Summary

  • Draft 4 of AFPUB-2016-GEN-001 did not change who could trigger an AFRINIC resource review. The random, selected and reported lanes—including an evidence-backed community complaint, staff evaluation and a 24-month limit on another reported-lane review of the same portfolio—came from Draft 3.
  • Draft 4’s recorded revisions were downstream. It narrowed five non-exhaustive indicators to two policy or contractual grounds, changed the handling of a previous holder’s database records from removal to updating, simplified the appeal formulation and replaced named-member compliance reporting with privacy-constrained activity reporting.
  • The inherited gate still mattered because opening a review could impose attention, disclosure, technical work, legal cost and uncertainty before any breach was established. Those burdens became more consequential when connected to possible recovery and registry-record changes.
  • AFRINIC can legitimately verify registry and contractual facts as a private technical coordinator. That role does not confer regulatory, police, confiscatory or judicial power. A defensible system therefore needs objective intake, bounded scope, notice, reasons, cure, independent review and operational continuity.

The puzzle begins with a familiar error in reading institutional documents. A sensitive provision appears in a later draft, so the later draft is credited—or blamed—for creating it. In this case, Draft 4, submitted on 11 April 2017, contains a mechanism through which an AFRINIC member might enter a resource review by random selection, an internal signal, loss of contact, self-request or a community complaint. Yet AFRINIC’s revision history says the fourth draft updated and rephrased sections 3.4, 3.5 and 3.6, not the trigger section 3.3.

The subsequent mailing-list circulation likewise described reformatting and changes to the provisions later numbered 13.4, 13.5 and 13.6.

That discrepancy is not clerical trivia. A review could require a member to collect records, answer technical or contractual questions, expose operationally sensitive information and absorb uncertainty. Its findings could feed into recovery steps, database treatment, an appeal process and public reporting. The opening decision therefore had practical force before anyone had established non-compliance. If the complaint safeguard and repeat-review limit are falsely described as Draft 4 reforms, the wrong consultation receives credit for constraining that force.

More importantly, readers may overlook what Draft 4 really altered: the downstream provisions that made entry through the unchanged gate consequential.

The correct reading also avoids the opposite mistake. Saying that the trigger text was inherited does not make Draft 4 irrelevant. Publication of a later draft republishes an operative architecture as a proposed whole. It asks the community to consider a gate and the consequences attached to it together, even where only the consequences have been redrafted. The responsibility of analysis is thus twofold: preserve authorship and chronology at sentence level, then assess the full institutional mechanism at the point when Draft 4 was put forward.

L3 — The trigger redline that Draft 4 did not make

AFRINIC identified the document as AFPUB-2016-GEN-001-DRAFT-04, version 4.0, with Amelina Arnaud, Ilunga Kabwika Serge, Jean-Baptiste Millogo and Wafa Dahmani listed as authors. The archived page records submission on 11 April 2017 and an under-discussion status. Seven days later, the Policy Development Working Group co-chairs circulated the updated proposal to the Resource Policy Discussion list. That sequence establishes publication and discussion. It does not establish adoption, implementation or use against any member.

The most reliable way to determine what the fourth draft changed is to place its text beside Draft 3 and then check the institutional revision notes. Both methods produce the same conclusion. Draft 3 and Draft 4 contain three classes of review: random, selected and reported. In both, random review was confined to named categories—Medium and above, IPv6-only Large and EU-AS members. In both, a selected review could arise from an internal report or a failure of contact between AFRINIC and the member. In both, the reported lane could begin with the member’s own request or with a community complaint that warranted investigation.

The complaint language is especially important because it is easy to mistake presence for novelty. Draft 3 already required a community complaint to be backed by evidence. Draft 3 already placed evaluation of the facts with AFRINIC staff, who would determine whether it was appropriate to conduct a review. Draft 3 already prevented another reported-lane review of the same resource portfolio where a full review had been completed during the preceding 24 months. Draft 4 reproduced those controls. It did not invent them, strengthen them through a new evidential standard or transfer the opening decision to a separate body.

The revision history dates the relevant Draft 3 change to 18 November 2016, when section 3.3.3 was updated after mailing-list discussion. There is a documentary wrinkle: the Draft 3 page labels the proposal version 3.0 but displays a submitted date of 9 August 2016, while its revision history records version 3.0 in November. That inconsistency counsels care with page metadata; it does not alter the textual comparison. On the words that matter, the evidence-backed complaint, staff evaluation and 24-month same-portfolio protection appear in Draft 3 and remain in Draft 4.

This is the central distinction between text present in a draft and text added by that draft. A reader looking only at Draft 4 can accurately say that Draft 4 contained the three lanes and complaint safeguards. The reader cannot accurately say that Draft 4 introduced them. Version discipline supplies the missing verb. Draft 3 added; Draft 4 carried forward. In governance analysis, that verb identifies when a choice was made, which round of scrutiny could have changed it and what later editors elected to leave intact.

The three lanes must themselves be kept distinct. Random selection depended on category, not an allegation. Selected review depended on an internal signal or lack of contact, not a third-party complaint. Reported review included two different origins: the member’s own request and a community complaint. Even inside the complaint path, receiving information, evaluating its evidential support and deciding to open a review were conceptually separate acts. The draft compressed those acts into a short formulation assigning factual evaluation to AFRINIC staff.

It did not identify a distinct intake officer, a separate opening decision-maker, a published decision matrix, an obligation to give opening reasons or a conflict rule.

Those absences matter, but they must not be filled with conjecture. The record does not show how staff would have organised the task in practice because it does not show that Draft 4 was implemented at all. It shows only what the proposed text did and did not specify. Nor does the word “whistleblower”, used when the authors later summarised triggers at AFRINIC-26, rewrite the policy text. The draft spoke of a community complaint. Meeting shorthand may illuminate how participants described a lane; it cannot silently add protections, legal status or a different category to the published instrument.

Against that unchanged entry architecture, Draft 4 made a material downstream redline. Draft 3’s section 3.4 offered a non-exhaustive list of five indicators of non-compliance. They were an unjustified lack of visibility of a resource on the global routing table; breach of AFRINIC policies; breach of the Registration Service Agreement or another legal agreement; an organisation no longer operating without a transfer of its blocks; and unauthorised transfers. The phrase “non-exhaustive” meant that the list did not purport to close the category.

Draft 4’s corresponding provision, renumbered as section 13.4 for insertion into the Consolidated Policy Manual, retained only two enumerated grounds: breach of AFRINIC policies and breach of the Registration Service Agreement or other legal agreements. The other three indicators disappeared as standalone bullets. The difference is substantial. A routing observation, an organisation’s operating status and a suspected transfer could no longer be pointed to as independently enumerated indicators under that list.

The remaining grounds tied an adverse conclusion more directly to an existing policy or agreement, although the strength of that constraint would still depend on identifying the provision allegedly breached and interpreting it within the registry’s proper private role.

The database consequence also changed. Draft 3 said that, after recovery, records of the previous holder would be removed from AFRINIC databases. Draft 4 said that those records would be updated. Updating a ledger is a more intelligible recordkeeping act than erasing the former holder from it. A registry benefits from preserving an accurate account of change, and deletion can destroy useful provenance. Yet the improvement should not be exaggerated. The database clause sat after a recovery path. Better record treatment did not answer who could order an irreversible deprivation, under what mandate, or with what independent control.

Draft 4 retained a three-month period of publication before recovery. It also retained the possibility that recovered resources could later be reassigned under existing allocation and assignment policies. These provisions reveal why the opening gate cannot be assessed as mere administrative housekeeping. A review was connected to a sequence that might culminate in an alteration of registry records and the availability of resources for reassignment. Even if each later step required its own conditions, the prospect of that sequence gave the opening decision leverage over the member from the beginning.

Appeal language was revised too. Draft 3 framed the route around a result that did not appear fair. Draft 4 stated more simply that reviewed members who were not satisfied had a right to appeal. The newer formulation was clearer and less awkward, but the institutional structure remained. Both drafts left the arbitration process with AFRINIC and a pool of knowledgeable community volunteers, and both described the outcome as unequivocal.

Changing the verbal threshold from apparent unfairness to dissatisfaction broadened or simplified access on the page; it did not by itself establish structural independence from the organisation whose review was being challenged.

Reporting moved in a different direction. Draft 3 required an annual report describing reviewed members and their level of compliance. Draft 4 instead required an annual report describing review activities in accordance with the Mauritius Data Protection Act and non-disclosure agreements with members. The change reduced identifiable compliance reporting and expressly recognised privacy constraints. That can protect members from unnecessary reputational exposure. It also reduces the amount of case-specific information available to outsiders.

A well-designed regime must reconcile those values through aggregate reporting, reasoned decisions to affected parties and auditable internal records, rather than treating either publicity or secrecy as an absolute good.

The official Draft 4 history therefore describes a coherent downstream revision: narrower enumerated grounds, different database handling, simpler appeal language and more privacy-conscious activity reporting, accompanied by reformatting and renumbering. It does not describe a new trigger design. Indeed, the embedded staff assessment on the Draft 3 page had already expressed concern about unjustified complaints and workload, treated the complaint threshold as a matter for staff discretion and questioned several recovery and reporting provisions that Draft 4 later changed.

That context helps explain why the downstream redline matters without assigning Draft 4 authorship to earlier safeguards.

The process continued after April. At AFRINIC-26 in June 2017, the authors summarised the triggers as a whistleblower, a request by the member concerned or AFRINIC acting at its discretion. Recorded comments invoked WHOIS correctness, cybersecurity and cooperation between AFRINIC and members in support of review. The co-chairs declared consensus and moved the proposal to last call. Those are significant facts about discussion and progression. Consensus-to-last-call was not ratification, implementation, adjudication or a finding that AFRINIC possessed powers beyond private technical coordination.

On 29 June, during that debate, Lu Heng challenged the notion that wording in the Registration Service Agreement disposed of the policy-governance question. He raised the risk that a court might disagree and that members could face consequential expense, and he warned against turning a registry into an Internet police force. The intervention belongs to the contemporaneous primary record, not to hindsight. Its central distinction remains the right one: a private agreement can organise record services and contractual duties, but it cannot manufacture sovereign authority merely by naming a power.

This leaves a precise verdict on the version puzzle. A title suggesting that Draft 4 revised who could trigger an audit overstates the redline. Draft 4 did no such thing. It presented the inherited gate alongside revised consequences. Correcting the title does not diminish the proposal’s significance. It restores accountability by placing each design choice in the draft that made it and permits a clearer examination of how an unchanged gate interacted with a changed downstream apparatus.