Russian Data Centers May Face Temporary State Management Under Decree 604 for Protection Shortfalls
Large Russian data centers may fall under the scope of presidential decree No. 604, which permits temporary state management of critical infrastructure facilities with insufficient protection. By default, Rosimushchestvo would assume the role of administrator.
The measure can be applied when an owner fails to fulfill security requirements, poses a threat to stable operations, inadequately protects the facility from drone attacks, or restores operations too slowly after an incident. The decree covers communications, energy, transport, industry, utilities, and other critical sectors.
Industry participants believe that major commercial and departmental data centers serving government bodies, banks, and federal operators clearly qualify. While Tier III and higher facilities usually maintain solid cyber defenses, the primary new expenses will involve physical security measures.
Operators must now protect generators, cooling systems, communication nodes, and other external engineering equipment against aerial threats. The challenge is especially acute in European Russia, where 80–90 percent of commercial data center capacity is concentrated in Moscow and St. Petersburg.
Protection against drones was not previously part of standard data center design. Some companies are already modernizing infrastructure. RTK-DC stated it continuously reviews security measures, while RUVDS confirmed work on safeguarding external equipment.
The market anticipates detailed sector-specific requirements tied to facility category and criticality. Experts highlight the need for redundant communication channels, DDoS protection, vulnerability management, and accelerated recovery processes. Additional protection will require significant capital expenditures that may ultimately be passed on to clients, particularly in government, financial, and telecommunications segments.
First Deputy Prime Minister Denis Manturov assured that no mass campaign or nationalization is planned; decisions will be made on a case-by-case basis at the highest level.
Related articles
How EVRAZ Built Effective Information Security Processes Without Draconian Restrictions
EVRAZ maintains over 92 percent compliance with information security requirements through a small dedicated team despite managing thousands of developers and industrial infrastructure. The company gradually implemented security controls with long transition periods, starting with critical vulnerabilities and expanding to all projects after internal demand grew. External contractor agreements include mandatory adherence to EVRAZ security standards, while architecture reviews enforce DMZ usage and protective controls such as WAF for internet-facing services. A real-world case showed developers initially resisting WAF due to latency concerns but later requesting its reinstatement after observing increased bot activity during a temporary disablement. The department also handled a case where a non-IT employee used AI-assisted development to build an internal service that was quickly compromised during a pre-meeting assessment. EVRAZ now focuses on scaling existing review processes to cover AI-generated code and vibe coding across all users rather than imposing outright bans.
Russia Ready to Disclose Source Code of Social Networks, Messengers and AI Models, Minister Shadaev Says
Russian Minister of Digital Development Maksut Shadaev announced that Russia is prepared to open the source code of its domestic social networks, messengers and video services to foreign partners. The offer includes showing the internal structure of the platforms and jointly modifying their algorithms. Shadaev compared reliance on Western IT products to digital colonialism, citing years of disagreements over compliance with Russian legislation. A similar proposal was made for Russian AI foundation models, which could be adapted to meet other countries' laws, cultural requirements and security standards. The statement was delivered at the Platform of Sovereign Development exhibition, yet no specific products, repositories, timelines or licensing terms were provided.
Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi
Russian authorities are discussing a new rule requiring owners of smartphones imported without customs clearance or purchased abroad to register the devices through the Gosuslugi portal within two weeks. Failure to register would result in the device being blocked from Russian mobile networks. The Ministry of Digital Development is preparing the requirements, which remain under discussion with possible changes to timelines and details. Devices already operating in Russia before April 2027 would be exempt and continue working without restrictions. Officially imported equipment would be added to the registry automatically. The measure is expected to significantly impact gray-market sellers, potentially forcing up to 70 percent of them out of the market and driving price increases of up to 40 percent for some models.
Google Opens Registration for Registered App Stores Program to Simplify Third-Party App Installs on Android
Google has opened registration for its new Registered App Stores program, enabling approved third-party app stores to install applications with a single tap and perform background updates on Android devices. The program introduces stricter compliance requirements, including an annual $10,000 registration fee paid before review, mandatory submission of all APK files and updates for malware scanning, and organizational verification. These features will become available starting December 1, 2026, on devices running Android 17 QPR2 and newer versions, with Russia listed among supported countries. Stores that remain outside the program can continue using the existing multi-step installation process. Google will impose additional fees if more than 1% of installation attempts or 2% of catalog applications are flagged as potentially malicious within any 30-day period. The initiative aims to balance user convenience with enhanced security controls while remaining entirely voluntary for alternative app distributors.