On 26 August 2026, the US Office of Foreign Assets Control (OFAC) sanctioned the Italy-based digital service and infrastructure provider Autistici/Inventati (A/I), designating the collective a Specially Designated Global Terrorist (SDGT). ARTICLE 19 warns that such action against an infrastructure provider violates international freedom of expression standards and sets a dangerous precedent.
Since 2001, A/I has provided digital and privacy services to activists and social movements based and operating in different countries and regions. OFAC alleges that its provision of encrypted email, secure video streaming, web hosting and other tools to ‘violent Antifa cells and other far-left militants across the world’ amounts to assistance to acts of terrorism.
An SDGT designation not only blocks A/I from doing its work: it also blocks any US persons and companies from working with the designated entity. This includes the US-based Public Interest Registry (PIR) which manages A/I’s ‘autistici.org’ domain. Legally required to comply with the OFAC designation, PIR suspended the A/I domain. On 6 September 2026, A/I announced it would shut down as a direct result of the sanctions, impacting roughly 16,000 mailboxes, 1,500 websites, 5,500 mailing lists and 10,000 blogs that the collective services.
What’s in a (domain) name?
The DNS is the internet’s address book: it translates domain names, like ‘article19.org,’ into the numerical addresses that indicate where in the network a given website sits. Those entries are not kept in one place. Each address suffix (like ‘.org’’ or ‘.com’), known as a top-level domain, has its own ‘registry’ which manages the domains registered with it. The DNS then reads that record to take users to the right site.
A/I registered its domain through ‘.org’, one of the most widely used suffixes on the internet and the one commonly chosen by NGOs and other public interest organisations. Although PIR manages a top-level domain used by millions of civil society organisations worldwide, it must comply with the legal requirements of the jurisdiction where it is incorporated. With no governance mechanism insulating its public interest function from unilateral state action, PIR argued it was left with no choice but to comply with the SDGT designation.
Remove an entry from that record and the domain stops working, which is what happened to autistici.org. This is why when PIR suspended A/I’s domain, every webpage and email address under it became unreachable at once.
How a US designation reaches an Italian collective through the global internet
A SDGT designation blocks all property and interests in property within US jurisdiction, and prohibits US persons and companies from engaging in any transactions, trade, or financial dealings with the designated entity. A/I is based in Italy and many of its users are outside the US. But the companies A/I depends on to provide its services are either based in the US, or they rely on US-based intermediaries, which exposes them to second-layer risk. Because the listing targets the entire collective rather than individual people or organisations alleged to have used it, every US entity – directly or indirectly in A/I’s supply chain – becomes a point of enforcement.
Indeed, domain registration, payment processing and much of the internet’s naming infrastructure run through US-incorporated intermediaries, each legally obliged to act on an OFAC listing regardless of where the designated entity or its users are located. And within a week, three of them acted: PIR stopped making the autistici.org domain available, and PayPal suspended A/I’s account. Banca Etica also suspended its account, while calling out the ‘use of anti-terrorism rules against dissent’. No Italian court was involved at any stage, and no court anywhere reviewed the impact on A/I’s users.
As ARTICLE 19’s recent research on DNS abuse shows, this is not an isolated incident. The report documents this pattern across very different jurisdictions: activists in India whose campaign websites vanished without warning or explanation, the Belarusian Association of Journalists losing its domain in exile, Catalan referendum domains seized ahead of the 2017 vote, and Nicaraguan outlets in exile blocked from using ‘.ni’. This is what our report describes as ‘damming a river to catch a fish’.
What is distinct about the A/I case is thus not the tactic. It is that it targeted an Italian infrastructure provider hosting the websites of activists, journalists and community groups across the world.
The global reach of a DNS suspension and its impact on freedom of expression
Domain operators, like domain registries, lack the technical ability to target specific websites. And rather than block individual webpages, governments are increasingly ordering domain operators to make entire domains inaccessible. This is a disproportionate response and akin to closing down the highway, because some cars are accused of breaking traffic laws.
Any restriction on freedom of expression must meet strict requirements of legality, legitimacy, necessity and proportionality. Designating a single digital service provider, like A/I, rather than the specific individuals or groups relying on it and which are alleged to have committed specific acts, restricts the expression of everyone who relied on the provider without the individualised assessment international human rights law requires. It fails the necessity and proportionality test because it removes access to content wholly unrelated to the one, or the conduct that purportedly justify the restriction.
Thousands of organisations lose their websites and email addresses, even if they are based outside of the US, not because of anything they have done, but because they chose an infrastructure provider that also serves groups targeted by the United States administration.
In addition to violating freedom of expression standards, this designation already spreads a chilling effect. Providers across Europe are now weighing whether their clients might attract a listing – some are declining work on that basis alone. Among others, this also hurts the budding EU ambitions at ‘digital autonomy’ through the creation of a robust, diverse and resilient field of infrastructure providers.
ARTICLE 19 calls on:
- The US government, and any country considering similar action, to ensure that any legal designation that could lead to a domain suspension – including any counter-terrorism designation – complies with international human rights law. This means that the circumstances in which a suspension or hold is applied must be clearly delineated in law, and that the suspension or hold has to be necessary and proportionate to the aim, and, evidence-based.
- EU member states and institutions to respond publicly to this designation and make clear that a foreign counter-terrorism listing is not, on its own, a basis for taking down content or infrastructure in the European Union. Any such efforts should comply with international human rights law, the EU Charter of Fundamental Rights, and other relevant EU laws. Those procedures, not one jurisdiction’s sanctions list, should determine what stays online in the European Union, and beyond.
- EU member states and institutions to sustain a strong, diverse and competitive internal market of infrastructure providers, which is more resilient against the second-order effects of foreign sanctions.
- Impacted infrastructure providers, including DNS registries and their respective service providers, to publish transparent information about how they respond to OFAC designations, including what challenge processes exist and what alternatives to full suspension are considered. Under the UN Guiding Principles on Business and Human Rights, private actors carry an independent responsibility to respect human rights. That responsibility is not discharged by pointing to a legal obligation to comply with sanctions.
- Organisations working on politically contested issues to consider carefully in which jurisdiction their digital infrastructure provider sits. Registering a domain name is a political choice as much as a technical one. Our DNS research sets out practical steps: decentralising domain and email services across registries, backing up website and mail content, and preparing a migration plan before it is needed. These steps build resilience against action of the kind taken against A/I, but they are not a substitute for the reforms called for above.
Protecting expression at the infrastructure level of the internet requires all hands on deck: from domain operators, to governments, to end-users. And as our recommendations above show, each has a critical role to play. The DNS was designed to enable access to information, not to stifle it. Let’s keep it that way.