On 13 October 2026, Estonia's Information System Authority (RIA) reported that traffic from Yandex's network to Estonian websites had fallen 99.8% against the September average. ERR News reports that Ukraine struck three Yandex data centers in the preceding week: in the Vladimir region east of Moscow, in Sasovo and in Kaluga. Yandex suspended operations at the Vladimir facility. RIA analyst Simon Berner said, "The average number of queries coming from the Yandex network has decreased by 99.8 percent."
The figure is a byproduct. Yandex's crawlers and services simply stopped sending requests. It does, though, show what happens when a few buildings carry a large share of a country's digital life.
The case for the sovereign internet model
The strongest argument for Russia's approach deserves a fair statement. Any state worries that its critical communications depend on foreign infrastructure it cannot control. Federal Law No. 90-FZ of 1 May 2019, published in Rossiyskaya Gazeta and in force from 1 November 2019, amended the Law on Communications and the Law on Information. It was sold as protection against external threats and as a way to keep Russian networks running if they were cut off from the global internet. Garant's commentary describes the aim as creating duplicate, backup infrastructure for uninterrupted operation of the Russian internet. Resilience is a legitimate public goal, and democracies pursue it too.
What the law actually built
Resilience in the engineering sense means redundancy, diversity and decentralization. The statute's text points the other way. According to the published text, it requires providers to install "technical means of countering threats" supplied by the regulator and to report their location. It creates a register of traffic exchange points, and autonomous-system holders must use those listed in the register. It lets the federal regulator manage the public telecom network centrally when it declares a threat. The Internet Society's analysis notes operators must give Roskomnadzor remote access to this equipment and that, in a declared emergency, the regulator can directly control routing.
The design therefore concentrates control rather than spreading it. Roskomnadzor holds the levers, and traffic is steered through registered chokepoints. Reporting from Mediazona says the deep-packet-inspection devices sit on every ISP's network and are controlled only by the regulator.
The model has moved from isolation to whitelisting
The 2026 version of the model leans even harder on a short list of domestic services. Mediazona reports that a registry of "socially significant services" began in September 2025 with 57 sites, including Gosuslugi, VK, Max and major Yandex services. Mobile shutdowns, which authorities attribute to Ukrainian drone attacks, left central Moscow without mobile internet for nearly three weeks in March 2026. Large companies, including Yandex, were told to block users detected using VPNs or risk losing their whitelist status.
If the approved domestic services are the only ones guaranteed to work during restrictions, the physical facilities hosting them become the system's critical dependency. Strikes on those facilities hit the part of the network the state has promised to keep alive.
What the strikes do and do not prove
Caution is needed. RIA itself said it was too early to judge any change in Russian cyberattacks. Berner said there was "no reason to assume that disruptions to Yandex data centers would have a significant effect on the frequency of cyberattacks directed against Estonia." RIA does not monitor Russian influence operations and could not confirm foreign media claims that the strikes disrupted them. A 99.8% drop in one network's requests also says little about how much capacity Yandex lost overall, since traffic can be rerouted to other sites.
The broader disruption is real, though. The Record reported on 14 October that the travel platform Anywayanyday suspended new bookings after a cyberattack, and that more than 500 flights were delayed or cancelled at Moscow-area airports amid Ukrainian drone attacks. That report does not link the cyberattack to the drone campaign, and the two should not be conflated.
The policy lesson
The lesson is for regulators everywhere, not only in Russia. A resilience mandate that works by centralizing control, registering exchange points and routing traffic through regulator-supplied equipment adds failure modes. It also gives users no recourse when a single site fails. Mediazona cites a Kommersant report of March 2026 on a plan to raise filtering capacity 2.5 times by 2030, to 954 Tbps, at about $186 million from the federal budget. Money is going into the control layer rather than into geographic redundancy for the services people rely on.
A pro-innovation approach to network resilience looks different. It favors many independent operators, multiple exchange points that anyone may join, open peering, and portability of services across hosts. Those properties let a network absorb the loss of a building. They also come with the open internet's other benefits: competition, speech and security audits that do not depend on one agency.
States have real security concerns, and wartime damage to infrastructure is not a failure of policy design by itself. But the evidence of this week is consistent with the long-standing engineering critique. A sovereign network built around a handful of facilities and one regulator's switches is controllable, yet brittle. Policymakers elsewhere weighing "digital sovereignty" rules should ask whether a measure makes the network harder to break or merely easier to command.