Did Ukraine’s strikes on Yandex servers take out Russian bots? What we know

In early October, a claim (archived) circulated that Ukrainian strikes on Russian bot farms caused right-wing or MAGA social media activity to decrease.

Yandex, a Russian technology giant that provides search engine, email and cloud services and facilitates payments, ride hailing and food deliveries, confirmed on Telegram and to local media that drone strikes damaged its servers in Sasovo, Kaluga (archived) and Vladimir from Oct. 7 to 11. Work to restore services affected by the strikes continued on Oct. 13.

Ukrainian President Volodymyr Zelenskyy said on Oct. 12 that Ukraine had struck “Yandex data centers” and that “a lot of people” had seen fewer Russian bots on social media platforms as a result.

The Facebook page Occupy Democrats, which spread the claim about the consequences of Ukrainian strikes against Russian bots, wrote:

Zelenskyy might just have saved our democracy. The genius is brilliantly bombing Russian data centers linked to FAKE NEWS pro-MAGA bot farms in Moscow. Without them, Putin’s midterm influence will accidentally fall from a 30th floor window.

MAGA, an acronym for Make America Great Again, is a political movement supportive of U.S. President Donald Trump. The U.S. has previously accused Russia of using “bot farms” to create false social media accounts that spread disinformation in the U.S. 

On Oct. 11, Tomáš Zdechovský, a member of the European Parliament, shared data (archived) he claimed showed a drastic decrease in online activity around Germany’s far-right Alternative für Deutschland political party in the days following the strikes. Other social media users claimed searches for various health-related topics (archived) and the number of social media accounts advocating for Alberta to seek independence from Canada (archived) also fell after Ukraine’s strikes.

Whether Ukrainian strikes on Yandex servers had indeed taken Russian bots that spread propaganda or misinformation offline was unproven at the time of this writing. As we will lay out below, social media users claiming a direct connection between Ukraine’s strikes and falling web traffic generated by Russian propaganda bots tended to identify correlation rather than causation.

Darren Linvill, who studies the tactics, strategies, and impacts of foreign information manipulations and interference at Clemson University, told Snopes via email on Oct. 13 that the Russian propaganda campaigns he studies do not use physical infrastructure within Russia for their efforts, meaning they would be unaffected by Ukraine’s strikes. Linvill, along with U.S. and international media, also said that a lot of the traffic that was affected by the strikes was likely legitimate, automated traffic, such as web crawlers that index Yandex’s search engine. 

Data from the global internet infrastructure company Cloudflare shared by some accounts (archived, archived) as proof of Russian “bot traffic” decreasing after Ukraine’s strikes showed graphs accounting for all automated traffic, not propaganda bot accounts specifically. Linvill described measuring a drop only in Russian propaganda bot accounts as “exceedingly difficult.”

Lacking credible proof that Ukrainian strikes on Yandex servers starting on Oct. 8 took Russian propaganda bots offline, we leave this claim unrated.

On Oct. 13, Zelenskyy’s office appeared to redefine his statement from the previous day that there was “less hate, less division, and fewer provocations because there were fewer bots” online after Ukraine’s strikes. The office reportedly told the BBC that Zelenskyy was “talking about the atmosphere on social media” rather than a fall in bot activity.

Snopes has contacted Zelenskyy’s office to verify this statement to the BBC.

Parsing the ‘evidence’ of falling Russian bot activity

Some social media users shared data from the global internet infrastructure company Cloudflare that they suggested showed that Russian bot traffic “dropped to nearly zero” after Ukraine’s strikes. 

The data in question, called “Bot vs. Human Traffic,” tracked HTTP requests, which are messages that a client (this could be a browser or a mobile app) sends to a server. Cloudflare assesses HTTP requests a given client sends and scores them according to whether it thinks a human or a bot sent the request.

Cloudflare’s data showed that HTTP requests from Yandex bots dropped on Oct. 8 and again on Oct. 10, dipping to 0.3% of maximum levels. Bot requests had been at 88.2% of maximum levels the week before. Cloudflare’s data also showed that almost all (99.6%) of the HTTP requests sent by Yandex clients were automated, which Cloudflare described as being from bots.

It is important to note that “bot” in Cloudflare’s terminology is not just propaganda bots but any requests that the company classifies as automated. The technology publication Mashable and Euronews reported that Yandex’s automated traffic likely included web crawlers, which are tools that search engines use to keep their database of websites up to date. Mashable reported that damage to a Yandex’s data centers or servers would bring traffic such as web crawlers to a halt.

Linvill also credited the fall in “bot” traffic from Yandex to legitimate, automated traffic such as web crawlers not operating from damaged servers. He wrote that Cloudflare’s data did not suggest there was “a particular reason to believe the strikes would have a significant impact on social bot activity from Russia.”

Other claims about a decrease in Russian bot traffic failed to directly connect Russian bots to any perceived changes in online activity. For example, Zdechovský’s post presented a graph with no source that did not specify what it measured. Another post that claimed a decrease in Google searches for various health-related topics compared data across only two weekends, which was unlikely to be enough to establish and analyze a trend.

An account that claimed accounts calling for Alberta to seek independence from Canada “fell off the face of the earth” after Ukraine’s strikes provided no supporting evidence for the claim that linked it to Russian propaganda bots.

We contacted Zdechovský to ask for the source of his graph and await a reply.

Russian propaganda campaigns hard to track

According to Linvill, actually documenting a fall in Russian propaganda bot activity would not be straightforward. He wrote: 

It would be exceedingly difficult to measure. You would first have to figure out what it was, exactly, you were measuring? There is no one path to influence and no one way malign propaganda is conducted. These efforts are run on global systems across a multitude of platforms and emanating from multiple actors even within the same country. They make it hard on purpose.

Linvill added that the Russian campaigns he followed did not use bots they ran themselves, instead paying for services run from outside Russia. He wrote: “It has clearly become important for Russia to outsource these services than to run them in house. It’s likely cheaper and easier, but also more secure and decentralized.”

In sum, readers should be cautious of blanket claims that Ukraine’s strikes on Yandex’s servers heavily affected Russia’s propaganda operation. While that may be the case, there was no credible evidence at the time of this writing directly linking strikes on servers to a fall in Russian propaganda activity online. Linvall suggested that Russian propaganda campaigns could come from overseas, meaning domestic strikes would not be effective against them, a point that Mashable’s reporting also made.

For further reading, Snopes previously published a guide to spotting bots on social media.

DeepL.com provided translations from Russian to English.

Sources