Is Zelensky right to say data centre strikes have taken down Russian bots?

Ukraine has struck three of Russian technology company Yandex’s five data centres since 8 October. The attacks were carried out after Moscow struck Ukrainian internet hubs. One strike caused Yandex to say it was struggling to maintain its services. The alleged link to online influence matters because Russian networks use automation to spread pro-Kremlin narratives and divisive messages.

The connection came mainly from Cloudflare charts. They showed that automated activity using Yandex’s network had declined. Some users interpreted that fall as evidence that Russian propaganda bots had gone offline. Posts also linked the supposed decline to fewer messages supporting groups such as MAGA in the United States and AfD in Germany.

Cloudflare warned that its figures covered all automated requests to websites on its network. That included harmless crawling by search engines. Researchers found no traffic change among known Russian accounts or bot clusters, and known networks remained active. The strikes clearly disrupted services, but their effect on influence operations remains unproven.

A social-media bot is an automated account or program that performs actions online without a person manually carrying out each one. It may post messages, amplify content, follow accounts, or repeat activity at scale. Bots are often associated with fake accounts and misleading or inflammatory posts, which is why they matter in political influence operations.

A real person using a social-media account chooses what to read, write, share, or comment on. A bot follows programmed instructions or automated processes. However, the article also notes that bots can perform ordinary technical jobs. They may scan web pages, collect information, or help pages appear in search-engine results.

That difference is crucial when interpreting data. A chart showing more or fewer automated requests cannot by itself reveal whether the activity involved propaganda. It may reflect routine indexing, service changes, or other technical tasks. To identify influence operations, researchers need evidence about the accounts, their messages, and their coordinated behaviour.

Ukraine struck three of Yandex’s five data centres. That is a substantial part of the network described in the article, although two of the five centres were not identified as struck. The attacks were part of Ukraine’s response to Russian attacks on Ukrainian internet hubs.

The first strike took place on or after 8 October, and two further attacks followed. After the second strike, on a Thursday, Yandex said it was struggling to maintain its services. The attacks therefore had a clear effect on the company’s computing capacity and online infrastructure.

The size of the disruption does not establish what happened to propaganda networks. Yandex’s services support many kinds of internet activity, including cloud services and website functions. Cloudflare data showed reduced automated traffic, but experts said this could reflect technical changes rather than the disappearance of Russian social-media bots. Known influence networks remained active.

Cloudflare’s charts measured automated internet requests made to websites hosted on its network. They did not isolate Russian propaganda accounts or identify the purpose of each request. Cloudflare explicitly said the drop was not necessarily social-media bot behaviour.

That distinction explains the misleading interpretation. Yandex uses bots to crawl much of the internet each day and index websites for search purposes. If its computing resources were damaged, the company could have switched those crawlers off. The resulting fall would appear in Cloudflare’s data even if political influence networks continued operating elsewhere.

The charts therefore showed an infrastructure change, not proof of a propaganda collapse. Researchers from dTeam found no traffic change from known Russian accounts and bot clusters on any platform. They also provided evidence that networks linked to Storm-1516 and Matryoshka remained active. Cloudflare data alone could not establish what those networks were doing.

Researchers found no evidence that the strikes had significantly reduced known Kremlin-linked influence operations. The US-based dTeam told BBC Verify that traffic from known Russian accounts and bot clusters had not changed on any platform. That directly challenged claims that online propaganda activity had suddenly collapsed.

The researchers also shared evidence that bots linked to Storm-1516 and Matryoshka were still active on social media on Tuesday. Both networks had previously been reported on by BBC Verify. Their continued activity showed that at least some known influence operations were still functioning after the attacks on Yandex facilities.

This does not prove that every Russian operation was unaffected. It shows that the available evidence did not support a broad shutdown. The strikes clearly disrupted Yandex’s cloud services and affected users, but researchers said a real impact on known influence groups would have produced visible changes in their traffic or activity.

When a major cloud or data-centre provider is disrupted, websites and online services that depend on its infrastructure can lose access to computing, storage, or other essential functions. The effects can spread beyond the provider’s own customers because connected websites may rely on the same systems to operate.

Netblocks research director Isik Mater said disruptions linked to the strikes affected all users globally. Websites relying on Yandex could become partially or entirely unusable. She also reported a clear impact on Yandex’s cloud services and platforms built on them. An entire area remaining out of service indicated a significant infrastructure incident, rather than a brief interruption.

This helps explain why the strikes produced visible online changes without proving that propaganda stopped. Technical outages can reduce automated requests, interrupt websites, and force services to change how they operate. They may also affect legitimate users far from Russia. The article provides no evidence that these disruptions ended Russian influence operations.

Automated internet traffic means software is sending requests or carrying out tasks without a person directing every action. That automation is useful for ordinary internet functions. Search engines use bots to crawl web pages, gather information, and help pages appear in search results. These activities are not political manipulation.

The article says Yandex bots essentially crawl the entire internet once a day for indexing. By contrast, influence operations can use automated accounts to post messages, promote narratives, or spread false, divisive, and inflammatory content. Both activities generate automated requests, even though their purposes are completely different.

That shared technical footprint makes broad traffic charts difficult to interpret. A decline may mean routine crawlers were switched off after computing resources were damaged. It does not show that coordinated political accounts stopped posting. Researchers must examine known accounts, messages, platforms, and clusters to distinguish harmless automation from organised influence activity.