ICANN Piloting SAML for Law Enforcement Access to Non-Public WHOIS Data
ICANN is testing a SAML-based system to allow urgent law enforcement access to non-public WHOIS information for critical threats.
The Internet Corporation for Assigned Names and Numbers (ICANN) is actively developing and testing a new technical mechanism designed to facilitate urgent requests from law enforcement agencies (LEAs) for non-public WHOIS data. This initiative aims to strike a balance between user privacy, particularly in light of regulations like GDPR, and the critical need for timely access to domain holder information when domains are misused for malicious activities.
The core of the problem lies in the evolving nature of WHOIS data. Historically, this information was publicly accessible, providing a direct line to domain registrants. However, privacy concerns and legal mandates have led many registrars to obscure this data, making it difficult for authorities to identify and contact individuals or entities behind domains used for illicit purposes such as hosting malware, operating command-and-control infrastructure, or facilitating phishing campaigns.
ICANN has defined specific criteria for what constitutes an urgent request, including "imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation." To address these situations, an Input Group on Law Enforcement Agency Authentication Mechanisms has been formed. This group is focused on the technical implementation of a secure request process, with policy considerations to be handled by other ICANN working groups.
The preferred technical approach currently being tested involves Security Assertion Markup Language (SAML). This standard will enable authenticated users within LEAs to log into ICANN's Registration Data Request Service (RDRS) and submit requests for non-public WHOIS details. ICANN is reportedly collaborating with agencies like the FBI and Interpol on these tests, signaling a commitment to real-world applicability.
To mitigate concerns about potential misuse or overwhelming the system, ICANN plans to implement strict controls. Law enforcement agencies will be required to nominate specific personnel authorized to make requests. Authentication will be managed through a shared token during SAML handshakes, and registrars will have a defined period (24 to 72 hours) to review and respond to requests, with the ability to deny those not meeting the urgency threshold.
Representatives from domain registrars, including Namecheap and Verisign, have expressed support for the proposal during ICANN's annual meeting, indicating a degree of industry buy-in. The process is designed to be iterative, with technical specialists developing the core mechanism, followed by policy experts refining the acceptable use guidelines and enforcement procedures.
Further considerations include safeguarding the identities of the law enforcement personnel making these requests, as they could become targets of harassment if their personal information is inadvertently exposed through the request process. The development is ongoing, with the goal of publishing a specification that agencies can conform to, ensuring a standardized and secure method for accessing critical domain registration data when necessary.