EXCLUSIVE: Will the Mauritius Supreme Court shake-up internet across Africa?

A little late to the party, the African continent has received a small but precious portion of a rare commodity: IP address blocks. As a reminder, these numbers serve to identify each device connected to the internet (whether that be a smartphone, tablet, or computer), so that it can access sites and services for the user.

The older ones, which are grouped under the acronym IPv4 (Internet Protocol Version 4), are limited in number and, more importantly were often distributed long ago, so their market value has exploded in recent years.

“As the internet grows, so does the demand for more IPv4 numbers,” say analysts Milton Mueller, Vagisha Srivastava and Brenden Kuerbis of the Internet Governance Project. Operators wishing to obtain these addresses in blocks often acquire them on the secondary market or “transfer market”, where the “price of IPv4 addresses has risen from about $8 per address in 2017 to $30 today, say the analysts.

Limited Stock

Despite the development of IPv6, a more modern internet protocol, IPv4 “still carries most internet traffic today,” says one industry expert.

The allocation of IP addresses is the responsibility of regional non-governmental institutions, the Regional Internet Registries (RIRs).

The African RIR is Afrinic, which has been allocated 2% of the world’s stock of just under 4 billion available internet addresses, compared with 40% for North America, 21% for Asia-Pacific, 18% for Europe and the Middle East, 4% for Latin America, and the remainder in the hands of the Internet Assigned Numbers Authority, the historical governing body of the net.

Afrinic was established in 2004 in Mauritius, nearly a decade after its North American counterpart ARIN. While the Asia-Pacific RIR exhausted its stock of IPv4 addresses in 2011, Afrinic still has some available, but its reserves are in sharp decline, from nearly 70 million “distributable” addresses in 2013 to just under 2 million today.

Six million addresses allocated

In reality, Cloud Innovation Ltd, headed by Lu Heng, “an IT guy with ambitions” according to his Twitter bio, is a PO box company, registered at the address of Abacus (Seychelles) Ltd – a name that comes up several times in Offshore Leaks report.

A partner of Larus Ltd, another company operating from Hong Kong but also headed by Lu Heng, Cloud Innovation applied to Afrinic in 2013 for the allocation of approximately one million IP addresses. In 2016, after two more allocations, Cloud Innovation found itself with 6.2 million IP addresses granted by the African registry.

An important clarification: Cloud Innovation cannot “sell” these IP addresses because it does not own them. They are common property allocated to the company, under certain conditions stipulated in the contracts signed with the LIR.

On the other hand, with a “local internet registry” (LIR) status and the stock of delegated addresses, the company can then allocate them to individual customers. Afrinic claims more than 1,900 members, including telecom operators such as MTN or Orange, financial institutions (Axa Mansard Assurance, Central Bank of Nigeria, or the Regulatory Authority for Electronic Communications and Posts in Burkina Faso and the General Directorate of Taxes in Côte d’Ivoire.

Theft and audits

While the use of resources allocated by the African Regional Internet Registry remains confidential,” Lu Heng was saying publicly at the time that he was using his resources in Africa and wanted to invest in Africa,” says an active member of the Afrinic community.”

At that time, Lu Heng claimed to want to support the use of VPNs against censorship,” recalls Ronald Guilmette, a cybersecurity researcher.

In 2016, the latter alerter Afrinic to a “theft” of IP addresses from the company. The case only came to light in 2019, leading the institution to appoint a new CEO, Eddy Kayihura, and to fire an employee suspected of involvement.

Since 2021, Cloud innovation has represented 80% of all of Afrinic block address updates.

For the privacy of their members, Afrinic declined to disclose the purpose of the addresses in 2013 and their purpose today. “To date, more than ten million IP addresses [in Afrinic’s inventory] regifted on Whois (an IP directory) are ten years old or older, compared to 40 million IP addresses that are fiver years old or older. Do all [the LRIs] have to justify their use again, when they don’t bother to update Whois?” a Larus representative replied.

Worrying overactivity

“Since the beginning of 2021, Cloud Innovation Ltd has accounted for 80% of all Afrinic block address updates on Whois,” the Larus company said. “[Yet] 313 of [Afrinic’s] 1,800 members have not made IP address assignments from their allocated inventory more than a year after receiving it, and 641 members have registered less than 50% of their allocated inventory,” Larus insists.

Cloud Innovation is accused of simply reselling IP addresses without having acquired any equipment.

In some respects, this overactivity would actually work against Cloud Innovation. According to some industry experts, Cloud Innovation is accused of having allocated IP addresses from Afrinic to customers outside of Africa who have no business there. These suspicions are reinforced by Laru’s commercial marketing.

From commercial disputes to legal battles

After a complaint from Cloud Innovation, Afrinic renewed its approach on 10 March 2021, and gave Cloud Innovation one month to comply, failing which Lu Heng’s company would have its membership in Afrinic withdrawn and 6.2 million IP addresses confiscated.

The commercial dispute turned into a legal battle on 7 April 2021, when Cloud Innovation took the matter to the Mauritian Supreme Court, which decided on 23 July to freeze Afrinic’s accounts at SBM Bank and Mauritius Commercial Bank to the tune of $50m, pending further information – “at the risk and peril” of Cloud Innovation, the judicial institution said.

Many voices in the global Internet community have risen to defend Afrinic and express their concern for the stability of the African Internet if the situation continues. A crowdfunding campaign for the African institution has even been launched by the Association of African Internet Exchange Points (AFIX).

Afrinic has also received the support of John Curran, CEO of its American equivalent, the American Registry for Internet Numbers (ARIN). In a statement published on 27 August, the highly respected member of the global Internet community said that “ARIN has first-hand experience and insight into Mr. Lu’s business practices in the search for IP address resources. Indeed, according to the U.S. executive, in 2013, “Mr. Lu, through his company Outside Heaven, Ltd. also approached and requested more than one million IPv4 addresses from ARIN.”

A request that was refused in the end by the American institution. “For two main reasons:

• Firstly, during the examination of his request to justify the provision of Internet address resources, Mr. Lu refused to provide ARIN with information that had been requested from him on several occasions;
• Secondly, the information provided by Mr. Lu was misleading and inconsistent”.

Finally, the US expert reports that: “Mr. Lu had no significant business establishment in the ARIN region; and based on his own statements, it was clear that the intended use of the IPv4 addresses – if issued – was for commercial activities outside the ARIN service region.”

Two visions clashed

While it may seem technical and legal, the conflict between Afrinic and Cloud Innovation Ltd is a highly strategic issue: who can legitimately use IP addresses dedicated to the African continent? There are two opposing views: on the one hand, those who consider that subscribers to blocks of IP addresses should be able to do what they want with the addresses allocated to them, and on the other, those who advocate a fair distribution, entrusted to a regulator.

Some defend Cloud Innovation, arguing that regional registries should be content with “accounting” role and let their members dispose of these resources as they see fit. This is the objective of a mysterious group called the Number Resource Society, whose website explicitly mentions Afrinic and which is registered in Hong Kong