Global Internet Governance Update: RIR Stability at Risk

An RIR, or Regional Internet Registry, is an important organization because of its vital role in ensuring the stability and security of the internet. The non-profit organization manages IPv4 and IPv6 addresses, as well as Autonomous System Numbers (ASNs). There are only five RIRs worldwide, and they are distributed in different regions:

●   AFRINIC - Africa

●   APNIC - Asia-Pacific

●   ARIN - North America

●   LACNIC - Latin America

●   RIPE NCC - Europe, Middle East, and Central Asia

Ideally, these organizations work with ISPs, businesses, and other entities in their region without any hiccups. Their roles are large enough that any operational interruption could cause major problems in their region.

But what happens when an RIR has failed to maintain its role due to various circumstances?

Techtimes reported that the Address Supporting Organization Address Council has recently “delivered a completed Recommended Draft of the RIR Governance Document — version 3 — to the Number Resource Organization Executive Council (NRO EC).” The NRO is coordinating with five RIRs regarding these proposals. The draft aims to replace the current governance, the Internet Coordination Policy-2 (ICP-2) established in 2001. It’s a proposed update to the 25-year-old framework that aims to address emerging problems with RIRs.

Proposals to New Governance Rules

The updated governance comes with a few major changes:

●   Anti-Capture - legal challenges to an RIR can easily cripple its operations. Affected IP addresses could be exposed to security problems with major financial implications. The latest governance rules mandate RIRs to ensure this does not happen.

●   Continued Recognition and Operation - an RIR is expected to maintain its operation and ensure it constantly meets the requirements set by the governance document.

●   Derecognition - the biggest update so far is the possibility of RIR’s derecognition. This happens when an RIR fails to meet its requirements and maintain operations, even with support from other RIRs.

The AFRINIC Problem

Changes to the governance system are a much-needed update, not only because of the evolving internet landscape. Legal challenges AFRINIC has faced since 2022 have also led to the proposed changes in governance. Legal battles against an IP address broker and its companies have prevented AFRINIC from doing its responsibilities. Even remedies such as new board elections have prevented AFRINIC from functioning because of the legal battles.

While legal battles continue, IP addresses under AFRINIC are exposed to Border Gateway Protocol (BGP) hijacking. This type of hijacking allows the culprit to claim a set of IP addresses. Information sent to the IP address can be intercepted and read by the hijacker.

Current Status of the Recommended Draft

NRO EC has released the following statement on their next steps about the latest draft:

 “The NRO EC will now review the ASO AC Recommended Draft RIR Governance Document and progress the next stages of the process, including coordination with ICANN and the RIRs, and the pathway toward a final version.”

The governance revision draft has been in development since October 2023. Because of the scale of its implementation, impact, and legal repercussions, years of consultation and revisions have been implemented. What’s at stake is not only the survival of an RIR but also the security and stability of the internet worldwide.