In recent days, the strange and shadowy world of cyberwarfare suddenly became very physical. Ukrainian drone strikes hit Russia’s largest data centre, a massive facility owned by Sberbank, the country’s biggest bank and technology company. This came right after Ukraine had already struck three data centres belonging to Yandex, the tech giant often called “Russia’s Google.” The impact on ordinary life in Russia was immediate and severe. Yandex’s traffic reportedly plunged by 94 percent, meaning millions of people suddenly found their email, search, maps, music, ride-hailing, marketplace and even financial services either broken or frozen. For a few days, the digital routines that we all take for granted simply stopped working for many Russians. Ukrainian President Volodymyr Zelensky claimed that these strikes had made it “easier to breathe” on social media platforms, suggesting that Russian disinformation and bot activity had been reduced. Later reports cast doubt on that claim, but the episode still did something important: it reminded us that the internet is not a magical cloud floating above our heads. It runs on physical buildings, cables, servers, and electricity. When those are hit, the online world wobbles. And that simple truth raises deeper questions about what “digital sovereignty” really means, and whether attacking infrastructure might be a new way to fight disinformation.
Data centres are not the kind of target military planners once thought about. They are not tanks, ships, or ammunition depots. But that may be changing as these facilities become the backbone of modern life and modern warfare alike. A data centre can hold the command-and-control systems of an army, the logistics of a government, and also the everyday services used by civilians—banking apps, health records, messaging, and news. When you attack a data centre, you can disrupt an enemy’s military operations, but you also disrupt the lives of ordinary people. In Russia, these disruptions could slow down the economy in the long run, which would hurt the country’s ability to continue fighting its war in Ukraine. The Ukrainian strikes did not happen in a vacuum. Russian forces had already attacked Ukrainian data centres and internet service providers, so there was a sense of retaliation and reciprocity. There is also a worrying precedent from earlier this year, when Iran hit data centres in the United Arab Emirates and Bahrain in response to American attacks. Those particular centres were run by Amazon Web Services, the world’s largest cloud computing company, with facilities spread across the globe. Normally, data centres are built with redundancy and backups so that losing one facility does not cause permanent damage. But even with those safeguards, the Iranian strikes caused long-term degradation of services and some irrecoverable loss of data. For Russia, the situation is likely worse, because Russian data centres have far fewer options for international backup. This is not an accident. It is the result of a deliberate vision of “digital sovereignty” that Moscow has promoted for the past decade.
The idea of digital sovereignty is not inherently bad. In fact, the principle that a nation should have autonomy and control over its own digital data and infrastructure sounds reasonable. Governments want to protect citizens’ privacy, secure critical systems, and ensure that foreign powers cannot easily disrupt their networks. But in Russia, the pursuit of sovereignty has taken a darker turn. It has enabled censorship, isolation, and a tightening grip over online information. Starting in 2015, Russia passed laws requiring certain data to be stored locally. Then, after Russia’s full-scale invasion of Ukraine in 2022, international sanctions further limited Russia’s ability to maintain backup infrastructure abroad. The result is a kind of digital fortress—but fortresses are also traps. When you put all your precious data inside a few walls, and then those walls are bombed, you have nowhere to go. You cannot simply switch your traffic to a friendly data centre in another country, because you have spent years building rules and systems to keep foreign data out. You have also scared away or been cut off from the global technology supply chains that could help you rebuild quickly. So while Russia tried to make itself sovereign and independent, it actually made itself more vulnerable. The recent drone strikes exposed this fragility in the most concrete way possible. A country that wanted to be a self-contained digital island discovered that an island can be blockaded, shelled, and starved.
Disinformation is often talked about as if it were simply a matter of false stories spreading online. Governments try to fight it by removing or debunking those stories, hoping that the truth will eventually win. But influence operations are much more complicated than that. Not all of them spread outright lies. Many of them are designed to erode public trust, to make people cynical about institutions, and to delegitimise democratic processes. Sometimes they do this by amplifying plausible but misleading narratives, or by flooding social media with harassment and abuse so that ordinary people switch off. We saw this in Australia during the 2023 referendum on an Indigenous Voice to Parliament, where campaigners generated competing narratives that worsened political polarisation. We saw it in New Zealand, where influence operations involved avalanches of misogynistic abuse aimed at derailing public support for policy initiatives. And of course, Russia is well known for its orchestrated interventions in democratic politics around the world. The goal is usually not to convince people of one particular idea, but to sow dissent, distrust, and dismay—to make people feel that everything is broken and that nothing can be trusted. Civil society groups and activists have developed creative ways to push back, including debunking false claims, prebunking them before they take hold, reporting misleading content to platforms, and using humour and memes to deflate harmful narratives. But these efforts are often reactive and exhausting. What the recent data centre attacks suggest is a different, more physical approach: if disinformation runs on servers, then perhaps you can fight it by cutting off the power to those servers. Whether or not Zelensky’s claim of reduced bot activity was accurate this time, the logic is compelling. Disinformation is not pure spirit. It lives in machines, and machines can be switched off.
That is exactly why the physical vulnerability of Russia’s internet matters so much. There are over a hundred data centres operating on Russian territory, but very few of them have robust backups and resilience plans in place. This is not just because of poor planning; it is a consequence of the regime’s own choices. When you concentrate all digital operations in a relatively small number of physical sites, you create a single point of failure. Once that infrastructure is hit, rebuilding is slow and difficult. Russia depends on China for advanced semiconductors, and even that relationship has limits. Sanctions have cut off many sources of high-tech equipment. Skilled engineers may be leaving the country or unable to access Western technology. The result is that a few well-placed strikes can cause cascading failures across the entire digital ecosystem. For ordinary Russians, this means broken services and lost data. For the Russian state, it means a less effective military and a more frustrated population. And for the rest of the world, it means that the digital influence operations which have caused so much trouble in democratic countries might be interrupted at the source. Attacking data centres is a violent act, and it raises serious ethical concerns because civilians are often collateral victims. But from a strategic point of view, it is a powerful reminder that influence operations are not abstract. They depend on infrastructure, and infrastructure can be targeted.
What lessons should democracies take from all of this? The first lesson is that digital sovereignty is not achieved through isolation and vertical control. Russia believed that building its own separate internet, with its own platforms, laws and physical infrastructure, would make it strong. Instead, it made itself vulnerable. Democracies should avoid that mistake. True resilience comes from openness, cooperation, and redundancy. It comes from having geographically distributed backups, so that if one data centre goes down, traffic can flow somewhere else. It comes from clear frameworks for risk and governance, so that critical systems are protected without turning into walled gardens. And it comes from strategic alliances—friendly nations sharing technology, standards, and security practices, so that no country has to face a digital crisis alone. When it comes to countering Russian disinformation and influence operations, the international community needs to think beyond debunking individual posts. It needs to consider sanctions and regulatory limits on Russian-based platforms like Telegram, which have been used for both communication and coordination. It needs to support Ukraine’s defence, including through bilateral security agreements, because the best way to stop Russian digital attacks is to help Ukraine win its war. The recent drone strikes on data centres are not something to celebrate; they represent a dangerous escalation in the use of physical force against civilian infrastructure. But they have revealed something important about the digital age. The internet is not disembodied. It is made of concrete, steel, silicon, and power lines. And the countries that thrive in the future will be those that understand this—not by hiding behind digital walls, but by building resilient, open, and interconnected systems that can survive shocks and keep people connected. That is what sovereignty should mean: not control, but strength; not isolation, but resilience.