Summary

  • ARIN's registration records still name the United States Department of Defense as direct-allocation holder of the eight large blocks that appeared in global routing under AS8003 in 2021, and nothing in the material read here shows the registration moving.
  • The lesson is not who hijacked what. It is what a prefix proves — operation at a timestamp — and what everyone who built a filter, a reputation list or an asset inventory on that announcement actually held.

At 16:57:35 UTC on 20 January 2021 a BGP update announced 11.0.0.0/8 with an AS path ending 6939 8003. Stéphane Bortzmeyer's decoded update carries the timestamp to the microsecond. Doug Madory, then at Kentik, reproduced the same minute with a slightly longer path, 1299 6939 6939 8003, and called it one of the earliest messages observed — not the first ever sent.

The block behind that announcement has been on the registry's books since 19 January 1984, when it was registered as a direct allocation under network name DODIIS, handle NET-11-0-0-0-1. Today ARIN's record for it names United States Department of Defense (DoD), organisation handle USDDD, with the last record update on 27 August 2025 (ARIN).

Seven more large blocks followed the same pattern, and every current ARIN record names the same holder: 7.0.0.0/8 DISANET7, registered 24 November 1997 (ARIN); 22.0.0.0/8 DNIC-SNET-022, 26 June 1989 (ARIN); 21.0.0.0/8 DNIC-SNET-021, 1 July 1991 (ARIN); 26.0.0.0/8 DISANET26, 1 May 1995 (ARIN); 28.0.0.0/8 DNIC-NET-028, 11 March 1996 (ARIN); 30.0.0.0/8 DNIC-NET-030, 1 July 1991 (ARIN); and 33.0.0.0/8 DISN-IP-LEGACY, 1 January 1991 (ARIN).

The worry arrived in public before the explanation did. On 11 March 2021 Siyuan Miao posted to the NANOG list that 7.0.0.0/8, 11.0.0.0/8, 22.0.0.0/8 and smaller prefixes "are now announced under AS8003 (GRSCORP)", and asked whether the announcements were authorised (NANOG archive). That is an outside observer documenting a concern. It is not a finding of hijack, and it does not establish who noticed first.

Four days later the registry's own chief executive answered on the same list. John Curran, identified in the message as ARIN President and CEO, wrote: "The number resources remain assigned to the DoD." The same message set out the mechanism — announcing routes for a block does not transfer the number resources, and it can be an ordinary service one network operator provides to a customer (NANOG archive).

The scale, in the publishers' own numbers. Kentik reported approximately 56 million originated IPv4 addresses by late January 2021 and 175 million unique addresses by mid-April (Kentik). Geoff Huston's annual review records 11.0.0.0/8 and 22.0.0.0/8 appearing on 20 January 2021, 33.0.0.0/8 on 7 April, and 21.0.0.0/8, 26.0.0.0/8, 28.0.0.0/8 and 30.0.0.0/8 on 19 to 20 April; it identifies AS8003 as registered to Global Resource Systems (APNIC). BTW's own directory card records the company with three public references and no confirmed operator role, which is a directory observation and not a finding about custody.

Then September. At 17:05 UTC on 7 September 2021, all but one of 765 prefixes previously announced by AS8003 moved to AS749, which Madory identifies as belonging to the Department of Defense. The observed paths changed from an ending of 6939 8003 to 6939 749; Hurricane Electric stayed the exclusive transit provider in those paths, and traceroutes still terminated at the same router in Ashburn (Kentik). Huston dates the same shift and identifies AS749 with the Defence Data Network (APNIC). The event was an origin replacement, not the disappearance of those blocks from global routing.

That sequence is the finding. Across nine months of routing visibility and the exit from it, the material read here contains no change in registered holder. The registrant Huston names and the holder ARIN names were never the same party, and no document examined here says they became one.

Read it the other way and the difference becomes hard to miss. If the routing table were authoritative for custody, the move of 765 prefixes on 7 September 2021 would have been a mass transfer of number resources. No registration change accompanies it. The routing event measured an operational rearrangement; the registry measured a holding, and the holding did not move. That is not a technicality. It is the distance between a signature and a dial tone.

So what did everyone else hold? A filter built on the announcement held a statement about who was operating a prefix in early 2021. A reputation list built on it held an attribution to a named autonomous system. An asset inventory that recorded the block as newly held by the announcing party held an inference the registry never made. Each of those is a defensible operational observation and an indefensible title claim — and only one of the two was ever on offer.

The 2021 registry picture itself needs care. Bortzmeyer reproduced a WHOIS response naming DoD Network Information Center (DNIC) as the organisation, direct allocation, registration 19 January 1984, last update 22 August 2007 (Bortzmeyer). That is a separate observation from today's USDDD record. The two labels belong to different dates and must not be read as one document.

Bounds, stated where they matter. The 7 September timestamp is a bulk origin transition that explicitly excludes one prefix; it is not a withdrawal time for every AS8003 route. No raw MRT archive was decoded for this account, so the timing rests on published measurement analyses. ARIN's JSON RDAP endpoints were rejected or unavailable during the research and the Whois-RWS records were read instead; the ASN-level registry document for AS8003 was not retrieved in its original form. No corporate filing, website or statement by Global Resource Systems, LLC was read.

None of that disturbs the centre of the episode — two independent measurement teams and the registry's own chief executive agree on its shape — and none of it turns an unread document into a finding.

The accountability question therefore resolves somewhere unfashionable. It sits with the record that carries the holding claim, and with whoever states publicly what that record says. Curran did, on a public mailing list, four days after a stranger asked. The registry has kept the same answer for four decades. The announcement came, was measured, was argued over, and left. The address blocks never moved in the only document that could have moved them.