Summary

  • Revocation is not a clerical reversal of allocation. Depending on the registry and contract, it can end registration rights, alter public records, interrupt reverse DNS or RPKI services, and expose an operator to routing and customer consequences.
  • The five RIRs publish materially different grounds and procedures. APNIC provides an Executive Council appeal; ARIN connects termination to revocation and arbitration; RIPE NCC separates suspension, termination and deregistration through an incorporated closure procedure; AFRINIC provides a show-cause period; LACNIC uses a staged public recovery process with an exceptional extension.
  • None of those current texts, standing alone, proves when every severe power first appeared, which members approved it, whether the approving body understood its operational reach, or which superior instrument authorised later expansion through a manual.
  • A defensible revocation regime should publish a clause-level lineage, define evidence and proportionality, preserve meaningful interim relief, disclose anonymised outcomes, allocate liability for error and state how registry services are restored or transferred.

The letter at the operations desk

Imagine the notice arriving at a network operator late on a Friday. It does not say that the operator's routers will be switched off at midnight. A regional Internet registry does not control every router on the Internet. It says something both narrower and, in a coordinated system, potentially more destabilising: specified registration rights are revoked, services will cease, records may be removed, and the organisation must stop treating the listed number resources as delegated to it.

The operator can continue announcing a route. Other networks may continue accepting it for a time. Yet the institutional supports around that route can change. Registry data may no longer identify the operator as the holder. Reverse DNS service may be affected. Resource Public Key Infrastructure materials may cease to support authorisations connected to the resources. Transfer requests can become impossible. Customers, transit providers, insurers, lenders and auditors may react to the loss of a recognised registry position even before routing filters do.

This is why revocation cannot be treated as housekeeping. It is a high-impact decision over a dependency that sits between contract, shared records and network coordination. The decision does not need to resemble a police seizure to demand a clear source of power. Practical consequence, not ceremonial form, sets the standard.

The essential questions are elementary. Who granted the power? To which legal person? Over which category of holder and which services? On what grounds? Through which instrument? Who may amend those grounds? What evidence is required? Can the holder obtain a stay before records change? Who bears the cost of a mistaken decision? If the registry itself fails, who can restore or replace the service?

Current RIR texts answer parts of this list. They do not yet form an easily auditable history. The weakness is not that nobody has ever accepted a contract or voted on a policy. It is that the chain from original competence to present consequence is often scattered among corporate constitutions, standard agreements, mutable manuals, staff procedures and institutional custom. A power can become familiar long before its authority becomes clear.

Allocation does not logically contain revocation

The usual defence begins with symmetry. If an institution can allocate a resource, it must be able to recover it when conditions fail. Without recovery, abandoned records accumulate, fraudulent applications gain permanence, unpaid services continue indefinitely and a finite pool cannot be administered responsibly. The argument has force. A registry without any correction or recovery mechanism would be unable to preserve accurate records.

But functional need is not the same as legal authority. A landlord needs a route to recover premises, yet cannot invent eviction procedure after signing a lease. A bank needs a route to close an account, yet the power depends on contract, law, notice and review. A professional body may need discipline, yet expulsion requires rules made by a competent body and applied fairly. Operational necessity explains why a power may be justified. It does not identify who created it or how far it reaches.

Allocation and revocation are also not mirror images. An allocation decision usually answers whether an applicant satisfies criteria at a point in time. Revocation can undo reliance accumulated over years. A holder may have built addressing plans, customer contracts, security controls and financing assumptions around the registration. Downstream users may have no direct relationship with the RIR but still depend on the number space. The cost of refusing a new request is not necessarily comparable to the cost of removing an established position.

The vocabulary of return, recovery, deregistration, termination, suspension and revocation further complicates the symmetry. These acts can be distinct. Ending membership may not automatically answer what happens to every resource. Suspending a portal service is different from deleting a registry entry. Deregistration is different from preventing packets from flowing. A voluntary return is different from an adverse taking. A legally compelled termination is different from a discretionary response to an alleged breach.

A legitimate system should preserve those distinctions. If a contract makes termination trigger revocation, the consequence should be explicit. If a policy permits removal while the contract continues, the authority should be separately identified. If an institution claims only a power to alter its own records, it should not describe that act as if it physically controls use everywhere. Precision limits both institutional overclaim and operator misunderstanding.

The missing lineage

The most revealing record would not be another current manual. It would be a lineage table. For every revocation ground, the table would show its first published appearance, prior wording, proposed change, explanatory memorandum, approving body, meeting date, vote, turnout, legal basis, affected contract classes, transition rule, remedy and subsequent amendment. It would distinguish a member vote from board approval, open policy consensus, staff implementation and unilateral contract revision.

That table is hard to find across the RIR system. Present texts are often accessible. Historical copies may also exist in archives. What is missing is the joined-up proof that a reader needs to trace a severe power from origin to current form. A clause can migrate from a contract into a procedure, acquire new examples in a manual, be restated on a help page and eventually appear inevitable. Repetition then substitutes for authorisation.

The difference matters because each document has a different institutional author. A corporate constitution may empower directors or members to manage the legal person. A membership agreement binds its parties. A policy process may establish resource criteria. An operations team may publish the steps for giving effect to a valid decision. A web page may explain the result. The fact that all are published by or associated with the same RIR does not collapse their authority into one source.

There may be good answers in meeting archives, legal opinions and contract histories. The present criticism is narrower: a member or affected holder should not need to reconstruct thirty years of institutional development to learn who approved the power that threatens its position. The registry is the custodian of its own constitutional record. It can publish the lineage.

Absence of a lineage does not prove a clause invalid. It creates an evidentiary deficit. The more consequential the power, the less acceptable it is to fill that deficit with phrases such as established practice, community expectation or necessary role. Those claims may explain reliance. They do not identify the principal, the act of approval or the limits accepted at the time.

APNIC: a clear consequence and an internal appeal

The Standard APNIC Membership Agreement offers an unusually direct view of the consequence. Its document identity says the current published version is APNIC-079 version 002, dated 9 February 2012, and that the original publication was 1 December 2001. It also says the page is for reference and the official document is supplied by APNIC. That caution alone shows why version and execution evidence matter.

The agreement permits written-notice revocation if a member fails to renew within the stated period. An insolvency event can support immediate revocation and termination. For an alleged breach, clause 4.1 requires a written notice describing the breach, the corrective action, a reasonable response period and the intended action. The member may deny the breach, show that it has been cured or identify exceptional circumstances. After considering the response, the company may send another notice or immediately revoke some or all rights under APNIC documents, including delegated resources, and may terminate the agreement.

Clause 4.4 then allows an appeal to the Executive Council where the member says relevant circumstances were not adequately considered or the company acted unreasonably. The Council must consider the appeal within 30 days and can require withdrawal of the revocation notice. Clause 4.5 says the member must immediately cease using resources specified in notices under the listed clauses, with injunctive relief contemplated if it does not.

This is not a hidden power. The operative contract names notice, response, consequence and appeal. It also reveals the governance problem. The company makes the initial decision; the appeal goes to the Executive Council embedded in APNIC's institutional structure; the member may have to cease use immediately while the Council has up to 30 days to consider the case. The text does not state in the same place whether lodging an appeal stays the consequence, which evidentiary record reaches the Council, or how conflicts are handled.

The agreement also incorporates APNIC documents as they exist from time to time and says amendments bind the member. That structure makes document lineage especially important. If a later APNIC document changes what counts as breach or alters resource obligations, the practical exposure can expand without changing the revocation verb. The proper audit therefore asks not only who approved clause 4.3, but who may change every incorporated rule capable of activating it.

ARIN: termination, revocation and a contract amendment route

The ARIN Registration Services Agreement, version 14.0, dated 15 August 2025, uses a different architecture. It defines included number resources in terms of registration rights and enumerates services such as registry entries, reverse name service, RPKI and record administration. That drafting helps separate the contractual position from a claim that the holder owns integers or that ARIN controls every route.

Section 13 gives ARIN termination rights for specified causes. Some grounds permit immediate termination; other breaches receive a 60-day cure period after written notice, subject to ARIN's reasonable determination. The agreement points a holder to section 14(k) to dispute a termination or suspension. Section 13(e) states the central consequence: except for specified situations, termination causes ARIN immediately to revoke the included number resources and cease services.

The treatment of covered legacy resources in one holder-termination setting is expressly different, showing that neither termination nor revocation has one universal effect across holder classes.

The agreement also contains a notable rule for changing the agreement itself. Section 1(e) describes a route based on an immediate and compelling need tied to a defined change in statute or case law, or a board recommendation ratified by a member vote. It provides notice and a delayed effective date. Policies are treated differently: the text reserves broad power to amend them and makes changes binding through notice or publication, while providing an order of precedence for inconsistency.

This is closer to a visible constitutional chain than a manual containing a free-standing severe power. Yet important questions remain. Which policy changes can materially widen the conduct that exposes a holder to termination? Were historical versions of the RSA approved under the same route? Which legacy holders signed which form? How often did a disputed suspension or termination reach arbitration, and was service preserved while it did?

ARIN's text also demonstrates why the phrase revocation power is too broad unless attached to a contract version. The agreement distinguishes rights, services, policies, legacy status and termination routes. A public statement that ARIN may revoke resources is incomplete. The defensible statement identifies the holder class, the included resources, the ground, the controlling agreement, the notice, the review route and the consequence.

RIPE NCC: three separate acts joined by incorporation

The RIPE NCC Standard Service Agreement, RIPE-812, dated November 2023, makes the layered nature of the power especially visible. Article 6.3 says that failure to comply with RIPE policies and RIPE NCC procedures can lead to suspension of services and deregistration of number resources in accordance with the named closure document. Article 9 provides termination rights and grounds, including failure to meet obligations after the procedural cure period, specified immediate grounds and legally required termination.

Suspension, contract termination and deregistration are therefore related but distinct. The agreement supplies contractual authority. Policies and procedures supply criteria and steps. The current closure document supplies the sequence through which warnings, deadlines, service consequences and record changes occur. The Articles of Association allocate corporate competence in the background, but they are not a substitute for this member-facing chain.

That separation is a strength when each layer remains within its assigned function. It becomes a vulnerability if an operational procedure can enlarge substantive grounds without the approval required for changing the agreement. A procedure can sensibly specify address formats, notice channels, deadlines and restoration steps. It should not acquire a new power merely because the contract incorporates procedures by reference.

RIPE NCC also offers an internal conflict arbitration route for defined disputes. The existence of review matters. Its adequacy depends on scope, timing, independence, evidence access and effect. A remedy that can declare error only after operational harm may be less valuable than one capable of preserving the position while contested facts are examined. A remedy outside its stated jurisdiction cannot be treated as a general appeal merely because it is called arbitration.

The lineage question remains historical. Which earlier service agreements first connected non-compliance to deregistration? When did the closure procedure begin to distinguish termination from resource-record removal? Which changes were approved by members, which emerged through the RIPE policy community, and which were management implementation? The current documents can be coherent while their ancestry remains difficult to see. Publishing that ancestry would strengthen, not weaken, their legitimacy.

AFRINIC: show cause, discretion and immediate effect

The AFRINIC Registration Service Agreement dated 27 November 2017 illustrates how a few words can determine the quality of a protection. The agreement provides that AFRINIC may give written notice of an intended termination, invite the applicant to show cause or cure the specified breach, and allow 30 days for a response. Where AFRINIC considers the grounds or corrective action satisfactory, the termination process stops.

The next step is severe. If the agreement terminates or expires, AFRINIC will immediately revoke the number resources and cease services, with broad no-liability language. The text therefore combines an opportunity to answer with institutional discretion over whether the answer is satisfactory and an immediate consequence after termination.

A show-cause period is meaningful. It can correct mistaken identity, outdated contact data, payment errors, successor confusion or allegations based on a third party's conduct. Its value depends on the decision record. Does the applicant receive the evidence? Is the reason for rejecting the response written? Is there an independent route capable of staying the consequence? Does the decision-maker distinguish curable administrative failure from fraud or deliberate abuse? Does the registry restore every affected service after error?

The no-liability wording heightens the need for those questions. A system that reserves a high-impact power, controls the evidence, decides whether the response is satisfactory and disclaims liability concentrates risk on the holder. Applicable law may limit the effect of an exclusion, but the contract should not rely on litigation to supply all proportionality.

AFRINIC's institutional difficulties also make continuity impossible to ignore. Revocation doctrine usually imagines a stable registry judging an unstable member. Governance must test the inverse case too. If the registry's own corporate capacity, systems or leadership are contested, who may exercise severe powers? Which records are preserved? Who can maintain services? A complete source-of-power account must include succession, not only enforcement.

LACNIC: a staged public process with a rare exception

LACNIC's Resource Revocation and Return policy uses the most visibly staged process among the five examples. The English text lists grounds including unused or unannounced resources where required, stale reverse-resolution or registration data, unauthorised transfers, repeated policy violations, contractual failure including non-payment or document fraud, and organisations that have disappeared or do not respond. It also says a process should not begin when a third party caused the violation without the recipient's knowledge and there is no collusion or negligence.

The policy calls for contact and rectification. If the issue is not regularised, the resources may be publicly listed for up to three months. After two months, specified NS records can be removed. After three months without correction, resources are recovered and holder records removed. The Board may extend the period for essential strategic infrastructure or exceptional conditions such as natural disaster or political instability.

These details show attention to cure and operational consequence. The third-party protection resists automatic punishment. The strategic-infrastructure exception recognises that a formally justified decision can be socially disproportionate. The staged period gives counterparties and the holder time to respond.

The same text raises constitutional questions. The English page warns that Spanish controls. A reader needs the authoritative version and amendment history. Which policy proposal introduced each ground? What constituency approved it, with what participation? What evidence is required before public listing? Is listing itself an adverse act capable of causing commercial harm? What review exists before NS records are removed? How is the Board's exceptional power constrained and reported?

LACNIC also demonstrates that revocation is not one moment. It is a sequence: detection, confirmation, contact, public identification, service alteration, record removal and later reuse. Due process should attach at the stage where harm begins, not only at the final database change. If public listing or NS removal creates immediate damage, a challenge available after three months is not a complete remedy.

ICANN recognition is not the missing grant

When the regional contract history becomes difficult, institutional accounts often move upward. The RIR was recognised; it performs part of a globally coordinated system; therefore it must possess the powers necessary to administer resources. This reasoning converts status into an unspecified grant.

ICP-2, the criteria for establishment of new RIRs, is important evidence. It addresses community support, bottom-up self-governance, neutrality, technical capability, funding and continuity. Recognition against those criteria can explain why one institution is accepted as the RIR for a region. It does not list every ground on which that institution may terminate a member agreement, remove reverse DNS data or revoke registration rights.

Recognition can support reliance. Other institutions can coordinate with the recognised RIR rather than choose among rival records. That practical effect is substantial. But a recognition instrument should not be made to do the work of a member contract. It does not identify the affected holder, breach, notice, appeal, liability or case-level remedy.

The same limit applies to the 2019 ASO Memorandum of Understanding. The MoU structures the Address Supporting Organization relationship and global number-policy roles. It is relevant to how ICANN and the RIR system coordinate. It is not a schedule of regional enforcement powers. ICANN's participation in a global policy structure is not proof that it approved every revocation clause used by every RIR.

This distinction protects all sides. ICANN should not inherit liability or authority that an instrument does not assign. RIRs should not have their contractual powers misdescribed as commands from ICANN. Members should know which institution made the rule they face. Clear attribution is a condition of accountability.

Technical hierarchy is not a blank cheque

RFC 7020 describes the Internet Numbers Registry System as a hierarchy rooted in the IANA address-allocation function, with RIRs serving regional communities and local registries serving customers. It identifies stewardship goals including uniqueness, registration, conservation and aggregation. It also recounts the development of regional responsibility.

Those goals explain why inaccurate or abandoned records matter. Uniqueness can be undermined if the same space is treated as available to conflicting holders. Registration quality can be undermined by false data. Conservation can support recovery of genuinely unused resources under an authorised rule. Aggregation can be affected by fragmentation and operational change.

Yet an Informational RFC is not a universal termination clause. It describes architecture and goals. It does not identify the governing law of a bilateral agreement, create a damages remedy or assign an adjudicator. Technical hierarchy establishes where functions occur; it does not answer every legal question about the institutions performing them.

The IANA Number Resources page similarly describes global pool coordination and allocations to RIRs under global policies. It helps identify the top-level service. It does not say that every power an RIR regards as useful is delegated by IANA. Nor would such a claim resolve member consent, because the member is not necessarily a party to the instrument governing IANA's service.

Institutional legitimacy is strongest when each layer claims only its own authority. IANA can describe global pool administration. ICANN and the ASO can describe global policy roles. An RIR can describe its corporate competence, contracts and regional policy procedure. A member can accept defined obligations. Courts and arbitral bodies can apply governing law. Calling the entire arrangement stewardship may be convenient, but it should not obscure these separate bridges.

Members voted for some things, but which things?

The title of this article is deliberately provocative. RIR members do vote. They elect directors or council members, approve constitutional matters and, in some systems, ratify agreements or fees. Open policy communities also deliberate and reach consensus on resource rules. It would be false to say that all severe powers appeared without participation.

The harder question is what the vote actually covered. Electing a board is not necessarily approval of every future enforcement ground. Approving a constitution is not necessarily consent to every staff procedure. Participating in a policy forum is not the same as signing a contract, and signing a contract is not the same as representing downstream customers. A vote on broad stewardship objectives does not automatically authorise any means considered useful to those objectives.

An approval record should identify the proposition. Did members vote on the exact agreement text? Did the board adopt a procedure under a clear delegated power? Did an open policy process approve the substantive ground while management merely implemented notice mechanics? Was the amendment prospective? Were existing holders given an exit or transition? How many eligible members participated? Were conflicts disclosed? Did the explanatory paper state that a change could end registration rights?

These are not demands for unanimous consent. Corporate and associational systems routinely act through valid majorities or assigned organs. The requirement is traceability. A board may have authority to decide. If so, the registry should cite the provision granting it and publish the decision. A community process may be authoritative for regional policy. If so, the policy should link to the proposal and consensus record. A contract may allow amendments. If so, the path and notice should be visible.

The phrase nobody voted to create describes the risk of accumulated text: a severe consequence can emerge from the interaction of provisions that were each approved for a narrower purpose. The cure is not to pretend participation never occurred. It is to show exactly where the whole power, as presently exercised, received approval.

Incorporated documents can move the trigger

Standard agreements often incorporate policies and procedures. This is practical. Number administration changes over time, and a registry cannot negotiate a new signed contract with every holder for every technical update. Incorporation allows common rules to evolve while preserving a stable service relationship.

It also creates a constitutional hinge. The revocation clause may remain unchanged while incorporated documents expand the obligations whose breach activates it. A new reporting duty, audit demand, transfer restriction, security requirement or data standard can become a termination trigger through the existing promise to comply. The severe power grows at the trigger, not the remedy clause.

An order-of-precedence clause helps when texts conflict, but does not answer expansion. There may be no contradiction between a broad duty to comply with policies and a new policy. The issue is whether the body adopting that policy was authorised to expose the holder to termination for that subject and whether the holder received adequate notice and review.

A defensible incorporation model separates substantive and operational change. Substantive grounds for suspension, termination or record removal should require the same level of approval as the severe power itself, or a clearly bounded grant from that approving body. Operational details can move through a faster procedure when they do not alter exposure. Every change should state which category it occupies and why.

Versioning must be more than placing a date on the current PDF. A holder should be able to retrieve the exact agreement and incorporated documents in force on the alleged breach date. The registry should provide a redline, effective date, approval link and transition rule. Otherwise, both sides may argue from today's text about yesterday's conduct.

Proportionality begins by separating consequences

Even a fully authorised power can be exercised disproportionately. The five systems contain different combinations of warning, cure, suspension, termination, deregistration, record removal, cessation of service and reuse. Treating them as one penalty prevents calibrated decisions.

An overdue fee may justify restricted member benefits before it justifies removal of long-relied-upon registry data. False identity documents may justify a faster and more severe response than an outdated contact field. A disputed transfer may require preservation of the status quo rather than immediate return to a pool. Conduct by an unaffiliated downstream customer should not automatically be attributed to the holder. Essential infrastructure may require a continuity arrangement even when the holder is in breach.

Proportionality needs a published ladder. The decision-maker should identify the objective, evidence, available lesser measure, expected operational effect, third-party impact, cure opportunity and reason the selected consequence is necessary. The ladder should distinguish reversible service limits from irreversible reallocation. It should state when an emergency permits acceleration and require later review.

The LACNIC exception for essential strategic infrastructure is one recognition of this problem. It should not remain exceptional in the sense of being conceptually isolated. Every RIR should know how it will handle hospitals, public safety networks, critical exchange infrastructure, government services and large customer dependencies without creating an immunity for important operators. Importance is not a defence to breach, but it is relevant to transition.

Proportionality also constrains public language. Calling an allegation fraud before adjudication can damage an operator beyond the registry action. Public recovery lists may be operationally useful, but should state status accurately and provide correction. A recordkeeper's credibility depends on precision about both resources and people.

Appeal without a stay may arrive too late

Every current protection should be assessed against time. APNIC provides an Executive Council appeal. ARIN identifies arbitration for disputes. RIPE NCC has a defined conflict procedure. AFRINIC supplies a show-cause period. LACNIC provides a staged cure period. These are material safeguards.

But a remedy can be formally available and practically ineffective. If the holder must cease use immediately, records change before review, RPKI materials lapse or counterparties terminate contracts, a later victory may not restore the original position. Network trust can be lost faster than a tribunal can issue a reasoned decision.

The key safeguard is interim relief. Filing every complaint should not automatically freeze a justified emergency response. A party should, however, be able to ask an independent decision-maker for a stay under a published test: seriousness of the issue, risk of irreparable harm, balance of effects, public interest, evidence preservation and security risk. The reviewer should be able to impose conditions, such as escrowed fees, restricted transfers or updated contacts, while preserving core registry status.

Independence is equally important. An internal council can know the institution and act quickly, but may oversee the staff whose decision it reviews. Arbitration can provide distance, but cost and procedural complexity may deter a small operator. Courts provide public authority but may be slow or geographically remote. A layered system can combine rapid independent interim review with later arbitration or litigation.

Reasons should be published in anonymised or redacted form where privacy permits. Without outcomes, members cannot know whether appeals correct error or merely confirm initial decisions. Registries cannot show consistent treatment. A remedy that leaves no jurisprudence also allows the same ambiguity to recur.

Liability is part of authority

Power and liability are often discussed separately. They belong together. An institution that claims authority to impose a severe consequence should state what happens when it is wrong. Broad exclusions may be understandable for technical coordination performed at scale, but total risk transfer weakens incentives to investigate carefully and restore quickly.

The losses from error can be varied: engineering time, emergency renumbering, customer credits, lost transactions, security remediation, professional fees, reputational damage and the cost of rebuilding registry relationships. Not every loss should automatically be recoverable. Causation can be complex, counterparties make independent choices, and unlimited exposure could threaten a registry's continuity.

That does not justify silence. A balanced regime can distinguish ordinary negligence, gross negligence, bad faith and legally compelled action. It can cap specified financial exposure while providing uncapped restoration duties. It can require prompt correction of records, reissuance of services, notification to counterparties and preservation of historical evidence. It can maintain insurance or a continuity reserve.

Liability also disciplines drafting. If a registry believes it could bear no responsibility even for an unsupported revocation, broad language becomes easier to adopt. If directors and members must consider restoration cost and independent review, they are more likely to define evidence and scope.

The point is not to convert every registry dispute into damages litigation. Effective non-monetary remedies may matter more. The point is that the holder should not bear all operational risk while the registry retains all interpretive discretion. Stewardship is a claim about responsibility, not merely control.

Replacement is the neglected half of revocation

Revocation discussions focus on replacing the holder. Institutional legitimacy also requires a plan for replacing the service provider. ICP-2 treats continuity as an important feature of a regional registry. Yet current public explanations are often much clearer about how an RIR can remove a member than how the wider system can replace an RIR that can no longer perform.

A complete replacement path would identify the decision-maker, threshold, evidence, notice, interim operator, data custody, cryptographic continuity, reverse DNS, account migration, contract succession, dispute handling and recognition of the successor. It would protect members from competing claims while preserving the uniqueness of records. It would distinguish temporary technical assistance from permanent institutional replacement.

This matters to the source of revocation power. If an RIR's authority is justified by recognition and operational necessity, the conditions for losing that role reveal the limits of the justification. A role that can never be transferred begins to resemble ownership. A role with a defined succession process looks more like stewardship.

Members should have standing in this discussion because they bear transition risk. ICANN, IANA, the NRO and other RIRs may have coordination roles, but those roles should be stated in executed instruments rather than inferred during crisis. Governments may have public-interest responsibilities without becoming registry operators. Technical continuity should be designed before institutional failure, not improvised after it.

The same principle applies at the holder level. When resources are recovered, the registry should state whether and when they may be reissued, how conflicting route announcements are handled, which historical data remain public and how downstream users are informed. Revocation without a replacement plan can turn an accountability measure into a coordination shock.

The strongest case for the current system

The fair argument for the RIRs is substantial. They administer globally unique resources through private-law institutions that have remained operational across decades of growth. They publish agreements and policies, maintain member structures, provide notice and cure in many cases, and expose more of their rules than many infrastructure providers. Revocation powers address real problems: abandonment, fraud, non-payment, inaccurate records, unauthorised transfers and persistent policy breach.

No global legislature could easily adjudicate every regional registry dispute. A treaty system might be slower, more politicised and less technically informed. Contract and community policy can adapt to new security and operational risks. Member elections and open processes provide forms of consent that are real even if they are not universal suffrage. Courts remain available under host law.

The absence of a single founding vote is not necessarily fatal. Institutions often develop incrementally. Corporate organs receive broad competence and adopt more detailed rules as conditions change. Holders renew agreements with notice. Reliance and repeated acceptance can strengthen settled expectations.

But this defence supports documentation, not opacity. If the powers are legitimate, a lineage will show it. If amendment routes are valid, publishing votes and redlines will demonstrate them. If remedies work, anonymised data will strengthen confidence. If broad discretion is rarely used and usually cured, denominators will prevent exceptional cases from distorting debate.

The current system does not need a myth of original public delegation to justify useful coordination. It needs an honest account of private authority: corporate competence, contract, member approval, policy participation, operational reliance and host-law review. That account can be strong while remaining bounded.

A revocation authority record

Each RIR should publish a revocation authority record beside its current agreement. The record should be designed for a member, court, network operator and policy entity to read without reconstructing the institution's entire archive.

First, it should name the legal person exercising the power and the corporate provision assigning competence. Second, it should identify every affected holder class: member, non-member, legacy holder, NIR-mediated recipient, successor, government body and insolvent entity. Third, it should list each substantive ground and the first instrument in which it appeared.

Fourth, it should link every amendment to proposal text, redline, approving body, meeting, vote or consensus record, effective date and transition rule. Fifth, it should map the sequence from allegation to notice, evidence disclosure, response, cure, interim measure, final decision, record change, service effect, appeal and restoration. Sixth, it should state whether an appeal stays any step and who can grant interim relief.

Seventh, it should distinguish contractual consequences from technical and third-party effects. Eighth, it should identify governing law, forum, liability limits, insurance and restoration commitments. Ninth, it should provide anonymised annual counts by ground and outcome. Tenth, it should state the institutional replacement and data-continuity plan.

None of this requires disclosure of confidential member data or security-sensitive methods. Aggregation and redaction can protect both. What cannot be withheld without cost to legitimacy is the constitutional architecture of the power itself.

The record should be versioned and cryptographically archived, with stable links. A current summary is not enough because disputes concern the past. Historical accuracy is part of due process.

What the evidence still cannot tell us

The official texts support a confident comparison of formal structures. They do not provide a reliable empirical denominator. We do not know from one common dataset how many warnings, suspensions, terminations, deregistrations or revocations each RIR initiated each year; how many were cured; how many were appealed; how often interim relief was requested; how many decisions were reversed; or which grounds produced the most disputes.

We also lack a complete public map of contract classes. A standard agreement may not govern every legacy holder, NIR entity, non-member recipient, successor or public institution on identical terms. Historical versions matter. A clause dated 2025 cannot explain a dispute governed by a form signed years earlier unless the amendment path validly brought it forward.

The operational effect is also difficult to measure. A registry record change does not mechanically determine routing, but counterparties can act on registry data, route-origin authorisations, reverse DNS and due-diligence signals. Case studies would need timestamps across notices, records, RPKI, route announcements, customer effects and restoration. Public documents rarely provide that joined timeline.

Finally, legal validity cannot be inferred from publication alone. Governing law may constrain discretion, exclusions or procedure. A court or tribunal may interpret a clause narrowly. A member may waive or settle a claim. Without decisions, one should not announce that every clause is enforceable or invalid.

These uncertainties should narrow conclusions, not end inquiry. The documents prove that severe powers exist in materially different forms. The missing evidence proves that their history and performance are not yet transparent enough for confident system-wide claims.

Authority should leave a trail

Internet number registries need correction powers. They must deal with false records, abandoned organisations, unpaid obligations, unauthorised transfers and serious policy breaches. The question is not whether every registration must last forever. It is whether a consequential institutional power can be tested from origin to remedy.

The answer should not depend on reverence for technical necessity. It should be visible in documents: a competent principal, a bounded grant, an identified recipient, precise grounds, valid amendment routes, evidence standards, proportional consequences, independent review, liability for error and a replacement plan. Every step should point backward to approval and forward to restoration.

APNIC, ARIN, RIPE NCC, AFRINIC and LACNIC already publish important parts of this architecture. Their differences are informative. They show that revocation is designed, not inevitable. Appeals can be internal or arbitral. Cure periods can be immediate, 30 days, 60 days or staged. Legacy resources can receive distinct treatment. Essential infrastructure can justify extension. Incorporated policies can carry more or less weight.

Because design choices exist, responsibility exists. A manual cannot acquire constitutional force merely by surviving on a website. A contract cannot claim legitimacy merely because renewal was convenient. Recognition cannot substitute for a member-facing grant. Operational dependence cannot become title by repetition.

The most credible registry will not insist that its authority is obvious. It will publish the trail. That trail allows members to see what they accepted, directors to see what they may change, reviewers to see what they can remedy and the wider Internet to distinguish stewardship from unbounded control.