Karim Khan’s mailbox¶

In February 2025 the United States sanctioned Karim Khan, then chief prosecutor of the International Criminal Court, after the Court’s judges issued arrest warrants for Benjamin Netanyahu and Yoav Gallant in November 2024. Khan’s assets were frozen and he subsequently lost access to his official Microsoft-hosted email account. He switched to Proton Mail, a Swiss provider.

The designation named a prosecutor. It did not need to name the provider.

The case shows the mechanism at a mailbox in The Hague, by the same route it later took to a collective’s domain and bank account in Italy: a sanction made serving one person an offence for a US company, and the company and its customer had to decide between them who would stop serving him.

It also shows something the Autistici/Inventati case makes less visible: sometimes the intermediary decision itself becomes disputed.

One mailbox in The Hague¶

On 6 February 2025, President Donald Trump issued Executive Order 14203, imposing sanctions on the ICC in response to the Court’s actions concerning Israel and the United States. On 13 February, OFAC added Karim Khan to the SDN list. The sanctions blocked property subject to US jurisdiction and prohibited US persons from providing him with funds, goods or services unless authorised.

Khan subsequently lost access to his Microsoft-hosted ICC email account. Public reporting initially described this as Microsoft blocking the account on the orders of the US government. Microsoft said that it had not stopped services to the ICC as an organisation.

In May 2025, a Microsoft spokesperson told the Dutch public-sector publication Binnenlands Bestuur that the company had been in contact with the ICC throughout the process and that this had ultimately led to the disconnection of a sanctioned official from Microsoft services. The company maintained that it had not suspended services to the Court itself.

That left two accounts of the same event.

The ICC could disable Khan’s access in order to preserve its wider Microsoft relationship.

Microsoft could require or strongly encourage that outcome because continuing to serve a sanctioned person would put the company in breach of the sanction.

In February 2026, Microsoft asked the UK Parliament to correct evidence given by one of its executives to the Business and Trade Committee. Hugh Milward, its senior director of corporate, external and legal affairs, had told the committee that “it was the ICC’s decision to terminate and to respond to that sanction, not Microsoft’s”, and that “it was the ICC that has the ability to switch on and off their own users”. Microsoft’s correction says it remained in contact with the ICC throughout the process that resulted in the disconnection of its sanctioned official, and that it never ceased or suspended its services to the ICC.

Dutch media had reported what that contact involved: Microsoft told the Court that compliance required denying Khan access, and that otherwise it would end email for the entire organisation. The Court then suspended his access. Bert Hubert, who had supplied the Dutch press with the information, confirmed those reports to the Register. The committee published the transcript as delivered, without annotation.

The exact allocation of responsibility is therefore more complicated than “Microsoft switched off the mailbox” or “the ICC did it itself”. Milward’s second sentence describes the mechanism: the provider tells the customer which of its users it may keep, and the customer does the switching.

One account was where the sanction on one man met the Court’s dependence on Microsoft.

The Court later decided to move its workplace environment away from Microsoft and towards OpenDesk, an open-source suite delivered by the German Centre for Digital Sovereignty, ZenDiS. The ICC confirmed the move on 31 October 2025, against the background of the sanctions and concerns about dependence on US technology providers.

By September 2026 the Court’s deputy prosecutor said the Court had replaced Microsoft’s office software with openDesk over the past year. Its evidence platform, intake application and storage also run on US companies. Reuters had reported evidence being backed up for fear Microsoft would disengage. In a December briefing to parliament, the Dutch foreign and justice ministers said they were talking to the relevant service providers to prevent overcompliance.

Somebody else’s switch¶

Whoever gets the final line in the argument about the mailbox, the chain runs the same way:

US sanctions
     │
     ▼
Karim Khan becomes sanctioned person
     │
     ▼
Microsoft services become legally and commercially exposed
     │
     ▼
ICC and Microsoft assess available options
     │
     ├── restrict Khan's access
     │
     └── preserve services for the wider Court

The designation did not need to name Microsoft. It only needed to make serving one of the Court’s users an offence for it.

That is the mechanism described in the overview: a sanction on one node makes another node choose. The intermediary does not need to agree with the designation. It needs to decide what it is prepared to lose.

Microsoft’s initial public position emphasised that it had not cut services to the ICC as an organisation, and its president has denied that the company’s actions involved any cessation of services to the Court. The later parliamentary correction and reporting about Microsoft’s communications with the Court showed that the company had told the Court to cut him off or lose its mail.

Both statements describe different edges of the same graph.

                     sanctions
                         │
                         ▼
                    Karim Khan
                         │
                  individual account
                         │
                         ▼
                   Microsoft
                         │
                         ▼
              ICC organisational services

The dependency test asks what choices remained to each party once serving Khan had become an offence, whoever pulled the plug.

The case also tests the first of the properties, provider substitutability, for an institution.

The Court did eventually choose a different software environment. That is evidence that an exit path was available, not that one had already been tested, and not evidence that the original dependency was harmless. The migration began after one user had already been cut off by a decision made outside the Court.

A service that can move its mail and workplace systems has an exit. One that can only begin moving after its dependency has become unavailable has an exit plan, and those are not the same thing.

Last reviewed: 2026-09-25.