In the early hours of 8 October a drone set fire to a Yandex data centre in Sasovo, a town in Russia’s Ryazan region. Yandex told AFP that the facility had stopped operating entirely.
The outage reached Yandex Cloud and the products built on it, such as Yandex Disk and Yandex Documents, and Yandex shares fell more than 3 percent on the Moscow Exchange. The site is a converted corner of a machine-tool plant.
By the Sasovo city administration’s own account, Yandex had put roughly 6 billion rubles, about $75 million, into it over eleven years. That is a modest sum for a building whose loss can be felt in a country’s cloud services.
Whether Ukraine aimed at the data centre or at the factory around it is still unclear, and Kyiv has been coy. Zelenskyy said Ukraine “always responds in kind” and noted that Russia has been hitting Ukrainian data centres. I don’t think the ambiguity matters.
A warhead that can burn a factory can burn the server hall inside it, and anyone planning a strike now knows it.
The Russians started this particular exchange. Their strikes in late September damaged at least six Ukrainian data centres, including facilities run by MiroHost, Parkovy, Data Group, Utels and Pautina.
Moscow said the targets processed and transmitted intelligence for Ukraine’s armed forces and threatened Ukraine with a “digital detox.” It offered no evidence for these claims. The claim is nonetheless doing real work. It is the old argument that anything useful to the enemy is a legitimate target, and data centres are close to the perfect illustration of it, because one building can serve a bank, a ministry and a logistics unit at the same time.
An attacker never has to prove which workload justified the strike, and the defender can’t prove which didn’t.
The same logic played out in the Gulf in March. Drones damaged three Amazon Web Services data centres in the UAE and Bahrain, taking two of the three availability zones in the UAE region offline, and Uptime Institute called it the first confirmed military attack on a hyperscale cloud provider. Careem, payments firms and major UAE banks reported disruptions. Iran’s Revolutionary Guard said it chose the Bahrain site because AWS hosts US military workloads there. AWS declined to comment on that claim, but the claim should worry every government that has moved its operations onto commercial cloud.
Governments have spent a decade telling themselves that renting capacity from a private provider is a procurement decision. Iran treated it as a targeting decision.
The engineering assumptions need rethinking too. AWS builds each region from several physically separate availability zones, each with independent power, cooling and networking, so that losing one does not take the region down. That design anticipates fires, floods and failed substations. It does not anticipate a barrage that hits more than one site within the same hours, and in the UAE it didn’t survive one.
Yandex’s customers had a similar promise: data stored across four availability zones, with a paid backup service on top. Redundancy that sits within a few hundred kilometres of itself protects against accidents. Against a military that has decided the buildings are targets, it is thinner than the marketing suggests.
My view is that most governments are far behind on this, and that the lag is a choice. They have defence budgets for airspace and ports and, until now, almost nothing for the shared buildings where tax records, payment rails and hospital systems live.
A country that can’t keep its banking app running through one night of drone strikes has a security problem, and it is a larger one than whatever the app does for the economy on a normal day. Nobody should need the next war to point this out, since the last two already have.
Three things follow, and none is exotic. Military and sovereign workloads should not share halls, or even providers, with consumer services, so that a strike aimed at one doesn’t take out the other.
Critical systems need geographic redundancy measured in countries, not in rooms. And the powers that write the rules of war need to say, plainly and soon, how commercial cloud fits into the law of armed conflict, because right now each belligerent is writing that law with its own drones and its own press releases.
Until then, the data centre down the road is infrastructure that belongs to everyone and defended by no one, and Ryazan and Dubai have both shown what that leaves it open to.
Kumbirai Thierry Nhamo || Social Justice Activist
Email: kumbiraithierryn@gmail.com
Portfolio: https://muckrack.com/kumbirai-thierry-nhamo/
Source: The Next Battlefield May Be the Data Centre Down the Road – Zealous Thierry
COMMENTS