MILAN/WASHINGTON — In an unprecedented escalation of extraterritorial economic enforcement intersecting with digital infrastructure, the long-standing Italian digital services and email collective Autistici/Inventati (A/I) has found itself subjected to United States terrorism sanctions. The designation, enacted by the US Department of the Treasury, has triggered immediate operational crises, most notably the suspension of its primary domain through registry-level intervention.
The move has sent shockwaves through the European digital rights community, raising profound questions about the vulnerability of foundational internet governance structures—such as the Domain Name System (DNS)—to unilateral foreign sanctions, and forcing mail operators worldwide to grapple with complex compliance dilemmas.
Main Facts
The Sanctions Designation
On August 26, 2026, the US Treasury Department’s Office of Foreign Assets Control (OFAC) updated its Specially Designated Nationals (SDN) and Blocked Persons List. Among those added was Autistici/Inventati, an Italian collective that has spent decades providing privacy-focused digital tools, encrypted email, and web hosting to activists, civil society organizations, and privacy advocates.
The designation was executed under Executive Order 13224, a counterterrorism authority originally signed in the wake of the September 11 attacks to starve terrorist organizations of financial and material resources. A/I was bundled into a sanctions package alongside Palestine Action, a UK-based direct-action group designated as a terrorist organization by the British government in July 2025, and Masar Badil, which the US Treasury characterizes as a front organization for the Popular Front for the Liberation of Palestine (PFLP).
According to the official Treasury Department release, OFAC alleged that Autistici/Inventati provided "material or technological support" in support of acts of terrorism. Specifically, the Treasury cited the collective’s provision of web hosting, encrypted email, chat, and video conferencing infrastructure.
The Response from Autistici/Inventati
Autistici/Inventati fiercely rejected the allegations in a public statement published via their blog network on August 27, 2026. The collective stated that it does not provide infrastructure for illicit acts, but rather champions fundamental human rights by supplying essential tools for secure digital communication and "digital self-defence." For over twenty years, A/I has operated as a decentralized, non-commercial bastion of digital privacy, offering its services free of charge to grassroots movements and individuals seeking refuge from corporate surveillance and state overreach.
The Domain Suspension and Technical Fallout
While the sanctions theoretically targeted financial and property assets held within US jurisdiction, the practical blow fell hardest on the collective’s core digital infrastructure. On August 28, 2026, the primary domain—autistici.org—suddenly became unreachable across the global internet.
A technical audit revealed that the domain status had been shifted to serverHold. This restrictive Extensible Provisioning Protocol (EPP) status, applied at the registry level, prevents domain name system (DNS) servers from resolving the domain name into an IP address, effectively rendering the website invisible and cutting off standard mail delivery loops for the domain.
Crucially, the collective noted that its physical and virtual servers remained entirely operational and secure; the blockade was purely a function of domain-name routing and registry compliance. The disruption paralyzed @autistici.org email addresses. While existing cached messages remained accessible to users via local clients, inbound and outbound mail traffic ground to a halt.
The Registry and Registrar Dynamics
The mechanics behind the serverHold status highlight the fragile and US-centric architecture of global domain governance.
- The Registry: The
.orgtop-level domain (TLD) is operated by the Public Interest Registry (PIR), a non-profit organization headquartered in Reston, Virginia, United States. - The Registrar: The commercial registrar through which the domain was managed is a French entity.
Because PIR operates under United States jurisdiction, it is legally bound to comply with OFAC regulations. However, as of late August 2026, neither PIR nor the French registrar had issued public statements confirming whether the serverHold status was enacted in direct response to an administrative mandate from OFAC, a directive from the Internet Corporation for Assigned Names and Numbers (ICANN), or an independent risk-mitigation maneuver by the registry’s legal compliance team.
Chronology of Events
To understand the velocity at which the crisis unfolded, the sequence of events from late August 2026 is detailed below:
- July 2025: The UK government proscribes Palestine Action as a terrorist group, setting a precedent for international scrutiny of networks associated with the organization.
- August 26, 2026:
- The US Treasury’s OFAC updates the SDN list under Executive Order 13224, designating Autistici/Inventati alongside Palestine Action and Masar Badil.
- OFAC issues General License 36, providing a temporary authorization window through September 25, 2026, to allow for the orderly wind-down of certain transactions involving the designated entities.
- August 27, 2026: Autistici/Inventati publishes an initial response rejecting the terrorism allegations and characterizing the sanctions as an attack on digital self-defense and privacy tools.
- August 28, 2026: The
autistici.orgdomain goes offline globally. Domain WHOIS and DNS records confirm the implementation of aserverHoldstatus applied at the.orgregistry level by the Public Interest Registry. - August 30, 2026: Autistici/Inventati issues a comprehensive operational update. The collective informs users that while their servers are intact, new mail delivery is stalled. They announce urgent efforts to transition services to a replacement domain, while advising users on alternative hosted domains to pivot immediately to
inventati.org, which continues to resolve normally.
Supporting Data and Technical Context
Regulatory Framework: Executive Order 13224 and OFAC
Executive Order 13224 grants the US executive branch sweeping powers to block assets and transactions involving designated terrorists, terrorist organizations, and those providing support to them. When an entity is placed on the SDN list:
- All property and interests in property of the target that are within the United States, or that come within the possession or control of US persons, are blocked.
- US persons are generally prohibited from engaging in any transactions, trade, or business dealings with the designated entity.
- Foreign financial institutions and international entities face severe secondary sanctions risks if they knowingly conduct or facilitate significant transactions for sanctioned persons.
General License 36
Recognizing that sudden blockades can create massive administrative and technical friction, OFAC issued General License 36 alongside the designation. This license authorized the wind-down of transactions involving A/I through September 25, 2026. However, General License 36 failed to prevent the immediate technical blacklisting executed by US-domiciled registry operators, illustrating a profound disconnect between financial wind-down grace periods and instantaneous DNS-level enforcement.
Infrastructure Split: .org vs. .it / .net
Autistici/Inventati operates across multiple domains and infrastructure nodes. While autistici.org fell victim to the US-based PIR registry freeze, other domains managed under European frameworks—most notably inventati.org—remained unaffected and continued to resolve. This technical bifurcation provided an immediate lifeline for the collective, allowing them to migrate users and sustain critical communications channels despite the crippling blow to their flagship domain.
Official Responses and Stakeholder Reactions
The Silence of Registry Operators
The application of serverHold without transparent public communication from the Public Interest Registry has drawn sharp criticism from digital rights advocates. PIR, which manages over 10 million domains under the .org umbrella, has maintained absolute silence. Media outlets and domain industry watchdogs, including Emailexpert, reached out to both PIR and the French registrar for comment, but received no substantive clarification regarding whether the action was taken under direct legal compulsion from the US government or as a preemptive over-compliance measure.
Civil Society Outcry
European digital rights organizations have mobilized around the incident, framing it as a dangerous precedent. Activists argue that weaponizing the domain name system—the bedrock infrastructure of the internet—to enforce foreign political and security mandates threatens the decentralized nature of the global web.
By targeting a service provider rather than adjudicated criminal actors, the US Treasury has effectively shifted the burden of policing global speech and secure communication onto technical intermediaries who lack judicial oversight.
The Mail Operator Dilemma
The sanctions have also ignited fierce debates within technical circles regarding email federation and security protocols. On forums such as the Delta Chat community board, system administrators and mail operators have raised urgent operational dilemmas:
- To Deliver or Reject? Should third-party mail servers continue to accept and route emails originating from domains associated with a sanctioned entity, or does doing so violate strict-liability US secondary sanctions?
- Federation Integrity: If mail operators begin blocking domains based on foreign political designations, the foundational premise of email as an open, federated protocol begins to fracture.
Implications for Global Internet Governance
The inclusion of Autistici/Inventati on the US sanctions list and the subsequent silencing of their domain has wide-ranging implications that stretch far beyond the borders of Italy and the United States.
1. The Extraterritorial Reach of US Sanctions
This case demonstrates how US regulatory frameworks can reach deep into European civil society infrastructure. Because critical elements of internet infrastructure—such as the .org TLD registry—are operated by US entities governed by US laws, foreign organizations relying on these foundational layers are structurally vulnerable to American foreign policy decrees, regardless of local European laws or data protection frameworks (such as the GDPR).
2. Over-Compliance and the Chilling Effect
Intermediaries—including registrars, registries, cloud providers, and payment processors—increasingly practice risk-averse over-compliance to avoid catastrophic regulatory penalties from OFAC. When confronted with ambiguous designations, intermediaries often choose the path of least resistance: immediate suspension. This creates a severe chilling effect on free expression, privacy advocacy, and open-source infrastructure development.
3. The Fragmentation of Digital Infrastructure
The Autistici/Inventati crisis underscores the urgent push toward "digital sovereignty" in Europe and other regions outside the United States. As long as critical internet resources remain tethered to US-administered registries and legal frameworks, European collectives, NGOs, and privacy projects remain exposed to sudden, extrajudicial shutdowns.
The incident serves as a stark reminder that digital security is no longer just a matter of encryption and server hardening; it is inextricably bound to geopolitical control over the physical and logical layers of the internet itself. As Autistici/Inventati works to rebuild its operations on alternative, resilient domains, the global tech community is left to reckon with a new normal where a stroke of a bureaucrat’s pen in Washington can erase a European digital sanctuary overnight.
