Summary

  • A joint communiqué published on 13 October 2025 said that the body it described as AFRINIC’s Board was reviewing IP resource allocations and the rights of every Resource Member who had joined since June 2022. It did not publish the reason for that boundary, the review terms, the affected-member count, the standard of proof, interim protections, remedies, or an independent appeal route.
  • AFRINIC has a legitimate thin-ledger function: it may preserve evidence, seek accurate information, identify conflicts, notify an affected member, correct a demonstrable error, and ask an independent court to decide contested rights. A Board, receiver, RSA, policy consensus, human reviewer, or internal appeal cannot convert that function into sovereignty or an unstated power of retrospective punishment.
  • The public delegated statistics expose thousands of post-boundary resource rows, but rows and opaque identifiers are not members. They do not prove admission date, contract identity, routing, fraud, validity, or the size of the reviewed cohort.
  • Any adverse case must be individual, evidence-led, non-retroactive, continuity-preserving, and independently reviewable before AFRINIC alters WHOIS or RDAP visibility, RPKI, reverse DNS, IRR data, transfer recognition, or member services. The public record through 10 August 2026 supports accountability for the review’s design, not a verdict that the cohort is either valid or invalid.

Analysis

The sentence that created a class

On 13 October 2025, a joint communiqué signed in the names of the AFRINIC Board of Directors and the Receiver announced more than an administrative housekeeping exercise. The communiqué said that matters related to IP resource allocations, and the rights of all Resource Members who had joined AFRINIC since June 2022, were under review. It also said that the matter was the subject of ongoing court proceedings and was receiving legal consideration.

That statement proves an institutional act: the review was publicly announced on that date, and its stated reach was defined by membership after a month in 2022. It does not prove the legal validity of the body acting as the Board, the scope of the Receiver’s mandate, the content of any court order, the existence of a breach by any member, or the eventual result of any file. When authority matters, the accurate description remains the purported new Board. When reporting the communiqué’s own words, the accurate formulation is that the communiqué described the body as the Board.

The June boundary matters precisely because the announcement did not explain it. The public words do not resolve whether “since June 2022” means from the first day of the month, after a particular meeting, after a loss of quorum, or some other legal or administrative event. A date may be a sensible way to inventory records created during an unusual period. It may not silently become proof that everyone on one side of the date shares a defect.

This is the first accountability test. A review can begin with a lead. It cannot turn the lead into a presumption of guilt. Membership in a time-defined class says nothing by itself about who submitted accurate information, who paid required fees, which agreement was executed, who processed an application, what actual or apparent authority existed, what resource was deployed, or what customers and counterparties later relied on that deployment. Those are member-specific facts.

The communiqué supplied none of the machinery needed to answer them publicly. It did not publish terms of reference, a cohort list or size, reviewer identities, conflicts safeguards, a schedule, an evidentiary standard, decision categories, notice procedures, interim protection, possible remedies, an appeal body, or a final decision-maker. It said the matter was in ongoing court proceedings but did not identify the relevant proceeding in the paragraph. A later case-list entry concerning an allocation-related dispute cannot be joined to that sentence by inference. A case table is a summary, not the pleadings or an operative order.

The same communiqué said the Receiver had filed an application to terminate the receivership on 8 October 2025, that a court decision was awaited, and that he would continue supporting implementation until formal discharge. A filing is a request, not a discharge order. The statement also announced Finance, Audit, Remuneration, and Legal Committees, with the Legal Committee expected to take stock of ongoing cases. Those announcements describe internal organisation. They do not answer the prior question of what legal source authorises any adverse resource decision.

What an honest review may do

AFRINIC is entitled to know whether the registry information it keeps is unique, accurate, current, and traceable. It may preserve original applications, signed agreements, payment records, allocation logs, staff approvals, contact changes, transfer records, and competing claims. It may ask a Resource Member a reasonable and specific question about identity, authority, use, or an outdated contact where an applicable agreement permits that request. It may give notice of an apparent clerical error and accept a correction. It may keep the earlier entry in an audit history rather than rewriting the past.

It may mark a genuine dispute without pretending the dispute has already been decided.

These are not trivial powers. A clean ledger helps operators find responsible contacts, prevents duplicate recording, supports fraud control, records transfers, and supplies security metadata. Correcting a mistyped range, an obsolete email address, a duplicate row, or a demonstrably unauthorised database entry can protect both the affected member and everyone relying on the registry. If two parties claim the same resource, preserving both claims and freezing conflicting changes can prevent disorder while an independent decision-maker tests the evidence.

The limit is equally concrete. A registry record is evidence of a recorded disposition; it is not authorship of the network’s operational reality. Routes are propagated by networks and accepted by peers. Customers use services. Contracts allocate risks. Engineers create route-origin authorisations and reverse-DNS configurations. Investors and lenders make decisions around scarce resources and the businesses that deploy them. AFRINIC influences those systems through its interfaces, but influence does not become sovereignty merely because interruption would hurt.

That is why ledger correction must remain distinct from retrospective invalidation. Correcting an objectively wrong contact after notice does not entail declaring that a completed admission never existed. Recording a competing claim does not entail erasing the existing holder. Asking for documents does not entail revoking a resource. Investigating authority does not entail terminating membership. A human review does not make the conclusion independent. Moving an appeal to another committee does not make it structurally separate when the same Board commissioned the inquiry and ultimately owns the decision.

The governing sequence is narrow: preserve, specify, notify, disclose enough evidence for an answer, allow response and cure, decide with reasons, and keep an independent stay and review available before irreversible operational effects. If facts remain contested, AFRINIC can seek direction from a competent court. Correction follows proof. Punishment requires separately established authority, process, and a remedy tailored to the individual wrong.

Authority cannot be pooled into a larger power

The review touches several institutions, but their powers do not merge simply because they appear in one communiqué.

A valid AFRINIC Board has genuine corporate management authority. Mauritian company law places management under a Board while subjecting it to the Companies Act and the company’s constitution. The statutory structure makes composition and quorum relevant, and requires powers to be exercised honestly, in good faith, in the company’s best interests, and for the purposes for which they were conferred. It also provides a court route for specified circumstances in which a company has no directors or too few for a quorum. These are meaningful corporate powers and constraints.

They do not make a private membership company sovereign over Internet number resources.

For this review, the corporate receipt must therefore be exact. Who constituted the Board? Was the required quorum acting? What constitution provision and delegation governed the decision? What was the proper purpose? The sealed public record does not adjudicate those questions. The absence of an answer is not a final finding that the Board is invalid. It is a reason not to treat the Board label as self-proving authority for coercive action.

The Receiver’s authority is different. Insolvency law defines a receiver through receivership property and directions in a court order or appointment instrument. The court may terminate or limit a receivership when its purpose has been satisfied or circumstances no longer justify continuation. The exact order therefore controls what this Receiver could preserve, administer, support, or seek from the court. His participation may strengthen continuity and custody of evidence.

It cannot legislate new substantive rights, cleanse a defective corporate act by association, or manufacture a punitive power absent from the order, statute, or a valid agreement.

AFRINIC staff hold another kind of power: operational knowledge and custody. AFRINIC reported that staff maintained WHOIS, RDAP, RPKI, IRR, DNS, and member-support functions through the governance gap. Staff may know who submitted an application, which documents arrived, who approved a step, and what later changed. That evidence can be essential. Yet processing a record does not itself settle whether every corporate authorisation was valid; equally, a later Board cannot convert a question about staff authority into member wrongdoing without proving what the member knew and did.

The Legal Committee may investigate cases, organise evidence, and advise within a valid delegation. Lawyers can improve the quality of reasons and identify where court direction is required. But a committee is not an independent court. Legal involvement does not expand the Board’s jurisdiction, and a lawyer’s review does not cure the conflict created when an institution serves as investigator, claimant, decision-maker, and internal appellate body.

Courts possess binding adjudicative authority within their jurisdiction. That makes the missing order particularly important, not less important. The communiqué’s reference to proceedings cannot substitute for pleadings, evidence, reasons, or relief. The article cannot infer that an unnamed proceeding authorises the cohort review, much less that it authorises revocation. If an order exists, its text, conditions, duration, and review rights must be read rather than enlarged from the single word “review.”

External bodies named by AFRINIC occupy yet another layer. The communiqué credited ICANN, ISOC, the NRO, local authorities, and others with support during AFRINIC’s challenges. That is AFRINIC’s description of assistance. It does not prove that any supporter endorsed this review or an adverse remedy. Support for continuity, elections, or the regional registry system cannot confer title or sanction power that the supporter does not possess. Institutional recognition is not a deed. Silence is not authorisation.

Operators and relying parties finally control or inhabit the running layer. They originate routes, accept reachability, serve customers, validate security information, finance networks, and contract around continued use. Their reliance does not cure fraud or a duplicate claim. It does mean that a remedy designed inside AFRINIC can impose losses on people who neither appointed its Board nor caused an original administrative error. Their exposure must be counted before the institution touches a dependency surface.

The RSA case for review, stated at full strength

The strongest defence of the purported Board’s action begins with the period it inherited. AFRINIC reported that it operated throughout 2023 without a CEO and without a quorate Board, yet it continued adding members and providing registry services. A newly functioning corporate organ could reasonably conclude that it had a duty to understand the decisions made during an exceptional governance and receivership gap. Ignoring questionable records might preserve errors, duplicate claims, preferential treatment, or fraud. It could expose the company, compliant members, and third parties to greater harm later.

The dated 2017 Registration Service Agreement form gives this defence substance. It requires accurate, complete, and updated information; places applications within AFRINIC’s policy-linked discretion; allows reasonable information requests and utilisation review; states use and policy duties; and describes remedies connected to breach. Its termination language includes notice and a 30-day opportunity to show cause or cure. It describes an internal appeal to the AFRINIC Board. AFRINIC’s public Assisted Review description likewise presents review as a means of maintaining accurate, comprehensive, current registry data and checking compliance.

Company law strengthens the administrative case without resolving it. A valid Board cannot manage litigation, financial exposure, and institutional risk intelligently if it is forbidden to inspect records inherited from a governance gap. Duties of good faith and proper purpose can support an inquiry intended to protect legitimate members as well as registry integrity. The communiqué itself paired those aims: it reiterated a commitment to WHOIS integrity and to protecting members’ IP resource rights.

A date boundary can also be efficient. If the institution’s concern arose from a specific period, inventorying records from that period is more practical than searching its entire history. An inventory need not prejudge anyone. Aggregate reporting can expose patterns while keeping member identities and commercially sensitive evidence private. Active litigation can justify withholding privileged analysis. A member’s reliance cannot turn proved fraud into truth, and a running network cannot make duplicate claims coexist safely forever.

This defence establishes why doing nothing is not an acceptable default. A thin registry must be able to examine its own evidence, contact members, isolate conflicts, and correct proven inaccuracies. A Board that refused even to preserve records or investigate credible discrepancies would fail the coordination function that justifies the registry.

Why the strongest defence stops before coercion

The defence supports an inquiry. It does not support a collective adverse inference, an unstated remedy, or a conversion of administrative control into ownership.

First, the agreement must be proved member by member. The public source is a generic form dated 27 November 2017. It records terms AFRINIC claimed in that version, but it does not establish which version every post-June-2022 member actually signed, how the agreement was formed, or which law and facts apply to a particular dispute. Contract power is private, text-bound, and bilateral. It is not public sovereignty, and it cannot be expanded by a later interpretation designed around an institutional crisis.

Second, the agreement’s own process language matters. Notice, a chance to show cause or cure, and a stated remedy structure are not decorative. If AFRINIC invokes the RSA as authority, it must accept the limits and protections in the same instrument. It cannot cite cooperation duties while discarding formation questions, proof, cure, or proportionality. Nor can clause 13’s internal Board appeal provide sufficient independence where the purported Board initiated the review, selects the evidence, and controls the adverse decision. An independent stay must exist before a contested action becomes technically or economically irreversible.

Third, corporate authority is bounded by purpose and source. A Board may investigate company affairs, but management power does not establish title to addresses or AS numbers. The fact that AFRINIC can change a database field does not mean it owns the reality represented by that field. If the RSA denies ordinary property character to number resources while describing a member’s exclusive right of use within justified need, AFRINIC cannot quietly turn that denial into a reversionary property interest for itself.

Fourth, a receiver cannot amplify the power. A preservative mandate can support custody, continuity, and an application for directions. It cannot be stretched into a merits-based sanction unless an exact order says so. Even an express resource-disposition order would have to be applied according to its text, jurisdiction, conditions, and review rights. The Receiver’s signature beside the Board’s does not fill an evidentiary blank.

Fifth, the June line remains an investigative filter. It is not evidence. One member may have supplied false documents; another may have corrected an innocent mistake; another may have been processed under actual or apparent staff authority; another may have a genuinely competing claimant; another may have no defect at all. Fraud proved against one applicant does not contaminate its neighbours in time. Equal treatment means comparable facts receive comparable outcomes, not that different files receive one cohort-wide result.

The proper answer to the steelman is therefore not to stop the review. It is to make the review auditable and narrow. Preserve the records. Publish the legal mandate and process categories. Give each affected member particularised allegations. Apply the agreement and authority record actually relevant to that member. Separate clerical correction, contractual remedy, contested legal relief, and operational execution. Keep services stable while a dispute is decided. Where coercion remains contested, go to an independent adjudicator before imposing it.

The large ledger that cannot name the cohort

The public delegated-statistics ledger illustrates why precise language matters. A calculation on the extended snapshot bearing serial 20260809 counted records dated from 1 July 2022 through that snapshot with allocated or assigned status. It found 2,391 rows: 719 allocated ASN rows, 921 allocated IPv4 rows, 217 assigned IPv4 rows, 429 allocated IPv6 rows, and 105 assigned IPv6 rows. Within that single snapshot, those records were associated with 1,022 distinct opaque identifiers.

These figures describe a public ledger surface. They do not describe 2,391 members, 1,022 members, or any other cohort size. A single member may be represented by multiple resource rows. An opaque identifier may refer to a holder whose membership predates the row, and the format documentation warns that identifiers are not guaranteed to remain stable across file versions. A transferred record may retain an earlier date. A row does not prove when a member joined, which agreement it signed, who approved an application, who beneficially controls the holder, whether a route is currently announced, or whether an allocation is legally valid.

The 1 July starting point is itself only a conservative whole-month implementation of the communiqué’s undefined “since June 2022” wording. It avoids pretending to know the day, but it cannot solve the ambiguity. The calculation is valuable because it shows that the potential administrative surface is substantial. It is dangerous if converted into a people count or a presumption that thousands of records are defective.

AFRINIC’s own annual reporting adds context without closing the gap. It reported 195 new members during the whole of 2022, bringing its total to 2,116, along with 249,596 allocated IPv4 addresses, 135 IPv6 prefixes, and 221 ASNs. Those calendar-year aggregates cannot be split at the June boundary from the reported figures. For 2023, AFRINIC reported 187 new members and 2,290 members in total while also saying that it lacked a CEO and a quorate Board throughout the year. That combination shows continuing institutional activity during a governance gap. It does not prove that any particular admission was authorised or invalid.

Numbers can make an inquiry look determinate before the legal categories exist. The antidote is to keep every quantity attached to its unit. Rows are rows. Opaque identifiers are opaque identifiers in one snapshot. Annual memberships are whole-year self-reports. The review cohort remains undisclosed. No arithmetic may bridge those categories.

How a database dispute reaches a running network

The practical stakes arise from AFRINIC’s position across several consequential interfaces.

WHOIS and RDAP publish registry state, contacts, and status information. A careful correction can improve contactability and trust. Erasing a holder or suppressing a record during a dispute can make the absence look like nonexistence. The safer design preserves history and exposes a non-prejudicial conflict status where needed, without announcing a legal conclusion that has not been reached.

RPKI is more sensitive. Route Origin Authorisations and certificate services influence how networks validate the origin of a route. Withdrawing or refusing that service to force acceptance of a disputed legal theory can cause security and reachability consequences far beyond the original paperwork. An administrative question about authority or a stale document does not automatically justify changing validation signals while the merits remain open.

Reverse DNS can also be operationally important. AFRINIC’s role in administering the parent delegation does not turn it into a lawful collection lever. IRR route objects are likewise used as evidence and operational inputs. Any change should be logged, notified, reversible, and distinct from the final legal merits.

BGP reachability itself comes from network operation and interconnection. AFRINIC does not originate a route merely by listing a prefix, and it cannot make packets forget a working topology by changing a row. Yet registry information shapes filtering, trust, customer diligence, and commercial behaviour. A registry action can therefore injure operational reality without authoring it. That combination—limited constitutive authority but significant practical leverage—is why the review must be restrained.

Transfer recognition and finance reveal the same mechanism economically. IPv4 scarcity makes stable control capital-sensitive. If a date-defined class faces indefinite uncertainty, every associated resource can attract a governance-risk discount, including resources held by members who complied fully. Buyers and lenders may demand deeper diligence or withdraw. Transfers may stall. Insurance and customer negotiations may become harder. Opaque workarounds become more attractive. These effects can start with an announcement, before any formal adverse decision.

The risk is a hold-up problem. Operators have sunk costs in routing, equipment, customer acquisition, security configuration, contracts, and financing. AFRINIC controls interfaces that can affect the value of those investments while it does not bear most of the downstream loss from an erroneous action. If the institution can threaten service or security metadata to secure agreement with its legal conclusion, it gains leverage beyond the authority needed for accurate bookkeeping.

That asymmetry does not mean a record can never be corrected. It means the remedy must distinguish the person responsible for a proved wrong from innocent customers, peers, creditors, and other relying parties. A narrow conflict marker, escrowed change control, preservation order, or tailored court direction often protects registry accuracy with less collateral damage than deregistration, certificate impairment, or categorical transfer freezes.

The minimum individual process

Every member file should begin with a question that can be answered: what exact row or representation is said to be inaccurate? The notice should identify the source record, the alleged discrepancy, the agreement and authority relied upon, and the possible consequence. General suspicion attached to a date is not an allegation.

The evidence stage should preserve the original application, agreement version, payment history, staff action, allocation log, contact changes, and any receiver involvement. It should identify who had actual or apparent authority at the time rather than judging a completed act solely by a later governance arrangement. Disclosure can protect personal information and litigation privilege while still giving the member enough of the case to answer it.

The response stage should permit correction of missing or stale information and provide a reasonable cure period where the applicable agreement does. A clerical error with an otherwise valid authority chain should close through correction and confirmation. A contested claim needs a reasoned decision separating facts, contract interpretation, corporate authority, and proposed remedy.

Continuity must be the default during dispute. Cohort membership alone should never trigger automated revocation, deregistration, service termination, or impairment of RPKI, reverse DNS, IRR, WHOIS or RDAP, portal access, or transfers. Where a genuine competing claim demands protection, AFRINIC can preserve both claims, restrict conflicting registry changes, and seek independent direction without erasing either party.

Before any irreversible effect, the member needs an independent stay and review. An appeal to the same Board is not enough when that Board owns the inquiry. The reviewer must be able to test the Board’s composition and delegation, the Receiver’s order, the applicable RSA, the evidence, the proportionality of relief, and the consequences for third parties. Written reasons must make reversal possible, and technical restoration must be rehearsed and time-bounded in case AFRINIC is wrong.

Different facts require different endpoints. A typo can be fixed. A stale contact can be refreshed. A proven duplicate can be isolated pending adjudication. Fraud attributable to an individual member can support stronger contractual or court relief, but still requires notice, proof, reasons, and a remedy that does not casually punish innocent dependants. A later policy or amended RSA may set future requirements after valid adoption and notice; it cannot retroactively prove a completed act invalid.

What the public record permits us to conclude

Through 10 August 2026, no public terms of reference, cohort register, interim-protection protocol, individual determination, or final report specific to the announced review was located in the sealed public record. Later reporting and the maintained court-case table increase the observable institutional record but do not identify the proceeding linked to the cohort sentence or disclose an outcome. That bounded finding does not prove that private notices, sealed filings, unindexed orders, or unpublished work do not exist.

The uncertainty cuts both ways. The record cannot support a declaration that all post-June-2022 members are valid. It equally cannot support a declaration that any or all are invalid, fraudulent, unauthorised, or revocable. It does not adjudicate the purported Board’s validity or reveal the Receiver’s complete mandate. It does not show that any named external supporter approved this review or any remedy.

What the record does support is an accountability demand. AFRINIC can and should verify that its ledger is accurate. The purported new Board and the Receiver must publish enough to show where the review’s authority begins and ends. Until they do, the June line remains an investigative selection, not a legal verdict. A registry may correct evidence. It may not use control of evidence and security interfaces to create an unexpressed punitive jurisdiction.

The public test is simple to state even if individual files are difficult: identify the exact error; trace the exact authority; protect reliance and operational continuity; separate correction from punishment; and put contested coercion before an independent decision-maker. Anything broader makes the ledger a throne. Anything narrower allows AFRINIC to improve accuracy without pretending it authored the networks that rely on its records.