Two graphs¶
PayPal closed the account Autistici/Inventati took donations through on 27 August 2026, the day after the United States
put the collective on its sanctions list. On 28 August Public Interest Registry, which runs the .org names, stopped
autistici.org resolving. On 1 September Banca Etica suspended the bank account.
None of them touched a server, and on 18 September the collective’s services ended. Purple Lantern’s seven static sites, the Home’s rented tenant and Golem Trust’s yard were drawn and moved with that sequence as the threat. The adversary is in green, in Compliance takes the stack, as seven threat events, and between them the three stacks met five of the seven.
What is controlled and what is depended on¶
what is controlled
│
┌────────────┴────────────┐
│ │
technical graph dependency graph
│ │
server/network/app identity/finance/
filesystem service/jurisdiction
│ │
▼ ▼
direct attack transferred exposure
Before the move, a US registry held Purple Lantern’s name, a US forge held its code and a US host served its pages.
None of the three had to be broken into. The registry could put the name on hold, as Public Interest Registry did to autistici.org, and the sites stop resolving. The forge could suspend the account that holds the code. The host could stop serving the pages. Each is one decision at one desk.
The Home ran one server in its comms room and rented everything else, mail, files, chat and logins, from one landlord, so one decision at that landlord ended all four. Golem Trust runs its platform on one operator’s yard, and when that operator’s bank reads a designation, everything Golem Trust hosts stops at once. The left graph is what each of them can rebuild from its own copies. The right graph is what somebody else can end in an afternoon.
Direct attack and transferred risk¶
A seizure, a subpoena, a phishing mail and a burglar are direct attacks, and green has a runbook for each: after device seizure, responding to a legal demand, phishing click response, and device encryption, so that a stolen laptop is a lost laptop and nothing more. A bank deciding that a customer is not worth a fine is transferred risk, and no runbook tells the bank anything. Purple Lantern’s, the Home’s and Golem Trust’s checklists test for the right branch: a recovery route outside the mailbox it recovers, no one landlord under two layers, an exit that has been run once.
The path through the intermediaries¶
jurisdictional pressure
│
▼
target
│
┌──────────┬───────────┼───────────┬───────────┐
▼ ▼ ▼ ▼ ▼
registry registrar bank payment host
│ │ │ │ │
▼ ▼ ▼ ▼ ▼
domain domain account funding service
loss loss loss loss loss
│ │ │ │ │
└──────┬───┴──────┬────┴──────┬────┴──────────┘
│ │ │
▼ ▼ ▼
DNS identity email
│ │ │
└──────────┼───────────┘
▼
user migration
│
┌──────────┴──────────┐
▼ ▼
replacement EU replacement elsewhere
provider provider
│ │
▼ ▼
same calculation new jurisdictional
│ exposure
▼
continued service
or withdrawal
The designation puts a name on a list, and every intermediary screens its customers against that list. Each decides alone whether the customer is worth a fine, a lost licence or a lost card network. Purple Lantern’s registrar, mail provider, forge and host are four such decisions. The Home’s are the table of everyone who can say no on its contract page. Golem Trust’s largest is Hetzner. The replacement provider reads the same list, so the European branch of the drawing runs into the same calculation.
The path through the target’s own hardening¶
technical hardening
│
▼
less useful data
│
▼
better privacy against
ordinary investigation
│
▼
different interpretation
of the architecture
│
▼
greater perceived
jurisdictional risk
Autistici/Inventati kept no IP addresses, so the breach of Noblogs on 28 August yielded addresses and password hashes and nothing that named a user. The Treasury’s press release listed hosting on foreign servers and encrypted email among the services that made the collective designable. The same design choice protects users from a subpoena and describes the provider to a designator. Golem Trust sells sovereign compute and runs open source where it can. That is its pitch to a customer, the Civic Defence Establishment, and it is the sentence a designation would quote.
The seven threat events, and where each stack met them¶
T1, provider withdrawal. Purple Lantern’s hosting page lists the three ways a designation ends a host: a European subsidiary’s or parent’s bank, insurer or lawyers make it suspend the service; a US-owned infrastructure provider drops the European host; a European company over-complies and closes the account. The Home’s tenant page: Microsoft’s compliance desk, or its validation partner, ends the tenant, and the Home loses its mail, its files, its chat and its logins in one afternoon and finds out by the mail stopping. Golem Trust’s substrate page: Hetzner suspends Golem Trust, and everything it hosts stops at once.
T2, dependency contagion. Not exercised. None of the three stacks watched a second provider leave because a first one had. What each drew instead is one company under several contracts, which is T7.
T3, jurisdictional substitution. Purple Lantern’s hosting page: a server in Frankfurt run by a European subsidiary of a US company and a European provider on its own hardware in Frankfurt are different graphs. The Home’s contract page: the move cannot make a Swiss or German court less reachable than an American one. It can only say which court.
T4, dependency-induced migration. The second event none of the three stacks exercised. Purple Lantern has readers, not accounts. The Home’s donors write to a name the city’s own registry holds. Golem Trust’s customers are, in its drawing, everyone Golem Trust is itself the answer for (contract). Where the users go when the provider itself is listed is the question the dependency test ends on, and none of the three stacks has answered it.
T5, recovery-path failure. Purple Lantern’s authentication page: domain, mail, domain was a loop
until the recovery codes went into the vault. Its email page: post@purplelantern.eu recovered
the registrar and the registrar recovered the mail. Its small-print page: the account suspended,
the appeal needs a login, the login needs a second factor, the second factor needs the suspended account’s
device. The Home’s contract page: each landlord keeps a local administrator with its own second
factor and recovers through a Posteo mailbox none of them runs, so no suspension takes the door the appeal has to go
through.
T6, evidence destruction by dissolution. Purple Lantern keeps its invoices independently and in euros (financial), its design notes and issues as Markdown in the repository and not in the forge (git), and the suspension and appeal path of each provider written down before it is needed (checklist). The Home’s contract page names the courts its testimony now sits under. What none of them holds is the case a dissolved organisation cannot bring: the collective’s application at Pisa tests the bank’s freeze and not the designation.
T7, false independence. Purple Lantern’s authentication page: a registrar, a mail provider, a forge and a host are four companies and one system if they share a recovery address. The Home’s contract page: the last column of the small print reads Hetzner four times. Golem Trust’s substrate page: what four separate providers looked like from above, Golem Trust saw from below as one point. Its contract page keeps the residual: two of the companies that can say no turn out to be one.
Green dependency test¶
If this provider decides that keeping the customer costs more than losing it, what still works, where does the layer move, and what does the move depend on. The green model calls it the dependency test.