A server seized in Amsterdam, a copy for Washington

By the Archibou Team

On 13 October 2026, Dutch police seized a server in an Amsterdam datacenter. The server belonged to an Italian host. The request came from the United States. The Dutch Parliament learned about it from the press. This is not the CLOUD Act. It is a 1981 treaty, and it may be more instructive than you think.

1. The facts

Autistici/Inventati (A/I) is an Italian non-profit access provider that has offered free email addresses and web hosting for about twenty-five years to organisations, collectives and activists. Around 20,000 groups use its services.¹ The collective describes itself as anticapitalist and antifascist.

On 26 August 2026, Washington designated it a “Specially Designated Global Terrorist” (SDGT).² The State Department accuses it of providing the digital infrastructure of “violent antifascist cells” and other far-left militants. The public grievances concern the hosting of communications and claims of responsibility; to our knowledge, they do not establish direct participation in violence. A/I disputes this. The Italian Senate notes that no Italian or European criminal proceedings target the organisation for terrorism.²

Yet the designation alone had immediate effects: loss of the domain name, closure of the PayPal account, freezing of bank assets. In early September, A/I announced its dissolution.² An American administrative decision, without trial, ended twenty-five years of activity, even before the seizure.

On 13 October, Amsterdam police intervened in a datacenter at the Science Park in Amsterdam-Oost. They seized an A/I server. A copy was made; it is intended for the American authorities. The physical server itself is to be returned to the datacenter.³ The Amsterdam prosecutor's office states that the data had not yet been transferred to the United States as of 17 October.⁴ The Dutch Cloud Community, the Dutch federation for cloud and hosting, claims the opposite.⁵ The contradiction remains unresolved to this day.

On 15 October, the DCC published a statement and sent an urgent letter to the police: it asked on what legal basis the intervention took place, and whether independent judicial review had occurred.⁴ On 16 October, MPs from four parties (PRO, D66, SP and PvdD) tabled written questions to the Minister of Justice and Security David van Weel — and, for question 2026Z22534, also to the State Secretary for Economic Affairs.⁶ They asked, in particular, how many times in the last two years Washington had requested the seizure of servers or data from European hosts, and how many times the Netherlands had agreed.

2. The mechanism: a treaty, not extraterritoriality

This is where the case gets interesting, and where it differs from the CLOUD Act.

The legal basis is not an American law forcibly applied in Europe. It is the mutual legal assistance treaty (MLAT) signed between the Netherlands and the United States in 1981.⁷ Dutch police acted under Dutch law, with Dutch powers, but at the request of the United States. As a lawyer quoted by Decrypt put it: “An FBI agent in Amsterdam has roughly the powers of a tourist.”⁸ States ask each other for permission. Here, the Netherlands granted it.

The treaty sets conditions. The request must concern acts punishable in both countries by at least one year of imprisonment. It may be refused if it harms the essential interests of the requested state, if it concerns a political offence, or in case of double jeopardy.⁸ The Amsterdam prosecutor's office considers that none of these grounds applied.⁴

Two details raise eyebrows.

First, the “principle of trust”: the Dutch prosecutor assesses neither the proportionality of the request nor its actual necessity for the American investigation. It checks that the treaty's conditions are met, not that the request is justified.⁸ That is the very principle of mutual legal assistance, and what makes it effective. But it is also what makes it blind to political use.

Second, the American designation. It has no legal value in the Netherlands. Neither the Dutch government nor the European Union has endorsed it. It was not pronounced by a court.⁸ And yet it triggered the request, and it is what made it possible to meet the treaty's threshold. “The Dutch problem,” the lawyer says, “is that the Washington label underpins the request, and the Netherlands does not share it.”⁸

In other words: a foreign administrative act, without trial, served as the basis for European judicial cooperation. This is not a violation of the law. It is the law working as designed, and that is precisely what is worrying.

3. Why this is more worrying than the CLOUD Act

We are starting to understand the CLOUD Act.⁹ An American company must hand over to the American authorities the data it holds, wherever it is. The workaround is simple in theory: choose a genuinely European provider, with no American parent company.

The A/I case shows the limit of that workaround. Here, the host is Italian, the server is in the Netherlands, the data is in Europe. And it was still copied for Washington, because the Dutch state cooperated. The MLAT does not care about the nationality of the provider. It cares about territory, and about the willingness of the requested state.

Consequence: a European host is not a legal shield. It is a link. The shield depends on what the state is prepared to refuse, what a judge is allowed to review, and what the company is able to do: notify, encrypt, challenge, resist.

This is an unpleasant nuance for all those selling “sovereign cloud” as a magical property of soil. Soil is not enough. And the context makes the nuance more urgent: AWS, Microsoft and Google control 70 to 80% of the European cloud market.¹⁰

4. The precedent

This case is not only about A/I. It sends a message to all European hosts serving sensitive clients: journalists, NGOs, opponents, international institutions. You could be next.

The message is all the stronger because the procedure was discreet. No public judicial decision, no prior debate, no information to Parliament. An American request, a Dutch execution, a copy. Parliament learned about it from the press.¹¹

The International Criminal Court sits in The Hague. In 2025, according to Handelsblatt, its prosecutor lost access to his Microsoft-hosted email after American sanctions (Microsoft disputes any suspension); it decided to replace Microsoft 365 with openDesk, an open-source suite, for 1,800 workstations.¹² The question asked by Dutch MPs is explicit: can companies working for the ICC still act freely if they know that this kind of request exists?⁶

5. The sovereignty chain

The lesson is not “Europe is useless”. It is that sovereignty is not an address. It is a chain. And it must be examined link by link.

1. Ownership. Who owns the entity holding my data? An American parent company, a non-European fund, a French cooperative?
2. Operations. Who administers the servers, with which staff, from which country?
3. Jurisdiction. Which law applies to the contract, the provider, the data?
4. Judicial review. Who examines an access request before it is executed? An independent judge, a prosecutor, no one?
5. Grounds for refusal. What can be opposed to an abusive request? An essential interest, a political offence, a conflict of laws?
6. Technology. Is the data end-to-end encrypted? Can the provider notify its client? Can it refuse to produce a key it does not hold?

The server is the last link, not the first. A datacenter in France with an American parent company remains exposed to the CLOUD Act. A datacenter in the Netherlands with an Italian host remains exposed to the MLAT. A datacenter in France with a French company, French staff and encryption whose key the client holds is more robust, but it is not invulnerable to a lawful French requisition. Sovereignty is not immunity. It is control of the chain.

6. And for you?

For a family storing photos, the risk is obviously lower than for an activist collective or an international institution. But the principle is the same: what matters is not only where the server is, but who owns it, who can receive a request, and what happens if the request is accepted.

A French host is not magic. It is a shorter chain: the law applied is yours, the authority that can request is yours, and remedies are before your judges. That is already a lot. It is exactly Archibou's choice: French law, no American parent company, no automatic analysis of your files.¹³ And one requirement: if a lawful requisition arrives, it must be clear, limited and challengeable, not silent.

7. What to remember

• A European server can be copied for a foreign authority, by a European state, without a public judicial decision.
• The basis was not the CLOUD Act, but a 1981 mutual legal assistance treaty.
• The American designation that triggered the request has no legal value in Europe, yet it was enough.
• Sovereignty is not an address, it is a chain: ownership, operations, jurisdiction, review, refusal, encryption.
• A European host is a better link. Not an automatic shield.

Article published by Archibou. October 2026.

May be freely shared and reproduced under a CC-BY-4.0 licence, with attribution.