Russian data centers face new security requirements amid Ukraine's drone threats

Russian data center operators are reportedly preparing to spend more on physical defenses as Moscow tightens security requirements for critical infrastructure amid continued Ukrainian drone attacks.

A new decree signed by President Vladimir Putin in late August allows the government to temporarily take control of critical infrastructure if operators fail to adequately protect their facilities, including from drone attacks, according to a report by Russian newspaper Kommersant earlier this week.

The decree covers facilities across a broad range of critical infrastructure sectors, including energy, telecommunications, transportation and utilities. According to Russian media reports, the new rules are also affecting data centers, especially those hosting systems used by government agencies, banks and major service providers.

Some data centers have already begun strengthening defenses around external engineering equipment, Nikita Tsaplin, chief executive of Russian hosting provider RUVDS, told Kommersant.

The requirements could pose a particular challenge because much of Russia’s data center capacity is concentrated in areas increasingly exposed to Ukrainian drone operations, primarily around Moscow and St. Petersburg. Russia had 181 data centers as of February, according to data from Russian brokerage BCS.

Data centers were not traditionally designed to withstand aerial attacks, but increasingly capable drones have increasingly raised concerns , local industry experts said. 

Russian media reported as early as 2023 that some companies were considering moving data from facilities around Moscow to locations east of the Ural Mountains, in part because of drone attacks on the capital.

Ukraine has dramatically expanded its long-range drone operations since then, striking airports, oil refineries, industrial facilities and warehouses deep inside Russia.

Ukrainian President Volodymyr Zelensky said earlier this week that Kyiv intends to further increase that pressure, saying the goal is to “close” Russia’s skies and warning that drones will penetrate “on a scale that has to be taken into account.”

Russia has also hit Ukrainian data centers. . A strike in July damaged a major data center in Kyiv, forcing several local internet providers to fully or partially suspend operations. 

Ukrainian data centers have also faced cyberattacks. In January 2024, a facility serving several state-owned companies said an attack disrupted its customers’ operations.

Russian data center operators also told Kommersant they plan to strengthen their cybersecurity, including by setting up backup communications, improving protection against DDoS attacks and better managing software vulnerabilities.

Investments in both physical and digital security are likely to make data centers more expensive to operate — costs that could ultimately be passed on to customers.

“For the industry, this will undoubtedly mean a significant increase in capital expenditures, which in the long term will inevitably affect the cost of IT infrastructure for end users,” Tsaplin said.

Russia has been experimenting with different ways to protect critical infrastructure from Ukrainian drones, including anti-drone nets, metal barriers and even smoke screens. In August, authorities reportedly began installing metal frameworks for anti-drone netting around electrical infrastructure in Moscow, including a major substation in the eastern part of the capital.

A document leaked from Russian oil giant Rosneft earlier this year acknowledged the limitations of many of these defenses, saying they could not guarantee that facilities would remain safe from explosions or debris.

Zelensky reported Friday that a drone had struck the headquarters of the Security Service of Ukraine (SBU) in the heart of Kyiv.