ICANN Tests Secure Sign-On So Police Can Urgently Request Hidden Domain Owner Details

ICANN, the organisation that coordinates internet domain names, has started testing authentication schemes that would let law enforcement agencies make urgent requests for non-public WHOIS information. The requests would be limited to cases involving an "imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation."

Domain registrars collect customer details, which used to appear in public WHOIS records. Some registrars now substitute their own contact details to protect privacy, and laws such as GDPR sometimes require data to be hidden. That is reasonable, but it makes it harder for police to reach a domain holder whose resources are being misused, whether on purpose or by accident. Examples include hosting malware, acting as command-and-control infrastructure for malware, or facilitating phishing.

An ICANN Input Group on Law Enforcement Agency Authentication Mechanisms explained its progress at the organisation's annual meeting in Bali, Indonesia. Representatives of registrars Namecheap and Verisign spoke during the session and were both supportive. The group's work is largely technical: once a mechanism exists, separate ICANN policy groups will decide acceptable use and related issues. The source article's opening does not cover further detail on timelines or how the system would be rolled out.