Part 4 of a 5-part AfroDIG investigation
6,291,456 IPv4 addresses, simulated rental potential of USD 28.69 million a year and USD 156,320.92 in documented payments to a US law firm. From the Seychelles to Hong Kong, then the United States and Africa, this investigation examines potential revenue from Cloud Innovation’s portfolio, identified expenditure and funding commitments around Lu Heng.
On 6 April 2022, the US law firm Pillsbury receives USD 35,007.60 from LARUS. On 21 July, another payment amounts to USD 22,476.40. The Justice Department filings record these amounts as legal fees and expenses. Cloud Innovation and LARUS appear in the same client engagement. These payments provide a verifiable trail of expenditure within a business network whose consolidated accounts are absent from the records assembled for this investigation.
The business model begins with IP address leasing. Cloud Innovation holds resources delegated by AFRINIC, and LARUS commercialises them under their operating authorisation. Rentals can generate recurring revenue. The registry’s rules determine the conditions under which the portfolio can be retained and exploited. The institutional confrontation therefore involves the value of a commercial activity.
Potential revenues from 6.29 million IP addresses
At the centre of the conflict are 6,291,456 IPv4 addresses, in 4 blocks delegated to Cloud Innovation by AFRINIC between 2013 and 2016. These identifiers enable networks to communicate. Their use can be leased to operators, hosting companies and service providers. A portfolio of addresses can therefore generate recurring revenue.
The division of responsibilities is formalised. Cloud Innovation is registered in the Seychelles and LARUS in Hong Kong. A US filing from 2021 identifies Heng Lu as the owner of both companies. The operating authorisation given to LARUS covers customer relationships, leases, renewals and routing coordination. Lu Heng retains the strategic and commercial direction described in the document.
A simulation conveys the scale. For AFRINIC resources, IPXO reports an average leasing price of USD 0.38 per address per month in the first half of 2026. Applied to all 6,291,456 addresses, with 100% paid utilisation for 12 months, that price yields USD 28.69 million in annual gross revenue, before expenses. This is not Cloud Innovation’s or LARUS’s turnover. Actual revenue depends on contracts and receipts that are not public.
Gross revenue is not profit. Commissions, technical costs, payroll, advisory fees and taxes must then be deducted. Lease contracts, paid utilisation rates and transfers between Cloud Innovation and LARUS are essential to move from this simulation to the actual economic result.
That economic scale explains why the registry’s rules are a major commercial issue. The terms governing retention, leasing and transfer directly affect exploitation of the addresses. Challenging AFRINIC’s authority also means defending the conditions under which a resource portfolio earns revenue.
His governance proposals follow that economic logic. In his public positions, he advocates resource portability, the ability to switch registries and limits on their oversight powers. He argues that restrictions on rights and transfers depress address values. The entrepreneur is therefore proposing changes to the rules of a market in which his companies operate.
USD 156,320.92 in identified payments to Pillsbury
Matching 5 filings identifies 12 payments totalling USD 156,320.92 between 22 October 2021 and 15 April 2024. The series comprises USD 1,699.83 in 2021, USD 116,935.74 in 2022, split between the August 2022 and March 2023 statements, followed by USD 17,635.80 in 2023 and USD 20,049.55 in 2024. This engagement also includes intellectual property advice. It covers neither all the firms involved nor the letters sent in 2025.
The engagement of 3 November 2021 provides for legislative, regulatory, executive and communications strategies concerning LARUS’s interests in response to AFRINIC’s actions. Protecting the private information of American Internet users is among the arguments advanced. A dispute over an African registry’s resources is thus taken into the sphere of US public authorities.
Fellowships, sponsorships and funding commitments
Commercial operations, support for participation and advocacy are distributed across several structures that Lu Heng presents together. LARUS supplies network services. NRS advocates changes to the rules. BTW.Media covers infrastructure and its governance. The foundation funds education and participation. This organisation connects distinct activities around the same entrepreneur without publishing consolidated accounts for their operations.
Cloud Innovation says it funds the LARUS Foundation every year. Its fellowship terms provide for flights, rooms, registrations and, under the applicable conditions, allowances. Recipients must attend sessions and submit a report within 30 days. Lu Heng claims support for more than 1,000 African students to attend major Internet events.
This funding opens doors for participants who could not afford to travel. It also gives the funder a lasting presence where rules are debated. Independence turns on the conditions of support, the expectations expressed and transparency about the relationships. Receiving a fellowship proves neither the purchase of a vote nor the surrender of autonomy.
Visibility also has a price. In Arlington, from 27 to 29 October 2025, LARUS is a host sponsor of NANOG 95. The 2025 prospectus offers this category at USD 50,000, including 10 registrations. That is the list price, not an invoice paid by LARUS.
In Mozambique, INTIC announces a USD 500,000 programme following its agreement with NRS on 8 March 2024. It concerns Internet governance, cybersecurity and digital policy. Lourino Chemane signs for the institute and Elton Kambugu for NRS’s Africa division. The announced commitment does not establish disbursement.
In Africa, NRS reports 18 participants in person and 9 remotely in Dakar on 16 April 2026, at the Onomo hotel. In Enugu on 20 June 2026, it reports approximately 56 participants at an event explicitly linking IP addresses with capital. These figures establish attendance. They disclose neither the number of funded travellers nor total room nights. Tickets, negotiated rates and invoices remain necessary to calculate expenditure.
NRS also seeks representation mandates. This is where conference participation connects with the exercise of institutional power. Who authorises the organisation? For which decisions? With what right of revocation? Transparency about those delegations matters as much as transparency about funding. A full meeting room is not, in itself, a political mandate.
Chinese operations and the domain name market
The documented Chinese connections lie in business, institutional support and operating approvals. In 2022, Lu Heng’s nomination to APNIC’s Executive Council receives support from Huawei Singapore Pte Ltd, alongside Galaxy Broadband and Nayatel. The entrepreneur advocates the value of registration rights and the development of the IPv4 market. This support comes in an election whose policy implications directly affect his sector.
In Wuhan, another business presence concerns domain names. On 30 July 2025, ZDNS announces that China’s Ministry of Industry and Information Technology has approved Wuhan Yunwaiheng Information Technology Co., Ltd., 武汉云外恒信息技术有限公司, as the organisation managing .HELP in China. ZDNS says it supported the operation on regulatory, technical and operational matters. The provider describes itself as the National Engineering Research Center for Domain Name System, approved by the National Development and Reform Commission.
Lu Heng includes .HELP among his activities and states that private domain sales go through LARUS. IANA identifies Innovation Service Ltd in the Seychelles as the extension’s operator, with a transfer recorded on 4 January 2024. The activity thus connects a Seychelles registry with an authorised operating arrangement in China. Contracts, royalties and the distribution of revenue form the next stage of this financial trail. These documents do not establish the ownership of the Wuhan entity.
Huawei Singapore, the ministry’s approval and ZDNS’s role are documented relationships. They do not demonstrate that Beijing directs Lu Heng’s operations. The financial trail concerns access to the Chinese market, contracts with partners, royalties and revenues actually received.
The missing accounts between income and expenditure
The records identify payments and commitments, but do not consolidate all the flows. Between address rentals, commissions, intercompany transfers, representation expenditure and distributions to owners, several links remain inaccessible. The records assembled do not allow each fellowship, event or legal bill to be attributed to income from a particular block of addresses. The precise source of funds, distribution of profits and taxes paid remain to be established.
The figures assembled here describe different realities. USD 156,320.92 in receipts declared by a law firm, a USD 50,000 list price, a USD 500,000 announced programme and USD 28.69 million in theoretical revenue cannot be added together into a budget. They illuminate different scales of a system in which resource values, funding for participation and the capacity to litigate intersect.
AFRINIC’s litigation expenditure
On the other side of the dispute, AFRINIC bears a significant financial burden. Its unaudited 2025 financial summary records USD 877,929 in legal expenses, including USD 464,708 for Trinity Legal and USD 353,000 for Mohammad M Namdarkhan. Approximately USD 416,000 in provisions is included in those 2 items. Electoral costs reach USD 1,043,425. These charges are not all attributable to Cloud Innovation and have not all been paid. They nonetheless show the scale of resources absorbed by the crisis.
The lawyers’ work also addresses AFRINIC’s ability to defend itself. On 15 October 2024, in judgment 2024 SCJ 473, the Court of Appeal upholds Cloud Innovation’s objections to an appeal by the registry. The former director who initiated it no longer has the required authority. The lawyers lack a valid mandate for that appeal. The 2021 resolution relied on depended in particular on powers entrusted to a chief executive who had left office. The appeal is set aside and the receivership order restored.
The weakness is not technical in the computing sense. It lies in the authority to act. Who could initiate the appeal? Under what mandate? Was that authority valid when proceedings began? In this case, the answers were enough to defeat the appeal. Scrutiny of representative powers becomes a decisive battleground. An institution can lose a route of appeal because it failed to secure the validity of its own acts.
The law does not invariably side with AFRINIC against Cloud Innovation. In interlocutory judgment 2022 SCJ 253 of 19 July 2022, the judge rejects the registry’s abuse-of-process objection in the proceedings examined. She accepts the relevance of the new circumstances raised by the company. That decision prevents all its legal actions from being indiscriminately labelled abusive.
In autumn 2026, the confrontation shifts to the register of members. On 31 October, AFRINIC challenges Cloud Innovation’s registration, relying in particular on a decision of 19 June 2025 concerning its status as a resource member. On 3 November, Cloud Innovation announces 4 steps. It will approach the court that appointed the receiver, lodge a complaint with the Director of Insolvency, notify the Registrar of Companies and request an investigation within the applicable statutory framework. It also envisages seeking contempt sanctions and the receiver’s removal.
Cloud Innovation presents these steps as necessary to enforce court orders. AFRINIC invokes protection of its governance. The confrontation extends simultaneously to the judiciary, insolvency oversight and company administration. Lawyers examine jurisdiction, mandates and the effects of orders. Disagreements about governance take the form of applications capable of affecting those exercising it.
The division of work between counsel and law firms
This apparatus does not rely exclusively on major firms. Lawyers in their first years of practice act directly on behalf of the companies. Khoo Chin Ern, a University of Malaya graduate, was admitted to the Bar in 2020. When she signs the August 2025 demand, she has approximately 5 years of professional seniority. Her career includes CK Oon & Co. That firm’s name establishes part of her professional background; it does not make the firm the author of the letter signed for Cloud Innovation.
Ian Phua, admitted to the Bar on 7 May 2021, has just over 4 years of practice when he writes to CIO Africa. At Aaron KC Ng & Partners, his work includes contractual disputes, defamation and winding-up proceedings. At ARIN 54, he is identified as legal counsel for LARUS Limited. These backgrounds illuminate the first layer of intervention, the lawyers who write on behalf of the company, formulate complaints and set deadlines.
The organisation thus combines junior profiles with experienced specialists. The remuneration of the former is not public. By contrast, the US engagement with Pillsbury specifies a discounted rate of USD 1,088 an hour for one lawyer. The arrangement distributes interventions between counsel acting in the company’s name and outside specialists.
In London, Lu Heng retained Tom Double and Adham Harker of Brett Wilson, together with Hugh Tomlinson KC of Matrix Chambers. Tom Double, previously at Schillings International, became a Brett Wilson partner in 2021. Adham Harker works on matters including urgent pre-publication interventions, defamation and privacy. Hugh Tomlinson specialises in media and information law. This expertise enables intervention at each stage, from challenging an article to negotiations between legal teams.
In the United States, David Tsai signs the September 2025 letter for Pillsbury. His move to K&L Gates, announced on 14 September 2026, subsequently marks a change of firm. No transfer of Cloud Innovation’s engagement to his new employer has been established. Responsibilities are identified through signatures and mandates at the time of each intervention.
The strength of this organisation lies in its capacity for repetition. One newsroom receives a letter. Another receives a follow-up. A reader must respond for sharing an article. For the company, these tasks can be distributed among several professionals. For every recipient, they create a new file to handle. The asymmetry is also measured in working hours diverted from reporting.
Removal demands and their cost to the media
On 18 September 2025, I receive a letter from Pillsbury Winthrop Shaw Pittman, the US law firm instructed by Lu Heng and Cloud Innovation. Dated the previous day and signed by David Tsai, it demands the removal and retraction of 4 articles published on Medium. The deadline is 19 September. It challenges the descriptions used, the account of legal proceedings and the connections drawn with China. Funding legal representation takes on another dimension here, the resources needed to respond to a removal demand within a single day.
This letter follows others. On 22 August, ChinErn Khoo, acting for Cloud Innovation and Lu Heng, had already demanded the removal of a publication by noon, GMT−4, that same day. The letter challenged 6 formulations or implications. It named Medium and raised the prospect of proceedings in the United Kingdom, the European Union, South Africa and Mauritius. From one message to the next, the signatories change and jurisdictions accumulate. For the recipient, the demand remains the same. Retrieve the evidence, examine the complaints and, if necessary, fund a defence.
The law is at work here long before a hearing. It acts on the time available, the financial risk and the decision to keep an article online. The correspondence examined for this investigation reveals how this works. It reaches authors, media outlets, platforms and even readers who share a link. Its effect extends beyond protecting a reputation. It raises the cost of public discussion about commercial interests tied to an essential Internet resource.
On 1 July 2025, Ian Phua writes to CIO Africa on behalf of Cloud Innovation. He warns that, unless the demands are met within the stated deadline, lawyers may be instructed to seek an injunction in the High Court, damages and legal costs. On 2 July, Carol Odero confirms that the article was removed the previous day, in good faith and without any admission of fault or liability. In this exchange, removal comes before any judicial decision produced in support of the demand.
3 days after that first letter, the pressure reaches someone who shared the article. On 4 July 2025, Cloud Innovation writes to Stéphane Bortzmeyer. The engineer has shared a text on X. The company gives him 24 hours to delete his post. It also demands that he stop distributing the article and refrain from further references or comments, direct or indirect, about the company and its officers, including in emails and on mailing lists.
The demand goes beyond correcting a specific error. It seeks future silence on an entire subject. The letter names Bortzmeyer’s employer, although he is acting in a personal capacity. Sharing a link becomes the basis for allegations accompanied by threats of litigation, an injunction and legal costs. The company is no longer addressing only the person who writes. It is addressing those who circulate what has been written.
On 13 August 2026, another route is used to reach AfroDIG. Louise Tan, signing as legal counsel for LARUS, approaches the forwarding service associated with the domain’s contact privacy protection. She demands the removal of an article, a photograph and copies or links shared on social media, with confirmation by the following day. She invokes a written assignment of rights in the portrait to Lu Heng. The message does not request disclosure of the protected contact details. It uses the intermediary to deliver another removal demand to the publisher.
These episodes reveal an expanding scope of challenge. The article is tracked through its republication. Those sharing it are identified. The photograph supplies an additional complaint. The platform and technical intermediary become possible recipients. A single piece of content thus forces several people to assess separately the cost of keeping it accessible.
Removal as an economic outcome of legal pressure
A demand that makes an article disappear produces an immediate result. It reduces the text’s circulation without waiting for a trial and makes the recipient bear the cost of choosing between publishing and defending themselves. In the CIO Africa exchange, that result is achieved on 1 July 2025. The subsequent demands to people sharing the text show that the challenge does not stop at its first publisher.
The image of a wolf that has tasted blood captures the risk in this dynamic. When pressure secures a retreat, repeating the method becomes more attractive. That incentive sits at the heart of the power imbalance. If removal costs less than resistance, the threat can work before its legal strength is examined. Every recipient is left to make the same calculation on their own account.
The scope of the letters matters. Asking for a specific assertion to be corrected opens a debate about a fact. Demanding an end to all future references to a company and its officers seeks to close that debate. In the letter to Bortzmeyer, the latter demand is explicit. This is where defending a reputation meets pressure on public speech.
Judicial or negotiated successes also give threats weight. On 9 May 2024, a statement in the High Court in London makes public the settlement between Lu Heng and the Telegraph. The newspaper removes an article published on 31 May 2023 and agrees to pay substantial damages and legal costs. The amount remains unknown. The agreement resolves specific allegations about a purported Chinese endeavour to dominate Africa’s Internet and a campaign targeting APNIC. It is not a judgment on the merits of all Lu Heng’s activities.
For media outlets subsequently receiving a demand, that precedent exists. It signals the potential cost of an inadequately substantiated allegation. It does not remove the need to examine other facts, publications and demands. Redress obtained in one case creates no general right to shield a business model from investigation.
Funding a defence and continuing the investigation
Pressure does not always secure the expected removal. On 8 July 2025, Stéphane Bortzmeyer makes the demands public. He publishes the letter, keeps his post online and links to archives of the articles. Correspondence received individually becomes evidence accessible to everyone. A threat loses part of its advantage when its terms can be examined beyond the relationship between sender and target.
Joseph Lorenzo Hall also makes his response public. He announces that he has instructed Albert Sellars LLP and refuses to remove his posts. He states that he is acting personally. His defence is then covered by Techdirt. Sharing a contested article thus prompts further reporting on the removal demands themselves.
Another limit emerges on 25 August 2025. Medium responds to a copyright complaint by requesting the elements required for a notice compliant with its DMCA procedure. This response does not determine whether the articles are accurate. It does, however, prevent a removal request from taking automatic effect without satisfying the requirements of the mechanism invoked.
These responses do not erase the imbalance of resources. They show how to reduce it. Preserving versions, making letters available for scrutiny, obtaining advice and sharing defence costs help recipients escape the imposed urgency. Documentary rigour becomes a collective resource. Correcting an established error and rejecting an excessive demand follow the same commitment to independence.
For AFRINIC, resistance also depends on accounts, mandates and the validity of decisions. Community mobilisation cannot repair an expired authority to act. Political denunciation cannot replace transparent accounts. Governance weaknesses have already given the registry’s opponents openings. Closing them is a condition of its defence.
The financial stakes run through the entire battle over AFRINIC. Address leasing creates a recurring revenue model, while the registry’s rules determine how those resources can be exploited. Identified payments show the capacity to fund advisers, but the available accounts do not reveal all revenues or how they are allocated. Proceedings and removal demands add another expense, borne by those who must defend themselves. Understanding the power exercised around these resources therefore requires examining money received, money committed and the cost imposed on those who challenge it.
This investigation is part 4 of a 5-part series. Read the preceding instalments. Part 1 · Part 2 · Part 3.