ICANN is testing a Security Assertion Markup Language authentication system to let authorized personnel at agencies like the FBI and Interpol file urgent requests for non-public WHOIS domain registration data through its Registration Data Request Service. Discussed at ICANN’s annual meeting in Bali, Indonesia, the pilot targets severe incidents involving imminent threats to life, critical infrastructure, or child exploitation.
Bali Meeting Updates on Law Enforcement Access Mechanisms
The Input Group on Law Enforcement Agency Authentication Mechanisms detailed its ongoing technical progress during the annual ICANN gathering in Bali, Indonesia. According to The Register, the group framed its current mandate as strictly technical. The objective is to engineer a reliable authentication architecture while leaving acceptable use policies and related governance safeguards to separate internal ICANN policy groups.
Privacy regulations such as the General Data Protection Regulation and individual registrar policies often require masking contact details in WHOIS databases. While these measures protect consumer privacy, they routinely complicate investigations when domains host malware, operate command-and-control infrastructure, or facilitate phishing scams. The newly tested framework aims to bridge that operational gap.
SAML Pilot Testing With the Federal Bureau of Investigation and Interpol
ICANN is currently running technical pilots of the system using Security Assertion Markup Language single sign-on mechanics. The initial trials involve two specific entities: the Federal Bureau of Investigation and Interpol. However, the system architecture remains flexible to accommodate alternative authentication schemes so that additional vetted agencies can eventually conform to the workflow.
ICANN routes that transmission directly to the registrar responsible for selling the targeted domain. Registrars then face strict operational windows to evaluate the legitimacy of each inbound demand.
Registrar Review Windows and Urgency Thresholds
Domain registrars designated as operational gatekeepers receive explicit time limits to process incoming queries. Registrars have 24 hours to review standard urgent requests, with an extension up to 72 hours permitted for complex investigations. Registrars retain absolute authority to reject any inquiry that fails to satisfy ICANN's narrow urgency criteria.
Routine regulatory or civil inquiries do not meet this bar.
| Operational Parameter | Proposed Technical Standard |
|---|---|
| Authentication Protocol | Security Assertion Markup Language (SAML) |
| Request Portal | Registration Data Request Service (RDRS) |
| Standard Response Window | 24 Hours |
| Complex Query Window | Up to 72 Hours |
| Targeted Use Cases | Threats to life, infrastructure, or child exploitation |
Registrar Support and Safeguards Against System Abuse
Representatives from major industry players Namecheap and Verisign spoke publicly during the Bali session to voice support for the proposed authentication pipeline.
To prevent massive investigative bodies from flooding registries with indiscriminate queries, ICANN plans to restrict access to specifically nominated personnel. Verification relies on a secure token passed during the initial SAML handshake. The Input Group continues to refine the technical layer of this token, while separate committees determine the exact personnel vetting standards. Developers are evaluating mitigation strategies to protect the identities of individual investigators from targeted harassment or retaliation when their contact credentials accompany an RDRS submission.
Technical Specification and Future Agency Onboarding
The Input Group’s ultimate aim is to publish a specification that external law enforcement agencies can conform to in order to authenticate and transmit queries through the Registration Data Request Service. By establishing a standard SAML workflow, ICANN intends to balance investigative efficacy with structured institutional guardrails.
