What are the laws regarding ISP recording IP addresses? How would they know who had which?

Question

Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address on a certain day with a certain individual? For example if someone hacks a website and their IP address is found, can anything be done about it? If ISPs do keep logs, what is associated with a persons IP address? I mean does DHCP somehow know the geographical location of who gets what IP, and then that information is stored?

Answer 1

• Some ISPs force a connection reset every 24h and you get a new IP address assigned, others don't force you and yet others give you a fixed ip address.

• There are laws requiring the ISPs to log the User - IP association (which in turn is associated with your contract)... but e.g. in the EU there is the data retention directive that requires ISPs to even log individual connections. (Actually the EU directive is a "contract" between the European Council/Parlament and member nations, not between EC/EP and ISPs. The nations must adopt the directives in local law themselves. Usually they either adopt it as is, adopt it and extend it, have already adopted it or refuse to do so (this usually works by ruling that it conflicts with constitution).) read more at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32006L0024:EN:HTML. There is a visualisation for retained mobile phone connection metadata at http://www.zeit.de/datenschutz/malte-spitz-data-retention

  • Concerning your question about geographical location: There is a limited number of IP adresses available. They are goverened and distributed by organisations like http://www.iana.org and (?) http://www.ripe.net/ . Now your ISP buys IP addresses (whole ranges and networks) and uses them to connect you to the internet. They are not sitting there and free to use like on a private network with DHCP. (Try looking up your IP address and looking it up at https://apps.db.ripe.net/search/query.html)

There are databases like http://www.geoiptool.com/ that try to provide location information for any given ip address, but their accuracy greatly depends on different factors (e.g. if your ISP only operates in a small regional area or in the entire USA). Usually those databases are only good for associating IPs to countries.

Answer 2

Yes. ISPs do store all DHCP ip assignment logs. They know exactly who and when had what IP address. For them is it a legal obligation to harvest this information to facilitate any legal queries and investigations. In US they have to follow The Federal Communications Commission (FCC) regulations.

In US ISPs keep track of these items (as available) associated from IP assignment logs and their billing system records for any IP address they assign -

• Subscriber's name
• Subscriber's billing address, and service address
• Subscriber's contact number, phone and email whichever are available
• Date and time range of when a particular IP address was assigned to the subscriber
• Service account number and account status any particular time frame, along with their hardware details (modem etc).

They do not keep track of who accessed what site or what IP address and when, no tracking of subscriber's online activities/traffic. It is against privacy laws.

ISP are obligated to provide this information to Law Enforcement Agencies (Police, FBI etc) for any given investigations of frauds, hacking, online crimes, threats to the society and to prevent loss of a life.
Every ISP has their own procedure to provide this information to law enforcement agencies, some do it quicker, some take longer time.

Also take a look at Customer Proprietary Network Information (CPNI). It is a compliance requirement for all ISPs to protect network propitiatory information of every subscriber. It includes, call records, IP address, service details and also Personally Identifiable Information (PII) to some extent.

EDIT: To add more into this, A good example is - ISP has all subscriber IP information, If a subscriber uploads a pirated content on a site, or make it freely available on internet, the content owner can request investigation on this to the ISP and the ISP will dig through their DHCP lease history and actually send the subscriber a Piracy Act violation notice.

EDIT: A correction - For them is it a legal obligation to harvest this information is wrong. I couldn't find any document to support this. Thou from my day to day experience I know almost all ISPs harvest client IP information.

Answer 3

You need to specify the legal jurisdiction, when asking a question about the law.

In the US, I do not know of any legal requirement to record and retain this information (there have been some proposals but I do not believe any were enacted into law), but I believe most ISPs do anyway. In the EU, I believe there is a requirement to retain and record this information.

For further information:

• Wikipedia on Telecommunications data retention - includes a summary of the legal requirements in various countries, and supports my statements above

• ISP Data Retention: Early Results In - A summary of which major ISPs retain this sort of data.

• Resources from several civil liberties organizations on data retention policy: EPIC on data retention, CDT on data retention.

Answer 4

Your ip address is associated with your bill. If somebody reports your ip address, they will send you a warning, cut you off, the other company will setup a lawsuit, eventually if the hacked site was police, you will be jailed, and depending on how serious it was, you will get either fine or up to 5 year meditation, depends on the country.