Regional Internet Registries Work To Prevent One Of Their Own Going Rogue

APRICOT 2025 Global and local change is coming to the world's five Regional Internet Registries. The orgs that delegate and manage IP addresses are working on a policy that will allow them to stop one of their number going rogue, and the process is proving controversial.

A push to revisit policy came in late 2023 when the Number Resource Organization (NRO) – the peak body for the five RIRs – decided to initiate a review of a document called ICP-2 that defines the criteria for establishment of new RIRs.

ICP-2 was developed before the RIRs for Africa, and for Latin America and the Caribbean, started operations. The policy was used to bring them into existence. No new RIR has commenced operation since 2005.

The NRO felt it wise to revisit ICP-2 because it had been largely ignored for decades, and while it defines how to create a new RIR it doesn't offer guidance on what happens if an RIR isn't doing its job or behaves in ways that hurt the global IP addressing system.

In 2024 NRO proposed set of principles that define a set of criteria RIRs must observe – among them strong governance, financial stability, and avoiding capture by another organization – that it believes should be included in a revised ICP-2.

The principles for the first time define a full lifecycle for an RIR, through its formation, operation and monitoring to ensure it remains on mission principles, and the last resort of deregistration for a dysfunctional RIR.

In late 2024 a questionnaire was circulated to seek feedback on those principles. The results of that consultation were published this week and proved controversial when raised at the annual general meeting of the Asia Pacific Network Information Centre (APNIC) on February 27th.

One reason for controversy was that almost half of the 298 responses submitted were found to be duplicate comments, possibly created by an AI, and were therefore considered as a single response.

When the floor was opened to questions about ICP-2, one speaker defended those responses on the grounds that the internet governance community includes many for whom English is not their first language. The speaker also criticized considering them as a single response.

Other speakers expressed surprise that work on ICP2 had not been more widely publicized and was not the subject of a session at the Asia Pacific Regional Internet Conference on Operational Technologies (APRICOT) that preceded the APNIC meeting.

Officers of the orgs involved in work on ICP-2 pledged further efforts to ensure stakeholders are aware of work on the policy, regretted that past efforts to do so appear not to have worked well, and suggested future RIR meetings will include sessions on the policy.

A draft of a revised ICP-2 is now under way, and the timeline for its development calls for it to be ready for consideration in the final quarter of 2025.

For what it’s worth, The Register became aware of the effort after a September 2024 blog post and in November 2024 we were briefed on ICP-2 by APNIC general counsel Jeremy Harrison.

Stakeholders have had time to dig into the matter.

It began in Africa

Harrison told us one reason the internet governance community decided to revisit the policy is the ongoing situation at the African Network Information Centre (AFRINIC), the RIR for Africa.

AFRINIC has a long history of trouble. The org has struggled amid allegations of sexual harassment and staff corruption. Since 2023 it has been the subject of multiple court cases and has been unable to appoint a CEO or constitute a board.

Through it all, AFRINIC has continued to perform its core functions.

Had it been unable to do so, the reforms floated for ICP-2 would outline how AFRINIC, or any other RIR, would be assisted or reformed.

The good news for AFRINIC is that in early February courts in Mauritius appointed a receiver charged with conducting elections that will allow appointment of a new board.

So perhaps AFRINIC will soon again operate on normal footing.

AFRINIC elections, however, often produce controversy .

The Register expects things may get quite spicy in coming weeks!

Do you know more? The Register is investigating recent internet governance controversies. Contact us here in confidence.

New leadership

While debate about ICP-2 draws global attention, change has also come to two of the five RIRs in the form of new leadership appointments, a rarity in the slow moving world of internet governance.

In October 2024, the Asia Pacific Network Information Center (APNIC) named former ICANN regional managing director and vice president Jia Rong Low director general after the retirement of Paul Wilson, who led the org for 26 years.

Low has already been busy. At APNIC's meeting he revealed the org's four senior directors have been made redundant as he seeks to streamline the organization and cut costs to address a budget deficit.

APNIC has also started an audit of historical IP address delegations after a whistleblower found suspicious delegations in India. Subsequent investigations saw IP address delegations to 44 entities revoked.

The audit also uncovered 1,200 delegations in Indonesia that APNIC believes "share a variety of common elements."

The Indonesian Internet Service Providers Association has appointed independent legal counsel "to conduct a comprehensive review of all activities regarding Internet Protocol delegations made by the Indonesia Network Information Center." The Register understands that review is expected to take many months to complete.

Also at the APNIC meeting, members of the org's Executive Council (the equivalent of its board) announced their intention to explore rule changes that would extend their terms but also impose term limits.

• Huawei handed 2,596,148,429,267,413,
  
  814,265,248,164,610,048 IPv6 addresses
• 250 million-plus reserved IPv4 addresses could be released – but the internet isn’t built to use them
• Internet samurai says he'll sell 14,700,000 IPv4 addresses worth $300m-plus, plow it all into Asia-Pacific connectivity
• Four months, $1bn... and ICANN still hasn’t decided whether to approve .org sale with just 11 days left to go

The Latin American and Caribbean Internet Addresses Registry (LACNIC) has also appointed a new CEO, Ernesto Majó, after its previous leader Oscar Robles-Garay stepped down after a decade in the job.

Majó is a 20-year LACNIC veteran and his appointment was made in line with the org's succession plan and described by the org's board as demonstrating "continuity and stability."

The early months of Majó's tenure won't just be business as usual as in January 2024 LACNIC detected 120 unauthorized logins to its member portal and later found hundreds of valid credentials to that portal for sale on the dark web.

Most of those credentials used weak passwords, and most of the accounts did not use multi-factor authentication (MFA) to access LACNIC's portal.

The RIR has since made MFA compulsory, with a March deadline for most members to adopt the security control.

At APRICOT, LACNIC communications manager Maria Gayo said the MFA rollout is going well.

More comfortable change is underway at RIPE NCC, the RIR for Europe, the Middle East, and parts of Central Asia, in the form of a new office in Dubai to help it better serve the region. The RIR is also adapting its operations to cope with the fact that its service area includes Iran, Belarus, and Russia, all of which are the subject of international sanctions. ®