Summary

  • AFRINIC’s revision history dates Version 8 of AFPUB-2016-GEN-001 to 29 May 2019, while the proposal page separately records 7 June 2019 as the submission date. The proposal reached no consensus at AFRINIC-30 and again at AFRINIC-31, and the official page now marks it expired.
  • Draft 8 added meaningful safeguards: a member randomly selected for review could not have been reviewed for another reason in the preceding 24 months; recovery was narrowed to the non-compliant portion; the ordinary return period was at least six months; good-faith compliance or renumbering needs could justify more time; an appeal could be filed within four weeks; and AFRINIC had to publish an annual report.
  • Those improvements did not settle the source-of-power question. Random and internally selected reviews, staff-screened complaints, discretionary evidentiary demands, an undefined compliance threshold, an AFRINIC-approved-needs condition, public recovery notice, unilateral recovery, database changes, reallocation and an arbitrator pool AFRINIC could suggest went beyond simple record verification.
  • A private RSA can support reasonable information requests, accurate registry records and proportionate service remedies. It cannot give a technical bookkeeper sovereign, regulatory, police, punitive, confiscatory or public-law adjudicative authority, nor make the same organisation investigator, claimant, decision-maker and beneficiary of recovered scarcity.

A better clock attached to an unproven power

Imagine that one segment of a network operator’s address holdings is found non-compliant. Under Draft 8, the operator would ordinarily have at least six months to return the affected resources. That sounds, at first, like restraint. The proposal did not automatically put the operator’s entire portfolio on the line, and it allowed a longer period where the organisation cooperated in good faith or could show that renumbering required more time. These were substantive improvements, not decorative ones.

But the six-month period was only the middle of the mechanism. Before it came selection and judgment. After it came publication, recovery, a database update and possible reallocation. A member could enter review at random, because of an internal report or lack of contact, or following a community complaint supported by evidence that AFRINIC staff considered sufficient. Staff could, at their sole discretion, insist that complaint evidence be put into a sworn affidavit or declared true before a Commissioner of Oath.

If AFRINIC concluded that part of the holding breached its policies, the RSA or another legal agreement, it would start recovery of that part.

The practical stakes were therefore much larger than a request to refresh a contact record. A running network could have customers, route-origin authorisations, reverse DNS, security processes, transfer plans and financing assumptions built around the addresses in question. A public recovery notice could affect confidence before a neutral forum had ruled. Reallocation could make the decision irreversible in commercial terms. The proposal’s procedure had to be tested against the narrower authority of the private contract it invoked, not merely admired for being more orderly than an immediate revocation.

That contract mattered. The published 2018 form of AFRINIC’s Resource Services Agreement required reasonable information and cooperation connected to service, contemplated a utilisation review, and described consequences for non-cooperation. It also set out a 30-day show-cause and cure sequence before termination. On termination or expiry, its text said AFRINIC would immediately revoke number resources and cease services without liability. Those words prove what the public contract form said.

They do not prove that the same version bound every member in June 2019, that every remedy was valid in every dispute, or that private agreement transformed AFRINIC into a regulator or court.

The distinction is foundational. A registry may authenticate a contracting party, verify signing authority, resolve a duplicate claim, confirm contactability, request a document tied to the service, correct an inaccurate record and preserve a dispute notation. It may enforce clearly assented reciprocal obligations through proportionate and reviewable contractual measures. It may ask a court or genuinely independent tribunal to decide fraud, illegality or contested entitlement. Those are legitimate tools for reliable coordination.

What it may not do is infer public authority from its control of a database. It cannot turn random selection into a general licence to investigate, a complaint into private prosecution, a staff view of continuing need into a forfeiture judgment, or an administrative record change into proof that a holder’s operational and economic position has vanished. The bookkeeper’s ability to edit the book is not ownership of what the book describes.

Draft 8 is especially revealing because it was the final and most refined formulation in this proposal chain. AFRINIC’s revision history dates Version 08 to 29 May 2019, while the official page separately gives 7 June 2019 as the date submitted. The page identifies the instrument as AFPUB-2016-GEN-001-DRAFT08, calls it Version 8.0, names Amelina A. A. Arnaud, Jean-Baptiste Millogo and Marcus ADOMEY as authors, and now labels it expired. “Final” here means last in the chain, not adopted policy.

The proposal framed regular review as a response to inefficient use, stockpiling and abuse. It said Section 4 of the RSA supplied the framework for investigating use, requiring cooperation and applying measures when a member failed to comply. The strongest reading of that case deserves to be heard. Number registries depend on accurate identity, contact and allocation records. False or abandoned records can facilitate fraud and duplicate claims. An organisation that obtained a service on a policy-specific representation can reasonably be asked for evidence of that representation.

A registry that never checks anything would not be a reliable registry.

Yet reliability does not require an open-ended mandate. The legitimate question is always: what exact record or contractual fact is being checked? Draft 8 instead proposed regular reviews of compliance with both the RSA and allocation or assignment policies, covering all allocated or assigned resources, with priority for IPv4 and ASNs capable of being mapped to two-octet ASNs. Its reach was broad while several critical thresholds remained undefined.

The first threshold was the trigger. Random review did include a new protection: the selected member must not have been reviewed for another reason in the previous 24 months. This reduced repeat exposure. It did not explain the randomisation method, the population from which a member would be selected, conflict controls, or why absence of a specific discrepancy justified intrusive demands. An internal report or lack of contact could also start a selected review, but the proposal did not state what an internal report had to establish.

A reported review could begin on the member’s own request or an evidence-backed community complaint, with staff judging the evidence. That was more disciplined than a bare allegation, but it left AFRINIC as the gatekeeper of a potentially coercive case.

The second threshold was evidence. Giving staff discretion to require an affidavit could deter frivolous complaints and impose accountability on an accuser. It could also lend formal gravity to material that remained untested. A sworn assertion is not a judgment. Draft 8 did not fully specify disclosure to the member, reliability tests, treatment of confidential material, conflicts, burden of proof or the consequence of evidence that was plausible but disputed.

The third threshold was compliance. Draft 8 defined non-compliance by reference to AFRINIC policies, the RSA and other legal agreements. That formulation gathered several different sources of obligation into one enforcement channel. A wrong contact email, a disputed interpretation of historical need, a missed contractual duty and alleged unlawful use are not interchangeable. Each requires its own evidence, remedy and decision-maker. Staff discretion over the “acceptable” level of compliance and the duration of an extension made the cure period flexible, but also made a decisive standard difficult to predict.

The remedy then moved beyond correction. Except in cases described as fraudulent acquisition or unlawful use and abuse, the organisation would have at least six months to return the affected resources. Cooperation in good faith or a valid need for more renumbering time could support a longer negotiated period. If the position could not be rectified, and the member had not transferred resources to meet other AFRINIC-approved needs under adopted policies, the resources would be published for three months.

AFRINIC would then recover them, update the previous holder’s database records, and could allocate or assign them again under existing policies.

Limiting recovery to the non-compliant portion was materially fairer than exposing everything. But proportional confiscation is still confiscation if the institution lacks the authority to decide the underlying entitlement. A transfer route conditioned on AFRINIC-approved needs also placed staff judgment between the operator and an alternative disposition. Public notice could operate as a reputational sanction. Database alteration and reallocation would not merely record a settled outcome; they could execute AFRINIC’s own contested conclusion and give a scarce resource a new claimant.

The appeal clause offered a four-week filing period after communication of the result and referred the appeal to arbitration under Mauritius’s Code of Civil Procedure. A defined appeal is better than no appeal. Yet AFRINIC could suggest knowledgeable community volunteers as a pool of arbitrators. The proposal did not fully establish appointment independence, cost, interim protection, workload, the record to be reviewed or whether recovery paused during appeal. Review is weakest when the original investigator can shape the adjudicator pool and irreversible action can continue before the challenge is resolved.

An annual meaningful report, subject to applicable law and regulation, was another genuine safeguard. Aggregate reporting can show how often each trigger is used, what types of defects are found, how long cures take and whether outcomes are consistent. Draft 8 did not specify that detail, however. Reporting after the fact also cannot supply authority missing at the moment of decision.

The meeting record confirms that these were not merely retrospective concerns. At AFRINIC-30 on 19 June 2019, the authors stressed compliance and described number resources as communal and not for sale. Recorded objections raised instability from taking resources back, implementation capacity, enforceability, changing legitimate need, repeated unresolved opposition and duplication of powers already claimed under the RSA. The meeting found no consensus and returned the proposal to mailing-list discussion.

AFRINIC-31 again recorded concerns about unclear selection and possible misuse against members, while also acknowledging the case for record integrity. After eight iterations across more than three years, there was again no consensus; co-chairs said major issues remained unaddressed and considered dropping the proposal.

No source here establishes that Draft 8 was adopted, ratified, implemented or used. No member is shown to have received an affidavit demand, recovery notice or adverse appeal outcome under it. The official page records a last modification on 18 October 2020 and now marks the draft expired. That status is crucial: the text is evidence of an attempted authority design, not proof that the design became law or practice.

The better design would begin from the opposite direction. No routine random review would occur. A defined discrepancy, duplicate claim, material contact failure, fraud indicator, court instrument or member request would start a narrowly scoped verification. AFRINIC would state the fact at issue, disclose the functional evidence category and give reasons. The last verified registry state and essential technical services would remain intact during an ordinary cure. Any interim hold would be limited to the smallest affected operation.

The investigator would not choose the adjudicator, and a genuinely independent forum could grant interim relief before irreversible recovery.

That approach does not protect fraud or excuse abandonment. It places each problem in the institution capable of deciding it. AFRINIC can maintain an accurate ledger and enforce a clear private bargain. Courts and independent tribunals can determine contested rights. Operators can correct records without being forced to treat a staff interpretation as sovereign command. The boundary is not anti-accountability. It is what makes accountability lawful, proportionate and technically safe.