ICANN testing tech to let law enforcement access non-public WHOIS info

The Internet Corporation for Assigned Names and Numbers (ICANN) is currently testing authentication methods that would grant law enforcement agencies the ability to request non-public WHOIS information under specific circumstances. This information typically includes details about domain registrants and is usually publicly accessible.

However, domain registrars often provide alternative contact details to protect customer privacy. As privacy laws like GDPR have become more stringent, it has become increasingly difficult for law enforcement to contact domain holders if their resources are being used for malicious activities such as hosting malware, acting as command-and-control infrastructure, or facilitating phishing attacks.

To address this issue, ICANN has established an Input Group focused on Law Enforcement Agency Authentication Mechanisms, which discussed its progress at the recent ICANN annual meeting in Bali, Indonesia. The proposed mechanism for granting law enforcement access to non-public WHOIS information involves using Security Assertion Markup Language (SAML).

Through this approach, authenticated law enforcement users can log into ICANN's Registration Data Request Service (RDRS) to submit requests for the data they need. ICANN has already tested this method with the FBI and Interpol, but is open to considering alternative authentication mechanisms. Once ICANN finalizes the technical specifications, other ICANN bodies responsible for policy will work on establishing acceptable use guidelines and related issues.

The registrar will have a 24-hour window (up to 72 hours for complex queries) to respond to the request, or may deny the request if it does not meet the urgency threshold. To prevent abuse, ICANN intends to limit the number of requests by designating specific authorized personnel from law enforcement agencies. Additionally, the group is considering measures to protect the identities of law enforcement workers who submit these requests, as they may become targets of harassment if their contact information becomes publicly available.