How A Dispute Over IPv4 Addresses Blew The Lid Off An Effort To Reshape Global Allocation

Special report Two of the world's five regional internet registries – which among other things manage the allocation of IP addresses – are in the sights of a secretive lobby group: the Number Resource Society.

We have learned the NRS hopes to steer this allocation of scarce and valuable IPv4 addresses through various pressure tactics.

The society makes questionable accusations – claiming for instance the organizations that oversee the running of today's 'net, as well as their leaders, wish to "destroy the entire internet" for personal gain. The NRS also criticizes those governance organizations' structures and oversight, often on spurious grounds. Yet the society's own operations are utterly opaque: it won't even put a name to its commentary.

The NRS’s president – its sole identifiable officer – did not respond to multiple requests for comment from The Register, save for one occasion when we pointed out he had been removed from the society's website.

Strangely, NRS president Paul Wollner is not even the society's most visible member or advocate.

That role goes to Lu Heng – an entrepreneur with a long and colorful history of agitating for change in the internet governance world, who has publicly stated that today's oversight bodies are redundant and should dramatically scale back their activities.

The society represents a determined effort to reshape how the world allocates its remaining IPv4 addresses, taking that process away from regional internet registries.

The NRS appears to be well-funded, and it is relentless. The society's conduct and connections led The Register to believe it is likely not the grassroots lobby group it paints itself to be, but a vehicle for commercial entities that would profit from its desired reinvention of internet governance.

It began in Africa

The NRS emerged in the second half of 2021, after the affairs of the African Network Information Centre (AFRINIC) again became controversial.

AFRINIC is one of the world's five regional internet registries, or RIRs: AFRINIC; Asia-Pacific's APNIC; North America’s ARIN; Europe’s RIPE; and Latin America’s LACNIC. These are the organizations that manage, allocate, and track the use of internet number resources – IP addresses and autonomous system numbers. The RIRs are membership-based organizations, and develop and police policies based on consensus.

The African registry has a history of dysfunction, and in 2019 appointed a CEO whose reform agenda included an audit of the resources AFRINIC administers, to ensure they had been properly allocated according to its policies and were being used appropriately.

The audit found various issues, including internal corruption that led to inappropriate allocation of IP addresses by an AFRINIC staffer.

In June 2020, in an action unrelated to its discovery of its own staff making inappropriate IP address allocations, AFRINIC management wrote to an organization called Cloud Innovation to which it previously granted the rights to use more than seven million IPv4 addresses. Cloud Innovation's CEO is Lu Heng, who also leads the NRS's most visible member company, Hong-Kong-based Larus Limited.

AFRINIC's letter alleged Cloud Innovation had breached an agreement with the RIR, with actions including leasing IPv4 addresses to entities outside the geographic area AFRINIC serves. The registry also claimed Cloud Innovation applied for the addresses for reasons that were later changed once they were leased. If Cloud Innovation failed to satisfy AFRINIC, it could lose those IP addresses it was leasing out.

(Representatives for Larus told us in their view AFRINIC's enforcement of its rules on what IP addresses can be used for was selective, and that it was infeasible for Cloud Innovation to tell the RIR about the ultimate use of each and every IP address by its customers.)

Leasing or reselling IP addresses is contentious, because RIRs consider them to be a resource allocated to those who need them – not a commodity to be traded.

But there are plenty who are willing to pay for leased IP addresses – especially IPv4 addresses, as only just under 4.3 billion will ever be available in total. In practice, the number actually usable on the public internet is much less. The vast majority of these addresses have been allocated and are either in use, or hoarded by those who were granted rights to the resources.

IPv4's successor, IPv6, was designed to offer as many as 3.4×10³⁸ addresses – enough to last for centuries. But IPv6 isn't backward-compatible with IPv4, and a good number of users of the older protocol don't want to go through the pain of reconfiguring their networks and are instead trying to acquire as many IPv4 addresses as possible to meet their future needs.

Some of those who hold more IPv4 resources than they need for operational purposes therefore make them available on secondary markets.

RIRs allow transfers of IP addresses and charge modest administrative fees to facilitate them. They also approve third-party brokers to handle some transfers. But they are not in favor of leasing IP addresses. RIRs mostly tolerate leasing, even though their policies don't explicitly allow it. Debate continues about whether RIRs should change those policies.

While that happens, the seven million IPv4 addresses Cloud Innovation sourced from AFRINIC remain rather valuable. Given its concerns, AFRINIC wanted to clear things up, and maybe even take them back.

Three researchers from the Internet Governance Project (IGP) at Georgia Tech's School of Public Policy in the US – Milton Mueller, Vagisha Srivastava, and Brenden Kuerbis – analyzed Cloud Innovation's activities and found it leases IPv4 addresses for $2 to $3 apiece, per year, and believe the company’s fees to AFRINIC are around $10,000 a year. (Cloud Innovation told us the fees are $38,400.)

"So, do the math," the researchers wrote in 2021. "Seven million numbers leased at just $2/year can generate upwards of $14 million in revenue."

'Legal terrorism'

Opinion varies on AFRINIC's decision to challenge Cloud Innovation and its threats to deallocate those seven million IP addresses.

John Curran, CEO of the American Registry for Internet Numbers (ARIN), described the face-off as a "not uncommon" dispute of a sort that sometimes emerges between RIRs and their members.

The Internet Governance Project's researchers called AFRINIC's confrontation of Cloud Innovation an "overreaction to its past problems and was undertaken without appropriate risk management." They then labelled Cloud Innovation's response to Africa's RIR as "legal terrorism … designed to destroy AFRINIC rather than to preserve its legitimate business interests in a contractual dispute."

Cloud Innovation did not appreciate AFRINIC's threats. It insisted it was not in breach of any agreements, and that any attempts to regulate it were inappropriate overreach. The firm launched a complex series of connected lawsuits against AFRINIC, one of which resulted in an injunction to freeze the registry's bank account.

That decision, for what it's worth, is one of several in which Mauritian courts have found in favor of Cloud Innovation. One such decision found that AFRINIC’s actions may not have afforded due process to Cloud Innovation.

In any case, Cloud Innovation had been allocated millions of IPv4 addresses by AFRINIC, and it wasn't about to let them go easily.

Among AFRINIC's responses to Cloud Innovation's legal war was an August 2021 accusation [PDF] that it believed Cloud Innovation's customers used leased IP addresses for activities that "relate to illegal gambling, illegal streaming of movies and other copyrighted content, or adult content/pornography sites, including some with indecent images of children."

(Representatives of Larus told The Register AFRINIC did not identify the leased IP addresses linked to that aforementioned material, making it hard for Cloud Innovation to tackle the alleged activity. The representatives told us requests for those addresses were made, and that AFRINIC did not provide them. They also said a police complaint had been made against AFRINIC regarding this matter. The reps assured us Cloud Innovation works with law enforcement agencies and cybersecurity companies to tackle bad behavior by customers. Indeed, the outfit’s homepage prominently features a form allowing reporting of IP address abuse. They added Cloud Innovation shouldn't be held liable for what customers do with their leased IP addresses.)

Cloud Innovation's many legal ripostes have left AFRINIC unable to appoint a CEO or stage fresh board elections. The lawsuits it has launched are so numerous and complex that unpicking them all would require vast effort.

Enter the NRS

In June 2021, while AFRINIC and Cloud Innovation fought, an unknown entity registered the domain name nrs.help – the online home of the NRS. A website appeared soon afterwards.

The Internet Archive’s snapshot of the site in September 2021 lists its address as Flat A3, 11/F, TML Tower, Tsuen Wan, N.T, Hong Kong.

That's the same address as a company called Larus Limited, whose CEO is named Lu Heng – the same Lu Heng who leads Cloud Innovation. Larus is Cloud Innovation's partner and states the two work together "to delegate IP addresses to customers."

The Larus website details its IP leasing services, promising it can do so without a "complicated RIR transfer procedure."

"No need to go through RIR membership because IP addresses will be assigned to you from Larus's pool," the company's website states.

You can join the dots here: Cloud Innovation was allocated millions of IP addresses from AFRINIC, and leases them via Larus, which is closely tied to the NRS. Both Cloud Innovation and later the NRS lobbied hard against AFRINIC – not just to stop a claw-back of IPv4 addresses, but to reform the registry and the allocation of addresses entirely.

An outcome that would suit Cloud Innovation nicely.

War of words

The NRS appears to have started campaigning against AFRINIC in September 2021, when the RIR's forums lit up in a thread titled "Lu Heng + Larus and the Number Resource Society" that contains several allegations that someone contacted AFRINIC members with a false claim that the registry would soon close and they should join the society instead.

In 2022, the NRS started publishing videos to promote itself and its position. In this video, the society articulated a complaint that is very close to Cloud Innovation's beef with AFRINIC: that the African RIR overreached with its threat to recoup the allocated IPv4 addresses.

"The formation of the NRS was prompted by corruption, distortion, and threats made by AFRINIC in its bid to reclaim IPs and disconnect millions of end users," the video states.

"We firmly believe that an alliance of ISPs is required to bring the community and the internet operators together to hold the RIR to a higher standard of accountability and transparency."

The NRS has pushed for universal internet access without restrictions on netizens' activities. Just last month, the NRS started to campaign for ISPs to have the right to outright own IP addresses, which should be freely traded like any other asset, it said. RIRs would be downgraded to playing just a monitoring role, essentially, in that case.

"A virtual marketplace would exist similar to a stock exchange," an unnamed NRS spokesperson explained to The Register. "The price for IPs would fluctuate depending on demand and supply, and would provide a [decentralized] solution for the future.

"RIR's role would be to ensure no duplication of IPs and ensure correct ownership registration. They would have no role in setting the values of the IP assets and would not own the IPs. This would require a change in RIR bylaws."

If the NRS gets its way – ISPs fully own their IP addresses, and RIRs are just mere bookkeepers – Cloud Innovation's problems with AFRINIC would simply go away.

(Representatives for Larus told us they already consider RIRs to be bookkeepers, so there would be no reduction in role in their opinion. The reps said this viewpoint is held by others in the internet governance world.)

A defense, of a sort

Also this June, the NRS published a document defending Cloud Innovation's actions on grounds that its request for and use of the IP trove AFRINIC awarded it allowed the African registry to secure the rights to another ten million IPv4 addresses from IANA.

The Register has never seen the NRS support any other private entity. It seems likely the society's interests intersect with Cloud Innovation’s concerns.

As discussed above, Cloud Innovation's interests aren't unreasonable: IPv4 resale and leasing is widely practised, and Europe's RIPE NCC allows its addresses to be passed on to customers outside the area it administers, though it is alone among RIRs in doing so.

While the NRS's free market ideas are well beyond those allowed by other RIRs, RIPE's policies mean there is a precedent at the kernel of its cause. You might therefore think the NRS would take the high ground.

Instead, in public it often goes low. Or goes gonzo.

This effort, for example, incorrectly claimed AFRINIC wants to disconnect Africa from the internet and hopes "to monitor everyone in Africa and the world” using powers "beyond any government, and no one is overseeing them."

Other NRS videos use even stronger terms. In this clip, a society spokesperson claimed AFRINIC has "long claimed to have sovereign power, claiming to be the world's government that can control it."

In the same video the society states: "The AFRINIC board are obligating all the resource members to monitor the end users of the internet and if the resource members refuse to do that, [their] membership is to be terminated immediately."

AFRINIC's service agreement [PDF] asserts no such thing.

(The society's stance on AFRINIC's network surveillance appears to rely on this letter [PDF] from the RIR to Cloud Innovation, in which the African registry accuses the company of failing to monitor websites for offensive or illegal material. Representatives of Larus said one can infer from that letter that AFRINIC requires all members to police the internet, and said the monitoring requirement is unreasonably onerous. The reps reiterated that Cloud Innovation, like other network providers, should not be held liable for customers’ activities, depending on the jurisdiction.)

The NRS and Lu Heng are linked

As The Register investigated this situation, we noticed that the NRS website once contained another artifact linking to it to Larus: a Larus Foundation email address as a contact for the NRS. The Foundation is an internet governance advocacy founded by Lu Heng. Cloud Innovation proudly states it donates to the Foundation annually.

The NRS told us Larus gave it a website template, which explains the presence of Larus artifacts at nrs.help.

But there are other links. A content marketer named Catherine Coz's LinkedIn profile states she was employed by both the NRS and Larus Foundation from September 2021 to January 2022 – the period during which the NRS was in startup mode.

A Pakistan-based Larus employee named Umer Pirzada stated he has worked for Larus since February 2021 and served as a director of NRS since February 2023. Pirzada did not respond to our request for comment.

It appears all but certain that Lu Heng, Larus, and Cloud Innovation were, at the very least, aware and supportive of the NRS from its very earliest days.

Cloud Innovation certainly profits from trouble at AFRINIC, because the RIR's actions against it have effectively ceased – meaning challenges to its operations are stalled.

AFRINIC in trouble. Cloud Innovation in the clear

Indeed, Cloud Innovation's lawsuits – plus some brought by Larus and African ISPs – meant that by mid-2022, AFRINIC was not in a good state. CEO Eddy Kayihura's contract expired. Decisions in Mauritian courts made it nigh-on impossible for AFRINIC to appoint a board, so it was not possible to reappoint Kayihura. Other RIRs later warned AFRINIC could be close to failure.

Cloud Innovation, meanwhile, carried out business as usual – presumably with money pouring in from its IPv4 assets.

And as The Register will soon report, the NRS moved on to a new target: the Asia Pacific Network Information Centre (APNIC). ®

Editor's note: This article was updated after publication to include responses from Larus's representatives.