Summary

  • Draft 7’s only stated change from Draft 6 was an alteration to section 13.4A. It introduced at least six months to return resources, possible extra time for good-faith restoration or renumbering, and staff discretion over the acceptable level of compliance and the length of an extension.
  • The change did not clearly establish that correcting a breach or notifying AFRINIC of changed use would preserve the registration. AFRINIC staff said the predecessor had appeared clearer on precisely that point and asked whether the new wording made recovery mandatory.
  • The wider sequence concentrated entry, evidence assessment, remedial acceptance, timing and adverse registry consequences around AFRINIC staff, while the four-week appeal language named neither a clear starting point nor a completion deadline or automatic stay.
  • Six months and flexible renumbering time could be humane and useful. But AFRINIC is a private technical bookkeeper and coordinator, not a sovereign, regulator, police force, punitive body, confiscator or public-law adjudicator. Internal policy cannot confer those powers.
  • A defensible design would separate correction from return, identify the exact obligation and affected resource, preserve continuity while cure remained possible, limit any change to what was proved, and suspend publication, recovery, database alteration and reallocation until independent review was complete.

L3 — The cure promise that became a return clock

The smallest grammatical choice in Draft 7 carried the largest practical consequence. A period for correcting a discrepancy and a period for returning resources are not two descriptions of the same protection. The first treats restoration of accurate records or contractual compliance as capable of preserving the existing registration. The second presumes movement towards surrender and makes any alternative depend on further acceptance. Draft 7 placed its new minimum period in the second category.

That is why a six-month number, considered alone, could make the proposal look more restrained while leaving the holder less certain about the only question that mattered: can a proven correction end the case?

The comparison with the immediate predecessor is unusually direct. Draft 6, submitted on 10 April 2018, ended section 13.4A with AFRINIC attempting to contact the organisation and correcting any discrepancy towards the Registration Service Agreement. It did not contain the later minimum period, the sentence about good-faith restoration or renumbering, or the clause leaving the accepted level of compliance and duration to staff. Draft 7, submitted on 6 April 2019 by Amelina A. A. Arnaud, Jean-Baptiste Millogo and Marcus ADOMEY, changed that part.

Its revision history described the sole stated change from Draft 6 as clarification of recovery and the conditions for a longer term to return resources.

That stated purpose matters. The revision was not presented as a broad reconsideration of how reviews began, how complaint evidence worked, how publication occurred, how an appeal operated or what an annual report should disclose. Those elements remained around the amended section. The new work was concentrated at the point where contact with an organisation might lead either to a corrected record or to the removal of resources. Draft 7 said that, except in cases of fraudulent resource acquisition or unlawful usage and abuse, the organisation would be given at least six months to effect return.

It then said AFRINIC would negotiate a longer term if the organisation was cooperative and working in good faith to substantially restore compliance, or if it had a valid need for extra time to renumber.

The qualifying language was not trivial. It brought two very different activities into one sentence. Restoring compliance suggests that the original registration might remain viable after the defect is corrected. Renumbering suggests that return is already the expected destination and that extra time is needed to reduce the damage of getting there. Draft 7 did not state, in a separate and controlling rule, that full correction preserves the registration unless a distinct obligation requires a resource-specific change. Instead, staff would decide the accepted level of compliance and the duration.

The person subject to review therefore lacked a clear textual answer about whether cooperation could conclude the matter or simply earn more time on a path towards return.

AFRINIC’s staff assessment of 21 May 2019 made this more than an outside reading of awkward prose. Staff said Draft 6 had seemed clear that an organisation could correct a breach. Their examples included notifying AFRINIC of changed use under RSA article 4(a) and correcting a breach under RSA 6(d)(vii). They then said the changed section 13.4 no longer made that right clear. The institution’s own operational readers thus found that a provision described as clarification had weakened the clarity of the corrective option.

That assessment also asked what it meant to “initiate the resource recovery process”. Did it require reclamation of all resources? What should happen if WHOIS use records were incomplete? If only part of a historical allocation was in use, should the entire allocation face recovery, or should the parties negotiate return of only the unused part? These were questions, not findings about any actual holder. Their significance lies in what the proposed text failed to decide. If the opening notice did not isolate the exact discrepancy and exact resource, a broad remedial phrase could reach well beyond the record defect that justified contact.

The difference between correction and return becomes concrete in an ordinary operational example. Imagine that an organisation’s registered use description is stale, but its identity and control are not disputed and its network still depends on the address space. An accurate notification could bring the ledger into line with reality. If the relevant agreement expressly requires that notification, the organisation can supply it and demonstrate present use. Under a true cure rule, verified correction ends the discrepancy.

Under a return-centred rule, staff could treat the same evidence as only “substantial” compliance, decide it did not reach an unstated level, and continue to negotiate the period before surrender. Draft 7 did not clearly prevent that second reading.

No example establishes that AFRINIC would in fact have taken the broader path. The official record identifies Draft 7 as Under Discussion. It does not show adoption, ratification, implementation, application to a named member, recovery of a resource, actual loss or a judicial ruling on the draft. That boundary is important. The criticism concerns institutional design and the uncertainty created by the text; it is not an allegation that the authors or staff acted in bad faith, nor that an adverse step occurred.

The six-month exceptions made the uncertainty sharper. Fraudulent acquisition, unlawful usage and abuse were removed from the stated minimum. Yet the proposal did not say how much time applied in those cases, what evidence would establish the exception, who would make any legally authoritative determination of unlawfulness, or what continuity rule governed while the allegation was tested. Staff expressly asked how much time would be given. A private registry may preserve records, secure evidence, prevent duplicate claims and cooperate with competent lawful authorities.

It cannot turn an undefined exception into police, prosecutorial or judicial power.

The three ways into review illustrate how much depended on staff judgment by the time the amended remedy language was reached. Draft 7 retained random selection across the membership. It also allowed selection after an internal report or after AFRINIC could not contact an organisation. The reported-review route could follow a member’s request or an evidence-backed community complaint that staff considered sufficient. For complaint evidence, staff could require a sworn affidavit or a declaration before a Commissioner of Oath. The sentence about the same resource portfolio and a 24-month period remained inside that reported-review paragraph.

Those entry classes are relevant here only because they fed the same decision path. They meant that a holder might arrive at section 13.4A through a random choice, an internal concern, failed contact, its own request or an outside complaint deemed sufficient. The proposal’s premise said section 4 of the RSA supplied a framework for investigation, cooperation duties and measures for failure to comply. Reviews could cover allocated or assigned resources, with priority for IPv4 and ASNs mappable to two-octet ASNs. Regardless of the entry route, the eventual notice had to distinguish a record question from a claim demanding return.

Draft 7 did not make that distinction safely enough.

Once a policy or agreement breach was alleged, the institutional chain ran through contact and attempted resolution into the amended return language. If the situation could not be rectified and the member did not make an AFRINIC-approved transfer, the text contemplated publication of the resources for three months. During that period the organisation could seek compliance or transfer the resources. Recovery, database updating and possible reallocation under existing policies could follow.

The chain therefore linked staff’s view of adequate compliance to public status, recognised transfer, registry alteration and eventual availability to someone else.

The wording “could not be rectified” did not repair the cure problem upstream. It raised another one. Rectification might mean making WHOIS information accurate, meeting an identified contractual duty, transferring resources, returning an unused portion or surrendering an entire block. Those remedies have different legal and engineering effects. Without a rule that first fixes the exact obligation, evidence, affected resource and successful correction condition, a general reference to rectification cannot tell the holder which act will preserve continuity.

The three-month publication stage added a reputational and commercial dimension. Staff interpreted publication of resources under review as the addition of remarks attributes to relevant WHOIS objects. AFRINIC legal counsel expressed reservations that a three-month publication period might conflict with data-protection and confidentiality duties and could resemble naming and shaming. Again, the record does not show that remarks were actually placed against a member under Draft 7. But the proposed possibility mattered because counterparties often treat registry status as a signal long before a final legal conclusion exists.

A lender assessing network assets, a buyer considering a transfer, a customer evaluating continuity or an upstream operator checking address information may not distinguish a provisional registry remark from an adjudicated finding. Public uncertainty can reduce bargaining power even if a discrepancy is later corrected. It can delay financing, complicate a transaction and provoke defensive changes by other networks. If the same staff who found the evidence sufficient also decided what counted as compliance and whether extra time was valid, publication could impose consequences before an independent reviewer had decided the dispute.

Draft 7 did contain appeal language. It referred to a right to appeal a review result “within the four weeks” through arbitration under Mauritius’s Code of Civil Procedure. AFRINIC could, if asked, suggest knowledgeable community volunteers as arbitrators. But the phrase did not identify the event from which four weeks ran. The text set no completion deadline and did not say that an appeal automatically suspended publication, recovery, a database change or reallocation. A right that arrives without a clear clock and without protection against irreversible action may be formally present while practically weak.

The possibility of community knowledge in an arbitral process could be useful for understanding number-resource operations. Technical familiarity, however, is not independence by itself. A neutral review must be institutionally separate from the first decision, disclose reasons and evidence, permit a meaningful response and preserve the position until a decision is reached. If a resource is published, recovered, removed from the database and reallocated before review finishes, a later correction may not restore the same operational relationships.

Suspensive effect is therefore not a decorative procedural preference; it protects the ability of review to provide an effective remedy.

Annual reporting could have supported accountability, but a general promise of an annual report did not answer the immediate holder-level questions. Aggregate reporting can reveal how many reviews began, how long they lasted, how many discrepancies were corrected, how many decisions were reversed and how often extensions were granted. It can expose drift without revealing private member information. Yet retrospective totals cannot substitute for a precise notice, a clear cure standard and a stay for the organisation facing present consequences.

Staff’s assessment also warned that workload and review duration were uncertain. Requests would be handled first-in, first-out, with staff exercising discretion. That operational reality interacts badly with an undefined appeal trigger and no completion deadline. A six-month period sounds definite, but if the investigation, evidence exchange, extension decision, transfer discussion and neutral review have no coordinated timetable, the organisation cannot know when engineering and legal costs will arise or how long uncertainty will persist.

The impact extends beyond the holder because Internet number registrations sit inside a dense web of operational dependencies. Renumbering can require changes to routing announcements, DNS, reverse DNS, RPKI material, filters, allowlists, geolocation records, customer configuration, security controls and contracts. Each change may be manageable with enough time and cooperation. Together they can become a costly migration whose risks fall on people who never participated in the policy discussion and cannot control the registry decision.

Customer continuity also changes the meaning of proportionality. A discrepancy in one part of a historical allocation does not automatically justify action against every address and every service attached to it. Staff’s own question about partial use recognised this. The safe approach is resource-specific and evidence-specific: correct the inaccurate row, address the proved contractual breach, and alter no more of the registration than the verified problem requires. A general return clock, especially one governed by an undefined compliance threshold, obscures that discipline.

The registry itself has something to lose from ambiguity. Accurate records depend on timely, candid information from holders. If notifying changed use may be treated as evidence leading towards surrender rather than a route to correction, members have a weaker incentive to disclose early. A clear cure rule encourages accurate notice because it tells the organisation what it can do to restore the record. A vague return-centred rule risks turning the registry’s need for truth into an adversarial contest over consequences.

This is why the D6-to-D7 change cannot be evaluated simply by comparing zero months with six months. Draft 6 lacked the explicit minimum but seemed, to AFRINIC’s own staff, clearer that correction was possible. Draft 7 supplied time while making the purpose of that time less secure. One version could be criticised for insufficient scheduling; the next could still be worse on the prior question of whether successful correction preserved the registration. Protection requires both a defined period and a defined legal destination.

The strongest defence of Draft 7 begins with practical compassion. Immediate recovery could be destructive. Six months gives engineers time to inventory dependencies, notify customers and plan changes. Some organisations will need longer because their networks are complex or because equipment, contracts and external coordination cannot move quickly. A cooperative organisation working in good faith deserves flexibility. No static rule can anticipate every discrepancy, so experienced registry staff need bounded judgment.

That defence is serious. A minimum period is generally better than an abrupt registry alteration. A negotiated extension for real renumbering needs could prevent outages and reduce collateral harm. Professional judgment is unavoidable when evidence differs from case to case. And the registry has a legitimate responsibility to ensure that its records are accurate, unique and tied to authenticated identity and control. Ignoring demonstrable errors would not be neutrality; it would be neglect of the very service AFRINIC exists to provide.

The benign case nevertheless proves why the cure right had to be explicit. Flexibility is protective only when the underlying destination is lawful and clear. Staff judgment can assess whether submitted evidence corrects an identified record discrepancy; it cannot create a power to compel surrender because the policy community used broad language. Extra time can ease necessary renumbering; it cannot establish that renumbering is necessary. A humane timetable does not cure an unbounded authority claim.

Nor can allegations of fraud, unlawful usage or abuse solve the authority problem. Those terms may describe grave conduct, but their seriousness points towards competent public institutions, not away from them. AFRINIC can authenticate records, preserve relevant information and comply with lawful directions. It is not a police force, prosecutor or court capable of deciding criminality or public-law illegality. Excluding such allegations from the only minimum period without defining a continuity-preserving legal route made the design less bounded, not more credible.

At L3, then, the redline reveals a deceptively simple institutional choice. Draft 7 could have said that an organisation receives a defined period to correct the exact breach, that successful correction preserves the affected registration, and that return arises only where a separate proven obligation requires it. It did not. It framed six months around return, offered longer time through staff acceptance, and left its own staff asking whether the clearer cure option had disappeared. The contradiction was not hidden in a distant clause. It sat inside the provision presented as clarification.