Paths through other people¶
Nothing has to be exploited, nothing has to be exfiltrated, and the target’s own systems can remain healthy from the first day to the last. The path runs through decisions made by third parties. Each step is a party solving its own problem.
Through the desks¶
jurisdictional pressure
│
▼
target
│
┌──────────┬───────────┼───────────┬───────────┐
▼ ▼ ▼ ▼ ▼
registry registrar bank payment host
│ │ │ │ │
▼ ▼ ▼ ▼ ▼
domain domain account funding service
loss loss loss loss loss
│ │ │ │ │
└──────┬───┴──────┬────┴──────┬────┴──────────┘
│ │ │
▼ ▼ ▼
DNS identity email
│ │ │
└──────────┼───────────┘
▼
user migration
│
┌──────────┴──────────┐
▼ ▼
replacement EU replacement elsewhere
provider provider
│ │
▼ ▼
same calculation new jurisdictional
│ exposure
▼
continued service
or withdrawal
A designation puts the target’s name on a list, and every intermediary screens its customers against it.
The registry can disable the domain at the registry level. A registrar can refuse to administer it. A DNS provider can stop publishing the records. A certificate authority can refuse to issue or renew certificates. A bank or payment processor can freeze the account that pays for it. A host can end the service itself. An identity provider can remove an administrative account. A mail provider can suspend an address that other systems use for recovery. A transit provider can withdraw connectivity.
These are separate dependencies. None needs the others to act first, and none needs the pressure to have been aimed at it directly. Each has only to decide that this customer is not worth a fine, a lost licence or a lost network.
In the Autistici/Inventati case, the autistici.org domain became unreachable on 28 August and was later confirmed as blocked by Public Interest Registry, the .org registry. Banca Etica suspended all operations on the account on 1 September, and on 4 September told the association it would close the account and withhold the funds. On 6 September the collective decided to terminate its services and dissolve, with the planned shutdown set for 18 September.
The failures converge on the users, who may leave, lose access, or have to move. Where they go is the branch.
A replacement inside the European Union can restore the service while leaving the users with a provider that has just watched what happened to the previous one. A replacement in another jurisdiction can restore the service while putting the users under that jurisdiction’s warrants, gag orders and material-support statutes.
The path therefore does not end when a replacement provider is found. The dependency test asks the next question: what happens when that provider makes the same calculation?
Through the armour¶
technical hardening
│
▼
less useful data
│
▼
better privacy against
ordinary investigation
│
▼
different interpretation
of the architecture
│
▼
greater perceived
jurisdictional risk
A privacy provider can retain data useful to an investigator and respond when served with compulsory process. It can also design the system so that useful data is unavailable to the provider in the first place.
Riseup has occupied both positions and documented the transition. Its canary statement from February 2017 records compliance with two sealed FBI warrants after its legal options had been exhausted. Riseup then introduced personally encrypted storage for new accounts. It stored mail that only the user’s own login could read, so there would be less to hand over next time.
The second configuration is the one Autistici/Inventati had adopted. Two days after the designation, its blogging platform was breached and its user database was taken: email addresses and hashed passwords, but no IP addresses, because those were not logged. The architecture therefore limited what the breach could reveal. Autistici/Inventati’s own account of the incident records those limits, and the case records what became of the haul.
The two games are coupled. A provider that keeps no logs is harder for a prosecutor to use and easier for a designator to describe: the Treasury’s press release lists hosting on foreign servers and encrypted email among the services that made the collective designable.
There is no stable point at which the provider can hold still. The next intermediary reads the absence of logs as a reason to leave.
Through the missing plaintiff¶
A third path runs through what the target does about the pressure.
Dissolution can stop the next intermediary, and the next user, from being drawn in. It can also remove the organisation that could challenge the decision.
A designation with nobody left to challenge it can become a precedent that no court has examined. An open question leaves the next intermediary guessing at the fine.
That path is drawn as a threat event of its own. The state does not have to take another step. Every remaining intermediary still decides for itself.
Through the exits¶
provider loss
│
├── domain lost ──────► email lost
│ │
│ ▼
│ recovery lost
│
├── email lost ──────► account recovery lost
│
├── payment lost ────► renewal lost
│ │
│ ▼
│ service loss
│
└── identity lost ──► administration lost
│
▼
recovery harder
The dependencies can reinforce one another. Losing a domain can take down email. Losing email can remove the recovery route for other services. Losing payment can prevent renewal of the domain or hosting. Losing an identity provider can remove administrative access to the remaining systems. Losing backups or the ability to obtain software can make rebuilding elsewhere slower or impossible.
The target can remain technically intact while losing the means to operate, recover or move it.
The second graph is not only a route into the system. It is also the set of routes by which the system can get out.
Last reviewed: 2026-09-25.