Summary

  • AFRINIC disclosed on 9 March that routes from 102.224.0.0/12, a reserved block of 1,048,576 IPv4 addresses, had appeared in global routing with support from public IRR data.
  • It said ARIN relayed the alert, related IRR entries were removed, key transit providers and the suspected entry creator were contacted, and monitoring was increased.
  • RIPE RIS history independently records several prefixes and origins during February and March. Its current endpoint shows zero of 328 IPv4 peers seeing the /12, while RPKI validation for the AS13560 /12 observation is “unknown,” not “invalid.”
  • AFRINIC did not publish the exact IRR objects, maintainers, affected-prefix list, incident timeline, withdrawal proof or the completed additional safeguard. That is an audit gap, not evidence of complicity or failed containment.

A real registry duty, not an excuse for wider power

There are governance disputes in which the first question is whether a registry should act at all. This is not one of them.

A block marked reserved and unallocated should not be announced by an unrelated network. A false routing-policy object can be consumed by operators that automate IRR-based filters. Once the assertion enters those systems, a record that ought to describe routing authority can help manufacture the appearance of authority. Stopping that failure protects uniqueness, registry accuracy and the security signals on which independent networks rely.

That is the narrow function Heng Lu’s doctrine identifies as legitimate. A registry may maintain a truthful ledger, expose conflict state, prevent fraudulent alterations and keep security assertions intelligible. It does not acquire sovereignty over commercial use, transfers or an entire region merely because it performs those tasks. AFRINIC’s technical response should therefore be judged on technical evidence, not treated as proof of every authority the institution claims elsewhere.

The 9 March notice provides a useful starting record. AFRINIC identified 102.224.0.0/12, said no member held it and described smaller parts appearing in the global routing system. Its current delegated-statistics file marks 1,048,576 addresses beginning at 102.224.0.0 as reserved. This was not a dispute over an allocated member’s lease, customer assignment or transfer. The public fact is an attempt to route unallocated reserved space.

What AFRINIC says it did

AFRINIC attributes the alert chain to ARIN. According to the notice, an operator in the ARIN region found its Autonomous System Number appearing in the announcements without the resource holder’s consent. AFRINIC says its review linked the routes to data placed in a public Internet Routing Registry.

The response had four stated components. AFRINIC requested and obtained removal of the related IRR entries. It contacted key transit providers to stop propagation. It contacted the party it believed had created the entries and requested an immediate end to the announcements. It increased monitoring to confirm full withdrawal.

These are substantive actions. Removing the policy objects attacks one source of automated acceptance; contacting transit providers targets routes already in circulation; monitoring addresses the difference between requesting withdrawal and observing it. AFRINIC also kept the notice in its public news index. The record deserves credit for disclosing both the incident and a response rather than hiding behind a generic claim of stability.

But a statement of action and an auditable incident report are different products. The notice names no IRR database, route object, maintainer, creation time, removal time, origin ASN, exact prefix or transit contact. It gives no first-observed and last-observed timestamp. It says the block remained under containment work and that additional technical and procedural safeguards were being reviewed, but the fixed public packet contains no after-action document closing that promise.

Route history supplies part of the missing clock

RIPE RIS data does not reproduce AFRINIC’s internal investigation, but it makes several routing states visible.

For AS13560, the history records the full 102.224.0.0/12 from 21 February through 7 March 2026. It records 102.224.0.0/13 from 24 February through 10 March and 102.232.0.0/13 from 4 through 10 March. Those dates align closely with AFRINIC’s 9 March disclosure and its statement that withdrawal monitoring continued.

The same history contains two other origins. AS214174 appears for 102.236.0.0/17 on 8 February and again on 21 February. AS3563 appears for 102.224.0.0/13 during one eight-hour interval on 16 March, after the AFRINIC notice. Those records must not be collapsed into a single campaign. The packet does not establish that every origin belonged to the incident AFRINIC investigated, that the named ASN holder created an IRR entry, or that an organisation knowingly authorised the route.

RIPE’s AS overview currently associates AS13560 with a Charter Communications registry entry and AS3563 with Pilot Network Services. It exposes no holder string for AS214174 in the captured response. These are registry labels for observed origin identifiers, not findings of intent or responsibility. A route may contain a party’s ASN without that party’s consent—the precise alert mechanism AFRINIC itself described.

At the 12 August freeze, the RIPE routing-status endpoint reported that zero of 328 RIS IPv4 peers saw the /12. That supports a present withdrawal conclusion at the collector layer. It does not prove that every more-specific route is absent from every network, nor does it reconstruct the route between collectors. RIS is a powerful observation system, not omniscience.

The RPKI state is “unknown”

The captured RPKI-validation response for AS13560 and 102.224.0.0/12 returns “unknown” and lists no validating ROA. That wording matters.

An unknown route is not an RPKI-invalid route. Route Origin Validation distinguishes the absence of covering authorisation from a cryptographic contradiction with an existing authorisation. Reporting the event as though RPKI rejected the route would turn a missing control into a control that did not exist in the observed state.

The standards nevertheless show a relevant design option. RFC 6483 explains that an AS0 ROA attests that the covered prefix and its more specifics should not be used in routing. RFC 6491 says IANA should issue AS0 ROAs for unallocated resources and for reserved resources not intended to be routed. These texts make AS0 a concrete control to examine.

They do not settle AFRINIC’s exact duty here. The /12 sits within address space administered through an RIR, and the fixed packet contains no evidence that AFRINIC had an AS0 ROA, lacked one through error, was legally required to create one, or implemented one after the incident. The responsible question is therefore documentary: did AFRINIC assess an AS0 ROA or another cryptographic protection, and what did it decide?

The control chain crosses institutions

The incident also shows why “the registry” is not a single switch.

An IRR object is a published assertion. A network may use that assertion to generate a prefix filter. A transit provider may then propagate an accepted BGP announcement. RIS collectors may observe it. RPKI validators may classify it as valid, invalid or unknown depending on covering ROAs. Removing one object can interrupt future filter builds, but it does not instantly rewrite every router or prove that all cached configurations have changed.

AFRINIC does not control every public IRR, every mirror, every transit policy or every relying network. That is counterevidence against the simplistic claim that one missing AFRINIC control caused every observed route. It is also why an after-action record should map the dependencies instead of ending at “we contacted providers.”

The minimum public ledger could state the affected prefixes; observed origins with an explicit no-fault warning; the IRR source and object identifiers; creation and deletion timestamps; first and last route observations; whether stale mirrors persisted; the RPKI state; what monitoring surface was used; and which preventive control was implemented. Sensitive contact details could remain redacted without deleting the technical chain.

Security work does not validate unrelated gatekeeping

NRS warns operators that registry control can become a chokepoint for ordinary downstream address use. That concern belongs to disputes about allocated resources, leasing, customer assignments, transfers and adverse enforcement. Applying it mechanically to this event would be a category error. The affected /12 was reserved and unallocated. Preventing an unsupported route from that space is not evidence of an attack on a member’s lawful operation.

The converse error is equally serious. Because AFRINIC performed a valuable technical function, supporters cannot use this incident to validate its current Board, Receiver relationship, transfer restrictions, definition of community or every exercise of policy authority. Technical usefulness proves technical usefulness.

Heng Lu’s continuity doctrine draws exactly this line: preserve the records, publication services, security chain and running networks; do not bundle those necessities with an incumbent institution’s wider discretionary claims. LARUS’s operator-risk analysis adds the practical consequence. A bad registry assertion or weak control is paid for by networks that must diagnose filters, reputation and reachability. The answer is a verifiable ledger, not institutional immunity.

What must close the incident

AFRINIC’s immediate response looks directionally correct on the published facts. It received an alert, investigated an IRR path, obtained removal of entries, contacted relevant networks and monitored withdrawal. Current RIPE collector data is consistent with the /12 no longer being visible.

The unresolved governance question is whether the institution converts those actions into reusable protection. “Reviewing safeguards” is a future tense. A completed control would have a name, scope, activation date, owner, test and measurable result.

Members and operators should be able to ask six bounded questions: Which prefixes and objects were affected? When were they created and removed? Which routes were observed, and when did each disappear? What was the RPKI state? Did mirrors or cached filters extend the exposure? What technical or procedural safeguard is now active?

Answering them would not weaken AFRINIC. It would demonstrate the kind of authority a registry can legitimately earn: not authority over a continent, but trust in an auditable security function.

BTW’s separate research on continuity-preserving transition architecture is linked below for readers who want the wider institutional framework. It is Further reading only, not the source manuscript for this news report and not another news item counted in this bundle.

Sources