Mauritius Probes AFRINIC as African Allies Back Elections

Ongoing Struggles and Investigations at AFRINIC

The African Network Information Centre (AFRINIC), one of the five regional internet registries globally, is currently under scrutiny following an investigation initiated by the government of its home country, Mauritius. This development has sparked renewed concerns about the organization’s stability and operations.

AFRINIC is responsible for managing IP addresses and autonomous system numbers across 54 countries in Africa and the Indian Ocean. However, the organization has long been plagued by internal dysfunction. Since 2022, it has operated without a board, and recent events have only deepened the crisis.

In June, AFRINIC held an election, but the process was later annulled due to “potential irregularities related to voter documentation.” The receiver overseeing the election provided no further details on the matter. In mid-July, the receiver mentioned that complaints about the election had been submitted to authorities, with the police conducting an investigation. As a result, the receiver has refrained from commenting on the annulment and instead scheduled a new election for August 29.

A week after this announcement, the Mauritian government issued a notice declaring AFRINIC a "declared company." Under Mauritian law, this declaration suspends existing court cases involving the company and makes it difficult to initiate new ones. It also triggers a government-commissioned investigation into AFRINIC's affairs.

The decision to declare AFRINIC was partly driven by concerns over the registry's inability to fulfill its core functions, such as assigning new IP address blocks to African network operators. This has raised questions about the effectiveness of the nation's legal system. Additionally, a member of AFRINIC, Cloud Innovation Ltd, a Seychelles-based company involved in past disputes with AFRINIC, filed an application to have the registry wound up.

The government's proclamation, which outlines the terms of the investigation, appointed Puisne Judge N. F. Oh San-Bellepeau to conduct the inquiry and submit a report by September 30. Among the matters to be examined are the legality of court decisions regarding AFRINIC and whether the receivers fulfilled their responsibilities. The judge will also investigate whether Cloud Innovation’s petition for winding up the company is frivolous and lacks legal basis.

Cloud Innovation has not directly commented on these developments, but its CEO, Lu Heng, directed inquiries to Blue Tech Wave Media, a publication that has published articles supporting Cloud Innovation and criticizing AFRINIC. The site describes AFRINIC as broken beyond repair.

Despite these criticisms, several African institutions have expressed support for AFRINIC. The African Union, representing 55 African nations, called for stakeholders to sustain AFRINIC’s operations and ensure Africa's internet stability. Smart Africa, an alliance of 40 nations focused on advancing economic development through technology, also supported AFRINIC and commended Mauritius for granting the registry “declared” status. The group urged AFRINIC to follow its bylaws as it prepares for the upcoming elections.

AFRINIC has taken steps to educate members about the August elections, which will be conducted entirely online, requiring voters to register before the poll. However, there have been concerns about whether these arrangements comply with AFRINIC’s bylaws. The organization has created a voter registration portal to facilitate the process.

Recently, a post on the African Network Operators Group mailing list raised concerns about a potential security vulnerability on the portal. The post claimed that unauthenticated users could access personal information of registered voters. AFRINIC denied the existence of a vulnerability, stating that the information seen by the user was a test nomination created internally by staff.

The organization explained that each document uploaded to the platform contains a unique 39-character ID, making it impossible to guess or enumerate through automated means. It also noted that the site does not permit listing or browsing. AFRINIC suspects that the only way the test files were accessed was through an insider sharing the URL.

Amidst all this uncertainty, three key dates will shape AFRINIC’s future. The first is August 29, when the new election will take place. The second is September 30, the deadline for the judge’s report. The third will occur in late 2025, when the Number Resource Organization (NRO) finalizes a revised policy on handling dysfunctional registries, including de-recognizing them. Internet governance bodies have indicated that this policy was largely influenced by the challenges faced by AFRINIC.