Summary

  • On 15 December 2025, AFRINIC advised Resource Members, the community and stakeholders not to respond to emails from the Number Resource Society and not to provide personal or voting information to an entity that AFRINIC had not formally sanctioned. AFRINIC attributed the statement to its Board of Directors and Receiver, but the public page did not include a Board resolution, minutes, quorum record, named signatory, specific court direction or particularised legal basis for the instruction.
  • The enquiry, as described by AFRINIC, NRS and BTW, asked two factual questions: whether the recipient had registered to vote and whether the recipient had cast a ballot. It did not ask how anyone voted, nor did the published question set seek identity documents, facial images, biometrics, passwords, signed delegations, candidate choice or legal comment on pending proceedings.
  • AFRINIC had a real duty to protect the election data it controlled. NRS, in turn, had to justify and safeguard its own collection of replies. Those parallel responsibilities do not give AFRINIC ownership of a person’s first-hand knowledge or make registry approval a prerequisite for a voluntary factual answer. Privacy protection must be designed into verification; it must not be confused with suppressing verification.
  • AFRINIC is a private company, registry and record coordinator, not a sovereign authority. Its Board can manage company affairs within corporate law and the constitution, and its Receiver can act within the appointing instrument and court orders. Neither position creates general jurisdiction to determine contempt, criminality or spam liability, or a punitive power over members who answer an outside enquiry.
  • The proportionate response was available: authenticate the sender, publish a clear processing notice, minimise the facts collected, allow refusal and opt-out, place identity evidence with an independent custodian, reconcile results in aggregate, and provide correction and appeal. That design would have protected voters without making the institution whose record was being checked the gatekeeper of the check.

Analysis

The phrase that changed the nature of the statement

The decisive words in AFRINIC’s 15 December statement were not its reminder that election information deserved care. That proposition was sound. The decisive move was to advise people not to provide information to an entity that had not been “formally sanctioned” by AFRINIC. In those words, a data-safety warning became an institutional permission claim.

That claim matters because several separate questions were folded into one. AFRINIC could decide whether it would disclose data from systems it controlled. It could tell members that it had not supplied their contact details to NRS. It could advise recipients not to hand over identification documents, credentials, ballot choices or confidential company material. It could preserve evidence relevant to litigation. None of those functions, however, determines whether an independent organisation may ask a voluntary question, whether an individual may answer from personal knowledge, or whether the answer has evidentiary value.

The institution also described NRS as neither an AFRINIC member nor an authorised or endorsed investigator. That establishes the absence of an internal appointment; it does not establish the absence of a right to enquire. An independent press organisation does not become unable to request a fact because the subject of its reporting has not accredited it. An advocate does not need the recordkeeper’s endorsement before inviting a person to check the recordkeeper’s entry. Formal appointment matters if the question is who can certify an election, compel evidence, operate the registry or bind the company.

It is not the source of legitimacy for asking two voluntary factual questions.

This distinction keeps both organisations inside their proper boundaries. NRS may advocate, research, convene and represent members who expressly authorise it. It is not AFRINIC; it does not operate the registry, RPKI, WHOIS or RDAP; it is not an election administrator, appeals body, court, settlement forum, custodian of the official record or continuity provider. Its enquiry could generate evidence but could not certify a result. AFRINIC, meanwhile, operates the ledger and company systems, but ledger custody does not make it a regulator of every conversation about the ledger.

What was actually asked, and what was not

Both sides’ public accounts fix the core questionnaire at two points: did the recipient register to vote, and did the recipient cast a ballot? NRS said it did not seek a legal view or comment on court proceedings. The questions, on the sealed record, did not seek the candidate selected. They did not request the identity documents, facial image, signed delegation, organisational identifiers, email address or telephone number that AFRINIC’s election process itself handled. The full original outbound message, its headers, footer, links and attachments were not located, so no broader claim should be made about every element of the communication.

The agreed two-question scope is nevertheless unusually clear.

The difference between whether a ballot existed and how it was marked is fundamental. The latter belongs to ballot secrecy. The former is a participation fact that can be checked without revealing political preference. A well-designed election audit must be able to distinguish eligibility, executive authorisation, registration, identity verification, ballot issuance, ballot casting, system custody and candidate choice. Treating all those layers as one undifferentiated category of “voting information” makes a protected secret swallow the surrounding audit trail.

That does not mean a reply is automatically harmless. Even a yes-or-no response becomes personal data when it is attached to a named person or account. Its collection requires a stated purpose, a lawful basis where applicable, reasonable security, limited retention and a way to object. A response might also be wrongly interpreted as speaking for the member company when the individual intended only to report personal conduct. But those are design requirements. They call for separation, notices and limits, not a rule that independent verification is permissible only after AFRINIC approves the verifier.

The public record leaves important gaps about NRS’s implementation. It does not disclose the full address-source ledger or recipient-selection method. It does not establish the controller jurisdiction for this exercise, a documented lawful-basis analysis, the complete processing notice, the retention period, storage controls, cross-border safeguards, complaint handling or the mechanics of the promised identity protection.

AFRINIC alleged repeated unsolicited communications and member frustration, but the sealed record contains no per-recipient delivery count, sending dates, complaint ledger, bounce record or evidence of messages continuing after an objection. Without those particulars, neither blanket exoneration nor a finding of unlawful spam is justified.

The correct conclusion is deliberately narrower. NRS’s purpose and two-question scope had accountability value. NRS publicly promised to protect identities and pass concerns through lawful channels. It still bore responsibility for every part of its own data processing. Recipients remained free to decline. A person’s freedom to decline, however, is different from an institution asserting that a reply should depend on its sanction.

A public record with several distinct denominators

The enquiry did not arise in a numerical vacuum. AFRINIC’s final register displayed 581 numbered designated-voter entries. Its published statistics showed 548 completed biometric registrations and 33 incomplete registrations. It recorded 484 ballots as cast by 12 September 2025. Those figures yield an incomplete-biometric share of 5.68 per cent. They also produce 64 completed-biometric registrants without a recorded ballot, or 11.68 per cent of completed registrations. The 484 ballots equal 83.30 per cent of all listed voters and 88.32 per cent of completed biometric registrations.

These calculations describe AFRINIC’s aggregates; they do not diagnose them. A completed biometric step does not independently prove a valid executive designation. The absence of a recorded ballot does not prove exclusion, error or misconduct. The public snapshot does not explain the reasons for each incomplete registration or non-casting record, and it is not established that every status field shared exactly the same cutoff. Nor is 83.30 per cent a turnout rate for all AFRINIC members. It is simply ballots divided by the 581 entries in the published register.

The distinctions are precisely why first-person verification has value. An individual can say whether that individual completed a particular action. A member executive can verify whether the company issued a designation. The platform can account for credential and ballot events. AFRINIC can account for its register and processing. An independent reviewer can compare the layers without assuming that any one of them is conclusive. The purpose is reconciliation, not accusation.

The public election design had already acknowledged part of this logic. AFRINIC announced a provisional public register so Resource Members could verify details and raise objections. The final-register page said four late executive confirmations were added, leaving 577 entries before those additions, and that no new application was accepted after 26 August. AFRINIC also said no discrepancy reports had been received during the provisional stage by the publication time. Those institutional statements show that verification and correction were contemplated controls. They do not prove that later evidence was impossible or irrelevant.

Another public control remained incomplete in the located record. Article 9.1 of the election guidelines required the Nomination Committee chair to announce the total votes for every candidate. The result message named eight successful candidates but displayed no candidate-by-candidate totals. The absence does not establish an incorrect result; the totals may exist in an artifact outside the sealed record. It does mean that one required public reconciliation element was not available in the located announcement.

The aggregate figure of 484 cannot substitute for candidate totals, just as candidate totals could not substitute for proof of individual authorisation.

Official publication proves institutional conduct, not every contested premise

AFRINIC’s statement is strong primary evidence of what AFRINIC said and asked people to do. It proves that the page characterised the September election as court-mandated, supervised, fully transparent and subject to continuing litigation. It proves that AFRINIC invoked privacy, lack of mandate, alleged spam and possible contempt or prejudice. It does not, simply by being official, prove that every message was repeated, that the messages were legally spam in every recipient’s jurisdiction, that an answer could amount to contempt, or that a named court order prohibited the two factual responses.

The distinction between publication and adjudication is especially important when official language carries the aura of law. AFRINIC referred generally to jurisdictions in its service region where unsolicited bulk email may be prohibited, but the statement named no country, statute, message classification, recipient, applicable consent rule or adjudicated violation. Communications rules can turn on jurisdiction, commercial character, recipient status, frequency, prior relationship, notice and conduct after an objection. The package cannot resolve those facts because the necessary records are absent.

The same discipline applies to the phrase “under litigation.” A matter being before a court can justify caution about evidence preservation and claims that might prejudice proceedings. It does not make every independent factual question contemptuous. Courts decide contempt within the scope of applicable law and orders. The located 5 September order directed the Receiver to proceed with the 12 September election in the presence of the Electoral Commissioner, who would oversee and supervise the process with the stated aim of a free and fair election in AFRINIC’s and members’ best interests.

No located text in that order addresses the December enquiry or prohibits a voter from confirming registration or participation.

AFRINIC’s own court-case table, last modified on 8 April 2026, continued to list the appeal from the September election order, election-related contempt proceedings and the Receiver-discharge application as ongoing. That is AFRINIC’s published status record, not an independently refreshed court docket and not a final holding. It prevents a writer from treating the litigation as concluded in either direction. A later court judgment could change the status of the election or Board without retroactively turning AFRINIC into a sovereign authority over voluntary speech.

Board power, Receiver power and the missing bridge

AFRINIC’s page ended by attributing the statement to the Board of Directors and the Receiver. That is evidence of institutional attribution. It is not the same thing as a visible chain of authority.

Under the cited corporate framework, a validly acting Board can direct and supervise the company’s business and affairs, subject to the Companies Act and AFRINIC’s constitution. The Bylaws give the Board broad management and delegation powers. They also require a quorum: a majority of directors and not fewer than five. The public statement contained no resolution, meeting date, attendance list, vote, minutes, conflict record, quorum evidence or named signatory. Undisclosed internal records may exist, so the correct finding is a public accountability gap, not proof that the Board failed to act.

Receiver power is similarly bounded. The Mauritius insolvency framework ties a receiver’s powers to those expressly or impliedly conferred by the instrument or court order, subject to the relevant limits. AFRINIC communications described the Receiver as continuing to support the transition pending formal discharge. But the package does not contain the appointing instrument provision or later court direction that specifically authorised the December non-response instruction. The September election order concerns conducting and supervising the election; its located scope does not itself supply a general communications mandate.

Corporate and receivership authority therefore support a limited proposition: the institution and its officers could issue advice about company systems, privacy and litigation risk if acting properly within their powers. They do not support a leap from internal authority to public jurisdiction. The Board cannot decide a recipient’s criminal or regulatory liability merely by describing conduct as potentially illegal. The Receiver does not acquire general speech-control power from proximity to the court. Neither can punish contempt; that belongs to a competent court.

No AFRINIC rule or remedy authorising punishment of a member for answering the two questions appears in the record.

This is the private-bookkeeper boundary. AFRINIC’s role is important because its records coordinate scarce number resources and its services are operationally consequential. It has practical leverage. Yet practical dependence is not sovereignty. A private ledger can be indispensable without becoming legislation. A Board election can authorise directors to perform corporate functions without transforming them into public rulers. Court supervision can validate or constrain specified acts without turning the supervised company into an arm of general state authority.

The more dependent members are on the recordkeeper, the more carefully that boundary must be expressed. Advice from an indispensable registry may be experienced as more than casual guidance even when no formal sanction is available. That asymmetry heightens the duty to identify the precise authority, evidence and remedy behind a warning. It does not justify assuming coercion where none is proved; it explains why vague court-adjacent and illegality language can chill correction.

The principal, the designated voter and the fact witness

The September guidelines required one natural-person voter directly authorised by a member executive and prohibited proxy and Power of Attorney voting for that election. AFRINIC’s general-meeting Bylaws, by contrast, recognise written proxy and authority instruments in their own context. That textual tension is not resolved in this package, and it should not be converted into a judgment on the election rules. It does illuminate a vital distinction: every role is instrument-specific.

The member legal entity is the principal for corporate electoral authorisation. The designated voter receives a narrow authority to cast a vote under the election process. The designation does not automatically make that person the company’s general spokesperson, lawyer or attorney. A database contact, mailing-list participant or meeting attendee likewise gains no corporate mandate merely by appearing in a process.

At the same time, lack of general corporate authority does not erase first-person knowledge. A person can accurately say, “I registered” or “I did not cast a ballot,” without claiming to bind the company on the validity of the election or on pending litigation. A careful verification system would record the answer as an individual account, then separately seek the executive designation or company confirmation needed for a corporate conclusion.

Collapsing those layers produces error in both directions: it can overstate a personal reply as company policy, or suppress a useful factual correction because the speaker lacks a general Power of Attorney.

This is also why “community” cannot do the analytical work. Attendance, stakeholder language and repeated participation do not create a sovereign constituency or a blanket mandate. Formal member votes authorise directors within company law and the constitution. They do not authorise the institution to convert coordination into general jurisdiction. Conversely, an advocate cannot claim to represent every resource holder because some people participate in its work. NRS’s defensible role is narrower: advocacy, research, convening and representation of expressly authorised members, alongside independent fact gathering from willing respondents.

The privacy case AFRINIC was entitled to make

The strongest case for AFRINIC’s intervention should be stated without dilution. Its election system processed sensitive and potentially harmful material: names, contact information, organisational roles, government identification, facial images, delegation letters and organisation identifiers. Its published privacy notice identified transparent and auditable elections as a purpose and described access, correction, deletion or restriction, objection and complaint rights. Mauritius data law sets principles of lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, retention control, security and accountability.

It also addresses collection notices, lawful bases, transfer safeguards and limits on incompatible disclosure.

Against that background, AFRINIC faced active proceedings and said it had received complaints about unsolicited contact. The original NRS email is missing. The public NRS response does not set out the complete controller and processing protocol. A public name in a voter register is not unlimited consent to be contacted, profiled or exposed. A cautious institution could reasonably tell recipients to verify the sender, avoid disclosing identity documents or confidential material, assess any company duty, and wait for a clear statement of purpose, legal basis, retention, security, opt-out and escalation.

If the raw outreach had requested government identification, facial data, passwords, candidate choice or full company files, a non-response recommendation could have been proportionate. If messages continued after an explicit objection, a recipient-specific data or communications complaint might have been well founded. If a named order prohibited the enquiry, the contempt warning would become a reviewable legal instruction. If AFRINIC had offered a trusted independent channel under a published privacy protocol, it could reasonably have directed respondents there instead of to the original sender.

None of those conditions is established on the sealed record. The public question set was narrow. AFRINIC did not identify the specific order, law, jurisdiction, complaint evidence or alternative reconciliation procedure on which the blanket instruction depended. Its legitimate controller duty over its own systems did not confer ownership of facts known independently by individuals. The strongest privacy case therefore supports a targeted safety notice and an improved verification channel. It does not support making AFRINIC endorsement the condition of legitimate enquiry.

The evidence value of an independent channel

BTW later reported that it reviewed protected reply correspondence and found several first-person accounts that did not align with apparent registration or participation entries. That finding must remain within its boundary. The exact denominator, identities, coding ledger and duplication controls were not published. The causes of the reported differences are unknown. They could not, on this record, establish fraud, ballot substitution, responsibility, outcome effect or election invalidity. No individual case should be reconstructed here.

The significance is more limited and more durable: the channel produced material evidence that merited reconciliation. That fact makes the 15 December instruction consequential. An independent enquiry need not deliver a verdict to perform an accountability function. It can identify which records need comparison, which principals need to confirm authority, and which system events need an audit trail. A discrepancy is the beginning of verification, not its conclusion.

Institutional correction is strongest when it does not depend on trusting one participant’s database as the final answer to a question about that database. AFRINIC could provide its records. Member executives could verify designations. Individuals could attest to their own actions. The platform and election bodies could provide technical and procedural artifacts. An independent custodian could compare those sources while protecting identities. Each layer would check the others. No single reply would control the outcome, and no single institution would possess a veto over the inquiry.

That approach is consistent with data protection rather than hostile to it. Accuracy and correction are data-protection values too. A person whose name or status appears in a public election record has an interest in correcting an inaccurate entry. AFRINIC’s privacy notice recognised access, correction and objection rights. Protecting those rights requires a usable route for a data subject to raise a conflict. A warning that deters the person from communicating the conflict, without providing an independent substitute, protects custody at the expense of accuracy.

A proportionate verification design

A workable design starts by refusing the false choice between unrestricted outreach and institutional silence. It can preserve the evidentiary value of first-person facts while reducing collection, exposure and pressure.

First, the verifier should publish a complete notice before collecting answers. It should identify the controller, applicable jurisdiction, purpose, lawful basis, source of contact details, intended recipients, retention period, cross-border conditions, security model, right to object, deletion route and complaint channel. The message should be one-time by default, make participation voluntary, and stop follow-up after an opt-out. Sender authentication and a separately verifiable public page would reduce impersonation and phishing risk.

Second, the questionnaire should stay minimal. Registration and ballot participation should be separate fields. It should not request candidate choice, identity documents, facial images, passwords or copies of confidential company records. It should state that a personal answer records personal knowledge and does not represent the member organisation unless the respondent supplies separate authority. The verifier should not collect more attributes merely because more could be useful.

Third, identity should be separated from analytical results. A trusted independent custodian could verify the respondent and preserve evidence under access controls. The working dataset could use pseudonymous case identifiers. Analysts could see the claimed status and comparison result without receiving the person’s raw identifying materials. Any escalation should follow a defined threshold and lawful channel, with the respondent told who will receive what.

Fourth, the reconciliation should compare distinct ledgers rather than force a binary verdict from one source. The 581 register, 548 completed-biometric records and 484 ballots should be matched to executive designations, registration events, platform receipts and correction records under controlled access. The exercise should record timing and provenance. It should also publish the candidate totals required by the guideline if those totals are available and lawfully releasable. A missing or mismatched item should enter review, not be labelled misconduct.

Fifth, every affected person and member principal should have correction and appeal. AFRINIC should be able to contest a proposed finding with system evidence. NRS should be able to explain its collection and coding. The individual should be able to correct or withdraw a statement subject to legitimate evidence-preservation needs. The member organisation should be able to distinguish a personal act from a corporate authorisation. A neutral reviewer should decide disputed classifications under a published method.

Finally, the public report should be aggregate and bounded. It should state how many records were eligible for comparison, how many were verified, unresolved or excluded, and why, without publishing identities or inviting speculation. It should disclose limitations, dates and custody rules. It should not proclaim fraud, assign motive or declare the election valid or invalid unless a competent process supports that conclusion. Raw evidence should be retained only as long as the published protocol and applicable law require.

This is not a proposal to give NRS the functions of AFRINIC, a court or an election authority. NRS could commission, advocate for or participate in such an exercise only within its charter and the authority expressly granted by participating members. The independent custodian and reviewer must have separate, published mandates. AFRINIC’s cooperation would materially improve the audit, but its sanction should not be the legal source of a person’s freedom to provide a voluntary fact.

Why the distinction matters to operators

Registry governance can seem distant from network operations until uncertainty enters the records on which resource holders rely. LARUS’s operator-focused analysis treats RIR influence as grounded in contracts and recognition rather than sovereignty, while tracing governance instability into access, redesign, transfer, diligence and continuity costs. That does not mean the 15 December statement caused a route outage or resource loss; no such causal evidence is in the package. It means that thinly evidenced authority claims can add risk where the institution’s records already carry practical weight.

AFRINIC’s published 2025 expense tables reported USD 1,043,425 in election costs and USD 877,929 in legal costs, a combined USD 1,921,354. The September election component was USD 111,576: USD 75,000 for the Receiver, USD 19,600 for Voatz, USD 2,900 for KYC, USD 14,046 for a staff token and USD 30 for another listed item. These are AFRINIC’s accounting categories, not an independent audit or a finding of waste. The legal total is not all attributed to the election.

The figures nevertheless establish scale. When a low-data factual reconciliation might clarify records before disputes harden, refusing to design one can be economically material. The costs are not only invoices. Boards, operators and counterparties devote time to legal review, contingency planning and governance diligence when authority is unclear. The package does not quantify harm caused by the statement, and it would be wrong to assign the published costs to it. The defensible point is that unresolved records and prolonged escalation have real cost pathways, while a narrow, secure audit can be comparatively contained.

Operators and resource holders also bear a different incentive from institutional agents. Their customers, uptime, capital and transactions absorb uncertainty directly. Registry personnel, committees and advisers have duties of their own but do not necessarily experience the same balance-sheet effects. That agency gap does not prove bad faith by any director, Receiver or employee. It argues for external checks, clear mandates and evidence that can be reviewed by the people carrying the downside.

What remains unknown

The sealed record is substantial but incomplete. The raw NRS email and delivery history remain unavailable. The source of recipient addresses, selection method, complaint and opt-out records are unresolved. NRS’s controller jurisdiction, complete notice, lawful-basis record, retention, storage, identity-separation and transfer safeguards are not public in the located material. Those gaps prevent a definitive judgment on its full processing compliance.

The internal chain for AFRINIC’s statement is also incomplete. No Board resolution, quorum record, minutes or legal advice was published with it. No specific Receiver instrument or court direction addressing the December enquiry was located. No named national anti-spam rule was applied to a named recipient. These absences prevent a conclusion that the joint institutional attribution lacked internal authority, just as they prevent AFRINIC’s public label from being treated as adjudication.

The election record has open elements: candidate-by-candidate totals, signed audit artifacts, a full reconciliation of the register, biometric statuses and ballots, and the explanations for protected member accounts. The latest final court dispositions after AFRINIC’s April 2026 update are outside the package. No measured response-suppression rate, service impact or additional cost caused by the instruction is known. Gaps must remain gaps.

The narrow finding

AFRINIC was entitled—and required—to protect the personal information it controlled. It was entitled to caution members about identity disclosure, uncertain senders and pending proceedings. NRS was not entitled to escape data law merely because its purpose was accountability. It needed a clear, secure and objection-respecting processing design, and no member was obliged to answer.

But AFRINIC went further when it made formal sanction by AFRINIC the rhetorical test for a legitimate response and supported that test with unparticularised spam, illegality and contempt language. A private corporate recordkeeper can manage its systems and speak for itself. It cannot turn institutional dependence into sovereignty, decide legal liability by announcement, or own the first-person facts of members and voters.

The response should not be a contest over which institution deserves unquestioned trust. It should be an auditable allocation of roles. AFRINIC supplies and protects the official records. Member executives confirm corporate designations. Individuals may voluntarily confirm their own actions. NRS advocates, researches and convenes within its limited role. An independent custodian protects identity and compares evidence. Courts and regulators decide legal questions within their jurisdiction. Correction and appeal remain open.

That arrangement protects privacy precisely by preventing any one actor from controlling identity, interpretation and outcome. It protects accountability by allowing a factual record to be checked without exposing a secret ballot. Most importantly, it restores the modest premise on which a registry’s legitimacy depends: the bookkeeper’s record can be important without being beyond independent verification.