A man rides a bicycle in front of a residential building damaged in Russian attacks during a local ceasefire related to a humanitarian aid mission in Oleshky, in Kherson, Ukraine, Thursday, Oct. 29, 2026. (AP Photo/Evgeniy Maloletka)
On October 8, Ukraine’s drones hit a Yandex data center in Sasovo. President Volodymyr Zelensky explained the logic: they “always respond in mirror-like fashion.” Russia had spent weeks bombing Ukraine's data centers. Kyiv was simply returning the favor.
Three weeks later, this one-off mirroring has become a campaign of striking multiple Russian data centers. Ukraine struck two more Yandex facilities, in Kaluga and Vladimir, by October 11. On October 14, it hit a data center run by Sber, Russia's largest bank. On October 18, it targeted one belonging to VKontakte, the country's biggest social network. And finally, on October 23rd it struck a Russian finance ministry data center.
Each strike has moved the war further from a battlefield, and each one is setting a precedent in an area of war where the rules for data centers are still unsettled. Ukraine has every reason to be angry, but by matching Russia in this gray zone, it is giving away the thing that has served it best in this war: the clear difference between how it fights and how Russia does.
That difference has been real. Ukraine became a full member of the International Criminal Court in 2025 and has accepted its jurisdiction over crimes on its territory since 2013, while Russia remains outside the court. Ukraine did limit the court’s war crimes jurisdiction over its own citizens for seven years, but it had already accepted that jurisdiction for over a decade. Kyiv has also offered to halt strikes on civilian infrastructure if Russia does the same, and even while announcing retaliation in October, Zelensky stressed that Ukraine would never target children. Nonetheless, it is clear that Ukraine is the victim in this war, but going down to the same level as Russia and striking civilian infrastructure could undermine its position in the long run.
Data centers are now a part of nearly everything in an economy; from payments and maps, to hospital records and government services. When one data center goes down, the damage spreads across industries and beyond just the building or surrounding areas. After the October 11 strike in Vladimir, Yandex users reported outages not only across Russia but in Serbia, Kazakhstan, Belarus and Armenia, hurting civilians with no say in the war. This spillover is worse in Russia than in Ukraine. Russia’s digital sovereignty rules require data to be stored at home, so services depend on a small number of large hubs; Yandex, Russia’s largest tech company, operates just five. Ukraine, by contrast, had moved most of its data to servers in Europe, so Russian strikes did less damage.
International humanitarian law applies to data centers, but it hasn’t kept pace with how central they have become to daily life. Its core rules apply to digital technology as they do to anything else. The law states that attackers must distinguish civilian objects from military targets, take precautions, and avoid civilian harm that outweighs the military gain. But no treaty addresses data centers specifically, and they are often civilian and military at once; as noted by François Delerue in Data Centers and International Humanitarian Law, “these centers often commingle military and civilian data and applications.” Some argue they should never be lawful targets because destroying them harms civilians far more than it helps any army. Others conclude they can sometimes qualify as military objectives. The very category of “dual-use” objects, which also includes bridges and power grids, legal scholar Francesca Capone notes, still has no clear legal definition. This lack of a legal definition is now more relevant than ever, with “dual-use” infrastructure (data centers) now infiltrating every aspect of our lives. The International Committee of the Red Cross has urged states to agree on how to protect civilian digital infrastructure in war. The general rules of IHL already apply, but there are no additional protections written specifically for data centers, so how those rules apply is being decided right now, while the strikes continue on both sides.
Ukraine's defenders have a strong argument; it is simply that Russia started this. Its forces have been striking Ukrainian data centers since mid-September, and on September 27 alone they damaged 10 in Kyiv and one in Dnipro. Russia's Defense Ministry called its campaign a "forced digital detox."
The targets are not purely civilian either. The Sasovo data center shares a site with a sanctioned factory that supplies Russia’s military industry. It also housed two of the three supercomputers Yandex uses to build its AI models. Euronews reports that these facilities are tied into Russia’s surveillance system. Ukraine's supporters can fairly say these are tools of the Russian state that may then outweigh their use for civilians. And deterrence matters. If Russia pays no price for attacking Ukraine's data centers, it will likely continue to do so.
None of that changes the central problem: data centers, despite their use to the Russian military, are still dual-use infrastructure, and mirroring is not necessarily the right strategy for the weaker side in a war that depends on outside support. Especially since Ukraine’s backers have called for both sides to stop striking each other’s infrastructure.
Ukraine’s greatest asset has been its contrast with Russia. Kyiv’s case to Washington, Brussels, and the Global South rests on the claim that Russia wages war on civilians and Ukraine does not. That case matters more as support softens. Sympathy and aid are not the same thing: in February, 61% of Americans said they sympathize more with Ukraine, but a more recent Economist/YouGov poll from October 22nd found that only 46% of registered voters want the U.S. to keep sending military aid, that number was at 56% in July. Among Republicans, whose party controls the White House, support has dropped to 28%, down from 41% in July. The White House’s support has also proven sensitive to how Ukraine fights: this month, Trump blamed Zelensky for diesel prices driven partly by Ukrainian strikes on Russian refineries. Each strike that disrupts civilian life risks giving skeptics another argument to decrease aid to Ukraine.
President Donald Trump meets with Ukraine's President Volodymyr Zelenskyy during the United Nations General Assembly, Tuesday, Sept. 22, 2026, at the UN headquarters. (AP Photo/Julia Demaree Nikhinson)
The military payoff also looks quite small in comparison to the possible detriment to its position. Yandex restored most key cloud services within days by shifting to its other sites. Analysts at Poland’s Centre for Eastern Studies found that the attacks have so far had a limited impact on Russia’s economy. If a strike causes days of disruption for ordinary users and little lasting damage to the Russian military, it fails the basic test of proportionality that Ukraine itself invokes against Russia. Moscow claims the Ukrainian data centers it hit processed military intelligence. But its own Defense Ministry called the campaign a “forced digital detox,” and one September strike in Kyiv left about 100,000 households without internet. Russia’s aim, like its attacks on Ukraine’s power grid, appears to be pressure on civilians and the economy rather than pure military gains. Even that payoff was limited, because Ukraine had moved most of its data to servers in Europe. Ukraine’s strikes serve a similar purpose; Kyiv’s long-range campaign aims to hurt Russia’s economic ability to wage war, and Zelensky justified the data center strikes as retaliation. When both sides gain so little militarily, what remains is clear purposeful disruption for ordinary people in aims to damage the economy.
This all gets worse once you include the bystanders. The outages that reached Serbia, Kazakhstan, Belarus and Armenia hit users with no part in the war, in countries that Ukraine may even need to persuade or at least keep neutral. Apart from Belarus, a close Russian ally, each has been slowly moving away from Moscow. Serbia condemned the invasion and, during Zelensky’s visit to Belgrade in August, pledged support for Ukraine’s territorial integrity, though it still refuses to sanction Russia. Kazakhstan has refused to recognize Russia’s annexations and says it won’t help Moscow evade sanctions. Armenia has frozen its membership in Russia’s military alliance, and its foreign minister said last week he doesn’t see it returning. These are exactly the governments Ukraine needs to keep from drifting its way, especially due to their geographic proximity to the war. This becomes harder to do if their citizens’ daily lives are disrupted by Ukraine’s attacks.
Ukraine has a better option. It has already moved most of its own data to servers in Europe. It has the moral standing to make a public pledge not to target civilian data infrastructure, and to challenge Russia to match it. If Moscow accepted, the pledge would become a mutual agreement. If Moscow refused, as it likely would, the refusal would be on the record, and Ukraine would be actively shaping the rules of digital war all while strengthening its position by highlighting Russia’s unjust war strategy.
A commitment like this would add something the law currently lacks. International humanitarian law already requires attackers to spare civilians, but it leaves room to argue over whether any given data center is a military target. An agreement that names data centers, cloud services, and internet exchanges as off-limits would close that gap; if either side kept striking, it would be clear who broke the deal.
There is already a model for this. On October 11, Trump announced an “energy ceasefire,” and Zelensky said Ukraine was ready to stop striking Russian energy infrastructure if Russia did the same. Ukraine could offer to add data centers to that deal, on the same terms. Violations would be hard to hide. Outages show up in real time; internet monitor NetBlocks tracked Yandex Cloud dropping to 30 percent of normal connectivity after the Vladimir strike. And responsibility is rarely in doubt, since both governments have openly claimed their data center strikes. The energy ceasefire itself has been shaky. Kyiv reported Russian attacks on energy sites after it was announced. Nevertheless,even a failed deal would show which side is willing to follow the rules and strengthen Ukraine’s argument for aid, especially with US support slipping.
Whoever sets the norm for data centers now will shape every war that follows. Ukraine should want to set that norm.