Free pass for US data requests? Seizure of far-left activist server sparks concerns in Europe

The seizure of a server belonging to a far-left hacktivist collective sparked concerns in the Netherlands that it could create a dangerous precedent for the US to access Europeans’ data.

The Dutch authorities seized the server from an Amsterdam-based data center that belonged to Autistici/Inventati, an Italian activist provider, in mid-October at the request of the US authorities, following the group’s terrorist designation.

The Dutch Cloud Community (DCC), the country’s association for the cloud and internet sector, issued a statement on October 15th, expressing serious concerns about the police's handling of the situation.

The association claimed that the police appeared to have seized the server without a Dutch judge or the Public Prosecution Service reviewing the request, which “should not be possible within a democratic state governed by the rule of law,” the DDC said.

“This sequence of steps appears to provide a blank check for data requests from the US, without any judicial substantiation or review,” the DCC statement, which Cybernews machine-translated, reads.

In addition, the DCC emphasizes that the absence of “any visible form of judicial oversight” leaves Dutch digital infrastructure providers without safeguards against the consequences of foreign political decisions.

The Amsterdam Public Prosecutor’s Office told ANP news agency that the server was seized under the mutual legal assistance treaty (MLAT) between the countries, adding that the seized data has not yet been shared with the US.

New concerns about data sovereignty

The question of data transfer is a sensitive one in Europe because US laws, such as the Cloud Act, compel American companies to hand over data requested by its law enforcement.

As Europe is highly dependent on US providers, with 3 American giants – Amazon, Google, and Microsoft – controlling 70% of the continent’s cloud market, concerns are growing that the law gives the US government a free pass to access European data.

The Cloud Act is a major argument for European providers promising data sovereignty. However, the Autistici/Inventati case raises the question of whether data is private even when it’s stored on European soil.

Vili Lehdonvirta, a professor of technology policy at Aalto University, notes that MLAT is the original, sovereignty-respecting way for law enforcement to obtain data from a foreign jurisdiction.

He points out that Europe’s digital sovereignty debate was partly sparked by the FBI’s decision to skip MLAT procedures entirely and demand that US tech firms hand over data they held in foreign jurisdictions.

“But this case is not an example of that, as here the US law enforcement went through the Dutch authorities,” Lehdonvirta writes in his LinkedIn post.

Why was Autistici/Inventati sanctioned?

Autistici/Inventati offered free email and web hosting services for about 25 years to approximately 20,000 organizations and activists globally.

The US declared the provider a Specially Designated Global Terrorist in August, accusing it of operating “the digital infrastructure for violent Antifa cells and other far-left militants across the world,” including Hamas and the Islamic Revolutionary Guard Corps (IRGC).

Autistici/Inventati, which calls itself anti-fascist and anti-capitalist, isn’t considered a terrorist by the EU or individual member states. Nevertheless, it immediately lost its account with the Italian bank Banca Etica due to fears of exposure to US sanctions.

In addition, the provider’s PayPal account was suspended, and it lost its website, which contributed to Autistici/Inventati shutting down its services days later.

Over 30 European organizations signed an open letter to Autistici/Inventati, stating that the effects of this designation will not be limited to the provider or to those directly using its infrastructure.

The letter reads, “It speaks to an escalation of massive, institutional attacks on safe and secure communication, alternatives to for-profit big tech platforms, democratic organizing, and more, which will be felt by the digital rights community and the wider civil society.”