On October 9, 2026, the United States imposed sanctions on the International Criminal Court (ICC) in The Hague as an institution. Until now, only individual judges, prosecutors, and other individuals had been on the sanctions list. For readers of this blog, the most interesting question is what will happen to the court’s digital operations. The court uses services similar to those used by most European government agencies and companies. This article is a follow-up to my September series on the Italian collective Autistici/Inventati. The United States has also placed that collective on its sanctions list. Both cases illustrate how technological dependence can be used as a political tool. License No. 14: digital services, but only until revoked -------------------------------------------------------- The Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury has added the court to the SDN sanctions list. U.S. persons and companies are therefore prohibited from doing business with it unless a license authorizes it. Along with the designation, the office issued four general licenses. License No. 13 authorizes transactions necessary for the court’s day-to-day operations, such as salaries, rent, and contributions from member states, through April 7, 2027. Licenses No. 15 and 16 cover pensions and defendants held in custody by the court. License No. 14 is essential for digital operations. It authorizes telecommunications and Internet services, including, among other things, email, video conferencing, collaboration platforms, user authentication, web hosting, and domain registration. It also authorizes enterprise software and related cloud services, including cybersecurity, data storage, and data backup. Its text does not specify an expiration date. At first glance, this is good news: U.S. suppliers can continue to provide the listed services to the court. However, there are two catches. The license does not impose any obligations on the suppliers. It removes the sanctions barrier, but a supplier may terminate the cooperation for its own reasons. Furthermore, the agency may amend or revoke the general license. The U.S. Department of State explicitly states in General License No. 13 that it will amend it depending on how negotiations with the contracting states proceed. The court therefore continues to use U.S. technology, but only as long as the U.S. government allows it. Same tool, different configuration ---------------------------------- In the Autistici/Inventati case, the United States applied a different legal basis but followed the same procedure: inclusion on the SDN list and a general license. The difference lies in what the licenses permitted. This is best illustrated by examining each layer of operations individually. **The collective’s domain was suspended within two days, while the license expressly permits domain registration for the court.** Two days after the designation, the American operator of the .org registry put the autistici.org domain into serverHold status. In this status, the domain disappears from the DNS and the address stops working. The court uses the domain icc-cpi.int. The .int extension is administered directly by IANA, a function performed by the American nonprofit organization ICANN. Although License No. 14 permits domain registration, it does not guarantee that a specific domain will remain operational. **The collective lost PayPal and ran into bank account restrictions in less than a week, while the court has six months of operations covered.** The collective’s PayPal account was closed the day after the designation. The Italian bank Banca Etica restricted its account after less than a week. Under License No. 13, the court may pay salaries, rent, and invoices through April 7, 2027. **The collective received no special exemption for technology.** Its license only authorized winding down relationships through September 25, that is, for about a month. The court may continue to use email, web hosting, enterprise software, and related cloud services with no expiration date. **The court lost its insurance even before it was added to the sanctions list.** The French insurance company AXA terminated its employee health insurance contract with the court as early as October 1. According to the Financial Times, the reason was concern over the impact of U.S. sanctions. Experts cited by the Atlantic Council warn that banks may take similar action. A license does not guarantee that a European company will continue its cooperation. The company is assessing its own legal obligations, payments routed through the U.S., and sanctions risks. Neither the court nor the collective determined this difference. It was determined by the U.S. executive branch, and according to the State Department, it is subject to change. The practical impact of the sanctions, therefore, does not depend solely on inclusion on the list. It is also significantly influenced by the scope of the licenses. Precedent: the chief prosecutor’s email --------------------------------------- A case from 2025 illustrated what such dependence looks like in practice. In February of that year, the United States added Karim Khan, the court’s chief prosecutor, to its sanctions list as an individual. The prosecutor subsequently lost access to his Microsoft email account. The AP reported on this in May 2025. Khan then switched to the Swiss service Proton Mail. From the outset, Microsoft has maintained that it did not suspend services to the court as an institution. In February 2026, it apologized to a British parliamentary committee for the inaccurate testimony of its representative. The company’s representative had claimed there that the court, not Microsoft, had shut down the email service. However, according to the Dutch press, Microsoft informed the court that the sanctions required Khan’s account to be blocked. Otherwise, it reportedly would have terminated email service for the entire organization. The court then blocked the account on its own. Microsoft has not issued any further statement on the matter. The lesson is simple. With a cloud service, it’s not just where the servers are physically located that matters. It also matters which country’s laws apply to the provider. The provider doesn’t even have to shut down the service itself. All it has to do is give the customer a choice. openDesk: what the court is replacing Microsoft with ---------------------------------------------------- In October 2025, the court confirmed that it was switching from Microsoft office software to openDesk. This software suite is developed by the German Center for Digital Sovereignty (ZenDiS), which is owned by the German government. Osvaldo Zavala Giler, the court’s secretary responsible for its administration, stated at the time, according to the Handelsblatt newspaper, that the court must reduce its dependencies and strengthen its technological autonomy. He added that this would be costly and inconvenient in the short term. openDesk is not a single application. It is a set of open-source projects under a common interface. Open-Xchange handles email, calendar, and contacts. Nextcloud stores files. Documents are edited in Collabora Online. Chat runs on Element and the Matrix standard. Video calls are handled by Nordeck. The wiki is powered by XWiki, diagrams by CryptPad, and project management by OpenProject. Authentication and identity management are handled by Nubus from Univention. Open source alone does not guarantee sovereignty. What matters is where and by whom the software package is operated. openDesk can be operated on its own servers or with a European provider. If operated in a U.S. cloud, the dependency would remain, just at a lower level. The court has not publicly disclosed how far along the transition is. In March 2026, the JusticeInfo website reported that the status of the transition was unclear. As of the date of publication, I have not found any more recent information. However, the office suite is only part of the operation. Some specialized systems remain with U.S. vendors. **The prosecutor's office is working with evidence stored in U.S. cloud services.** According to JusticeInfo, the office uses the RelativityOne platform and the eVault evidence repository. Both services are operated by U.S. companies. Microsoft, Accenture, and their joint venture Avanade are involved in the Harmony project, which the EU co-funds to digitize the office. openDesk does not replace these systems. The European Response --------------------- The European Commission stated that it is prepared to protect European entities and ensure that the court can continue to function. Belgium is calling for the activation of a blocking regulation that would prohibit European companies from complying with U.S. sanctions. The Netherlands has asked the Commission to prepare for its activation. However, the regulation currently covers only select U.S. regulations, primarily those targeting Cuba and Iran. EU foreign ministers discussed the court on October 12 in Luxembourg. Following the meeting, EU High Representative Kaja Kallas stated that the EU has options to ensure the court can continue its work and that member states want to protect the court. She described the six-month period during which License No. 13 permits the court’s normal operations as an opportunity for dialogue. However, she did not announce any specific steps, such as activating the blocking regulation. Meanwhile, on October 9, the chairs of five European Parliament committees and delegations had already called on the Commission to activate the blocking regulation immediately. However, even a blocking regulation would not resolve the technical issue. It could prohibit a European company from complying with the sanctions, but it couldn’t force an American company to do anything. Microsoft, Amazon, or Google would find themselves caught between two legal systems, while U.S. sanctions would continue to apply to them. What this means for ordinary users ---------------------------------- Most readers of this blog will never end up on a sanctions list. However, the group of people against whom governments use such tools changes over time. Not long ago, few would have expected an international court as an entire institution, or a volunteer email provider, to end up on the list. Moreover, the same mechanism works even without sanctions. An account with a major provider can be terminated due to a violation of terms of service, an error in an automated system, or a court order. The difference between a minor inconvenience and a catastrophe then depends on whether you have somewhere else to go. Prosecutor Khan reacted quickly and switched to the Swiss service Proton Mail. For the average user, this suggests four practical steps. **Keep your address on your own domain.** You can then switch providers without changing your address. The bank, government agencies, and your contacts don't have to know about the change. **Back up your data outside of your primary provider.** Regularly export your email, contacts, calendar, and files. Keep an encrypted backup on your own drive and, ideally, with another provider in a different jurisdiction. Test your ability to restore data from the backup from time to time. The provider cannot remotely disable the copy you keep on your own device. **For critical services, have a backup plan ready.** It could be a second email account with a different provider, a second messaging app you use to stay in touch with your closest friends and family, or a backup storage solution. You don’t have to use them every day. It’s enough if they work when your main service goes down. Check once in a while to make sure you can still log in to them. **Have a backup plan for recovering your accounts.** For important accounts, set up a recovery email address that is independent of your primary provider and the domain you use for your main email. Store your two-factor authentication backup codes securely, away from your main account. However, a custom domain is not a panacea. It makes it easier to switch email providers, but it does not guarantee independence from the registrar or the extension administrator. The Autistici/Inventati case showed that even a domain can be suspended by the extension administrator. Before registering, it is therefore worth checking who manages the extension, what rules it is subject to, and under what conditions a domain can be suspended or transferred elsewhere. What follows from this ---------------------- The court’s case is, so far, one of the most high-profile tests of European digital sovereignty. The court began reducing its technological dependencies a year ago, yet it continues to rely on several U.S. suppliers. There are three lessons to be learned from this for European institutions and companies. **Simply locating the servers in Europe is not enough.** The supplier’s legal ties, ownership structure, and dependence on other services are also important. An American provider’s European data center does not, in and of itself, protect against U.S. sanctions. **Open-source software makes it easier to switch operators.** However, operational resilience also depends on where and by whom it is operated, as well as on identity management, updates, and other support services. openDesk or another open-source package offers the greatest benefit when it runs on the organization’s own infrastructure or with a provider in a different jurisdiction. **The office suite is just the beginning.** Equally important are the domain, identity management, specialized applications, backups, the bank, and the payment gateway. Anyone who wants to know how resilient their system is must go through all the layers. The problem, however, is not American companies themselves. The problem is dependence on a single jurisdiction, whatever it may be. Rules change with governments and the geopolitical situation. That is why it is difficult to predict how a particular jurisdiction will act in a few years. This also applies to Europe. Switzerland, long considered a safe haven for privacy, has been preparing a revision of its rules on communications surveillance since 2025. I therefore do not view alternatives as a sign of distrust toward any one country. I see them as a way to spread the risk. For individuals, this means having their own domain and keeping their data under their own control. For countries and the European Union, it means having infrastructure that can be operated without outside permission if necessary. Complete independence isn’t realistic. But less dependence provides more options. The court began answering these questions a year ago. License No. 14 now gives it time. How long that lasts is not up to the court. --- Related articles ---------------- - [**Autistici/Inventati and US Sanctions: When Counterterrorism Turns Against Digital Infrastructure**](https://vsx.global/autistici-inventati-cases-and-u-s-sanctions-when-counterterrorism-measures-target-digital-infrastructure/). How the same tool hit a volunteer collective and which layers of its operations went down. - [**Your Own Domain: The First Step to Being Able to Leave Whenever You Want**](https://vsx.global/own-domain-first-step/). Why it makes sense to have an address on your own domain, and what it solves. - [**Switzerland Is Building a Second System Alongside Microsoft. And Europe Is Changing How It Measures Sovereignty**](https://vsx.global/switzerland-is-building-a-second-system-alongside-microsoft-europe-is-changing-the-measure-of-sovereignty/). How another institution is preparing for the possible loss of U.S. services. - [**FOSS Alternatives, Part 3: Productivity and Office – Everyday Tools Without Cloud Dependency**](https://vsx.global/foss-alternatives-part-3-productivity-and-office-everyday-tools-without-cloud-dependency/). Nextcloud, LibreOffice, and other free tools that openDesk also builds on. Sources ------- - [OFAC](https://ofac.treasury.gov/recent-actions/20261009) — designation of the court on the SDN list and General Licenses No. 13 to 16 (October 9, 2026) - [OFAC](https://ofac.treasury.gov/media/937186/download?inline) — General License 13: Authorizing Certain Transactions Involving the International Criminal Court (October 9, 2026) - [OFAC](https://ofac.treasury.gov/media/937191/download?inline) — General License 14: Authorizing Certain Transactions Related to Telecommunications and Enterprise Software Involving the International Criminal Court (October 9, 2026) - [U.S. Department of State](https://www.state.gov/releases/office-of-the-spokesman/2026/10/imposing-sanctions-on-the-international-criminal-court-2/) — Imposing Sanctions on the International Criminal Court (October 9, 2026) - [The Register](https://www.theregister.com/2026/02/18/microsoft_asks_uk_parliament_to_correct_record/) — Microsoft throws spox under the bus after Parliament testimony on ICC email kerfuffle (February 18, 2026) - [JusticeInfo.net](https://www.justiceinfo.net/en/156691-how-sanctions-can-weaponize-us-tech-against-the-icc.html) — How sanctions can weaponize US tech against the ICC (March 19, 2026) - [Euronews](https://de.euronews.com/2025/10/30/istgh-open-desk) — Internationaler Strafgerichtshof wechselt von Microsoft zu deutscher Software (October 30, 2025) - [openDesk](https://www.opendesk.eu/en/product) — an overview of the modules and projects on which the package is based - [IANA](https://www.iana.org/domains/int) — managing the .int extension - [Insurance Journal](https://www.insurancejournal.com/news/international/2026/10/02/887731.htm) — International Criminal Court, AXA Cut Ties Amid Trump Campaign Against Court (October 2, 2026) - [Atlantic Council](https://www.atlanticcouncil.org/dispatches/the-us-just-sanctioned-the-international-criminal-court-whats-next/) — The US just sanctioned the International Criminal Court. What’s next? (October 9, 2026) - [Agence Europe](https://agenceurope.eu/en/bulletin/article/13956/10/european-commission-ready-to-protect-icc-and-european-partners-against-unprecedented-us-sanctions) — European Commission ready to protect ICC and European partners against “unprecedented” US sanctions (October 10, 2026) - [Euronews](https://www.euronews.com/2026/10/09/eu-calls-us-sanctions-on-international-criminal-court-regrettable) — Threats against ICC ‘not acceptable,’ EU says after US announces sanctions (October 9, 2026) - [Council of the EU](https://www.consilium.europa.eu/en/press/press-releases/2026/10/10/international-criminal-court-statement-by-the-high-representative-on-behalf-of-the-eu-following-the-announcement-of-us-sanctions/) — International Criminal Court: Statement by the High Representative on behalf of the EU following the announcement of US sanctions (October 10, 2026) - [EEAS](https://www.eeas.europa.eu/eeas/foreign-affairs-council-press-conference-high-representative-kaja-kallas-5_en) — Foreign Affairs Council: Press conference by High Representative Kaja Kallas (October 12, 2026) - [European Parliament](https://www.europarl.europa.eu/news/en/press-room/20261009IPR48086/sanctions-on-the-icc-joint-statement-by-afet-droi-inta-juri-and-d-us-chairs) — Sanctions on the ICC: Joint Statement by AFET, DROI, INTA, JURI and D-US Chairs (October 9, 2026) - [Der Bundesrat](https://www.admin.ch/de/newnsb/EXv-JkPBAZuL) — Fernmeldeüberwachung und mitwirkungspflichtige Unternehmen: Bundesrat nimmt Ergebnis des Vernehmlassungsverfahrens zur Kenntnis (February 11, 2026) - [EUR-Lex](https://eur-lex.europa.eu/legal-content/CS/TXT/?uri=CELEX:31996R2271) — Council Regulation (EC) No. 2271/96 (Blocking Regulation) *This text is based on information available as of the date of publication. The description of the licenses is based on their wording on the OFAC website and does not constitute legal advice. Information about the court’s technologies comes from public sources, as the court does not disclose details about its infrastructure.* This page was machine-translated. The text may contain errors.