30 October 2026hß · Privacy & digital policyCurated

RIPE 93: how dependent is Europe's internet on US law?

Summary

heise online reports from the RIPE 93 meeting of the European IP address registry in Sofia, where network operators debated how vulnerable their infrastructure is to US sanctions. The trigger is the Italian provider Autistici/Inventati: after the US sanctions authority OFAC designated it, the .org registry suspended its domain, its bank froze its accounts, and 10,000 blogs, 1,500 websites and 16,000 mailboxes disappeared. Topics included moving ripe.net, the mutual dependency of DNS and RPKI, a European alternative to Let's Encrypt and the RIPE NCC's withdrawal from the US cloud.

The trigger: a provider disappears

On 26 August 2026, the US Treasury's Office of Foreign Assets Control (OFAC) designated the Italian NGO Autistici/Inventati a Specially Designated Global Terrorist. The Public Interest Registry (PIR), which runs the .org domain and is subject to US law, then suspended the provider's domain. With it, 10,000 blogs, 1,500 websites and 16,000 mailboxes became unreachable.

In early September, the Italian bank Banca Etica froze the accounts for fear of US secondary sanctions, and the provider shut down its services. Two weeks before the meeting, Dutch police, at the FBI's request, seized a server at Amsterdam Science Park said to belong to Autistici/Inventati. Timo Hilbrink of the Dutch provider Freedom Internet concluded in Sofia that RIPE members must protect themselves against such sanctions.

PIR belongs to the Internet Society (ISOC). Its CEO Sally Wentworth wrote in early October that refusing would have exposed PIR to considerable criminal and civil liability. According to heise, she did not answer how users can be protected against disproportionate sanctions.

What the meeting played through

The RIPE NCC allocates IP addresses for Europe, the Middle East and Central Asia, including to providers in Iran. This could put it in the sights of US sanctions policy itself. Its main domain ripe.net sits under .net, and the .net registry Verisign would have to enforce sanctions just like PIR.

One proposal was to move to ripe.nl under the Dutch registry SIDN. Babak Farrokhi of the resolver operator Quad9 asked what would happen if SIDN were then targeted. Most members currently consider it unlikely that anyone would block an entire country zone in the root, although it is technically possible.

Routing expert Randy Bush pointed out a circular dependency: routing certificates (RPKI) need DNS to be fetched, and DNS needs secure routing. An intervention in DNS can therefore also damage global routing.

One participant suggested a European clone of Let's Encrypt, since hardly anything works without the US organisation's certificates anymore. According to heise, ZeroSSL, launched in Austria in 2020, has since been bought by a Texas investment firm. RIPE co-founder Daniel Karrenberg recommended reducing dependence on hyperscalers for email.

The RIPE NCC brings its infrastructure back in-house

In 2019, the RIPE NCC started a 'Cloud First' strategy. In June 2026, Managing Director Hans Petter Holen explained the reversal on RIPE Labs: geopolitical uncertainty, regulation such as NIS2 and higher expectations around RPKI and root zone stability had led to a reassessment of the risks of US hyperscalers. Simply returning to the old setup is not enough; a complete rebuild is needed, with several data centres, geographically redundant storage and a virtualisation platform with as little vendor lock-in as possible.

In Sofia, Holen conceded to the members who had warned against outsourcing: 'You were right.' For 2027, EUR 14.59 million is planned for network equipment and self-managed infrastructure in two data centres connected by dedicated lines, 14 percent more than in 2026 and the largest item in the EUR 44 million budget.

The EU has sanctions too

The RIPE NCC is based in Amsterdam and must enforce EU sanctions. Of 2,339 members and end users checked, mainly from Russia, Belarus and Iran, 53 are subject to sanctions. Only the registration of their address resources is frozen; the addresses remain in use and are not withdrawn.

The RIPE NCC checks US sanctions voluntarily, because Dutch banks comply with them and fees from sanctioned members could not be collected otherwise. Since 2021, more than EUR 7 million in deferred or suspended fees has accumulated.

Our position: a sanctions list is not a court ruling

With one administrative decision in Washington, thousands of blogs, websites and mailboxes disappeared whose users were not on any list themselves. Anyone who speaks, publishes or organises through a provider loses their voice because a registry and a bank prefer to obey rather than examine. That is censorship, even when it is justified as counter-terrorism and no authority has banned a single text.

Under the rule of law, courts decide on guilt case by case. Blanket shutdowns of communication channels are not among its tools, not even via private intermediaries. Wikipedia describes censorship as the attempt to control human expression; the Chaos Computer Club has warned for years that any blocking infrastructure, once built, will be used for more and more purposes. The Autistici/Inventati case shows that this infrastructure already exists: it is called domain registry, bank account and data centre.

Network operators are therefore right to reduce their dependencies. But the goal must not be merely to move the point of control from the US to Europe. In a democracy, every form of censorship must be rejected, including the European kind.

Ideas

Running a domain under .com, .net or .org indirectly subjects you to US sanctions law.
Through registry and bank, a sanctions listing hits all of a provider's customers at once.
RPKI and DNS depend on each other; an intervention in one hits both.
Moving a domain to another zone only shifts the risk to a different registry.
Without an alternative to Let's Encrypt, many services lack a fallback for certificates.
Outsourcing to the cloud saves investment that has to be made up with interest on the way back.
European banks also comply with US sanctions to protect themselves.

Insights

The dependence on US law lies less in servers than in contracts: registry, bank, certificate authority and payment service are the points where a service is switched off without anyone pulling a cable.
Even the tools meant to make routing more secure inherit this dependency: the RIPE NCC's RPKI data is fetched via names under ripe.net, a zone managed by Verisign.
The RIPE NCC did not leave the cloud for technical reasons but because its risk assessment changed. For smaller operators, this is a reminder to review their own cloud decisions regularly, not only when prices rise.

Quotes

'We must not forget that Autistici was not a political organisation but a service provider.' (Timo Hilbrink, Freedom Internet, as quoted in German by heise)
'You were right.' (RIPE NCC Managing Director Hans Petter Holen to the members who had warned against the cloud strategy, as quoted in German by heise)

Facts

RIPE 93 took place in Sofia from 26 to 30 October 2026.
With the .org domain of Autistici/Inventati, 10,000 blogs, 1,500 websites and 16,000 mailboxes disappeared.
For 2027, the RIPE NCC plans EUR 14.59 million for its own infrastructure, out of a total budget of EUR 44 million.
Of 2,339 RIPE members and end users checked against EU sanctions, 53 are affected; their addresses remain usable.
Since 2021, more than EUR 7 million in fees has been deferred or suspended at the RIPE NCC.

References

Remarks

The heise report does not explain why OFAC designated Autistici/Inventati; this post therefore only assesses the consequences for infrastructure and users, not the allegation.
The date of this post is the last day of RIPE 93; the heise report appeared two days later.

Recommendations

List who your domain registry, DNS host, certificate authority, mail provider and bank are for your own services, and which law each is subject to; an RDAP or whois query shows a domain's registry.
Keep a second domain under a country-code TLD in your own jurisdiction for important services, and run name servers with more than one provider.
Configure ACME clients so that a second certificate authority can step in without rework, and already allow it in the domain's CAA record.
Read Hans Petter Holen's RIPE Labs article: it shows what costs and effort a withdrawal from the cloud actually involves.

Read the original article

Search the Web Archive