[arin-ppml] AFRINIC And The Stability Of The Internet Number Registry System

[Ronald F. Guilmette]

In message <F04ED1585899D842B482E7ADCA581B84A9C40DDC at newserver.arneill-py.local>
Michel Py <michel at arneill-py.sacramento.ca.us> wrote:

>+1

I also would like to jump onto this bandwagon and likewise express my
appreciation for John's publication of his missive in support of AFRINIC.

I have a rather special and personal reason to be interested in these matters,
as some of you no doubt know.

As those who know me can attest, I have for many years now been a persistent
critic of essentially all of the organs of Internet governance, including
all of the RIRs and also ICANN.  But I like to think that my criticisms
remain fair and above the belt.  I don't believe in kicking an institution
when it's down, as AFRINIC is, at present.

Also, as many of you surely also know, back in the latter part of 2019, I,
together with my South African journalistic collaborator, Jan Vermeulen
@ MyBroadBand.co.za, publicly exposed the fact that our investigations
had revealed a years-long insider embezzlement scheme within AFRINIC
involving the theft of a great deal of valuable IPv4 address space.

Following those public revelations, the insider responsible was fired
and a police report was filed in relation to that individual's blatantly
criminal activities.  Those activities quite unambiguously consisted of
both (a) assigning himself large swaths of IPv4 address space out of
AFRINIC's free pool and also (b) manipulating the WHOIS records of numerous
long-abandonded AFRINIC legacy blocks so as to effectively cede control of
those blocks to various other parties.

To its credit, in the wake of that scandal AFRINIC conducted a detailed and
conprehensive audit of its records with assistance from APNIC, and made the
results of that audit public.  It also reclaimed into its free pool all or
essentially all of the stolen free pool space that I and Jan had identified
as having been purloined as part of the overall embezzlement scheme.

I only wish that I could say that AFRINIC's Board and management had been
quite so diligent and responsible in the case of the numerous stolen
AFRINIC legacy blocks.  Alas, they have not been, the result being that
many stolen AFRINIC legacy blocks are still in profitable use by the
recipients of those stolen goods to this day... a fact which I continue
to remind everyone about at every opportunity, for all the good it will
do.  (AFRINIC is quite obviously loath to clean up this mess for which
AFRINIC itself is quite clearly responsible.)

Crime on the Internet DOES pay, it seems, as long as one commits it in
connection with abandoned legacy blocks.  But enough about that.  I have
digressed from the real point of this email.

Despite my many disagreements with the various RIRs, e.g. over the provable
thefts of legacy blocks, over their reluctance to do anything about those,
and over what I feel is -all- RIR's pervasive and over-the-top fetishization
of secrecy, I am compelled in the present context to set aside all of those
ongoing concerns and take the side of AFRINIC in all of its several and now
very public legal conflicts.

For those unaware, there are two such conflicts that substantially pre-date
the current multi-pronged legal attacks of Lu Heng / Cloud Innovation
against AFRINIC and its board chaiman and CEO in their personal capacities.

I will not elaborate upon these other two earlier and still ongoing legal
disputes other than to say that both were brought against AFRINIC by what
appear to be disgruntled final recipients of some of the same embezzled
AFRINIC free pool IPv4 blocks that were first identified by myself and
Jan Vermeulen in the fall of 2019, based upon substantial hard evidence.
These two Plaintiffs are obviously unhappy that AFRINIC did the Right Thing
and reclaimed the provably stolen free pool blocks back into the AFRINIC
free pool so that these blocks could eventually be re-deployed for the
benefit the AFRINIC community.

Personally, I think that both of these two lawsuits are somewhere beyond
frivolous and that they are both inevitably doomed to fail, being as they
are simply attempts to misuse and abuse the Mauritian courts to reclaim
clearly stolen goods.  Indeed, it is yet another of my many criticisms
that AFRINIC, for reasons that remain unexplained, has not yet succeded
at persuading the Mauritian courts to flush these meritless actions down
the toliet, where they belong, despite both legal actions having been
pending for numerous months now.

That brings us to the present legal conflict between Lu Heng and his company,
Cloud Innovation, and AFRINIC.

It is hard to competently comment on this legal conflict given that neither
I nor any other non-party has even been allowed to see any of the relevant
legal filings.  Contrary to the default status of court documents in just
about every civilized country, all court documents in Mauritius are sealed
by default and are not considered public documents.  Fortunately however
Lu Heng and/or his various public reprentatives, real or fictitious, have
openly discussed many aspects of Cloud Innovation's multiple Mauritian legal
actions.  Some small clues have also been made public by AFRINIC.  Despite
these limitations, I'd like to just offer up a few observations based on
the limited set of publicly known facts.

Firstly, in my rarely humble opinion, and based upon my own personal past
experience with litigation, it is my belief that when it comes to Cloud
Innovation's $1.8 billion dollar lawsuit against AFRINIC arising out of
AFRINIC's attempts to reclaim the 6,291,456 IPv4 addresses that AFRINIC
previously assigned to the company, Lu Heng hasn't got a legal leg to
stand on.  In fact, I felt so certain of this that awhile back I even
went so far as to draft and post my best attempt at a lawyerly brief in
support of Defendant AFRINIC's (hypothetical) Motion To Dismiss.  This
prior public post of mine provided all of the several reasons why I believe
that Cloud Innovation's primary lawsuit MUST fail as a matter of law:

   https://lists.afrinic.net/pipermail/community-discuss/2021-August/004505.html

The bottom line is that the one and only thing that creates any connection
between Cloud Innovation and AFRINIC is the RSA and the RSA (Section 4(c)(i))
says quite clearly that AFRINIC can take your space back if you start using
it for some purpose(s) other than the one(s) you said you were going to use
it for when it was assigned to you.  That's it.  End of story.

Like a Houdini, Lu Heng is now trying to wriggle his his way free of this
plain English part of the contract, but unfortunately for him, he really
can't.  It's not ambiguous or anything.  As part of his attempts to somehow
wriggle out of the clear and express terms of the contract, he is basically
doing everything he can to throw sand in the umpire's eyes.  He's making
claims that the AFRINIC board has acted in bad faith, that it has acted
in a manner totally outside of community-ratified policy edicts, and that it
has effectively exercised "selective enforcement" against him, in particular,
even though there are lots of other AFRINIC resource holders who, upon careful
review, would also be found to be in violation of the rules.

Personally, I don't think that the Board has acted in bad faith.  It might
perhaps be an arguable point that the Board made some decisions... prudent
decisions... based on facts and evidence in a manner that was not specifically
and explicitly codified into formal policy, but I think that's the whole
point of having a board... so that you have some intelligent and knowledgable
people who can make decisions about the "corner cases" that fall outside of
the normal course of business and/or that fall outside of the written,
codified, and fully ratified policies and procedures.  If codified and
community-ratified policies covered every possible situation and every
possible eventuality, then you wouldn't even need a boad of directors.
You could just feed the facts into an AI that had been given the full set
of RIR policies and out would pop the Right Answer for any given situation,
no matter how bizzare or unique.

In short, board members are there it make decisions.  They aren't just
intended to be potted plants or window dressing.

Lu Heng's point about "selective enforcement" is perhaps his best (and only?)
argument, but even in this case it is, or at any rate should be a loser
in court.  I mean where is it written that life should be fair?  Do we
criticize the FBI and the DoJ for investigating and prosecuting some
specific bank robber if they fail to also investigate a small-time thief
or con-man with equal vigor?  No, of course not.  More to the point, it
is quite certainly *not* a permissible defense in any court of law that I am
aware of to say that if you have comitted some offense you should be set
free just because the authorities were, for whatever reasons, not able
to also and likewise apprehend and prosecute *all* other similar offenders.

There is an old Japanese saying that "The nail that sticks up shall be pounded
down."  Lu Heng made himself a HUGE target by getting himself 6 million+
valuable IPv4 addresses.  To a certain extent, he himself did a lot to
insure that he would be very near the front of the line when AFRINIC started
looking around for comapnies that were breaking the rules.  Now he needs
to live with that outcome, which is at least partially a result of his own
choices.

Finally I would like to discuss the topic of tactics, and the really quite
objectionable means that Lu Heng is employing to achieve his ends.

A former attorney of mine once remarked to me that "A lawsuit is war by other
means."  Based upon my own past experiences with litigation I think this is
accurate.  In civilized societies, no matter the depth of our disagreement,
hatred, or animosity, as civilized men we submit ourselves to a process that
does not involve us meeting on a field to re-enact one of the blood-soaked
battle scenes from the movie "Braveheart" (1995).  It must be noted however
that even in war, there are rules of conduct.  In modern times these have
been codified into the Geneva Conventions, but the concept of limits, even
in time of war, dates back hundreds of years.  Limits dictating what is and
what isn't acceptable behavior in war were even referenced by William
Shakespeare ih his classic retelling of the tale of The Battle of Agincourt
which took place in the year 1415.

I believe that Lu Heng, by his legal actions, has placed himself beyond the
pale of even the civilized form of war that takes place in courtrooms.

Although it is quite certainly Lu Heng's right to legally contest AFRINIC's
recent attempts to reclaim his IPv4 blocks, via the courts in Mauritius, 
there are two related legal actions that he has undertaken, both of which
I personally find reprehensible, uncalled for, and entirely outside of what
I consider civilized behavior.

First, there is this matter of the freeze that was placed by the Mauritian
courts on all or essentially all of AFRINIC's working capital.  Even just
the fact that Lu Heng requested this freeze is a sign of bad faith in my
opinion.  It is one thing to take a party to court in order to secure a
reasonable and fair judgement if that party has in fact wronged you,
economically or otherswise.  It is another thing entirely to prevail upon
some misguided or biased judge in a tricky legal maneuver designed to
totally hobble one's adversary by freezing all of its assets before the
merits of either their case or your's has even been considered in court.
(Note also that Lu Heng obtained this freeze order in an exceptionally
dubious "ex parte" legal proceeding where AFRINIC was not even allowed to
be present to defend itself.)

I remain awestruck by the fact that some judge in Mauritius was persuaded
to enter this freeze order without so much as even making a reasonable
inquiry about the probability, or lack thereof, that AFRINIC was any kind
of a flight risk, or that it might up and disappear, in the dead odf night,
along with all of its operating capital.  If *any* judicial inquiry had
been made about this possibility, the courts would surely have seen that
AFRINIC had been in business in Maurituius for some 17 years, and that it
had offices, desks, chairs, phones, Internet connections, and a staff of
over 50 souls, all of which would have indicated, quite persuasively, that
AFRINIC wasn't going anywhere, and that there was neither need for, nor
cause for its assets to be frozen before it was allowed to make its case
in court.

In short, I have no idea what the judiciary down there in Mauritius has been
smoking, but whatever it is, it must be some potent stuff.  Or perhaps I am
just expecting too much from a little speck of sunswept beaches that, in
total, is 35% smaller than the State of Rhode Island, and which is known
worldwide primarily for those beautiful beaches, along with tax evasion
and money laundering.

In any event, the bizzare and throughly unjustified asset freeze is only
one of the legal actions that Lu Heng has undertaken and which I personally
find reprehensible.

More recently Lu Heng has also filed suit for defamation against both the
Chairman of the AFRINIC board of directors, and also the AFRINIC CEO.  The
damages he is requesting in this separate action are $80 million USD.

REGARDLESS of whether Lu Heng has a valid cause of action in this separate
defamation suit or not, the suit itself certainly give every appearance of
being a legal intimidation tactic, intended to bring additional pressure on
the decision makers at AFRINIC.

Maybe Lu Heng has a valid case for defamation and maybe he doesn't.  As noted
above, even the legal complaint in this separate defamation case is not
available to the public, based on the Mauritian judicial policy of default
secrecy.  It is thus essentially impossible for any non-party to know if
this case has any merit or not.  What can be said is that the -timing- of
this separate suit against the AFRINIC chairman and the CEO, in their personal
capacities, raises the unavoidable question of whether or not the Mauritian
courts are being misused and abused for the improper purpose of intimidation.

To sum up, it is my belief, based upon my reading of the AFRINIC RSA, that
AFRINIC was well within its rights to do what it did as far as reclaiming
Lu Heng's 6+ million IPV4 addresses.  And even if it wasn't, the only
remedy available to Lu Heng is the termination of the RSA contract between
Cloud Innovation and AFRINIC, which is exactly what AFRINIC has been seeking
to achieve anyway.

Separately, Lu Heng's actions in seeking and obtaining a freeze of AFRINIC's
working capital, and his separate legal action against the AFRINIC chairman
and CEO in their personal capacities are both, in my opinion, grotesque
abuses of the Mauritius judicial system, and it is my hope that they will
be seen as such by all parties with an interest in these matters.


Regards,
rfg