MacSouverain

FREN
radar

One American order was enough to make autistici.org disappear

The US branded the Autistici collective a terrorist group, and its .org domain was pulled from DNS by its registry. What it says about the sovereignty of your own services.

The facts


On 26 August 2026, the US State Department and Treasury designated the Italian collective Autistici/Inventati a “Specially Designated Global Terrorist”.

Twenty years of encrypted email, web hosting and anonymity tools, used by journalists and whistleblowers and to get around censorship, filed away with a stroke of the pen on the same shelf as a jihadist network.

Immediate fallout: PayPal suspends the account on 27 August, dollar payment channels are cut off, and the domain autistici.org is made unreachable on 28 August, pulled from DNS by its registry in all likelihood.

On 1 September, Italian bank Banca Etica closes the collective’s account too, fearing secondary sanctions. And a deadline is already running: OFAC has set full cut-off for 25 September 2026, after which no American actor, registrar, bank or payment processor, may deal with Autistici at all.

Cut off how? The Americans never touch the Italian servers or the host. They pull the one string they hold: the registry behind the extension. .org is run by an American entity, Public Interest Registry, based in Virginia.

Under pressure from an OFAC designation, the Office of Foreign Assets Control, the registry can be forced to pull the name from the DNS zone, a serverHold. The domain vanishes from the root, everywhere, all at once.

That was autistici.org’s fate on 28 August. Public Interest Registry has made no public statement, but this serverHold, a status only the registry can set, and the timing leave little doubt about who pulled the string. The name isn’t erased for all that; it’s frozen, pulled from DNS publication but still registered, and therefore reversible.

Remember the rule: if the registry behind your extension is American, the United States can act alone, with no judge in your country getting a say. .com, .net and .org are all in exactly that situation.


Why it matters to you

Europe would go about it differently, because it has no such lever. No European mechanism lets you brand a collective “terrorist” and make its domain evaporate worldwide.

Its tools, the TCO regulation on terrorist content, the DSA, Piracy Shield-style DNS blocks, target content and access, not infrastructure. Europe cuts access from its own territory, the domain itself survives elsewhere.

The political reaction bears this out: Italy’s interior minister pointed out that no law compels Italy to enforce an American sanction on its soil, and MEP Brando Benifei announced he would ask the European Commission for protection under the DSA.

A designation from Washington doesn’t make Autistici a terrorist organisation in the eyes of Rome or Brussels.

Two mirror-image models. The United States seizes what hosts, the European Union regulates what gets said. One strikes the root, the other filters the tap. A host that wants to be sovereign has to defend against both, not just one.

The trap is thinking a national domain keeps you safe. A .ch at SWITCH, a .fr, a .eu at EURid all escape Washington’s direct order, European registry and all.

But the domain is only one link. If your host, your registrar, your Cloudflare CDN or your payment rails are American, the indirect levers stay wide open, and that is exactly what hit Autistici on the payments side.

PayPal and dollar donations cut off before anyone even touched its domain. The sovereignty of a service isn’t a domain, it’s a full stack: national registry, national registrar, national hosting, payment collection outside the dollar zone.

The sanction pours in through one channel or several.

Jillian York, of the Electronic Frontier Foundation, sums up the stakes: the idea that an alternative host could be branded a terrorist for providing a service plenty of people want should worry you well beyond Autistici.

For my part, it frankly worries me. The US is dismantling, piece by piece, privacy in every form, under all kinds of pretexts, but with a single goal: total control over people’s digital lives and mass surveillance.

More insidious than a dictatorship, but with the same censorship.


What you do now


1. Look at the extension on your critical domains. A .com, a .net or a .org depends on an American registry, seizable on a simple OFAC order. For what really matters, move to a .ch at SWITCH, a .eu at EURid, or a .fr.


2. Don’t stop at the domain. Go through the whole stack: registrar, hosting, CDN, payment methods. A European domain sitting on an American host or behind Cloudflare is sovereignty in trompe-l’oeil.


3. Keep in mind the domain is just one lever among many. The easiest blows to land are indirect: the bank, the payment, the registrar. The right question isn’t “does my domain hold?”, it’s “which floor of my stack can an adversary bring down without going through a judge in my country?”.


Sources