A Firestorm in Haven
The on-going saga at the African Network Information Centre (AFRINIC) is a threat to the stability of the global Internet, and emblematic of Africa’s governance challenges.
When you want to visit a Website, you generally use a domain name (e.g. hell.com). The domain name is then translated to an address, called a unique Internet Protocol (IP) address, which every device connected to the Internet has while it is connected. The transport of data between computers connected on the Internet is handled by another service, the Transmission Control Protocol (TCP). Together, TCP and IP, commonly written as TCP/IP form the workhorse of Internet communication.
The most used version of the IP addressing system is the fourth, called IPv4, which was first adopted on January 1, 1983, by ARPANET, the precursor to the present Internet. The pool of IPv4 addresses is managed by ICANN, a United States-based non-profit organization which helps management the domain name and addressing systems of the global Internet. IANA, an arm of ICANN whose services are now performed by PTI, an organization under ICANN, distributed IPv4 addresses to network operators around the world through five Regional Internet Registries (RIRs).
The IPv4 address space has 4.3 BILLION addresses, although a significant number of them are reserved for special purposes. However, by the early ’90s it was realized that the available pool of IPv4 addresses was being depleted at an unsustainable pace. The new addressing system developed to replace IPv4 is called IPv6 and provides 340 undecillion (or 340 trillion trillion trillion addresses!) To put this number in perspective: if you are paid 390 trillion dollars per hour, you would have to work 24/7 for 100 thousand billion years (not counting the leap years) to earn just under 340 undecillion dollars.
In 2011, IANA staff reported to the IANA Committee of the ICANN board (both of which I was members of at the time) that the last five blocks of IPv4 addresses were distributed to the five RIRs on February 3. In short order and relatively quick succession, the RIRs all reported that they, too, had run out of IPv4 addresses. APNIC, the Asia-Pacific RIR, reported it exhausted its pool in April 2011, while LACNIC and ARIN reported that they had exhausted their IPv4 addresses in June 2014, and September 2015, respectively. In November 2019, RIPE NCC, reported it had run out of IPv4 addresses, and a few months later, the AFRINIC, the RIR serving Africa, said its IPv4 pool was down to about 2 million addresses.
Although the widespread deployment of IPv6 started in the early 2000’s, the problem is that it is not backwards compatible with IPv4. In addition, many computers and applications use IPv4, meaning that the demand for IPv4 addresses kept increasing as their supply was being exhausted. This created a new market in which the average price an IPv4 address jumped from $6–24 per address in 2014, to $23–60 in 2021.
Africa’s share of IPv4 addresses attracted many dealers, both legit and otherwise. Thus, a 2019 investigation found that huge chunks of IPv4 addresses assigned to South African entities and worth $28.6 million ($33.5 million in 2023) on the open reseller market had either been stolen or were being squatted on by network operators outside the country. Additional investigations found that as early as 2012, an AFRINIC employee who later resigned, was involved in illegal brokering IPV4 addresses worth millions of dollars.
In June 2020, AFRINIC accused Cloud Innovation Ltd. (CIL), a Seychelles-based company, of violating AFRINIC rules as well as the Registration Service Agreement (RSA) which governs the acceptable use of IP addresses allocated by AFRINIC to its members. CIL, which as an Africa-based company is entitled to apply for IP addresses from AFRINIC, vigorously contested AFRINIC’s accusations against it.
The issue remained dormant until March 2021, when AFRINIC responded to CIL’s rebuttal. AFRINIC re-stated its claims against CIL and asked it to provide additional information about their use of the IP addresses allocated to them. Otherwise, AFRINIC threatened, it would terminate the RSA CIL signed with AFRINIC, and the IPv4 addresses allocated to it by AFRINIC would be re-possessed.
CIL sought an injunction from the Mauritius Supreme Court in March 2021, marking the start of a series of legal battles of AFRINIC, which is based in Mauritius, considered by many as a peaceful haven in Africa. In the 19 months between March 2021 and September 2022, CIL filed 29 applications, petitions, and other complaints to the Mauritius Supreme Court. In addition, Larus Ltd., a Hong Kong-based company and CIL partner filed four cases against AFRNIC during the same period. Lu Heng, a Chinese national who apparently also has nationalities of “several countries” was, in 2023, the CEO of both CIL and Larus Ltd.
AFRINIC, on its part, had started to self-destruct about three years before the start of its legal battles with CIL. In March 2018, the Chair, and Vice Chair of AFRINIC’s board of directors stepped down following allegations of sexual harassment of an AFRINIC staff. That, however, did not satisfy many AFRINIC members who in May 2018 voted against all candidates who ran for positions on the AFRINIC board.
AFRINIC limped on and in 2019 got a new CEO, Eddy Kayihura, who had high hopes for the organization. Mr. Kayihura promptly went on to address the theft of IP addresses from AFRINIC and, following a comprehensive audit of AFRNIC’s allocated IPv4 addresses, went after CIL. AFRINIC quickly got stuck in a legal quagmire, with the Mauritius Supreme Court freezing and unfreezing its bank accounts. In a curious twist, Mr. Kayihura dragged AFRINIC to court, and finally exited his position because the AFRINIC did not have a properly constituted board to renew his contract.
Although AFRINIC has not ground to a complete halt, its predicament has worried the global Internet community. In August 2021, the President of ARIN, the RIR for North America, expressed ARIN’s concern about impact of the litigation against AFRINIC, and the freezing of its bank account on AFRINIC’s operations and possibly, the stability of the global Internet. In the same vein, the Number Resource Organization (NRO), the umbrella organization for the five RIRs wrote to the AFRINIC community in July 2022, expressing their concern about the litigations against AFRINIC, and urging them to “come together to help steer AFRINIC in a positive direction.”
AFRINIC is, as at the writing of this article, still in a limbo, with no CEO, no properly constituted board of directors, and some pending litigations. Although it is paying its staff, its adverse legal situation is not sustainable, and could lead to operational failure, according to the President of ARIN in a February 2023 address. Unless something is done to address the situation, AFRINIC could fail to discharge its responsibilities to the global Internet community and threaten the stability of the global Internet. And that would be an unfortunate and avoidable tragedy.
