Summary

  • AFRINIC’s Board approved consent by email on 28 September 2016 for ICANN to subcontract the IANA Numbering Services to PTI, the subcontract recited written RIR consent on 30 September, and the Board unanimously ratified Resolution 201609.300 on 12 October. Those are distinct recorded steps, not interchangeable dates.
  • The substitution did not replace the contractual obligor. PTI performed the operational work, while ICANN remained the Operator under the five-RIR service-level agreement, retained full liability and could step in if PTI failed to perform an obligation.
  • The real continuity architecture lay in measurable service duties, reports, security, public registry data, dispute procedures and successor handoff. It created no sovereignty or regulatory power for AFRINIC, the RIR collective, ICANN or PTI.

Consent changed the performer, not the obligor

Resolution 201609.300 is easy to overread because it sits at the intersection of institutions that often describe themselves in the language of community, stewardship and global coordination. The resolution itself was narrower. AFRINIC’s 2016 Board record says that clause 15.9 of the IANA Numbering Services service-level agreement required ICANN to obtain consent before subcontracting. It records ICANN’s wish to subcontract those services to Public Technical Identifiers, or PTI. It then records the Board’s consent and its authorisation for AFRINIC’s chief executive to sign that consent.

The act was corporate approval within a private contract chain. It was not an award of public power, an ownership transfer or a declaration that AFRINIC could command the numbering system.

The chronology makes the narrowness clearer. According to the Board record, the resolution was approved by email on 28 September 2016. The ICANN–PTI subcontract, dated 30 September, recites that the regional Internet registries had given prior written consent. AFRINIC’s Board then unanimously ratified the resolution at its meeting of 12 October. The September number in Resolution 201609.300 therefore belongs with the email approval, while the October meeting supplies the recorded ratification.

Treating all three references as one ceremonial date would flatten a sequence that matters: internal approval, written consent as recited by the subcontract, and later formal ratification were related but distinct steps.

The public material does not include a signed copy of AFRINIC’s individual consent instrument. That absence places a firm limit on what can be said about its exact wording, the date on which it was signed or any conditions it may have contained. The Board page proves what the Board recorded and authorised. The subcontract proves that the RIRs’ prior written consent was recited in the agreement between ICANN and PTI. Neither document licenses an invented clause or a claim that AFRINIC imposed special terms. Care with this gap is not pedantry.

A study of contractual accountability fails at the outset if it fills a missing contract with institutional assumptions.

The underlying service-level agreement had been signed on 29 June 2016. It named ICANN as the Operator and joined it to the five regional Internet registries, one of them AFRINIC Ltd. Its subject was administrative and technical service, not jurisdiction over people or title to resources. The covered work included maintenance of the IPv4, IPv6 and autonomous-system-number registries; allocations to RIRs; treatment of returned resources; and associated administration for reverse DNS. The Number Resource Organization likewise describes these IANA activities as administrative tasks essential to coordination.

That description is useful for the nature of the work, but any broader institutional account of representation must remain attributed rather than accepted as proof that participation created a public mandate.

This distinction between an important service and governmental authority is foundational. Number registries are indispensable to coordination because operators need consistent records and dependable administrative execution. Indispensability does not convert the administrator into a sovereign. A contract governing registry maintenance says who must do defined work, to what standard, for whom and under what remedy structure. It does not grant a power to legislate, police, adjudicate, punish or confiscate.

AFRINIC’s participation as one contractual party therefore mattered to the service relationship without making the organisation a regulator or source of public-law title.

Article 15.9 of the signed SLA supplied the substitution control. ICANN could not subcontract or delegate the services without the RIRs’ prior written consent. The point of such a clause is not to make the customer the owner of the subcontractor. It is to prevent the named obligor from quietly moving critical work to an unknown or unacceptable performer while leaving the other parties to discover the change after the fact. Consent makes the change visible and conditioned on agreement before performance moves.

In a service whose output is a shared registry and whose failures can propagate operational uncertainty, that advance control has practical value.

Just as important, the same article closed the obvious escape route. Article 15.9.2 says that subcontracting neither releases nor diminishes ICANN’s obligations and that ICANN remains fully liable to the RIRs. This allocation separates the entity doing the work from the entity answerable under the main agreement. PTI could become the performer without requiring each RIR to reconstruct its rights against an affiliate with which it had no equivalent SLA. If registry maintenance slowed, reports disappeared or another covered duty went unmet, the contractual line still ran to ICANN as Operator.

The 30 September subcontract reflected that arrangement rather than replacing it. It recited the RIRs’ prior written consent and assigned PTI the operational performance ICANN needed in order to discharge its SLA obligations. At the same time, it preserved ICANN’s full liability and allowed ICANN to perform an obligation itself if PTI did not. PTI’s procedures and methods were also subject to prior ICANN approval. The affiliate received a bounded performance role inside a chain of responsibility; it did not receive freestanding authority over the RIRs, resource holders or the public.

That bounded role answers one of the simplest but most consequential questions in institutional design: when the organisation whose staff and systems execute a service changes, who receives the complaint and bears the obligation? The answer here was deliberately asymmetric. PTI did the operational work. ICANN remained the contracted Operator. ICANN also retained a step-in path. This was not merely a corporate-family diagram in which two connected boxes could be treated as interchangeable. The documents allocated different roles to the two entities and made the distinction legally meaningful.

AFRINIC’s consent must also be placed within the collective structure of the SLA. The RIR parties’ relevant rights and powers were collective and, for the pertinent contractual actions, unanimous. AFRINIC supplied one component of the five-RIR consent mechanism. It did not act alone for the other registries and did not issue a unilateral order to PTI. That limitation is central to an accurate account of Resolution 201609.300. The resolution showed AFRINIC participating in a negotiated customer-side control. It did not show AFRINIC exercising jurisdiction over a global function.

Collective consent can be slower than unilateral discretion, but here slowness was not necessarily a defect. Requiring all five RIR parties to accept substitution forced a proposed change in performer into a shared decision. Each RIR’s position mattered to the completion of the contractual step. The mechanism therefore protected against an Operator treating one region’s acceptance as enough for everyone. Yet unanimity still remained a private allocation of decision rights among named parties.

It cannot be transmuted into evidence that those organisations possessed the political consent of every network operator or resource holder in their regions.

PTI’s corporate timing supplies additional context without changing the legal analysis. PTI was incorporated in August 2016 as an ICANN affiliate and began performing IANA functions in October through contracts and subcontracts. Organisational separation was part of the transition’s implementation, but incorporation alone did not answer who remained liable for numbering performance. The subcontract did. Its importance lies precisely in the fact that a new legal person entered the operating chain while the SLA counterparty stayed put.

The strongest benign account begins here. A specialist affiliate could give the IANA functions a more distinct operational home without forcing a disruptive replacement of established customer agreements. A separate performer could concentrate systems, personnel and procedures around the relevant work. Prior RIR consent could control the substitution. Retained ICANN liability could prevent the affiliate boundary from becoming a counterparty gap. ICANN’s approval of PTI’s documented procedures, together with its right to step in, could make operational separation compatible with accountable continuity.

On that reading, Resolution 201609.300 was not bureaucratic decoration. It completed one necessary link in a carefully sequenced handoff. The Board acknowledged the contractual prerequisite, approved consent and authorised signature. The collective RIR mechanism then supplied the consent recited in the subcontract. PTI could perform. ICANN continued to answer. Nothing about this required the fiction that one institution embodied the entire service or possessed an unchallengeable mandate. The arrangement’s strength came from separated roles that were joined by explicit obligations.

The critical account begins from the same separation. An affiliate boundary can make responsibility harder to see. Users may encounter PTI branding, PTI staff, PTI systems or PTI reports and reasonably conclude that PTI is the party against which every right runs. A parent or affiliate may point back to the performer when a technical fault occurs, while the performer may point to the parent when contractual remedies are raised. Unless reports, incident routes, escalation, cure obligations and transition rights visibly follow the written chain, corporate specialisation can become accountability diffusion.

The available AFRINIC record does not tell us whether its signed consent added conditions designed to counter that risk. It also does not establish that anyone objected to the arrangement, that consent was coerced, that the subcontract was unlawful, or that the handoff caused an outage or other harm. A strong critique need not manufacture a scandal. It can ask whether the architecture makes responsibility legible under stress, then test that question against the duties that the agreements actually preserve.

That test points away from institutional slogans and toward the service specification. “Stewardship” may express a desired ethos, but it does not by itself tell an operator how fast a request should move, which entity must provide a status update, what happens after non-performance, where registry records reside, or how a successor takes over. “Community” may describe a process or constituency, but it cannot replace a named obligor. Continuity becomes credible only when those practical questions have answers that survive a change in performer.