A few weeks ago, we were the subject of several cease-and-desist letters, and a lawsuit, for the first version of this article. Due to delays in securing representation, and delays in communication, we were forced to appear in court before we were prepared. In settlement, we agreed to unpublish the initial version without prejudice, leaving open the right to cover the same story in a new form.

This time around, I am writing in a much more dry and clinical style, and ensuring that all factual claims are linked and cited in context, reserving almost all analysis, opinion and speculation until the very last concluding section. This is done merely to avoid confusion about the status of our claims, all of which are linked to sources in context, for which public resources exist. Other claims are backed up by internal sources. We did not err in our assessment of the story below, and the issue is of significant public interest.

Many thanks to those who have reached out to help, and those who have provided information. We now have adequate legal counsel and are confident that we may defend our claims without trouble.

‍

In ten days, AFRINIC, an NGO which functions as the internet registry for the African continent, is supposed be holding its regular board elections, but these have been postponed, and await plans from the official receiver who has taken charge of the company. The organisation manages the distribution of IP addresses for the whole African continent, and apportions them to members, rationing what is, for now, a scarce resource to members who pay limited fees at no profit.

The board elections allow a representative from every member organisation (private companies, universities, government bodies) to vote in a governing body. In these elections, a man is contesting for a position on the basis of cancelling its main functions, and privatising the IP addresses, so that they can be sold, rented and traded for profit without regulation.

This man is Chinese citizen Lu Heng.

‍

Crash course

IP addresses identify every device connected to the internet, and are vital to its function. There are two protocols - the limited IPv4, and the virtually unlimited IPv6. The world is running out of IPv4 addresses, with the final blocks allocated in 2011. IPv4's 32-bit structure limits it to about 4.3 billion unique addresses, insufficient for today’s internet demands. The transition to IPv6, with its 128-bit structure offering vastly more addresses, is critical but slow.

Many organizations cling to IPv4 due to compatibility issues, cost, and complexity of upgrading infrastructure. IPv6 adoption is growing slowly, with only 45% adoption globally, and 5% in Africa. Delays in transitioning could lead to a fragmented internet, higher costs for scarce IPv4 addresses, and hindered innovation.

Meanwhile, lucrative trading of IPv4 blocks has emerged, with prices rising as supply dwindles, further complicating access for smaller players. Switching to IPv6 requires careful rationing of IPv4 to allow a buffer zone, and commoditisation would threaten this, and increase scarcity.

Nobody owns IP addresses. They are allocated to members on the basis of registration services agreements (SRAs), wherein users agree to codes of conduct and commit to specific uses, which they must state up front.

This process is managed by the Regional Internet Registries (RIRs). They manage the distribution of Internet number resources (IP address space and Autonomous System Numbers). They include AFRINIC for Africa, The Asia Pacific Network Information Centre (APNIC), the American Registry of Internet Numbers (ARIN), LACNIC, covering South America and the Caribbean, and RIPE NCC for Europe, the Middle East and Central Asia.

Several of these bodies have been approached or targeted in some way by reform campaigns by Lu Heng.

‍

What Lu Heng does

Lu Heng is a Chinese citizen who owns Hong Kong based company Larus, which rents and “trades” the IPs across the globe.

The dwindling supply of IPv4 numbers has stimulated a lucrative secondary market for IPv4 addresses, as companies who receive them practically for free (aside from the membership fees to their RIRs, and the occasional service cost) trade them for an average price of around R900 (US$45) each. This is known, in economic terms, as rentseeking - “growing one's existing wealth by manipulating the social or political environment without creating new wealth”.

In Africa, Lu Heng owns a company called Cloud Innovation, registered in the Seychelles, as a means for gaining access to AFRINIC, which has some of the few remaining free IPv4 blocks. The basic business model of Cloud Innovation is passing on its IPv4 allocation to Larus.

Shortly after graduating from university in Groningen in 2012, Mr. Lu Heng, through Cloud Innovation, received 6.2 million IPv4 addresses from AFRINIC (~5% of all the IPv4 addresses in Africa) in four different installments (154.80.0.0/12 issued July 2013; 45.192.0.0/12 issued December 2014; 156.224.0.0/11 issued December 2015, and 154.192.0.0/11 issued September 2016). Larus was founded in 2016.

Larus is attached to the Larus Foundation – an NGO Lu Heng has described as focusing on "internet governance education." This appears to be largely used as a PR vehicle for pushing a certain model of reform for the RIRs.

In an interview with Lu Heng himself, he explains how he aims to utterly dismantle and transform the RIRs to subvert their entire stated and practiced purpose, by taking away their control of the only thing they exist to manage - IP addresses. He intends to privatise the IPv4 database and allow member companies to profit off a common resource without restriction.

This campaign started soon after he ran into limitations imposed by these RIRs on his use of their resources, and the changes he wishes to see almost exclusively benefit companies sharing his business model. Removing controls over IP address allocations would hasten the depletion of IPv4 addresses, pushing up their price, and release them for trade outside of the regions they are currently restricted to.

This can’t be a good situation for anyone, except for those who have a vested interest in selling IP addresses. But his campaign to transform AFRINIC came at a time when they were extremely vulnerable.

‍

Past corruption at AFRINIC

In 2020, Eddy Kayihura took over AFRINIC. He had inherited a rotten organisation, and intended to use his new mandate to clean house.

Just prior to his election, an exposé by investigative journalist Ron Guilmette and AFRINIC member Jan Vermeulen revealed that a founding member of AFRINIC, Ernest Byaruhanga, had been accused of stealing 4.1 million IP addresses, 2.3 million from AFRINIC's “free pool” and 1.7 million from “legacy” IP addresses - already legitimately apportioned to a number of organisations including Sasol, Woolworths, and the City of Cape Town. They were worth over R800 million, and were sold on the black market to agents who forward spam, steal data, and sabotage functioning websites. The former CEO Alan Barrett admitted he was aware of what was happening and did nothing.

It was under Byaruhanga and Barrett’s governance that Lu Heng received his massive chunk of the lucrative IPv4. Byaruhanga, like Lu Heng, had run an IP leasing company, and may have personally benefitted from the heist.

APNIC assisted in investigating the thefts, and after dealing with the heist, AFRINIC was assisted by ARIN in completing a registry audit, to make sure the remaining IP addresses were being used correctly.

‍

Cloud Innovation

In the process, ARIN determined that Cloud Innovation’s usage of the IP resources was unusual, and as a matter of routine, was asked to clarify its operations. AFRINIC found that the resources were not being used for the purpose stipulated in the registration services agreement (RSA) which justified their issuance.

As a result, these addresses were seized, with prior warning to allow customer migration off those resources.

ARIN helped AFRINIC to review the IPs Lu Heng had obtained, and demonstrated that they were not being used in Africa. While some address blocks were being routed from an ISP in South Africa, Cloud Innovation itself announced others routed through Hong Kong and the United States - the vast majority thereof.

John Curran, President and CEO of ARIN, wrote a rare explainer in 2021 on their dealing with Lu Heng. ARIN had first-hand experience with Lu Heng’s business practices in seeking IP number resources. Through his company Outside Heaven, Lu Heng had already approached ARIN to try to get his hands on over a million IPv4 addresses. ARIN refused, because Lu Heng allegedly provided false information about his location and intentions, and based on the balance of evidence, was allegedly intending to use the IPs for purposes ARIN did not approve of, outside of their jurisdiction.

According to testimony in a libel case from 2022, in which Lu Heng unsuccessfully sued a detractor in Malawi (Cloud Innovation Limited v. Brian Munyao Longwe, Civil Cause No. 380 of 2022, High Ct. of Malawi), a good deal of the clients using the IPs that had been seized by AFRINIC were using them for child pornography and gambling sites, I quote:

Lu Heng may defend this state of affairs by claiming he has no control of what his users do, but he has at minimum an ethical duty to take them down, and in some jurisdictions, a legal duty, which he has failed to adhere to.

By all accounts, AFRINIC is well within its rights under the registration services agreement - which always stipulates a regional use basis - to reclaim them. The point, after all, is to make sure the IPs are used to benefit the development of the African internet, not to serve vested interests on a global scale.

The AFRINIC bylaws clearly stipulate that membership (and consequently use of their resources) is restricted for use within the region itself. Resource members (the membership category Cloud Innovation falls under) must comply with terms of use defined by the RSA, and this pertained to Cloud Innovation.

Yet somehow, Lu Heng is apportioning the IPs registered under this RSA through his Hong Kong based company Larus instead. In fact, the membership requirements in the AFRINIC bylaws explicitly rule out Lu Heng’s entire business model. The resources as per his RSA may only be used for the purpose for which it was assigned - if Lu Heng wants to use it for a different purpose that has to be communicated with AFRINIC. Leasing is not a valid motivation since it’s not his organisation that needs the resources.

Cloud Innovation itself is a nearly empty site that simply hosts a few press releases related to Lu Heng’s battle with AFRINIC, and links to Larus, the company Lu Heng started in 2016. Since one cannot actually own IP addresses, and Larus is advertising that they can sell IP addresses as if they were legal property, their business model appears to be fraudulent by definition.

‍

The lawsuits

But Lu Heng disputed AFRINIC’s authority to enforce its own contracts and regulations, and launched a barrage of court cases in Mauritius (25 of them initially), not only to keep control of his lucrative address blocks, but also to extract punitive costs, freeze their accounts, and subsequently depose the board.

The courts turned out to be so deeply unsympathetic that they issued several of the orders ex parte - meaning that orders were granted against AFRINIC in their absence, without them having presented evidence for their side. Why these rulings have been allowed to go ahead remains opaque, since none of these cases are available to the public online. But one possibility is that the judges simply do not understand the technical details, and their crippling of a vital element of the internet management infrastructure is perhaps a byproduct of the belief that it is simply a service enterprise like any other.

For the next 12 months, AFRINIC was crippled in its ability to perform its critical functions. The first ex parte order, which froze AFRINIC’s bank accounts was lifted after three months by the Mauritian courts once AFRINIC was able to make its case, but caused enormous strain in the meantime. The second ex parte order stopped the annual election of Directors at the annual general meeting.

As a result, AFRINIC was left with no board, no CEO, and has occasionally been forced to close operations, due to not being able to pay its staff. With the previous officeholder's contract expiring, and AFRINIC unable to renew it, they couldn’t even conduct meetings to work around these obstacles.

After a court order on the 12th of September 2023, Vasoodayven Virasami was appointed receiver. In Mauritius, when a company is in financial distress, it has an impartial receiver appointed by the state on behalf of a creditor to manage its assets to repay debts. The receiver takes control of specified assets, with powers to manage, sell, or recover income to settle debts, but owes a duty to the company to obtain fair value and preserve core functions if possible.

But under Virasami’s control, the organisation failed to process applications for assignment of IP addresses, limiting internet usage for new companies. Somehow, Lu Heng’s close associate Paul Wollner managed to get hired as an “IT consultant” by the new state-appointed receiver, and accompanied him into the head offices on their first day. That act was reported to Mr Virasami’s boss and the directors. CCTV footage of their concurrent entrance into the premises exists. From a former board member:

“Thanks for reaching out. I hope you are aware that as at 15th October 2024 when the OR was restated, the 4 remaining Directors including myself were effectively removed as Directors and have no locus standi in AFRINIC. So to the best of my knowledge AFRINIC currently has no Board. If you are referring to the period around October 2023, when the OR was first appointed, then yes, Mr. Virisami came to the AFRINIC office the very first time with Paul Wollner as his IT Consultant. And there are sworn affidavits in the Mauritius Courts to this effect.”

The abuse of due process was severe enough that the community of RIRs urged the Mauritian government to intervene. As ARIN CEO John Curran’s letter on behalf of the NRO put it:

“It would be very unfortunate for the African regional community if the above situation proves that the designation of Mauritius as the place to locate AFRINIC has been wrong. It is our understanding that AFRINIC has repeatedly asked for recognition from Mauritius of it as an international organization. […i]f granted, it might lead to more appropriate outcomes […] while also ensuring AFRINIC continues to remain accountable and subject to Mauritian laws.”

Last month, AFRINIC won a court order forcing the substitution of the court-appointed receiver due to a failure to execute his duties. Mr. Gowtamsingh Dabee is now the newly appointed receiver over AFRINIC. Upon Dabee’s appointment, ICANN, the highest body responsible for internet address management (including IP, email, domain names among others), wrote him an open letter explaining the importance of the organisation he was about to be custodian of, and begging him not to hurt it like his predecessor did:

“ICANN understands that under the Official Receiver, there were limitations placed on AFRINIC’s ability to perform assignments of numbering resources. ICANN, through its IANA function, has received at least one formal complaint from an applicant to AFRINIC for numbering resources stating that they have been waiting for months for any communication or assignment. ICANN understands that similar concerns have been raised on AFRINIC’s membership mailing lists.

We are hopeful that, with AFRINIC acting under your direction, AFRINIC’s assignment work can swiftly restart, so that organizations in AFRICA are no longer denied IP address space to build and grow their networks. ICANN seeks AFRINIC’s assurances that AFRINIC will return to acting in alignment with its core functions and re-start assignments of numbering resources even while work is proceeding to complete the elections for AFRINIC’s governing board by the Court’s mandate of 25 April 2025. Resource assignment is important today, and cannot wait for a period of months to restart.”

‍

The AFRINIC board elections

In the lead-up to elections for the AFRINIC board last time, there were a number of significant irregularities.

In an affidavit to the court in Tanzania, Vinayin Benedict, an AFRINIC member, details the lobbying efforts by Lu Heng and the NRS to get AFRINIC’s IP addresses privately commoditised, including offers of bribery to gain control of his AFRINIC ID and organisational handle.

The NRS mentioned in the above affidavit once shared a physical address with Larus. They offer themselves as an alternative to the The Number Resource Organization (NRO), the highest body overseeing the regional internet registries as a coordinating body for joint work and support.

While the NRS claims extensive membership (the legitimacy of which is questioned by several sources interviewed for this piece), it has no affiliations with RIRs. In an October 2022 talk by ARIN CEO John Curran, the NRS’s PR campaign against AFRINIC was described as contributing significantly to its problems.

Tech news site The Register found a Wayback Machine snapshot of the NRS's contact page. On it, the NRS’s email address link was coded as a mailto link to info@larus.foundation, an email address for Lu Heng’s “charity” foundation which augments the work he does through Larus.

In the upcoming AFRINIC board elections, Paul Wollner, the head of the NRS, is Lu Heng’s preferred candidate.

But this is not the only RIR that Lu Heng has launched such a crusade against.

‍

APNIC

The 2022 executive council elections at the Asia Pacific Network Information Centre (APNIC) were fraught with abuse.

APNIC distributes and manages IP addresses and AS numbers for 56 countries, and in 2019, the board began restricting the supply of IPv4 addresses, rationing the last remaining block of 16.7 million addresses to postpone its inevitable exhaustion. APNIC now allocates just small blocks of 512 addresses.

During the 2022 board elections, APNIC was forced to appoint external lawyers to investigate several alleged breaches of its electoral code of conduct, including intimidation and bribery, along with a significant astroturfing campaign. Several of these complaints were referred to the Australian authorities.

The NRS endorsed a number of candidates and called for members to "seize control," calling for the IPv4 addresses to be commoditised on "a free market where businesses are free to run unhindered", proposing a relocation of headquarters from Australia to Singapore, and big cuts to membership fees.

Soon enough, there were a number of shenanigans. APNIC warned its community that several members had received phone calls lobbying for votes, from someone claiming to be APNIC staffer, including false claims of irresponsible governance and that the organisation was “a dictatorship”:

“Most reports have included complaints of unsolicited phone calls and emails promoting candidates […] However, there have been credible and serious reports of Members receiving threatening anonymous phone calls demanding silence on election issues.”

APNIC had to appoint the private law firm Maddocks to oversee the investigation, because there were so many instances of misconduct that their in-house staff could not handle them.

An unknown party issued injuctions to prevent the publication of the identity of the parties, but one of them was released due to internal disciplinary processes - Larissa Santos, one of Larus’s nominees. The contact data for many of the members who were intimidated were scraped from confidential information only available to employees and directors. APNIC chose not to publish this information because the “threats of legal injunctions against publication of details that would have interrupted the election process if successful. It was decided not to risk any delay to determining or announcing the election result, and therefore not to publish those details as the injunctions would have stalled the elections.”

The NRS was found to have distributed pamphlets accompanied by a letter from their candidate Larissa Santos.

One particular claim used by the illicit campaign (that APNIC is a dictatorship) also happens to be almost identical to claims Lu Heng had been promoting on his company website, where he claimed that, despite the company being run on a democratic basis with regular elections of the board of governors, it was somehow also “100% owned, operated and controlled by just one man, Mr Paul Byron Wilson, for 25 years”.

This is clearly twisting the facts. As another APNIC member explained, citing official regulations,“It is a requirement set by [ASIC, Australia’s statutory body for managing company registrations] that at least one company director be a resident of Australia. […] Paul serves as an ex-officio member to meet this requirement." More pertinently, he explained that: “they have been quite clear in the proposed concept for corporate diversity. Effectively, no single organisation, corporation or related bodies corporate can have more than one EC member serving. This is designed to prevent the council from being stacked with members from one organisation that may have a conflict of interest.”

This would explain the need for intimidation and astroturfing. Six of the candidates, including Lu Heng, were pushed by the Number Resource Society (NRS), which is run by Paul Wollner, and based in Morocco, and some of the candidates were employed at Larus. They also published content alleging abuse of powers and self-enrichment schemes by standing senior governance officials. Lu Heng tried to get the investigating firm Maddocks removed as counsel, alleging a conflict of interest due to APNIC’s in-house counsel having worked for the firm before.

Ultimately, the “reformers” were rejected, and none of Lu Heng or his preferred candidates won a seat. The new council swiftly implemented rule changes to prevent a repeat of the same debacle. Karl Kloppenborg, an Australian telecoms engineer, urged APNIC members to hold an extraordinary meeting to amend bylaws, limiting each company or entity to one representative on the council.

‍

Election time

AFRINIC will be holding its own board election, the first since being placed under receivership, on the 25th of April.

If he succeeds, Lu Heng’s strategy could see IPv4 addresses for the African region completely taken up for the East Asian market at rates favouring him, and the permanent privatisation of one of the basic building blocks of the internet in Africa (Asia too, if his campaign there is successful).

While Lu Heng claims to have the best interests of internet users at heart, his actions do not reflect this. Rather than simply acting to preserve his core business, Heng took a scorched-earth strategy, by means of lawfare, which crippled AFRINIC’s functioning, and launched a campaign aimed at erasing it and its core function.

His business model also creates a vested interest that is hard to ignore. Gaining control of APNIC and AFRINIC would allow Heng and his associates to manipulate allocation rules - say, by loosening restrictions on transfers or leasing - to favour Larus’s model, boosting profits by flooding the market with IPs under his control, scooping up massive revenue by renting them out through his main company, Larus.

Heng’s campaign would only be profitable in the long term if his aim were to commercialise the reserved addresses and prevent the IPv6 upgrade. But it would still be tremendously profitable in the short- to mid-term if he could remove regional restrictions and allow global capital to seize and trade African IP addresses as passive rentiers. Even at $1 per address, he would rake in over $6 million a year, and rates are far steeper in reality, with no meaningful overheads.

He aims to break apart the regional governance system, and create a single “unregulated” market under the guidance of his conflicted interests. This could see the end of the internet as we know it, and possibly create a new global tech giant on the back of little more than lawfare, gatekeeping and rentiership.

‍