How a dispute over IP addresses led to a challenge to internet governance

Updated One of the world's five regional internet registries, or RIRS, has been the subject of campaigns by a secretive lobby group calling itself the Number Resource Society (NRS).

We have learned this is part of the NRS's push for changes to the role of RIRs, the bodies that, among other things, centrally manage the internet's number resources including IP addresses.

The society has claimed RIRs, and their leaders, wish to "destroy the entire internet" for personal gain. The NRS also criticizes those governance organizations' structures and oversight. The society’s operations are opaque: it does not put a name to its commentary, arguing that the society “takes its governance inspiration from the Swiss form of direct participation in decision making” and attributing remarks to an individual would therefore be inappropriate.

The NRS’s president – its sole identifiable officer – did not respond to multiple requests for comment from The Register, save for one occasion when we pointed out he had been removed from the society's website.

One of the people most closely linked to the society is Lu Heng – an entrepreneur with a long history of agitating for change in the internet governance world, and who has publicly stated that today's oversight bodies should lose some responsibilities and perform just basic functions.

It began in Africa

The NRS emerged in the second half of 2021, after the affairs of the African Network Information Centre (AFRINIC) again became controversial.

AFRINIC is one of the world's five RIRs: those five are Africa's AFRINIC; Asia-Pacific's APNIC; North America’s ARIN; Europe’s RIPE; and Latin America’s LACNIC. These are the organizations that manage, allocate, and track the use of internet number resources – IP addresses and autonomous system numbers. The RIRs are membership-based organizations and develop policies based on community consensus.

The African registry has a history of dysfunction, and in 2019 appointed a CEO whose reform agenda included an audit of the resources AFRINIC administers, to ensure they had been properly allocated according to its policies and were being used appropriately.

The audit found various issues, including internal corruption that led to inappropriate allocation of IP addresses by an AFRINIC staffer.

In June 2020, in an action unrelated to its discovery of its own staff making inappropriate IP address allocations, AFRINIC management wrote to an organization called Cloud Innovation to which it previously granted the rights to use more than seven million IPv4 addresses. Cloud Innovation's CEO is Lu Heng, who also leads a company that, in correspondence with The Register, the NRS identified as a member: Hong-Kong-based Larus Limited.

AFRINIC's letter alleged Cloud Innovation had breached its agreement with the RIR, with actions including leasing IPv4 addresses to entities outside the geographic area AFRINIC serves.

Representatives for Larus told us this month in their view AFRINIC's enforcement of its rules on how IP addresses can be used was selective, and that it was infeasible for Cloud Innovation to tell the RIR about the ultimate use of each and every IP address when they are dynamically assigned to customers who may be geographically spread out. An IP address may be assigned to a web server one month, and to a VPN server the next, for example, and each change-of-use shouldn't be held up by approval from AFRINIC, Larus argued.

IP addresses, especially IPv4 addresses, are widely traded. IPv4 addresses are increasingly valuable, as few remain to be granted by RIRs. As IPv4 is not backwards compatible with its successor IPv6, some organisations use private markets to obtain more resources. Some organisations therefore seek IPv4 resources to broker and/or lease, which are mundane and uncontested practices.

That said, some RIR community members are working to codify a previously unwritten policy that “internet resources should not be leased ‘per se’, but only as part of a direct connectivity service.”

If adopted – and there is no guarantee of that – the proposed policy would mean the very small pool of remaining IPv4 addresses that RIRs are yet to grant use of to resource members would not be made available to IP traders, brokers, or lessors. Such organisations looking to RIRs for resources they wish to lease would have to look to the market for such resources.

The seven million IPv4 addresses Cloud Innovation sourced from AFRINIC are therefore valuable. Given its concerns over the use of the addresses that Cloud Innovation manages, AFRINIC back in 2020 wanted to clear things up.

Three researchers from the Internet Governance Project (IGP) at Georgia Tech's School of Public Policy in the US – Milton Mueller, Vagisha Srivastava, and Brenden Kuerbis – analyzed Cloud Innovation's activities and found it leases IPv4 addresses for $2 to $3 apiece, per year, and believed the company’s fees to AFRINIC were around $10,000 a year. Representatives for Larus this month told us the fees are actually $38,400.

"So, do the math," the researchers wrote in 2021. "Seven million numbers leased at just $2/year can generate upwards of $14 million in revenue."

Litigation

Opinion varies on AFRINIC's decision to challenge Cloud Innovation, and the RIR's threats back in 2021 to deregister those seven million IP addresses.

John Curran, CEO of the American Registry for Internet Numbers (ARIN), described the face-off as a "not uncommon" dispute of a sort that sometimes emerges between RIRs and their members.

The Internet Governance Project's researchers called AFRINIC's confrontation of Cloud Innovation an "overreaction to its past problems and was undertaken without appropriate risk management." They then labelled Cloud Innovation's response to Africa's RIR as "legal terrorism … designed to destroy AFRINIC rather than to preserve its legitimate business interests in a contractual dispute."

Representatives of Larus now disagree with the label "legal terrorism," saying the IGP came to that conclusion early on in Cloud Innovation's litigation against AFRINIC, and told us its lawsuits against the RIR have since been considered justified by the courts.

Cloud Innovation did not appreciate AFRINIC's threats. It insisted it was not in breach of any agreements, and that AFRINIC’s actions and arguments were inappropriate overreach. The firm launched a complex series of connected lawsuits against AFRINIC, one of which resulted in an injunction to freeze the registry's bank account.

That decision, for what it's worth, is one of several in which Mauritian courts have found in favor of Cloud Innovation. One such decision found that AFRINIC’s actions may not have afforded due process to Cloud Innovation. Another decision rejected AFRINIC’s argument that Cloud Innovation’s many lawsuits were a deliberate tactic to complicate the matter and make it harder to resolve.

The back and forth between the legal combatants became heated. Among AFRINIC's responses to Cloud Innovation's legal war was an August 2021 accusation [PDF] that it believed Cloud Innovation's customers used the leased IP addresses for activities that "relate to illegal gambling, illegal streaming of movies and other copyrighted content, or adult content/pornography sites, including some with indecent images of children."

Representatives of Larus told The Register AFRINIC did not identify the leased IP addresses linked to that aforementioned material, making it hard for Cloud Innovation to tackle the alleged activity. The representatives told us requests for those addresses were made, and that AFRINIC did not provide them. They also said a police complaint had been made against AFRINIC regarding the RIR's alleged poor handling of this matter.

The reps further assured us Cloud Innovation works with law enforcement agencies and cybersecurity companies to address allegations leveled at its customers. Indeed, the outfit’s homepage prominently features a form allowing the reporting of IP address abuse. They added Cloud Innovation shouldn't be held responsible for what customers do with their leased IP addresses.

Enter the NRS

In June 2021, while AFRINIC and Cloud Innovation fought, an unknown entity registered the domain name nrs.help – the online home of the NRS. A website appeared soon afterwards.

The Internet Archive’s snapshot of the site in September 2021 lists its address as Flat A3, 11/F, TML Tower, Tsuen Wan, N.T, Hong Kong.

That's the same address as a company called Larus Limited, whose CEO is named Lu Heng – the same Lu Heng who leads Cloud Innovation. Larus is Cloud Innovation's partner, and states the two work together "to delegate IP addresses to customers."

The Larus website details its IP leasing services, promising it can do so without a "complicated RIR transfer procedure."

"No need to go through RIR membership because IP addresses will be assigned to you from Larus's pool," the company's website states.

War of words

The NRS appears to have started campaigning against AFRINIC in September 2021, when the RIR's forums lit up in a thread titled "Lu Heng + Larus and the Number Resource Society" that contains several allegations that someone contacted AFRINIC members with a false claim that the registry would soon close and they should join the society instead.

In 2022, the NRS started publishing videos to promote itself and its position. In this video, the society articulated a complaint that is very close to Cloud Innovation's beef with AFRINIC: that the African RIR overreached with its threat to act regarding the allocated IPv4 addresses.

"The formation of the NRS was prompted by corruption, distortion, and threats made by AFRINIC in its bid to reclaim IPs and disconnect millions of end users," the video states.

"We firmly believe that an alliance of ISPs is required to bring the community and the internet operators together to hold the RIR to a higher standard of accountability and transparency."

The NRS has pushed for universal internet access without restrictions on netizens' activities. Just last month, the NRS started to campaign for ISPs to have the right to outright own IP addresses, which should be freely traded like any other asset, it said. RIRs would play a monitoring role, essentially, in that case.

"A virtual marketplace would exist similar to a stock exchange," an NRS spokesperson explained to The Register. "The price for IPs would fluctuate depending on demand and supply and would provide a [decentralized] solution for the future.

"RIR's role would be to ensure no duplication of IPs and ensure correct ownership registration. They would have no role in setting the values of the IP assets and would not own the IPs. This would require a change in RIR bylaws."

NRS argues such change is needed because the internet has essentially outgrown the thinking that determined the role of RIRs. The society also said it stood by the claims in its videos.

If the NRS gets its way – ISPs fully own their IP addresses, and RIRs serve as bookkeepers – disputes like that between AFRINIC and Cloud Innovation would be moot.

Representatives for Larus told us they already consider RIRs to be bookkeepers. The reps said this viewpoint is held by others in the internet governance world.

More IPs

Also this June, the NRS published a document defending Cloud Innovation's actions on the grounds that its request for and use of the IP trove AFRINIC awarded it allowed the African registry to secure the rights to another ten million IPv4 addresses from IANA.

The Register can find no other instance in which NRS uses a private entity’s plight to illustrate its arguments. The NRS assured us Cloud Innovation does not enjoy any special treatment over other members.

As discussed above, Cloud Innovation's interests aren't unreasonable: IPv4 resale and leasing is widely practiced. According to Larus, RIRs by and large allow their addresses to be configured and passed on to customers outside the regions they administer, though we're told RIPE NCC is alone in allowing its members to be legally registered outside of its service region.

In pursuit of its goals, the NRS issues statements that make extraordinary claims. This video, for example, opens: “There is a small company called AFRINIC in Mauritius that can destroy the entire internet. It is the almighty internet god that wants to disconnect the entire African continent.”

In correspondence with The Register, the NRS objected to any suggestion that such language was exaggerated.

In this clip, a society spokesperson claimed AFRINIC has "long claimed to have sovereign power, claiming to be the world's government that can control it."

In the same video the society stated: "The AFRINIC board are obligating all the resource members to monitor the end users of the internet and if the resource members refuse to do that, [their] membership is to be terminated immediately."

AFRINIC's service agreement [PDF] appears not to describe such powers.

The NRS's stance on AFRINIC's network monitoring and surveillance appears to rely on this 2021 letter [PDF] from the RIR to Cloud Innovation, in which the African registry accused the company of failing to monitor websites and other hosts that use IP addresses it was granted for offensive or illegal material. Representatives of Larus said one can infer from that letter that AFRINIC requires all members to police the internet, and said the monitoring requirement is unreasonably onerous. The reps reiterated that Cloud Innovation, like other network providers, should not be held liable for customers’ activities.

The NRS and Lu Heng are linked

As The Register investigated this situation, we noticed that the NRS website once contained another artifact linking it to Larus: a Larus Foundation email address as a contact for the NRS. The foundation is an internet governance advocacy body founded by Lu Heng. Cloud Innovation proudly states it donates to the foundation annually.

The NRS told us Larus gave it a website template, which explains the presence of Larus artifacts at nrs.help.

But there are other links. A content marketer named Catherine Coz's LinkedIn profile states she was employed by both the NRS and Larus Foundation from September 2021 to January 2022 – the period during which the NRS was in startup mode.

A Pakistan-based Larus employee named Umer Pirzada stated he has worked for Larus since February 2021 and served as a director of NRS since February 2023. Pirzada did not respond to our request for comment.

AFRINIC in trouble

By mid-2022, AFRINIC was not in a good state. CEO Eddy Kayihura's contract expired. Decisions in Mauritian courts made it impossible for AFRINIC to appoint a board, so Kayihura was not reappointed. Other RIRs later warned AFRINIC could be close to failure.

Cloud Innovation, meanwhile, carried out business as usual. ®

Update on July 10

This article was revised after publication to incorporate responses from Larus and NRS's representatives. Additionally Larus told us IP address leasing is commonplace and not at all unusual, and we are happy to make that clear.

We also note that after this story was published, the NRS issued a blog post arguing that RIRs are "important" though "can be susceptible to mismanagement."