Law enforcement requests: a guide for authorities

Where should an authority send a request?

To [email protected], from an official address of your authority. Use one of two subject lines:

• "Legal request" for orders, preservation requests and questions about the procedure;
• "URGENT" only for an imminent threat to life, serious bodily injury, critical infrastructure, or child exploitation.

[email protected] also works with the same subject lines. Write in English or Spanish. Attach the order as a PDF; the email itself can be short.

The operator is DomaineGoat LLC, a company incorporated in Panama. Domains are registered through our ICANN-accredited registrar partner. Requests to PanamaRegistrar are handled under Panamanian law, which is set out on the Panama domain law page; a request to our registrar partner follows its own law.

What should a request include?

Everything we need to check it and act on it without writing back. Include:

1. Your authority: name, unit, officer, official email, and a phone number we can verify from public sources.
2. The legal basis: the court order or Ministerio Público order, or the treaty channel used.
3. The domain names, exactly, one per line. A request without named domains is a bulk request.
4. What you ask for: suspension, preservation, or production of named data, and for which period.
5. Your case reference and the offence under investigation.
6. Confidentiality: whether the customer may be told, and until when.

Our rule is that we confirm every order with the court or prosecutor's office that issued it, through its official contact details, before acting. The same check applies to Ministerio Público orders. Expect us to contact your office through its official channels before we act.

Which route applies to a Panamanian authority?

A Panamanian court order, or a Ministerio Público order under the Code of Criminal Procedure. Law 478 of 4 August 2025 added the tools that matter to a registrar:

• Article 338-A: expedited preservation for up to 90 days, renewable. We keep the order confidential, as the article requires.
• Article 338-C: production order for computer data in our possession or control, including subscriber data.
• Article 338-B: preservation and partial disclosure of traffic data. We do not carry our customers' website or email traffic.

We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case; orders under articles 338-A and 338-C are such prosecutor's orders. They are checked like court orders and counted separately in our transparency report.

Article 24 of Law 81 of 2019 obliges us to answer duly made requests from competent judicial authorities. It also bars bulk requests in every case.

How does a foreign authority use these routes?

It sends its request to Panama, and a Panamanian authority then issues the order that reaches us. A request sent straight to us from abroad, without that step, gets a written reply naming the right channel. It discloses nothing.

This is not a delay we choose to add. Article 29 of the Constitution of Panama reserves the examination of private documents to a competent authority. Law 81 of 2019 (art. 33, No. 8) treats transfers made in international judicial cooperation as lawful, which is the path treaty requests follow.

How can an authority get data preserved?

Through a Ministerio Público order under CPP article 338-A, or, from abroad, through Panama's 24/7 contact point. Article 338-A allows preservation for up to 90 days, renewable. Since Law 478 of 2025, Law 11 of 2015 also provides expedited preservation for foreign requests, through the 24/7 contact point designated by the Procurador General.

Our own retention helps in the meantime. The email and domain records are kept while the domain is registered with us, and for the period ICANN rules require after that. Records of complaints and orders are kept as long as the decision can be challenged. The full list is on what we hold.

What counts as an emergency?

Four cases, and only four: an imminent threat to life, serious bodily injury, critical infrastructure, or child exploitation. They are handled first, but the data we hold still leaves us only on a Panamanian order; the Ministerio Público can issue a preservation or production order directly (CPP arts. 338-A, 338-C).

Send them with the subject "URGENT". State the threat, why the data or action will help, the domain, and how we can verify you.

For active abuse, the abuse track is often faster. Phishing, malware, botnets and fraud that takes money from victims are suspended within 24 hours of a well-documented report. Child sexual abuse material is suspended immediately, and the URLs are reported to NCMEC. ICANN's RAA §3.18.3 sets a 24-hour review for well-founded reports from law-enforcement contacts. See report abuse.

What data does PanamaRegistrar actually hold?

For each domain, the full set is short:

• one verified email address (ICANN requires registrars to verify it within 15 days);
• the account number, a random number we generate;
• the domains in the account and their DNS settings;
• the account balance;
• payment records: the amount, the coin and the network of each crypto top-up.

The email is the only contact data we collect: no name, postal address, phone number or identity document. With Domain protection, the registry and WHOIS show DomaineGoat LLC; the customer behind it is known to us only by the verified email. We do not host websites or email, so content and server logs sit with the customer's providers. Our registrar partner and the registry keep their own registration records under their own law; the .com and .net registries hold no registrant contact data.

What happens to a defective request?

It is answered in writing, and nothing is released or done until it is put right. The reply lists what is missing: the order, the legal basis, the domains, or a channel through Panama. We do not complete a request ourselves or guess its scope.

Three requests are always refused: a bulk request (Law 81 of 2019, art. 24), a foreign judgment without exequatur, and an order we cannot verify with its issuer. Each refusal is counted in the transparency report, published every quarter from January 2027. Prices for the domains this procedure covers are on the price list.