The AFRINIC Insider Question
How Did 16 Million IP Addresses Leave Africa Without Anyone Noticing for Six Years?
I. The Six-Year Silence
Between 2013 and 2019, Cloud Innovation received allocations equivalent to 6.2-16 million IPv4 addresses from AFRINIC. None were ever used in Africa. No one said anything for six years.
This isn't possible without inside help.
AFRINIC's allocation policies require that addresses be used within the African service region. This isn't a minor technicality โ it's the foundational requirement of the regional internet registry system. Every RIR (ARIN, RIPE, APNIC, LACNIC, AFRINIC) exists specifically to ensure addresses serve their region.
For 16 million addresses to flow out of Africa without triggering a single audit between 2013 and 2019 requires one of three scenarios:
- Complete incompetence โ AFRINIC's staff failed to notice their largest allocation wasn't being used in Africa for six years
- Deliberate blindness โ Staff noticed but were instructed not to investigate
- Active facilitation โ Someone inside AFRINIC helped structure the allocations to avoid triggering review
Let's examine each.
II. The Scale Problem
First, let's understand why "nobody noticed" strains credulity:
| Entity | IPv4 Addresses | Context |
|---|---|---|
| Cloud Innovation (estimated) | 6.2 - 16 million | More than most African countries combined |
| Kenya (entire country) | ~4 million | 55 million people |
| Nigeria (entire country) | ~6 million | 220 million people |
| South Africa (entire country) | ~30 million | 60 million people |
| AFRINIC total pool | ~108 million | All of Africa + Indian Ocean |
Cloud Innovation held 6-15% of AFRINIC's entire address space. This is equivalent to a single shell company holding more IP addresses than Kenya and Nigeria combined โ two countries with a combined population of 275 million people.
For context: AFRINIC's staff knows their large allocation holders. They're a small organization (fewer than 200 employees) managing address space for an entire continent. The idea that they "didn't notice" their largest non-African allocation is not credible.
BTW Media "EXPOSED" Article Summary:
In their investigation titled "The letter that reveals who was really benefitting from AFRINIC," BTW Media obtained internal correspondence suggesting that AFRINIC board members and senior staff were aware of non-compliant allocations and that certain individuals within the organization benefited from maintaining the status quo.
Source: BTW Media investigative series on AFRINIC crisis
III. The Board Crisis Timing
AFRINIC's governance crisis of 2021-2022 wasn't a spontaneous institutional failure. It followed a specific pattern:
The Governance Collapse Sequence
- 2019 โ AFRINIC begins audit of Cloud Innovation's address use (first enforcement action)
- 2020 โ Internal tensions over enforcement vs. legal risk
- 2021 (May) โ CEO Eddy Kayihura suspended (later fired)
- 2021 (July) โ Cloud Innovation obtains Mauritius court injunction blocking revocation
- 2021 (Sept) โ Multiple board members resign
- 2021 (Dec) โ AFRINIC CFO Ernest Byaruhanga arrested for fraud (R6.5 million)
- 2022 โ Remaining board struggles to maintain quorum
- 2022-2023 โ AFRINIC placed under receivership by Mauritius court
- 2024-2025 โ Receivership continues; AFRINIC cannot enforce any policies
- 2026 โ Cloud Innovation calls for AFRINIC "wind-up" (permanent dissolution)
Look at the sequence: enforcement begins โ CEO removed โ board collapses โ CFO arrested โ receivership โ dissolution proposal.
The timing raises immediate questions.
Q: Was the CEO's suspension connected to the Cloud Innovation enforcement action?
Eddy Kayihura was AFRINIC's CEO when the organization began enforcing its policies against Cloud Innovation. His suspension came less than two months before Cloud Innovation obtained its court injunction. While the official reasons for his suspension involved other governance issues, the timing means the person driving enforcement was removed just as the enforcement was becoming legally contentious.
Coincidence probability: Low. The person most likely to pursue enforcement was removed at the exact moment enforcement became most threatening to Cloud Innovation.
Q: Was the CFO's arrest connected to the broader crisis?
Ernest Byaruhanga was arrested in December 2021 for fraud involving R6.5 million (~$360,000 USD). While this appears to be independent corruption, it served the same purpose as the board resignations: reducing AFRINIC's institutional capacity to act.
The pattern: Whether the CFO's fraud was independent or facilitated, its timing contributed to AFRINIC's inability to function. Each institutional failure โ CEO fired, CFO arrested, board resignations โ reduced the organization's capacity to enforce the Cloud Innovation revocation.
Q: Were board resignations coordinated or spontaneous?
Multiple AFRINIC board members resigned in September 2021 โ the same period when Cloud Innovation's legal challenge was escalating. Board resignations that prevent quorum serve one purpose: preventing institutional decision-making.
Without quorum, AFRINIC cannot:
- Approve new enforcement actions
- Hire replacement executives
- Authorize legal defense spending
- Implement policy changes
The resignations didn't need to be coordinated by Cloud Innovation directly. They only needed to happen at the right time โ and in an environment of institutional crisis, individual board members leaving for "personal reasons" creates the same outcome as coordinated action.
IV. The R6 Billion Question
MyBroadband (South Africa) reported that the IP addresses at the center of the AFRINIC crisis are valued at approximately R6 billion (~$315 million USD at current rates).
When $315 million in assets is at stake, the question isn't "would someone try to corrupt the institution?" โ it's "how much did it cost?"
The Economics of Institutional Capture
AFRINIC's annual budget is approximately $10-15 million. Its staff salaries reflect Mauritius market rates. Board members serve as volunteers or receive modest stipends.
The addresses Cloud Innovation controls are worth $315 million. Spending $5-15 million on litigation over 6 years is rational. Spending an additional $1-5 million to ensure institutional dysfunction would be rational too โ it's less than 2% of the asset value.
When the prize is $315 million and the institution protecting it operates on $10 million/year with volunteer governance, the asymmetry guarantees that the institution will lose.
Q: Who funded 6+ years of international litigation against AFRINIC?
Known: Cloud Innovation Limited (Seychelles) is the named plaintiff. Legal representation includes firms in Mauritius, possibly UK and Hong Kong jurisdictions.
Unknown: Where Cloud Innovation's litigation funding originates. A Seychelles shell company has no visible revenue to support years of multi-jurisdictional legal proceedings costing $5-15 million.
Possible sources:
- LARUS revenue โ IP brokerage profits funding legal defense (possible but questionable whether margins support this scale)
- Sub-lessee revenue โ Income from leasing the disputed addresses (circular: using the contested addresses' revenue to fund the contest)
- External funding โ Third-party investors or state actors funding the litigation as strategic investment (addresses worth $315M justify external investment)
- Litigation funding firms โ Commercial litigation funders who take a percentage of outcome (standard for high-value IP disputes)
The most concerning option: If the funding is external and state-connected, it transforms this from a business dispute into a state-sponsored governance attack. The Seychelles incorporation ensures we cannot determine which option is correct โ which is, again, the point of the structure.
V. The Allocation Process โ How It Actually Works
To understand how inside help would function, we need to understand AFRINIC's allocation process:
Standard AFRINIC IPv4 Allocation Process:
- Application โ Organization submits request with justification for need
- Evaluation โ AFRINIC hostmaster reviews against policy (CPM - Consolidated Policy Manual)
- Verification โ Applicant must demonstrate they serve the African region
- Approval โ Senior hostmaster or designated authority approves
- Allocation โ Addresses assigned and registered in AFRINIC database
- Audit โ Periodic review of address utilization (theoretically)
Steps 2, 3, 4, and 6 all require human judgment. Each is a vulnerability point.
For Cloud Innovation to receive massive allocations between 2013-2016 while having no African operations, the following must have been true at step 3:
- Either Cloud Innovation provided false documentation of African operations (fraud)
- Or the verification step was skipped/weakened for this applicant (facilitation)
- Or the policy was interpreted so loosely that "serving Africa" included leasing to others who might serve Africa (creative interpretation)
The third option โ creative interpretation โ is the most likely initial mechanism. AFRINIC's policies during 2013-2016 may not have explicitly prohibited allocating addresses to a company that promised to serve Africa through sub-leasing, even if the sub-lessees never actually deployed in Africa.
But this interpretation requires someone inside AFRINIC to actively choose the permissive reading over the restrictive one. That's facilitation, not incompetence.
VI. The Manufactured Crisis Theory
Q: What if the AFRINIC governance crisis was manufactured to create conditions for dissolution?
The thesis: Cloud Innovation (and/or its backers) recognized that AFRINIC's enforcement, even if delayed by litigation, would eventually succeed. The long-term strategy isn't to win the legal case โ it's to ensure AFRINIC ceases to exist before it can enforce anything.
Supporting evidence:
- Cloud Innovation's website (cloudinnovation.org) now explicitly calls for AFRINIC "wind-up" โ permanent dissolution
- This is unprecedented: no IP holder has EVER sought to destroy an RIR
- The receivership provides the legal mechanism: an institution under receivership can be wound up if deemed non-viable
- Every institutional failure (CEO removal, CFO arrest, board collapse) contributed to making AFRINIC appear non-viable
Counter-evidence:
- AFRINIC had genuine governance problems predating Cloud Innovation's involvement
- African internet governance has long been under-resourced
- Board dysfunction is common in non-profit organizations
Assessment: MEDIUM confidence. The manufactured crisis theory explains the observed sequence better than coincidence, but genuine institutional weakness was the necessary precondition. The most likely reality: pre-existing weaknesses were exploited and amplified, not created from scratch.
Q: What if AFRINIC insiders received payments for favorable treatment?
Circumstantial indicators:
- CFO arrested for fraud in 2021 โ demonstrates that financial misconduct existed within AFRINIC
- BTW Media reports suggest internal beneficiaries of the status quo
- AFRINIC staff salaries ($10-50K range for Mauritius) create vulnerability to financial inducement
- The allocation process has single points of failure (individual hostmaster approval)
What we CANNOT prove: Direct payments from Cloud Innovation to AFRINIC staff. Seychelles incorporation prevents tracing fund flows. Mauritius anti-corruption investigations focused on the CFO's independent fraud, not on allocation-related corruption.
What we CAN observe: The outcome. Regardless of mechanism, 16 million addresses left Africa without triggering intervention for six years. Whether this was achieved through payment, pressure, or creative policy interpretation, the result is identical: institutional capture that served Cloud Innovation's interests.
Q: What happens if AFRINIC is actually dissolved?
Scenario: If the "wind-up" succeeds, African IP addresses have no governing authority. This creates several possible outcomes:
- ICANN steps in โ But ICANN's multi-stakeholder model requires African participation, which dissolution undermines
- Another RIR absorbs โ RIPE or APNIC could manage African space, but this is neocolonial and politically unacceptable
- Addresses become property โ Without a registry, addresses are held by whoever currently routes them. Cloud Innovation's injunction means they currently route 16M addresses. Dissolution makes the injunction permanent by eliminating the entity that could challenge it.
- A new "AFRINIC 2.0" is created โ Under different governance (possibly influenced by entities that destroyed AFRINIC 1.0)
The critical insight: Options 3 and 4 both serve Cloud Innovation. If addresses become pure property, Cloud Innovation owns $315M in assets permanently. If a new institution is created, Cloud Innovation (having destroyed the old one) is positioned to influence the new one's policies.
This is why dissolution is the endgame: It's the only outcome where Cloud Innovation's address holdings become permanent and unchallengeable.
VII. The Digital Colonialism Frame
There's a broader frame that this entire series dances around, and it needs to be stated plainly:
What we are documenting is the largest theft of African digital resources in history, conducted through legal mechanisms by entities connected to the world's second-largest economy, while the international community watches and does nothing.
The IP addresses allocated to AFRINIC were meant to serve Africa's digital development โ the 1.4 billion people who still have some of the lowest internet penetration rates globally. Instead, those addresses serve Chinese hosting companies, bulletproof hosters, and attack infrastructure that targets everyone else.
This is not metaphorical colonialism. This is literal resource extraction:
| 19th Century Colonialism | Digital Resource Extraction (2013-present) |
|---|---|
| Extract minerals from Africa | Extract IP addresses from AFRINIC |
| Corrupt local governance to enable extraction | Destabilize AFRINIC governance to prevent enforcement |
| Use legal frameworks of the colonial power | Use Mauritius courts (former colonial legal system) |
| Leave no infrastructure for local use | None of 16M addresses serve African networks |
| Profits flow to the colonial power | Revenue flows to Hong Kong/Shanghai/Wuhan entities |
| Local institutions too weak to resist | AFRINIC under receivership, cannot enforce |
| International community expresses "concern" | ICANN, RIPE express "concern" but take no action |
The parallel isn't perfect. But it's close enough to be uncomfortable for everyone who claims to care about digital development in Africa while simultaneously doing nothing about the largest address block ever allocated to entities with no African presence.
VIII. Who Benefits โ The Complete Map
BENEFICIARIES OF AFRINIC'S DESTRUCTION: Cloud Innovation (Lu Heng) โโโ $315M in address assets become permanent property โโโ No further compliance requirements โโโ Sub-leasing continues indefinitely Sub-Lessees (Yisu Cloud, Scloud, UCloud, etc.) โโโ Continued access to cheap African-allocated addresses โโโ Geographic mismatch enables attribution evasion โโโ No audit or usage requirements State Actors (if theory holds) โโโ 16M unattributable IP addresses for operations โโโ Pre-positioned infrastructure across 8+ countries โโโ No institutional authority can demand accountability โโโ Volt Typhoon-class capability without direct attribution Litigation Funders (whoever they are) โโโ Return on $5-15M investment: $315M in assets โโโ Precedent: RIRs can be destroyed through litigation โโโ Replicable against other registries LOSERS: Africa's 1.4 billion people โโโ 16M addresses that should serve their internet development โโโ Weakened governance institution โโโ Precedent that African digital resources are extractable Global Internet Community โโโ Weakened multi-stakeholder governance model โโโ Precedent that RIRs can be litigated into dissolution โโโ Erosion of the principle that addresses serve communities Law Enforcement / Security Researchers โโโ 16M addresses with no meaningful accountability โโโ Attribution becomes impossible for attacks from these ranges โโโ Our honeypot data proves active malicious use (threat score 100)
IX. The Uncomfortable Conclusion
This series has asked many questions. Some have answers. Some don't. But one conclusion is inescapable:
- AFRINIC was compromised from within. The six-year silence (2013-2019) cannot be explained by incompetence alone. Someone inside the institution enabled or tolerated the extraction.
- The governance crisis was exploited, not coincidental. Every institutional failure โ CEO removal, CFO arrest, board collapse โ served Cloud Innovation's interests. Whether manufactured or merely exploited, the pattern is systematic.
- Dissolution is the endgame. Cloud Innovation's call for "wind-up" is the logical culmination of a strategy that began with allocation and ends with permanent, unchallengeable ownership.
- The international community has failed. ICANN, RIPE, APNIC, and the Internet Governance Forum have expressed concern but taken no action that changes the outcome. Six years of "concern" while $315M in African digital resources is extracted.
- Our honeypot proves the harm is real and ongoing. Cloud Innovation IPs show threat scores up to 100. WHG/HBING infrastructure hosts the most dangerous attacks in our dataset. The addresses taken from Africa are being used to attack the world.
The Geography of Nowhere is not an abstract governance failure. It is active harm, enabled by institutional capture, funded by unknown parties, and protected by jurisdictional architecture specifically designed to prevent accountability.
X. Series Conclusion
Over eight articles, we have documented:
- The mechanism: Geographic discrepancy in IP registration creates accountability-free infrastructure (Part A)
- The operator: Lu Heng controls Cloud Innovation, LARUS, NRS from Hong Kong/Shanghai/Wuhan (Part B)
- The market: IPXO and similar marketplaces enable attribution death at industrial scale (Part C)
- The victim: AFRINIC โ Africa's internet registry โ placed under receivership and facing dissolution (Part D)
- The weapon: WHG/HBING's SSH-key-proven dual structure provides tiered anonymity (Part E)
- The question: Whether Lu Heng represents Chinese state interests in African IP address acquisition (Part F)
- The surveillance: How routing through specific states enables intelligence cooperation architecture (Part G)
- The inside job: How AFRINIC's capture was achieved and why dissolution is the endgame (Part H)
Every article in this series is backed by our honeypot telemetry, open-source intelligence, corporate records, and documented court proceedings. We have named names, shown SSH keys, traced corporate structures, and followed money where it was visible.
What we cannot do is force action. That requires institutions โ and the institutions that should act are either captured (AFRINIC), constrained (ICANN), or complicit (intelligence agencies that benefit from the same infrastructure).
The Geography of Nowhere persists because too many powerful actors benefit from its existence.
All we can do is document it. And hope that documentation eventually matters.