Your registrar is European. Is your registry too ?

i[a]sy.st (Leet) — Sat, 29 Aug 2026 13:00:37 +0100

Introduction

On 26 August, the US State Department and Treasury designated A/I aka Autistici and Inventati a “specially designated global terrorist” under Executive Order 13224. A/I is a volunteer collective in Italy that has provided free email, hosting, mailing lists and blogs for activists since 2001. Without any legal proceedings, with just a press release this has shown how centralized and censorable the internet is when a european collective lost its main domain due to US sanctions.

Domain

$ whois autistici.org
| status:      serverHold, clientTransferProhibited, serverTransferProhibited, serverUpdateProhibited
| registrar:   Gandi SAS
| expiration:  2029-08-10
| last changed: 2026-08-28T01:57:20Z

First, a little bit about the technical consequences of this listing. The registrar of the main domain autistici.org is still Gandi SAS, a French registrar that was known for its activism. It was a good choice (the one I chose for my website too, btw).

So why is the website inaccessible when US sanctions do not concern European companies ? Well, the bad choice here was the TLD. The suspension statuses are serverX which mean they were set by the registry, not the registrar. This is because .org is operated by Public Interest Registry, a US non-profit which makes by extension the .org a domain bound by OFAC sanctions. All of this to say that their main (and probably others are about to follow) domain is suspended and cannot even be moved to a company outside of the US as it will always be under the same .org registry.

A/I took a lot of technical precautions so that their services were private and resilient. Nothing here makes them less private which is good. However, their resilience plan only ever concerned the servers. As they did have 9 mirror domains but those only used three different tlds with only one being under a tld not owned by a US registry. So they did have redundancy of domains but not redundancy of jurisdictions.

PS : Maybe giving the tld most-used by human right organizations and activists solely to a US company wasn’t a good idea ? I hope most organizations will start to move away from it.

But just add a backdoor for the terrorists !!!

The US government has not accused A/I of doing anything illegal itself other than providing technical support for illegal acts. It has accused A/I of hosting people who did do illegal things and of filtering its users by political affinity which it factually does.

If I had to bet the listed allegations are not false and I would trust the US government (I know) on that. However, none of those establish that A/I wrote any of it, knew about it in advance, or had any control over it. The argument is that running the pipe makes you responsible for what goes through. This makes every email provider and ISP a co-conspirator to crimes. This is the reason the simple counter argument to “just add a backdoor for the terrorists” has always been : you cannot build an exception that only opens for people you dislike, because you will not always be the one holding the key.

The word “terrorist” is not a description here. Whoever is in control gets to apply it, and it works on any activist group. If you think that’s fine because you don’t like anarchists, the only thing standing between you and the same treatment is that the people currently holding the definition happen to agree with you.

Hail the free speech absolutists

For several years now a large part of the US political spectrum has explained to us that deplatforming and the control of online speech is the gravest threat facing civilisation, that private moderation decisions are effectively state censorship, and that the answer to bad speech is more speech which I fully agree with. The United States government has now just deplatformed an email provider by executive order. I now hope all of those US free-speech absolutists will do something about this even though it might be to support a community they despise, because of the argument made previously on the moving definition of “terrorists”.

Solutions to domain suspension for email providers

A solution could have been to use the .it tld as by the time Italy would want to seize their domain they would have had more issues as an Italian organization. But that would still only move the issue to another jurisdiction rather than removing it.

The only concrete technical solution to this that A/I could have implemented would be onion domains. Those can’t be seized as long as the keys are kept secure. This does not replace the domain, and it shouldn’t pretend to. A Gmail user will never be able to send an email to a .onion email address. This isn’t a solution for everyday communications but this is a solution that should be implemented by any email provider used by activists or that have governments or police as their threat model. This permits for everyone communicating between those services to go through the onion network and to a .onion domain making communications more secure and private.

What you can actually do to support A/I ? (before the 25 of September)

I will not paraphrase what they said, just go read their post : https://cavallette.noblogs.org/2026/08/10083/2.