The bookkeeper has become a gatekeeper.

An IP address works like a phone number for a network: it lets computers and networks find one another. For that to work, no two networks may use the same number at the same time. Five organisations, the Regional Internet Registries, keep the records that make sure of it, each for its own part of the world.

Their essential work is modest. They record which network holds which numbers, check that a change of holder is genuine, stop the same block from being registered twice, and publish the information other networks and security systems rely on. I have described a registry as a clerk of uniqueness, and as the address book of a growing city: it records which number is in use by whom, so that traffic can find its way.

Nothing on this page argues against that work. The Internet needs it, done reliably. What has gone wrong is everything that has grown on top of it.

The registries’ rules were written when addresses were plentiful and nearly worthless. Words such as “public resource”, “need” and “stewardship” did little harm while nobody had much at stake. Then the free supply of IPv4 ran out. Addresses began to be bought, sold, leased, financed and fought over in court, and they became part of how businesses reach their customers. The rules kept their old language, but the same words now decide who may use something valuable.

So the list became a gate. In several regions a buyer must first convince the registry that it needs the addresses and will use them on the registry’s timetable: at APNIC, with a detailed plan to use them within twenty-four months; at ARIN, by documenting that it will use at least half of a larger block within twenty-four months. In February 2026, as I read its new transfer policy, AFRINIC went further: every transfer needs its prior written approval, some addresses may not leave the region at all, and transfers made outside the channels it approves are not recognised.

None of this protects uniqueness. A registry can check that the seller is genuine and the record correct without deciding whether a business plan deserves to exist. Around the transfer rules a wider habit has grown, which I call enforcement creep: registration used to police leasing, customers’ locations and business models, with revocation held in reserve for anyone who does not comply.

A registry decision can freeze a sale, strand a network’s addresses or disturb the security records that other networks use to trust its routes. When such a decision destroys value, the registry answers for almost nothing. AFRINIC’s and ARIN’s agreements cap their liability at the greater of six months’ fees or US$100; APNIC’s seeks to exclude its liability and asks members to indemnify it. Small organisations with association-sized budgets hold power over assets and services worth far more than they could ever repay.

Nor can a network walk away. Its addresses stay with the registry of its region, however that registry behaves. It cannot take them to a better-run registry the way you keep your phone number when you change mobile provider.

The consequences reach beyond business. The five registries are private organisations under the laws of Mauritius, the United States, the Netherlands, Australia and Uruguay. A country whose networks depend on them bears the damage if its numbering is disrupted, while the lever sits with a foreign private company whose liability can be as little as US$100. I call this sovereignty inversion.

The registries and the wider world of Internet governance defend their power by saying they speak for someone: a region, a continent, “the community”, the end user. The numbers tell a different story. ICANN’s At-Large Advisory Committee, which its bylaws describe as the home of individual Internet users, has fifteen members; about six billion people are online. When RIPE NCC’s members voted in May 2025, turnout was 5.3%: 1,039 votes from 19,713 eligible members.

Taking part is valuable, and I do not object to it. I object to turning it into a mandate. A service region is a map drawn for administrative convenience, not a people. Being affected by a decision is not the same as having the authority to make it. Meanwhile the operator, who signs the customer contracts, runs the routers and answers when the service fails, counts as one voice among many in rooms that decide what may happen to its network.

The cost does not fall on the registries. It falls on operators, in delays, legal work and deals that never happen; on their customers, who pay more and may be forced to renumber systems built around an address; and on the countries that depend on those networks.

It falls hardest on the poor, the very people the rules claim to protect. Decades of allocation by “need” rewarded whoever was already large: the United States holds 43.63% of allocated IPv4 addresses, the whole AFRINIC region about 3.15%. Fees, paperwork and uncertainty cost a small operator in a poor market far more than a large one, and a rule that stops a region’s addresses from leaving lowers what they are worth to the people who hold them. I call this the poverty penalty.

Most of these costs stay hidden. Small operators cannot afford to fight a registry, so they settle, comply or disappear, and their silence is then taken for consent.

AFRINIC shows what happens when this structure comes under strain. By its own account it operated without a quorate board from 2022, and a court appointed a receiver to organise new elections. In February 2026 the newly elected board, whose election was itself disputed, ratified the transfer policy that keeps addresses in the region; a court challenge to that ratification was lodged in March 2026. An institution that could not govern itself still claimed the power to decide what networks may do with their addresses.

Africa is not an exception. The same contract terms, liability caps and need tests exist in the other regions, and the rulebook that recognises the registries is itself being rewritten. The dispute that brought AFRINIC to court is the best known, but it is not the point. The point is the structure that made it possible.

That is why I describe this as a failure of design rather than a story about bad people. A system that gives an unaccountable institution control over what others depend on will produce the same harm whoever sits on its board.