The bill¶

Payoffs and expected loss describe a bank. They describe an institution that can price the cost of keeping a relationship and decide what to do with the number.

They describe much less well what disappears when the provider does.

The model is blind on that side. The intermediary can calculate the cost of keeping a relationship. The people on the other side cannot necessarily calculate the cost of losing it, because some of the things being lost have no substitute, no market price and no recovery path.

The archive goes dark¶

A mailing list can be the membership record, the archive of decisions and the only route to people who never supplied a phone number.

A blog on the collective’s platform, running since 2007, can be a publication archive that exists nowhere else. A list of subscribers can be the only record of a community. A domain can be the name by which people have known an organisation for years.

These are records of relationships, not interchangeable accounts.

The figures from the Autistici/Inventati case make the scale visible: roughly twelve thousand mailboxes by one published count and sixteen thousand by two others, alongside thousands of blogs, websites and mailing lists. Each number is a count of infrastructure, but what counts is what is attached to that infrastructure: people, correspondence, decisions, publications, contacts and history.

When the provider disappears, some of those things disappear with it.

The reset link bounces¶

An address at the collective was, for some users, the recovery address for a bank account, a government login or a professional registration.

Losing the mailbox locks the user out of every system that still believes the address exists.

Those systems do not know that the provider has disappeared. They send the reset link into the dark.

This is why identity continuity is a dependency property. A mailbox can be part of the recovery infrastructure of several otherwise independent systems, and the resets keep failing, one system at a time, long after the provider has gone.

Routes to people¶

A provider can also be a communications map.

Legal support, solidarity networks and advocacy groups can lose published contact addresses. Journalists can lose established routes to sources. Members can lose the addresses through which they recognised one another.

People can still communicate. The old route no longer brings the same trust, history or certainty.

A journalist may hesitate before contacting a source at an address publicly associated with a sanctioned organisation. A member may not know whether a replacement address belongs to the same person. A mailing list can be recreated while the social relationship that gave it meaning cannot.

The surveillance model describes chilling effects at population level. Underneath them is the dependency: the disappearance or exposure of a single communication route decides who can still write to whom without being read.

Everyone with a contract¶

There is another category that the game-theoretic model sees mostly as an externality: everyone who has a commercial or operational relationship with the target.

A provider’s withdrawal creates work and risk elsewhere. Suppliers have to unwind contracts. A bank has to freeze, hold or return the money. Hosting partners have to decide which services stop. Registries have to decide whether the name resolves. Customers may have to migrate.

In the Autistici/Inventati case, Treasury issued General Licence 36 to permit specified wind-down transactions with the designated organisation until 25 September. A licence does not show that any intermediary was legally required to withdraw. It shows that enough parties had contracts to unwind that the Treasury wrote them a permit.

The blast radius is larger than the named target.

The target is one node. The contracts around it are edges, and every edge has another party on the far side.

The far side of the desk¶

The same mechanism cut off a prosecutor in The Hague and a collective’s newsletter in Pisa.

They are not equivalent organisations, and the consequences are not equivalent. The mechanism does not require them to be. It requires only that an intermediary decide that keeping the relationship has become more expensive, risky or uncertain than ending it.

The intermediary can put what it stands to lose into a calculation. The people on the far side often cannot. A bank can price the risk of continuing an account, a technology provider the risk of continuing a service, a registry the risk of keeping a disputed domain, an organisation the cost of moving to another provider. A mailbox owner cannot price the loss of twenty-five years of correspondence, a witness the loss of a trusted route to legal support, or a community the disappearance of its membership record. An archive cannot negotiate with the compliance department.

The asymmetry, drawn:

state pressure
      │
      ▼
intermediary exposure
      │
      ▼
intermediary decision
      │
      ▼
provider relationship ends
      │
      ├── data
      ├── identity
      ├── archives
      ├── relationships
      ├── routes to people
      └── recovery paths
              │
              ▼
        impacts outside
        the original calculation

The intermediary’s decision can be locally rational while the loss falls on people who were never part of that calculation.

Resilience is not only whether a provider can be replaced. It is what cannot be.

Last reviewed: 2026-09-25.