Regional Internet Registries collectively employ hundreds of staff worldwide and operate with annual budgets in the hundreds of millions of dollars, all funded by mandatory membership fees. This funding model exists because RIRs hold a de-facto monopoly over the registration of number resources. The question is whether this scale of expenditure is justified by their actual function.
Ahead of the 2023 APNIC elections, I raised serious concerns about its governance. At the time, those concerns were dismissed, and I was publicly attacked by a small but well-connected group with vested interests. Subsequent disclosures proved those warnings correct: APNIC was, in effect, under the legal control of a single individual. For two decades, its sole owner, director, and shareholder held structural power over the Internet for the Asia-Pacific region through a private company arrangement. That concentration of control was dangerous and fundamentally incompatible with the role APNIC claims to serve.
As IPv4 exhaustion rendered the original allocation role of Regional Internet Registries obsolete, a recurring question emerged: should RIRs continue to exist, and if so, in what form? Various alternatives have been proposed—state control, intergovernmental bodies, or treaty-based institutions modeled after organizations like the IAEA. All of these proposals share the same flaw: they attempt to solve a simple technical problem by adding political and bureaucratic complexity.
IPv4 addresses are widely treated as assets, traded for billions of dollars by cloud giants and telecom operators. Amazon alone has acquired close to one hundred million IPv4 addresses. Alibaba, Tencent, Huawei, and others have spent hundreds of millions, if not billions, doing the same. Yet there is a detail most boards and CFOs miss: none of those companies actually o
The revision of ICP-2 presents an opportunity to fix a structural weakness in Internet governance: the lack of guaranteed portability of number resources. Portability means that a network must have the unconditional right to move its IP addresses or ASNs from one Regional Internet Registry to another. This should not be optional, conditional, or discretionary; it must be a hard requirement embedded in ICP-2. Without portability, networks are effectively locked into the RIR they first registered with and are forced to bear the consequences of that RIR’s governance failures or operational breakdowns. That dependency creates systemic risk for the Internet itself.
The Internet today still relies on legacy structures that allocate and register critical identifiers—names and numbers—through centralised institutions that predate modern decentralised technology. These institutions, known as Regional Internet Registries, were created when the network was small and technical collaboration was informal. As the Internet matured into a global utility, the centralised control of identifiers became a structural vulnerability: a choke point susceptible to power capture, opaque governance and political pressure.
Global discussions on data sovereignty often confuse technical ideals with operational realities. At the Interconnect World Forum 2025 in Tokyo, I highlighted a core truth: enforceability of national data localisation laws is limited in a global digital economy where data flows everywhere and no single jurisdiction can physically contain connectivity.
A registry’s role is administrative, not punitive. Confusing the two is one of the most dangerous mistakes in Internet governance.
A registry exists to maintain accurate records: who is using which number, and under what documented procedures. It is, in essence, an address book. Asking such an institution to police behavior, impose penalties, or “punish” participants is a category error. You do not use an address book as an instrument of enforcement.
The Internet has been steadily moving toward decentralisation for decades. From infrastructure to applications, from blockchain to Web3, almost every layer is reducing single points of control. Yet one critical layer remains stubbornly centralised: names and numbers—domain names and IP addresses. This is not a philosophical issue but a structural risk. Any centralised choke point can be captured, politicised, or abused, and when that happens, the Internet fragments.
The Internet is often discussed as if it were a territory that can be owned, controlled, or conquered. This is a fundamental misunderstanding.
