Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address on a certain day with a certain individual? For example if someone hacks a website and their IP address is found, can anything be done about it? If ISPs do keep logs, what is associated with a persons IP address? I mean does DHCP somehow know the geographical location of who gets what IP, and then that information is stored?
There are databases like http://www.geoiptool.com/ that try to provide location information for any given ip address, but their accuracy greatly depends on different factors (e.g. if your ISP only operates in a small regional area or in the entire USA). Usually those databases are only good for associating IPs to countries.
Yes. ISPs do store all DHCP ip assignment logs. They know exactly who had what IP address and when. For them it is a legal obligation to harvest this information to facilitate any legal queries and investigations. In the US, they have to follow The Federal Communications Commission (FCC) regulations.
In the US, ISPs keep track of these items (as available) associated from IP assignment logs and their billing system records for any IP address they assign…
They do not keep track of who accessed what site or what IP address and when, no tracking of subscriber's online activities/traffic. It is against privacy laws.
ISP are obligated to provide this information to Law Enforcement Agencies (Police, FBI etc) for any given investigations of frauds, hacking, online crimes, threats to the society and to prevent loss of a life.
Also take a look at Customer Proprietary Network Information (CPNI). It is a compliance requirement for all ISPs to protect network propitiatory information of every subscriber. It includes, call records, IP address, service details and also Personally Identifiable Information (PII) to some extent.
EDIT: To add more into this, A good example is - ISP has all subscriber IP information, If a subscriber uploads a pirated content on a site, or make it freely available on internet, the content owner can request investigation on this to the ISP and the ISP will dig through their DHCP lease history and actually send the subscriber a Piracy Act violation notice.
EDIT: A correction -
As the owner and operator of an ISP, I can say that most of us (90%) keep connection logs. We need these internally for troubleshooting purposes. From these logs I can tell you exactly which user account was assigned what IP address and how long they had that address for (start stop times). I further have MAC address information on the device that made the connection to me. I keep these logs for 7 years and only provide information to law enforcement when provided with a court order commanding it so provided. We usually get a court order per month. When we do, law enforcement provides the time of date range, IP address used, any other pertinent info they have. They ask for just about the kitchen sink on the suspect. We by law only provide exactly what they ask for.
You need to specify the legal jurisdiction, when asking a question about the law.
In the US, I do not know of any legal requirement to record and retain this information (there have been some proposals but I do not believe any were enacted into law), but I believe most ISPs do anyway. In the EU, I believe there is a requirement to retain and record this information.
For further information:
protected by Community♦ Dec 16 '13 at 15:27
Thank you for your interest in this question.
Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?