Summary

  • Resolution 202002.550 made visible a necessary institutional chain: an internal audit finding, referral to the Central CID, possible international cooperation, correction of the registry record and repair of the controls around allocation and database changes.
  • Evidence must be frozen before a suspect WHOIS entry is altered. The prior state, change event, actor, authorisation, timestamps and supporting workpapers are materially different records, and a clean final row cannot substitute for them.
  • AFRINIC could audit its own files, restrict access, preserve records, assist investigators and correct proven errors. Those are duties of a private technical bookkeeper, not sovereign powers to investigate coercively, prosecute, punish, confiscate or adjudicate title.
  • A defensible correction process must protect both investigators and affected holders through documented custody, notice, isolation of disputed records, reasoned decisions and a reviewable path that does not confuse database control with ownership of the underlying operational reality.
  • The resolution was valuable because it disclosed an audit finding and an external referral. Its institutional value ultimately depends on whether that disclosure joined up with verifiable hand-off, accurate record repair, layered verification, exception closure and reporting that members can scrutinise.

L3 — Freeze the evidence before fixing the record

An auditor opens an allocation file and finds that three things do not agree. The file says one thing about the basis on which an address block was recorded. The approval trail does not show the authority one would expect for that result. The public WHOIS entry presents a finished allocation as though the path to it were ordinary. At that moment, the tempting administrative response is to correct the public row. It is also the moment at which a registry can accidentally erase part of the case it needs to understand.

Copying the final WHOIS row is not enough. A final row shows a state, not how that state came to exist. The evidentiary object includes the original database state, every relevant change event, the account or person associated with the change, the authority claimed for it, timestamps, approval records and the internal audit workpapers that exposed the mismatch. It may also include rejected attempts, privilege changes, file annotations and the relation between an internal allocation record and what was published.

If the registry edits first and reconstructs later, it risks replacing contemporaneous evidence with its own recollection of the evidence. Preservation therefore has to precede correction, even when correction is urgent.

That sequence is the institutional core of AFRINIC Resolution 202002.550. The Board register places the resolution in February 2020 but gives no day. The resolution records the Board’s statement that a recent internal audit had revealed what it called substantial “malversation” in the allocation of IP resources. It also records that the matter had already been reported to the Central CID of the local police force for investigation, notes a possible international ramification and resolves that AFRINIC would cooperate with relevant international law-enforcement agencies. Those are important disclosures. They are not findings of guilt.

The wording has to be kept attached to its speaker. “Malversation” and “fraud” were terms used in AFRINIC’s institutional account. A February update referred to “alleged theft”. An August statement said AFRINIC had reason to believe that resources had been misappropriated, while also saying the criminal investigation remained ongoing. None of those formulations supplies the missing conclusion of a police file, a charging decision or a judgment. The public record described here does not establish who performed any alleged act, whether any named or unnamed person was culpable, or what final disposition a competent authority reached.

A responsible analysis can examine the controls implicated by AFRINIC’s statements without turning corporate language into a verdict.

The first control problem is therefore one of preservation under pressure. A registry database is operational infrastructure. Its entries cannot simply be placed in a museum while every question is resolved. Operators and holders depend upon usable registration information; registry staff still have to answer requests; and a visibly questionable record can continue to mislead. Yet the same database may contain traces needed to establish what happened. The task is not to choose between evidence and service.

It is to create a controlled fork: preserve the historical state in a form that cannot be silently rewritten, while treating the live entry according to a documented and reviewable operational decision.

Preservation starts by defining the event, rather than merely photographing the current screen. A useful evidence record distinguishes the object that changed from the event that changed it. It identifies the before state and the after state. It records when the change was requested, approved and applied; which credentials were used; which human or automated role acted; what supporting material was supplied; and where the authority for the change was documented. It retains the allocation file and approval trail in the state in which the auditor encountered them.

It also preserves the work that led the auditor to connect the mismatch across those sources. Without those joins, each individual record may look plausible while the inconsistency between them disappears.

This is why an audit conclusion alone is not a sufficient hand-off. Investigators need the material from which they can test the conclusion. An internal auditor may competently say that controls failed or that records are inconsistent. A public investigator must be able to establish what evidence exists, how it was obtained, whether it remained intact and what alternative explanations it permits. The evidentiary package should therefore distinguish raw records from analysis, and contemporaneous material from later annotations. It should record who collected each item, when custody changed and whether subsequent access altered anything.

The public materials do not provide an inventory, custody log, hashes, hand-off receipt or police file, so one cannot claim that any particular preservation technique was used. The point is what the institutional chain requires if it is to be verifiable.

There is a second reason to freeze before fixing: a correction is itself a new event. It must not be allowed to merge invisibly with the event under examination. Suppose a reviewer concludes that the live entry cannot safely remain as it is. The registry may need to isolate, annotate, reverse or correct that entry. Whatever the chosen measure, the change should create its own record with its own authority, evidence basis, time and reviewer. Otherwise, a later reader may be unable to tell the questionable historical state from the remedial act. The registry would then have exchanged one provenance problem for another.

Isolation can be especially important when the evidence is adequate to doubt the current entry but not yet adequate to settle every contested interest. A disputed record need not be treated as unquestionably normal. Nor does administrative control of the database allow the registry to declare who ultimately owns every interest associated with the resource. A quarantine or flagged review state can separate operational caution from final adjudication. It can restrict further unauthorised alteration, retain the before state and create time for notice and competent review.

The exact treatment must be justified by the evidence and the registry’s contractual and technical role, not by a desire to imitate sovereign seizure.

AFRINIC’s later public updates describe parts of this operational response, but they must be read at the level at which they were made. On 21 February 2020, AFRINIC said the Mauritius Police Force had initiated an investigation and that the registry was supporting it. The same update separately described continuing work on internal controls, resource-recovery activity and an ongoing WHOIS update. Those streams are related, but they are not interchangeable. Supporting a police investigation is an external-cooperation function. Updating WHOIS and strengthening controls are registry functions.

Recovery activity may raise further questions of evidence, notice and competing claims; it does not become lawful merely because it is mentioned alongside a police inquiry.

The distinction becomes clearer in AFRINIC’s statement of 25 August 2020. AFRINIC said it had followed due-diligence processes to retain sufficient evidence for ongoing cases, conducted a comprehensive audit of existing WHOIS allocations, contacted affected holders, reversed some entries and used layered verification. It also kept the criminal investigation separate and described it as ongoing. These statements indicate an attempt to join preservation, holder engagement, record work and control reinforcement. They remain AFRINIC’s account of its actions.

They do not provide the underlying evidence inventory, the reasoning for each item-level decision or a final answer to every dispute.

The annual report adds a high-level description of scope. It says the audit examined rightful custodianship and the allocation processes for legacy and non-legacy IPv4 resources, and reports that internal and external processes gained multiple verification layers. That is useful for understanding the control surface. It does not expose the audit workpapers or a complete exception ledger. Nor should the broader quantities and recovery disputes attached to later discussion displace the resolution-specific question.

The useful analytical object is the join: what must connect an internal finding to preserved evidence, a competent referral, a distinguishable correction and a repair that prevents recurrence?

The answer begins with an explicit stop on uncontrolled change. Once a credible mismatch is identified, the registry should constrain the credentials, roles or processes capable of modifying the affected records. That is not punishment. It is containment within the registry’s own systems. A temporary restriction protects the operational environment and preserves the reliability of subsequent review. It should be scoped, logged and revisited, because an indefinite or opaque restriction can itself become an unreviewable exercise of power.

The principle is least necessary privilege: enough control to prevent contamination or recurrence, without treating suspicion as a final finding about a person.

Next comes evidence capture across systems. Allocation administration rarely lives in one field. The relevant path may pass through correspondence, request records, approval notes, ticketing systems, database logs and published registration data. A sound review maps the path rather than assuming that the public output tells the full story. It reconciles identities and roles across those systems, records gaps and preserves contradictory material. A document that weakens the initial theory belongs in the package as surely as one that supports it. Preservation is not the production of a persuasive internal narrative.

It is the retention of material a competent investigator and an affected holder may need to test that narrative.

Then comes separation of duties. The person who identifies an exception should not possess an unchecked ability to alter the historical record and approve the remedial state. A four-eyes control means more than adding a second signature to a foregone conclusion. The second reviewer must be able to examine the evidence basis, the authority for action, the effect on the holder and the integrity of the preserved history. The reviewer should be independent enough to challenge categorisation: is this a data-quality error, a procedural failure, suspected wrongdoing, a contested entitlement or several of those at once?

Each category calls for different action, and an undifferentiated label can encourage an administrative team to overreach.

The practical tension is timing. If the registry waits for every public-law process to conclude before it touches an obviously unreliable live record, operators may continue to rely on bad data. If it replaces the entry immediately and treats its own conclusion as conclusive, it can damage evidence and affected interests. The sequence resolves the false choice. Freeze the evidentiary state first. Record the basis for any interim isolation. Refer suspected criminal conduct to the proper authority. Give affected holders meaningful notice consistent with legitimate investigative constraints.

Correct or reverse a registry entry when the evidence is adequate for that administrative act. Keep the original state and the correction event separately traceable. Permit challenge. Repair the controls that produced or failed to detect the mismatch.

Notice belongs inside this mechanism, not as a courtesy added at the end. A holder may possess records that explain an apparent mismatch, reveal another control failure or show reliance that affects how an operational transition should be managed. Notice does not mean disclosing protected investigative material or allowing further alteration. It means stating, to the extent properly possible, what record is affected, what administrative status has changed, what evidence or rule supports the action, what immediate operational consequences follow and how the holder can respond.

A process that invites evidence is more likely to correct the right fact than one that treats the registry’s first internal view as unanswerable.

Contestability also improves evidence quality. A reasoned challenge can expose mistaken identity, missing authorisation, inconsistent timestamps or the difference between control of a registry account and operational use of the address space. It can show whether the proposed correction tracks verified reality or merely imposes the database owner’s preferred account. The correction process should therefore retain the holder’s submissions, the registry’s response and the reviewer’s reasons as part of the subsequent record. This is not a miniature criminal trial.

It is an administrative safeguard against turning technical custody of a ledger into an arbitrary decision about the world outside it.

The operator perspective makes the discipline concrete. The registry does not deploy the resource, finance the network or serve the operator’s customers. A legitimate holder or operator bears the cost when registry data becomes unreliable or when a correction is abrupt, opaque or mistaken. Registration errors can propagate into due diligence, routing-security decisions, customer assurance, financing and operational planning. LARUS’s operator analysis is relevant here because it shows how opaque registry decisions can transmit continuity and cost risk through infrastructure.

It does not prove that Resolution 202002.550 caused a particular outage or loss; no such causal result is established. It explains why accurate, reviewable record work is not clerical housekeeping.

IPv4 scarcity sharpens the consequences without licensing spectacle. A record concerning a scarce resource may attract commercial reliance and competing assertions. That makes provenance, notice and controlled correction more important, not less. Scarcity cannot convert an internal database entry into a sovereign title instrument, and it cannot convert a registry administrator into a confiscator. It does raise the price of ambiguity. The more consequential the entry, the greater the need to preserve what changed, establish who authorised it, separate an interim safeguard from a final decision and leave a reviewable trail.

The best reading of the February resolution is therefore procedural. Its value lies in making a chain visible at the point where secrecy would have been corrosive. The Board acknowledged an internal audit finding. It disclosed that the matter had been referred to a public investigative body. It recognised that cooperation might need to cross borders. That disclosure provided members and affected parties with a basis to ask whether evidence was protected, whether live records were being corrected responsibly and whether the underlying access and approval controls were being repaired.

It did not answer those questions in full, and the resolution itself should not be made to carry details it did not publish.

The month-only dating is a small but revealing limit. The public Board register places Resolution 202002.550 in February 2020, while AFRINIC later said it had reported the matter to the Mauritius Police Force on 10 December 2019. The sequence supports the statement that referral preceded or existed by the time of the public Board disclosure. It does not support inventing a precise February resolution day. Precision in governance writing is part of the same discipline as precision in a registry record: do not make the ledger appear more certain than the evidence allows.

What remains unknown is substantial. There are no public audit workpapers here, no complete evidence inventory, no custody log, no hand-off receipt and no police file. There is no final police, prosecutorial or judicial disposition. Later updates do not offer a complete item-level ledger of corrections, and they do not settle every question that could arise over custodianship. There is no supported causal loss figure, operator outage or completed measure of control effectiveness attributable to the resolution. These are not footnotes to be filled by confident inference.

They define the boundary between a defensible analysis of institutional design and an unsupported reconstruction of events.

Within that boundary, the preservation rule is exact: evidence has to remain distinguishable from the registry’s remedy. Original state, change history, actor, authorisation, timestamps, source material, auditor work and later correction cannot be flattened into one sanitised present. The clean row is needed for service; the preserved history is needed for truth-testing. Good administration holds both at once.