Summary

  • Resolution 201411.211 applied to information discussed within AFRINIC’s Board, barred disclosure to third parties without approval, said a violation might lead to expulsion as provided by the bylaws, and treated information as public once the Board disclosed it to a third party not under a non-disclosure agreement.
  • The purpose was defensible. Confidentiality can protect candour, privacy, legal advice, security material and negotiations. The problem was the rule’s architecture: it published no subject-matter classes, harm test, duration, exceptions, classification record or distinct process for deciding an allegation before a removal vote.
  • AFRINIC’s members were not passive recipients of a registry service. Under the governing bylaws they elected directors, discussed policy, approved financial statements, received the auditor’s report, considered the annual report, determined general policy and could use a five-per-cent threshold to request a special meeting. Those powers depended on access to meaningful evidence.
  • AFRINIC remained a private bookkeeper and coordinator, not a sovereign regulator or public enforcement authority. A private confidentiality duty could govern handling inside the company, but it could not create new power or make the Board’s own approval the final measure of what members needed to audit delegated authority.

A legitimate concern, expressed as a sweeping rule

The meeting record gives Resolution 201411.211 a concrete setting. AFRINIC’s Board met at the Hennessy Park Hotel in Ebene, Mauritius, for a meeting scheduled from 23 to 25 November 2014. The confidentiality resolution was put to a vote on the first day. It passed with six votes in favour, no votes against and one abstention. The record does not identify the individual voters, the abstaining director or the drafter of the final language. Those absences matter because the resolution should be assessed as an institutional act, not as a vehicle for attributing motives to named people.

The minutes show that the concern was not abstract. Earlier in the meeting, during a different motion, director Aminata A Garba proposed a graduated response to a director who leaked information: a warning on the first occasion and concrete action on a second. That proposal helps establish the Board’s concern, but it was discussion rather than the rule ultimately adopted. The final resolution did not reproduce the proposed warning-first sequence. Treating the discussion and the operative act as interchangeable would give the adopted text procedural safeguards it did not state.

When the meeting resumed, chair Sunday Folayan reiterated that Board discussions should remain confidential. The recorded discussion ranged across audio recordings, photographs of internal documents, a CEO-resignation announcement said to have become known before the official announcement, an internal memo said to have reached the community, and concern that information might pass through conversations with members of the Council of Elders. Andrew Alston discussed recordings, confirmed deletion of certain recordings and suggested an NDA for the Council of Elders.

Legal counsel Ashok Radhakissoon was recorded as advising that Webex recording should be agreed by all members and kept in one place, and that the Board needed to decide between a resolution and an amendment to an NDA.

This context supplies a strong reason to consider a confidentiality instrument. It does not prove that any identified director leaked anything, that a rule had been violated, that an alleged disclosure caused harm, or that any person acted from an improper motive. The minutes preserve claims, concerns and proposed responses. They are not a completed investigation. Nor are they a full written legal opinion. A sound analysis has to hold both propositions at once: the Board had genuine subjects to address, and the public record did not adjudicate the underlying allegations.

Against that background, the resolution established a compact four-part mechanism. First came the protected class: information discussed within the Board. Second came the prohibited act: disclosure to third parties without approval. The Board register specifies “Board approval,” while the minutes use “approval”; the closed record provides no version-control explanation that would justify inventing a hierarchy between them. Third came the consequence: violation “may” lead to expulsion from the Board as provided by the bylaws.

Fourth came a release rule: information disclosed by the Board to a third party not under NDA was no longer confidential and was deemed public.

Each part answers a different question. The first says what falls inside the rule. The second identifies who controls release. The third states what can be at stake for a director. The fourth specifies the act that changes the information’s status. Read together, they did more than ask directors to behave discreetly. They created an information-control system in which the starting category was broad, the gateway was institutional approval, the potential consequence touched Board tenure, and publicity followed the Board’s own disclosure choice.

That is why the exact words matter. A narrowly drawn rule might have protected personal data, privileged legal advice, live security vulnerabilities, tender information or active negotiating positions. Resolution 201411.211 did not publish those categories. A purpose-based rule might have required a reasonable expectation of defined harm from disclosure. The resolution did not publish such a test. A time-limited rule might have protected information while sensitivity remained and then required review or release. The resolution published no duration or declassification schedule.

The subject was instead “Information discussed within the Board.” The location of discussion, rather than the inherent character or continuing sensitivity of the information, supplied the visible boundary.

Breadth on paper does not prove universal withholding in practice. Directors may have released information routinely; informal distinctions may have existed; a separate agreement may have supplied definitions or exceptions. None of those possibilities is established by the available record. The proper criticism is therefore precise. The published rule did not tell members or directors which internal distinctions constrained its broad language. When tenure could be implicated, unpublished boundaries could not perform the same accountability function as a clear public standard.

The protected class: everything that crossed the Board table

The phrase “Information discussed within the Board” is the rule’s centre of gravity. It does not turn on origin. A document need not have been created by the Board. It does not turn on content. The information need not be personal, privileged, commercially sensitive or security-critical. It does not turn on consequence. Disclosure need not threaten a defined harm. On the published wording, the fact of discussion within the Board is what brings information within the protected class.

That design has an institutional attraction. It is simple. Directors do not have to make difficult classifications while a meeting is under way, and a person considering disclosure does not have to predict whether a particular fragment will later be judged sensitive. A bright starting rule can reduce accidental leaks, selective briefing and arguments over whether an unfinished discussion was “official.” It can also reassure directors that tentative views will not immediately be placed in public, allowing them to test proposals, change their minds and challenge colleagues.

But administrative simplicity shifts risk. The broader the initial category, the more important the exceptions, expiry rules and review mechanisms become. Without them, the rule can cover routine operational information, evidence of decision quality, records relevant to financial supervision, and material needed to understand policy choices in exactly the same grammatical way that it covers private personnel data or legal advice. The rule does not state that all such information was in fact withheld. It does mean that the published language did not distinguish them.

This distinction between a rule’s capacity and its documented application is essential. There is no evidence here that a particular member asked for a specific record in 2014 and was refused because of Resolution 201411.211. There is no established inspection dispute, enforcement decision or judicial ruling. Yet governance instruments can be evaluated before a documented injury. A rule governing the flow of evidence changes the conditions under which accountability operates.

Members deciding whether to ask a question, directors deciding whether to answer it and insiders deciding whether protected reporting is safe all respond to the visible scope and possible consequence.

The problem is especially acute when the protected class is defined by institutional contact. Information does not acquire a different factual nature merely because directors discussed it. A financial figure remains a financial figure. Evidence about service performance remains evidence about service performance. A policy option remains a policy option. Some of those things may deserve temporary protection for specific reasons, but the reason should do the analytical work. “The Board discussed it” identifies a place in the organisation, not the harm that secrecy prevents.

The resolution’s own release clause reinforces this point. If the Board disclosed information to a third party who was not under NDA, the information ceased to be confidential and was deemed public. Its status could therefore change without the content changing at all. A security fact did not become less security-sensitive by crossing that line; a harmless operational fact did not become more harmless. The change followed an institutional act of disclosure. That feature makes the rule legible as a control over authorised circulation rather than a taxonomy of inherently secret information.

The approval gate: the agent controlled the evidence about the agent

The official Board register says disclosure to third parties required Board approval. The minutes use the shorter phrase “without approval.” It would be wrong to invent a formal version hierarchy, an approval form, a voting threshold or a delegation practice that the record does not provide. The safest conclusion is the one common to both: disclosure depended on approval, with the register expressly locating that approval in the Board.

Approval is a normal component of confidentiality. Someone must be able to release a document, brief an auditor or determine that sensitivity has passed. The difficult question is institutional location. AFRINIC’s members delegated governance functions to directors and retained rights through which they could evaluate those directors. If the Board alone controlled the release of all information discussed within it, the body being assessed also controlled the evidence available for the assessment.

That is not proof that the Board always chose opacity. It is a structural conflict, not an allegation about individual conduct. Even conscientious directors can face competing incentives. They may sincerely regard criticism as based on incomplete information while simultaneously treating the fuller information as confidential. They may believe unity is vital while members need to see disagreement to assess judgment. They may understand an unfinished deliberation as fragile while members see the same material as essential to deciding whether a policy was responsibly developed.

A rule should anticipate those tensions rather than assume that the approval-holder’s good faith eliminates them.

In a principal-agent relationship, information is the medium through which authorisation remains answerable. Elections alone are not enough. A principal who can replace an agent but cannot learn what the agent did has a formal power with a weakened factual basis. The same is true of policy discussion, financial approval and meeting rights. Each can exist in a bylaw while becoming harder to use intelligently if the relevant evidence is categorically placed behind the agent’s permission.

The approval gate therefore required counterweights. A written reason could have explained why a class of information was protected. A named custodian could have made responsibility traceable. An expiry date could have prevented temporary sensitivity from becoming indefinite. A member-rights exception could have ensured that information necessary for a constitutional decision reached members in a suitably protected or summarised form. An independent review route could have tested refusals without requiring immediate public disclosure. None of these controls appears in the published resolution or accompanying minutes.

Again, absence from those public records does not prove that no private practice existed. It proves something narrower but still important: neither a director considering disclosure nor a member trying to understand the rule could find those safeguards in the instrument that announced the duty and the possible consequence. Where a rule touches who may remain a director, public incompleteness is itself a governance fact.