ICANN pilots single sign-on for law enforcement access to non-public WHOIS
ICANN tests SAML login to let law enforcement request non-public WHOIS data faster.
Why it matters: This technology streamlines law enforcement access to domain registration data amid critical threats, impacting privacy, cybersecurity, and internet governance.
- On Jan 28, 2025, ICANN replaced WHOIS with the Registration Data Access Protocol (RDAP).
- ICANN is piloting Security Assertion Markup Language (SAML) for law enforcement authentication.
- Law enforcement can request non-public WHOIS info for urgent threats like child exploitation or critical infrastructure risks.
- Registrars have 24 hours to respond to urgent requests, 72 hours for complex ones, with discretion to deny requests.
- ICANN collaborates with FBI and Interpol on the pilot and plans to protect law enforcement identities during requests.
On January 28, 2025, ICANN replaced the legacy WHOIS service with the Registration Data Access Protocol (RDAP) for domain registration data. RDAP improves on WHOIS by enabling secure, internationalized, and differentiated access to gTLD registration information.
Building on RDAP, ICANN is currently piloting a Security Assertion Markup Language (SAML)-based authentication system to allow law enforcement agencies to log into the Registration Data Request Service (RDRS) with single sign-on. This aims to streamline requests for non-public WHOIS data—critical in cases involving imminent threats to life, critical infrastructure, or child exploitation.
In the pilot, law enforcement agencies, including the FBI and Interpol, nominate specific personnel authorized to submit requests. These individuals use authentication tokens within the SAML framework to securely file urgent requests, enhancing accountability and security.
Registrars handling these requests must respond within 24 hours for urgent matters or up to 72 hours for complex queries. They retain discretion to deny requests that do not meet the urgency criteria, balancing access needs with privacy concerns.
ICANN is also considering measures to protect the identities of law enforcement personnel making requests to prevent harassment or targeting, although specific protections have yet to be detailed.
This initiative reflects ICANN's broader effort to uphold privacy while enabling timely law enforcement interventions in compliance with evolving data protection and cybersecurity demands.
By the numbers:
- January 28, 2025 — WHOIS replaced by RDAP for gTLD registration data.
- 24 hours — registrar response time for urgent law enforcement requests.
- 72 hours — registrar response time for complex non-public WHOIS queries.
Yes, but: The timeline for full implementation of the SAML-based access system and detailed identity protections for law enforcement personnel remain unclear.
What's next: ICANN will continue collaborating with law enforcement and registrars to refine the pilot and establish formal implementation protocols.