Law Enforcement & Public Safety
ARIN and Law Enforcement Agencies
ARIN frequently assists Law Enforcement Agencies (LEAs) in obtaining information from the registry needed to accomplish their mission. Typically, the information they need is publicly available in Whois, and ARIN staff will assist in locating this data. However, there are occasions when LEAs need additional information that ARIN may have that is not publicly available.
Due to ARIN’s business practice of maintaining confidentiality, we cannot provide any non-publicly available information without a subpoena or court order. Below is an overview of the type of information that ARIN can provide to LEAs and guidelines for obtaining that information.
What information is in ARIN’s public Whois?
Registration information about:
- Internet Protocol (IP) addresses and Autonomous System Numbers (ASNs) issued by ARIN
- IP addresses and ASNs issued by ARIN’s predecessor registries
- Organizations that hold these resources
- Points of Contact (POCs) for resources or organizations
- Customer reassignment information (from an ISP to its customers)
- Referential information for:
- Other authoritative RIRs
- Customer reassignment information put into an RWhois server by an ISP
What information is not in ARIN’s public Whois?
- Domain names and any associated information
- Authoritative information for:
- Sub-delegations by ISPs using RWhois
- Resources registered in other RIRs’ Whois
- Customer reassignments smaller than /29 (per ARIN policy)
- Some privatized residential customers (per ARIN policy)
- Routing information
- Accurate geographic location of the network
- The main purpose of Whois is to record authorized users or assignees of an Internet resource. ARIN cannot guarantee that the address associated with an Internet resource record is the actual physical location of the network.
What information might ARIN be able to provide?
ARIN may be able to provide current and historical information about:
- Upstream ISP or end user contact information (on direct allocations and assignments)
- Customer reassignment information smaller than /29
- Previous address holders subsequent to a transfer of the resources to another organization
- Financial transaction records and billing POCs
- Banking information (if available)
- Other miscellaneous information provided by customers when seeking ARIN services
Generally, the most specific user information can be obtained directly from the ISP or end user organization; however, ARIN information may be helpful in identifying the appropriate ISP or end user organization.
Note: To learn more about Whois, view the Quick Guide to ARIN’s Whois.
Considerations When Using Whois Data for Investigations
- Publicly displayed Whois data is public information
- If data is not publicly displayed, a duly issued subpoena specifying the information requested is required
- Whois data is not always up-to-date as it is the registrant’s responsibility to update not only their own information, but also their customer’s information
- Legacy space is rarely updated as there is no contractual requirement to do so
- Not all customer reassignments will be in Whois, for instance:
- RWhois
- Those smaller than /29
- Many IPv6 reassignments
Subpoenas and Court Orders
A subpoena should include the name of the organization, the individual’s name(s), the IP address or ASN in question, and the specific date range for alleged activity or for information requested. Subpoenas should not include extraneous material that is not related to ARIN’s services or business model (e.g. exhibits or requests formatted for other respondents such as telephone service providers or ISPs; requests for subscriber information, etc.).
Please note that ARIN’s legal counsel is readily available to cooperate with law enforcement regarding the appropriate language for subpoenas and court orders requesting or directing the production of information and documents by ARIN. This will help streamline the process, and shorten response times, by ensuring that subpoenas and court orders contain mutually agreeable language that neither ARIN nor law enforcement finds objectionable.
Properly served subpoenas and court orders should be directed to ARIN’s national registered agent (see below), who will accept the document on behalf of ARIN and forward it to ARIN’s legal counsel.
Corporation Service Company
100 Shockoe Slip
2nd Floor
Richmond, VA 23219