Beyond the machine¶

Not only servers and data.

A technical threat model protects what is on the machine. This one protects the machine from other people’s compliance departments. It also protects the people who depend on it, who still need to be found when it is gone.

Asset	What is being protected
Service continuity	The ability to keep operating
User access	Users can still log in
User identity	Mailboxes, domains, credentials, recovery routes
Relationships	The ability to communicate with users, suppliers and peers
Historical record	Archives that may exist nowhere else
Independence	Freedom to choose providers without importing another jurisdiction’s risk
Exit capability	The ability to leave a provider without losing the system
Organisational existence	The ability of the project to continue as a legal or operational entity
Evidence	Logs, correspondence, contracts, records and other material needed to contest a decision
User safety	Users not named, listed or cut off because of who hosted them

A mailbox is infrastructure¶

A mailbox receives and sends mail. It resets the passwords of other accounts. For some people it is the only address anyone has.

For some users, an address at the designated collective was the recovery address for a bank account, a government login or a professional registration. Losing it locks the user out of every account that pointed at it.

A mailing list can be the membership record, the archive of decisions and the only route to people who never supplied a phone number.

A blog on the collective’s platform, Noblogs, had been running since 2007. It was publishing posts that existed nowhere else.

Without the mailbox there is no login, no contact and no archive. Without the evidence there is no case to bring.

Last reviewed: 2026-09-25.