The ongoing saga at the African Network Information Centre (AFRINIC), which distributes Internet addresses in Africa, is a threat to the stability of the global Internet and emblematic of Africa’s governance challenges.

Global Internet Addressing System

When you want to visit a Website, you generally use a domain name (e.g., hell.com). The domain name is then translated to an address, called a unique Internet Protocol (IP) address, which every device connected to the Internet has while it is connected. The transport of data between computers connected to the Internet is handled by another service, the Transmission Control Protocol (TCP). Together, TCP and IP, commonly written as TCP/IP, form the workhorse of Internet communication.

The most used version of the IP addressing system is the fourth, called IPv4, which was first adopted on January 1, 1983, by ARPANET, the precursor to the present Internet. The pool of IPv4 addresses is managed by the Internet Corporation for Assigned Names and Numbers (ICANN), a United States-based non-profit organization that helps manage the domain name and addressing systems of the global Internet. Internet Assigned Numbers Authority (IANA), an arm of ICANN whose services are now performed by PTI, an organization under ICANN, distributed IPv4 addresses to network operators around the world through five Regional Internet Registries (RIRs).

The IPv4 address space has 4.3 BILLION addresses, although a significant number of them are reserved for special purposes. However, by the early ‘90s, it was realized that the available pool of IPv4 addresses was being depleted at an unsustainable pace. The new addressing system developed to replace IPv4 is called IPv6 and provides 340 undecillion (or 340 trillion trillion trillion addresses!) To put this number in perspective: if you are paid 390 trillion dollars per hour, you would have to work 24/7 for 100 thousand billion years (not counting the leap years) to earn just under 340 undecillion dollars.

The IPv4 Shortage Crisis

In 2011, IANA staff reported to the IANA Committee of the ICANN board (both of which I was members of at the time) that the last five blocks of IPv4 addresses were distributed to the five RIRs on February 3. In short order and relatively quick succession, the RIRs all reported that they, too, had run out of IPv4 addresses. APNIC, the Asia-Pacific RIR, reported it exhausted its pool in April 2011, while LACNIC and ARIN reported that they had exhausted their IPv4 addresses in June 2014 and September 2015, respectively. In November 2019, RIPE NCC, reported it had run out of IPv4 addresses, and a few months later, the AFRINIC, the RIR serving Africa, said its IPv4 pool was down to about 2 million addresses.

Although the widespread deployment of IPv6 started in the early 2000s, the problem is that it is not backward compatible with IPv4. In addition, many computers and applications use IPv4, meaning that the demand for IPv4 addresses kept increasing as their supply was being exhausted. This created a new market in which the average price of an IPv4 address jumped from $6-$24 per address in 2014 to $23-$60 in 2021.

The African Situation

Africa’s share of IPv4 addresses attracted many dealers, both legit and otherwise. Thus, a 2019 investigation found that huge chunks of IPv4 addresses assigned to South African entities and worth $28.6 million ($33.5 million in 2023) on the open reseller market had either been stolen or were being squatted on by network operators outside the country. Additional investigations found that as early as 2012, an AFRINIC employee who later resigned, was involved in illegal brokering IPV4 addresses worth millions of dollars.

AFRINIC Takes Action Against CIL

AFRINIC addressed the problem in June 2020, and accused Cloud Innovations Ltd. (CIL) of violating AFRINIC rules, as well as the Registration Service Agreement (RSA) which governs the acceptable use of IP addresses allocated by AFRINIC to its members. CIL responded, and vigorously contested AFRINIC’s accusations against it. The issue remained dormant until March 2021, when AFRINIC responded to CIL’s rebuttal. AFRINIC re-stated its claims against CIL, and asked it to provide additional information about their use of the IP addresses allocated to them. Otherwise, AFRINIC threatened, it would terminate the RSA CIL signed with AFRINIC, and the IPv4 addresses allocated to it by AFRINIC would be re-possessed. CIL rejected AFRINIC’s request publicly, saying they were arbitrary and excessive.

CIL sought an injunction from the Mauritius Supreme Court in March 2021, marking the start of a firestorm of litigation in this otherwise peaceful haven. In the 19 months between March 2021 and September 2022, CIL filed 29 applications, petitions, and other complaints to the Mauritius Supreme Court. In addition, Larus Ltd., a Hong Kong-based company to which CIL is affiliated, filed four cases against AFRNIC during the same period. Tellingly, Larus Ltd. and CIL were both founded by Lu Heng, a Chinese national who apparently also has nationalities of ” several countries.”

AFRINIC’s Own Struggles

AFRINIC, on its part, had started to self-destruct about three years before the start of the legal fracas with CIL. In March 2018, the Chair and Vice Chair of AFRINIC’s board of directors stepped down following allegations of sexual harassment of an AFRINIC staff. That, however, did not satisfy many AFRINIC members who in May 2018 voted against all candidates who ran for positions on the AFRINIC board.

AFRINIC limped on and in 2019 got a new CEO, Eddy Kayihura, who had high hopes for the organization. Mr. Kayihura promptly went on to address the theft of IP addresses from AFRINIC and, following a comprehensive audit of AFRNIC’s allocated IPv4 addresses, went after CIL. AFRINIC quickly got stuck in a legal quagmire, with the Mauritius Supreme Court freezing and unfreezing its bank accounts. In a curious twist, Mr. Kayihura dragged AFRINIC to court, and finally exited his position because the AFRINIC did not have a properly-constituted board to renew his contract.

Global Internet Community’s Concerns

Although AFRINIC has not ground to a complete halt, its predicament has worried the global Internet community. In August 2021, the President of ARIN, the RIR for North America, expressed ARIN’s concern about the impact of the litigation against AFRINIC, and the freezing of its bank account on AFRINIC’s operations and possibly, the stability of the global Internet. In the same vein, the Number Resource Organization (NRO), the umbrella organization for the five RIRs wrote to the AFRINIC community in July 2022, expressing their concern about the litigations against AFRINIC, and urging them to “come together to help steer AFRINIC in a positive direction.”

AFRINIC is, as at the writing of this article, still in a limbo, with no CEO, no properly constituted board of directors, and some pending litigations. Although it is paying its staff, its adverse legal situation is not sustainable and could lead to operational failure, according to the President of ARIN in a February 2023 address. Unless something is done to address the situation, AFRINIC could fail to discharge its responsibilities to the global Internet community and threaten the stability of the global Internet. And that would be an unfortunate and avoidable tragedy.