USA designates Italian collective Autistici/Inventati as terrorists, active for 25 years

Full text

Twelve days — that’s how long it took a designation, signed in the US, to bring an end to the 25-year-long work of Autistici/Inventati, an Italian technology collective which supplied a non-commercial, privacy-first communications infrastructure alternative to Big Tech.

On August 26, the US Departments of State and the Treasury denounced Autistici/Inventati (A/I) as Specially Designated Global Terrorists, in a statement by the Office of the Spokesperson (OFAC), for operating infrastructure for "far-left militants across the world".

A/I was hit with sanctions and an announcement that anyone engaging with them "may risk exposure to sanctions". A wind-down deadline was set for September 25.

The US terrorism accusations were made under Executive Order 13224, with A/I allegedly "having materially assisted, sponsored, or provided financial, material, or technological support for, or goods and services to or in support of, an act of terrorism".

It’s an accusation that the collective strongly rejects, arguing that it "merely provides digital self-defence tools for activists, individuals, groups and associations", i.e. that it’s not a terrorist. It’s a software supplier.

If you’ve not heard of Autistici/Inventati (A/I) before, you are not alone. In some ways, it’s a wonder that this tiny Italian collective came under the radar of the US Treasury’s Office of Foreign Assets Control (OFAC) at all.

Since its beginnings in 2001, A/I has been volunteer-run. It has provided email, mailing lists, messaging apps, web hosting, and blogging platforms, all designed to be resilient to censorship and surveillance, to thousands of users worldwide.

Within days of the announcement, though, one of A/I's domains became unreachable, its donation gateways were closed, and its bank accounts were frozen. On Sunday (September 6), A/I announced it would shut down for good to protect users from potential repercussions.

There’s no hiding that Autistici/Inventati has been a political project. The group self-describes as an anti-fascist, anti-racist, anti-sexist, anti-militarist organisation and opposed to capitalism and authoritarianism. With few larger beacons of capitalism on the planet than the US Treasury, perhaps it should not have been a surprise that A/I got noticed?

And, crucially, unlike a regular privacy software and service provider, the group had supplied its tools only to individuals and projects that shared its views. Most of A/I users were grassroots movements and activists on that same side of the political spectrum.

Nonetheless, the story has an eerie ring to it. The ease with which a single nation has been able to silence a global movement, without any international legal process, should stand as a warning. And, if punishing the host of a private service for what its users do on its platform becomes normalized, could your favorite encrypted apps be next?

Who is Autistici/Inventati?

(Image credit: Autistici/Inventati) A group of Italian technology activists, hackers, and digital rights defenders founded Autistici/Inventati (A/I) during the anti-globalization movement at the start of the millennium. Since 2018, it has been a legally recognised non-profit organization — Associazione AI-ODV — based in San Giuliano Terme, Italy.

For about a quarter-century, A/I offered a non-commercial oasis in a corporate-dominated web. As the collective confirmed to TechRadar, as of September 6, the group had included about 20,000 email accounts, 20,000 blogs, 5,000 mailing lists, and 1,500 websites — a drop in the ocean compared to Proton’s 100 million registered accounts , and the 6 million subscribers to Riseup , another volunteer-run collective.

That said, the actual number of people engaging with the A/I infrastructure, however, is most likely higher, given all the people accessing the websites, newsletter, and emails sent, which are hosted on its services, or reading a post on its flagship NoBlogs platform.

"Given that one of the features of our tools is the protection of communications, we are unable to provide precise data [on users]," an A/I spokesperson told us, echoing the group’s privacy policy , which centers on collecting as little data as possible about its users.

In its terms and conditions , A/I is also clear regarding the responsibility for the content: users are "the sole responsible" for the data they store and the content posted on their platforms. “We do in no way pre-screen, filter, or verify the content uploaded by the users, nor do we have the opportunity to edit or modify it,” the policy also reads.

It’s a level of independence, anonymity, and privacy that had already put the collective under the justice system’s scrutiny in the past. This time, however, the US action was different.

"We are not dealing with a legal or technical dispute, but rather a case that highlights the fragility of a tool everyone takes for granted," an A/I’s spokesperson told us.

Targeting the infrastructure: what’s behind the US terror designation?

The US Treasury has sent a clear message: providing digital tools to political direct-action groups or sanctioned foreign political parties — the order directly mentioned the Kurdistan Workers’ Party (PKK) among those — constitutes "material assistance" or "technological support" for terrorism.

For the US Treasury Secretary, Scott Bessent, the "enablers" of what he deems far-left extremists must be targeted with "the full weight of our economic tools to bear".

While this isn't the first time the US has targeted independent, open-source software — they did so in 2022 against Tornado Cash — the recent action against A/I still marks an escalation: from targeting the content, to aiming squarely at the infrastructure that hosts it. It’s a shift that digital rights experts warn could have heavy repercussions.

Talking to Italian broadcaster Rai News , American non-profit digital rights group Electronic Frontier Foundation’s director of international freedom of expression, Jillian York, explained that the practice of designating an internet platform and service provider as a terrorist group — rather than those who directly perpetrate violence — has "enormous" implications.

"They are targeting the messenger. I don’t think members of the group would necessarily endorse the actions of the people they host. What they endorse is the freedom to host, the ability to remain anonymous, and the ability to maintain privacy," York added.

(Image credit: Future) NEW : Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

The threat to everyday privacy tools: who is next?

By issuing a terror designation to an independent technology collective, Washington has dragged the legal principle of "material support" into dangerous terrain. But could such an attack really be replicated?

Let's take Proton as an example. This well-known privacy-first firm offers an encrypted alternative to the Gmail suite (email, docs, sheets, cloud storage, calendar, and even videoconference tools), alongside a secure VPN service .

ProtonMail and other Proton apps are a popular choice among everyday users, activists, and journalists worldwide owing to their zero-knowledge architecture and strict no-log policy. The Swiss-based company explicitly uses the impossibility of disclosing any data to authorities as a selling point.

So, if a sanctioned organization or political direct-action group uses a Proton account to communicate, might the host risk being designated an "enabler" of terrorism? Probably not quite, for now at least.

The difference is that A/I isn't a neutral provider. Unlike Proton — or another volunteer-run network, the Tor Project — that doesn’t make any distinctions about who can subscribe to its services, the Italian collective did support only users who demonstrated their shared political views.

Still, experts at the European Digital Rights (EDRi) and 30+ digital rights groups see these events as an "attack on independent internet infrastructure, fundamental rights of multiple collectives, safe and secure communications, democratic anti-authoritarian organising and the democratic integrity of the EU".

Beyond politics, what's clear is that the move could be seen as a thin end of the wedge: if providing privacy-preserving infrastructure to controversial or radical groups is reclassified as terrorism, it leads to a chilling question: how long will it take before something similar happens again, and who might be next?

That's why, according to the CEO of Nym Technologies, the provider behind the privacy-first, decentralized NymVPN , Harry Halpin, only a decentralized infrastructure can truly be resilient to similar attacks.

"A government can easily take centralized domain names and bank accounts down, but the service as a whole should continue to operate if designed properly," Halpin told TechRadar, adding that "I hope that even if Nym Technologies disappeared tomorrow, the infrastructure should run without us."

A move against bigger commercial entities than A/I may not seem as likely, but the current US administration is nothing if not bold. All the same, there is a clear distinction between commercial companies, such as Proton, Tuta, or Signal, and independent projects, like A/I, where the aim isn’t profit:

"We hold different visions of the Internet — radically different ones — and we have been targeted for this reason as well," A/I told TechRadar.

That rationale, though, could include other non-profit projects like the well-known Tor Browser, which, one day, may also find itself in the US government’s crosshairs. Should Tor be successfully taken down in the same way, it would undermine the very nature of a free and open internet.

As A/I told TechRadar: "If a case like ours were to happen again, it would mean that those in power have decided to make the Web as we have known it — from its inception to the present day — disappear; a Web where the vast distinction between the provider of a tool and its user was abundantly clear."

A case for digital sovereignty

The fall of Autistici/Inventati doesn’t just create a possible precedent for digital rights, it also exposes a stark reality: a foreign government can unilaterally disable a European digital service without having to seize physical servers or prove criminal liability in court.

Washington did not have to target physical hardware. The US could, instead, simply count on centralized choke points across the internet's core infrastructure to do its work.

While A/I’s servers remained operational, access to one of its domains — autistici.org — was severed at the DNS level. Short for Domain Name System, DNS allows your web browser to find the IP address of the domain that you type in and connect to the site you want.

A/I believes that the operator responsible for managing these connections, the US-based Public Interest Registry (PIR), placed the domain in a 'serverHold' status as a direct consequence of the US sanctions. It’s worth noting that there is currently no public statement from PIR at the time of publication.

Simultaneously, the risk of secondary sanctions led PayPal to close A/I’s account and compelled Italy’s Banca Etica to suspend A/I’s current account, despite the bank’s commitment to human rights.

Whether or not we share A/I’s political views, the ease with which the 25-year-old tech collective has been dismantled is a dark moment for digital rights. Unless independent infrastructure is actively defended, the vision of the Internet as an open, free, and democratic forum will cease to exist.

At the very least, this tale should serve as a wake-up call to any even slightly controversial service built on US-owned internet foundations. Without digital sovereignty protection elsewhere, might, it seems, is right. What the US Treasury wants kicked off the internet, it may well get.