Yandex outage didn't destroy Russian bots, just moved them

A Cloudflare chart circulating this week shows bot traffic plummeting after Ukrainian drone strikes hit Yandex servers. The interpretation has been immediate: Russian disinformation infrastructure took a hit. But the signal everyone is reading tells you almost nothing about whether Russia's actual disinformation capacity degraded at all.

The bot traffic that dropped was probably ordinary — Yandex users reconnecting through different CDNs, legitimate service bots rerouting, the background noise of a company shifting traffic when one set of servers goes dark. Cloudflare measures traffic volume, not intent. A spike in bot activity on a server farm can mean state-sponsored troll farms or it can mean the automated systems that keep a search engine running. The chart cannot distinguish between them. Assuming it can is exactly how we built false confidence after Twitter's 2016 purge of Russian troll accounts.

That purge looked decisive. Researchers measured a 70% drop in troll farm activity within weeks of the suspension. Policymakers cited it as proof the model worked. What they missed until months later was simpler: the same operators had migrated to VK and Telegram. They did not disappear. They relocated to platforms with looser moderation and kept working. The infrastructure survived because it was designed to be transient.

The actual question here is not whether Yandex mattered but how quickly Russian disinformation operations can reconstitute themselves. If they run redundant infrastructure across multiple cloud providers — which any competent adversary does. Then a single outage is a speed bump. The bot traffic recovers not because new infrastructure was built but because existing backup systems came online. We keep mistaking routing changes for the destruction of Russian information warfare because the alternative. That they simply relocated. Feels less like victory.

This is not a character flaw in the analysts making the claim. It is a design problem in how we measure success against adversaries who expect disruption and build for it. Until we stop celebrating the signal and start tracking what actually reconstitutes, we will keep arriving at the same premature conclusion that the threat has been neutralized when it has only shifted address.