Special report Two of the world's five regional internet registries – which among other things manage the allocation of IP addresses – are in the sights of a secretive lobby group: the Number Resource Society.
We have learned the NRS hopes to steer this allocation of scarce and valuable IPv4 addresses through various pressure tactics.
The Society makes questionable accusations – claiming the organizations that oversee the running of today's 'net, as well as their leaders, wish to "destroy the entire internet" for personal gain. The NRS also criticizes those governance organizations' structures and oversight, often on spurious grounds. Yet the society's own operations are utterly opaque: it won't even put a name to its commentary.
The NRS’s president – its sole identifiable officer – did not respond to multiple requests for comment from The Register, save for one occasion when we pointed out he had been removed from the society's website.
Strangely, NRS president Paul Wollner is not even the society's most visible member or advocate.
That role goes to Lu Heng – an entrepreneur with a long and colorful history of agitating for change in the internet governance world, who has publicly stated that today's oversight bodies are redundant and should dramatically scale back their activities.
The Society represents a determined effort to reshape how the world allocates its remaining IPv4 addresses, taking that process away from regional internet registries.
The NRS appears to be well-funded, and it is relentless. The Society's conduct and connections led The Register to believe it is likely not the grassroots lobby group it paints itself to be, but a vehicle for commercial entities that would profit from its desired reinvention of internet governance.
The NRS emerged in the second half of 2021, after the affairs of the African Network Information Centre (AFRINIC) again became controversial.
AFRINIC is one of the world's five regional internet registries, or RIRs: AFRINIC, Asia-Pacific's APNIC, North America’s ARIN, Europe’s RIPE, and Latin America’s LACNIC. These are the organizations that manage, allocate, and track the use of internet number resources – IP addresses and autonomous system numbers.
The African registry has a history of dysfunction, and in 2019 appointed a CEO whose reform agenda included an audit of the resources AFRINIC administers, to ensure they had been properly allocated according to its policies and were being used appropriately.
The audit found issues including internal corruption that led to inappropriate allocation of IP addresses.
In June 2020, AFRINIC management wrote to an organization called Cloud Innovation to which it previously granted the rights to use more than seven million IPv4 addresses. Cloud Innovation's CEO is Lu Heng, who also leads the NRS's most visible member company, Hong-Kong-based Larus Limited.
AFRINIC's letter alleged Cloud Innovation had breached an agreement with the RIR, with actions including leasing IPv4 addresses to entities outside the geographic area AFRINIC serves, and possible misrepresentation of the reason it wished to be allocated the addresses in the first place. If Cloud Innovation failed to satisfy AFRINIC, it could lose those IP addresses it was leasing out.
Leasing or reselling IP addresses is contentious, because RIRs consider them to be a resource allocated to those who need them – not a commodity to be traded.
But there are plenty who are willing to pay for leased IP addresses – especially IPv4 addresses, as only just under 4.3 billion will ever be available in total. In practice, the number actually usable on the public internet is much less. The vast majority of these addresses have been allocated and are either in use, or hoarded by those who were granted rights to the resources.
IPv4's successor, IPv6, was designed to offer as many as 3.4×1038 addresses – enough to last for centuries. But IPv6 isn't backward-compatible with IPv4, and a good number of users of the older protocol don't want to go through the pain of reconfiguring their networks and are instead trying to acquire as many IPv4 addresses as possible to meet their future needs.
Some of those who hold more IPv4 resources than they need for operational purposes therefore make them available on secondary markets.
RIRs mostly tolerate this, even though their policies don't explicitly allow it. Debate continues about whether RIRs should change those policies.
While that happens, the seven million IPv4 addresses Cloud Innovation sourced from AFRINIC remain rather valuable. Given its concerns, AFRINIC wanted the clear things up, and maybe even take them back.
Three researchers from the Internet Governance Project (IGP) at Georgia Tech's School of Public Policy in the US – Milton Mueller, Vagisha Srivastava, and Brenden Kuerbis – analyzed Cloud Innovation's activities and found it leases IPv4 addresses for $2 to $3 apiece, per year. Its fees to AFRINIC are just $10,000 a year.
"So, do the math," the researchers wrote in 2021. "Seven million numbers leased at just $2/year can generate upwards of $14 million in revenue."
The Number Resources Society's name is very similar to that of the Number Resources Organization (NRO) – the peak body for the five RIRs.
The RIRs and the NRO are part of the complex interlocking internet standards and governance organizations that includes ICANN, the Address Supporting Organization, IANA, and the IETF.
The NRS claims it "is acknowledged as a global non-profit membership organization advocating for a global unlimited, free, accountable and accessible internet for all." But it is not global and has no formal relationships with today's internet governance organizations.
Opinion varies on AFRINIC's decision to challenge Cloud Innovation and its threats to deallocate those seven million IP addresses.
John Curran, CEO of the American Registry for Internet Numbers (ARIN), described the face-off as a "not uncommon" dispute of a sort that sometimes emerges between RIRs and their members.
The Internet Governance Project's researchers called AFRINIC's confrontation of Cloud Innovation an "overreaction to its past problems and was undertaken without appropriate risk management." They then labelled Cloud Innovation's response to Africa's RIR as "legal terrorism … designed to destroy AFRINIC rather than to preserve its legitimate business interests in a contractual dispute."
Cloud Innovation did not appreciate AFRINIC's threats. It insisted it was not in breach of any agreements, and that any attempts to regulate it were inappropriate overreach. The firm launched a complex series of connected lawsuits against AFRINIC, one of which resulted in an injunction to freeze the registry's bank account.
Cloud Innovation had been allocated millions of IPv4 addresses by AFRINIC, and it wasn't about to let them go easily.
Among AFRINIC's responses to Cloud Innovation's legal war was an August 2021 accusation [PDF] that it believed Cloud Innovation's customers used leased IP addresses for activities that "relate to illegal gambling, illegal streaming of movies and other copyrighted content, or adult content/pornography sites, including some with indecent images of children."
Cloud Innovation's many legal ripostes have left AFRINIC unable to appoint a CEO or board. The lawsuits it has launched are so numerous and complex that unpicking them all would require vast effort.
In June 2021, while AFRINIC and Cloud Innovation fought, an unknown entity registered the domain name nrs.help – the online home of the NRS. A website appeared soon afterwards.
The Internet Archive’s snapshot of the site in September 2021 lists its address as Flat A3, 11/F, TML Tower, Tsuen Wan, N.T, Hong Kong.
That's the same address as a company called Larus Limited, whose CEO is named Lu Heng – the same Lu Heng who leads Cloud Innovation. Larus is Cloud Innovation's partner and states the two work together "to delegate IP addresses to customers."
The Larus website details its IP leasing services, promising it can do so without a "complicated RIR transfer procedure."
"No need to go through RIR membership because IP addresses will be assigned to you from Larus's pool," the company's website states.
You can join the dots here: Cloud Innovation was allocated millions of IP addresses from AFRINIC, and leases them via Larus, which is closely tied to the NRS. Both Cloud Innovation and later the NRS lobbied hard against AFRINIC – not just to stop a claw-back of IPv4 addresses, but to reform the registry and the allocation of addresses entirely.
An outcome that would suit Cloud Innovation nicely.
The NRS appears to have started campaigning against AFRINIC in September 2021, when the RIR's forums lit up in a thread titled "Lu Heng + Larus and the Number Resource Society" that contains several allegations that someone contacted AFRINIC members with a false claim that the registry would soon close and they should join the Society instead.
In 2022, the NRS started publishing videos to promote itself and its position. In this video, the Society articulated a complaint that is very close to Cloud Innovation's beef with AFRINIC: that the African RIR overreached with its threat to recoup the allocated IPv4 addresses.
"The formation of the NRS was prompted by corruption, distortion, and threats made by AFRINIC in its bid to reclaim IPs and disconnect millions of end users," the video states.
"We firmly believe that an alliance of ISPs is required to bring the community and the internet operators together to hold the RIR to a higher standard of a Source: The register