A Firestorm in Haven
The on-going saga at the African Network Information Centre (AFRINIC) is a threat to the stability of the global Internet, and emblematic of Africa’s governance challenges.
When you want to visit a Website, you generally use a domain name (e.g. hell.com). The domain name is then translated to an address, called a unique Internet Protocol (IP) address, which every device connected to the Internet has while it is connected. The transport of data between computers connected on the Internet is handled by another service, the Transmission Control Protocol (TCP). Together, TCP and IP, commonly written as TCP/IP form the workhorse of Internet communication.
The most used version of the IP addressing system is the fourth, called IPv4, which was first adopted on January 1, 1983 by ARPANET, the precursor to the present Internet. The pool of IPv4 addresses is managed by ICANN, a United States-based non-profit organization which helps management the domain name and addressing systems of the global Internet. IANA, an arm of ICANN whose services are now performed by PTI, an organization under ICANN, distributed IPv4 addresses to network operators around the world through five Regional Internet Registries (RIRs).
The IPv4 address space has 4.3 BILLION addresses, although a significant number of them are reserved for special purposes. However, by the early ’90s it was realized that the available pool of IPv4 addresses was being depleted at an unsustainable pace. The new addressing system developed to replace IPv4 is called IPv6 and provides 340 undecillion (or 340 trillion trillion trillion addresses!) To put this number in perspective: if you are paid 390 trillion dollars per hour, you would have to work 24/7 for 100 thousand billion years (not counting the leap years) to earn just under 340 undecillion dollars.
In 2011, IANA staff reported to the IANA Committee of the ICANN board (both of which I was members of at the time) that the last five blocks of IPv4 addresses were distributed to the five RIRs on February 3. In short order and relatively quick succession, the RIRs all reported that they, too, had run out of IPv4 addresses. APNIC, the Asia-Pacific RIR, reported it exhausted its pool in April 2011, while LACNIC and ARIN reported that they had exhausted their IPv4 addresses in June 2014, and September 2015, respectively. In November 2019, RIPE NCC, reported it had run out of IPv4 addresses, and a few months later, the AFRINIC, the RIR serving Africa, said its IPv4 pool was down to about 2 million addresses.
Although the widespread deployment of IPv6 started in the early 2000’s, the problem is that it is not backwards compatible with IPv4. In addition, many computers and applications use IPv4, meaning that the demand for IPv4 addresses kept increasing as their supply was being exhausted. This created a new market in which the average price an IPv4 address jumped from $6–24 per address in 2014, to $23–60 in 2021.
Africa’s share of IPv4 addresses attracted many dealers, both legit and otherwise. Thus, a 2019 investigation found that huge chunks of IPv4 addresses assigned to South African entities and worth $28.6 million ($33.5 million in 2023) on the open reseller market had either been stolen or were being squatted on by network operators outside the country. Additional investigations found that as early as 2012, an AFRINIC employee who later resigned, was involved in illegal brokering IPV4 addresses worth millions of dollars.
AFRINIC addressed the problem in June 2020, and accused Cloud Innovations Ltd. (CIL) of violating AFRINIC rules, as well as the Registration Service Agreement (RSA) which governs the acceptable use of IP addresses allocated by AFRINIC to its members. CIL responded, and vigorously contested AFRINIC’s accusations against it. The issue remained dormant until March 2021, when AFRINIC responded to CIL’s rebuttal. AFRINIC re-stated its claims against CIL, and asked it to provide additional information about their use of the IP addresses allocated to them. Otherwise, AFRINIC threatened, it would terminate the RSA CIL signed with AFRINIC, and the IPv4 addresses allocated to it by AFRINIC would be re-possessed. CIL rejected AFRINIC’s request publicly, saying they were arbitrary and excessive.
CIL sought an injunction from the Mauritius Supreme Court in March 2021, marking the start of a firestorm of litigation in this otherwise peaceful haven. In the 19 months between March 2021 and September 2022, CIL filed 29 applications, petitions, and other complaints to the Mauritius Supreme Court. In addition, Larus Ltd., a Hong Kong-based company to which CIL is affiliated, filed four cases against AFRNIC during the same period. Tellingly, Larus Ltd. and CIL were both founded by Lu Heng, a Chinese national who apparently also has nationalities of “several countries.”
AFRINIC, on its part, had started to self-destruct about three years before the start of the legal fracas with CIL. In March 2018, the Chair, and Vice Chair of AFRINIC’s board of directors stepped down following allegations of sexual harassment of an AFRINIC staff. That, however, did not satisfy many AFRINIC members who in May 2018 voted against all candidates who ran for positions on the AFRINIC board.
AFRINIC limped on and in 2019 got a new CEO, Eddy Kayihura, who had high hopes for the organization. Mr. Kayihura promptly went on to address the theft of IP addresses from AFRINIC and, following a comprehensive audit of AFRNIC’s allocated IPv4 addresses, went after CIL. AFRINIC quickly got stuck in a legal quagmire, with the Mauritius Supreme Court freezing and unfreezing its bank accounts. In a curious twist, Mr. Kayihura dragged AFRINIC to court, and finally exited his position because the AFRINIC did not have a properly-constituted board to renew his contract.
Although AFRINIC has not ground to a complete halt, its predicament has worried the global Internet community. In August 2021, the President of ARIN, the RIR for North America, expressed ARIN’s concern about impact of the litigation against AFRINIC, and the freezing of its bank account on AFRINIC’s operations and possibly, the stability of the global Internet. In the same vein, the Number Resource Organization (NRO), the umbrella organization for the five RIRs wrote to the AFRINIC community in July 2022, expressing their concern about the litigations against AFRINIC, and urging them to “come together to help steer AFRINIC in a positive direction.”
AFRINIC is, as at the writing of this article, still in a limbo, with no CEO, no properly constituted board of directors, and some pending litigations. Although it is paying its staff, its adverse legal situation is not sustainable, and could lead to operational failure, according to the President of ARIN in a February 2023 address. Unless something is done to address the situation, AFRINIC could fail to discharge its responsibilities to the global Internet community, and threaten the stability of the global Internet. And that would be an unfortunate and avoidable tragedy.
