Summary

  • Governments can establish legal conditions and express public interests, members can exercise formal governance rights, and open meetings can reveal concerns. None of those acts alone proves that the networks dependent on registry services authorize a permanent successor.
  • The primary consent record should be organization-level authorization from verified resource holders, Local Internet Registries, Internet service providers, and other direct registry customers, with affiliate consolidation, current authority checks, geographic distribution, dissent reporting, and a challenge period.
  • A temporary continuity operator can be appointed quickly and narrowly when services are at risk. Permanent recognition requires a separate decision that tests operator mandate, community legitimacy, independence, capability, transition safety, and the candidate's ability to serve a large multinational region without capture.

Failure produces a contest to define the region

A registry failure creates two vacancies at once. The first is operational: someone must keep registration records accurate, answer urgent requests, maintain reverse DNS processes, support route-security services, and preserve the evidence needed to resolve disputed holdings. The second is political: someone must decide what institution should carry the regional mandate after the emergency. These vacancies are related, but they should not be filled by the same shortcut.

The first claimant is often the incumbent's membership. Members elected directors, paid fees, or participated in the association. They possess a recognizable legal relationship with the failed institution. A second claimant is government. Ministries and regulators can invoke sovereignty, cybersecurity, economic development, or continental coordination. They can convene officials and speak in the language of public authority. A third claimant is the visible technical community: people who attend meetings, post to mailing lists, serve on committees, and understand the institutions.

A fourth is the operator population that may not be visible at all: thousands of organizations that hold addresses or Autonomous System Numbers, run networks, depend on registry services, and rarely attend governance meetings.

Each group can contribute legitimate evidence. None should be allowed to collapse the others into its own mandate. A member ballot can exclude resource holders who lack voting status. A government declaration can speak for a state without authorizing the service relationship of private networks. A conference can be open while still attracting a self-selected fraction of the region. An operator poll can protect direct users while overlooking broader concerns about public law, inclusion, and long-term institutional design.

The choice is not between pure technocracy and pure sovereignty. It is about ordering distinct tests. For a permanent replacement, the first priority should be verified authorization from the entities that receive or rely directly on registry services and will have to fund, use, and govern the successor. That operator mandate should then be tested for geographic breadth, independence, technical capability, public-interest safeguards, and consistency with the wider registry system. Governments and open communities should scrutinize the result, not substitute assertion for it.

This order follows the nature of the institution. An RIR is not a parliament for everyone who uses the Internet, and it is not an agency delegated by a single state. It is a regional, not-for-profit service and policy institution in a hierarchy that keeps number resources unique and registration information accurate. The people most exposed to a wrong successor are the organizations whose operational records and service relationships must move. Their authorization does not answer every question, but a successor without it begins with a legitimacy deficit that no ceremonial endorsement can cure.

ICP-2 put network support before elite sponsorship

The original ICP-2 recognition criteria were written for creating new RIRs, not replacing failed ones. Even so, their ordering remains instructive. The candidate had to demonstrate broad support from Local Internet Registries and the ISP community in the proposed region. The text asked for clear consensus, a very substantial majority, willingness to receive service, active participation in bottom-up development, financial support, and evidence that every effort had been made to contact existing LIRs.

That was not a requirement to collect prestigious letters. It was a migration test. Networks already received service from an existing registry. A new regional institution could not become credible unless a substantial portion of those networks wanted to move, expected to participate, and would finance the institution. The support evidence connected legitimacy to future operation.

ICP-2 also accepted government grants and private donations as possible early funding while requiring the RIR to become demonstrably independent and autonomous. That distinction is still important. Governments can help create conditions for a stable institution. Their assistance does not grant them the right to control it. A replacement that depends on one state or political coalition for money, appointments, or policy direction may solve a temporary vacuum by creating a permanent capture risk.

The current RIR Governance Document Version 2 sharpens the categories. It defines a resource holder as a person or entity holding number resources registered with an RIR, a member as someone entitled to vote for the governing body, and the numbering community more broadly to include resource holders, governments, civil society, the technical community, private enterprise, and academia. For recognition, it separately requires resource-holder support and community support.

Those definitions imply a hierarchy of evidence even though the draft does not fully describe how to measure it. Resource holders must broadly support the candidate, be committed to financing it, and participate in governance. The broader community must be committed to the institution and its policy process. The first is a direct service and institutional mandate. The second is a wider legitimacy test. Both matter, but they are not interchangeable.

After failure, that separation becomes essential. A crowded consultation can show community interest without proving resource-holder authorization. A formal member vote can show governance consent without including every holder. A ministerial communique can show governmental preference without satisfying either test. The final finding should identify which kind of support each piece of evidence proves.

Membership is relevant, but it is not the entire service population

It is tempting to say that members own the decision because RIRs are member-based associations. This is partly right. A lawful, current membership body normally elects the board and has the clearest internal authority to reform bylaws, replace directors, approve major transactions, or restore governance. Rehabilitation should begin there whenever lawful member action remains possible.

But membership categories differ. The NRO's overview of the five RIRs shows the variation. Some systems include associate members who hold no number resources. Some serve resource holders that are not members. ARIN reports customers with resources not covered by its ordinary membership relationship. RIPE NCC serves a large number of end users through sponsoring LIRs in addition to members. APNIC describes non-members and NIR-related entities alongside member categories. A single word, "member," does not identify the same operational constituency in every region.

Failure can make the mismatch worse. Membership records may be contested, outdated, inaccessible, or manipulated. Fees may have been suspended. Voting contacts may not match the people authorized to commit an operator to a successor. Associate membership may be easy to acquire. Affiliates may hold multiple memberships. A faction may seek to enlarge or shrink the electorate just before a decisive vote.

The answer is not to discard membership. It is to report member authorization separately and verify it. A member ballot should state the eligibility date, membership class, voting weight, proxy rules, affiliate treatment, turnout, invalid ballots, challenges, and geographic distribution. The body conducting the ballot should preserve an auditable list and allow entities to confirm how they were classified. If a court or lawful corporate officer must determine the voting roll, that determination should be disclosed.

Member support can be decisive for rehabilitating the existing corporation because members possess rights under its constitution and domestic law. It is less complete as the sole basis for transferring the regional service mandate to a new institution. That transfer affects nonmember holders and other direct customers as well. The successor should therefore need both a valid member result where obtainable and an independently assembled operator mandate.

Where the two disagree, the disagreement is information, not an inconvenience. Strong member support but weak holder support may mean the association wants a candidate its customers do not trust. Strong holder support but weak member support may indicate that governance rules no longer reflect service dependence, or that a commercial coalition is trying to bypass lawful member rights. The decision maker should investigate the cause rather than averaging the results into a vague claim of consensus.

Meeting attendance cannot serve as a franchise

Open meetings are central to regional policy. They permit anyone to propose, discuss, support, or oppose changes. The NRO describes RIR communities as open to anyone interested in number-resource policy and says membership is not required to participate. That openness is a strength for policy discussion. It is a poor substitute for an electorate deciding which institution will control regional services.

Attendance is self-selected. Travel cost, visas, language, time zones, employer support, connectivity, and professional familiarity shape who appears. Remote participation reduces some barriers but does not erase them. A meeting may be lively and diverse while still representing a tiny share of the organizations that depend on the registry. Applause, rough consensus, a show of hands, or silence in the room provides no reliable denominator.

The scale difference is large. The NRO reports tens of thousands of members in several regions and thousands in the smallest, while policy meetings ordinarily involve far fewer active entities. The 2024 questionnaire on proposed ICP-2 principles received 298 individual submissions. Those submissions can illuminate arguments and expose concerns. They cannot, without verified organizational authority and a defined electorate, prove that a region authorized a particular successor.

Individual participation also creates an attribution problem. One operator may send several employees; another sends none. A consultant may advise multiple organizations. A government delegate may speak personally, institutionally, or diplomatically. An attendee's technical expertise does not establish power to bind the legal entity that holds resources. Counting people in the room can therefore reward organizations with travel budgets and governance specialists rather than reveal the distribution of service consent.

Meetings should perform a different function. They should test the candidate in public. Entities can question governance, fees, technical design, security, independence, transition readiness, language access, and treatment of dissent. Session records can identify issues that the ballot materials omitted. Candidate answers can become enforceable commitments. But the meeting should not be described as the region choosing a successor unless the entities also constitute a verified electorate under published rules.

Consensus remains useful for policy and institutional design. It asks whether serious objections have been heard and addressed, not only whether one side has more votes. For succession, consensus should supplement authorization. The operator ballot establishes who accepts the service institution; the open process establishes whether the institution has answered legitimate regional objections. Neither can silently replace the other.

Government has a strong role and a bounded mandate

Governments cannot be reduced to outside observers. A registry is incorporated under domestic law. Its data, employees, contracts, taxes, creditors, and assets sit within legal jurisdictions. Governments may operate networks and hold resources themselves. Regulators understand critical-infrastructure duties, privacy restrictions, competition concerns, sanctions, and public-sector dependencies. In a failure, courts and ministries may be able to preserve assets or permit a lawful transition that no global institution can accomplish alone.

Governments also represent people who are not direct registry customers. Rural users, small businesses, schools, hospitals, and public agencies experience the effects of network disruption without holding resources or attending policy meetings. A successor's language policy, fee structure, incorporation location, and service reach can affect national development. These are legitimate public interests.

Yet a government is not automatically the operator community. It cannot ordinarily authorize private companies to accept a service provider, transfer contractual relationships, disclose protected records, or finance a new association. A collection of governments can demonstrate regional diplomatic support while still lacking direct authorization from the networks that will use and fund the candidate. Diplomatic representation follows states; registry service relationships follow legal entities and resources. The maps overlap but are not identical.

The multinational nature of an RIR also limits unilateral claims. The current draft requires a service region to cover a large, multinational area and forbids government or private-party undue control over RIR services. If one state, even a populous or technically important one, can select the replacement, the resulting institution may fail the independence test at its birth. A regional communique does not solve that problem if the process by which governments reached it was opaque or if operators were merely invited to observe.

Government input should therefore be recorded in a separate public-interest and legal assessment. Each participating authority should identify its competence, the interests it represents, the laws or risks it invokes, and whether it is also a resource holder. The assessment should report support, opposition, abstention, and nonparticipation by jurisdiction. It should not be converted into operator votes unless a government is casting a verified authorization for its own network entity.

Government objection can still matter greatly. A candidate that cannot lawfully incorporate, protect data, employ staff, receive assets, or operate across the proposed region is not viable regardless of operator enthusiasm. A state should be able to present that evidence. The decision maker must distinguish a concrete legal barrier from a political preference. The former may require redesign; the latter belongs in the balance of regional support but should not become an undeclared veto.

The primary mandate should come from verified operators

"Operator" needs a precise meaning. It should not mean anyone who describes themselves as technical. For succession, the core operator electorate should consist of legal entities with a current, verifiable relationship to number resources or RIR services in the affected region: resource holders, LIRs, ISPs, NIRs where they have a direct service role, sponsoring LIRs, and other direct registry customers. The categories should be reported rather than merged blindly.

Verification begins with identity. The electorate record should match the registry's service data, public delegation statistics, contracts where relevant, and independent corporate information. Each entity should have one canonical identity, with historic names and subsidiaries linked. A response should come from a person authorized to bind or formally represent the entity for governance or service decisions. Generic email replies and conference sign-up names are limited public evidence.

The NRO's statistics program shows that the registry system already maintains extensive public allocation and assignment data for IPv4, IPv6, and ASNs. Those files cannot by themselves create a voting roll; they do not settle membership, current control, customer status, or confidential contacts. They can, however, help test whether outreach covers the operational landscape and whether claimed supporters correspond to real resource relationships. Registry records, independently preserved at the start of the case, should supply the primary eligibility evidence.

Affiliate consolidation is essential. One corporate group may hold resources through many subsidiaries or memberships. Counting every affiliate independently can let a large group manufacture breadth. At the same time, collapsing unrelated operating companies too aggressively can erase genuine separate networks. The rules should define control, publish the method, allow challenge, and report both legal-entity and ultimate-control views.

One organization should normally provide one baseline authorization. Address volume should not become voting power; otherwise historic IPv4 holdings could dominate institutional legitimacy. Nor should every ASN or allocation produce another ballot. Resource scale still matters for transition risk, so the final report should include secondary measures: share of active service relationships, prefixes, ASNs, RPKI dependencies, and customer reach associated with support and opposition. Those are impact measures, not extra votes.

Operator priority is justified by commitment as well as exposure. The candidate needs fee income, governance participation, accurate customer data, and operational cooperation. A mandate is stronger when supporters agree not only that the institution sounds desirable but that they will receive service, pay published fees, update contacts, participate in governance, and cooperate with a tested migration. This is the practical logic embedded in ICP-2's original support requirement.

A mandate requires a denominator and an authority trail

Every claim of regional support should answer: support among whom? Without a denominator, 500 letters can be overwhelming or trivial. A credible assessment starts by freezing an eligibility date before campaigning changes the population. It then publishes aggregate counts by category and jurisdiction, explains exclusions, and creates a process for entities to challenge omission or duplication.

Outreach should be direct, repeated, multilingual, and proposal-specific. Each eligible organization should receive the candidate's constitution, governance structure, fee model, service plan, security and continuity arrangements, transition timetable, independence disclosures, and principal risks. The organization should be offered clear choices: support, oppose, conditionally support, abstain, request more information, or report that the contact lacks authority. Non-response should remain non-response, not silent consent.

The authority trail matters as much as the answer. The record should identify the signatory's role, the basis of authority, any board or executive approval required, the date, the candidate version considered, and the scope of commitment. Public reporting can protect names and contacts while an independent verifier inspects the underlying authorization. Each organization should be able to confirm its own record and withdraw or correct a statement obtained through misrepresentation.

No universal percentage can replace judgment, but the rule should define a safe harbor. One defensible example would require verified delivery to a very high share of known eligible entities, valid responses from at least half, support from at least two-thirds of valid respondents, and affirmative support representing more than half of all eligible entities after affiliate consolidation. It should also require meaningful support across the service region rather than a total produced by one jurisdiction or corporate cluster. These figures would be a proposed safeguard, not a claim about current ICP-2 law.

Cases outside the safe harbor should not automatically fail. A region emerging from institutional collapse may have damaged contact records or fear among entities. The decision maker could accept a lower response only with independent evidence explaining the gap, longer outreach, multiple published contact points, and stronger geographic and service-coverage checks. It should never transform poor participation into consensus merely because the timetable is inconvenient.

Opposition must be analyzed, not subtracted. Operators may oppose the candidate because of fees, location, governance, data transfer, incumbent loyalty, technical doubt, or political concern. Conditional support may identify a fix that turns conflict into mandate. A dissent report should group reasons, state how the candidate responded, and identify unresolved issues. The objective is not a perfect score. It is a decision whose residual opposition is understood and manageable.

Geographic breadth prevents a national coalition from becoming the region

Regional legitimacy has a spatial dimension. An RIR serves a large multinational area, while networks, population, infrastructure, and membership are unevenly distributed. A simple regional total can be dominated by the largest market. A strict one-country-one-vote rule can give very small operator populations the same control as much larger service communities. Neither extreme is adequate.

The mandate report should therefore show several views. It should publish support by country or territory, by subregion, by operator category, by affiliate group, and by service dependency. It should identify jurisdictions with low outreach, low response, or concentrated opposition. No single jurisdiction's result should be presented as regional consent, even if that jurisdiction contains a large share of members.

Geographic safeguards need not grant every government a veto. A candidate could satisfy a breadth test by receiving affirmative operator support in a majority of defined subregions and a substantial range of jurisdictions, while demonstrating a plan to address dissent elsewhere. The boundaries should be established before the vote, not drawn after seeing results. Tiny numbers should be aggregated or protected to avoid exposing individual positions.

NIRs and sponsoring LIRs require special handling. A national registry may represent many downstream customers operationally, but its single authorization should not automatically erase those customers' views. The assessment should record the NIR's institutional position and seek direct or sampled evidence from the entities it serves where contact and law permit. Likewise, a sponsoring LIR should not be assumed to speak for every end user whose records it maintains.

Legacy and independent resource holders must not disappear because they participate less. Some may have no ordinary membership relationship yet depend on accurate registration and route-security services. They should receive notice and a way to state transition concerns. Their lower governance engagement is not consent to any successor.

Geographic analysis also reveals candidate bias. A proposed headquarters, language regime, payment system, or board design may serve one subregion well and others poorly. If opposition clusters around those features, the answer may be institutional redesign rather than a rhetorical campaign for unity. Regional consent should influence the candidate before recognition, not merely bless it afterward.

The candidate must earn more than a favorable ballot

Operator support is necessary, not sufficient. Networks can support an institution that is not ready, independent, or legally viable. A popular candidate can still lack reliable systems, audited finances, competent staff, security controls, continuity arrangements, or a governance structure resistant to capture. Recognition needs a separate capability judgment.

Version 2 requires a candidate to meet ongoing operational requirements substantively, avoid harm to the registry system, and produce a material improvement over the existing condition. It also requires financial stability, operational independence, not-for-profit status, incorporation within the region, member-elected governance, open policy development, impartiality, transparency, performance, continuity, confidentiality, dispute resolution, and anti-capture controls. These criteria should be tested through evidence and simulation, not accepted as promises.

The candidate should operate a parallel readiness environment using non-authoritative test data. Independent assessors should examine service management, access control, change approval, backup restoration, incident response, data migration, RPKI operation, reverse DNS support, customer authentication, staffing, vendor dependency, and financial resilience. The results should be summarized publicly with sensitive details protected. A candidate that cannot pass readiness should not receive permanent status because the incumbent is worse.

Governance readiness deserves equal attention. Who selected the founding board? When will members elect a majority? How are affiliates controlled? Can one donor or state withdraw funds and disable service? What rights do resource holders receive? How are disputes decided? Are fees predictable? Can the institution serve languages and time zones across the region? A transitional board may be necessary, but its powers and expiration should be fixed.

The operator mandate must attach to the institution actually tested. Material changes to the constitution, headquarters, board selection, fees, service-region boundary, data arrangement, or transition plan should require renewed authorization or a reasoned determination that prior consent still applies. Support for an idea is not support for every later entity using the same name.

Competing candidates should receive fair access to the same eligibility and service information, subject to privacy and security. The incumbent peers should not be able to favor a familiar candidate through private assistance. Governments should not be able to exclude a candidate from consultation because it lacks political sponsorship. A published timetable, common questions, independent assessors, and conflict disclosures can reduce that risk.

A temporary operator is not a successor by endurance

During failure, the region may not have time to complete a full mandate assessment before service support is needed. Version 2 recognizes this through emergency continuity: ICANN and the other RIRs may authorize a qualified entity to provide affected services temporarily, subject to publication, community feedback, time limits, restoration rights, and post-event review. That is the correct conceptual separation.

An emergency operator should be selected for neutrality, competence, security, speed, and reversibility. It may be another RIR, a jointly controlled service entity, or another qualified institution under the eventual rules. Its authority should be limited to named services. It should not set regional policy, enroll a permanent membership, campaign for recognition, dispose of assets, or use temporary custody to create a political advantage.

Temporary performance can become evidence of capability, but not proof of consent. An operator may run services well for several months and still lack the regional mandate or governance design required of a permanent RIR. Conversely, a regionally supported candidate may need time before it can operate. The final process should compare candidates under the same recognition criteria rather than award status to whoever happened to receive emergency access.

The derecognition and recognition decisions must be sequenced clearly. Version 2 says a derecognition notice may designate a successor or interim entity, while its recognition article establishes a separate process for a candidate RIR. A permanent successor should not appear through the wording of a derecognition notice without passing recognition. The notice may name an interim operator and a path for candidate evaluation; permanent responsibility should begin only after the candidate satisfies the recognition requirements and any appeal is resolved.

The interim operator should preserve the operator electorate rather than reshape it. It should not add strategic membership classes, suspend opponents, alter contacts for political reasons, or condition essential service on supporting a candidate. An independent monitor should review sensitive changes. When the permanent decision arrives, the operator should hand over under a published, tested plan.

This separation reduces pressure on the consent process. Networks can accept emergency help without being counted as supporters of the helper's permanent recognition. Governments can facilitate lawful temporary access without selecting the next institution. Members can pursue rehabilitation without denying immediate service protection. The region gains time to make a real choice.

Damaged records require reconstruction, not a smaller electorate

A failed registry may be unable to produce a clean list of members, holders, and authorized contacts. That is not a reason to let the entities who happen to be reachable choose the successor. It is a reason to reconstruct the electorate from several independent records and to disclose the uncertainty.

The reconstruction should begin with preserved registry data and compare it against public allocation files, route-security service records, reverse DNS administration, billing history, executed agreements, prior election rolls, customer-support records, and corporate identity information. No single record should control. Billing can include former customers; public allocation files may not reveal a current legal entity; service contacts may be technical rather than authorized; and election rolls may omit nonmember holders. Reconciliation should classify each discrepancy rather than silently discard it.

An independent custodian should take a dated snapshot before any candidate or incumbent faction can modify eligibility. Ordinary service updates must continue, but changes relevant to voting status, organization identity, contact authority, or affiliate grouping should be logged and reviewed. Where two parties claim control of one entity, the entity's vote should be held as challenged until corporate authority is established. Where the conflict cannot be resolved in time, the final report should calculate the result both with and without the disputed authorization.

Unreachable entities deserve a stated category. Some contacts will bounce, some organizations will have dissolved, and some records will point to obsolete staff. The assessor should attempt multiple channels, including known abuse, administrative, contractual, and corporate contacts where lawful. It should publish aggregate delivery rates and explain when an entity was classified as inactive rather than merely unresponsive. A candidate should not benefit from poor records created by the failure it seeks to replace.

Operators downstream of an LIR present another difficulty. The RIR may not hold a direct contract or complete contact information for every customer using addresses. Those customers should not automatically enter the same electorate as direct resource holders, because that could create duplicate representation through the upstream LIR. Their service interests should still be sampled and reported, especially where the transition changes sponsoring arrangements, fees, or record-maintenance duties. The report should make clear whether an observation is a direct authorization, a downstream customer view, or a general community submission.

Data protection must constrain reconstruction. The assessor should collect only what is necessary to verify identity, service relationship, authority, and response. Raw contact details should not be published or shared with campaigns. Candidates can receive aggregate outreach reports and a neutral channel for distributing equal materials, not a copy of the registry's customer list. Every access to protected data should be logged, and the data should be retained only for the period needed to resolve challenges and audit the result.

The result may still contain uncertainty. A credible decision does not hide that fact. It can state that a defined percentage of the eligibility file was verified, a defined portion remained unreachable, disputed entities could not alter the outcome, and support retained geographic breadth under conservative assumptions. If uncertainty is large enough to change the result, the mandate is not proved. The answer is more time under bounded continuity arrangements, not a confident declaration built from the easiest names to count.

A two-ledger decision is stronger than a blended claim

The final consent report should not announce one mysterious percentage. It should maintain two principal ledgers and several supporting assessments. The first ledger is the operator mandate: verified organizations, resource relationships, authority, response, commitment, opposition, affiliation, and geographic distribution. The second is member governance: voting eligibility, turnout, weights, proxies, affiliate treatment, and lawful corporate effect.

Alongside them should sit a broader community report. It should summarize open consultations, technical objections, civil society concerns, academic analysis, and proposals from nonmember entities. A government and legal report should state positions by jurisdiction, identify concrete legal barriers, and distinguish public-sector resource-holder votes from sovereign or regulatory submissions. A capability report should test the candidate. A transition report should identify the effect on services and records.

The decision maker can then explain the weight assigned to each. Operator mandate should have priority on acceptance of the service institution. Member authorization should carry particular weight on the fate of the existing corporation and transfer of its governance rights. Governments should carry decisive weight on proved legal impossibility and substantial weight on public-interest risk, but not on private operator consent. Open community input should shape conditions, expose defects, and test legitimacy without becoming an unverified ballot.

A two-ledger model avoids the language of stakeholder soup, in which every kind of support is mixed until no reader can tell what was measured. It also prevents double counting. A government agency that holds resources may appear once in the operator ledger for its own network authorization and once in the government report for its public position, with the roles disclosed. An employee may contribute to an open discussion without creating another vote for the employer.

The final decision should address divergence. If the candidate passes the operator safe harbor but governments identify a lawful data-transfer barrier, recognition may need conditions or a different architecture. If governments strongly support but operators do not, the candidate lacks the primary mandate. If members oppose while nonmember holders support, the decision should investigate whether rehabilitation, membership reform, or a new candidate better reconciles the conflict.

This method makes disagreement visible and therefore governable. Consensus does not require pretending that every constituency said the same thing. It requires a reasoned account of why the institution can serve despite remaining objections and what protections answer them.

Consent must survive verification and appeal

Campaigns for institutional control create incentives to exaggerate. Candidate sponsors may present endorsements as commitments, count subsidiaries separately, use old letters, or imply that meeting entities authorized a decision. Incumbent factions may suppress contacts, question every signature, or warn holders that participation threatens service. Independent verification is the barrier between advocacy and mandate.

The verifier should be selected through a conflict-screened process independent of the incumbent, candidates, governments, ICANN staff responsible for the final recommendation, and peer RIR executives. It should receive the eligibility data under strict protection, contact a sample or all respondents as appropriate, test authority, identify duplicates, and publish aggregate findings. Candidates and objectors should be able to challenge methodology and specific classifications.

Every eligible entity should receive a private confirmation showing whether it was included, its category, affiliate grouping, recorded response, and any commitment attributed to it. A correction period should precede the final calculation. Disputes unresolved by the verifier should be listed and, if material, decided by an independent reviewer. This is especially important where an entity's name is publicly cited.

The final recognition or derecognition decision should be appealable under a dedicated rule. A candidate, incumbent, or concretely affected holder should be able to allege that the support record was materially inaccurate, the eligibility method was discriminatory, a government or affiliate exercised undisclosed control, required breadth was missing, or the remedy exceeded the verified mandate. Interim protection should prevent a permanent handoff while preserving essential services.

Appeal does not mean rerunning the entire regional consultation whenever a entity is unhappy. The challenger should identify a material error and show how it could affect the outcome or remedy. The panel should be able to order correction, renewed outreach, removal of invalid support, clarification of conditions, or a new decision. A transparent and carefully verified mandate will usually survive that scrutiny, which is precisely the point.

The support record also needs an expiry rule. Authorization should remain valid long enough to complete recognition but not indefinitely. If litigation or readiness delays last years, operators should be asked to reconfirm. If the candidate changes materially, old support should be treated as historical. Regional consent is a present commitment, not an asset a candidate acquires forever.

The 2023-present reform debate should settle the measurement question

The update to ICP-2 began because the original document did not govern mature failure. The review has moved from principles through two drafts and broad consultation. The second-round community report records concern about the meaning of members, petition thresholds, one-country concentration, shell membership, capture, transition legitimacy, and the need to preserve community involvement. It also records questions about how the new recognition criteria reflect regional community support.

Those concerns converge on one missing element: a measurable consent method. The current draft says resource holders must broadly support a candidate and the numbering community must support it, but it does not define outreach, authority, denominator, affiliate treatment, geographic breadth, response thresholds, dissent, expiry, or verification. Leaving every question to later procedure would make the principle easy to invoke and hard to audit.

The governing instrument need not contain a ballot manual. It should contain minimum guarantees. Resource-holder support must be organization-level and verified. Member support and community support must be reported separately. Government endorsement must not substitute for operator authorization. Affiliates must be consolidated under a published rule. The service region must show meaningful geographic breadth. Non-response must not count as support. Material candidate changes must reopen consent. The final report and challenge process must be public.

Detailed procedures can then adapt contact methods and thresholds to regional conditions. They should be developed openly and approved before a failure, not written by the factions competing to control a transition. The current draft says later implementation procedures cannot contradict the main document. Clear consent guarantees would give that clause something substantive to protect.

The same minimums should govern recognition after derecognition. A crisis should not lower the permanent standard. It can justify an interim operator and accelerated readiness work. It cannot transform urgency into regional authorization. If a suitable candidate does not yet have the mandate, the honest answer is temporary continuity plus further consultation, not a permanent appointment dressed as necessity.

Regional legitimacy begins with those who must use the result

The question "governments, members, or operators?" invites a winner. The better answer assigns each constituency the decision it is competent to make. Members decide the lawful internal future of their association. Governments establish and explain legal and public-interest conditions. The open community debates policy, inclusion, and institutional design. Operators authorize the service relationship on which a permanent registry depends. ICANN and the other RIRs test the candidate against global coordination and continuity requirements.

Priority belongs to the operator mandate because it connects consent to use, funding, data, and operational dependence. It is not a claim that network companies own the Internet. It is a limit on the power of visible institutions to speak for entities they have not contacted or cannot bind. The broader public-interest tests remain capable of stopping or conditioning a candidate that is captured, unlawful, unsafe, exclusionary, or regionally narrow.

A legitimate result should be easy to describe without slogans. The decision should be able to say how many eligible entities existed, how many were reached, who had authority, how affiliates were treated, where support and opposition were located, what members decided, what governments established, what open consultations changed, how the candidate proved readiness, and how dissenting holders will continue to receive service. If those facts cannot be stated, the region has not yet chosen.

Registry failure is a moment when institutional visibility can be mistaken for consent. Ministers have platforms. Meeting regulars have microphones. Board factions have corporate papers. Large operators have lawyers. Smaller resource holders often have only a service contact and a need for accurate records. A fair succession process brings that quiet population into the decision without silencing the legitimate roles of everyone else.

The permanent successor should therefore be the candidate that passes two tests in order: a verified, geographically broad mandate from the networks and resource holders that will rely on it, followed by an independent judgment that the institution can lawfully, safely, and impartially serve the whole region. Anything less risks replacing one failed registry with a new institution whose authority was never actually granted.