Africa’s gold, diamonds, and even people have long been exploited by outsiders. The same may be said for digital materials.
Millions of internet addresses allotted to Africa have been misplaced, some unlawfully, some through insider manipulations tied to a former top employee of the NGO that gives addresses to the region. Many have profited spammers and scammers instead of assisting Africa’s internet development, while others feed Chinese appetites for pornography and gaming.
The group AFRINIC is seeking to retrieve the stolen addresses under new leadership. However, a legal challenge brought by a well-heeled Chinese businessman is jeopardizing the body’s survival.
Lu Heng, a Hong Kong-based arbitrage specialist, is a businessman. Between 2013 and 2016, he collected 6.2 million African addresses via dubious methods. That’s around 5% of the continent’s total, which is more than Kenya’s.
AFRINIC does not sell IP address blocks to internet service providers or others. They pay membership dues to defray administrative expenditures, which are maintained to a minimum. However, there was plenty of potential for graft.
Lu fought back when AFRINIC revoked his addresses, which are now valued at almost $150 million. His attorneys persuaded a judge in Mauritius, where AFRINIC is based, to freeze the company’s bank accounts in late July. His firm has launched a defamation suit against AFRINIC and its new CEO for $80 million.
It comes as a surprise to the worldwide networking community, which has long viewed the internet as a technology platform for social progress. Some fear that it will jeopardize the internet’s entire numerical address system.
“There was never really any thought, particularly in the AFRINIC region, that someone would just go after a foundational element of internet governance and try to shut it down, try to make it go away,” said Bill Woodcock, executive director of Packet Clearing House, a global nonprofit that has assisted in the development of Africa’s internet.
According to reporters, Lu is a law-abiding businessman who did not break any restrictions in purchasing the African address blocks. He further claims that the internet’s five regional registries have no business deciding where IP addresses are utilized, notwithstanding the consensus of the internet’s stewards.
“AFRINIC is designed to serve the internet, not Africa,” Lu explained. “They’re merely bookkeepers,” says the narrator.
AFRINIC is attempting to regain internet real estate by reversing Lu’s address blockages, which is crucial for a continent that trails behind the others in using internet resources to better living standards and improve health and education. Only 3% of the world’s first-generation IP addresses have been assigned to Africa.
Worse, the organization’s former No. 2 official, Ernest Byaruhanga, who was removed in December 2019, is accused of stealing millions of AFRINIC IP addresses. It’s uncertain if he was acting on his own.
Eddy Kayihura, the registry’s new CEO, indicated at the time that he had filed a criminal complaint with Mauritius police. He upended management and set about reclaiming squandered IP address blocks.
The global internet-governance community has been startled and disappointed by Lu’s legal victories in the case. For starters, network activists are concerned that they may assist China in acquiring more internet resources. The Chinese state-owned telecommunications companies China Telecom and China Mobile are among Lu’s key clients.
“It doesn’t appear that he’s in charge. He appears to be the show’s frontman. Mark Tinka, a Ugandan who oversees engineering at SEACOM, a South African internet backbone and services provider, said, “I assume he has quite a large backing that is actually pulling the strings.” Tinka is concerned that Lu has “unlimited access to resources.”
Accusations that Lu is working for the Chinese government, according to Lu, are “wild” conspiracy theories. He claims he is the target of “character assassination.”
While billions of people use the internet on a daily basis, its underlying workings are poorly understood and rarely examined. Five fully autonomous regional groups that operate as nonprofit public trusts select who owns and manages the internet’s finite stock of first-generation IP address blocks on a global scale. AFRINIC was the final of the five registers to be established, having been established in 2003.
In the industrialized world, the pool of 3.7 billion first-generation IP addresses, known as IPv4, was nearly depleted just over a decade ago. These IP addresses currently sell for $20 to $30 each at auction.
The current problem was sparked by the discovery of the alleged AFRINIC fraud. Byahuranga and maybe others misappropriated 4 million IP addresses worth more than $50 million, which was uncovered and disclosed by Ron Guilmette, a freelance internet detective in California, and journalist Jan Vermeulen of the South African tech website MyBroadband.
But that wasn’t the end of it.
The ownership of at least 675,000 errant addresses is still a point of contention. Some are owned by an Israeli businessman, who has filed a lawsuit against AFRINIC for attempting to retrieve them. According to Guilmette, 1.2 million stolen addresses are still in use.
According to Guilmette, someone modified with AFRINIC’s WHOIS database records — which act as deeds for IP addresses — to steal so-called legacy address blocks. He stated that it was unclear whether Byahuranga was acting alone or if additional insiders or perhaps hackers were involved.
Many of the plundered address blocks were taken from businesses, including mining behemoth Anglo American.
Many of the disputed addresses continue to host websites with gibberish URL address names that contain gambling and pornography geared at a Chinese audience, despite the fact that such online operations are prohibited by the Chinese government.
When Kayihura set his eyes on Lu this year, he wrote him a letter claiming that IP address blocks assigned to his Seychelles-based firm were not “originating services from within the AFRINIC service region – contrary to the rationale provided.”
Lu declined to comment on the justifications he supplied to AFRINIC for the IP addresses he got but claimed he had never infringed any of the organization’s policies. Such justifications are part of a procedure that is often opaque and confidential. Kayihura declined to comment on them, citing the ongoing legal proceedings. Neither would the two CEOs of AFRINIC at the time Lu received the allocations.
According to emails obtained by reporters, Lu made it plain to AFRINIC in his initial request for IP addresses in 2013 that his customers would be in China. Lu said in the emails that he needed the addresses for virtual private networks, or VPNs, in order to get through the Chinese government’s firewall, which restricts popular websites like Facebook and YouTube.
In a 2013 meeting in Beijing, he said he addressed this with Adiel Akplogan, AFRINIC’s initial CEO, as cited in the emails. Akplogan, who stepped down in 2015, declined to comment on any discussions he might have had with Lu about the matter.
Alan Barrett, Akplogan’s successor, and a South African internet pioneer would only remark that “all required procedures were followed.”
Lu said his company, Cloud Innovation, had exited the VPN market and turned towards leasing address space by that time, in 2016-17.
Other regional registries, such as RIPE in Europe and ARIN in North America, routinely allocate address blocks outside their borders, according to Lu.
Experts believe that’s true, but Africa is unique since it’s still developing and vulnerable to abuse – even if AFRINIC’s bylaws don’t expressly prohibit geographical foreigners from receiving IP space.
According to Woodcock of the Packet Clearing House, unlike other regional registries, AFRINIC’s stewards failed to form solid relationships with governments on the continent with the wherewithal to fend off legal challenges from affluent usurpers.
“In the African region, the required governmental relationships to make it classified as critical infrastructure were never prioritized,” he continued. “This isn’t a threat originating in Africa. This is a Chinese threat.”
The international registry community has rallied to AFRINIC’s reformers’ defense.
In a statement of support, ARIN’s president, John Curran, urged the Mauritian court should look into whether any fraud was perpetrated in granting the IP addresses to Lu. According to him, his court action “has the potential to have a substantial impact on the general stability of the Internet number register system.”
The regional registries have set up a mutual aid fund of more than $2 million to keep AFRINIC operational during the legal battle.
Using IP addresses obtained from AFRINIC, reporters discovered multiple pornography and gambling sites aimed at a Chinese audience. Despite the fact that some sites are blocked in China, they can still be accessed through VPNs.
According to Lu, such sites make up a small percentage of the websites that use his IP addresses, and his organization has tight restrictions against uploading illicit information such as child pornography and terrorism-related material. He claims that he does not actively police the content of the millions of websites hosted by individuals who lease from his company, but that all actionable accusations of criminal activity are submitted to law enforcement quickly.
It’s unclear how far Byaruhanga’s police investigation has progressed. Attempts to find out if Mauritian police have even attempted to question him were met with silence. Byahuranga is thought to be living in Uganda, but he was unable to be reached for comment.
His former employer, Akplogan, claimed he was unaware of Byahuranga’s suspected misuse of addresses at the time.
“I have no idea how he accomplished it,” said Togolese-born Akplogan, who now lives in Montreal. “And those who know the truth about my administration of AFRINIC realize that it is not something I would have known and allowed to happen.”
Akplogan is presently vice president for technical engagement at ICANN (Internet Corporation for Assigned Names and Numbers), the California-based agency that regulates the global network address and domain name companies. He was inducted into the Internet Society Hall of Fame two years ago.
