Africa’s internet riches looted, disputed by China broker

KAMPALA, Uganda (AP) – Foreigners have long benefited from Africa’s riches of gold, diamonds and even people. Digital resources have not proven different.

Millions of Internet addresses assigned to Africa have been tossed, some fraudulently, including through insider input linked to a former top employee of the nonprofit organization assigning the continent’s addresses. Instead of serving Africa’s internet development, many have benefited from spammers and scammers, while others quench Chinese appetite for pornography and gambling.

New management at the non-profit organization, AFRINIC, is working to recover the lost addresses. But a legal challenge from a Chinese businessman with deep pockets threatens the body’s existence.

The businessman is Lu Heng, a Hong Kong-based arbitration specialist. Under controversial circumstances, he obtained 6.2 million African addresses from 2013 to 2016. That is about 5% of the continent’s total number – more than Kenya has.

ISPs and others to whom AFRINIC assigns IP address blocks do not purchase them. They pay membership fees to cover administrative costs that are intentionally kept low. However, it left plenty of room for grafting.

AFRINIC made no claim for graft when it recalled Lu’s addresses, which are now worth about $ 150 million, saying his business did not adequately serve Africa’s interests. Lu fought back. At the end of July, his lawyers persuaded a judge in Mauritius, where AFRICNIC is based, to freeze his bank accounts. His firm also filed a $ 80 million defamation suit against AFRINIC and its new CEO.

It is a shock to the global networking community, which has long regarded the Internet as a technological scaffolding to promote society. Some worry that it could undermine the entire numeric address system that makes the Internet work.

“There was never really any thought, especially in the AFRINIC region, that someone would just directly attack a basic element of Internet governance and just try to shut it down, try to make it disappear.” said Bill Woodcock, CEO of Packet Clearing House, a global nonprofit organization that has helped build Africa’s Internet.

Lu told The Associated Press that he is an honest businessman who did not break any rules to get the African address barriers. And rejecting consensus from Internet stewards, he says its five regional registries have no business deciding where to use IP addresses.

“AFRINIC must serve the Internet, it is not meant to serve Africa,” Lu said. “They’re just accountants.”

By revoking Lus’ address blocking, AFRINIC is trying to reclaim internet properties that are critical of a continent that is lagging behind in utilizing internet resources to raise living standards and increase health and education. Africa has only been assigned 3% of the world’s first generation IP addresses.

To make matters worse: the alleged theft of millions of AFRINIC IP addresses involving the organization’s former No. 2 official, Ernest Byaruhanga, who was fired in December 2019. It is unclear whether he acted alone.

The registry’s new chief executive, Eddy Kayihura, said at the time that he had lodged a criminal complaint with Mauritius police. He shook up the management and started trying to recover recalcitrant IP address blocks.

Lu’s trial is not related to the criminal complaint against Byaruhanga. But it has also amazed and terrified the global internet governance community. Network activists are concerned that they may help facilitate additional Internet resources from China, firstly. Some of Lu’s largest customers include the Chinese state-owned telecommunications companies China Telecom and China Mobile.

“It does not look like he is running the show. It does look like he is the face of the show. I expect him to have quite a bit of backing that actually pulls the strings,” said Mark Tinka, a Ugandan leader engineer at SEACOM, a South Africa-based internet backbone and service provider, Tinka worries that Lu has “access to an endless pile of resources.”

Lu said allegations that he works for the Chinese government are “wild” conspiracy theories. He said he is the victim of ongoing “character assassinations.”

While billions use the internet daily, its internal functions are only slightly understood and rarely subject to control. Globally, five fully autonomous regional bodies acting as non-profit public trusts determine who owns and operates the Internet’s limited stock of first-generation IP address blocks. AFRINIC was founded in 2003 and was the last of the five registers created.

Just a decade ago, the pool of 3.7 billion first-generation IP addresses, known as IPv4, was completely depleted in the developed world. Such IP addresses are now being auctioned for between $ 20 and $ 30 each.

The current crisis was accelerated by the revelation of the alleged fraud at AFRINIC. The study of 4 million IP addresses worth more than $ 50 million by Byahuranga and perhaps others was discovered by Ron Guilmette, a freelance Internet expert in California, and revealed by him and journalist Jan Vermeulen from the South African technology site MyBroadband.

But it was far from it all.

The ownership of at least 675,000 wayward addresses is still in dispute. Some are controlled by an Israeli businessman who has sued AFRINIC for trying to reclaim them. Guilmette estimates that a total of 1.2 million stolen addresses are still in use.

Someone had tampered with AFRINIC’s WHOIS database records – which are like deeds for IP addresses – to steal so-called older address blocks, Guilmette said. It is unclear whether it was Byahuranga alone, or whether other insiders or even hackers were involved, he added.

Many of the wrongful address blocks were unused IP space stolen from companies, including the mining giant Anglo American.

Many of the disputed addresses continue to host sites that have junk URL names and contain gambling and pornography targeted at an audience in China whose government bans such online businesses.

When Kayihura turned his attention to Lu this year, he told him in writing that IP address blocks assigned to his Seychelles-registered company did not “originate services from the AFRINIC service region – contrary to the stated justification.”

Lu would not discuss the reasons he gave AFRINIC for the IP addresses he has been given, but said he has never broken any of AFRINIC’s rules. Such justifications are part of what is typically an opaque, confidential process. Kayihura would not comment on them, citing the legal case. Nor would the two men who were AFRINIC’s executives when Lu received the grants.

Emails obtained by the AP show that Lu in his first request for IP addresses in 2013 made it clear to AFRINIC that his customers would be in China. In those emails, Lu said he needed the addresses of virtual private networks – known as VPNs – to bypass the Chinese government’s firewall that blocks popular sites like Facebook and YouTube there.

He said he discussed this with Adiel Akplogan, AFRINIC’s first CEO, in Beijing at a 2013 meeting mentioned in emails. Akplogan, who resigned in 2015, would not comment on any discussions he may have had with Lu on the subject.

Akplogan’s successor, South African internet pioneer Alan Barrett, would only say that “all appropriate procedures were followed.”

At the time, in 2016-17, Lu said his company, Cloud Innovation, had left the VPN business and switched to address space leasing.

Lu notes that other regional registers – including RIPE in Europe and ARIN, the North American Registry – routinely assign address blocks outside their regions.

That may be the case, experts say, but Africa is a special case because it is still evolving and vulnerable to exploitation – even though AFRINIC’s statutes do not explicitly prohibit geographical outsiders from gaining IP space.

Unlike other regional registries, AFRINIC’s stewards neglected to forge strong alliances with continental governments with the resources to ward off legal challenges from wealthy usurpers, Woodcock of the Packet Clearing House said.

“The governmental conditions needed to get it treated as critical infrastructure were never prioritized in the African region,” he added. “This is not a threat coming from Africa. This is a threat from China.”

The international registry community has come together to help the struggling reformers of AFRINIC.

ARIN President John Curran said in a statement of support that the Mauritian court should also consider whether fraud was committed by assigning the IP addresses to Lu. His legal battle “has the potential to have a significant impact on the overall stability of the Internet number registration system,” he wrote.

A Mutual Assistance Fund of more than $ 2 million created by the regional registries is available – and has been offered – should AFRINIC need it to keep running during the legal battle.

The AP found several pornography and gambling sites targeting a Chinese audience using IP addresses obtained by Lu from AFRINIC. Although these sites are banned in China, they can still be accessed there via VPNs.

Lu said such sites make up a small portion of the sites that use his IP addresses and that his company has strict policies against posting illegal material such as child pornography and terrorism-related content. He said he does not actively monitor the content of millions of sites hosted by those who rent from his business, but all actionable complaints about illegal activity are forwarded immediately to law enforcement.

It is not clear whether the police investigation into Byaruhanga is advanced. Mauritian police did not respond to attempts to determine if they had tried to question him at all. Byahuranga is believed to be living in his native Uganda, but could not be located for comment.

Akplogan, his former boss, said he was not aware at the time of Byahuranga’s alleged misappropriation of addresses.

“I do not know how he did it,” said Akplogan, who is a Togolese student and is now based in Montreal. “And for those who know the reality of my management of AFRINIC, they know full well that it’s not something I want to have known and let it go (on).”

Akplogan, who was inducted into the Internet Society’s Hall of Fame two years ago, is currently Vice President of Technical Engagement at ICANN (Internet Corporation for Assigned Names and Numbers), the California body that oversees global network address and domain name companies.


Bajak reported from Boston and Suderman from Richmond, Virginia.


In a story originally published on October 1, 2021, The Associated Press reported on how millions of Internet addresses assigned to Africa do not serve Africa’s Internet development. The story was updated on November 22, 2021 to further clarify that businessman Lu Heng’s lawsuit was not related to a criminal complaint against an official of AFRINIC, the non-profit organization that assigns the continent’s Internet addresses, and that AFRINIC did not claim a graft against Lu . .

Leave a Comment