Alessandro 'kLeZ' Accardo personal website

The personal website of an Italian developer. /nick kLeZ, since forever.

The court that doesn't exist

Posted on • by

If an Italian association wanted to seriously challenge the OFAC designation it has just had slapped on it, who would it turn to? The short answer is: nobody. Not because it’s hard, but because the court where you’d go doesn’t exist.

I’ll assume you’ve read the post from 27 August. In short: on 26 August the US State Department and Treasury designated Autistici/Inventati as a Specially Designated Global Terrorist, an executive administrative act that freezes economic relations under American jurisdiction without going anywhere near a judge. A/I has announced it will appeal. Let’s see where it can do that.

§Where you appeal

Two routes, and both of them are inside the United States.

The first is a petition for reconsideration to OFAC, under section 501.807 of Title 31 of the Code of Federal Regulations. You ask the office that signed it to think again. There are no binding deadlines: the office replies whenever it feels like it, and in the meantime the designation stays in force with all its effects.

The second is going to the federal courts, in practice the District of Columbia. Here the problem is twofold. The standard of review for executive acts on national security is extremely deferential. And the file the designation rests on may contain classified material that the designated party never gets to see: you’re defending yourself against accusations you can’t read in full. In the previous post I cited KindHearts v. Geithner and Al Haramain v. Department of the Treasury, the two cases in which American courts found due process violations in designations made under the same Executive Order 13224. Both involved entities based in the United States, and in the Al Haramain ruling the Ninth Circuit notes that most designated parties are neither US citizens nor US entities, and don’t enjoy those protections.

There is no third route. There is no European court, nor any international tribunal, with jurisdiction over an OFAC designation. The remedy, the whole of it, is administered by the country that did the designating.

§The shield that doesn’t cover this case

The Union does have a tool against extraterritorial US sanctions: Regulation 2271/96, the blocking statute, which forbids European operators from complying with certain American measures. In the previous post I noted that its annex lists measures on Cuba and Iran, and that counter-terrorism sanctions aren’t among them.

It’s worth adding that the tool, when it applies, actually works. In December 2021, in Bank Melli Iran v Telekom Deutschland, the Court of Justice of the EU interpreted that regulation for the first time. It ruled that the prohibition applies even without an explicit order from the American administration, that is, even when the European operator falls into line on its own initiative out of caution; and that a national court can declare void the termination of a contract motivated by the wish to comply with US sanctions, after weighing the objectives of the regulation against the economic losses the operator would face.

So the mechanism has teeth. It’s just no use to A/I, because the measure hitting it isn’t in the annex. The shield exists, it’s hanging on the wall, and it’s calibrated for a different threat.

§The new tool, and why it’s no use

Since late 2023 there’s also Regulation 2023/2675, the anti-coercion instrument. It was created to respond when a third country uses economic leverage to force the Union or a member state into a political choice. It has never been triggered; the Union is weighing its first use right now, these very weeks, against US tariff threats.

This one doesn’t apply to the A/I affair either. Article 2 of the regulation defines coercion as a measure by a third country aimed at preventing or obtaining the cessation, modification or adoption of an act by the Union or a member state. A counter-terrorism designation of a private party doesn’t take that shape: it doesn’t ask Italy to change a law or drop a position, it isolates an entity, full stop. The tool was built with China in mind, and it doesn’t reach coercion when coercion turns up wearing an ally’s uniform.

There’s a second reason, simpler. Even supposing it did apply, it’s a tool the Commission wields in relations between states. It’s not a remedy A/I can trigger on its own behalf.

§It’s not on the European list

The Union’s own terrorist list, based on Council Common Position 2001/931, is reviewed roughly every six months. In the latest renewal it counts a few dozen entries between individuals and entities. A/I is not among them, and never has been.

Under Italian and European law, then, the A/I Association is a third-sector body operating legally. Under US law it’s a terrorist organisation. The two classifications coexist without ever touching, and the one producing concrete effects on Italian soil is the second.

§What Italy will do

In the previous post I wrote: nothing. I stand by it.

There’s been a bit of noise in Parliament, from several sides, and a parliamentary question has been announced asking the Commission to step in under the Digital Services Act. But the DSA is a policy direction, not a remedy you can trigger, and above all the executive, the only party with standing to act, hasn’t done anything and won’t.

The bare minimum would have been to formally request, through diplomatic channels, to see the evidence against a party resident in Italy and never investigated in Italy for terrorism. And an assessment by the Garante, the Italian data protection authority, of the effects the designation has on tens of thousands of people in Europe who have nothing to do with any of it: the mailbox users. If an Italian company had handled those people’s data with a tenth of that nonchalance, the Garante would have come through its front door with a battering ram.

It won’t happen. And here the reason needs splitting in two, because they’re two different things.

It doesn’t want to. The victims are unpresentable, the political cost of defending them is high and the return is zero. No Italian government in the last thirty years has ever spent half a gram of capital with Washington on an online social centre, and this one is no exception. If anything, given the chance it would do something against the collective, because they’re political opponents and because doing so would curry favour with Trump and his cronies.

It can’t. The technical and financial leverage over the internet is almost entirely American, and there’s no venue Italy could take the matter to and get anything out of it. The real pressure tools against the ally are few, and no government would use them for this.

The distinction matters. “Doesn’t want to” is a political problem, and a different government could, in theory, decide differently. In theory, mind. “Can’t” stays put regardless, under any government, because it’s structural.

§The principle with no judge

International law has the principle of non-intervention: every sovereign state has the right to conduct its own affairs without outside interference. It’s not an opinion, it’s customary law, and the International Court of Justice affirmed it unambiguously in 1986, in the case between Nicaragua and the United States.

It describes what happened rather well: a foreign executive producing legal effects on the territory of another state, against a party of that state, outside any shared procedure. The principle is there, the facts fit it.

And it’s useless, for two reasons that stack up. It’s a principle governing relations between states: there’s no action an association can bring to enforce it. And the state that could enforce it, Italy, has just finished explaining that it won’t.

§The line nobody wrote

Back to the opening question. Why is there no court?

Because the whole scaffolding holding this stuff up, mutual legal assistance treaties, cybercrime conventions, domain registries, certificate authorities, rests on a line nobody ever put in black and white: that the country holding the levers uses them in good faith. There’s no judicial review above OFAC because, when that architecture was designed, assuming the hegemon would behave like a gentleman passed for realism, not naivety.

It wasn’t realism, it was a blank cheque. And now they’re cashing it at their leisure. An executive signs a list and twenty thousand people in Europe find their email hooked to a terrorism designation without a judge ever having seen a shred of evidence. This isn’t abuse of the system: it’s the system doing what it was left free to do, against the target that was cheapest to hit, the one with no lawyers in Washington and no phone call to make to anyone who matters.

The United States put the crown of King of the free world on their own heads in 1945, and they haven’t asked anyone’s permission since. The victory they still wave about as a mandate includes two atomic bombs on cities full of civilians, dropped on a country already on its knees. Their own government’s official inquiry says so, the 1946 Strategic Bombing Survey: Japan would have surrendered anyway by the autumn, even without them. Eisenhower said so, speaking of “grave doubts” because “Japan was already defeated”. And according to a reading that’s been doing the rounds for sixty years, those two bombs served more to show the Soviet Union what they were made of than to end a war already decided. Hit small to speak to those watching: that’s the move, from 1945 to San Giuliano Terme, without a comma’s difference.

Europe, meanwhile, has played the butler. It let infrastructure, payments, certificates and domains all live in someone else’s house, and now it’s discovering, one case at a time, that the digital sovereignty it fills its panels with isn’t worth a fuck against a contract signed in Virginia. The only thing that held up is the stuff the collective had built for itself after already taking a few slaps in 2004. Not an institution. A scar.

And here’s the punchline, for those working in security. This whole system is trust by default: you trust an actor because it sits in a certain position, not because it’s proved anything. It’s exactly the model we spent twenty years learning to dismantle on networks, because it’s the one that always gets breached, and usually by someone who was already inside. The answer, on networks, is called zero trust: trust nobody by default, verify every time, assume the compromise is already under way.

In geopolitics we’re still on the flat network with admin accounts handed out to everyone, pulling a surprised face when the one we trusted turns out to be the problem. Applying a bit of zero trust here too means one specific thing: don’t let a critical piece of infrastructure, a domain registry, a certificate authority, a cryptographic standard, sit entirely in the hands of a party you can neither control nor replace.

For the European Commission, which talks about digital sovereignty at every conference, the list is short. Put ENISA, ETSI and the European certification schemes in a position to genuinely match their US counterparts, with the funding and the mandate to do it, not on slides. Build a credible alternative to NIST standards before being able to afford treating them as suspect: that NIST can be bent we’ve already seen, when the NSA slipped a backdoored random number generator into it, something that stayed in an official standard from 2006 and was only removed in 2014, after the Snowden papers. No need to deprecate everything: ISO really is international, that stays. What’s needed is to stop depending on the pieces that sit in Washington and answer to Washington.

The trust Europe took for granted towards the United States has run out. It’s time to stand on its own two feet, and to make sure that the next time Washington wants to switch off a European server by pressing a button at home, that button isn’t connected to anything.

§Sources