What happened

On 26 August 2026 the US Treasury designated the Italian collective Autistici/Inventati a Specially Designated Global Terrorist (SDGT) under Executive Order 13224. Treasury alleges that the collective provided hosting, encrypted email and the Noblogs platform to "Antifa cells" and other violent far-left groups, and that it served the Kurdistan Workers' Party (PKK).1 The same day OFAC issued General License 36, which authorises only the wind-down of transactions with the collective.2 The collective, founded in 2001, denies the allegations and describes its services as tools for digital self-defence.4

The rest took about ten days. On 27 August PayPal suspended the account. On 28 August Public Interest Registry (PIR), the US operator of .org, placed autistici.org on serverHold and the domain stopped resolving. On 1 September Italy's Banca Etica suspended the account as a precaution.3 PIR said it must comply with US sanctions law.4 The wind-down licence ran until 25 September, and on 6 September the collective announced it was ending all services.4 At its peak it served about 16,000 mailboxes, 10,000 blogs, 1,500 websites and 5,500 mailing lists.3

On 13 October Dutch police, at the request of the United States, seized a server the collective rented in an Amsterdam data centre. The basis was a bilateral treaty on mutual legal assistance in criminal matters, and a copy of the data is being prepared for the US side.5 Neither the Dutch government nor the EU has adopted the US designation.6

Why distribution did not help

The servers sat in different countries, but the control points existed only once: one domain at one registry, one payment provider, one bank. One decision at each was enough to switch the service off. None of those decisions was a court ruling, and none was taken in Italy or in the EU.

A question for RIPE

At RIPE 93 in Sofia, Timo Hilbrink gave a talk titled "How safe are our domain names from US sanctions?"8 He said Autistici/Inventati was not a political organisation but a service provider, and warned that RIPE NCC itself could come under fire as an IP address provider.7 Participants pointed out that Verisign, which runs .net and .com, is also subject to US law, and asked what would happen if SIDN, the operator of .nl, were targeted.7 Internet Society CEO Sally Wentworth wrote that refusing to enforce sanctions would have exposed PIR to "significant criminal and civil liability".7 Joe Abley proposed not building a "separate European internet" but steadily removing single points of failure: one bank, one currency, one data centre, one registry.10

For RIPE NCC these dependencies already cost money. It has abandoned its 2019 "Cloud First" strategy and is returning to self-operated infrastructure in two data centres.7 The draft 2027 budget raises capital expenditure from €930K to €10.5M, including €2.2M for office renovation, and the infrastructure renewal project runs from 2026 to 2028.9 According to heise, of 2,339 members and end users screened, 53 are officially subject to sanctions. Since 2021 more than €7M in contributions has been deferred because Dutch banks comply with US sanctions.7

Which points of failure technology can close

Each dependency in this story can be examined separately.

Domain and DNS. If access to a service starts with a name in someone else's registry, that registry is the off switch. The alternative is to check authenticity by cryptographic signature rather than by the channel the address arrived through. If the client already knows a public key, a signed server list can be delivered by any route: directly, through DNS queries, via an intermediary or as a file. The client discards a forged copy and replaces a blocked channel with another.

Records that can be seized. Keys and node lists can be published in an append-only public log, such as a smart contract. Such a record cannot be seized like a server, and nobody can quietly show one recipient something different from what everyone else sees.

Individual IP addresses. Blocking specific addresses is countered by rotating nodes and by letting each client see only a small part of the network. This is not leaving IP behind: nodes still need addresses, hosting and allocations from regional registries, including RIPE NCC itself.

One example of this approach is the IPvX research project. In a lab experiment, messages are delivered directly over Ethernet with a dedicated EtherType, with no IP or DNS on the delivery path. An exchange between five machines over two routes, including route rebuilding, has been tested.11 The authors state plainly that a global network and open admission are not yet proven, and that their RFCs are working drafts, not IETF standards.11 Lopux, a consumer service built on the same network, offers a VPN and its own namespace, Lopux-Internet. These names resolve only inside the network and do not depend on ordinary registrars.12 It is a pilot: registering new zones still requires operator approval, and the registry runs on the Sepolia test network rather than Ethereum mainnet.

What technology does not provide

None of these techniques would have helped Autistici/Inventati keep its bank account, its donations or the server the police came for. A protocol removes the dependency on a registrar, but not on the jurisdiction the operator works in, nor on banks weighing the risk of secondary sanctions. There are new dependencies too: the blockchain and its RPC providers, node hosting, the developers themselves. A project with a single operator is also a single point of failure, just in a different place. IPvX currently has one voting member,11 and its website says so openly.

This leads to the conclusion the author of the Habr article also reaches: technical redundancy offers little protection against administrative decisions by a state.10 Only spreading every kind of dependency — technical, financial, legal and organisational — protects, so that no single decision switches everything off at once.

Conclusion

The Autistici/Inventati case is no reason to expect RIPE NCC to be switched off tomorrow. But "single point of failure" now has to be read more broadly: not only a disk or a link, but also a registry, a bank or an official's signature. Technology can close some of these points: the domain, DNS, specific IPs, forged records. The rest requires organisational measures — several banks and jurisdictions, distributed governance. That is exactly what RIPE is discussing now.

  1. [1] Treasury Takes Action Against Violent Far-Left Terrorist NetworksU.S. Department of the Treasury
  2. [2] Counter Terrorism Designations; Issuance of Counter Terrorism General LicenseOFAC, U.S. Department of the Treasury
  3. [3] Italian hosting collective Autistici/Inventati is shutting down after a US terrorist designationTNW (Netherlands)
  4. [4] Autistici/Inventati, dagli USA le sanzioni al collettivo italianoEuronews (EU)
  5. [5] Why has the US seized Autistici/Inventati servers in Amsterdam?Digit / nd (Germany), Matthias Monroy
  6. [6] 'Terrifying Precedent': Dutch Hand US Data From Seized Anti-Fascist ServerDecrypt (USA)
  7. [7] RIPE members debate reliance on U.S. internet infrastructureheise online (Germany), Monika Ermert
  8. [8] Plenary, 27 October 2026: How safe are our domain names from US sanctions?RIPE 93 programme
  9. [9] Draft Activity Plan and Budget 2027 PublishedRIPE NCC
  10. [10] Вопрос к RIPE: кто следующий — или как хостинг с 25-летней историей закрылся в Италии из-за санкций АмерикиHabr, Александр Чекалин
  11. [11] IPvX research projectIPvX
  12. [12] Lopux-VPN and Lopux-InternetLopux