Concerns Grow As AFRINIC’s Funds Are Frozen Over IPv4 Dispute
Summary
Africa’s regional internet registry, AFRINIC, is involved in a legal dispute over an increasingly valuable commodity: IPv4 address space. Kentik’s Doug Madory takes a deeper look at what’s happening.
An evolving legal dispute involving AFRINIC, Africa’s regional internet registry, has led to the freezing of the organization’s bank account and concerns about the stability of the continent’s internet operations. How did we get here?
What Are the RIRs?
The global internet is administered by five regional internet registries (RIRs): APNIC, ARIN, RIPE NCC, LACNIC and AFRINIC. These registries are nonprofit companies charged with managing the distribution and assignment of the IP addresses and AS numbers allocated to their respective geographic regions as illustrated in the graphic below.
South African tech publication MyBroadband explained it this way, “If IP addresses are internet real estate, then AFRINIC’s Whois database is like the deeds office for all of Africa and the Indian Ocean region.”
Last month, the internet “deeds office” of Africa attempted to reclaim IPv4 addresses that AFRINIC had determined to be inappropriately allocated. The company with the disputed addresses filed a claim for damages against AFRINIC and a court in Mauritius (where AFRINIC is based) ordered the freezing of the registry’s bank account up to $50 million.
In response, AFRINIC CEO Eddy Kayihura published this video on the organization’s YouTube channel assuring the continued operation of the registry despite the unprecedented legal situation.
IPv4: An Increasingly Valuable Commodity
In 2015, I authored one of the first analyses of the new private market for IPv4 address space. As the available supply of IPv4 addresses became exhausted and IPv6 adoption lagged, the demand for IPv4 naturally increased. Markets were established and what had once simply been a network configuration setting was now an increasingly valuable virtual commodity.
The dramatic increase in value led to a burgeoning industry of IPv4 brokers as well as those who would attempt to obtain IPv4 directly from registries through duplicitous means.
In 2019, the Department of Justice indicted a man in South Carolina for fraudulently obtaining over 700,000 IPv4 addresses from North American registry ARIN estimated to be worth between “$9,850,880 and $14,397,440.”
In a Lightning Talk at LACNIC in 2018, Etienne Sharp blamed “ghost companies” for spiriting into Latin America, setting up virtual offices to obtain precious IPv4 address space at little cost, and then proceeding to use the address space outside the LACNIC region. Russian security company DDoS-Guard (aka Dancom) was one of those ghost companies in Etienne’s presentation, and earlier this year, LACNIC revoked its right to use the address space it obtained from Belize.
And finally in 2019, internet researcher Ron Guilmette’s analysis uncovered the “Great $50M African IP Address Heist” in which an AFRINIC employee had been selling large amounts of the region’s IPv4 address space for personal profit. It was also Ron’s analysis that contributed to LACNIC’s decision to revoke DDoS-Guard’s address space.
Since that “heist,” AFRINIC had a change in leadership and has been working to tighten up its controls around IPv4 allocation. It was this work that led it to revoke the address space of Cloud Innovation Ltd. That Cloud Innovation’s IPv4 space is used outside the AFRINIC region is clear and verifiable — several major U.S. telecoms announce the space on behalf of their U.S. customers. The case hinges on whether the allocation of the address space violated AFRINIC policies, as written years ago.
Statements of Concern
The Internet Society issued a statement this week on the AFRINIC situation expressing their concern that “any interruption in AFRINIC’s operations due to ongoing litigation could have a significant negative impact on not only the stability of the African internet registry, but also on the billions of people who use the Internet worldwide.”
The Internet Service Provider’s Association of South African put out their own statement adding that “a stable, reliable, and efficient regional internet registry that engages with the community in an honest and transparent manner is in the best interests of all African internet users. ISPA hopes that any litigation that threatens this can be swiftly resolved, so that AFRINIC can continue to provide services to its members, internet resource holders and the broader community.”
There is more at stake beyond the particulars of the IPv4 address space in question. Specifically, can AFRINIC enforce its tighter controls governing IP address distribution for Africa and the Indian Ocean without risking a court order to freeze its operating budget? The fate of AFRINIC and the administration of the internet in Africa are now in the hands of the Mauritian courts. Stay tuned.
