What does Putin's data center decree require?
President Vladimir Putin signed decree No. 802 on Monday 2 November 2026. The Kremlin published the document at 16:20 Moscow time under the title "On temporary measures to support the functioning of information resources on the territory of the Russian Federation."
The core requirement is narrow. Owners of data centers must reserve 10% of their floor space and capacity so that Russian information resources can keep running if needed, according to the Kremlin's own summary of the text.
Interfax, which read the published decree, reported that operators have ten days from signing to meet the reservation requirement. That puts the deadline at 12 November. They continue using the reserved space until a government subcommission decides otherwise; after such a decision, they must provide it within 24 hours.
The subcommission sits under the government commission on digital development and information technology. It will also set the maximum payment for the reserved capacity, Interfax reported. Separately, the Ministry of Digital Development has been ordered to inventory available capacity and floor space at privately owned data centers across the country.
One clause reaches beyond Russia's borders. The decree allows temporary use of computing capacity located abroad, provided a subcommission decision is agreed with the Federal Security Service (FSB). The Moscow Times, citing Reuters, reported the same FSB condition.
Nothing in the reporting suggests ownership changes hands. The facilities stay private, and the reserved slice remains in commercial use until the state calls it in. Interfax describes the mechanism as a reserve that authorities can access quickly when they choose.
Why did Russia issue the decree now?
The decree's preamble presents it as an emergency response to outside pressure. It cites "the need to take urgent measures in response to the unfriendly actions of certain foreign states," in Interfax's translation of the text.
The practical trigger was a month of drone strikes on Russian computing infrastructure. Ukrainian drones hit facilities belonging to Yandex, Sberbank and VK between 8 and 18 October, disrupting consumer services, corporate cloud customers and payments. Anadolu Agency reported on 16 October that Russian officials were already working with the Defense Ministry to strengthen security at other sites.
The sequence is documented by several outlets. On 8 October, Yandex's data center in Sasovo, in the Ryazan region, caught fire and stopped operating entirely, the company told CNBC. On 9 October, its Kaluga facility, described by Anadolu as Yandex's largest data center in Russia, lost several modules. On 11 October, a third site in the Vladimir region ceased operations.
The air war has not shrunk since. On 29 October, Moscow's mayor, Sergei Sobyanin, said Russian air defenses had downed most of 613 drones heading toward the capital overnight, Reuters reported. That same day, Yandex told investors the strikes had forced it to withdraw its 2026 guidance.
Those two facts sit awkwardly together. Russia can intercept most drones aimed at Moscow while still failing to protect fixed, easily located facilities such as data halls. A single hit on a cooling plant or a switchyard can take a site offline even when the building itself survives.
The decree does not address air defense. It addresses what happens after capacity is lost: who gets the remainder, how quickly, and on what terms.
- •8 October: Yandex's Sasovo site in Ryazan region hit by fire, operations halted entirely (CNBC).
- •9 October: Kaluga site, Yandex's largest in Russia, loses several modules (Anadolu Agency).
- •11 October: Vladimir region site ceases operations (Anadolu Agency).
- •14 October: Sberbank's Balakovo data center in Saratov region struck (Reuters, Anadolu Agency).
- •18 October: VK's facility in the Leningrad region targeted overnight (The Record).
Which companies were hit, and why are data centers targets?
Yandex took the broadest hit. The company confirmed serious damage to one data center, the shutdown of another and infrastructure disruption at a third, The Moscow Times reported. Internet monitoring group NetBlocks measured connectivity to Yandex Cloud at around 30% of normal levels after the 8-11 October strikes, and 84 cloud services were affected.
The outage spread well past Yandex's own apps. Real estate platform Cian, retailer M.Video and internet provider Dom.ru all reported disruptions on 11 and 12 October, according to Anadolu. Yandex said it would waive eligible Yandex Cloud fees from 8 to 31 October and offer relief to personal Yandex 360 subscribers.
The financial cost is now visible. On 29 October, Yandex withdrew its 2026 guidance, saying it had faced "additional external factors making it difficult to assess its financial results for the remainder of the year." Third-quarter revenue was 411 billion rubles (about $5.1 billion), up 12% year on year, with adjusted EBITDA of 88 billion rubles and net profit of 46 billion rubles. It had previously guided toward roughly 20% revenue growth, and its shares fell about 1.3% on the Moscow Exchange after the suspension.
Sberbank's Balakovo site was described by Reuters as Russia's biggest data center, reported to host the bank's new supercomputer. First Deputy Chairman Alexander Vedyakhin confirmed the attack and said all of the bank's systems continued to work normally. Saratov Governor Roman Busargin said the strike also damaged residential buildings and killed one person, Anadolu reported.
VK's case is more contested. The company confirmed its Leningrad region facility was targeted on 18 October but denied any effect on services. Independent monitors recorded about 6,600 complaints on Downdetector and roughly 2,100 on the Russian service Sboy, while NetBlocks put VK connectivity at 56% of normal. Ukrainian drone maker Fire Point said its FP-1 drones were used, and cited published figures showing the site held more than 20,000 servers in 640 racks. Pavel Durov, who built the facility before selling it, wrote: "They failed to protect it."
The strikes are not one-sided. In late September, Russian drones hit several data centers and internet providers in Kyiv, temporarily cutting internet access for about 100,000 households in the capital and surrounding region, according to Ukraine's digital transformation ministry. A Friday strike hit the offices of telecom company Datagroup in central Kyiv and killed four people, The Guardian reported. Ukraine's foreign minister, Andrii Sybiha, wrote on X that Russia had targeted major Ukrainian data centers to disrupt the flow of information.
That history helps explain the tempo on both sides. Data centers sit close to the machinery of daily life, from payments and maps to air-raid alerts and government services. Fighting has moved onto that layer of infrastructure because damaging it imposes visible costs on civilians, which is exactly why the question of who controls spare capacity has become urgent in Moscow.
Is Russia also hardening its data centers?
Yes, and the engineering response is running alongside the legal one. Rostelecom, described by Meduza as Russia's largest internet provider, plans to build underground data centers with what Vedomosti, citing company sources, called an increased level of protection against external threats. The company is in talks with metals producer Nornickel about building one together, according to a source familiar with the discussions.
A Rostelecom source described three layers of defense to Vedomosti. The first is a backup site holding data copies in case primary infrastructure is damaged. The second is spreading computing capacity and services across several geographically separate sites. Underground placement is the last resort. Sources said it could protect facilities from drones and from certain missile strikes.
The government has been moving in the same direction. The Digital Development Ministry approved a set of recommendations in late October for protecting against drone attacks and other aerial threats, including placing data centers underground, Meduza reported. The ministry issued the guidance after Ukrainian drones struck facilities belonging to Yandex and Sberbank.
Physical hardening is slow and expensive, though. Existing halls cannot be moved in a week, and underground construction depends on geology, permits and mining expertise. The new reserve requirement does not add a single server; it redistributes access to servers that already exist.
What does 10% of private data center capacity actually mean?
The decree sets the reserve as a share of floor space and capacity, but neither the Kremlin's summary nor the reporting puts a number on it in megawatts, and no list of covered operators has been published. That gap matters, because 10% of floor space and 10% of power capacity are different constraints. Interfax reported that the Digital Development Ministry's inventory is meant to establish exactly what private operators have available.
In practice, the mechanism looks like a call option rather than a standing transfer. Operators keep selling and using the reserved capacity until the subcommission acts. But every operator now has to hold back a slice that may not be available to long-term customers, and it must be ready to surrender that slice within a day.
The pricing detail is the least settled. Interfax says the subcommission will set a maximum payment for providing reserved capacity, but the decree as reported does not publish a rate, a formula or a compensation standard. Operators therefore face an obligation whose revenue is set later by the same body that can order the handover.
The commercial backdrop is already difficult. The Moscow Times reported in June that Russia had suspended 38 data center projects worth a combined 168.6 billion rubles (about $2.26 billion) over three years, citing high borrowing costs and strains on the power grid. Adding a state claim on capacity does not make financing new halls easier.
For customers, the risk is priority. Banks, retailers, delivery apps and government services that depend on a handful of large providers have now seen what a strike can do to them. The decree creates a formal rule for who gets computing power when the system is short, and that rule gives the state first call.
Is the foreign capacity clause a contradiction?
Russia has spent years pushing data localization and building an internet architecture designed to function under isolation. A 2019 law, often called the sovereign internet law, gave regulators the ability to cut off international connectivity or services such as cloud providers when they deem it necessary, according to the Internet Society. A decree that now permits temporary use of computing capacity abroad, with FSB approval, sits awkwardly beside that program.
Read another way, the clause is a pressure valve. If domestic halls are damaged or full, letting operators route work to foreign facilities keeps Russian services online. The condition that the FSB must agree shows the state wants control over where that work goes, not simply access to more servers.
The clause also raises questions the reporting does not answer. It is unclear which countries or providers would be acceptable, whether Russian user data could be processed abroad under the arrangement, or how the FSB would verify a foreign facility. No such list has been published.
What the combination signals is more important than the legal wording. Moscow is treating commercial computing capacity as strategic infrastructure that can be inventoried, reserved and redirected, while accepting that the country's own capacity is not currently sufficient to guarantee service during attacks.
What is still unknown, and what happens next?
Several basics are missing from the public record. Interfax and The Moscow Times describe the reserve, the ten-day deadline, the 24-hour handover and the FSB-approved foreign option, but neither reports penalties for operators that fail to comply. It is also unclear when, or whether, the temporary measures expire.
The scope of state use is another open question. The decree speaks of supporting the functioning of Russian information resources, which could mean spare compute for government services. It does not say whether the state would gain access to data stored on reserved servers, a distinction that matters enormously for banks, retailers and cloud customers.
Damage assessments remain partial. Yandex has not disclosed the full extent of the damage or a recovery timeline. VK disputes that its services were affected, while independent monitors recorded a sharp drop in connectivity. The claim that all three Yandex supercomputers were likely severely affected comes from the science outlet T-Invariant, as cited by The Moscow Times, and has not been confirmed by the company.
The first test is 12 November, when the reservation requirement takes effect. The second is the formation of the subcommission and the publication of its decisions, which will show whether the mechanism is used for emergencies or becomes routine. The inventory results will reveal whether the state's 10% claim is a marginal buffer or a significant share of the market.
Further strikes would test the arrangement immediately. The October campaign showed that a handful of well-aimed drones can knock out services used by millions of people, and Russia's response so far has been to reorganize access to capacity rather than to add much of it.
For Yandex, the near-term question is guidance. The company said it might resume publishing forecasts at its next earnings report, which would signal a clearer view of repair costs and outage risk. For everyone else, the decree sets a precedent: in Russia, private data centers now hold part of their capacity for the state.