No, Ukraine's strikes on Yandex data centers didn't cripple Russian influence ops

Ukrainian drone strikes against Russian data centers sparked viral claims about a sudden drop in Russian influence operations on social media — even as experts see no evidence to support this.

Kyiv struck data centers run by Yandex — Russia's "answer to Google" — in three different regions between Oct. 9 and 11, a response to Russian strikes against similar facilities in Ukraine.

Yandex acknowledged the attacks, noting that its data center in Vladimir Oblast had to be shut down due to damage and reported disruptions to various online services within Russia.

Soon after, commentators on social media began reporting an alleged decrease in activity by "Russian bots" online, linking this to Ukrainian strikes on Yandex.

President Volodymyr Zelensky even alluded to this in his address to the Warsaw Security Forum, saying it is "a little easier to breathe on many social media platforms."

Yet beyond anecdotal examples circulating online, there is no data showing that the attacks on Yandex disrupted Moscow-backed disinformation and influence operations.

At least some of the claims appear to stem from a simple confusion of terms.

The bot confusion

The source of this confusion is a chart from the internet company Cloudflare showing that bot activity from Yandex's network dropped to 54.7% after a Ukrainian strike on a data center in Ryazan Oblast.

The rate then plummeted to 0.3% after the third data center was hit in Vladimir Oblast.

But the chart simply shows automated web page requests from Yandex's own infrastructure, primarily its search crawlers — bots that browse and index web content.

It has nothing to do with activity by what is commonly referred to as Russian bots or trolls on social media.

"No reliable graph can consolidate bot and troll activity across multiple social media platforms without their internal data that measures telemetry, traffic, and behavior," Roman Osadchuk, the director of Threat Intelligence at the LetsData tech company, tells the Kyiv Independent.

Osadchuk acknowledges a moderate dip in social media comments and posts, both by bots and real users, over the weekend, but regards it as a coincidence.

This decrease "could be explained by tech complications on the side of companies that run influence operations like SDA or Structura, or it could simply be lower output from the weekend shift on the troll/bot farm, or a general fluctuation in comments."

No major fact-checking or disinformation-monitoring organizations reported a radical drop in Russian disinformation activity on social media, though some European officials echoed the claims.

In Poland, Tomasz Siemoniak, a minister coordinating the work of special services, claimed he had received exclusive information from the country's internal security service, the ABW, about a "radical decline in Russian bot activity online" due to the strikes.

But no such data has been published, and local disinformation monitors report no drop in Moscow-backed influence operations.

The Disinformation Analysis Center at Poland's state-run Research and Academic Computer Network (NASK) recorded no significant decrease in activity by disinformation accounts between Sept. 30 and Oct. 11.

"Only isolated cases of individual accounts becoming inactive were observed, but there is no basis for conclusively linking these instances to the attacks in question," the center's Daria Tomczuk told the Kyiv Independent.

Nor is there convincing evidence in other European countries.

Czech Member of the European Parliament Tomas Zdechovsky shared a graph purportedly linking the Ukrainian attacks to a drop in online activity around the far-right Alternative for Germany (AfD) party.

But the German technology website Rohtext disputed this, noting that the graph does not list a source or explain a methodology. Rohtext reported no links between AfD activity and Yandex centers.

Why striking Russian servers won't silence trolls

Another theory that appeared online is that damage to Yandex data centers may have disrupted the infrastructure supporting Moscow's influence operations.

However, Russian disinformation is believed to heavily rely on decentralized networks of proxies abroad, which would not be disrupted by strikes against Russian data centers.

"There's a lot of documented evidence that these troll operations operate in other countries like North Macedonia or the Philippines," Dave Troy, a disinformation researcher and investigative journalist, told the Kyiv Independent.

Given the blockade on the Russian internet imposed by the outside world and heavy domestic restrictions, it simply makes more sense to run disinformation operations from abroad, he adds.

This proxy strategy also makes it hard to pinpoint a drop in activity that is decisively Russian.

One commentator pointed to a drop in impressions under posts linked to Storm-1516, a Kremlin-backed disinformation group.

But Bot Blocker, a group monitoring Russian disinformation, countered that the bot network used by Storm-1516 is most likely a neutral commercial engagement-for-hire provider, not affiliated with a particular state.

"This engagement amplifying network is quite unlikely to be run from Yandex data centers," Bot Blocker told the Kyiv Independent.

Troy warns that misstating the impact of Ukrainian strikes on Russian data centers could pose a strategic risk by itself.

"The danger is thinking a specific victory has been achieved, but in reality the threat lies elsewhere and must still be assessed and fought," he adds.