ICANN tests SAML authentication for law enforcement urgent requests to non-public WHOIS data via RDRS
ICANN has begun testing authentication schemes that would let law enforcement agencies file urgent requests for non-public WHOIS data when facing imminent threats to life, serious bodily injury, critical infrastructure or child exploitation. The work is led by the Input Group on Law Enforcement Agency Authentication Mechanisms, which reported its progress at ICANN's annual meeting in Bali, Indonesia. The aim is to close the gap left by privacy services and laws such as GDPR, which make it hard to contact domain holders whose resources host malware, serve as C2 infrastructure or support phishing. Registrars Namecheap and Verisign voiced support during the session. This is a governance and product-development item with no direct threat to defenders.
Technical Details
- ICANN's preferred approach is Security Assertion Markup Language (SAML), so that authenticated law enforcement users can log into the Registration Data Request Service (RDRS) and file requests.
- The approach is already being tested with the FBI and Interpol. ICANN is open to other authentication mechanisms, and the Input Group intends to publish a specification that agencies can conform to.
- RDRS passes each request to the registrar that sold the domain. The registrar has 24 hours to respond, or up to 72 hours for complex queries, and may deny requests that do not meet the urgency threshold.
- To prevent request flooding, agencies must nominate designated personnel, and that permission would be enforced through a token exchanged during the SAML handshake. The token's content is a policy question for other ICANN groups to settle.
- The group is also considering how to protect the identity of requesting officers, who could face harassment if their email addresses are exposed.
Remediation
No remediation applies. Acceptable-use and policy questions will be handled by separate ICANN policy groups once the technical mechanism is defined.
Linha do tempo
-
ICANN tests SAML authentication for law enforcement urgent requests to non-public WHOIS data via RDRS
ler a análise desta fonte ocultar
ICANN has begun testing authentication schemes that would let law enforcement agencies file urgent requests for non-public WHOIS data when facing imminent threats to life, serious bodily injury, critical infrastructure or child exploitation. The work is led by the Input Group on Law Enforcement Agency Authentication Mechanisms, which reported its progress at ICANN's annual meeting in Bali, Indonesia. The aim is to close the gap left by privacy services and laws such as GDPR, which make it hard to contact domain holders whose resources host malware, serve as C2 infrastructure or support phishing. Registrars Namecheap and Verisign voiced support during the session. This is a governance and product-development item with no direct threat to defenders.
Technical Details
- ICANN's preferred approach is Security Assertion Markup Language (SAML), so that authenticated law enforcement users can log into the Registration Data Request Service (RDRS) and file requests.
- The approach is already being tested with the FBI and Interpol. ICANN is open to other authentication mechanisms, and the Input Group intends to publish a specification that agencies can conform to.
- RDRS passes each request to the registrar that sold the domain. The registrar has 24 hours to respond, or up to 72 hours for complex queries, and may deny requests that do not meet the urgency threshold.
- To prevent request flooding, agencies must nominate designated personnel, and that permission would be enforced through a token exchanged during the SAML handshake. The token's content is a policy question for other ICANN groups to settle.
- The group is also considering how to protect the identity of requesting officers, who could face harassment if their email addresses are exposed.
Remediation
No remediation applies. Acceptable-use and policy questions will be handled by separate ICANN policy groups once the technical mechanism is defined.