[arin-ppml] Global internet stability is at risk due to AFRINIC's current mismanagement

[Anthony Ubah]

Dear Community,



We are writing this letter to let you know that AFRINIC's recent actions
have brought some serious risks to the hundreds of millions of users of the
Internet Ecosystem.



A global internet depends on cooperation. Being one of five regional
Internet Registries, AFRINIC has the power to delete the registration of
more than a hundred million IP addresses. This power could be  even more
destructive with the addition of AS0 ROAs for space which is disputed or
reclaimed. Therefore, billions users and large scale content and services
that rely on those IP addresses could face instant lost of connection if
AFRINIC starts revoking registrations of its members with IP addresses used
in active service. Such disconnection will disrupt the connectivity of
users as well as impact service at a global scale that has never been seen
in human history.



AFRINIC has been sending the following lines to members who have active
users and service in their IP addresses:



*“(AFRINIC) will in its sole discretion determine whether to immediately
terminate the said Agreement as well as to proceed with the reclaiming of
the aforesaid IP Number Resources.*



*You are further informed that AFRINIC shall not be held liable for any
loss or damage of whatever nature arising out of the present notice or any
action that AFRINIC may take in accordance thereof.”*



We have confirmed that many members have also received such notice on
AFRINIC's pretense of violation of their RSA (Registration Service
Agreement), in addition to their Bylaws, their CPM (Consolidate Policy
Manual). The combined scale of those members services impacts tens of
millions of Internet users and services globally.




AFRINIC's claims were mainly based on the following:



*1.  "Any change in network or service provided, will request AFRINIC's
approval and is subject to re-justification of the allocation.(NOT
assignment)."*



In reality, the CPM has provided a distinctive use of "Allocation" and
"Assignment". Its intended allocations are for general purpose that LIRs
can use or assign (or in some cases sub-allocate) and assignments are made
within an allocation (or directly from AFRINIC to end users) to serve a
specific purpose. To request an LIR to return its allocation when the
specific purpose of the assignment has changed, has never happened in any
RIR, and was never the intention of any RIR policy.



*2.  "AFRINIC space cannot be used outside of the AFRINIC region with the
exception of soft landing space only for the purpose of supporting
connectivity back to Africa. "*



In fact, the community has manifested its consensus regarding the fact that
there is no regional restrictions for the use of IP addresses for pre-soft
landing space. The only territorial restrictions to ever gain consensus in
the community specifically covers space issued after the start of the soft
landing policy which is clearly stipulated under the CPM. Any act by
AFRINIC to disregard this is a blatant act against the community-approved
document, CPM.



3. Multiple AFRINIC resource members have been asked to provide information
about third parties *that are not using addresses issued to said resource
member (e.g. about BYOA(Bring Your Own Address) transit customers).*



In scenarios where one resource member (A) is a customer of another
resource member (B), there have been multiple instances of AFRINIC
demanding that B report utilisation details of A. B is not responsible for
the RIR compliance of B's customers except in regards to space issued to B
under B's registration service agreement (RSA). Hence, AFRINIC's actions
here attempt to force the resource member to violate customer
confidentiality and potentially violate data protection laws. We know of a
number of members whose resource requests have been delayed or denied
pending compliance with such demands. In some cases, AFRINIC has gone so
far as to threaten RSA termination based on failure to comply with these
demands.



*4. "AFRINIC can disconnect millions of users and services without taking
any liability and at their will whenever they would like."*



*(All the references to AFRINIC's claims, in their actual wording that were
sent to the resource members, have been attached at the bottom of this
letter, except for point 4, which was shared at the beginning of the
letter)*



The above claims do not correspond with AFRINIC's governing documents (CPM,
RSA, and bylaw). They are a misinterpretation of those documents that have
led to an incorrect conclusion. Using those claims to manage people’s
network and trying to reclaim people active and legitimately utilised IP
addresses without having any concerns about the end users or services that
are being impacted is a direct and serious threat to the global internet.



We are hoping the global community can realise and act together, to right
this wrong. If you are part of AFRINIC's resource membership, please speak
out and express your need for::



*1.     **The freedom to run your network as you see fit*

*2.     **The ability to protect the internet connectivity of your users.*

3.     *The ability to disclose only that data which is necessary for the
legitimate administrative purposes of the registry.*



The reference details of AFRINIC’s claims are shown as below:



*Point 1:*



*“AFRINIC acknowledges the feedback provided and further takes note that
the current utilisation of the allocated no longer matches the "needs"
expressed when resources were issued, in accordance with the RSA and we
hereby refer you to clause 6(d)(iii) of the RSA; which your organisation
signed, thereby acknowledged and agreed that the “right of use” of IP
Number Resources is bestowed within the ambit of the “need” which is*
*justified
in its application and for no other purpose during the currency of the
present agreement.”*



*Point 2:*

*“AFRINIC space cannot be used outside of the AFRINIC region with the
exception of soft landing space only for the purpose of supporting
connectivity back to Africa according to section 6 of the bylaw"*



Section 6 of the bylaws only states what type of membership each entity
qualifies for and the requirements of said membership, nothing about IP
usage. The relevant portion of section 6 is below:



6.1) Subject to the other provisions of this Article, membership shall be
open to:

●      Any Person who is geographically based within, and providing
services in the African region, and who is engaged in the use of, or
business of providing, open system protocol network services; or

●      Any other Person who is approved by the Board or the members.



*Point 3:*



AFRINIC requests the following information to its member regarding a
customer that does not use his AFRINIC IP:



*“Kindly provide the name and the actual service being provided to that
client. Moreover, please share with us the reason that the client gave to
justify their need for a third-party AS number. You may alternatively share
the agreement which you have with that particular customer.”*




The signatures of dozens of community members and resource members are
attached in the Google drive link below :
https://drive.google.com/drive/folders/1-4ihJZjnDpca4F0JUL8N3yY_eoGhiEjX?usp=sharing



Regards,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20210708/b56f80b9/attachment.htm>