Autistici/Inventati¶

On 26 August 2026 the United States designated Autistici/Inventati, an Italian collective providing email, mailing lists, blogs, hosting and other digital services, as a Specially Designated Global Terrorist. Twenty-three days later, the collective’s services were due to end.

No server had to be seized to produce that result.

A designation made the registry, the payment processor and the bank each decide whether to keep the collective, and each decided not to. An ordinary technical breach happened the same week, a different kind of event, and the two are kept apart.

Twenty-three days¶

On 26 August, the US Department of the Treasury, through OFAC, placed Autistici/Inventati on the SDN list with the SDGT designation under Executive Order 13224. The collective says it was never formally notified and learned of the designation through the press. The Treasury’s press release described A/I as an Italy-based far-left organisation providing technological tools and services to violent left-wing extremist groups. A/I rejects those allegations and describes its work as providing infrastructure for communication, privacy and digital self-defence.

The Federal Register notice records A/I alongside Palestine Action and Masar Badil. Its entry uses the clause concerning material, financial or technological support for, or goods or services to or in support of, an act of terrorism, and gives its organisation type as “data processing, hosting and related activities”.

The first consequences appeared outside the target’s own machines. On 27 August, PayPal suspended the account through which the collective collected donations, without notice.

On 28 August, autistici.org became unreachable. A/I says the domain was placed in serverHold and blocked by Public Interest Registry, the .org registry. The collective has not established that PIR acted on a direct instruction from OFAC. The domain stopped resolving without the server being touched. On 6 September the Italian chapter of the Internet Society complained to PIR and to the Society that a provider could be accused of terrorism for content published by its users, and that dot org is not US property but a global resource.

The same day, Noblogs suffered a separate technical breach. A/I says an attacker gained privileged access through a software vulnerability and exfiltrated data from the user database, including email addresses and hashed passwords. IP addresses were not available because A/I did not log them. The platform was taken into read-only mode while it was secured. Domani reports that the platform was renamed “Trumpblogs” for a few minutes, that an account on X claimed the intrusion, and that the data was released by a Trump-aligned influencer, whom Domani names, who then published a map of the sites Noblogs hosted. Who did it is not established. What they got was a list of addresses and password hashes. The list named nobody, because nothing that could identify users had been logged. It was handed to somebody else to draw a target map with. The intrusion added no route the designation did not already have.

These are two different paths through the system on the same day:

US designation
      │
      └── dependency exposure
              │
              └── domain becomes unreachable

software vulnerability
      │
      └── privileged access
              │
              └── Noblogs data exfiltration

The first is the dependency mechanism. The second is a conventional technical attack.

On 1 September, Banca Etica suspended all operations on A/I’s account. The bank says the account had operated normally since 2018 and remained in its medium anti-money-laundering risk category until the US designation. It described itself as costretta, forced, to raise the risk profile and temporarily suspend the account while it sought further clarification. It also said that continuing the relationship could expose the bank’s wider operations: its other customers and members would lose card services and payments outside the euro area. The bank suspended first and sent its inquiries afterwards, to the Ministry of Economy and Finance, the Italian Banking Association, Assopopolari and its external lawyers, telling the association’s lawyers the suspension would hold at least until the answers came back.

The bank did not describe itself as carrying out an instruction from the US government. It described a sum of its own: every customer’s cards and non-euro payments against one account.

A/I subsequently challenged the suspension. Its 8 September application to the Pisa court argues that no Italian law requires the bank to freeze funds only because of a foreign OFAC designation. The application therefore tests the Italian bank’s decision and the legal basis for the freeze. It does not itself test the validity of the US designation.

On 4 September, Banca Etica told A/I that it would terminate the contract unilaterally and that the funds in the account, donated by thousands of people, organisations and collectives, would not be available to the association. A/I says this left it unable to meet administrative commitments, pay suppliers and continue providing services. Alessandro Messina, formerly the bank’s director, argued that the bank could have excluded A/I from the Visa circuit and kept its other services running, and some of the bank’s customers started a petition against the closure.

On 6 September, after consulting lawyers about possible ways to continue, the collective decided to terminate its services and dissolve. A/I says the decision was made to avoid exposing users and people around the collective to further legal and financial risk: the concrete possibility that someone close to it could face criminal or financial consequences, the collective told Domani, left no other choice. Its end, it added, might turn the situation into everyone’s problem instead of somebody’s, or worse, nobody’s. It began preparing instructions for users to retrieve mailboxes, websites, blogs and mailing lists. The planned shutdown date was 18 September.

OFAC also issued General Licence 36, authorising the wind-down of transactions involving A/I until 25 September. That licence provided a route for an orderly wind-down. It did not require every intermediary to continue the relationship until the end of that period. A wind-down authorisation and an intermediary’s decision to withdraw are separate things.

The figures differ by source. The figures reported as the collective’s own were roughly 12,000 mailboxes, more than a thousand websites, over 3,000 blogs and around 3,000 mailing lists. Domani counted 16,000 mailboxes, 20,000 blogs, 5,500 mailing lists and 1,500 sites over twenty-five years. Il Fatto Quotidiano put them at over 16,000 mailboxes, around 10,000 blogs and more than 7,000 sites and hosting spaces. Nobody will reconcile them now that the machines are off. The totals count for less than the fact that the service was infrastructure for a large population.

Nobody touched a server¶

The designation did not need to name the registry, PayPal or the bank. It made each of them decide whether to keep the collective as a customer, and each decided not to. Every other provider and partner had to ask itself the same question.

Banca Etica’s statement makes the mechanism unusually visible. The bank publicly condemned what it regarded as the political use of the OFAC listings while suspending A/I’s account and warning about what continuing the relationship could cost the bank and its other customers.

That is the situation the dependency test asks about:

What happens when the intermediary does not need to agree with the original decision to decide that continuing the relationship is too risky?

The answer here was not one order passed down a chain. It was three intermediaries each finding the customer more expensive than it was worth.

The case also shows why technical hardening and dependency resilience are different properties. A/I’s decision not to log IP addresses limited what could be obtained from the Noblogs database after the breach. It is a privacy property. It did not protect the domain from becoming unreachable or the bank account from being suspended. The two graphs had different failure modes.

The sequence, drawn:

                    US designation
                          │
              ┌───────────┼───────────┐
              │           │           │
           registry      bank      other
              │           │       providers
              ▼           ▼           │
        domain loss   money loss       │
              │           │            │
              └───────────┴─────┬──────┘
                                ▼
                         service pressure
                                │
                                ▼
                         collective dissolves
                                │
                                ▼
                            users move

The technical breach sits beside this graph rather than inside it:

software vulnerability
        │
        ▼
privileged access
        │
        ▼
user database
        │
        ├── email addresses
        └── hashed passwords

        IP addresses absent
        because they were not logged

A system can be well defended against one path while remaining vulnerable through another.

The final dependency is the users themselves.

A mailbox is not only a mailbox when it is also a bank recovery address, a government-login address, a professional contact address, a mailing-list identity and twenty-five years of correspondence. Moving the server does not recreate those relationships. Once the collective decided to dissolve, there was no organisation left to recreate the identities on behalf of its users.

The case ends where the dependency test ends: with whether the people attached to the service had somewhere viable to go.

Last reviewed: 2026-09-25.