I’m not a lawyer, but there are all kinds of extremely broad computer crime statutes on the books. No prosecutor would bring this case. This would flagrantly violate the spirit of the law, which was intended to stop unsolicited dick pics and other forms of targeted harassment. It would certainly not merit extradition to the UK, or the UAE for that matter.

It’s not worth worrying about such extreme what-if cases. If the Feds were so determined to destroy an innocent person in a kangaroo court, there’s easier ways of doing so. They could plant CSAM on the server. They could coerce an informant to accuse you of SA (like they did to Assange).

Realistically, the worst sanction this dev could reasonably expect, is to have their domain taken down. That’s what happened to the OG .cx domain, after all…