Keep the Internet free

We are not terrorists. Autistici.org is an infrastructure of dissent

Press Release

[Last updated: September 10, 2026]

1. Quick summary

On August 26, 2026, the U.S. Department of the Treasury, through OFAC (Office of Foreign Assets Control – the authority responsible for managing and enforcing economic and financial sanctions) sanctioned Autistici/Inventati (A/I), an Italian collective that has been providing digital infrastructure – email, hosting, mailing lists, chat, videoconferencing and other privacy-friendly online services – to movements and activists since 2001. Washington designated it as a Specially Designated Global Terrorist (SDGT), alleging that it has provided financial, material or technological support to terrorism and to organizations already subjected to sanctions. A/I rejects the allegations and declares that its activities consist in providing tools for digital self-defence and infrastructure for the freedom of communication.

On August 28 the autistici.org web domain was found to be unreachable. The collective attributed the problem to the DNS level and to the .org domain registry, Public Interest Registry (PIR), which was later confirmed. This technical point is important: what was shut down was not a server; the domain was made unreachable by preventing the normal DNS publication or resolution. And the decision was made by PIR, which is allegedly a non-profit organization created by the Internet Society to manage the .ORG domain and “serve the public interest online”.

That same day, A/I’s Paypal account, which was used to gather donations, was shut down without any notice. Few days after, Banca Etica communicated through a series of phone calls their intention to temporarily suspend the association’s bank account, containing all of A/I’s funds, all gathered through donations from users. On Friday September 4 this decision was enacted, thus making it virtually impossible for the association to honour administrative committments, pay service providers and provide services to users. On September 8 the association filed an urgent appeal against Banca Etica, asking the bank to immediately restore the functionality of the bank account operations, since no Italian law requires a bank to freeze funds following a designation by the United States.

When A/I’s was designated, the collective set up to explore all possible solutions to appeal against the sanctions and to keep existing. Nevertheless, after talking to several lawyers it became clear that such a fight would endanger many users and individuals in the hacker and activist communities, exposing them to manipulations and financial and legal harm, or worse. So on September 6 the collective decided to terminate all services and dissolve the group. They have started preparing as smooth a transition as possible, publishing instructions on how to back up blogs, websites, mailboxes and mailing lists. The planned date for this shutdown is set to be September 18, 2026.

2. Who is Autistici/Inventati

Autistici/Inventati was born in Italy in March 2001 from the meeting of individuals and collectives active in the fields of technology, privacy, digital rights and political activism. The collective offers free infrastructure as an alternative to large commercial platforms. A/I presents itself as an anti-fascist, anti-racist, anti-sexist and anti-militarist organization, opposed to capitalism and to authoritarianism, and selects the projects it hosts based on their compatibility with these principles.

The infrastructure is managed through a formally recognised association. This means that A/I is not an informal group: its activities are run by an association complying with all existing legal regulations, with legal responsibilities, contractual relationships and the associated obligations and controls.

This does not mean that the association has never had to deal with the justice system. Over the years there have been proceedings and interventions by the authorities, also on an international scale. Among the episodes recalled by the collective are the 2004-2005 intervention on the servers hosted by Aruba, in the context of an investigation launched by the public prosecutor’s office in Bologna, as well as subsequent disputes concerning individual pieces of content or accounts. In all these legal procedures, the association and its leadership have been acquitted from all charges. In another case, following a suit by Trenitalia concerning a satirical site, the court of Milan ruled in defense of satire. All these proceedings took place through ordinary judicial channels and Italian authorities never designated the association as a terrorist organization.

OFAC’s designation is connected to the usage of A/I’s services by alleged “terrorist groups”, but Autistici/Inventati never received requests for information on these users or takedown orders related to illegal contents, and has never been informed of any investigation or legal procedure related to their activities. Had this been the case, the association would have complied with legal requirements, and potentially appealed to a court of law if they had deemed it appropriate.

3. What the United States has decided

On August 26, OFAC placed Autistici/Inventati on the Specially Designated Nationals and Blocked Persons List with the SDGT designation. The legal basis is Executive Order 13224, issued in 2001 and subsequently amended, which allows for action to be taken against those who, in the view of the US administration, provide material, financial or technological support to terrorist activities.

It is worth noting that A/I was never formally notified about this decision and only learned about it through the media.

The SDGT designation should not be confused with the Foreign Terrorist Organization (FTO) category. It is primarily a sanctions designation: assets and property interests subject to the US jurisdiction are frozen, and US citizens are generally prohibited from conducting transactions with the designated entity, subject to OFAC authorization.

4. What Washington accuses A/I of

According to the US Treasury, A/I provides digital infrastructure, tools and services to “violent Antifa cells” and other left-wing extremists. The statement cites hosting, encrypted email, chat and videoconferencing, streaming, and the infrastructure associated with Noblogs. Washington also claims that the infrastructure was made available to organizations already subjected to sanctions, specifically naming the PKK.

The logic behind this accusation is therefore not simply “A/I carried out a terrorist attack”. The point is so-called material support: according to Washington, the technological infrastructure constitutes a means of supporting individuals or activities qualified as terrorist.

The point at issue is therefore less straightforward than the phrase “has carried out terrorist acts” suggests: the charge concerns the role of the infrastructure and of the services provided to users. In this perspective, the question becomes to what extent the provision of technological services — email, hosting, chat, streaming or other communication tools — can be considered material support to a subject qualified as terrorist.

OFAC further maintains that the sanctions do not target the mere protected political expression, but rather support for conduct falling within the definition of terrorism in Executive Order 13224.

5. The collective’s response

A/I firmly rejects the US qualification. The collective describes itself as composed of volunteers and digital activists, saying that it merely provides digital self-defence tools for activists, individuals, groups and associations.

Despite this rejection, A/I has realized that keeping existing and fighting against the US government’s sanctions would be too dangerous for many users and individuals, who would be exposed to manipulations as well as legal and financial harm.

The point is that the U.S. government has decided to apply an extra-judicial procedure that makes it impossible to appeal through a due process and that exposes both those who provide services to A/I and those who use A/I services within the U.S. to the risk of being designated as terrorists. This is why on September 6 the collective decided to terminate all services and dissolve the group by September 18, 2026.

6. OFAC in a nutshell

The SDN List is the list of designated entities. In A/I’s case the acronym SDGT stands for Specially Designated Global Terrorist: it is a US sanctions designation, distinct from the Foreign Terrorist Organization (FTO) category, but with concrete economic consequences. The OFAC entry file on A/I also includes the notation “Secondary sanctions risk”.

The strength of this system does not stem solely from the fact that the United States can block assets within the US. The influence of the financial system, the US dollar and US companies can produce indirect effects abroad as well: banks, platforms and providers may sever ties to avoid compliance risk. This phenomenon is often called de-risking.

7. Why the sanction have had effects outside the US

The US designation does not automatically amount to a ban on A/I in Italy or the European Union. The US, the EU and individual states have distinct legal systems and counter-terrorism lists. Inclusion on the OFAC list does however produce significant pressure on operators dealing with the designated entity.

OFAC has also issued General License 36, which authorises the wind-down of certain transactions involving A/I within September 25, 2026. In this context, the term “wind-down” refers to the possibility of closing or bringing pre-existing relationships and transactions with the sanctioned entity to an orderly conclusion within a timeframe set by OFAC. It is therefore not an authorisation to maintain relationships indefinitely, but rather a deadline. It is important to distinguish between the period granted for the wind-down, any applicable legal obligations, and the independent decisions of operators who choose to sever the relationship earlier.

Although the deadline for the wind-down period is supposed to be September 25, 2026, Banca Etica - an Italian bank that claims to have an “ethical” mission - decided already at the beginning of September to shut down A/I’s account. Banca Etica explained this decision with its fear that U.S. secondary sanctions could endanger services for all their customers and members. But no Italian or European law requires funds to be seized following an OFAC designation, so the AI ODV association has filed an appeal against Banca Etica.

8. August 28: Noblogs gets hacked

On August 28 someone managed to escalate to privileged access on the noblogs.org platform, leveraging a software vulnerability. We had to intervene to restore the site to safety.

Now Noblogs is available in read-only mode.

After the hack, we found proof that data had been exfiltrated. The attacker probably had access to the user database, which contains email addresses of NoBlogs users, along with their hashed passwords. Since we do not log IP addresses, the attackers could not possibly access this data.

9. August 28: what happened to the DNS

When a user types autistici.org in their browser, the computer needs to know which IP address it should connect to. The DNS (Domain Name System) performs this function: it translates a human-readable name, such as autistici.org, into the server’s numerical address.

Simplified diagram: user → DNS → IP address → server → website.

If the DNS stops returning the correct match, the server may remain active but the website becomes unreachable for the users of that domain.

It is therefore important not to mix up the act of “disconnecting or suspending the domain” with the decision to “shut down the server”. The former action affects a different level of the hosting infrastructure.

10. ICANN, PIR, registrars and servers: who does what

Diagram: ICANN → coordinates the system; PIR → manages .org; registrar → administers domain registration; servers/hosting → host the content. For this reason, PIR should not be described as the provider that “hosts” A/I’s website.

11. The blocking of autistici.org

Technical findings have indicated that the domain is in serverHold status, a status that normally prevents the domain from being published in the DNS. The technical data documents the status of the domain, but does not in itself prove who decided to take this action or for what reason.

The domain was rendered unresolvable and it was later confirmed that Public Interest Registry (PIR) had blocked it. It’s worth noting that PIR is a non-profit organization created by the Internet Society to manage the .ORG domain and “serve the public interest online”.

Only recently, on September 6, did the Italy Chapter of the Internet Society decide to complain with both PIR and the Internet Society about this action. In his letter, the president of the Italy Chapter, Stefano Giordano, expressed worry both for the fact that a provider could be accused of terrorism due to content published by its users and because “Dot org is not U.S. property nor a for-profit corporate undertaking, but rather a global, supranational resource vital to freedom of expression and association online”.

12. Why is DNS so important?

This incident shows that digital infrastructure can be targeted at different levels. It is not necessary to seize the server containing specific data: action can be taken against the domain name that allows it to be found. In this sense the domain name becomes a point of control.

The central question therefore becomes: what happens when an Italian collective, its servers and its users are formally located outside the US jurisdiction but use a .org domain managed by a US registry and financial or technological services linked to the US market?

13. Banca Etica: the sanctions also affected an Italian bank account

The consequences of the US designation do not only affect the internet. According to Autistici/Inventati’s own account and as reported by media outlets, Banca Etica has informed the collective that it is planning to close their account following A/I’s placement on the OFAC list. This is a significant development because it shows how a decision taken by a US authority can produce concrete consequences even in the financial dealings of an Italian organization.

It is important, however, not to read this situation as a consequence of a direct order to close the account sent by the US Government to Banca Etica. What is happening is more complex. Inclusion on the OFAC list subjects the sanctioned party to a set of restrictions and, in Autistici/Inventati’s case, the US measure also signals a risk of secondary sanctions. For a bank or another financial intermediary, this can translate into a compliance issue: continuing to maintain relationships with the sanctioned party may be considered too risky from a legal, financial or reputational point of view.

This is known as de-risking: an intermediary may choose to terminate a relationship not necessarily because an Italian regulation automatically requires it to do so, but because it wants to avoid exposure to the risks arising from the US sanctions system. In this sense, an OFAC sanction can produce effects far beyond the US jurisdiction without the need for a direct order addressed to the individual bank.

The case is particularly interesting because it concerns Banca Etica, an institution that has made responsible finance and a commitment to to human rights an important part of its identity and which has already criticised the extraterritorial impact of US sanctions, including when such measures were taken against UN Special Rapporteur Francesca Albanese. The A/I case therefore shows a potential tension between two imperatives: on the one hand, the bank’s principles and public stances; on the other, the obligations, risks and compliance assessments connected to managing a relationship with a party placed on the OFAC lists.

Here too it is therefore useful to distinguish between US sanction and Italian consequences. Washington has designated A/I; the decision to terminate the banking relationship, if confirmed, is however a decision by the Italian intermediary. It is precisely this chain — OFAC → designation → compliance risk → intermediary → possible termination of the relationship — that shows to which extent US financial sanctions can have indirect effects even on entities located outside the United States.

The overall picture is therefore one of a potential domino effect leading to the disruption of various services: web infrastructure, domain names, email and financial tools. It is precisely this proliferation of points of dependency that sets this incident apart from the simple censorship of a web page.

14. The broader issue: when infrastructure becomes support

This case is interesting because it shifts the focus from the responsibility of those carrying out an action to the responsibility of those providing the infrastructure that enables communication, organisation or the publication of content.

The question does not concern only A/I. The same principle could, in theory, apply to email providers, cloud services, hosting providers, messaging platforms, payment systems or domain registrars. The point is establishing when the provision of a general-purpose service becomes, under the applicable laws, “material support” to a terrorist organization.

15. Timeline

August 26, 2026 — OFAC sanctions A/I as SDGT under Executive Order 13224.

August 26, 2026 — OFAC issues General License 36, authorizing the wind-down of certain operations with A/I within September 25.

August 27, 2026 — The Italian press reconstructs the designation and the collective’s response.

August 27, 2026 — A/I’s Paypal account is suspended.

August 28, 2026 - Noblogs.org is hacked and the A/I collective takes it down to secure it. It is now online again, but only in read-only mode.

August 28, 2026 — Autistici.org is found unreachable; A/I attributes the problem to the DNS and points to PIR (Public Interest Registry) as the point of intervention. After few days it is confirmed that the domain was actually disabled by PIR.

September 1, 2026 — Banca Etica suspends A/I’s bank account as a cautionary measure against possible secondary sanctioning of the whole bank.

September 6, 2026 — The Autistici/Inventati collective decides to terminate all services and dissolve the group to protect its users and communities from legal and financial threats and manipulations connected to an Executive Order that defies the rule of law.

September 8, 2026 — The AI ODV association files an urgent appel against Banca Etica, asking the bank to immediately restore the functionality of their bank account operations.

16. What we know / what we don’t know

We know: A/I was placed on the OFAC SDN list with the SDGT designation on August 26.

We know: Washington has accused A/I of providing infrastructure and digital services to violent extremists and to sanctioned terrorist subjects.

We know: A/I rejects the accusations and claims its role consists in providing infrastructure for communication, privacy and digital self-defence.

We know: A/I’s OFAC entry file also carries the indication ‘Secondary sanctions risk’.

We know: Noblogs.org was hacked and the attackers exfiltrated data including usernames and hashed passwords. They did not have access to IP addresses, which aren’t logged by default.

We know: On August 28, the autistici.org domain had a resolution/accessibility problem and the domain was detected in serverHold status.

We know: PIR acted on the autistici.org domain in conseguence of the SDGT designation.

We know: A/I’s bank account and Paypal account have been shut down.

We know: Banca Etica is not legally compelled by the US sanctions to close the bank account.

Not yet established: That PIR acted on OFAC’s direct order.

Not yet established: That ICANN ordered or authorized the suspension.

Not yet established: Who is behind the attack on Noblogs.

Sources