closed Timeline for Urgent Requests for Lawful Disclosure of Nonpublic Registration Data

Outcome

In total, 12 Public Comments were submitted by stakeholders from across the community on the proposed timeline for Urgent Requests for lawful disclosure of nonpublic registration data.

Commenters considered whether the proposed language for inclusion in Sections 3.8, 3.9, 10.7, and Implementation Note K of the Registration Data Policy clearly describe the applicable requirements for urgent disclosure.

Commenters also evaluated whether the proposed Urgent Request timeline aligns with the requirements in the Expedited Policy Development Process on the Temporary Specification for gTLD Registration Data (EPDP-Temp Spec) Phase 1 Recommendation 18 (Rec 18), and the expectations provided by the Generic Names Supporting Organization (GNSO) Council,  Governmental Advisory Committee (GAC), and ICANN Board. Additionally, commenters provided feedback on the proposed Section 10.7 and whether the authentication mechanism (when available) requires additional policy work.

All Public Comments received were reviewed and carefully considered by ICANN org. Any substantive changes required to the proposed timeline for Urgent Requests for lawful disclosure of nonpublic registration data will be reviewed with the Registration Data Policy Implementation Review Team (IRT).

What We Received Input On

The Expedited Policy Development Process on the Temporary Specification for gTLD Registration Data (EPDP-Temp Spec) Phase 1 Recommendation 18 (Rec 18) anticipated "a separate timeline for responses to urgent requests for lawful disclosure of non-public registration data” and indicated that the response time and criteria would be established during implementation. Specifically, Rec 18 states that a:

separate timeline of [less than X business days] will be considered for the response to 'Urgent' Reasonable Disclosure Requests, those Requests for which evidence is supplied to show an immediate need for disclosure [time frame to be finalized and criteria set for Urgent Requests during implementation].

The current Registration Data Policy, which went into effect on 21 August 2025, does not include a required timeline within which registrars and registry operators must respond to requests categorized as “urgent,” because the EPDP-Temp Spec Phase 1 Implementation Review Team (IRT) did not reach an agreement on such a timeline. However, the IRT did reach agreement on the circumstances to be defined as “Urgent”:

Urgent Requests for Lawful Disclosure are limited to circumstances that pose an imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation in cases where disclosure of the data is necessary in combatting or addressing this threat. Critical infrastructure refers to the physical and cyber systems that are vital in that their incapacity or destruction would have a debilitating impact on economic security or public safety.

Since a response timeline for urgent requests remains unresolved, the Governmental Advisory Committee (GAC), ICANN Board, and Generic Names Supporting Organization (GNSO) Council encouraged ICANN org to continue IRT discussions to determine an appropriate timeline required for registry operators and registrars to respond to Urgent Requests for lawful disclosure in situations that pose an imminent threat to life, serious bodily harm, infrastructure, or child exploitation. When considering an appropriate timeline as required in Rec 18, the following points were noted among the Board, Council, and GAC

• Any proposed timeline measured in “business days” – whether one, two, or three business days – does not seem suitable for addressing such urgent threats. Instead, a much shorter response timeline, measured in minutes or hours rather than days, appears to be more appropriate.
• In order to determine a timeline, ICANN org, in consultation with the EPDP-Temp Spec IRT, should operate upon the assumption that the timeline to be agreed-upon will apply when an Urgent Request is submitted by an entity that has been authenticated through a to-be-agreed mechanism, which is being discussed in parallel within the GAC.
• The work on the Urgent Requests timeline would not constitute policy development as defined in Annex A of Bylaws, but rather would be continued implementation work on Rec 18 of the EPDP Phase 1 Final Report.

To this end, ICANN org is seeking input from the community on the proposed timeline for Urgent Requests for Lawful Disclosure. Specifically, ICANN org requests Public Comment on the following:

1. Does the draft language proposed for inclusion in Sections 3.8, 3.9, 10.7, and Implementation Note K of the Registration Data Policy clearly describe the applicable requirements?
2. If you believe that the draft language proposed does not clearly describe the applicable requirements, what areas require additional clarification?
3. Does the proposed Urgent Request timeline align with the requirements in EPDP Phase 1 Rec 18, and the expectations provided by the Board, GAC and GNSO Council?
4. The IRT has discussed the proposed Section 10.7 and some IRT members believe the authentication mechanism (when available) would require additional policy work, while others believe the authentication mechanism is part of the implementation of Rec 18 and would not require additional policy work. Do you believe this requires additional policy work?
1. If you believe this requires additional policy work, please explain.
2. If you do not  believe this requires additional policy work, please explain.

NOTE 12 November: Item number 1 above has been edited for clarity

Background

The Expedited Policy Development Process on the Temporary Specification for gTLD Registration Data (EPDP) Phase 1 Recommendation 18 (Rec 18) anticipated "a separate timeline for responses to urgent requests for lawful disclosure of non-public registration data” and indicated that the response time and criteria would be established during implementation. The relevant section reads that a:

separate timeline of [less than X business days] will be considered for the response to 'Urgent' Reasonable Disclosure Requests, those Requests for which evidence is supplied to show an immediate need for disclosure [time frame to be finalized and criteria set for Urgent requests during implementation]. 

Currently, no such timeline exists in the Registration Data Policy, which went into effect on 21 August 2025. As part of Rec 18’s further review, in its 3 June 2024 correspondence, the Board identified the concern that urgent requests would more appropriately be responded to within minutes or hours rather than the previously proposed business days, specifically:

To the extent that law enforcement needs registration data to respond to situations that pose an imminent threat to life, serious bodily harm, infrastructure, or child exploitation, the proposed timeline - whether one, two, or three business days - does not appear to be fit for purpose. To respond to truly imminent threats, a much shorter response timeline, i.e., minutes or hours rather than days, would seem to be more appropriate.  

The GAC and GNSO Council also acknowledged that the use of business days may not be appropriate to respond to Urgent Requests for the disclosure of data.

To address the Board’s concern that the use of business days is not fit for purpose to address truly imminent threats and the lack of an authoritative, legally sufficient cross-border system to validate law enforcement entities, on 15 October 2024 the GAC proposed two separate parallel tracks:

1. An authentication path where the GAC Public Safety Working Group (PSWG), in collaboration with contracted parties, would explore possible ways forward on an authentication solution.
2. “Discussions about an appropriate response time for Urgent Requests should be based on an assumption that urgent requests received by registrars have been authenticated”

Subsequently, the GNSO Council, GAC, and ICANN Board held two trilateral calls. During its 19 December 2024 meeting, the GNSO Council considered the IRT's previous discussions regarding the separate timeline for urgent requests and noted the IRT could not agree to a timeline, in part, because of the lack of a global authentication mechanism.

In response to the GAC’s proposal, the GNSO Council assumed work on the additional timeline discussions would occur within the existing IRT. Specifically noting “To be clear, this would not constitute policy development as defined in Annex A of Bylaws (the GNSO PDP) but rather, would be continued implementation work on Recommendation 18 of the EPDP Phase 1 Final Report”

In light of the GAC's two-track proposal to develop such a mechanism, and resume timeline discussions within the EPDP-Temp Spec IRT, the Board, GNSO Council, and GAC reached an agreement during their second trilateral meeting on 12 February 2025 that implementation work should resume on Rec 18, specifically related to identifying an appropriate timeline within which registry operators and registrars should be required to respond to urgent requests for lawful disclosure. On 27 March 2025, the GNSO Council further acknowledged and agreed with the GAC’s suggestion that the discussion regarding the response time for urgent requests should continue within the EPDP-Temp Spec IRT, and subsequently encouraged that ICANN org resume IRT meetings in the near term.

To date, ICANN org has held six sessions with the EPDP-Temp Spec IRT, where the IRT members shared concerns and feedback related to the Urgent Request requirement and proposed language. Throughout these sessions, various perspectives were shared, and the language proposed for Public Comment reflects a synthesis of all the inputs and concerns that were considered.

Supporting Information