ICANN tests login system for law enforcement access to non-public WHOIS data
in plain words
Domain names have owner records called WHOIS data, and many are now hidden for privacy. ICANN, the group that coordinates domain names worldwide, is testing a secure login so police can ask for hidden details in urgent cases. Police agencies would have to show a real emergency to use it.
Full summary
ICANN Internet Corporation for Assigned Names and Numbers The nonprofit that coordinates the global DNS and gTLD policy. Full definition of ICANN is testing authentication schemes that would let law enforcement agencies make urgent request An emergency request for hidden registration data, with a 24-hour answer deadline not yet in force. Full definition of urgent request for non-public WHOIS The legacy lookup service for domain registration data, now replaced by RDAP for gTLDs. Full definition of WHOIS information. The requests are meant for situations involving an imminent threat to life, serious bodily injury, critical infrastructure, or child exploitation. ICANN's own wording sets that definition.
Domain registrar A company that registers domain names for customers with the registry. Full definition of registrar collect information about their customers, and that data was once publicly available in WHOIS records. Some registrars offer services that substitute their own contact details to protect customer privacy, and laws such as GDPR General Data Protection Regulation The European Union data protection law that led to hiding personal data in WHOIS. Full definition of GDPR mean registrars are sometimes required to hide registration data The information kept about a domain and its owner. Full definition of registration data. The source says this makes it harder for law enforcement to contact a domain holder when a domain is misused for malware Harmful software, often spread or controlled using domain names. Full definition of malware, command-and-control infrastructure, or phishing Impersonating a trusted party to steal data, often with look-alike domains. Full definition of phishing.
ICANN's Input Group on Law Enforcement Agency Authentication Mechanisms is considering the issue. The group reported its progress at ICANN's annual meeting in Bali, Indonesia. Representatives of the registrars Namecheap A large American retail registrar, also known for challenging ICANN decisions on pricing. Full definition of Namecheap and Verisign The company that operates the .com and .net registries. Full definition of Verisign spoke in support of the proposal during that session.
The Input Group's work is largely technical. Once it devises a mechanism for requests, other ICANN policy groups will work out acceptable use and related issues.
ICANN's preferred approach is Security Assertion Markup Language (SAML). Authenticated users at law enforcement agencies would log into ICANN's RDRS Registration Data Request Service ICANN's free service for requesting hidden gTLD registration data from participating registrars. Full definition of RDRS (RDRS) and file requests. ICANN is already testing this with the FBI and Interpol, but it is open to other authentication mechanisms that would give other agencies access. The Input Group aims to publish a specification that those agencies can conform to.
ICANN will pass requests filed in RDRS to the registrar that sold the domain. The registrar will have 24 hours to consider a request, or up to 72 hours for complex queries. Registrars may deny requests they feel do not meet the urgency threshold.
Some readers may worry that a large agency could flood RDRS with requests from thousands of individual agents. ICANN plans to prevent this by requiring agencies to nominate specific personnel permitted to make requests, enforced with a token shared during SAML handshakes. The content of that token is a policy question the Input Group expects others at ICANN to finalize later.
Another open issue is how to protect the identity of law enforcement workers who make RDRS requests. ICANN considers them at risk of harassment if their requests include email addresses.