---
id: "3e808d1d-e3d4-4676-868f-27fee3c24f71"
kind: "link"
title: "ICANN tests login system for law enforcement access to non-public WHOIS data"
language: "en"
section: "icann"
date: "2026-10-20T05:20:37Z"
updated: "2026-10-20T12:36:07Z"
canonical: "https://tldlog.com/l/icann-tests-login-system-law-enforcement-access-non-public/"
origin: "master"
translations:
  es: "https://tldlog.com/es/l/icann-prueba-sistema-acceso-fuerzas-orden-datos-whois-no/"
  de: "https://tldlog.com/de/l/icann-testet-anmeldesystem-strafverfolgungsbehoerden-zugriff/"
  fr: "https://tldlog.com/fr/l/icann-teste-systeme-connexion-acces-forces-ordre-donnees/"
  it: "https://tldlog.com/it/l/icann-testa-sistema-accesso-forze-ordine-dati-whois-non/"
  pt-BR: "https://tldlog.com/pt/l/icann-testa-sistema-login-acesso-autoridades-policiais-dados/"
  ru: "https://tldlog.com/ru/l/icann-testiruet-sistemu-vkhoda-dostupa-pravookhraniteley/"
  zh-Hans: "https://tldlog.com/zh/l/icann-ceshi-zhifa-denglu-whois/"
source:
  name: "theregister.com"
  url: "https://www.theregister.com/networks/2026/10/20/icann-testing-tech-to-let-law-enforcement-access-non-public-whois-info/5304036"
  language: "en"
  date: "2026-10-20T02:11:27Z"
---

# ICANN tests login system for law enforcement access to non-public WHOIS data

## in plain words

Domain names have owner records called WHOIS data, and many are now hidden for privacy. ICANN, the group that coordinates domain names worldwide, is testing a secure login so police can ask for hidden details in urgent cases. Police agencies would have to show a real emergency to use it.

ICANN is testing authentication schemes that would let law enforcement agencies make urgent requests for non-public WHOIS information. The requests are meant for situations involving an imminent threat to life, serious bodily injury, critical infrastructure, or child exploitation. ICANN's own wording sets that definition.

Domain registrars collect information about their customers, and that data was once publicly available in WHOIS records. Some registrars offer services that substitute their own contact details to protect customer privacy, and laws such as GDPR mean registrars are sometimes required to hide WHOIS data. The source says this makes it harder for law enforcement to contact a domain holder when a domain is misused for malware, command-and-control infrastructure, or phishing.

ICANN's Input Group on Law Enforcement Agency Authentication Mechanisms is considering the issue. The group reported its progress at ICANN's annual meeting in Bali, Indonesia. Representatives of the registrars Namecheap and Verisign spoke in support of the proposal during that session.

The Input Group's work is largely technical. Once it devises a mechanism for requests, other ICANN policy groups will work out acceptable use and related issues.

ICANN's preferred approach is Security Assertion Markup Language (SAML). Authenticated users at law enforcement agencies would log into ICANN's Registration Data Request Service (RDRS) and file requests. ICANN is already testing this with the FBI and Interpol, but it is open to other authentication mechanisms that would give other agencies access. The Input Group aims to publish a specification that those agencies can conform to.

ICANN will pass requests filed in RDRS to the registrar that sold the domain. The registrar will have 24 hours to consider a request, or up to 72 hours for complex queries. Registrars may deny requests they feel do not meet the urgency threshold.

Some readers may worry that a large agency could flood RDRS with requests from thousands of individual agents. ICANN plans to prevent this by requiring agencies to nominate specific personnel permitted to make requests, enforced with a token shared during SAML handshakes. The content of that token is a policy question the Input Group expects others at ICANN to finalize later.

Another open issue is how to protect the identity of law enforcement workers who make RDRS requests. ICANN considers them at risk of harassment if their requests include email addresses.

Source: [theregister.com](https://www.theregister.com/networks/2026/10/20/icann-testing-tech-to-let-law-enforcement-access-non-public-whois-info/5304036)

## also covered by

- [elhacker.NET](https://blog.elhacker.net/2026/10/icann-prueba-tecnologia-para-que-las.html) (in Spanish)