AFRINIC corruption: what AFRINIC’s own audit found

By AFRINIC’s own account, millions of addresses were taken inside AFRINIC.

In January 2021 AFRINIC published the result of an audit of all its IPv4 number resources. It found 2,371,584 IPv4 addresses “misappropriated from AFRINIC’s pool of resources and attributed to organisations without justification”. The misappropriation, AFRINIC wrote, had come to light around mid-2019, and among the measures it announced in response was a fraud and corruption policy. None of this is our finding. It is AFRINIC’s own, about its own house.

AFRINIC’s own account points to a former employee.

It says that, following its own investigation, “a former employee was found to have misappropriated IP number resources” from its pool, and that the matter was reported “to the Mauritian Central Criminal Investigation Division”. The addresses were taken from the registry’s own pool and attributed to organisations “without justification”. Those are AFRINIC’s own findings, about its own house.

2,371,584 IPv4 addresses from AFRINIC’s pool, by AFRINIC’s own count.

Of these, AFRINIC said it had reclaimed 1,060,864, while 1,310,720, “related to two distinct organisations”, were still to be reclaimed. The audit also reports 1,799,168 legacy addresses that “appeared to have been compromised”, 936,704 of them “currently under dispute”. A registry exists to keep one record accurate. By its own audit, millions of addresses went astray inside this one.

No.

AFRINIC registered every address we hold, through its own process, to a member it has had since 2013. The complaint of AFRINIC’s management against us was never theft: it was about how AFRINIC’s own rules should be read. AFRINIC’s published account of its audit names no company. When AFRINIC’s management moved to end our membership, the Supreme Court of Mauritius stopped it three times.

Not by the record of the Supreme Court of Mauritius.

On 25 November 2024 the Official Receiver told the Court that, despite his instruction to AFRINIC’s staff, “seven IP addresses have been issued without my permission” between 15 and 31 October 2024. At the same hearing the Court recorded his undertaking that members admitted without his consent since 19 September 2023 would have no vote. By then AFRINIC had too few directors to act and no chief executive, and the Court had placed it in receivership.

As things stand, no one answers to AFRINIC’s members for it.

AFRINIC’s contract caps its liability to a member at six months of fees or 100 USD, whichever is greater. Its register of members, by the Registrar of Companies’ record of 28 October 2026, names eight directors and one company, and on our information more than 2,000 resource members have been left off it. A member left off the register is left without the rights that come with it. Power that answers to no one does not stay clean.

Members with real rights, and a registry that only keeps the record.

Every eligible Resource Member should be recognised under company law, entered in AFRINIC’s register of members and protected by the rights that come with it, as we said on 1 November 2026. Elections should be held under AFRINIC’s constitution, as the Court ordered. And a registry should do one thing: keep an accurate record of who holds which addresses. A registry that answers to its members and to the Court has no room for what AFRINIC’s audit found.