• Lu Heng accuses RIR system of “mandate laundering”—elevating administrative record-keeping into quasi-sovereign authority, captured in the “bookkeeper’s paradox”.
  • The CircleID exchange with ARIN’s John Curran exposes a constitutional fault line: when “rough consensus” is turned against “running code”, do the registries retain technical legitimacy at all?

THE EASTER Monday of 2026 found Silicon Valley’s engineers still nursing their holiday hangovers. Yet on CircleID, an obscure forum for internet policy cognoscenti, a digital bomb detonated. “Running-Code Betrayal: How the RIR System Turned Consensus Against the Technical Community”, penned by Lu Heng, founder of Hong Kong’s LARUS Limited, accused the world’s five Regional Internet Registries (RIRs) of a constitutional coup. These bodies, meant merely as “thin coordination layers”, had crowned themselves “quasi-sovereign authorities”.

Within 48 hours, John Curran struck back. As chief executive of ARIN, the American registry, since 2009 and a board member since 1997, Mr Curran is internet governance’s nearest equivalent to an elder statesman. His rapid response betrayed the gravity of the challenge. Mr Lu was not quibbling about policy. He was alleging “mandate laundering”—the conversion of private administrative power into apparent public legitimacy through “ritual language”.

What followed was 26 rounds of intellectual bare-knuckle boxing—54 comments across ten days, perhaps the most consequential public brawl in internet governance for years.

The collapse of a digital fief

The five RIRs—ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC—have quietly doled out IP addresses, the internet’s basic resource, since the 1990s. The quarrel’s roots lie in a five-year legal slog between AFRINIC, which allocates addresses for Africa and the Indian Ocean, and Cloud Innovation Ltd, a Seychelles-registered firm. Between 2013 and 2016, AFRINIC handed Cloud Innovation 6.3m IPv4 addresses, which later leased through LARUS to thousands of networks worldwide.

In 2020, AFRINIC demanded their return, citing an “out-of-region use” restriction drawn from its “Soft Landing” framework. Mr Lu protested that no such general policy existed in his original Registration Services Agreement (RSA); the restriction appeared only in transitional documentation. The dispute landed in Mauritius’s courts.

Then came the twist. On July 23rd 2021, it was not AFRINIC that froze Mr Lu’s assets, but Mr Lu who froze AFRINIC’s. A “Provisional Authorisation to Attach Order” of $50m against SBM Bank and Bank of Mauritius paralysed the registry. Salaries went unpaid. The “reverse freeze” exposed what Mr Lu would later call the RIRs’ “structural fragility”: a body that theoretically stewarded a continent’s digital infrastructure could be choked by a single member’s legal manoeuvre. Though the court declared the order “null and void” three months later, the damage endured. AFRINIC’s board lacked quorum for three years—what Mr Lu termed “governance breakdown”—recovering only in September 2025. Nine cases remain pending. The 6.3m addresses still hang in limbo.

The room and the many

Back on CircleID, Mr Curran mounted a defence both “institutionalist” and “pragmatic”. RIR authority rests on three pillars, he argued: open policy development processes, community participation, and members’ power to amend governing documents. “RIRs are membership organisations,” he wrote. “Incorporated entities subject to law, with boards elected by their members, operating under bylaws that the members can amend.” Dissatisfied? Participate.

Mr Lu punctured this in round six. “Openness is not consent,” he wrote. “Dependence is not endorsement.” The board room of RIRs, he noted, was stuffed with “policy regulars, registry staff, lawyers, and institutional insiders”—a “narrow and self-selecting” class fluent in “procedural language”. The engineers actually running networks had neither time nor patience to decode this “ritual class” and its “insider language”. His verdict—”the room is not the operator community”—became the debate’s defining phrase.

Beyond the forum, a chill settled. An ISP director told BTW.media, under the condition of anonymity: “Everyone discusses this privately. But publicly? People fear being tagged ‘anti-community’.” Under the RIRs’ cultivated discourse, questioning the “multistakeholder model” borders on heresy—what Mr Lu diagnosed as “institutional hypoxia”: the mistaken belief that operator silence signifies health.

Also read: Why global coordination among RIRs remains structurally limited

The bookkeeper’s paradox

The philosophical climax arrived in rounds 16 and 17. Mr Curran offered the “community self-governance” defence: “There is no externally fixed mandate, as the registry instantiates the community’s desired coordination model.” RIR boundaries are dynamically defined by participant consensus; no “original design constraint” applies.

Mr Lu’s rebuttal was surgical. “A bookkeeper cannot vote itself sovereign,” he declared in round 17. “A committee of clerks cannot begin with record-keeping and end with authority over geography, continuity, transfer and survival merely because its meetings are open and its minutes are published.” This “self-authorizing power”—or “mandate laundering”—meant “private administrative power goes in; supposed public legitimacy comes out.”

The “bookkeeper’s paradox” cut to the quick. When AFRINIC’s board—operating “without a quorate board since 2022″—sought to reclaim 6.3m functioning addresses using “thin and contestable” policy grounds, was it performing “narrow technical coordination” or exercising “quasi-sovereign administrative power”? “A system confident in its legitimacy,” Mr Lu observed coldly, “does not begin by sealing the exits”—referring to AFRINIC’s “exit rule” transfer policy designed to ensure it “will not lose its current resource members to other RIRs in outgoing transfers.”

Running code versus rough consensus

The battle continues; the question remains.

Mr Curran insists RIR legitimacy derives from being “relied upon and adopted by global operators in the course of running networks”. Mr Lu counters that such “diffuse dependence” is mistaken for endorsement—”mandate laundering” whereby “a mailing list becomes a supposed people, a fee-paying membership class becomes a supposed constituency.”

The Mauritian court’s rejection of the “vexatious litigant” framing—its refusal to endorse the RIRs’ narrative that Cloud Innovation’s litigation was “abusive nuisance”—has already gutted the “community consensus” mythology. Yet the legal war grinds on.

The CircleID exchange leaves a constitutional question hanging. When “rough consensus” is turned against “running code”, when “community-developed policy” is invoked to endanger “already-running infrastructure”, do the registries retain “technical legitimacy” at all?

Mr Lu calls it “running-code betrayal”—a deliberate inversion of the IETF’s ancient credo. RFC 7282 declared that “running code is supposed to trump theoretical designs”. RFC 3935 anchored legitimacy in “making the Internet work better”. Yet the RIRs, he alleges, now use “rough consensus, policy process, and regional rhetoric against running code itself.”

The answer may lie in Mr Lu’s warning: “Today it is the bookkeeper. Tomorrow the gatekeeper. The day after, it claims the right to determine resource destiny.” Or, as he put it more starkly: “The institution exists for the network, not the network for the institution. Once that order is reversed, the claim to legitimacy does not weaken. It ends.”

When the internet’s address-book registry must justify why he has authority to manage addresses, the crown he crowned himself has already begun to slip.

Also read: Why RIRs lack authority and how community sovereignty can undermine the internet

John Curran has served on ARIN’s board since 1997 and as its chief executive since 2009. Lu Heng founded LARUS in 2016 and obtained some 6.3m IPv4 addresses from AFRINIC between 2013 and 2016 through Cloud Innovation Ltd. AFRINIC fell into “governance breakdown” in 2022, recovering in September 2025. In July 2021, Cloud Innovation secured a $50m “Provisional Authorisation to Attach Order” against AFRINIC’s assets; the court declared this “null and void” in October 2021.

Also read: Why RIRs don’t have power to enforce internet address policies