ICANN tests single sign-on for law enforcement WHOIS data requests

Law enforcement and hidden WHOIS data

Domain registrars collect information about their customers and in the past that data was publicly available in WHOIS records. Some domain registrars offer services that substitute their own contact details, to preserve customer privacy. In recent years, laws like GDPR mean registrars are sometimes required to hide WHOIS data.

That makes it hard for law enforcement to contact a domain holder if their resources are being misused, intentionally or otherwise, for purposes such as hosting malware, acting as command-and-control infrastructure for malware, or facilitating phishing. ICANN's definition for the kind of behaviour it thinks justifies urgent requests for WHOIS information is an imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation. The organisation has convened an Input Group on Law Enforcement Agency Authentication Mechanisms to consider the issue, and that group explained its progress during ICANN's annual meeting in Bali, Indonesia.

Single sign-on through RDRS

ICANN's preferred approach is to use Security Assertion Markup Language (SAML) so that authenticated users at law enforcement agencies can log into the governance organisation's Registration Data Request Service (RDRS) and file requests to access non-public WHOIS information. ICANN is already testing this approach with the FBI and Interpol, but is open to other authentication mechanisms to allow other agencies access RDRS. The Input Group's aim is to publish a spec those agencies can conform to.

ICANN will pass requests filed in RDRS to whichever registrar sold the domain. The registrar will have 24 hours to consider the request, or up to 72 hours for complex queries. Registrars will also be able to deny requests if they feel the query does not meet the urgency threshold.

Safeguards and next steps

One concern is that a colossal agency could flood RDRS with requests from thousands of individual agents, swamping domain registries. ICANN's plan is to avoid that by requiring law enforcement agencies to nominate certain personnel who are permitted to make requests, and to enforce that permission using a token shared during SAML handshakes. The content of that token is the kind of policy question that the Input Group expects others at ICANN to finalise later.

Another issue under consideration is how to protect the identity of law enforcement workers who make RDRS requests, as ICANN feels they could become targets of harassment, or worse, if their requests to see WHOIS data include email addresses. Representatives of domain registrars Namecheap and Verisign spoke during the session about the proposal, and both were supportive. The Input Group's work is largely technical. Once it devises a mechanism to allow requests, other groups within ICANN dedicated to policy will work out acceptable use and related issues.

Sources: The Register