On the ICP-2 Revision, RIR Failure Standards, and Why Power Must Remain Bottom-Up

Who should decide when a registry has failed: its members, or the institutions above it?

Lu Heng · December 18, 2025 · 1 min read

Conceptual illustration of four people around a white round table, with a small blue server and an open ledger between them. — Who decides when a shared registry needs to change? Lu Heng argues that the decision belongs to its members, including when the service fails.

The revival of ICP-2, a document drafted over 20 years ago to define the criteria for establishing Regional Internet Registries, was triggered by the AFRINIC governance crisis—and rightly so.

RIRs today operate with extraordinary autonomy: they answer to no sovereign authority, lack clear failover mechanisms, and in some cases have no meaningful data escrow or contingency plan. Establishing a failure standard is necessary.

What is not acceptable is using that process to further centralize power. Any mechanism to de-accredit or re-accredit an RIR must be driven exclusively by its members, not by the NRO or ICANN.

The RIR system exists only by voluntary consensus; there is no law or enforcement behind it. A top-down solution would fail immediately, because members can simply withdraw recognition.

If ICP-2 is revised, it must reinforce—not weaken—the bottom-up model, with explicit requirements that any decisive action requires overwhelming member agreement.

Accountability must come from decentralization, not hierarchy. Even where process flaws exist, I strongly encourage all members to participate in the current NRO questionnaire: if the community does not speak, others will decide for it.

Where this Note sits

What should remain stable, and for whom?

This Note's focus

This question in the exhibition

“Every system eventually reaches a moment when it must either adapt to reality or attempt to freeze itself in place.”Hall 5 · The Scale of TimeThe Mountain Stays, Weather Passes Note 25

Reading map

Before you start

Continuity means a working network can keep operating even when its current administrator fails or must be replaced.

The problem
“Stability” is often used to defend a permanent gatekeeper, even when the real thing people need preserved is the record and the ability to continue elsewhere.
The proposed direction
Protect continuity of the record while keeping the service replaceable and the path of exit real.
Why it matters now
Waiting for a visible failure can mean waiting until the alternatives, knowledge, and bargaining power needed to leave have already disappeared.