Did the United States and Russia Just Agree to Collaborate on Data Centers?

Center for Strategic and International Studies | Nikita Shah, Justin Sherman

Russian Special Envoy Kirill Dmitriev proposed a joint U.S.-Russia data center infrastructure project during broader negotiations following Washington's decision to waive sanctions under the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026. Ukrainian forces recently struck Russian digital infrastructure, underscoring the acute national security vulnerabilities associated with dual-use data facilities during active conflict.

Existing regulatory mechanisms under the US Departments of the Treasury and Commerce continue to restrict technology transfers to Moscow, leaving the proposal's operational feasibility and legal framework entirely unverified. Sanctions exemptions remain completely undefined. Interconnecting digital architecture with entities subject to Federal Security Service coercion introduces immediate counterintelligence risks, severe data exfiltration exposure, and operational friction with Five Eyes and NATO allies. Without explicit commercial incentives or regulatory waivers, any combined infrastructure risks compromising critical US technology while destabilising multilateral sanctions enforcement across European Union partner states.

Comment

Any joint compute or hosting environment creates persistent access vectors for the Federal Security Service (FSB) through domestic legal mandates like the System for Operative-Investigative Activities (SORM-3). Without explicit operational boundaries or defined hardware oversight, physical and logical proximity to Russian state-compelled entities guarantees passive exfiltration opportunities. The complete absence of technical details in current proposals renders risk mitigation impossible for Western enterprise systems.

A comparable structural vulnerability emerged during the 2013 implementation of the U.S.-Russia Bilateral Presidential Commission cybersecurity working group, where diplomatic dialogue was weaponised to probe Western network vulnerabilities prior to the 2014 Crimean annexation. Shared physical or network touchpoints historically serve Moscow as low-cost intelligence collection nodes rather than cooperative security frameworks. Integrating critical infrastructure across hostile jurisdictions systematically degrades NATO counter-espionage postures.

Strategic Question for Discussion

If joint compute infrastructure exposes commercial networks to Federal Security Service authority under SORM-3 mandates, which carries greater operational weight for Western intelligence services — maintaining sovereign data isolation or preserving multilateral Five Eyes collection agreements?

The available evidence points toward strict data isolation as the overriding priority for Allied intelligence services. Experience with Russian legal mandates indicates that physical proximity to state-coerced infrastructure inevitably compromises surrounding data streams. Consequently, my assessment is that Five Eyes partners would restrict intelligence sharing with Washington rather than risk passive exfiltration through compromised dual-use nodes.

Share your assessment in the comments below.

Read the original article