Afrinic's new CEO promises change of culture at org laid low by allegations of corruption and dysfunction

Eddy Kayihura hopes to fix troubled regional internet registry

Interview In November, Rwandan IT expert Eddy Kayihura took over as CEO of Afrinic – Africa’s troubled regional internet registry, which is responsible for allocating the continent's IP addresses among other resources. This month he spoke to The Register about his plans for the future, including the overhaul of the registry.

So, why exactly did you take the job, we ask.

“That question wasn’t on the list,” Kayihura laughs before answering, with sincerity, that he “believes in this company, and the community.” A pause. “I was one of those who benefited from Afrinic; it has really contributed to the growth of the internet in Africa.”

He pauses again. “I knew there were problems. My assessment was that they don’t seem small, but they are addressable.”

One of those problems, we pointed out moments earlier, was that the registry's auditor PwC unexpectedly quit in mid-December, mere weeks after Kayihura took the helm. PwC was vague in its explanation for why it was ditching the organization, prompting Afrinic to formally ask for a longer explanation. But everyone already knew the answer.

It was because a founding member of Afrinic, Ernest Byaruhanga, had been accused of quietly stealing IP address blocks from Afrinic’s system and selling them on the black market to spammers.

For years, some in the internet community warned of suspicious activity, though little was done about it. Former Afrinic CEO Alan Barrett told the board in a parting note, after his resignation in April, that he was aware of allegations of the unauthorized sale of IP address blocks, though felt the claims were “not persuasive enough to justify opening an investigation.”

In early December, an explosive report linked Byaruhanga to two companies, Amiek Holdings and IPv4 Leasing, that had been handed control of IP blocks to sell. These revelations stemmed from months of research by investigative journalist Ron Guilmette, who had sent someone to offices in Kampala, Uganda, to photograph corporate ownership documents in person, and establish a paper trail leading to the Afrinic founding member.

Here we go again

Afrinic promised an investigation, causing the internet community to collectively groan: this was far from the first time Afrinic has been at the end of serious allegations that were subject to an internal probe that subsequently discovered there had been no wrongdoing. The decision on what to do came down to newly installed Kayihura, and it would be the CEO's first big test.

Ultimately, Kayihura satisfied those who had been waiting for years for Afrinic to act. First, he pulled in a fellow regional internet registry APNIC, which oversees Asia-Pacific, to carry out an investigation into what had happened.

Then, when that probe concluded address blocks had been wrongly assigned, and that Byaruhanga was allegedly behind it, Kayihura oversaw the staffer's eventual dismissal for serious professional misconduct. And then, most importantly, the chief exec reported the matter to the Mauritius Police.

“We have filed a complaint and the investigation is ongoing,” Kayihura tells us, adding Afrinic is still in frequent contact with the cops. He says he doesn’t believe any previous Afrinic issues have been referred to the police.

And before we have a chance to ask, he starts relaying what Afrinic is doing at its end to ensure this never happens again. “We have fixed the issues, and we can ensure that the [Whois IP address] database shows the true state of affairs. We won’t stop until everything is in order.”

Afrinic created the role of data manager that Kayihura swears was not opened solely in response to the scandal, but to improve operations in general. We note the new job will add an extra layer of checking and authorization before future changes can be made to Afrinic's Whois database of IP addresses.

Sexual harassment

That’s not the only scandal we wished to talk about. Back in 2018, Afrinic’s chairman Sunday Folayan and vice-chair Haitham El Nakhal quit after they and then-finance director Deesse were accused by Afrinic’s head of external relations, Vymala Poligadu, of sexual harassment, unprofessional behavior, and intimidation of staff.

The chair and vice-chair ejected, we note, after Poligadu’s formal complaint [PDF] – which includes text messages sent by the men to then-CEO Barrett and to a female Afrinic employee who subsequently left – was leaked to a mailing list and the allegations made public.

The messages showed Folayan urging Barrett to fire Poligadu, pressure she claimed was being applied on behalf of Deesse. The texts between Folayan and the female employee showed him pestering her at night. And a last set of messages between Poligadu and the female employee show her alleging Folayan was "constantly trying to find ways to sleep with me," and that Afrinic was "no environment for a woman.”

Several months later, Afrinic announced it had completed its report and found there had been “no evidence of harassment, bullying or intimidation on the part of certain members of the board against [Poligadu]” and only one situation that “amounts to an instance of harassment” by a head of department – Deesse – against Poligadu.

It did find that Folayan had breached his duty as a board member, but only because he had forwarded text messages – screenshotted from a WhatsApp group – discussing firing Poligadu. As for the text messages pestering the now-departed Afrinic female staffer, the investigation didn’t address it.

Civil war

Despite repeated calls, Afrinic refused to release the report detailing the allegations and its investigation, providing only its own summary of the report, leading to an outcry that nearly took down the entire organization. Angry members called for a vote of no confidence in the board, which the panel snubbed. And so the registry's members refused to vote in any new board seats at the next election, leaving the organization stuck in a legal limbo.

And – as far as we are aware – the harassment investigation report was never provided to anyone outside the board. Until now. Because in response to our repeat inquiries on the issue, Kayihura sent us a link to a PDF on Afrinic’s website just minutes before our interview. He said he did not know when it had gone live.

The file is called “Afrinic investigation redacted report 20180621” [PDF] – implying it was completed on June 21, 2018, and is a redacted version of the full report. Nevertheless, it has finally been published – another indicator Afrinic may finally have turned a corner and stopped viewing its serious internal problems as something that only it should know about.

Sensing a change in the wind, we ask Kayihura if he will publish the investigation carried out by APNIC into the apparent theft of Afrinic’s IP address blocks – a probe that led directly to Byaruhanga's dismissal. “It was not intended to be published,” he cautiously responds. “But I will consider whether we can do that.”

That still leaves claims of Afrinic's problematic work environment, however. The now-released 2018 report claims that at one point Deesse responded to a question from Poligadu about a specific project by pointing at his crotch, and asking: “Where do you want to find the budget, in my pubic hair?" Deesse denied the moment ever happened; the investigating committee thought otherwise.

Deesse quit in October last year; he was, at the time, interim CEO as well as finance director.

Change of culture

“From the time I joined, this has not been a high topic or priority,” Kayihura tells us, referring to tackling sexual harassment and bullying. “I can’t condone this behavior. I understand there was outside training and courses, and as far as I am aware that led to a change of culture.”

Kayihura came on board 18 months after that particular scandal, says there is a clear code of conduct, and that as far as he is concerned, “we are here to work, not to be harassed.”

He also says that, later this quarter, Afrinic will implement a new whistle-blower policy that will be open to staff and Afrinic members so they can lodge concerns confidentially about anything going on around the organization.

Is it possible that with certain execs all now gone, the rot in Afrinic has been cut out. However, that still leaves the fact there are repeat grumblings and frequent public insults traded within the Afrinic community between black and white Africans, as well as French-speaking and English-speaking Africans.

As a black, French-speaking African, who speaks near-perfect English, Kayihura may be, as one internet community member told this reporter in confidence, “the right combination to put this mess behind us.” As for Kayihura, he says on the issue of cultural differences: “I don't see it as a problem but instead an opportunity and a strength to build on.”

The actual job

And after all that, and with a clear sense of relief on his part, we got talking about Afrinic and its actual function.

The organization has relaunched an old IPv6 process called a “deployathon” so that network administrators across Africa can attend and learn how to get IPv6 up and running on their networks. Kayihura is keen to point out that it is not merely an academic exercise: the deployathons are focused on getting real IPv6 networks operating before they end. The events are hands-on and fiercely practical.

This is important because Afrinic has just announced that it is the last regional internet registry to hit the point where IPv4 addresses have finally run out. “IPv6 is key,” he tells us. He is also enthusiastic about Afrinic’s new strategic plan currently out for discussion.

He is keen on Afrinic’s ability to “work on training, research and educational networks” particularly the critical issues of internet exchange points – which Africa needs many more of – as well as the challenges and possibilities that will come with a huge increase in traffic. “Afrinic can have a real contribution to the global efforts, even if we are currently playing catch-up,” he notes.

In other words, his focus is on the job that Afrinic was set up to do all those years ago. Asked if he resents having to answer questions from a reporter about the misbehavior of former staff and board members, Afrinic’s new CEO pauses.

“I come from the business world. This is not something…” he trails off, then quickly returns. “But this is more of a stewardship role. So there has to be an expectation of press and public interest.”

And with that, we hang up, he goes to his job, and we go to ours. ®