Summary

  • AFRINIC's 10 March 2021 breach letter to Cloud Innovation Ltd set off a thirty-month cycle in which each enforcement step narrowed the registry's own room to manoeuvre.
  • A 13 July 2021 urgent injunction, a 23 July 2021 provisional attachment over up to USD 50 million and a 12 September 2023 receivership order successively moved control of the dispute from the registry's board to the Mauritian courts.
  • The evidence reviewed here rests on public institutional releases, statements and secondary reporting; the underlying judgments and letters have not been read directly, so no final merits determination is asserted.

The enforcement machinery became the primary risk to the institution

On 12 September 2023 the Supreme Court of Mauritius ordered AFRINIC, the African Network Information Centre, to be placed under receivership. The court appointed Vasoodayven Virasami as Official Receiver, with a mandate to maintain AFRINIC's assets, oversee elections, facilitate the formation of a proper board and appoint a CEO within six months (AFRINIC news release; Internet Governance Project analysis; NRO statement).

That order is the end of a thirty-month sequence that began as an ordinary contractual enforcement action. On 10 March 2021, AFRINIC wrote to Cloud Innovation Ltd alleging breaches of their Registration Service Agreement (AFRINIC news release; AFRINIC news release; AFRINIC news release). Nineteen days later, on 29 March 2021, the Supreme Court granted Cloud Innovation an interim injunction (MyBroadband report; Wikipedia: AFRINIC).

The notable feature of the case is not who won each application. It is that every escalation step narrowed the registry's own room to manoeuvre. A contractual enforcement action produced urgent injunctions, contempt warnings, a garnishee order over up to USD 50 million and, ultimately, judicial replacement of the registry's governance. The machinery designed to protect registry integrity became the main source of institutional risk.

The subject of this analysis is the official AFRINIC vs Cloud Innovation Ltd dispute timeline: the dated sequence of enforcement, litigation and remedy, examined through prevention, detection, response and the durability of the repair. The evidence base is a set of public institutional releases, statements and secondary reports; the underlying court judgments and letters have not been read directly here, so interim orders are treated as interim and no final merits determination is asserted.

The thirty-month sequence: enforcement, injunction, attachment, receivership

Between March 2021 and September 2023 the dispute generated at least thirteen documented procedural events. Read in order, they show how quickly a registry's member-enforcement authority can be converted into a contest over the registry itself.

On 7 July 2021 a Judge in Chambers set aside the interim injunction granted on 29 March 2021. AFRINIC moved immediately to terminate Cloud Innovation's membership and reclaim its IP resources (AFRINIC news release; AFRINIC news release). The next day, 8 July 2021, AFRINIC's Board passed a resolution to terminate the membership of Cloud Innovation Ltd (AFRINIC news release; AFRINIC news release).

The response was immediate and judicial. On 13 July 2021 Cloud Innovation obtained an urgent injunction restraining and prohibiting AFRINIC from terminating its membership and reclaiming its number resources (Cloud Innovation statement; Cloud Innovation statement). Two days later, after being warned of potential contempt for non-compliance with the 13 July order, AFRINIC reinstated Cloud Innovation's membership; AFRINIC's CEO gave an undertaking to comply with the interim order (AFRINIC news release; AFRINIC news release).

The monetary dimension arrived on 23 July 2021, when Cloud Innovation secured a provisional order of attachment — a garnishee order — allowing it to freeze up to USD 50 million in AFRINIC bank accounts, on claims for damages over the alleged unlawful termination (MyBroadband report; Cloud Innovation statement; Cloud Innovation statement).

The pressure did not stop there. On 27 August 2021 AFRINIC issued another letter indicating its intention to terminate and/or suspend Cloud Innovation's membership as a Resource Member (AFRINIC news release; AFRINIC news release). On 1 December 2021 AFRINIC wrote to Cloud Innovation stating that services provided to it might end by 31 December 2021 (AFRINIC news release; AFRINIC news release).

Three judicial milestones follow. On 14 February 2022 the Appellate Division of the Supreme Court of Mauritius dismissed Cloud Innovation Ltd's appeal against the 7 July 2021 judgment that had set aside the interim injunction (MyBroadband report; AFRINIC news release). On 19 July 2022 the Supreme Court set aside AFRINIC's preliminary objection, stating that Cloud Innovation was not a vexatious litigant and that new circumstances justified further applications (MyBroadband report; Wikipedia: AFRINIC). Then came the receivership order of 12 September 2023 (AFRINIC news release; NRO statement; Internet Governance Project analysis).

Prevention: what constrained the registry before enforcement began

Prevention in a registry context means the controls that stop a membership dispute from becoming an existential one. The record shows four candidate controls, and it shows how each one narrowed rather than widened the registry's options.

The first is the enforcement decision itself. AFRINIC's Registration Service Agreement obligations were enforced through a sequence of escalating measures: an initial letter on 10 March 2021, termination on 8 July 2021, a further termination or suspension notice on 27 August 2021, and a service-end warning on 1 December 2021 (AFRINIC news release; AFRINIC news release; AFRINIC news release). Each step carried a date and a stated intention, but the public record does not show what alternative remedy — suspension with a remediation window, independent review, or a negotiated transition — was offered before the most severe measure was adopted.

The second is the threshold for irreversible action. Termination of membership and reclamation of number resources are not easily undone. By 7 July 2021 AFRINIC was moving to reclaim IP resources within hours of the injunction being set aside (AFRINIC news release; AFRINIC news release). The speed matters: once resources are reclaimed and membership ends, restoring the prior position requires either cooperation or a court order.

The third is procedural sequencing. AFRINIC's Board resolution of 8 July 2021 was passed one day after the injunction was lifted (AFRINIC news release; AFRINIC news release). A one-day interval between a court ruling and a board decision to terminate a member is short enough that the resolution reads as a continuation of the litigation position rather than an independent governance decision. Whether internal review occurred in that interval is not established by the available evidence.

The fourth is the availability of a neutral forum short of litigation. The case moved from registry letter to Supreme Court injunction in nineteen days (AFRINIC news release; MyBroadband report). No documented intermediate step — mediation, an independent adjudicator, or a standing member-dispute panel — appears in the public record before that point.

None of this establishes that AFRINIC acted improperly. The undisputed facts are that AFRINIC alleged breaches, that Cloud Innovation denied the lawfulness of the termination, and that the courts made interim orders on both sides. What the sequence establishes is narrower and more useful: the registry had no visible mechanism that allowed enforcement to pause while a dispute was adjudicated.

Detection: the signals that were available and the ones that were not

Detection asks who saw the escalation coming and what evidence they had. Three signals are documented, each with a different owner.

The first signal was the March 2021 allegation letter. Its content, specificity and evidentiary basis are not reproduced in the public sources reviewed here; what is documented is that AFRINIC considered the Registration Service Agreement breached and said so in writing (AFRINIC news release; AFRINIC news release). A registry that cannot describe the evidentiary basis for an enforcement action in public cannot demonstrate that the action was proportionate.

The second signal was the reaction time of the counterparty. Cloud Innovation obtained its first interim injunction nineteen days after the letter and its second within six days of the membership termination (MyBroadband report; Cloud Innovation statement). That speed is itself a detection event: it told the registry that its counterparty had both the resources and the willingness to litigate each step.

The third signal was the garnishee order. Freezing up to USD 50 million in registry bank accounts on 23 July 2021 converted an operational dispute into a balance-sheet problem (MyBroadband report; Cloud Innovation statement). A registry's financial continuity is the infrastructure of its members' registrations; once that continuity is exposed to litigation risk, the dispute stops being bilateral.

What is not documented is the internal detection architecture. The public record does not establish whether AFRINIC maintained a formal risk register for member litigation, whether the Board received legal exposure estimates before the 8 July resolution, or whether the 27 August and 1 December letters were supported by a fresh assessment of the July events. Those are the questions a registry's own records would answer, and they are outside the evidence available here.

Response: how the remedy was delivered and what it cost

The response phase is the most documented part of the sequence, and the most instructive.

On 15 July 2021, AFRINIC reinstated Cloud Innovation's membership after being warned of potential contempt for non-compliance with the 13 July order, and the CEO gave an undertaking to comply (AFRINIC news release; AFRINIC news release). This is the central control failure in the timeline. A remedy to an enforcement action was delivered only after the enforcement action itself risked being held in contempt. The distinction between a voluntary correction and a compelled one matters for accountability: a registry that reinstates a member because a court requires it has not demonstrated that its own review process would have reached the same conclusion.

The second response was the undertaking itself. A CEO undertaking to a court is a personal and institutional commitment, and it is not the same instrument as a policy change. Nothing in the public record reviewed here establishes that AFRINIC changed its termination procedure, its member-notice requirements or its Board decision sequencing after July 2021. The subsequent letters of 27 August and 1 December 2021 indicate that the enforcement posture continued (AFRINIC news release; AFRINIC news release).

The third response was judicial. The Appellate Division's 14 February 2022 dismissal of Cloud Innovation's appeal restored the 7 July 2021 judgment (MyBroadband report; AFRINIC news release), and the Supreme Court's 19 July 2022 ruling on the preliminary objection kept the dispute alive on the merits (MyBroadband report; Wikipedia: AFRINIC). Both are procedural decisions; neither is a final determination on whether the termination was lawful.

The cost of the response phase is partly quantified. The attachment ceiling of USD 50 million is the only monetary figure established by the evidence in this package (MyBroadband report; Cloud Innovation statement). The cost in governance terms is not quantified but is visible in the outcome: a court concluded that AFRINIC's own governance could not be restored without external supervision.

Remedy durability: receivership as the last control and the open questions it leaves

The 12 September 2023 order appointed Vasoodayven Virasami as Official Receiver and gave him four tasks: maintain AFRINIC's assets, oversee elections, facilitate the formation of a proper board, and appoint a CEO within six months (AFRINIC news release; NRO statement; Internet Governance Project analysis).

Receivership is an unusual remedy for an internet registry. It replaces elected oversight with an appointed officer, which resolves an immediate control problem while creating a new accountability question: who supervises the supervisor, and on what timetable. The six-month CEO appointment window is the only deadline in the order that the evidence quantifies.

The parties' public positions diverged less than the litigation history would suggest. Lu Heng, founder and CEO of Cloud Innovation Ltd, welcomed the judgment appointing an Official Receiver and emphasised the need for stability and elections at AFRINIC on 13 September 2023 (Cloud Innovation statement; AFRINIC news release). A counterparty that spent two years fighting a registry's enforcement describing receivership as a stabilising step suggests the dispute had become a contest over governance rather than over a single membership.

Several questions remain unresolved by this evidence. Whether the six-month CEO appointment window was met, whether the receivership has ended or been extended, and whether AFRINIC's member-enforcement procedures were amended after receivership are all outside the record reviewed here. The Internet Governance Project analysis and the ICANN correspondence in this evidence base address the institutional stakes but do not settle those points (Internet Governance Project analysis; ICANN correspondence).

A registry's ability to terminate a member is part of what makes its registry function credible. The AFRINIC case does not show that the authority was wrongly held. It shows that the authority was exercised without a containment mechanism that could keep an enforcement action from becoming a governance crisis — and that when containment failed, the remedy that followed was judicial replacement of the registry's own board.

What the record establishes and what it does not

The evidence reviewed here supports four conclusions and leaves four open.

Established. The dispute moved from a 10 March 2021 breach letter to a 12 September 2023 receivership order in thirty months (AFRINIC news release; AFRINIC news release). Membership was terminated on 8 July 2021 and reinstated on 15 July 2021 only after a contempt warning (AFRINIC news release; AFRINIC news release). Litigation exposure reached a provisional attachment over up to USD 50 million (MyBroadband report; Cloud Innovation statement). The remedy ultimately imposed was external supervision with a six-month CEO appointment deadline (AFRINIC news release; NRO statement; Internet Governance Project analysis).

Not established. No filing, exhibit or docket number is identified in this evidence. The merits of the underlying breach allegations have not been determined in the material reviewed. The receivership's aftermath is the least documented part of the sequence. And the internal decision record — what AFRINIC's Board assessed before 8 July 2021, and what alternatives it considered — is not in the public sources available here.

For boards and operators in number-resource governance, the practical lesson is not that enforcement authority should be weakened. It is that enforcement authority needs a containment control: a documented, time-bounded step between a member's alleged breach and the irreversible termination of its membership and resources. In this case, the only such step that ultimately existed was a court order.