ICANN testing tech to let law enforcement access non-public WHOIS info
ICANN is testing a sign-in system that would let approved law enforcement staff request private domain-registration details in urgent cases involving threats to life, critical infrastructure or child exploitation. The work aims to help agencies contact domain holders when online resources may be used for malware or phishing, while keeping access to data hidden under privacy laws controlled.
ICANN’s preferred method uses SAML authentication to access its Registration Data Request Service, and is being tested with the FBI and Interpol. Requests would go to the relevant registrar, which would have 24 hours to respond, or up to 72 hours for complex cases, and could reject requests that do not meet the urgency threshold. ICANN is also considering limits on which officers can submit requests and ways to protect their identities; policy groups still need to settle acceptable-use rules.
- ICANN is testing authenticated access to private WHOIS data for urgent law enforcement requests.
- FBI and Interpol are trialling the proposed SAML sign-in approach.
- Registrars would have 24 hours, or up to 72 for complex requests, to respond.
New here? Start with this
Every website domain, such as example.com, is registered through a domain registrar. Registration records can include contact details for the person or organisation that registered it, but some of those details are not publicly visible because of privacy rules.
ICANN coordinates parts of the domain-name system and provides a service for submitting requests for registration data. Law enforcement agencies may seek hidden details when investigating serious online threats, but the registrar holding the records decides whether to release them under applicable rules.
The issue is how to help authorities reach domain holders quickly in urgent cases while protecting private information from improper access. The outcome could affect both investigations into harmful online activity and the safeguards that govern access to personal data.