The next round¶

The dependency graph does not stop when the target disappears.

The first-order effect is usually easy to see: a provider withdraws, a service closes, users move, contracts are unwound. The longer-term effects are harder to measure because the system grows around the disruption before the adversary moves again.

Some effects reinforce the original pressure, others reduce it, and some move the cost from one part of the graph to another.

A market for elsewhere¶

A dependency that becomes unreliable creates a market for its replacement.

Users move. Organisations migrate. Providers advertise alternatives. New infrastructure appears in jurisdictions that were not previously involved. The migration threads after the designation show the first of these in progress: the same three or four small providers named, one of them invitation-only.

This can reduce the target’s dependence on the original provider, but it can also leave the adversary with less to take from the new arrangement.

The long-term question is where the dependency went.

Moving countries¶

Organisations under pressure re-host in another jurisdiction.

A service that once answered to one state’s courts may end up with providers that answer to another’s. Users choose providers outside the adversary’s jurisdiction, and organisations restructure their contracts, payment routes, hosting and legal entities around that distinction.

The result can be a more diverse graph, or a new concentration somewhere else: ten small providers replaced by one large one removes one dependency and creates another.

The long-term effect is a changed graph.

The neighbours take notes¶

A visible withdrawal teaches other organisations what dependency failure looks like.

They can respond by keeping independent backups, separating domains from hosting, diversifying payment routes, moving recovery addresses, maintaining local archives, choosing providers in different jurisdictions and testing exits before they are needed. Taking back the stack is three organisations doing that after the listing, layer by layer, and the Court’s move to OpenDesk is a fourth. Gartner expects European spending on sovereign cloud to more than triple between 2025 and 2027, and names the suspension of the prosecutor’s mailbox as one of the reasons.

The adversary’s action becomes a case study for everyone watching it.

Transferred risk cuts both ways: making one dependency visibly dangerous can make other organisations leave that class of intermediary.

Bigger targets next time¶

The opposite can also happen.

Users leaving a provider under pressure converge on a few alternatives, organisations looking for a safe replacement choose the largest or most familiar provider, and suppliers consolidate because the small ones cannot afford the legal and financial uncertainty.

The immediate target becomes less visible while the surrounding system becomes more concentrated.

That leaves the next intervention a larger target.

How many independent paths exist after the migration counts for more than how many providers replaced the old one.

A signal read both ways¶

A designation or comparable state action also communicates to other organisations.

Some read it as a warning about the target, others as evidence that the target is under unusual state pressure, others again as evidence that ordinary providers are open to extraterritorial pressure. The signal runs the other way too: states in dialogue with Washington have pointed out that sanctions on the Court would hurt US companies as well, and the companies have become more careful about how it looks to pull services from a court.

Each reading can make a bank close the next account, or keep it, where no law says either.

The adversary does not control which interpretation spreads.

The same action can deter one organisation while convincing another to build outside the relevant jurisdiction.

A court draws the line¶

A contested intervention can generate challenges, appeals, parliamentary scrutiny, court proceedings or regulatory responses: the application at Pisa on whether an Italian bank may freeze funds on a foreign listing, and a Commons committee correcting its record on who switched off a prosecutor’s mailbox.

Those processes can establish what intermediaries can and cannot legally do, which protections apply, and where jurisdictional boundaries lie. The Bank Melli judgment of December 2021 is the one such ruling so far on the EU Blocking Statute: a European operator may end a relationship with a sanctioned party without giving reasons, but in a civil action it may have to prove that it was not complying with the foreign measure, and a national court may annul the termination unless doing so would cost the operator a disproportionate loss.

The next intermediary then knows what it may and may not do.

It can also raise the cost of repeating the intervention: once a court has ruled that a bank may not freeze funds on a foreign list, the next bank cannot.

No challenge has the opposite effect: an organisation that dissolves before a court examines the question leaves the uncertainty for the next intermediary to price.

A different graph next time¶

The most durable effect may be information.

Providers learn which customers draw a fine. Organisations learn which dependencies fail first. Users learn which parts of their identity and communication infrastructure they do not control. The sanctions have been an eye-opening moment for the Court and for the organisations around it, on the level of dependency on US technology and the US financial system, and the Court’s own staff ask daily what “material support” and “providing services” mean.

Future targets can then change their architecture before they are listed.

This produces a feedback loop:

state pressure
      │
      ▼
dependency failure
      │
      ▼
visible disruption
      │
      ├── users migrate
      ├── providers change policy
      ├── organisations diversify
      ├── jurisdictions respond
      └── new infrastructure appears
                  │
                  ▼
          dependency graph changes
                  │
                  ▼
          next intervention faces
             a different system

The adversary never gets the same graph twice.

The long-term question¶

A successful first-order intervention can still leave the next intervention harder.

The target disappears and its users migrate; the provider withdraws and the alternatives grow; one jurisdiction loses a service and another gains infrastructure and expertise; a visible use of financial or legal pressure has organisations redesigning their dependencies around it.

None of this means that every intervention produces resilience. The observable next moves are the test: a second European provider listed, a penalty levied on a bank or registrar, pressure on a provider inside US jurisdiction, or a court striking a designation down, and in the four weeks to 25 September none of them was reported.

It means the effect cannot be measured at the moment the original service stops. The graph that exists after everyone has learned what happened is the one the next round begins on.

Last reviewed: 2026-09-25.