Last week Ukraine ran what may be the most effective counter-disinformation operation of the year. It wasn’t a community note, fact-check, or trigger warning. It was a direct attack on Russian servers.

Overnight on October 7 to 8, Ukrainian drones hit a Yandex data center in Sasovo, about 300 kilometers from Moscow. Yandex is Russia's dominant search engine and its largest technology company. The company said the site had stopped operating entirely, and later that it could not confirm the equipment could be restored.

The next day, a second strike disabled several modules at Yandex's data center in Kaluga. Yandex said it could not give a timeline for bringing them back. Two of its five data centers had now been hit, and the Sasovo site housed two of the three supercomputers Yandex uses to build its AI models.

Major Russian companies that underpin the terrorist state’s entire economy run on Yandex. Russian Railways, the mobile carrier MegaFon and several Russian media outlets were knocked offline. On the afternoon of October 8, the websites of RIA Novosti, Interfax, Rossiyskaya Gazeta (a Russian propaganda outlet that BBC journalist Steve Rosenberg translates for Westerners everyday), RBC, Vedomosti, Kommersant and Vesti stopped loading. They came back within hours, but for a while, a large share of the Kremlin's domestic megaphone went silent.

Russia has been hitting Ukrainian data centers since late September, and President Zelensky said Ukraine always responds in kind. But the first person to claim the Sasovo strike publicly was Andriy Kovalenko, the former head of Ukraine's Center for Countering Disinformation - a center I visited while in Kyiv recently. The Center has a miniscule $2M budget up against Russia’s massive $2B budget. Russia’s budget is probably a lot higher than what is reported.

I tracked a basket of search terms that work as a thermometer for the health misinformation ecosystem: anti-vaccine myths, bogus cancer remedies, etc. Anti-vaccine narratives in particular are ones Russian troll networks have pushed for years, and now that Russia has its own pneumonic plague outbreak, they’ve been pushing false narratives even harder. I compared Google search interest for October 1 to 3, before the strikes, with October 8 to 10, after them. Every one of the nine fell.

The drops were steepest for the newer, more manufactured narratives. Searches for spike protein detox fell 26.1 percent and turbo cancer 20.3 percent, both products of the post-COVID anti-vaccine wave. That pattern is what you would expect if the thing that changed was amplification. Young narratives that depend on constant pushing lose altitude fastest when the pushing stops. Old ones have communities that carry them on their own.

In addition to disinformation narratives losing steam, Western podcasters allied with the Kremlin have lost viewers. One dropped over 70% after the Yandex strikes. No other plausible explanation has surfaced that would account for such a freefall in viewership.

A modern influence operation needs compute to generate content at scale, increasingly with AI. It needs servers to host the sites, run the bot accounts and coordinate the networks. Hitting the infrastructure works at the narrative-forming stage, and everything downstream loses capacity at once. In military terms, it is the difference between intercepting missiles and destroying the launchers.

For a decade, Western counter-disinformation has been played almost entirely on defense, and almost entirely downstream. Community notes come after a post trends. Retractions and corrections come after a story is published.

The lesson for governments is to treat the server farms, AI compute and hosting behind state influence operations as part of the war machine. The lesson for the rest of us is to measure. If we want policymakers to take information warfare seriously, we have to show them what moved, with data, and be honest about what we don't know yet.

The cheapest lie to fight is the one that never gets posted.

Andrew Moore
Founder, Narrative