The internet has an address book, and most of it is written in American law. That sentence is not new. What is new is that European network operators spent a week in Sofia asking what happens when the address book is used as a weapon.
At the 93rd meeting of RIPE, the registry that allocates IP addresses for Europe, the Middle East and Central Asia, the discussion was less about routing tables than about jurisdiction. The trigger was the Italian provider Autistici/Inventati. On 26 August 2026 the US Treasury's Office of Foreign Assets Control designated the NGO a Specially Designated Global Terrorist. Within days its .org domain was blocked by the Public Internet Registry, the registry operator run by the Internet Society under US law. Ten thousand blogs, 1,500 websites and 16,000 mailboxes went dark in one stroke.
Then the second wave arrived. In early September the provider's bank, Banca Etica, froze its accounts over the risk of US secondary sanctions. Autistici/Inventati decided to shut its services down. Two weeks ago, according to Timo Hilbrink of the Dutch provider Freedom Internet, Dutch police seized a server in a data centre in Amsterdam Science Park that is said to belong to the organisation; the FBI had requested legal assistance. A wind-down general licence followed from OFAC — after the sites were already gone.
"We must not forget that Autistici was not a political organisation, but a service provider," Hilbrink told the hall.
That is the part that unsettles registries. RIPE's own operations are not obviously insulated. It allocates address space to networks in Iran, for one thing. And its primary domain, ripe.net, sits under .net, whose registry Verisign is likewise subject to US law. Sally Wentworth, chief executive of the Internet Society, wrote in early October that refusing to implement sanctions would have exposed the registry to "significant criminal and civil risk" — an apology, not an answer.
The proposals on the table were practical and, in places, bleak. Move ripe.net under .nl, which is run by the Dutch foundation SIDN? "What if they go after SIDN?" asked Babak Farrokhi of the resolver operator Quad9. "Do we perhaps have to start accepting cryptocurrencies and using onion servers?" Others floated a European clone of Let's Encrypt, noting that the Austrian alternative ZeroSSL was recently bought by a Texas investment firm. Internet pioneer Randy Bush warned that interventions in the DNS also hit global routing, because routing certificates need DNS lookups and the DNS in turn depends on secure routing.
RIPE's own chief executive conceded a strategic defeat. Hans Petter Holen said the RIPE NCC had abandoned the "Cloud First" strategy it launched in 2019 and would go back to running more of its own infrastructure. "You were right," he told members. The 2027 budget puts €14.59 million — 14 percent up on the current year and the largest single line in a €44 million budget — into network equipment and self-managed infrastructure across two data centres joined by dedicated lines.
The money is not only about principle. Because RIPE NCC is headquartered in Amsterdam and Dutch banks observe US sanctions, the organisation has been unable to collect some fees at all. Since 2021, deferred or unbillable contributions have added up to more than €7 million.
And Europe has its own lists. Of 2,339 members and end users reviewed under EU sanctions, 53 are subject to measures — though those freeze the registration of address resources rather than withdraw the addresses themselves, a distinction that matters to anyone running a network.
The uncomfortable conclusion from Sofia is that the technical layer everyone treated as neutral — the root zone, the registries, the certificate authorities — was always a policy layer with a technical interface. Redundancy was designed for routers failing, not for a registry being told to stop answering.
