Domain regulator ICANN tests fast police access to hidden domain owner data

ICANN, the US-based non-profit that runs the global system of domain names, is testing a way for police to log straight into its request service and ask registrars for the hidden data of domain owners. The trial is being run with the FBI and Interpol, ICANN told its annual meeting, ICANN 87 in Bali, The Register reported on 20 October. It covers only urgent cases: an imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation.

What is hidden and who can ask for it

Since the EU's GDPR took effect in 2018, most registrars no longer show the owner's name, address, email or phone number in public WHOIS records. The registrar still holds that data, and anyone with a legitimate reason can ask for it. Since November 2023 ICANN has run the Registration Data Request Service (RDRS) for this. A requester fills in a standard form, and ICANN passes the request to the registrar that sold the domain. The registrar decides whether to disclose.

The service is open to lawyers, brand owners, security researchers and government staff, not just police. In its first two years, to 30 November 2025, it handled more than 3,700 requests about 40,400 domains. 26% were approved, 55% denied, and the rest were partly approved or concerned data that was already public. Law enforcement accounted for 16% of requests. Registrars join voluntarily: at the end of the pilot, 80 registrars took part, covering 46% of domains. After the pilot ended, ICANN's board extended the service for up to two years.

How police sign-in would work

Today RDRS only asks for an ICANN account, and the ICANN committee that reviewed the pilot named verifying requesters' identity as one of its lessons. Under ICANN's rules, registrars must handle urgent requests within 24 hours, and the community has called checking who is really asking one of the main obstacles to meeting that deadline. The new scheme moves that check to the agencies themselves. ICANN prefers SAML, a common single sign-on standard: an officer logs in through their own agency's system, and RDRS receives confirmation that the request comes from a real police officer.

According to The Register, agencies would name the specific staff allowed to file requests, and a token exchanged at login would enforce that. This is also meant to stop a large agency such as the FBI from flooding the service with requests from many individual agents. ICANN says it is open to other login methods for agencies that do not use SAML, and wants to publish a specification any police force can follow.

The working group was set up in June. Its schedule puts the start of testing in December 2026 and the publication of findings in March 2027.

What stays open

The group only builds the technical part. It does not write policy and does not change the existing data rules. What the token contains, the acceptable use rules, and what happens to requests that do not meet the urgency bar will be decided by other ICANN groups. Registrars can still refuse a request they do not consider urgent, and get up to 72 hours for complex cases. Representatives of Namecheap and Verisign spoke in favour of the scheme. One unresolved issue is protecting the officers themselves: their email addresses in requests could expose them to harassment.

Why it matters

For police, this is about speed: domains used for phishing, malware or extortion often stay up while the owner cannot be identified. For site owners, it means that a hidden WHOIS record protects them from the public, not from the authorities. The registrar knows the details given at registration, and in urgent cases police will be able to request them through a verified channel. How strictly registrars will judge urgency is not yet known.