<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Dear Colleagues,<div><br>We are writing to clarify a recent report which inaccurately claims the discovery of a vulnerability in AFRINIC’s Designated Voter Nomination platform.</div><div><br>The report in question references two document links as evidence of a supposed flaw. However, these links were associated with a <b>test nomination</b> created internally by AFRINIC staff. They were <b>not publicly accessible</b> through the platform, nor were they exposed due to any system vulnerability. Rather, they appear to have been <b>shared by someone with legitimate access</b>.</div><div><br><b>Our Nomination Platform Remains Secure</b><br>We want to reassure the community that the platform remains secure and that no real member data has been compromised. We remain fully committed to a fair, trusted, and transparent election process.</div><div><br><b>Our immediate internal investigation confirms:</b><div><span class="Apple-tab-span" style="white-space: pre;"> </span>• The documents referenced were part of a controlled test nomination submitted during platform testing.</div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>• Access to these links was limited to the Registered Contacts of the organisation involved in the test, and AFRINIC staff directly supporting the election process.</div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>• No actual member data was leaked or made accessible to unauthorised individuals.</div><div><br></div><b>Why This Is Not a Vulnerability</b><div><span class="Apple-tab-span" style="white-space: pre;"> </span>• Each document link contains a unique 39-character (312-bit) ID generated randomly.</div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>• These links cannot be guessed or enumerated through any automated or manual means.</div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>• The file storage directory does not permit listing or browsing.</div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>• The only plausible way for such a link to become public is through intentional sharing by someone who received it.</div><div><br></div>Our findings strongly suggest that one or more recipients of the nomination emails shared these links externally, in violation of </div><div>AFRINIC's data confidentiality policies.</div><div><br></div><div><b>Our Priority is Ensuring Election Integrity</b></div><div>The integrity of this election process and the protection of member data remain paramount. AFRINIC’s 2025 Election Committee further wishes to reaffirm our commitment to ensuring transparent handling of any incidents, confidentiality among AFRINIC personnel and committees, and ensuring the highest standards of trust, fairness, and legal compliance.<br><br></div><div>AFRINIC has taken the following steps in response:<div><span class="Apple-tab-span" style="white-space: pre;"> </span>• Audited access logs for all nomination submission emails and document retrievals.</div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>• Launched a formal internal investigation to determine the source of the leak. Appropriate disciplinary or legal action will follow based on the outcome.</div><div><span class="Apple-tab-span" style="white-space: pre;"> </span>• Launched an additional security review of the election platform and related workflows to ensure confidentiality and appropriate access restrictions.</div><div><br></div>If you have any questions or concerns, please reach out to <b><a href="mailto:ecom2025@afrinic.net">ecom2025@afrinic.net</a></b>.<br><br></div><div>Sincerely,<br>AFRINIC 2025 Election Committee</div></body></html>