ICANN tests tech giving law enforcement access to non-public WHOIS info

Urgent access under review

The authentication work is being carried out by ICANN’s Input Group on Law Enforcement Agency Authentication Mechanisms. The group described its progress at ICANN’s annual meeting in Bali, Indonesia. ICANN defines qualifying cases as involving an “imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation.” The testing concerns how agencies can prove their identity when making such requests.

Registrar review process

ICANN plans to send requests filed through RDRS to the registrar that sold the domain. Registrars would have 24 hours to consider a request, with up to 72 hours allowed for complex cases.

A registrar could deny a request if it decides the case does not meet the urgency threshold. The article notes that law enforcement may also need to contact domain holders when domains are misused to host malware, support malware command-and-control, or facilitate phishing.

Policy questions remain

The Input Group’s work is primarily technical. Other ICANN groups focused on policy are expected to decide acceptable-use rules and related matters after a request mechanism is developed.

ICANN’s plan would require law enforcement agencies to nominate specific personnel authorized to submit requests. Their permission would be enforced through a token shared during SAML handshakes; the token’s contents are among the policy details still to be finalized.