Summary

  • Timo Hilbrink told RIPE 93 that OFAC listed Autistici Inventati on 26 August 2026 and that Public Interest Registry placed autistici.org on severHold two days later. Treasury records confirm the designation and a separate licence to wind down transactions.
  • Asked whether RIPE was prepared for sanctions exposure, Hilbrink answered no. He also said he did not work for the RIPE NCC; the transcript records no adopted plan, owner or deadline.

Analysis

The two-day interval is the sharp edge of Hilbrink’s account. On 26 August, the US Treasury Department’s Office of Foreign Assets Control added Autistici Inventati to its sanctions list. On 28 August, Hilbrink said, its .org name left the DNS after the registry put it on severHold. At the RIPE 93 closing plenary on 30 October, he returned to the case because the earlier discussion had run out of time. The official transcript records both his timeline and his answer when asked whether RIPE was ready: “At the moment no.”

The government record is narrower than the conference shorthand. OFAC’s 26 August update lists AUTISTICI INVENTATI as a specially designated global terrorist and records General License 36. The licence authorised transactions ordinarily necessary to wind down dealings involving the organisation through 25 September. The 2019 .org agreement identifies Public Interest Registry as the registry operator. None of those documents explains PIR’s reported severHold decision or identifies a direction to apply it. PIR’s decision or notice is the missing record; it would show whether the DNS action followed a legal demand or a registry risk decision.

That distinction matters because a government listing and a DNS switch sit at different control points. OFAC’s notice defines a sanctions status and the transactions covered by its licence. A registry changes the status that makes a name resolve. Between them sit contracts, legal advice, payment processors and the fear of being the next institution asked to explain a missed risk. Calling the result simply “the sanctions” hides the actor who made the operational choice.

The meeting did not fill that gap with an internal RIPE NCC map. Hilbrink named a .net domain, certificate services and cloud services as dependencies he worried about, then said he did not work for the NCC and could not confirm its arrangements. One attendee urged the group to inventory dependencies before picking remedies. Another asked whether moving to a national TLD would help if the local registry or the bank faced pressure instead. Randy Bush pointed to a DNS/RPKI dependency running in both directions. The list grew faster than any proposed owner.

Then came the argument over what resilience should look like. Some comments pushed toward European substitutes; others warned that building a sealed regional Internet would reverse the design goal. Joe Abley’s answer was more operational: avoid relying on one bank, currency, data centre, TLD or DNS service, and diversify at the edge. Daniel Karrenberg urged people to work on the dependencies they could actually change. Neither answer is a finished plan, but both reject the fantasy that one replacement domain repairs a chain of dependent services.

The transcript ends without a named lead, deadline or test. That is the practical failure exposed by the case. Before the next designation, an operator needs to know which authority can change each service, what notice reaches the affected organisation, who can challenge or reverse the change, and which dependencies keep working while that happens. “We should prepare” is not a contingency plan until somebody owns the map and runs the exercise.

Sources