Russia plans to move its data centers underground due to Ukrainian attacks

Russia has decided to locate data centers underground in response to Ukrainian attacks. This approach is intended to protect digital infrastructure from strikes, though details regarding the scale and timeline for implementing this plan have not been specified.

 

Russia’s Ministry of Digital Development has approved recommendations for protecting data centers from drone attacks. For strategically important facilities, the recommendations call for underground placement, structural reinforcement, and electronic warfare systems.

According to the document, Russian authorities plan to implement a comprehensive system for protecting data centers—ranging from physical fortification of buildings to off-site data storage and coordination with law enforcement agencies. The recommendations apply to facilities regardless of ownership or operator.

For the most critical data centers, the possibility of constructing them underground or in protected structures is being considered. The document also proposes reducing the visibility of facilities from the air, installing anti-drone barriers, and using electronic warfare measures.

Special attention is being paid to the resilience of the engineering infrastructure. Structures must protect server rooms, cooling systems, and power supplies from shock waves and debris. For mission-critical services, data redundancy is planned to reduce the risk of prolonged disruptions to digital platforms.

The recommendations also call for collaboration between data center operators and the Russian Ministry of Defense, the Russian National Guard, the Ministry of Emergency Situations, and emergency services.

The document classifies data centers into three categories based on their importance to the state and the economy:

• K1 – strategic facilities, damage to which could disrupt the performance of key state functions.
• C2 – centers of regional or sectoral importance, on which the operation of vital economic and social systems depends.
• C3 – corporate data centers, damage to which would cause significant losses to individual companies but would not result in large-scale consequences for the state.

Separate security criteria are established for each category. Specifically, these criteria pertain to the facility’s location, physical fortification, and redundancy of the digital infrastructure.  

At the same time, the implementation of these new measures may increase operators’ costs. Representatives of the Russian IT market predict that the additional costs of protecting data centers could lead to an increase in providers’ rates of approximately 10%.

As a reminder, a key data center of the tax service was attacked in Russia.

Prior to that, a data center in occupied Donetsk was attacked, and telecommunications infrastructure was damaged.

Additionally, in St. Petersburg, drones attacked oil facilities, an Ozon warehouse, and the VK data center.