State seizes a tenth of private server capacity

The Kremlin compensates for physical vulnerabilities in data centres with price controls and FSB sanctions.

A presidential decree published on 2 November obliges commercial data centre operators to set aside 10% of their capacity and space within ten days. The state is for the first time seizing such a significant share of civilian server infrastructure under the pretext of protecting information resources from external threats. Operators are permitted to run these capacities normally, but they must grant access to them within 24 hours of a verdict by a special government sub-commission.

Physical strikes on key nodes of the Russian digital economy prompted this urgent rulemaking. In October, Ukrainian drones attacked three Yandex data centres and one Sberbank data centre, destroying infrastructure and causing widespread disruptions to online services. While the Ministry of Digital Development and the Defence Ministry are only discussing additional measures for physical protection, such as anti-drone nets, officials decided to plug the resulting gap in computing power through administrative fiat.

The creation of this strategic reserve masks the military's inability to protect physical facilities from air attacks. The reserved tenth of commercial servers becomes a mobilization fund that the state intends to seize after any subsequent successful strike on IT infrastructure. Data centre owners find themselves trapped: their assets face real military risk, yet they are required to keep capacities constantly ready for tasks dictated by others.

The deployed system poses three questions for the market: who will pay for idle space, how the regulator will account for resources, and where the boundary of security agency intervention will lie. The decree formally guarantees payment for the use of reserved servers, but the same government commission that decides to deploy the reserve will also set the price caps. Private IT businesses are effectively stripped of the right to manage their own hardware, and the state dictates the cost of this service unilaterally.

A comprehensive audit of commercial IT assets serves as the instrument of control. The decree instructs the Ministry of Digital Development to conduct a full inventory of all vacant space and capacity in non-state data centres, forming a unified register of hardware accessible to the state. The handling of foreign infrastructure appears anomalous. In mid-October, the Association of Internet Trade Companies proposed allowing firms affected by attacks to place critical systems abroad. The authorities formally accommodated this request, but subjected it to a security filter: any temporary use of foreign sites now requires not only a verdict from the government sub-commission, but also mandatory approval from the FSB.

The strict framework of preemptive control forces the most influential players to seek alternative physical locations. While private businesses are required to maintain a ten percent reserve with a guaranteed transfer of resources within 24 hours, Rostelecom is negotiating with Nornickel to build a special underground data centre with maximum protection against strikes. This illustrates a deep divergence in approaches to security. State-affiliated giants are preparing rock-hewn shelters funded by the raw materials sector, while ordinary server owners are expected to absorb outside risks with their own commercial space.

The attempt to build a digital reserve through administrative pressure ignores the basic economics of the infrastructure market. United Russia's initiatives to create a service reservation system and the Ministry of Digital Development's manuals on installing protective nets do not build new racks or secure the skies above existing sites. The compressed ten-day deadline for reserving capacity turns the commercial IT sector into a mobilized system under strict external management. Businesses are forced to bear all operating costs and financial risks while officials and security services obtain veto power over key infrastructure survival decisions.

The economics of commercial data centres rely on maximum capacity utilization, and the forced seizure of a tenth of the infrastructure undermines operational profitability. The mandatory inventory of vacant capacity and server racks assigned to the Ministry of Digital Development effectively turns internal technological reporting into an open state registry. Private data centre owners lose the ability to contract rack space long-term and sell power to commercial clients because they must keep the reserve free. Market flexibility yields entirely to rigid administration, and the financial costs of idle racks are shifted onto IT operators.

Direct price regulation by the special government sub-commission is a key element of the new mechanism. Instead of applying commercial rates for the emergency allocation of computing resources, the state assumes the right to approve maximum fees for reserved capacity. Private operators fall into heavy dependence on administrative decisions: the hardware operating directive comes from a state body, and execution is strictly limited to a 24-hour window. This model effectively treats private data centres as natural monopolies, removing any possibility of hedging commercial risks.

Mandatory reliability and uptime requirements formulated by the Ministry of Digital Development create additional regulatory pressure on market participants. To guarantee readiness to hand over ten percent of the infrastructure within 24 hours, data centres must restructure internal technological processes and revise agreements with current customers. Independent companies will have to bake regulatory and military costs into their service prices, driving up server rental costs across the chain. The administrative mechanism thus redistributes the burden of the crisis from the state to commercial consumers of cloud services.

The proposal by the Association of Internet Trade Companies to allow critical systems to be moved to overseas backup centres reflected a direct attempt by business to insure itself against repeated strikes. However, the decree's procedure for using foreign sites is entirely subordinated to the security agency. Access to foreign capacity is possible exclusively by decision of the government sub-commission and after mandatory approval from the FSB, which effectively blocks rapid data migration during a critical outage. Instead of a flexible market tool, the private IT sector received another bureaucratic barrier that merely complicates emergency service restoration.

Rostelecom's parallel negotiations with Nornickel to create deeply buried underground data centres mark the final division of the market into two speeds. The largest state operator is enlisting the resources of an industrial giant to build highly secure data centres, gaining direct access to institutional support. Private infrastructure owners must cope with the risks of equipment destruction on their own while the Ministry of Digital Development removes a tenth of their useful capacity from commercial circulation. For the non-banking sector and cloud providers, this means unforeseen losses with no state co-financing.

United Russia's initiatives for systemic digital service reservation and new regulatory requirements from the Ministry of Digital Development shift the financial burden of technological protection entirely onto commercial operators. New reliability standards require private data centres not only to keep reserved racks ready, but also to implement physical drone protection measures at their own expense. Consequently, the state is forming a distributed militarized network of computing resources with a strict 24-hour transfer protocol, fully shifting current costs and capital risks onto private capital.

Measures proposed by United Russia for reserving critical services and Ministry of Digital Development recommendations on protecting facilities from drones cannot quickly replace destroyed capacity. Discussions with the Defence Ministry on additional security measures and the approval of new data centre reliability rules remain administrative instructions that build no new racks and create no physical shield over server rooms. Bureaucratic demands merely increase the regulatory burden on business without solving the fundamental vulnerability of civilian infrastructure to air attacks.

The strict ten-day deadline to allocate ten percent of space and capacity forces private capital to pay for state risks immediately. Operators must maintain this reserve in working order and be able to transfer it to the government within 24 hours of a decision. Market pricing for the seized resource is entirely abolished: a special sub-commission will set the payment rate, compelling businesses to finance state needs at fixed tariffs.

Blocking independent foreign relocation through FSB approval deprives commercial data centres of flexible adaptation options. While private operators could previously redistribute loads and diversify locations, the new order turns the entire commercial data centre sector into a tightly regulated rear-guard reserve. Security officials and bureaucrats gain total control over access to computing power without bearing any responsibility for the commercial losses of hardware owners.

Ultimately, the seizure of a tenth of server space creates no new secure facilities, but turns the civilian digital ecosystem into a mobilized resource. The market IT sector is obliged to function in a state of constant readiness to hand over equipment within a day upon instructions from officials. The state shifts all physical and financial costs of military failures onto the balance sheets of commercial companies while retaining absolute control over the country's key digital arteries.