Summary

  • On 19 April 2018, AFRINIC’s Board approved Resolution 201803.402 by email, opening a limited route by which directors and former directors could disclose confidential information to an independent investigation committee. The approved minutes record CB as proposer, SO as seconder, unanimous approval and HE as conflicted and not voting.
  • The resolution answered a concrete contradiction. An earlier Board rule, Resolution 201411.211, barred disclosure of Board information to third parties without Board approval and warned of possible expulsion, while AFRINIC had since commissioned an independent inquiry that needed information from people inside that wall.
  • The permission was sensibly bounded by speaker, recipient, purpose and continuing confidentiality. It was not public release, did not say that legal professional privilege was waived and did not turn AFRINIC’s internal inquiry into a regulatory or judicial process.
  • The published design remained incomplete. It did not identify who would decide “reasonable necessity”, define evidence classes, require access logs, give reviewable reasons for refusals, cover non-director witnesses expressly, state privilege-handling or retention rules, or create an independent process for later withholding and redaction.
  • AFRINIC is a private technical bookkeeper and coordinator. It may investigate its own institution and improve its records, but neither operational importance nor an internal evidence decision gives it sovereign, regulatory, police, punitive, confiscatory or public-law adjudicative authority.

L3 — The narrow door through the secrecy wall

AFRINIC had created a practical contradiction. On 14 March 2018, its Board commissioned an independent investigation into public allegations concerning staff and directors. But a resolution dating from November 2014 had said that Board information should not be disclosed to third parties without Board approval and warned that a violation could lead to expulsion. The investigators were outsiders to the Board. The people they might need to interview included directors and former directors.

A person in either class could therefore face two incompatible institutional signals: help the inquiry get at the facts, but do not disclose Board information to a third party without permission.

On 19 April 2018, the Board supplied that permission. Resolution 201803.402 allowed directors and former directors to reveal confidential information to the independent investigation committee, but only to the extent reasonably necessary for the investigation to proceed. It also expected the Governance Committee and the investigation committee to maintain confidentiality as applicable. The approved minutes identify CB as proposer and SO as seconder. They record unanimous approval by email, with HE marked as conflicted and not voting.

The initials should remain initials: the record supports neither an expanded name nor a more elaborate account of the conflict.

The date matters. The digits in “201803.402” are an instrument identifier, not proof that the resolution was adopted in March. The sealed approval evidence supplies the date: 19 April. This distinction may look clerical, but clerical precision is the beginning of institutional accountability. If the authority for a disclosure is challenged, the relevant questions include whether it existed before the disclosure, who approved it and which version controlled. A guessed date is not a harmless flourish when the very subject is permission to cross a confidentiality boundary.

The resolution’s merit lay in its modesty. It did not announce that all confidential material was open. It did not authorise directors to distribute information generally, brief the public or place documents online. It named a class of speakers, a recipient and a purpose. It imposed a threshold—reasonable necessity—and kept a confidentiality expectation on the bodies receiving and managing the information. This was an evidence-access bridge, not demolition of the wall.

That design offered four useful limits. First, the permission belonged to directors and former directors, not to anyone who happened to possess AFRINIC information. Secondly, the recipient was the appointed investigation committee, not an undefined set of third parties. Thirdly, the material had to be reasonably necessary for the inquiry to proceed, which rejected disclosure based solely on curiosity or convenience. Fourthly, confidentiality continued on the receiving side. Information could move for an investigative purpose without thereby becoming public.

Those limits made the measure materially better than either obvious extreme. At one extreme, the 2014 rule could have remained an absolute practical veto. AFRINIC would then have commissioned an inquiry while leaving potential witnesses to calculate whether co-operation might expose them to institutional sanction. At the other extreme, the Board could have purported to release every internal confidence without distinction. That would have disregarded legitimate privacy, data-protection and witness interests, and might have exposed material irrelevant to the inquiry.

Resolution 201803.402 chose a middle route: permit what the investigation reasonably needed, through a defined channel, while preserving applicable confidentiality.

The strongest benign reading deserves to be stated without qualification. A private company facing serious allegations had reasons to investigate and reasons to protect information. Directors and former directors might hold evidence bearing on the inquiry. Other people mentioned in their records might have no part in the alleged conduct. Staff members might fear exposure. Personal information might be embedded in a document whose other passages were relevant. The investigation committee needed usable access, but usable access did not require unrestricted circulation.

A purpose-limited disclosure power was a rational attempt to reconcile these demands.

The recorded abstention also matters. HE was treated as conflicted and did not vote. That fact does not tell us what the conflict was, how it was assessed or whether every possible conflict was identified. It does, however, make one element of the authority chain visible. The record shows that a named-by-initials participant did not exercise the vote because a conflict had been recorded. In an inquiry involving an institution’s own staff and directors, even that limited traceability is valuable. It prevents the public act from presenting unanimity as though every participant had taken part without qualification.

The permission also corrected a defect in the interaction between the 2014 secrecy rule and the 2018 inquiry. Resolution 201411.211 had required Board approval before Board information went to third parties. Resolution 201803.402 was that approval for a bounded class of investigative disclosure. It did not need to pretend that confidentiality had never applied. It recognised the existing rule, created a purpose-specific passage through it and left the remaining boundary standing.

This is the resolution’s central institutional achievement: it demoted secrecy from veto to managed evidence rule. Confidentiality can protect candour, personal data, deliberative space and people who co-operate with an inquiry. But when the institution itself has commissioned fact-finding, confidentiality cannot credibly mean that the institution’s own rule prevents the fact-finders from hearing relevant evidence. A secrecy rule that cannot yield through a documented channel becomes a means of controlling what may be known. A rule that yields without limits, by contrast, ceases to protect anyone.

The sensible question is not “confidential or open?” It is “access by whom, to what, for which purpose, on whose decision, recorded how and reviewable by whom?”

Resolution 201803.402 answered the first part of that question better than the second. “Directors and former directors” identified the speakers. “The investigation committee” identified the recipient. “For the investigation to proceed” stated the purpose. “To the extent reasonably necessary” supplied a proportionality threshold. The expectation that both the Governance Committee and investigation committee maintain confidentiality as applicable supplied an onward-handling principle. These are not trivial ingredients. Together they describe a controlled transfer rather than a release into the world.

The official record, however, proves the corporate act and no more. It proves what AFRINIC’s Board recorded, permitted and expected. It does not prove that every relevant item was disclosed, that every request was correctly scoped, that no witness hesitated, that every confidence was protected or that the allegations under inquiry were true or false. Nor does the word “independent” in AFRINIC’s own material settle every question about practical independence.

The Governance Committee reported that it appointed barristers from a Mauritian chambers; that is evidence of whom it said it appointed, not a judicial certification of the investigation’s design or result.

The later Governance Committee report nevertheless illuminates the problem the permission was meant to solve. The committee reported that Board non-disclosure-agreement issues had to be cleared before interviews and that this delayed the investigation beyond its 30 April reporting deadline. The report therefore confirms, at minimum, that confidentiality clearance was not an abstract concern invented after the event. It affected the timetable for obtaining evidence. It does not prove deliberate obstruction. It shows that the access architecture carried operational consequences.

The same report said the investigators requested an anonymised report to protect staff members who had provided evidence on a condition of confidentiality. Again, the limits of the fact are important. The resolution’s operative permission expressly named directors and former directors, not staff, contractors or every other possible witness. The later report tells us that staff members did supply evidence subject to a confidentiality condition. It does not disclose the evidence or establish a complete staff-authorisation protocol.

The juxtaposition exposes a design question without answering it: how were non-director witnesses brought safely within the inquiry’s evidence process?

That question is not a criticism of confidentiality itself. Witness confidence may be essential to fact-finding inside a small institution. Anonymisation can reduce the risk that a published account reveals who spoke. But anonymity at the reporting stage is not a complete witness-protection system. Investigators still need to know who supplied information, assess its reliability and, where fairness requires, test it against other evidence.

The institution needs rules about who may access identifying material, what may be shared with a person affected by an allegation, how retaliation concerns are handled and when identifiers may be retained or destroyed. The public resolution did not provide those mechanics.

Nor should confidentiality be conflated with legal professional privilege. The resolution used the language of confidential information. It did not say that privileged material was included, that privilege was waived or that anyone was authorised to decide a waiver. Confidentiality and privilege may overlap in practice, but they are not interchangeable categories. Ordinary confidential information can be shared for a limited purpose while retaining restrictions on onward use. Legally privileged material raises a distinct control question.

A sound evidence protocol would identify potentially privileged material, segregate it and route decisions about access through an expressly defined process. One cannot infer from silence that privilege disappeared.

The distinction between investigative access and public disclosure is equally firm. Resolution 201803.402 let information pass to the investigation committee under a necessity limit and an expectation of continuing confidentiality. It did not authorise publication. A later Board decision required a version of the report that conformed to data-protection, confidentiality, privacy and other applicable laws after the Board said that some information should not be published.

This later step is relevant here only because it reveals two separate gates: what investigators may see in order to test facts, and what the wider public may later see in a report.

Those gates should not be collapsed. If publication rules control the investigators’ access from the beginning, the inquiry may be deprived of material that can lawfully and properly be examined in confidence even though it cannot be printed. If investigative access automatically entails publication, witnesses and data subjects may be exposed unnecessarily. The proper architecture allows a protected investigative record to be fuller than the public account, while requiring any later withholding to be reasoned, limited and independently checkable. Resolution 201803.402 opened the first gate.

It did not explain the machinery connecting it to the second.

The Board’s later treatment of the 2014 rule adds another revealing boundary. In June 2018 it prospectively ended Resolution 201411.211 after recording a concern that the rule might hinder directors in fulfilling fiduciary duties. Yet it preserved the older rule’s application to previous discussions. That choice did not retroactively open all earlier information, cancel confidentiality obligations or dissolve any statutory duty. It instead left historical material within the old perimeter, which made the special investigative passage supplied by Resolution 201803.402 still relevant to the earlier discussions the inquiry might need to examine.

This chronology supports a precise conclusion at the first level of analysis. AFRINIC’s Board encountered a conflict between an internal confidentiality restriction and an internal investigation. It authorised a limited route through the restriction. The route was directed to appointed investigators, linked to reasonable necessity and accompanied by continuing confidentiality. A conflict abstention was recorded. Later documents show that NDA clearance affected timing, that staff-witness confidentiality mattered and that publication required a separate decision.

None of that proves the underlying allegations, the adequacy of the ultimate findings or bad faith by any participant. It proves a real governance mechanism with real, visible limits.