US terrorism designation hits a 25-year-old volunteer-run activist email host, and its main domain just went dark

US terrorism designation hits a 25-year-old volunteer email host, and supporters say the clock runs out September 25

On August 26, the U.S. Treasury and State Department designated Autistici/Inventati, a volunteer-run Italian collective that has offered activists free encrypted email and web hosting since 2001, as a Specially Designated Global Terrorist 1 2. The State Department fact sheet counts what the order reaches: roughly 16,000 mailboxes, 10,000 blogs, 5,500 mailing lists and 1,500 websites, all figures the fact sheet attributes to the group's own claims 2. Sum the four numbers and the designation touches about 33,000 hosted accounts, assembled by a collective that says it takes no pay and runs on voluntary donations 3. Spread across 25 years, that averages out to about three and a half new accounts or sites a day, every day, since the collective's first server went online in a Milan hacklab 4.

By the collective's own account there is almost nothing to confiscate, and that is what makes the case a precedent. The pressure point is not the group's property; it is the chain of companies every small internet service needs in order to exist. The date that matters is already fixed: September 25, 2026, when the temporary U.S. authorization for institutions to wind down their relationships with A/I expires 4.

Two days after the designation, on August 28, a post on the collective's Mastodon channel reported that its domain autistici.org had gone dark, and the report reached Hacker News the same day 5 6. When we fetched autistici.org on August 29, the site answered normally 3. Neither U.S. release names any domain, registrar or host, and the collective's post reports the outage without naming a cause 1 2.

The scale, by the government's own count

Treasury describes an Italy-based entity supplying digital tools and services to what it calls violent far-left extremists, and State describes an Italy-based extremist group that builds and operates "the digital infrastructure for violent Antifa cells" 1 2. Treasury's stated basis is that the collective provided technological support, goods and services in support of an act of terrorism, and the release alleges its services reached sanctioned organizations including the Kurdistan Workers' Party 1. The State fact sheet goes further, attributing to A/I-hosted infrastructure the communiqués of a 2026 European rail-sabotage campaign, a March 2026 pipeline attack, and U.S. cases including a firebombing campaign against crisis pregnancy centers 2. The collective answered the same evening, and its reply is blunt: "Antifascism and anticapitalism," the statement reads, "are not terrorism." 7

What hangs on the order, in the State Department's tally of the group's own claims 2:

• roughly 16,000 encrypted mailboxes 21
• about 10,000 blogs on the Noblogs platform 21
• some 5,500 mailing lists
• about 1,500 websites

The origin story is smaller than any of those numbers: about ten people at the LOA hacklab in Milan on March 3, 2001, building a server named Paranoia from a machine bought for 15,000 lire, about eight dollars 4.

How a blocking order bites a group with nothing to block

Treasury's order blocks any property touching the United States or U.S. persons, extends blocking to entities majority-owned by designated persons, and warns that civil penalties can apply on a strict liability basis 1. State adds the extraterritorial lever: foreign financial institutions may risk secondary sanctions for transactions involving the designated entity 2. A/I, for its part, says its work is unpaid and donation-funded, and Treasury itself notes the hosting runs on foreign servers 3 1.

Beniamino Irdi, a senior fellow at the German Marshall Fund and CEO of Highground, reads the design that way in Decode39: the asset freeze is the least significant part, because a small Italian association is unlikely to hold substantial U.S. assets. The real effect arrives through de-risking, as banks, payment systems, registrars, hosting and connectivity providers cut ties pre-emptively, and an entity can be "expelled from the services market without any court ruling ever having been issued in Italy" 8. Decode39 also notes the designation does not automatically place A/I on Italy's or the European Union's terrorist lists 8.

The sequence, assembled from the two releases, the collective's channel and the mobilization call; no single source states it in order:

• October 15, 2024: the U.S. and Canada jointly sanction Samidoun as a front for the PFLP 1
• July 2025: the U.K. proscribes Palestine Action as a terrorist group 1
• November 13, 2025: the State Department acts against what it calls Antifa groups engaged in violent and criminal acts 1
• August 26, 2026: Treasury and State designate A/I 1 2
• August 28, 2026: the collective reports its main domain dark 5
• September 25, 2026: the wind-down authorization expires 4

Read top to bottom, the list drifts from actors to their tools: a solidarity network, a direct-action group, a set of named groups, and finally the infrastructure underneath all of them.

The same practice, read two opposite ways

The sharpest named disagreement in the case concerns one fact both sides describe identically and value oppositely. A/I's homepage says "each and every service request is processed manually by one of our volunteers," a privacy practice framed as community gatekeeping 3. The State fact sheet presents the identical practice as evidence: the group "manually vets all potential users for ideological affinity" 2. Treasury's own release carries the tension in one document: its FAQ 1190 states "the United States does not sanction persons for engaging in political speech or other constitutionally protected activities," while the designation basis is the provision of services itself 1. Irdi's caution lands on the same seam: ideological selection of projects is, on its own, a weak basis for judicial proceedings, and the same infrastructure can serve a journalist, a dissident, or someone claiming responsibility for sabotage 8.

September 25, and who else sits one designation away

The date now circulating among supporters, September 25, is not a protest anniversary; it is the expiry of the wind-down authorization, after which institutions dealing with A/I lose their temporary cover to keep providing services 4. The mobilization call framed it plainly: defend Autistici/Inventati before September 25 4.

For operators of small infrastructure, the case shows exposure does not require revenue. A service with no assets worth freezing reported its main domain unreachable two days after the designation, the cause still unnamed; on the reading of Beniamino Irdi, senior fellow at the German Marshall Fund, the designation's real bite is not the freeze but the de-risking reflex of the banks, payment systems, registrars and hosts underneath every small service 8. For activists among the 16,000 mailbox holders, the practical question is migration and redundancy. For every registrar, host and payment processor, it is a calculation that now has a precedent attached. Irdi's warning to Washington's allies is the mirror image: if the criterion blurs political affiliation into concrete support for violence, the precedent divides the very partners it is meant to move 8. A/I says it will not back down and will keep doing what it has done all these years 7. On our reading, the A/I case shows the switch for the internet's volunteer layer is not a seizure notice: it is an expiry date in a compliance calendar.