ICANN现已开始测试相关身份验证机制，以便执法机构在必要时能紧急申请获取非公开的WHOIS信息——尤其是在涉及生命安全、关键基础设施保护或儿童权益保护等紧急情形时。域名注册商负责收集客户信息，以往这些信息均会通过WHOIS记录向公众公开。为保护客户隐私，部分注册商还提供用自身联系信息替代客户真实信息的服务。
ICANN has started testing authentication schemes that will allow law enforcement agencies to make urgent requests for non-public WHOIS information – when needed to address threats to life, critical infrastructure, or child exploitation. Domain registrars collect information about their customers and in the past that data was publicly available in WHOIS records. Some domain registrars offer services that substitute their own contact details, to preserve customer privacy.
近年来，随着《通用数据保护条例》等法规的实施，注册商有时必须对WHOIS数据进行隐藏处理。这一做法虽无可厚非，却也给执法机构带来了困扰：一旦域名被恶意利用，用于托管恶意软件、充当恶意软件的控制服务器或实施网络钓鱼等违法活动，执法部门便难以联系到域名持有人。
In recent years, laws like GDPR mean registrars are sometimes required to hide WHOIS data. That’s fair enough but makes it hard for law enforcement to contact a domain holder if their resources are being misused – intentionally or otherwise – for purposes such as hosting malware, acting as command-and-control infrastructure for malware, or facilitating phishing.
ICANN规定，只有出现“对生命安全构成紧迫威胁、可能导致严重人身伤害、危及关键基础设施安全或涉及儿童权益侵害”的情形时，执法机构才可提出紧急查询请求。为妥善处理这一问题，ICANN专门成立了“执法机构身份验证机制工作组”，该工作组昨日在印度尼西亚巴厘岛举行的年度会议上汇报了工作进展。
ICANN’s definition for the kind of behaviour it thinks justifies urgent requests for WHOIS info is “imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation.”The org has convened an Input Group on Law Enforcement Agency Authentication Mechanisms to consider the issue, and that group yesterday explained its progress during ICANN’s annual meeting in Bali, Indonesia.
或许有读者会担心该提案可能导致执法机构滥用权限、随意索取WHOIS信息。不过，以下几点或许能打消此类顾虑：首先，域名注册商Namecheap与Verisign的代表也在会议上就该提案发表了意见，两家企业均表示支持；其次，该工作组主要负责技术层面的设计工作，后续ICANN内部的其他政策制定小组还将负责确定请求使用的规范与细则。这正是互联网治理的正常运作方式！
At this point, readers may have concerns that this proposal could allow law enforcement authorities to make inappropriate requests for WHOIS information. Several factors may ease such concerns. One is that representatives of domain registrars Namecheap and Verisign spoke during the session about the proposal, and both were supportive. Another is that the Input Group’s work is largely technical. Once it devises a mechanism to allow requests, other groups within ICANN dedicated to policy will work out acceptable use and related issues. This is the way internet governance gets done!
专家们各自处理问题的部分，然后协作创建一个在技术层面上可靠、在实践中可行并且在多个司法管辖区可执行的系统。他们将如何实现目前，ICANN 首选的做法是使用安全断言标记语言（SAML），使执法机构的已认证用户能够访问治理组织的注册数据请求服务（RDRS），并提交获取非公开 WHOIS 信息的请求。ICANN 已经在与 FBI 和 Interpol 的合作中测试了这一做法，但也对其他认证机制持开放态度，以便让其他机构访问 RDRS。输入小组的目标是发布一套规范，让这些机构能够遵循。
Specialists work on their own bits of a problem and then collaborate to create a robust system that works at a technical level, is practical, and enforceable in multiple jurisdictions. How they’ll do it At this point, ICANN’s preferred approach is to use Security Assertion Markup Language (SAML) so that authenticated users at law enforcement agencies canto the governance org’s Registration Data Request Service (RDRS) and file requests to access non-public WHOIS info. ICANN is already testing this approach with the FBI and Interpol but is open to other authentication mechanisms to allow other agencies access RDRS. The Input Group’s aim is to publish a spec those agencies can conform to.
ICANN 将把在 RDRS 中提交的请求转交给出售该域名的注册商。注册商有 24 小时的时间来审议请求——对于复杂查询则可延长至 72 小时。注册商还可以在认为查询未达到紧急程度阈值时拒绝请求。
ICANN will pass requests filed in RDRS to whichever registrar sold the domain. The registrar will have 24 hours to consider the request – or up to 72 hours for complex queries. Registrars will also be able to deny requests if they feel the query does not meet the urgency threshold. readers might worry that a colossal agency like the FBI could flood RDRS with requests from thousands of individual agents, swamping domain registries.
读者可能担心像 FBI 这样的大型机构会让成千上万名个别特工的请求涌入 RDRS，淹没域名注册局。ICANN 的计划是通过要求执法机构指定可以提出请求的特定人员，并在 SAML 握手期间使用共享令牌来强制执行这一权限，从而避免这种情况。该令牌的内容属于政策层面的问题，输入小组预计将在 ICANN 内部由其他人随后敲定。
ICANN’s plan is to avoid that by requiring law enforcement agencies to nominate certain personnel who are permitted to make requests, and to enforce that permission using a token shared during SAML handshakes. The content of that token is the kind of policy question that the Input Group expects others at ICANN to finalize later.
另一个正在考虑的问题是如何保护提出 RDRS 请求的执法人员的身份，因为 ICANN 认为如果他们的请求中包含电子邮件地址，可能会成为骚扰（甚至更严重）攻击的目标。
Another issue under consideration is how to protect the identity of law enforcement workers who make RDRS requests, as ICANN feels they could become targets of harassment (or worse) if their requests to see WHOIS data include email addresses. ®