The Rule Reversed

There is a graph that went around in the second week of October, and if you share my politics you probably smiled when you saw it. It is a Cloudflare chart of automated web traffic, and in the days after Ukrainian drones hit a series of Russian data centers, the line drops off a cliff. Fewer bots, the caption said. Zelenskyy bombed the bot farms. Some versions went further: these were the operations that poison Western elections, the ones that helped put Trump in office, and now, weeks before the American midterms, someone had finally shut them down with fire.

I want to confess the pleasure I took in that story before I take it apart, because the pleasure is the problem. I oppose Trump. I support Ukraine's defense against an invasion Russia chose. The idea that a dictator's propaganda machinery could be interrupted by a drone strike, and that the democratic internet might get quieter and saner as a result, is exactly the kind of story I am primed to believe. I did believe it, for about a day, which is roughly how long it takes to check.

What follows is not an argument that the strikes were wrong. It is an argument about what we were being asked to accept, without noticing, when we celebrated them for the wrong reason.

Four Buildings

On October 8, drones struck Yandex's data center in Sasovo, in Russia's Ryazan region. Fire forced a complete suspension of operations. Reuters geolocated imagery to the site and noted thermal signatures consistent with a serious blaze. Yandex had said years earlier that Sasovo hosted two of the Nvidia-based supercomputers it used to train its YandexGPT models. It has not said whether they were damaged. The next day, a second Yandex facility, in the Kaluga region, was hit. Ukraine's drone manufacturer said several modules were knocked out; the regional governor reported nine people injured in that day's attacks on the region. On October 11, a third, in the Vladimir region, shut down entirely, and Yandex said no one was injured. Then, on October 14, drones struck Sberbank's data-processing center in Balakovo, in the Saratov region, a facility reportedly intended to host Russia's largest supercomputer starting in 2027. Sberbank said its services continued normally. The site sits near a nuclear power station, which was not damaged.

Four attacks in seven days. That is a campaign, and campaigns have targeting logic. Zelenskyy offered his version of it directly: "They have been hitting and continue to hit our data centres. We are responding. I can't share all the details." Mirror for mirror. Russia strikes Ukrainian digital infrastructure, Ukraine strikes Russian digital infrastructure.

Then the story grew a second life. In a speech at the Warsaw Security Forum, Zelenskyy said social media now contained "less hate, less division and fewer provocations," and he drew the causal line himself: "Because there were fewer bots. And it's pretty clear where those bots were coming from," reasoning that they disappeared when Yandex went offline. His office later walked that back to something softer: he had been talking about the atmosphere online, rather than a measurable fall in bot activity. But the graph was already moving, and the graph seemed to prove it.

What the Graph Could Not Show

Here is what the graph measured: automated HTTP requests coming from IP addresses associated with Yandex. BBC Verify asked what that means, and the answer it came back with is deflating. Yandex is a search engine. Search engines run enormous fleets of crawlers, automated programs that fetch web pages around the clock to keep an index current. When a company's data centers are burning, throttling the crawlers is among the first and most rational things its engineers would do, because crawling is compute-intensive and discretionary. A collapse in automated traffic from Yandex's address space is exactly what you would expect if Yandex turned down its indexing while it fought fires. It says nothing about who was posting on social media, where, or on whose behalf.

The people whose job is tracking Russian influence operations checked. Researchers monitoring the known networks, the clusters called Storm-1516 and Matryoshka and the rest, found no meaningful change in their activity after the strikes. Cloudflare itself cautioned that the drop was not necessarily social-media bot behavior. There is no public evidence that the struck hardware hosted influence operations, and no evidence that any influence operation went quiet. As for the midterm claim, the idea that these explosions weeks before an American election had somehow damaged the Republican Party's online machinery, there is simply nothing underneath it. No traffic analysis, no polling movement, no platform data. It is a conclusion someone reached before the smoke cleared.

None of this makes Russian election interference imaginary. The American intelligence community assessed in 2017 that Russia interfered in the 2016 election with the intention of damaging Hillary Clinton and assisting Donald Trump, and the Senate Intelligence Committee's investigation confirmed it in exhaustive detail. That record is real. What it does not do is tell us what was running in a server hall in Sasovo in October 2026, and it does not tell us that bombing that hall changed an American vote.

So the bots story collapses. What remains is harder, and more interesting. Because the buildings were real, the strikes were real, and the question they pose is real: under what circumstances does a data center become a legitimate target of war?

The Object in the Law

International humanitarian law has an answer, and it is more demanding than the one the internet supplied. Article 52 of Additional Protocol I to the Geneva Conventions sets a two-part test, and both parts must be satisfied. An object becomes a military objective only if, by its nature, location, purpose, or use, it makes an effective contribution to military action, and only if its destruction, in the circumstances at the time, offers a definite military advantage. The International Committee of the Red Cross treats this as customary law, binding on everyone, whether or not they signed the protocol. And in case of doubt, a normally civilian object is presumed civilian.

Notice what the test leaves out. The object's importance to the enemy never enters it. Neither does the object's value, its scarcity, or the regime's dependence on the company that owns it. And the test never asks whether the object contributes to the war effort in the loose sense in which a steel mill, a bank, a tax base, or a popular entertainer all contribute to a nation's ability to sustain a war. The drafters knew that logic, and rejected it, because it has no bottom. Once "war effort" is the standard, the enemy's entire society becomes the target list, and that is the world the law of armed conflict exists to prevent.

"Effective contribution to military action" is narrower. A data center qualifies if it is actually doing military work: hosting command and control, carrying operational communications, running targeting systems, training models built for battlefield use, housing the cyber units that conduct operations against the adversary. If Ukrainian intelligence showed that a particular Yandex facility was doing that work, the legal case for striking it could be strong, and the fact that civilian customers shared the building would not, by itself, make it immune. Military use can convert a civilian object. That is the honest first half of the analysis, and anyone writing about this should be willing to say it: the strikes may have been lawful. The intelligence that would prove it is not public, and it may never be.

But the second half has to be said with equal clarity. The reasons actually circulating in public, that Russia depends on Yandex, that AI chips are scarce, that the company trains models, that its networks may carry propaganda, that Russia hit Ukraine's data centers first, satisfy neither prong of the test. Retaliation in particular is a political explanation wearing legal clothes: a Russian attack on a Ukrainian building, even an unlawful one, does nothing to convert a Russian building into a military objective.

The Television Station

This is not a new argument, and we have the benefit of having watched it happen once before, in detail, with the lawyers present. In April 1999, during the Kosovo campaign, NATO bombed the headquarters of Radio Television Serbia in Belgrade, killing sixteen civilians. The justification offered was that RTS was the propaganda arm of the Milošević regime, that it spread hatred, that it kept the war going.

The prosecutor of the International Criminal Tribunal for the former Yugoslavia convened a committee to review the campaign, and the committee's report has been the reference point ever since. If RTS had been functioning as part of Yugoslav military command and communications, attacking it could have been legitimate. But attacking it because it broadcast propaganda was, in the report's careful language, "more debatable," and the analysis that followed was skeptical in substance. A mouthpiece for a government's war messaging does not, by being a mouthpiece, become a military objective. Incitement to violence, the Radio Mille Collines case from Rwanda, was different in kind, because there the broadcast was itself the weapon.

I keep returning to that report because it drew the line that this month is testing, and it drew the line knowing exactly how powerful propaganda is. The lawyers were not naive about what RTS had done. They simply refused the premise that shaping opinion is the same act as fighting. Swap the medium and the logic returns unchanged: a recommender system, a search index, a fleet of automated accounts, these are RTS with better distribution. The propaganda is faster now, personalized, continuous, algorithmically tuned, and it demonstrably shapes elections. The ICTY's answer survives all of that. Opinion is not ordnance. If it were, there would be no civilian information infrastructure left anywhere, because in 2026 nearly all information infrastructure shapes opinion.

The Rule Reversed

So let us apply the popular rule to our own side, because that is the only test a rule has to pass before we should consent to it.

Amazon Web Services hosts classified workloads for American intelligence agencies, in physical buildings full of servers that also carry hospital records and whatever someone was streaming the night the Yandex fires started. Microsoft put OpenAI's models on classified networks; OpenAI took a nine-figure defense contract of its own. Google provides cloud and AI services to militaries while running the search engine through which most of the world learns what is true. Meta's recommender systems demonstrably shape political attention at planetary scale, and state influence operations, including Russia's, run on its platforms every day. Palantir's software has sat between commercial AI and actual targeting. By the standard the internet applied to Yandex, that this infrastructure is powerful, that it shapes politics, that militaries use it, that it belongs to a geopolitical adversary's camp, every one of these companies operates buildings that could be described as military objectives.

If a Russian planner, or a Chinese one, or an Iranian one, ran that reasoning past us, we would call it what it is: a pretext for attacking civilian infrastructure, and probably terrorism. The buildings in Ashburn, Virginia and The Dalles, Oregon are full of the ordinary digital lives of hundreds of millions of people who have never made a decision about anything. So are the buildings outside Toronto and Montreal. When the target is ours, we can see instantly that "influences public opinion" is not a targeting criterion, that "hosts military workloads somewhere on the premises" cannot condemn the whole campus, that the workers on the night shift are not combatants. The test has to survive the reversal. A rule that only binds the other side is just a flag.

To be precise, the reversal cuts both ways, and pretending otherwise would be its own failure. If a Western data center genuinely hosts command systems or targeting infrastructure, the law does not grant it immunity because its landing page is friendly. The point is that the analysis is the same everywhere: facility by facility, workload by workload, contribution and advantage, proven rather than presumed. Ukraine's supporters should want that standard defended, because Ukraine's data centers are being struck under Russia's version of the loose rule right now, and Russia will quote every Western celebration of the Yandex campaign back at us the next time it burns a server hall in Lviv.

One Rack in a Thousand

There is a technical problem underneath the legal one, and it is going to get worse before it gets better. A modern data center is not a building with a function, the way a barracks is a building with a function. It is a building with tens of thousands of functions, interleaved down to the level of individual machines. The same hall that trains a commercial language model may also carry a logistics system for the ministry of defense, a hospital's records, a bank's settlement engine, and a state media archive, and the workloads may not even respect the boundaries of the hardware, because cloud infrastructure exists precisely to make computation indifferent to location.

This creates what the lawyers call a granularity problem. Even where a military use is proven, the question becomes: what exactly may be attacked? One workload does not contaminate a campus. The law of precautions asks the attacker to verify the objective, to choose means that minimize civilian harm, to weigh the anticipated military advantage against the civilian damage, which in this domain reaches beyond the workers in the building to the fires, the backup generators, the lost services, the corrupted data of people on five continents who never knew their files were in Sasovo. Whether the data itself counts as an object the law recognizes is still debated; that the servers and buildings holding it are objects is not. Proportionality does not disappear because the object has an IP address. If anything, the interleaving raises the burden: the more civilian life is woven into the target, the more specific the military case must be.

I should admit that I find this genuinely difficult, and I do not want to resolve it more cleanly than it deserves. Militaries are not going to stop using commercial cloud infrastructure, because it is good infrastructure, and states are not going to stop treating adversary compute as strategic, because it is. The two certainties grind against each other, and the result is a legal regime asked to make fine distinctions in conditions where the distinctions are deliberately obscured, sometimes by classification, sometimes by architecture, sometimes by both at once. There may be no clean answer here, only a direction of pressure: the more we insist on specificity, the closer to the object, the workload, the rack, the more of civilian life survives. The more we accept the campus, the company, the sector, the more the battlespace quietly absorbs the internet whole.

The Targeting of Intelligence Itself

A year ago I wrote about the physical concentration of AI, the way frontier training had to happen in fortress facilities full of co-located machines, and about the efforts, including work by people I know and work with, to distribute that training across the open internet. The argument then was about power: whoever controls the data center controls the intelligence. October adds the corollary I did not spend enough time on. Whoever concentrates the intelligence concentrates the target.

You can see the strategic logic from Ukraine's side, and it would be lazy to wave it away. Russia's AI ambitions run through a handful of facilities housing a handful of supercomputers built from chips it cannot replace under sanctions. In a war of attrition, an adversary's irreplaceable capital stock is a tempting objective, and the three Yandex sites and the Sberbank site read, on a map, like the pillars of a national capability. If some part of that capability was feeding military programs, the targeting analysis gets stronger still. But notice what the logic selects for. It does not select for bots, or propaganda, or election interference. It selects for concentration. The more essential a nation's intelligence infrastructure is, and the fewer places it lives, the more it looks like a refinery.

This is, I think, the deepest reason the decentralization argument keeps pulling at me, and also the place where I have to be most careful not to oversell it. Distributed training and inference, models trained across thousands of ordinary machines on ordinary networks, remove the fortress. There is no Sasovo to burn when the training run lives in ten thousand basements and university closets. The resilience is real, and so is the dispersal of control. But the distribution does not dissolve the ethical problem; it redistributes it. If military workloads can hide in a permissionless network, does the network's neutrality become a laundering mechanism? Can a participant in a distributed training run ever know whether their GPU-hours built a tutor or a targeting system? And if the answer is no, have we built infrastructure that is harder to bomb and harder to keep peaceful at the same time? I do not have a resolution to that, and I have stopped expecting one from architecture alone. Pope Leo's phrase, disarming AI, names a task that lives above the network layer, in what we choose to build with it.

What We Were Asked to Accept

The October campaign leaves me less interested in Yandex than in us. A story went around that was false in its particulars and enormous in its implication, and it moved fast because it was gratifying, and the gratification did the work that argument was supposed to do. The bots were bombed. The election was protected. The good guys struck a blow against the disinformation machine. Every clause of that sentence is doing something to the law, and the sum of it is the proposition that infrastructure which shapes opinion is a legitimate target of violence.

I do not accept that proposition, and I do not think the people repeating it would accept it either, the moment it was aimed at them. The test the law gives us is harder and more honorable: what was this building doing for the war, and what did destroying it achieve? Ukraine may be able to answer that question about these four facilities, from intelligence the rest of us will never see, and if so the strikes will stand on that evidence rather than on our applause. But the applause is its own datum. It tells the next planner, in the next war, on either side, that the public will not ask what the servers were doing. It will ask whether the servers were theirs.

curl -sL https://synapz.org/raw/2026-10-16-the-rule-reversed | shasum -a 256

curl -sL https://synapz.org/signatures/2026-10-16-the-rule-reversed.json | nak verify

curl -sL https://synapz.org/signatures/2026-10-16-the-rule-reversed.json | jq -r '.tags[] | select(.[0]=="x") | .[1]'