The second graph

A service can be built so that a seizure of its disks yields nothing, a subpoena finds no logs, and a node in one country can be replaced by a node in another, and still be ended in twenty-three days by a sentence in a register. The system itself may be technically resilient. The relevant system is the dependency graph around it.

Fourteen ways to be ended

The system can be a service, organisation, collective, project or infrastructure that depends on other organisations for some combination of:

  • identity and naming

  • domain registration

  • DNS

  • hosting

  • networking and transit

  • certificates

  • email

  • payment and banking

  • software distribution

  • authentication

  • backups

  • legal representation

  • communications

  • user migration

Each is a relationship with a party, or a chain of parties, that can end it. The question the model asks is what each of those parties does when keeping the relationship could cost it something whose size it cannot know in advance.

Four kinds of player

Four kinds of player are enough to describe the mechanism, as Nobody has to agree does.

A state chooses where to apply legal, regulatory or jurisdictional pressure, and how widely to draw the category. The targeted organisation chooses among continuing, adapting, litigating and dissolving. Intermediaries, each facing its own local decision, choose whether to maintain the relationship: a registry, a payment processor, a bank, a certificate authority, a transit provider, a hosting company. Successor providers sit downstream. They choose whether to accept displaced users, and whether doing so puts them next in line.

These players do not need to share an objective. The state does not have to defeat the target directly. It can give an intermediary a problem, and the intermediary can then solve its own problem by ending its relationship with the target.

The cost of the move is exported. The state does not bear it, and the intermediary does not have to agree with the reason for imposing it.

The mechanism needs a hold on the intermediary. A state can fine it, prosecute it, cut it off from dollar clearing or the card networks, revoke a licence or bar it from a market, or credibly threaten to. An intermediary with none of that to lose reads the list and changes nothing.

The sum runs one way

Public Interest Registry did not need to decide whether Autistici/Inventati was dangerous. The question facing an intermediary is what happens to the intermediary if it turns out to have been wrong.

Ending the relationship costs the intermediary something it can count: a registration, a customer, a service. Continuing costs nothing if nobody in Washington ever looks, and, if somebody does, whatever the intermediary has that the United States can reach. Banca Etica named its own: card services and payments outside the euro area, for every one of its customers. For a registry incorporated in the United States, the order applies directly.

The intermediary does not have to believe enforcement is likely. It only has to think it possible that the United States will notice, and to be unable to say how much of its business the United States would then cut off. The bank weighs a small certain loss against a large uncertain one, and for a bank that clears in dollars or issues cards on a US network, it makes withdrawal the safer choice across a wide range of beliefs about enforcement.

The intermediary does not have to know where the rule ends. Uncertainty about the boundary widens the area in which exit looks prudent: each institution draws its own defensive boundary, often wider than the law requires.

This pattern is not specific to the Autistici/Inventati case. The European Council on Foreign Relations described the pattern in 2019, when the target was Iran: a lack of clarity about how measures would be interpreted and enforced produced overcompliance by European companies and banks, which cut ties rather than risk a framework they could not map, and OFAC answered European governments’ requests for clarity slowly or inadequately, a pattern most commentators read as deliberate.

Coordination without coordination

Intermediaries might collectively prefer not to close accounts on a foreign state’s list. If they all refused, no single bank or registry could be singled out.

Individually, though, each has reason to protect itself. An agreement among exposed intermediaries not to comply could itself draw an investigation. Each player then has an incentive to leave the arrangement before everyone else does.

The result looks like coordination without coordination. Each intermediary decides based on what it alone could lose, what it alone knows and its own estimate of the downside. The decisions point in the same direction without anyone having agreed that they should.

Armour on the wrong graph

Autistici/Inventati had survived several rounds of the obvious game. In 2004 a commercial host let police copy its disks and told the collective it had been an electrical fault; the collective found out a year later, from a footnote in a case file. In 2010 Norwegian police cloned the disks of a server holding 2,000 accounts, on an Italian rogatory letter, to establish that the logs the collective said it did not keep were in fact absent.

Each round selected for resilience at the layer under attack. Each required an instrument: a prosecutor, a rogatory letter, somebody arriving at a building. The designation required none.

The defended graph ran through server, network, filesystem and application. The designation reached the collective through a different graph: identity, financial relationship, service relationship and jurisdictional exposure. The registry read the list and stopped the name resolving, the payment processor and the bank read it and closed the accounts, and none of them touched a server.

The critical links are controlled by neither the state nor the target. The United States did not control an Italian cooperative bank. The bank did not agree with the United States and said so in public. Yet the bank closed the account.

The designation added a new constraint to the bank’s own decision. The bank then did the rest unaided.

The result is the second graph: the set of dependencies through which an external decision can make parties the target does not control end their relationships with it.

Last reviewed: 2026-09-25.