ICANN testing tech to let law enforcement access non-public WHOIS info

ICANN has started testing authentication schemes that will allow law enforcement agencies to make urgent requests for non-public WHOIS information – when needed to address threats to life, critical infrastructure, or child exploitation.

Domain registrars collect information about their customers and in the past that data was publicly available in WHOIS records.

Some domain registrars offer services that substitute their own contact details, to preserve customer privacy.

In recent years, laws like GDPR mean registrars are sometimes required to hide WHOIS data.

That’s fair enough but makes it hard for law enforcement to contact a domain holder if their resources are being misused – intentionally or otherwise – for purposes such as hosting malware, acting as command-and-control infrastructure for malware, or facilitating phishing.

ICANN’s definition for the kind of behaviour it thinks justifies urgent requests for WHOIS info is “imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation.” The org has convened an Input Group on Law Enforcement Agency Authentication Mechanisms to consider the issue, and that group yesterday explained its progress during ICANN’s annual meeting in Bali, Indonesia.

At this point, readers may have concerns that this proposal could allow law enforcement authorities to make inappropriate requests for WHOIS information.

Several factors may ease such concerns.

One is that representatives of domain registrars Namecheap and Verisign spoke during the session about the proposal, and both were supportive.

Another is that the Input Group’s work is largely technical.

Once it devises a mechanism to allow requests, other groups within ICANN dedicated to policy will work out acceptable use and related issues.

This is the way internet governance gets done! Specialists work on their own bits of a problem and then collaborate to create a robust system that works at a technical level, is practical, and enforceable in multiple jurisdictions.

How they’ll do it At this point, ICANN’s preferred approach is to use Security Assertion Markup Language (SAML) so that authenticated users at law enforcement agencies can log into the governance org’s Registration Data Request Service (RDRS) and file requests to access non-public WHOIS info.

ICANN is already testing this approach with the FBI and Interpol but is open to other authentication mechanisms to allow other agencies access RDRS.