Russian data center operators are reportedly preparing for increased spending on physical defenses following new security requirements for critical infrastructure, prompted by ongoing Ukrainian drone attacks. A decree signed by President Vladimir Putin in late August allows the government to temporarily assume control of critical infrastructure facilities if operators fail to provide adequate protection, including against drone threats.
The new decree encompasses a wide array of critical infrastructure sectors, such as energy, telecommunications, transportation, and utilities. Russian media reports indicate that these regulations also apply to data centers, particularly those hosting systems for government agencies, financial institutions, and major service providers. Some data centers have already begun reinforcing defenses around external engineering equipment.
The new requirements present a significant challenge for Russia's data center industry, as a substantial portion of its capacity is concentrated in areas increasingly vulnerable to Ukrainian drone operations, notably around Moscow and St. Petersburg. As of February, Russia had 181 data centers. Industry experts note that data centers were not traditionally designed to withstand aerial attacks, but the growing capabilities of drones have elevated these concerns.
Reports from as early as 2023 indicated that some Russian companies were considering relocating data from facilities near Moscow to locations east of the Ural Mountains, partly due to drone attacks on the capital. Since then, Ukraine has significantly expanded its long-range drone operations, targeting airports, oil refineries, industrial facilities, and warehouses deep within Russia. Ukrainian President Volodymyr Zelensky recently stated an intention to further escalate this pressure, aiming to "close" Russia's skies and warning of increased drone penetration.
Russia has also targeted Ukrainian data centers. A strike in Kyiv in July damaged a major data center, leading to full or partial service suspensions for several local internet providers. Ukrainian data centers have also been subjected to cyberattacks; in January 2024, a facility serving state-owned companies reported an attack that disrupted customer operations.
In addition to physical security enhancements, Russian data center operators plan to bolster their cybersecurity measures. These include establishing backup communications, improving protection against distributed denial-of-service (DDoS) attacks, and enhancing software vulnerability management.
These investments in both physical and digital security are expected to increase data center operating costs, which could ultimately be passed on to customers. One chief executive of a Russian hosting provider noted that this will likely result in a significant rise in capital expenditures for the industry, inevitably affecting the cost of IT infrastructure for end-users in the long term.
Russia has been experimenting with various methods to protect critical infrastructure from Ukrainian drones, including anti-drone nets, metal barriers, and smoke screens. In August, authorities reportedly began installing metal frameworks for anti-drone netting around electrical infrastructure in Moscow, including a major substation in the eastern part of the capital. However, a leaked document from Russian oil giant Rosneft earlier this year acknowledged the limitations of many of these defenses, stating they could not guarantee protection from explosions or debris.
