Ukrainian President Volodymyr Zelensky says social media users may have noticed their feeds are a tad quieter this morning. The reason, he told the Warsaw Security Forum in Poland, is simple: on Sunday, Ukraine attacked a data centre in Vladimir, a city 120 miles east of Moscow, owned by Yandex, known as 'Russia's Google'.
Almost all of the IT giant's services, from maps and banking to food-ordering and its AI chatbot, are down but are 'returning to normal'. Zelensky said that since the drone strikes, it's become 'a little easier to breathe' online.
Fewer bots after strikes
'There was less hate, less division, and fewer provocations because there were fewer bots,' he said. 'And it's pretty clear where those bots were coming from – if they disappeared when Yandex went offline.'
X users have also said that they have seen fewer posts from dodgy accounts today, such as those supporting right-wing parties. Many are sharing a graph from Cloudflare, a tech company that helps websites manage internet traffic, which shows Yandex bot traffic fell by 99% compared to the week before.
European Parliament member Tomáš Zdechovský said this included users throwing their backing for the far-right party, Alternative for Germany. 'If confirmed, this is telling: Russian data centres get hit and online activity around AfD suddenly plummets,' he said.
Experts urge caution
Online commentators suggested Yandex's data centres may have powered bot farms, large networks of phoney social media profiles. Some use AI-enhanced software to generate posts and even repost, like and comment on the posts of other bots in the same murky network. Researchers say that, sometimes, automated trolls are easy to spot. Many use identical language, imagery and even profile pictures.
Moscow has a history of using bot farms to create Russian web brigades, otherwise called bots, to spread disinformation online.
Aras Nazarova, a senior security researcher at Cybernews, says it can be tricky to say. 'We cannot draw a direct connection between the attacks on Yandex data centres and changes in activity from Russian “disinformation bot farms”,' says Nazarova. 'Such misinformation campaigns rely heavily on making fake social media profiles appear as though they belong to real people, including by masking their source IP addresses.'
What the data shows
Many social media networks can detect where users are based, even if they use a VPN, or virtual private network, which masks their location. And if said location was a data centre, the account would likely be flagged as spam and be suspended, Nazarova says.
Pieter Arntz, a researcher at the cybersecurity company Malwarebytes, adds that people seem to be getting their bots mixed up. By 'bots', most commentators seem to mean state-sponsored social media accounts; in this case, Kremlin-controlled trolls. But Cloudflare doesn't just track these kinds of bots. Crawlers, which roam the internet to update a search engine's index, make up more than half of internet traffic, Cloudflare says.
'Russian-operated social-media bot farms certainly exist, but we haven't seen evidence tying a fall in their activity to these strikes,' says Arntz. 'To establish that, we'd need account-level activity data and a link to the affected infrastructure.'
What Cloudflare keeps tabs on is how many times AS13238, a Yandex network, tries to access a website, called an HTTP request. What it doesn't show is how many people are browsing the web or how many social media accounts are posting. Russian web traffic – both human and bot – has not dipped, according to Cloudflare.
'Some misinformation campaigns may have been affected, while others were not,' Nazarova adds. 'The most reliable way to assess changes in disinformation bot activity would be to identify the accounts involved and track their activity.'
Yandex told Metro that the 'mass manipulation on social networks, spam and other bad-faith activity is contrary to its rules'. 'Accounts that violate the platform's rules are blocked,' the company said.
Three of Yandex's four largest data centres have been knocked out by Ukrainian strikes. Its data centre in Sasovo, flattened on October 8, housed the IT giant's supercomputers Chervonenkis and Lyapunov. These power YandexGPT, the company's AI chatbot, though it is unclear if the units were damaged. On October 9, Kyiv forces attacked a Yandex facility in Kaluga.
