Russia extends its infrastructure takeover decree to data centres it never designated critical

The instruction arrives without a specification. Kommersant reports that most of the larger Russian data centres already run solid cybersecurity, so the outstanding work is physical ^[15], and the report says plainly that what those drone defences will consist of is unclear ^[6].

That asymmetry is the operative detail. The penalty is defined as operations placed under state administration ^[2], while the obligation itself carries no such definition. A control with no published standard is enforced at the discretion of whoever inspects it.

The legal route matters as much as the requirement. Data centres are not a formally designated critical infrastructure sector in Russia ^[4]. Operators were told the decree reaches them anyway, because so much other critical infrastructure runs on their cloud that an outage would hit both public and private sectors ^[5]. This is designation by dependency rather than by listing. The decree itself, signed last month, covers operators who fail to protect against Ukrainian hacks and drone strikes or who take too long to repair damage ^[3]. No signing date appears in the report; the bulletin's other items are dated September 2, 2026, which places the signature in August ^[14].

Scope: more than 180 data centres in Russia, more than 80% of them in the European part of the country, inside the range of Ukrainian strikes ^[8]. Eighty per cent of 180 is 144, and the "more than" on both figures pushes the real number higher ^[12]. The exposed population and the regulated population are close to the same set, which is why the instruction is easy to justify and hard to price. The facilities east of that line inherit the compliance cost without the threat.

The cost path has a named claim behind it. Risky Business, reading the Kommersant report, expects the counter-drone investment to be passed down to customers, raising IT costs across Russia and neighbouring countries ^[7]. Neither the per-site cost nor a compliance deadline appears in the reporting ^[13]. An operator budgeting now is pricing an undefined control against an undefined trigger.

The panic and the text point in different directions. Russian business owners initially read the decree as a legal framework for nationalising their assets ^[10]. Kremlin officials have since said the transfer of ownership and assets is temporary and will be used rarely, for the most egregious offenders ^[11]. The first is a reading; the second is an assurance from the party that would do the taking. The wording that triggers a takeover has not narrowed in either account ^[3].

For operators outside Russia, the transferable element is the mechanism itself. A state can attach physical-resilience duties to cloud providers through their customers' criticality, skip the sector list entirely, and back the duty with an operating takeover ^[4][5][2]. Anti-drone kit at a data centre perimeter is a wartime line item specific to Russia and Ukraine. Being regulated as critical infrastructure without being listed as critical infrastructure travels far more easily.