In recent weeks, network operators across Africa have been receiving emails that look, at first glance, routine. The subject lines are familiar, “IP Resources Protection for AFRINIC Members” and “NRS Advisory,” the kind of administrative language that rarely invites scrutiny. The messages, signed by Abdellatif Hddine of the Number Resource Society, propose brief online meetings and promote an “NRS Shield” programme built around a Power of Attorney framework, presented as a safeguard for IP resources. In another moment, such outreach might have passed as ordinary commercial solicitation.

But this is not an ordinary moment for AFRINIC. The Regional Internet Registry serving Africa and the Indian Ocean region is emerging from years of litigation, disrupted governance, and a prolonged receivership that has tested the resilience of the global registry system. Its board has warned members of a “web of litigation and procedural roadblocks,” urging caution in the face of representation requests and legal instruments. In that context, even a single email is no longer just a message, but part of a broader and unsettled governance landscape.

This context matters because what NRS is asking for is not a newsletter subscription or a webinar registration. NRS’s published materials present the Shield as a mechanism for coordinated representation in registry disputes through executed powers of attorney. AFRINIC’s court-appointed Receiver and AFRINIC’s subsequent communications have warned members about precisely this kind of outreach, stating that AFRINIC has no affiliation with NRS and urging vigilance when approached to sign documents delegating authority.

The obvious question is why a third party would seek, at scale, to insert itself into the legal and governance relationship between AFRINIC and its members at the very moment AFRINIC is trying to restore operational normalcy, implement policies ratified through the Policy Development Process, and conduct a bylaw review intended to close governance gaps exposed by the crisis.

This investigation examines what is publicly known about NRS, what is verifiable about its claimed identity and footprint, how its messaging intersects with AFRINIC’s bylaw review and transfer policy, and why many African Internet governance actors increasingly interpret this outreach through a geopolitical lens that includes China. The purpose is not to criminalise advocacy or to delegitimise dissent. It is to document the mechanism, assess the evidence, and describe the risks that AFRINIC members should understand before they sign anything.

A registry in recovery and a new policy flashpoint

AFRINIC is in the middle of a governance repair process that is unusually visible, unusually legalised, and unusually consequential. When the Supreme Court of Mauritius appointed a Receiver to “hold the ring” while disputes played out, the registry’s normal institutional rhythms were disrupted in ways that the global number resource system was never designed to absorb for long. One does not need to endorse every decision AFRINIC has made to recognise the systemic risk: if an RIR can be immobilised by litigation and procedural obstruction, the precedent does not stay regional. It becomes a stress test for the entire registry order.

Against that backdrop, AFRINIC’s decision to restart policy work and to initiate a bylaw review has become a new flashpoint. In February 2026, AFRINIC published a communiqué responding to what it described as “mischievous allegations” circulated by non AFRINIC sources about the ratification of Policy 2020 GEN 006 D3, AFRINIC’s updated number resource transfer policy.

Who is NRS and what can be verified

NRS presents itself as a global nonprofit membership organisation that “campaigns” so that businesses can “own” IP addresses. On professional networking platforms, NRS describes itself on LinkedIn as a nonprofit headquartered in Casablanca. Those claims are not inherently suspicious. Many legitimate civil society initiatives have small teams and evolving structures. What makes NRS unusual is not its stated mission but the timing of its emergence, the opacity of its leadership, and the way its infrastructure and messaging repeatedly intersect with the same commercial dispute that has paralysed AFRINIC.

A detailed investigation by The Register traced NRS’s emergence to the period when AFRINIC and Cloud Innovation were already locked in legal conflict and described the group’s operations as opaque, including an approach in which public commentary is often unattributed to identifiable individuals. The same reporting documented a key detail that can be checked directly through archives. In a September 2021 snapshot preserved by the Internet Archive, the NRS website listed its address as Flat A3, 11/F, TML Tower, Tsuen Wan, N.T, Hong Kong.

That archived address matters because it sits inside the same commercial and organisational gravity field as the AFRINIC dispute itself. The Register reported that the Hong Kong address matched that of Larus Limited, a company whose CEO is Lu Heng and which has publicly described itself as a partner of Cloud Innovation in providing IP leasing services.

NRS’s policy programme, as described both by its own content and by external reporting, is not limited to member education. It advances an explicit argument that IP addresses should be treated as tradable assets, with registries reduced to a thin bookkeeping role, and it has linked that vision to the need for bylaw changes. The ambition is structural. If adopted, it would shift the RIR model away from stewardship toward property-style commodification.

NRS’s claimed African footprint has also been difficult to verify in the ways that normally matter for institutional accountability. In earlier work I published on CircleID, I described how a court bailiff verification in Casablanca, dated 29 July 2025, recorded an attempt to locate NRS at an address publicly associated with the organisation, 133 Boulevard Ziraoui, and found no sign indicating NRS’s presence at that location. I treat that verification report as primary material on file. The point is not that an address discrepancy proves illegality. It is that, for an organisation soliciting powers of attorney from regulated operators, the inability to validate basic institutional presence in the jurisdiction it claims as its headquarters is a governance red flag.

The outreach email I reviewed is consistent with the pattern AFRINIC warned about. It positions AFRINIC governance developments as a new risk environment, offers a short briefing, and then steers the recipient toward the Shield programme and its Power of Attorney mechanism. AFRINIC has explicitly urged members to “seek information through official communication channels” and to be careful about signing representation documents pushed through non-official campaigns, particularly in the heated debate around the new transfer policy and bylaw review.

The market behind the emails

To understand why a “protection” email can be strategically significant, one has to understand the economics that sit underneath AFRINIC’s crisis. IPv4, the older version of the Internet Protocol, provides a finite pool of addresses. Scarcity has been a policy problem for decades, long enough that intergovernmental bodies analysed the implications of depletion and the transition to IPv6 as early as 2008.

Scarcity did not eliminate demand. It redirected it. As pools depleted across the RIRs, transfer mechanisms and a secondary market expanded, mediated by policies designed to preserve registry accuracy and prevent fraud while allowing addresses to move toward networks that still needed them.

In Africa, the market dynamics were amplified by history. AFRINIC was created later than other registries and managed a comparatively small share of global IPv4 space. That meant it held the last meaningful pool of IPv4 addresses available through allocation fees rather than market prices, a gap that created arbitrage incentives. The Internet Governance Project at Georgia Tech described the AFRINIC crisis in 2021 as inseparable from that structural gap between market value and registry pricing.

AFRINIC itself has long documented the exhaustion problem and the transition into a post exhaustion environment. In practical terms, once the pool runs dry, the registry’s stewardship function becomes less about issuing new blocks and more about maintaining the integrity of registration data, enforcing contractual compliance, and ensuring that transfers follow policy rather than private pressure.

NRS’s intervention is not abstract. On its own site, NRS has characterised AFRINIC’s ratified transfer policy as a “lock in mechanism” that would reduce the liquidity and market value of IPv4 addresses, and it has framed the bylaw review as part of the same struggle over “exit” and leverage. In the same notice, NRS embedded a link to a note authored by Lu Heng and labelled him as CEO of Larus Limited. Whatever one thinks of the economic argument, the attribution makes a basic point difficult to ignore. NRS is not merely an outside observer. Its narrative and its mobilisation sit in close proximity to the commercial actor most closely associated with the underlying AFRINIC dispute.

AFRINIC’s public documentation of the dispute identifies Cloud Innovation Ltd as a central litigant. In an August 2022 communiqué, AFRINIC stated that Cloud Innovation had been allocated 6.2 million IPv4 addresses and described the company as being “owned and controlled by a Chinese national.” AFRINIC has also documented Cloud Innovation’s July 2025 winding-up petition against the registry, a step that carries existential implications for Africa’s sole Regional Internet Registry.

In March 2026, AFRINIC’s board stated that since it attempted to bring Cloud Innovation into compliance with the Registration Service Agreement, AFRINIC has been subjected to a “relentless barrage” of legal actions, and it explicitly linked ongoing procedural roadblocks to Cloud Innovation Ltd, Larus Ltd, and “associated advocacy campaigns.” This is an important institutional statement. It places advocacy-style mobilisation in the same ecosystem as litigation, not as a separate civic conversation.

NRS has also acted in ways that align it publicly with Lu Heng’s institutional ambitions beyond Africa. On an NRS page dedicated to APNIC’s 2025 Executive Council election, NRS published a candidate profile for Lu Heng describing him as CEO of Larus Limited and reproduced nomination statements from multiple organisations, including Huawei International Pte Ltd. Again, the point is not that any nomination proves coordination. It is that NRS is building an ecosystem of legitimacy for a figure whose commercial interests sit at the heart of the AFRINIC dispute, while simultaneously approaching AFRINIC members to sign powers of attorney in the name of collective protection.

The clash is not simply about personalities. It is about whether AFRINIC, like the other RIRs, can maintain a policy boundary between legitimate transfers and speculative extraction. AFRINIC’s ratified transfer policy explicitly allows intra regional transfers, recognises legacy holders, and permits inter RIR transfers only under specific conditions, while also stating that AFRINIC-issued IPv4 from the pool cannot be transferred out of the region. That policy rationale is conventional within the RIR system: to enable redistribution while maintaining accurate registry data and reducing undocumented transfers that can compromise routing stability and legal certainty.

NRS, by contrast, frames the same policy choice as a direct threat to what it calls “IPv4 value” and has urged members to treat it as a balance sheet risk rather than a stewardship measure.. In other words, the email invitation to discuss “new Internet governance policy risks” is not neutral education. It sits inside a dispute over whether the RIR model should prioritise developmental stewardship or asset liquidity.

For the wider registry system, one of the most consequential interventions came not from Africa but from ARIN, the Regional Internet Registry for North America. In August 2021, ARIN’s President and CEO, John Curran, published an unusual public note on AFRINIC’s dispute with Cloud Innovation, warning that the litigation had the potential for “significant impact” on the stability of the global Internet number registry system. Curran wrote that Cloud Innovation was operating out of the Seychelles under the control of Lu Heng, and that ARIN had “first hand experience” with his business practices, including an approach by one of his companies in 2013 seeking more than 1 million IPv4 addresses from ARIN.

The dispute with Cloud Innovation illustrates how the IPv4 transfer economy can collide with the RIR stewardship model. AFRINIC’s August 2022 communiqué recounts that the registry challenged Cloud Innovation’s compliance with the Registration Service Agreement and that the conflict escalated into extensive litigation that affected operations. Independent reporting has also documented the operational consequences of that escalation, including court orders that froze AFRINIC’s bank accounts.

Within the technical community, the dispute also became a proxy argument about where stewardship ends and market freedom begins. Milton Mueller and colleagues at the Internet Governance Project characterised the conflict as driven by arbitrage opportunities created when AFRINIC issued IPv4 space at low administrative fees while global market prices for IPv4 were rising. They described Lu Heng as a Chinese entrepreneur who registered Cloud Innovation in the Seychelles and acquired millions of IPv4 addresses from AFRINIC in 2016, which the analysis argued were subsequently leased to customers on commercial terms. Cloud Innovation and Larus have disputed key aspects of AFRINIC’s claims and of external commentary, arguing that AFRINIC’s enforcement approach was selective and that tracking every customer’s geographic use is infeasible in a dynamic environment.

NRS’s rhetoric and strategy can be read as a continuation of that policy argument, but with a sharper mobilisation edge. The Register documented NRS advocating for a future where internet service providers “outright own” IP addresses and can trade them freely, while RIRs merely ensure correct registration and uniqueness. That is a material redesign of the registry model, not a marginal reform. It would also neutralise, by design, many of the contractual enforcement tools AFRINIC invoked when it challenged Cloud Innovation’s out of region leasing and compliance. In that sense, the policy worldview advanced by NRS aligns neatly with the interests of actors whose business depends on treating AFRINIC issued IPv4 space as globally tradable inventory.

The Power of Attorney element is therefore not a procedural footnote. It is a lever. A POA can consolidate representation, coordinate litigation, and centralise decision-making in a way that changes the internal balance of a membership organisation. AFRINIC’s Receiver warned members that AFRINIC does not endorse NRS’s representations and urged members to be vigilant if asked to delegate voting or decision-making authority. In the AFRINIC context, where governance legitimacy has already been litigated and election procedures have been contested, any mass delegation mechanism becomes part of the political economy of registry control.

Why this now reads as geopolitics

AFRINIC is not a peripheral technical association. It is part of the global coordination layer that makes the Internet function as a unified network. Its service region covers Africa and several island economies in the Indian and Atlantic oceans. Its recognition as a Regional Internet Registry sits inside the global governance framework established by ICANN’s criteria for RIRs and IANA’s allocation functions.

That is why global institutions have treated the AFRINIC crisis as a system-level concern rather than a regional inconvenience. In June 2025, the Number Resource Organization, the coordinating body for the RIRs, issued a public statement on AFRINIC elections stressing that trust in RIR governance is essential “not only for AFRINIC’s community but for the stability and cohesion” of the global number resource system.

Against this institutional background, the nationality of key actors has become politically salient. AFRINIC has described Cloud Innovation as “owned and controlled by a Chinese national.” ARIN’s CEO described Cloud Innovation as operating out of the Seychelles under the control of Lu Heng, who he said resides primarily in Hong Kong. NRS’s early web archive footprint pointed to a Hong Kong address.

These facts do not, by themselves, prove state direction. A Chinese passport is not a government instruction. But the AFRINIC dispute is unfolding in a wider strategic environment in which Chinese state-backed finance and Chinese firms have secured deep positions in African digital infrastructure. A Council on Foreign Relations working paper on China’s “Digital Silk Road” in Africa documents how Chinese companies, including Huawei, ZTE and China Telecom, have been instrumental in building backbone networks, last mile infrastructure, data centres and submarine cable projects, often enabled by state linked financing mechanisms that advantage Chinese vendors in procurement and standards setting.

In that environment, it is unsurprising that many African policymakers and technical community actors interpret the campaign around AFRINIC through a geopolitical lens. The core concern is not that China is secretly controlling AFRINIC. The concern is that a prolonged destabilisation of Africa’s sole RIR, combined with an advocacy ecosystem that normalises treating African-issued IPv4 space as a globally tradable commodity, can function as a form of external leverage over Africa’s digital sovereignty regardless of whether it is coordinated by the Chinese state. That leverage can be commercial, informational, and legal at the same time.

The IPv4 market has always had two layers. There is the formal layer, where transfers are recorded in registry databases under policies designed to preserve accuracy and prevent fraud. There is also an informal layer, where addresses can be leased, sub-delegated, or operationally controlled by parties that do not appear in the authoritative registration record. The informal layer thrives in precisely the situations AFRINIC has faced: scarcity, high switching costs, and uneven enforcement capacity. It is also a layer that can distort policy debates, because the most financially motivated actors have incentives to keep stewardship constraints weak and registry validation thin.

AFRINIC’s own transfer policy overview makes the link explicit. It describes the unified transfer policy as a way to “reduce informal or unregistered transfers” that could compromise legal certainty and registry integrity, and it frames accurate WHOIS and RDAP data as a public trust function. AFRINIC also maintains a formal resource transfer process and documentation for members seeking legitimate transfers under policy.

The scale of Lu Heng’s involvement is one reason the informal market question became political. ARIN’s CEO stated that Cloud Innovation received 6.2 million IPv4 addresses from AFRINIC in four installments. AFRINIC’s 2022 communiqué uses the same 6.2 million figure and ties it to a compliance dispute and litigation. In a market where individual IPv4 addresses have measurable and rising prices, aggregations at that scale create both commercial leverage and policy leverage.

This is where NRS’s positioning becomes easier to interpret. Its Shield programme, its messaging about “assets,” and its calls for coordinated legal action do not simply respond to registry instability. They also advance a narrative in which the registry’s stewardship role is redefined as illegitimate “thick control” over valuable operator-held resources. That rhetorical move has a predictable effect. It shifts the debate away from whether registry data is accurate and whether allocations followed policy, and toward whether registries should be allowed to enforce any constraints that could reduce the market liquidity of IPv4 space.

What members should understand before signing anything

For AFRINIC members, the most immediate and practical issue is not global theory. It is risk management. A message that promises “free legal protection” and “coordinated representation” can be attractive in a crisis. But it can also create new exposure. A Power of Attorney is a legal instrument. It can change who speaks for you, who receives sensitive information, and who can act in your name. In the AFRINIC context, where litigation has already been used as a strategic instrument and where institutional legitimacy is under review, delegation at scale can also shift governance outcomes.

AFRINIC’s Receiver and board have repeatedly urged members to rely on official channels for information about policy and governance. That is not a bureaucratic reflex. It is an attempt to preserve a single authoritative record during a contested period.

The deeper reason the African community should pay attention is that AFRINIC’s crisis has become a case study in how institutional capture can be attempted through a blended strategy. Litigation consumes time and freezes governance. Advocacy platforms flood the information space with a narrative that delegitimises stewardship and reframes enforcement as coercion. Recruitment emails solicit legal delegation mechanisms that can consolidate representation and coordinate pressure. None of these elements needs to be illegal to be effective. The mechanism works through asymmetry: asymmetry of resources, asymmetry of legal risk, and asymmetry of information.

A registry is a trust institution. Its value lies not in its bank accounts but in the credibility of its database and the legitimacy of its processes. AFRINIC’s bylaw review is an attempt to rebuild that legitimacy through institutional redesign and member consent. If African operators disengage, the vacuum will be filled by those with the strongest incentives and the most sophisticated mobilisation capacity.

The practical conclusion is not to panic. It is disciplined participation. When AFRINIC members receive outreach that claims to speak for the registry, to defend them against “new Internet governance policy risks,” or to offer representation through powers of attorney, they should treat it as a signal of contestation and verify it through AFRINIC’s official communications and established community processes. The long-term stake is larger than any single email. It is whether Africa retains credible stewardship over its own critical digital resources, and whether the global RIR system remains resilient when confronted with coordinated pressure that operates simultaneously through courts, markets, and narrative.