Russia is now looking underground for its data centers. Russia's Digital Development Ministry has proposed protection standards that include building sites below ground, camouflaging them from the air and adding drone defenses, according to the Kyiv Independent, which cites the state-controlled outlet Kommersant. The proposal followed Ukrainian drone strikes on Yandex, Sberbank and VK facilities between October 8 and October 18, 2026.
A second thread came on November 2: Vedomosti reported that state telecom Rostelecom is discussing underground data centers with the mining company Norilsk. As summarized by GIGAZINE, no build plan has been published. This post lays out what is documented, what is only an idea, and why attacks on data centers matter to anyone who watches AI infrastructure. We covered the strikes themselves in the Sasovo report and the third Yandex strike.
Quick reference: confirmed versus proposed
| Item | Status | Source |
|---|---|---|
| Drone strikes on three Yandex sites, a Sberbank site under construction and a VK site, Oct 8 to 18 | Reported by the Kyiv Independent; earlier posts cover the individual strikes | Kyiv Independent |
| Ministry guidelines with three protection tiers, including above or underground siting | Reported (Kommersant, Oct 25) | Kyiv Independent |
| Existing sites told to reduce aerial visibility and add layered defenses | Reported | Kyiv Independent |
| Kemerovo governor proposes using depleted open-pit mines (Oct 16) | Reported | Kyiv Independent |
| Rostelecom talks with Norilsk on underground sites | Reported by Vedomosti, via GIGAZINE | GIGAZINE |
| Contract, capacity, budget, completion date | Not reported | None found |
| Putin decree: 10% capacity reserve, foreign data centers allowed | Reported | GIGAZINE |
What the ministry guidelines say
The Kyiv Independent summarizes Kommersant's account. The guidelines cover existing, planned and under-construction facilities and set protection standards for three tiers:
- Top tier: strategic sites whose loss could disrupt key state functions for an hour or more.
- Second tier: sites supporting regionally or economically important systems, where outages could last four hours or more.
- Final tier: corporate data centers whose damage would not have wider consequences for the state.
The standards include whether a site sits above or below ground. For sites that already exist, the advice is to reduce their visibility from the air and add layered defenses: reinforced structures, electronic warfare and drone defense systems.
Note what this is not. It is a set of proposals and guidelines reported through a state-controlled outlet. We did not find the ministry document itself, and we did not find a deadline or a funding line. That is the main gap.
Shield with a radar arc, representing the drone defense layers proposed for Russian data centers
Rostelecom and Norilsk
Vedomosti, per GIGAZINE, reports that Rostelecom raised relocating some data centers underground during discussions with Norilsk, the nickel and palladium miner. The logic is simple: mining companies have tunnels, shafts and rock cover, and they know how to ventilate and power underground sites.
What we cannot say is whether this is more than talk. The report gives no site, capacity, cost or schedule. A well-covered precedent exists for caution: underground data centers exist in other countries, but they take years to plan, need power and cooling, and cost more than surface builds. A plan that is only "discussed" in early November will not change Russia's capacity this winter.
The mine and quarry idea
On October 16, Kemerovo Oblast governor Ilya Seredyuk proposed putting data centers inside depleted open-pit mines and quarries, noting their natural protection from aerial bombardment, per the Kyiv Independent. Data Center Dynamics reported the same line of thinking, with a coal-mine site and a green park on top as camouflage, according to GIGAZINE's summary. We could not open the Data Center Dynamics page, so we rely on that summary for it.
An open-pit mine is not the same as a tunnel. A pit is open to the sky, so protection would come from building into walls or covering the site, not from rock overhead. That detail matters, and none of the reports we read addresses it.
Two rows of server racks, one open and one closed, standing for hardened versus exposed data center designs
Why Russia's data centers are exposed
The Kyiv Independent quotes Serhiy Petrenko, former head of Yandex Ukraine, who estimates that about 80% of Russia's data centers are concentrated in Moscow and the surrounding region, within reach of Ukrainian long-range drones. That is one person's estimate, not an official count, but it explains why a few strikes had wide effects.
GIGAZINE adds that attacks have disrupted payment apps, digital banking, e-commerce, streaming, ride-hailing and food delivery, and contrasts this with Ukraine's decentralized services, which it says show higher fault tolerance. The same summary notes the Yandex failover trouble that followed an attack, which we reported in our third Yandex strike post.
The Putin decree on capacity
GIGAZINE reports that Putin recently signed a decree allowing government committees to permit the use of foreign data centers and ordered operators to reserve 10% of available capacity in case of a government request. The Kyiv Independent's news feed carries a matching headline. We did not read the decree text, so treat the 10% figure as reported, not verified.
The two moves point in the same direction: harden what exists, keep spare capacity for the state, and allow outside capacity when needed.
What this means for AI compute
Data centers host the compute that runs AI models and services. The Kyiv Independent says strikes could set back Russia's AI development and affect military technology. The Sasovo reporting we covered earlier included a claim of 2,700 GPUs, which we marked as unverified. Nothing here confirms a hardware loss figure.
Two broader points apply to any country.
Physical risk is now part of AI planning. Operators already weigh power, water and local opposition, as in the Ohio votes banning data centers and the midterm data center backlash. War adds a different category: hardening, camouflage and air defense. Few commercial operators plan for it.
Concentration is a risk. When most capacity sits in one region, a small number of attacks can take down many services. Spreading sites, testing failover and keeping data in more than one place are basic steps, and the Yandex outage shows what happens when failover does not work.
The same supply pressures show up elsewhere in the AI chain, such as in Malaysia's chip smuggling probe and in Google's planned Malaysia data centers, which show how much of the field depends on a few sites and supply routes.
What to do if you run infrastructure
- Map single points of failure. List which services depend on one site or one region.
- Test failover on a schedule. Do not assume it works; run it.
- Treat physical security as part of the plan. For high-risk regions this includes site selection and backup power.
- Limit what automated agents can change. If agents can change cloud settings, restrict their permissions so a failover cannot be disrupted by a bad automated action.
Timeline of the past month
- October 8 to 18: Ukrainian drones strike three Yandex data centers, a Sberbank facility under construction and a VK data center, per the Kyiv Independent.
- October 16: Kemerovo governor Ilya Seredyuk proposes using depleted open-pit mines and quarries for data centers.
- October 25: Kommersant reports the Digital Development Ministry's protection guidelines, with three tiers and an underground option.
- November 2: Vedomosti reports Rostelecom is discussing underground data centers with Norilsk.
- Around the same period: Putin signs a decree on foreign data centers and a 10% capacity reserve, as reported by GIGAZINE.
Seen in order, the proposals arrived within weeks of the strikes. That speed shows urgency, but it also means none of the ideas has been tested against real engineering limits such as power supply, cooling, and the time needed to dig and certify a site.
Questions readers are asking
Would an underground data center be safe from drones? Rock cover blocks most direct hits from small drones, but it does not remove the risk. Power lines, cooling intakes, fiber routes and entrances stay exposed on the surface. The reports do not describe how those would be protected.
Is camouflage realistic? The guidelines call for reducing a site's visibility from the air. For a large building with heavy power draw and cooling equipment, thermal and radio signatures are hard to hide. Again, the reports give no technical detail.
Does this slow Russian AI work? The Kyiv Independent says strikes could set back AI development, but no source we read measures that. Capacity loss, rebuild time and any hardware imports are all unreported.
What is still unknown
- The text of the ministry guidelines and whether they bind operators.
- Whether the Rostelecom and Norilsk talks lead to a contract.
- How many sites were damaged and how much hardware was lost. Figures so far come from partisan sources.
- Whether other operators, such as Yandex or Sberbank, announce hardened sites.
Bottom line
Russia has moved from reacting to strikes to recommending a hardened design: tiers, camouflage, drone defenses and a possible move underground. The documented part is the guidance and the strikes that triggered it. The underground part, so far, is talk. We will add an update if a contract, a site or the guideline text appears.
Related reading
- Yandex Sasovo data center drone strike: claimed versus verified
- Yandex Vladimir data center hit: third strike in a week
- Ohio voters pass data center bans
- Data center backlash in the midterms
- Malaysia seizes 30 AI servers in a chip smuggling probe
- Google's $15 billion Malaysia data centers
- Sources: Kyiv Independent, GIGAZINE summary of Vedomosti, DCD and Ars Technica
Details are accurate as of November 5, 2026 and rest on press reports; the guidelines and the Rostelecom talks had not been confirmed in primary documents when this was written.