Summary

  • Resolution 202101.596 made AFRINIC’s retrospective account of WHOIS database accuracy publicly reviewable. That was a worthwhile disclosure, but the Board’s vote and the report remained institutional assertions rather than an independent assurance opinion.
  • The disclosed record covered 2,824 IPv4 prefixes delegated to resource members from 2005 through 2019, described the evidence examined, identified exceptions and set out address-volume statuses and stated controls. Those details allow scrutiny without resolving every case or proving that every control worked.
  • The right accountability response is neither secrecy nor indiscriminate exposure of sensitive material. It is a versioned, privacy-preserving accuracy receipt that lets outsiders test the bookkeeper’s bounded performance without mistaking bookkeeping competence for sovereign, regulatory, punitive or adjudicative authority.

L3 — The day the ledger became inspectable

The most important word in Resolution 202101.596 is not “accuracy”. It is “publication”. On 20 January 2021, AFRINIC’s Board recorded its approval for the AFRINIC WHOIS Database Accuracy Report to be made public. The resolution was a short institutional act, but its practical consequence was substantial: claims that had been available principally inside the organisation became propositions that members, operators, researchers and affected parties could examine from outside it.

That shift matters because a registry database speaks in an official-looking voice. A WHOIS record presents names, contacts, number resources and other administrative information in a structured form. Its orderliness can encourage the reader to treat it as a settled account of reality. Yet the entry cannot explain, merely by appearing on a screen, whether the underlying request was properly evaluated, whether an alteration was authorised, whether the supporting evidence was sufficient, whether a historic import was faithful or whether a dispute remains unresolved. The database shows the administrative assertion.

It does not authenticate its own chain of authority.

AFRINIC’s publication supplied some of the missing context. The organisation said it had checked records for 2,824 IPv4 prefixes delegated to resource members from 2005 through 2019. It reported that nine lacked a ticket number and associated those nine with Fiber Grid allocations made in 2012–2013. Of the 2,815 checked records that did have ticket references, AFRINIC said 2,800 contained an evaluated resource request. It said the inconsistencies in the remaining 15 concerned prefixes imported from other registries through an earlier registration-transfer project.

These figures are concrete enough to discipline discussion. They specify a population, a period, a record-level test and two different kinds of exception. They also need careful attribution. They are AFRINIC’s reported findings. The public material considered here does not reproduce every workpaper or allow an outside reviewer to rerun every comparison. Publication makes the findings contestable and revisitable; it does not transform them into observations independently replicated for this analysis.

The report also described a wider examination. AFRINIC said it used internal resource files, WHOIS logs and history, delegated statistics, ticket records, membership and resource requests, reverse DNS, the Internet Routing Registry, external historical records, public reporting and whistleblower information. That breadth is relevant because database accuracy is not reducible to checking whether a row contains text. A meaningful examination compares multiple traces of an administrative act: the request, the institutional file, the recorded change, the public representation and external evidence capable of revealing a mismatch.

At November 2020, AFRINIC reported several address-volume statuses. It listed 1,060,864 pool addresses as reclaimed and quarantined, and 1,310,720 pool addresses as under review. It reported 467,968 legacy addresses for which unsubstantiated changes had been reversed, 394,496 legacy addresses consolidated at holding companies’ request and 936,704 legacy addresses under dispute pending a determination of custodianship. Those categories should be read separately.

The report did not establish here that they form mutually exclusive components of one number, and collapsing them into a grand total would manufacture a conclusion the disclosed record does not support.

The distinction between record counts and address volumes is one of the report’s most useful lessons. Nine files without ticket numbers may sound small beside a population of 2,824 prefixes. A count of files, however, is not a measure of the operational or economic exposure associated with those files. Conversely, a large address volume described as under review is not a finding of wrongdoing, a judgment about lawful custody or proof of harm.

Proper scrutiny must retain both measures and the status attached to each: how many administrative records were affected, how much address space they concerned and what, precisely, had or had not been concluded.

AFRINIC also described controls that it said it had adopted or strengthened. These included automation, planned checks and traceability for changes, and senior final review of resource and membership requests. The organisation pointed to a fraud and corruption policy introduced in June 2019 and an independent whistleblowing platform launched in 2020. It described stronger verification for legacy-resource updates, daily reports comparing MyAFRINIC and WHOIS, comparisons with delegated statistics, PGP authentication, access limited by role and qualification, and escalation for changes outside ordinary privileges.

The list offers a map of the control surface. It identifies where accuracy may be protected: at intake, during evaluation, when a change is approved, at authentication, in access control, through reconciliation and when unusual action requires escalation. But a list of controls is not the same as evidence that every control operated effectively. The public record considered here contains no independently reproduced before-and-after control matrix. It does not prove that each measure was wholly absent before the dates mentioned, came into force on a single common date or subsequently ran without exception.

This is where the Board’s decision deserves both credit and restraint. Publication was materially better than silence. It gave the public a defined body of assertions to question. A reader can ask why a ticket was absent, what an “evaluated” request meant, how imported records were treated, which evidence classes were reconciled, who owned a control and what remained disputed. Without publication, those questions encounter a blank wall. With publication, they encounter at least an institutional account.

Yet approval to publish is not approval to punish. The resolution did not settle custodianship for disputed addresses. It did not establish criminal liability. It did not make the Board a court, the registry a police force or the report an external judgment. Nor does the resolution prove that the Board independently reran the examination behind the report. The exact extent of any confidential review beyond the public act is unknown. The sound conclusion is narrower: the Board authorised disclosure of AFRINIC’s account of a function for which a registry should be answerable.

That function is genuine. RFC 7020 treats uniqueness and registration accuracy as core requirements of the Internet Numbers Registry System. A common record supports coordination only if participants can distinguish number-resource registrations and find dependable administrative information. NRS’s account of AFRINIC’s private registry and membership setting reinforces why accountability must attach to that useful coordination role. Neither source turns AFRINIC into a public authority. Instead, they help locate the institution’s legitimate task: maintain a dependable ledger for a shared technical system and make its performance reviewable.

Heng Lu’s distinction between the ledger and the gatekeeper sharpens the point. A registry record describes a claim about the world; it does not create the world it describes. The organisation maintaining the entry performs a bookkeeping service, even when that service is operationally important. Accuracy can therefore be tested without treating the current bookkeeper as the source of all underlying rights. The report was evidence about the performance of one bounded function, not a vote of confidence on every question of institutional power.

BTW’s analysis of WHOIS and RDAP as a public record arrives at the same boundary from the reader’s side. A public entry is useful evidence, but it cannot authenticate the authority chain that produced it. BTW’s earlier work on the allocation files provides context for the numbers disclosed by AFRINIC; this article does not reconstruct that history. Its subject is the later act of publication and the standard by which such an act should be judged.

The first judgment is favourable. AFRINIC disclosed a specific retrospective examination rather than issuing a generic reassurance. The second is deliberately incomplete. A self-authored report, however detailed, cannot be the final certifier of its own completeness. Resolution 202101.596 opened the ledger to inspection. It did not close the argument.