Clouding Over: The Impact of Sanctions on the Russian Cloud

On the eve of the Russian invasion of Ukraine, the Russian Internet and the Russian “Cloud” were booming. But the Western sanctions have stopped their growth in their tracks.

The world these days floats on an invisible cloud—the computer “cloud.” Despite its name, the “cloud” isn’t in the sky; it’s right here on earth. It’s made up of millions of computers—yours and mine, big ones and small ones—connected together through physical wires or satellite systems that converge in vast data storage centers, themselves containing tens of thousands of “servers,” each one with millions of chips, which provide memory and processor power. Businesses store data on it; anything that requires lots of memory and number-crunching uses it. The Internet depends on it. Your files live on it. “Big Data” lives on the “cloud.” And tomorrow’s “Internet of Things” and “Artificial Intelligence” will not exist without it. We all increasingly live on “the cloud.”

So do the Russians—or at least they did. On the eve of the Ukrainian War, the Russian internet was booming. Russian service providers offered a growing array of on-line products, ranging from taxi service and food delivery to retail sites and marketplaces of all kinds. Government agencies, though not as far advanced as the private sector, were experimenting with digital tax collection and various on-line services such as drivers’ license applications and on-line voting. While the Western media have tended to focus—and rightly—on the dark sides of the Russian cloud, such as cybercrime and the repression of political dissent, the rapid spread and the increasing sophistication of the Internet have been transformative for the Russian economy and the population. At the end of 2021, the Internet revolution was still gathering speed, as Russia moved into the era of “Big Data” and digitalization, essentially following the same path as its international counterparts, except about a decade behind.

Then came the Russian invasion and the massive imposition of Western sanctions. The effect of the sanctions, both official and unofficial, has been to stop the development of the Russian IT sector in its tracks. While the Russian internet continues to function, the sanctions have disrupted its access to the outside world, curtailed its investment and growth, and put the ambitious plans of both companies and government on hold. Over time—if the sanctions are maintained—the result will be a Russian cloud that is stunted and isolated, which will hold back the Russian economy.

ON THE EVE: RUSSIA’S SUCCESS STORIES

One of the biggest success stories was a company called Yandex, which had been founded in the mid-1990s as a modest start-up by two college friends, with the aim of creating Russia’s first on-line search engine. Over the following twenty-five years, Yandex grew into a giant, successfully competing with Google in the Russian search market. It soon branched out into other services, including mail, streaming, maps, gaming, and news. In 2011, Yandex’s initial share offering on Nasdaq netted $1.3 billion, making it the largest Russian company on foreign markets. By late 2021, its market capitalization had ballooned to over $30 billion, and the company was expanding into new services outside Russia, notably a joint venture with Grubhub, in which robot vehicles developed by Yandex delivered Grubhub meals to students at Ohio State University and the University of Arizona.

Russian banks, too, had become major players in the fast-growing Russian cloud. Russia’s largest bank, Sberbank, had hired an American, the former head of technology at Citigroup, to lead its development of a country-wide network of connected data storage and processing centers, offering the latest digital advances, such as biometric identification for its customers.

Government officials likewise had vast plans for the Russian cloud. The biggest cheerleader was the prime minister, Mikhail Mishustin. In 2020, Mishustin—whose background is in finance and tax policy-- proudly unveiled the first generation of a fully-digitalized system for tracking and collecting VAT (value-added tax) from retail outlets and small businesses. His minister for digital development, Maksut Shadaev, is a visionary whose entire career had been built around the promise of interconnected digital systems for the modernization of the state. Over the previous several years, Shadaev had pioneered the launch of a digital system for “state services” (gosuslugi) in Moscow Province, through which citizens could apply for drivers’ licenses, record births and weddings and many other formalities, both on their computers and smartphones. By the end of 2021, the gosuslugi were being extended to other locations throughout the country, and the program was popular with the public.

The atmosphere was bullish. Russian IT executives at conferences and in interviews enthusiastically spoke of their plans for the wholesale digitalization of the Russian economy. Government officials were even more keen. Digitalization would open a new era of transparent and efficient government, extending across all of Russia’s eleven time zones. The cloud was hailed as the future of Russia.

THE FOREIGN CORE OF THE RUSSIAN CLOUD

But the Russian cloud had one core potential weakness—it was almost entirely based on foreign technology and imports. According to the Russian Higher School of Economics, the dependence of the Russian electronics sector on foreign imports on the eve of the invasion was extraordinary. Imports accounted for 70% of the value added in technology, services, and software. For some key components, the dependence was even greater; of the nearly 53.000 servers in in operation in commercial data centers in 2021, almost all were foreign. Most of the physical connections of the Russian cloud to the outside world were likewise provided by fiber-optic cables set up in the 1990s in cooperation with Western companies. (The only exception is the Russian Far North, where connections have been provided by Russia’s satellite system.) Banks that were pioneering the use of the cloud to store biometric data on their customers often stored them in foreign data centers outside the country (despite a law adopted in 2015 forbidding this practice). On the eve of the invasion, the large Russian companies were spending over 200BR/year on licenses for foreign IT technology, compared to only 1.4BR for Russian licenses.

Over the past decade, the government had made increasing efforts to promote Russian-made technology, but without much success. The main problem was resistance by users to Russian products. Customer resistance to domestic cloud products was vividly on display in late 2021, on the eve of the Russian invasion, when Sber, Russia’s largest bank and one of the biggest users of servers and data centers, summarily rejected the just-developed Russian-made Elbrus 8C microprocessor, calling it “very weak, a completely unacceptable platform,” comparing it to the top-of-the-line Western counterpart, the Intel Xeon “Cascade Lake.”

The war and the sanctions came as a triple shock. Foreign servers and processors, on which the Russians had relied almost exclusively, were suddenly no longer available. Obtaining updated software was out of the question. Several major service providers have been placed on Western sanctions lists; thus, Sber was put on the US Treasury’s SDN list in February. They have also been hit by “self-sanctions” by various non-state organizations. Nasdaq halted trading in Yandex (although its Dutch registration has spared it so far from official sanctions). Truckloads of servers arriving in Russia have turned around, as drivers refused to unload. Lastly, there is suddenly a shortage of experienced IT personnel, as hundreds of thousands of IT professionals have quit their jobs and left Russia.

The sanctions hit the Russian cloud at a key transitional moment. In the West, the growth of the cloud had gone through three stages over the past two decades. Initially, most data were stored in mainframe computers on the sites of the operators. Then in the early 2000s, the leading IT giants, Amazon, Microsoft, and Google, built large data centers with many thousands of servers to handle their own data and operations; these marked the beginning of the “cloud.” In the latest stage, the three giants started selling their spare server capacity to buyers hungry for more storage. Memory, and the capacity to process stored data, have become commodities.

THE RUSSIAN CAPACITY FAMINE

But in Russia, on the eve of the invasion, this transition was still at an early stage. The result has been an acute famine—of people, skills, and capacity—and a scramble for the limited available server and data storage capacity. Desperate to find safer solutions, businesses and government agencies have besieged the one or two companies that, through luck or foresight, had created new data centers during the COVID downturn and had data storage capacity to spare. These have enjoyed a booming business, leasing space in their data centers—while raising their prices.

But smaller businesses—which number some 6 million, according to prime minister Mishustin--have been hard-hit, especially those located outside of Moscow and Saint Petersburg. These had lagged behind the pace of the leaders, continuing to rely on storing data on their premises and using stand-alone software packages for such services as finance and personnel management. They often used outdated systems.

The government is equally strapped for cloud power. The handful of providers with capacity to spare are now coming under pressure from government agencies—reportedly the security services above all—to surrender part of their service centers for government data storage and processing. So far they have successfully resisted, but the pressure is likely to grow.

Both the private sector and the government had long neglected security. Since the invasion, there has been an epidemic of cyberattacks, especially “denial of service” incidents. This will require upgrading to more secure systems, for which Russian products are not yet available. In addition, many of the specialists with expertise in security have now left.

Given these mounting problems—sanctions, supply shortages, loss of personnel, cyberattacks, and a general shortage of money for investment—even the leading players have been forced to retrench. Yandex, the industry leader, has withdrawn from its international ventures. Sber has had to put aside its ambitious plans to build a network of regional data centers offering “cloud for rent,” and its American leader has departed.

THE CLOUDED OUTLOOK:

Despite these problems, sanctions are not going to put the Russian cloud out of business any time soon. Indeed, for the moment the major service providers are posting increased profits—largely by raising their prices for cloud services—which has enabled them to keep expanding. But the rate of growth is slowing, from annual increases of 30-40% in previous years to only 5% so far in 2022. This slow expansion can only continue so long as servers are available; yet the import of new servers has now all but stopped, and the Russians only make a handful of their own. So long as the sanctions remain in force, then, the physical foundation of the Russian cloud will gradually degrade, as equipment needs to be replaced, and as the need for security against cyberattacks requires upgrades.

The big unknown is whether China will come to the rescue. But despite hopeful talk from Russian IT executives, there is little sign of that so far. For example, Huawei, which only last year had opened a data center in Moscow, has reduced its Moscow office to a skeleton staff and moved most of its employees back to China or other locations in the CIS. Other Chinese providers have been similarly cautious.

Thus to sum up, the main consequence of the sanctions for the Russian Cloud will be slower growth and gradual degradation, isolation from international trends, a chronic shortage of storage, a growing gap between Moscow/Saint Petersburg and the provinces, and increasing competition from the state for available capacity, to the detriment of the private sector. The whole “digital transformation” of the economy is under threat. The Russian Cloud was a child of Russia’s brief opening to globalization. But so long as the sanctions last, it is increasingly fated to be an orphan.

____________________________________________________________________________

Thane Gustafson is the author and co-author of eight books on Russian affairs, including most recently Wheel of Fortune: The Battle for Oil and Power in Russia (2012), The Bridge: Natural Gas in a Redivided Europe (2020), and Klimat: Russia in the Age of Climate Change (2021), all with Harvard University Press.