Summary

  • AFRINIC's 8 May extension moved the first-round bylaws-comment deadline to 17 May and named one designated route, forms.afrinic.net/brc-comment.
  • On 13 May, AFRINIC said the forms host was temporarily unavailable after a technical issue and promised a later restoration update. The checked record does not establish the incident's start, end, affected path, fallback or deadline remedy.
  • This does not prove that any comment was lost. It does show why an active consultation needs a privacy-safe submission-continuity receipt joining channel availability, acknowledgements, retries, compensation and the final accepted intake set.

The calendar kept moving. The door did not leave a receipt.

AFRINIC's first 2026 bylaws consultation opened with a conventional public promise. Members, stakeholders and the wider Internet community could submit views, comments and proposed amendments. The original period ran from 20 April to 10 May. The page linked an online form, while the archived announcement of 19 April preserved the designated submission endpoint.

On 8 May, AFRINIC extended the deadline to 17 May so that everyone would have sufficient time to provide comprehensive feedback. The extension again told readers to use the designated online form. Its mailing-list copy, archived at 13:41:12 UTC on 9 May, named the same address. Neither version identified an email, mailing list or second form as an alternative intake route.

Then, on 13 May, AFRINIC published an urgent-maintenance notice. forms.afrinic.net was temporarily unavailable following a technical issue. The technical team was working to restore full service, and a further update would be provided once the platform was back online.

Those sentences are admirably direct about the immediate state. They are not an incident timeline. The page gives a publication date, not a time. It does not say when the interruption began, which form paths failed, when service returned, how restoration was tested or whether an alternative route opened. Four calendar dates separate 13 May and 17 May. That is not evidence of a four-day outage.

No source inspected for this article shows that a contributor lost a comment, abandoned an attempt or was excluded. No source establishes that the form remained down until the deadline. A functioning form today cannot reconstruct its state then. The accountable question is therefore not, “Who was silenced?” It is much narrower: what public record shows that the extended opportunity remained usable, and that any interruption was reconciled with the set of submissions the committee later reviewed?

A received comment is not an attempted comment

The distinction matters because AFRINIC's Bylaws Review Committee Terms of Reference imposes a documentary chain. The committee is to develop mechanisms enabling submission, ensure submissions and sources are publicly accessible, provide a report detailing input and how each item was handled, and publish a report documenting actions taken.

On 4 August, the second-consultation notice said the committee had carefully reviewed every submission received. It said comments were analysed individually and collectively before proposed amendments were prepared.

That statement is meaningful. It addresses records that reached the accepted intake set. It does not answer a different systems question: whether every person who tried to use the designated route during the promised period either succeeded, received a failure message with a workable alternative, or obtained equivalent additional time.

Three events are often compressed into one:

attempt → platform acceptance → committee intake

An attempted submission may fail before the server creates a record. A platform may accept data but fail to issue an acknowledgement. A contributor may retry and create a duplicate. An accepted record may reach a queue but not the committee's review ledger. “Every submission received was reviewed” can be wholly accurate while the evidence for the first two joins remains absent.

This is why publication of the comments alone would not close the incident. Public comments prove what arrived. They do not count an error page, a timed-out request or a draft abandoned after an unavailable host. Conversely, a maintenance notice proves an interruption state at notice time; it does not prove that anyone tried to submit during it.

The correct response is a reconciliation record, not an accusation.

The smallest useful receipt

A submission-continuity receipt need not reveal what somebody wrote. It begins with the consultation identity and the exact text version under review. It states the opening time, closing time and timezone, not just a calendar date. It lists every authorised channel and the responsible operational role.

For an incident, it records detection time, public-notice time, affected operation, restoration time and verification method. “Host unavailable” should be separated from “comment endpoint could not accept a valid submission”; the first is what AFRINIC announced, while the second would require path-level evidence.

The receipt then connects three ledgers:

Ledger Minimum public fields
Availability channel, status interval, affected operation, notice, restoration and test
Submission privacy-safe acknowledgement, success or failure state, retry and deduplication state
Review accepted record count, inclusion in analysis, handling state and correction history

The public surface can carry aggregate counts and state transitions. Comment bodies, names, contact details, IP addresses, security logs and authentication material do not belong there. A contributor could receive an acknowledgement code and later verify that the code entered the reconciled intake set without disclosing the comment.

Retries require special care. If a user resubmits after restoration, two records must not be counted as two voices. If the first attempt never reached the application, the second must not be dismissed as a duplicate merely because its text resembles a cached draft. Deduplication needs a rule, a reason class and a correction path.

Deadline compensation is another explicit state. A short interruption may require no extension if a tested fallback remained open and the incident did not impair practical access. A longer or poorly timed interruption may justify extra time. The receipt should state the decision and its basis, not assume that extending every outage is necessary.

The endpoint was part of the governance instrument

The form was not incidental website furniture. In the initial call and extension, it was the named route by which an outside view became committee evidence. During an active consultation, availability of that route is part of the operating constitution of the process.

This does not make AFRINIC a public authority, nor does a technical problem automatically invalidate a private membership consultation. AFRINIC remains a private registry company coordinating number-resource records and services. The governance point is proportional: when the organisation invites participation through a specific interface, it controls the intake conditions and therefore owes contributors a reproducible account of material interruptions.

The current news index captured for this research still exposes both the extension and urgent-maintenance items. A separate restoration item was not identified in that checked index. This is only a bounded observation. AFRINIC may have communicated restoration through a status page, direct message or another channel not found here. Absence from one index is not proof that no update exists.

That uncertainty strengthens the case for joining records. A restoration event should be linked from the incident that promised it, and from the consultation whose channel it affected. Readers should not have to infer completion from the fact that the host later responds.

What this evidence cannot support

The available record does not disclose the cause beyond “a technical issue”. It does not support a security-breach claim. It does not show that member-service systems, WHOIS, RDAP, RPKI or the registry database were affected. It does not establish an outage duration or a lost-comment count.

It also does not justify invalidating the committee's later work. The August notice describes a review of every submission received. The right audit response is to ask how completeness of that received set was established around the incident, not to pretend that an undocumented interval proves an illegitimate draft.

Nor is this the same problem as the comment-to-decision ledger. Once a comment is accepted, readers should be able to see how it was classified, answered and reflected in text. Submission continuity sits one step earlier. It tests whether the door into that ledger was available under the promise AFRINIC made.

Sources