activity. Independent analysts and later reports have cast doubt on the extent of any disinformation reduction. Either way, the message was deliberate: Ukraine is treating information warfare as a material campaign, not just a rhetorical one.

Russia’s sovereignty problem

The vulnerability exposed by these strikes is no accident. It is the direct consequence of a decade-long Russian project called “digital sovereignty” — the idea that the Kremlin should control the infrastructure of information flow within its borders.

Laws passed in 2015 required certain categories of personal data to be stored on servers physically located in Russia. After the full-scale invasion of Ukraine in 2022, international sanctions made it nearly impossible for Russian companies to maintain backup infrastructure abroad. The strategy was meant to shield Russia from Western surveillance and censorship. Instead, it created a集中的 point of failure.

Over 100 data centres operate on Russian territory, but most lack meaningful redundancy. Rebuilding capacity will be slow. Russia already depends on China for advanced semiconductors, and any further disruption to that supply chain — whether through sanctions enforcement, export controls, or direct action — could deepen the damage for months or years.

A pattern already repeating

Russia is not the first country to see its data centres used as battlegrounds. Earlier this year, Iran struck data centres in the United Arab Emirates and Bahrain, targeting facilities operated by Amazon Web Services. The strikes degraded services over an extended period and caused irrecoverable data loss in some cases — even though cloud providers design their networks with geographic redundancy precisely to survive single-site failures.

The Iranian and Ukrainian strikes share a logic: if your adversary’s influence flows through physical infrastructure, you can disrupt that influence by destroying the infrastructure. The difference is that Iran’s targets were foreign-operated, while Ukraine’s strikes hit domestically owned Russian facilities — making the legal and normative questions sharper.

Why this matters beyond Ukraine

The most important implication of these strikes is not what they reveal about Russia, but what they normalise globally. Once a state demonstrates that data centre attacks can achieve strategic information effects, other governments will watch carefully. Authoritarian regimes will assess whether their own reliance on concentrated digital infrastructure leaves them exposed. Democracies will consider whether this is a tool worth developing.

Australia’s experience with the 2023 Indigenous Voice referendum illustrates the kind of influence operation that could become vulnerable to this approach. Campaigners did not spread outright lies — they amplified plausible competing narratives to deepen political division. Russia’s methods around the world follow a similar pattern: the goal is often not to convince people of a specific falsehood, but to erode trust in institutions broadly.

These operations still run on servers. They still require bandwidth, storage, and content delivery networks. That dependency is now a liability in ways it was not a few years ago.

What democracies should learn

The strikes offer a reminder that Russia’s information empire is materially fragile. It rests on a domestic platform ecosystem deliberately severed from the global internet, on a shrinking pool of physical infrastructure, and on a semiconductor supply chain that runs through a single partner.

Counter-disinformation policy in democracies has largely operated in the abstract — content moderation, platform regulation, media literacy programs. None of those are wrong, but they assume the battle is fought in the realm of ideas. Ukraine’s strikes suggest the battle can also be fought in the realm of concrete things: cables, chips, cooling systems, power supplies.

That does not mean democracies should seek to replicate drone strikes on foreign data centres. The legal, ethical, and escalatory risks are substantial. But the underlying principle deserves serious consideration in policy circles: information resilience is not only a software problem. It is an infrastructure problem.

Digital sovereignty, properly understood, does not come from isolation. It comes from distributed redundancy, robust governance frameworks, and strategic alliances that keep critical systems running under attack. Russia mistook control for resilience. Ukraine is proving that control without backup is just a bigger target.

The question for every government now is whether it has been building sovereignty — or merely constructing a larger data centre.