Yandex Traffic Drop Does Not Prove a Russian Bot Takedown

Ukraine struck three Yandex data centers in October, and a chart showing a steep drop in automated traffic soon became an apparent answer to a much bigger question: Had the strikes knocked Russian political bots offline?

The disruption was substantial. The strikes hit facilities in Sasovo, Kaluga and Vladimir over several days. Yandex said operations at the damaged Vladimir center had been completely suspended. Its AI chatbot and smart-home devices were among the services affected after the earlier attacks. Those are consequences for people who use Yandex services, whether or not they spend a second thinking about political accounts.

Ukrainian President Volodymyr Zelenskyy connected the strikes to social media at the Warsaw Security Forum on Monday. He said it had become “a little easier to breathe on many social media platforms” and attributed a perceived decline in hate and provocation to fewer bots, as Mother Jones documented. That is a consequential claim about online political life. It also asks a web-traffic chart to answer a question the chart wasn't designed to answer.

What Fell, and What Didn't Get Counted

The widely shared Cloudflare chart concerned traffic associated with Yandex. Researchers tracking Russian influence activity identified the drop as requests from automated Yandex web crawlers. Crawlers visit pages so a search engine can index them. Other automated requests can come from tools that check whether a service is running. Cloudflare's category encompasses automated internet requests; it isn't a tally of social-media accounts, posts or replies.

One account can make many requests. One person can operate multiple accounts. A request from a search crawler tells you that software visited a website, not whether a political message appeared in somebody's feed. That's the measurement jump behind the viral claim: a falling number in one category of internet activity got treated as a headcount of participants in another.

The size of the decline doesn't bridge that gap. A figure circulated as a 94% fall in automated traffic originating from Yandex on Sunday compared with the average for the second half of September. Change that comparison period or measure political-account posting instead, and you're asking a different question. The percentage describes the Yandex-linked traffic comparison; it supplies no percentage change for pro-Kremlin posts, AfD engagement or MAGA accounts.

Cloudflare's broader measure of bot activity from Russia remained largely unchanged around the attacks, The Verge reported. That measure also isn't a census of influence accounts. Together, the narrower drop and the broader steadiness suggest the Yandex disruption was prominent in Yandex-linked traffic rather than a general collapse of Russian automated traffic. They don't identify who was posting political content.

The Longer History Inside One Overloaded Word

“Bot” was carrying too much baggage before the strikes. A 2023 study by Indiana University media scholars found that participants tended to overestimate bots' prevalence and to see other people as more vulnerable to them than themselves. The researchers also described a lack of agreement over what counts as a social bot: people applied the label to fake profiles, spammers and fully automated accounts. The study examined perceptions, not the October outage. It helps explain why the same word could make a crawler chart look like a map of political manipulation.

Consider the comparison hidden inside that label. A Yandex crawler's job is to browse and index pages. A political influence account's purpose is to participate in a conversation, whether its operator is automated, human or some combination. Their output can both register as online activity, but a chart of the first measures requests to websites while a check of the second has to examine accounts and their behavior. If the question is whether fewer people encountered manipulative posts, neither measure alone captures what appeared in their feeds.

There is a historical reason to resist picturing every “troll farm” as a data center full of automated accounts. The Internet Research Agency, a Russian influence operation that drew attention after a 2015 exposé, operated from a St. Petersburg office building rather than a Yandex data center, as Gizmodo noted. That precedent doesn't establish where any present-day network runs. It does show why damaging one company's servers cannot automatically stand in for disabling every human-run or automated political operation associated with Russia.

Check the Accounts When the Claim is About Accounts

Researchers who track political activity found a different picture from the dramatic takedown claim. Antibot4Navalny said it saw no “dramatic drop” among the Kremlin-aligned human trolls targeting Russian domestic users that it tracks. The group also said the known Russian disinformation network Matroyshka remained active after the strikes. Those observations concern identified activity, although they cover the networks the researchers follow rather than every account online.

A separate check examined posting by 76 politicians from Germany's Alternative for Germany party and 136 MAGA accounts on Facebook. Valedmar Osted of Common Consultancy said his team compared posts with each account's usual performance at the same post age, weekday and time of day; the differences he gave fell within what he called ordinary day-to-day variation. These selected Facebook accounts aren't a random sample of Russian influence operations, and activity by a politician's account isn't itself evidence that the account is a bot. The check is useful for the narrower question people were asking about those accounts, not for estimating all covert activity across platforms.

The most sympathetic reading of Zelenskyy's point starts with what people experienced. Yandex services did go down, and some users said their feeds seemed different. His office subsequently told the BBC he had been describing the atmosphere on social media, rather than a concrete decline in bot activity. A perceived change is a reason to investigate particular accounts or networks. Without a before-and-after measure of that activity, timing alone cannot assign the change to the strikes.

That leaves a precise way to read the chart. The strikes damaged Yandex infrastructure, and Yandex-linked automated requests dropped sharply. The account checks complicate the claim of a broad political-bot shutdown, while leaving room for individual operations to have been affected. Next time an outage produces a viral “bots vanished” graph, ask what the graph counts before deciding whom it counts.