Summary

  • The United States designated Autistici/Inventati on 26 August 2026, and Public Interest Registry’s current RDAP record shows autistici.org under a registry-level serverHold with a last-change timestamp of 28 August. The public record does not establish that OFAC directly ordered PIR to take that action or that ICANN approved it.
  • OFAC General License 36 authorised ordinarily necessary wind-down transactions through 25 September; it did not require service providers to continue service. The governance gap is nevertheless concrete: no public case record links authority, object, timing, blast radius, narrower alternatives, notice, appeal and restoration into one accountable decision chain.

At 2026-08-28T01:57:20.598Z, something changed in the registry record for autistici.org. As observed on 20 September, Public Interest Registry’s RDAP service reports server hold, together with client and server transfer prohibitions and a server update prohibition. The domain remains registered, and nameservers remain listed. Its registered name does not resolve in the ordinary way because the registry status blocks publication in the DNS.

This is unusually precise evidence of an operational state. It is poor evidence of a decision.

The timestamp does not identify the person or office that authorised the hold. It does not cite an order, statutory interpretation, registry policy or contract clause. It does not say whether a request came from a government, a compliance adviser or another party. It does not describe what less disruptive options were considered. It does not record notice, a migration period, appeal rights or restoration conditions.

That distinction matters because the action was not confined to one contested page. PIR’s own Anti-Abuse Principles explain that a registry generally can suspend or delete only the entire domain. Such a measure affects websites, email, subdomains and all content attached to the registered name. The principles warn that DNS-level action can cause immense collateral damage and say the response should be proportionate and directed, where possible, at the party closest to the harmful content.

The public record therefore contains the result of a control without the receipt for exercising it.

Six events must not be collapsed into one

The first event was a sanctions designation. On 26 August, the US Treasury announced that it had designated Autistici/Inventati under Executive Order 13224, alleging that the Italian collective had provided material or technological support to designated actors. OFAC’s same-day recent-actions page added the organisation to its sanctions list. Those are US government allegations and legal acts; this article does not adjudicate their merits.

The second event was an authorization. General License 36 permitted, until 12:01 a.m. EDT on 25 September, transactions otherwise prohibited by the Global Terrorism Sanctions Regulations that were ordinarily incident and necessary to wind down dealings involving Autistici Inventati and entities it owned by at least 50 per cent. It imposed conditions on payments to blocked persons and did not authorize other prohibited dealings.

“Authorized” is the boundary word. GL36 was not a command that PIR, a registrar, a host, a bank or any other provider had to continue service through the deadline. Nor does the licence, on its face, identify the domain or prescribe a DNS status. The unused portion of the window makes timing a legitimate governance question; it does not answer that question in advance.

The third event was the registry action visible in RDAP. Its 28 August timestamp is two days after the designation and weeks before the licence expired. A serverHold is imposed at the registry layer. It is not interchangeable with a registrar’s client-side lock, termination by a host, closure of a bank account, or an operator’s own decision to end services.

The fourth and fifth events were actions elsewhere in the dependency chain. PublicSpaces’ parliamentary letter described later banking consequences. Autistici/Inventati’s campaign page gives the affected party’s account of learning about the designation, losing domain resolution and ultimately closing services and dissolving. These statements are relevant evidence of claimed effects, but they remain statements by advocates and the affected organisation.

The sixth event was an institutional challenge. On 18 September, Internet Society Netherlands said it had joined PublicSpaces and 26 other organisations—a group of 28 signatories—in asking the Dutch parliament to examine foreign-sanctions pressure. It specifically asked why the domain was put on hold on 28 August, why the wind-down period was not used, and whether warning and migration time could have been provided.

Writing all six events as “the sanctions shut down the service” would erase the operational chain. It would also make accountability impossible: each actor could point to the same broad cause while no public record showed who converted it into a particular technical effect.

Institutional relationship is not case control

Internet Society’s involvement adds a second distinction. Internet Society says it created PIR in 2002, remains responsible for appointing PIR’s board and receives funding enabled by PIR’s work. Its 2026 announcement of PIR board appointments confirms that governance relationship.

Those facts give the Internet Society community a legitimate reason to ask how PIR exercises a domain-wide control. They do not prove that Internet Society, or its Netherlands chapter, directed this case. Board appointment, financial relationship and public accountability are not the same as operational command over an individual registry status change.

This is exactly why the question should not be reduced to “who owns whom?” The useful question is which mandate travelled down which path. If PIR acted on a legal requirement, the public needs the jurisdiction, authority, covered party and operative obligation stated as far as law permits. If it acted under a registry policy, it should identify the clause and show why that policy covered the facts. If both mattered, the record should distinguish them.

PIR was quoted in press reporting as saying that it was legally required to suspend the domain. That statement is material, but it is not the missing instrument. The bounded public sources reviewed for this article do not contain the case-specific order, request or legal analysis. They also do not establish that OFAC directly instructed PIR or that ICANN requested or approved the hold.

General policies do not complete the case record

PIR’s published policies are more candid about registry power than many public debates. Its Anti-Abuse Policy reserves rights to lock, hold, suspend, cancel or transfer a registration for reasons including compliance with law, government requests, liability avoidance, contractual obligations, ICANN policies and correction of errors. The same policy says that action against an entire domain for website content is generally disproportionate, subject to limited categories and legal process.

That range explains what PIR may be able to do. It does not reveal which ground it applied here.

The same limit applies to appeal. PIR describes an informal review followed, for Anti-Abuse Policy suspensions, by a neutral third-party appeal through Forum. The published model involves a fee and possible PIR subsidy or reimbursement. Yet the sources reviewed here do not show that this sanctions-related hold was classified as an Anti-Abuse Policy decision, or that the advertised appeal is available. A remedy that exists for one policy route cannot be silently assumed for another.

A defensible public record can protect sensitive details without becoming empty. It need not disclose privileged advice or personal data. It should at least identify the decision class, accountable office, legal or policy basis, affected object, effective time, intended duration, technical status, expected service effects, notification method, review channel and restoration test.

The missing object is a decision-chain receipt

A decision-chain receipt would connect layers that are currently visible only in fragments. It would begin with the authoritative event—the 26 August designation—then state what the licence changed and did not change. It would record who decided that a registry-level status was required, what legal or policy proposition supported that conclusion, and why autistici.org was within scope.

The receipt would then make timing explicit. Why was 28 August the appropriate effective date? Was immediate action legally unavoidable, or was the wind-down authorization assessed and rejected as insufficient? If the service provider was free to choose within a risk range, who owned that choice? A meaningful answer can say that a deadline was unavailable without pretending that the deadline created an entitlement.

Next comes effect scope. A registered-name hold is not merely a website block. The receipt should identify known dependencies: web properties, mail, subdomains, authentication or other services. It should say whether the registry considered action closer to a specific service, advance notice, a limited migration interval, preservation of mail, or a reversible staged measure. The existence of an alternative does not mean it was lawful or practical; recording the assessment makes the proportionality judgment reviewable.

Finally, the receipt needs a life after the initial act. It should identify who can seek review, the evidence accepted, the reviewer’s independence, the conditions for restoration and the way a later correction supersedes the original entry. A mutable status without a durable reasoning record permits the infrastructure to change while the public history remains an untestable assertion.

This proposal is not a demand that registries become courts. It is the opposite. When a registry uses a blunt, domain-wide technical control in response to a dispute formed elsewhere, its record should show the narrow mandate it actually executed. That keeps the registry inside a defined role rather than letting the effect itself become the explanation.

Sources

  1. US Treasury designation announcement
  2. OFAC action of 26 August 2026
  3. OFAC General License 36
  4. PIR RDAP record for autistici.org
  5. PIR Anti-Abuse Principles
  6. PIR Anti-Abuse Policy
  7. PIR description of registrant appeals
  8. Internet Society Netherlands statement
  9. PublicSpaces parliamentary letter
  10. Internet Society on its relationship with PIR
  11. Internet Society’s 2026 PIR board appointments
  12. Autistici/Inventati’s account