[Chapter-delegates] We should speak up about the disabling of autistici.org

[Thilina Pathirana]

Dear All,

Following is a message from the Norwegian Chapter:

We believe the Internet Society should publicly address the removal of
autistici.org from the global DNS.

The domain’s registry record currently carries serverHold,
serverUpdateProhibited, and serverTransferProhibited - registry-level EPP
statuses. In particular, serverHold prevents the domain from being
published in the DNS. This is therefore not merely the suspension of a
customer account or the termination of a commercial hosting service: it
removes the domain from normal DNS resolution globally, disrupting web,
email, and other services that depend on the autistici.org name.

Autistici/Inventati was designated by the U.S. Treasury on 26 August. At
the same time, OFAC issued General License 36, authorizing transactions
ordinarily incident and necessary to wind down dealings involving the
organization until 25 September.

General License 36 does not require service providers to continue providing
service until that date. However, its existence raises an important
question: was disabling DNS resolution through serverHold legally required
immediately, or could the domain have remained delegated while being locked
against transfer or modification during an orderly wind-down period?

The public U.S. designation materials do not allege that
Autistici/Inventati itself carried out violent attacks. Instead, the stated
basis centers on its provision of technological infrastructure and
services, which the U.S. government characterizes as material or
technological support for terrorism. These are serious allegations, but the
public materials do not provide a detailed evidentiary record that allows
outsiders to independently assess the basis for such a far-reaching
infrastructure-level action.

This creates a broader Internet-governance concern. If a sanctions
designation by one government can result in registry-level action that
makes a domain used by people around the world cease resolving globally,
there should be transparency about the legal authority, necessity,
proportionality, safeguards, and avenues for redress involved.

PIR operates the .ORG registry and is a nonprofit subsidiary of the
Internet Society. Because these are registry-level status codes, the
registrant’s registrar cannot simply remove them, restore the delegation,
transfer the domain, or modify the registration independently.

This is particularly important because PIR already recognizes in its own
published principles that registry-level DNS action can have extensive
collateral effects, including disruption of an entire domain, email
services, subdomains, and associated content. PIR also states commitments
to proportionality, due process, transparency, and minimizing collateral
damage.

We therefore believe ISOC and PIR should publicly clarify:

   - Whether PIR, or its registry service provider acting on PIR’s behalf,
   imposed these registry statuses, and under what authority.
   - The legal basis for applying serverHold, and whether immediate removal
   from DNS was legally required.
   - Why continued DNS delegation during the OFAC-authorized wind-down
   period was not considered an appropriate or legally available alternative.
   - How the use of serverHold in this case was assessed against PIR’s
   existing commitments to proportionality, due process, transparency, and
   minimizing collateral damage.
   - Whether PIR’s existing notice, appeal, and redress mechanisms apply to
   registry actions taken for sanctions compliance, rather than actions taken
   under its Anti-Abuse Policy.
   - What safeguards exist to ensure that future sanctions-related registry
   actions are necessary, proportionate, transparent, and subject to
   meaningful review.

This should not be dismissed as routine compliance.

The question is not simply whether a U.S. entity must comply with U.S.
sanctions law. The deeper question is how that compliance is implemented
when control of globally shared Internet infrastructure is involved.

A registry-level serverHold has consequences far beyond one commercial
relationship or one jurisdiction. It can make a domain cease resolving for
users worldwide. Actions with that degree of global impact deserve a
correspondingly high level of transparency and accountability.

ISOC describes its mission in terms of an Internet that is open, globally
connected, secure, and trustworthy. A case in which registry control is
used to remove a domain from global DNS resolution is directly relevant to
those principles.

If ISOC remains silent in cases like this, it risks creating the impression
that its commitments to an open and globally connected Internet apply only
until they come into tension with the exercise of centralized control over
critical naming infrastructure.

At minimum, ISOC and PIR should explain what happened, what legal
obligations applied, why serverHold was considered necessary, and what
safeguards exist to prevent disproportionate use of registry-level
disconnection in the future.


Best Regards,

Thilina.



-- 
<https://about.me/thilina.pathirana?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=gmail_api&utm_content=thumb>
Thilina Pathirana
about.me/thilina.pathirana
<https://about.me/thilina.pathirana?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=gmail_api&utm_content=thumb>
*Researcher specialised in data networking*
*President - LKNOG*
*Chapter Leader - ISOC Norway*
*Member Internet Society ChAC - Steering Committee *
- – - – - – – - – – - – – - – – - – – - – – - – – - – – - – – - – – - --

“Save a Tree” – Please consider the environment before printing this email.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://elists.isoc.org/pipermail/chapter-delegates/attachments/20260829/97ac52df/attachment.htm>