Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address on a certain day with a certain individual? For example if someone hacks a website and their IP address is found, can anything be done about it? If ISPs do keep logs, what is associated with a persons IP address? I mean does DHCP somehow know the geographical location of who gets what IP, and then that information is stored?

share|improve this question

4 Answers

up vote 5 down vote accepted

  • Some ISPs force a connection reset every 24h and you get a new IP address assigned, others don't force you and yet others give you a fixed ip address.

  • There are laws requiring the ISPs to log the User - IP association (which in turn is associated with your contract)... but e.g. in the EU there is the data retention directive that requires ISPs to even log individual connections. (Actually the EU directive is a "contract" between the European Council/Parlament and member nations, not between EC/EP and ISPs. The nations must adopt the directives in local law themselves. Usually they either adopt it as is, adopt it and extend it, have already adopted it or refuse to do so (this usually works by ruling that it conflicts with constitution).) read more at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32006L0024:EN:HTML. There is a visualisation for retained mobile phone connection metadata at http://www.zeit.de/datenschutz/malte-spitz-data-retention

    • Concerning your question about geographical location: There is a limited number of IP adresses available. They are goverened and distributed by organisations like http://www.iana.org and (?) http://www.ripe.net/ . Now your ISP buys IP addresses (whole ranges and networks) and uses them to connect you to the internet. They are not sitting there and free to use like on a private network with DHCP. (Try looking up your IP address and looking it up at https://apps.db.ripe.net/search/query.html)

There are databases like http://www.geoiptool.com/ that try to provide location information for any given ip address, but their accuracy greatly depends on different factors (e.g. if your ISP only operates in a small regional area or in the entire USA). Usually those databases are only good for associating IPs to countries.

share|improve this answer
2  
Technically it's a EU directive, and needs to be implemented in local law to come into effect. Germany currently has no such law, because the previous attempt was struck down by our constitutional court, and they can't agree on a new law. – CodesInChaos Jul 17 '12 at 8:52
You are correct. – Tie-fighter Jul 17 '12 at 15:41
@Tie-fighter Do you mind updating to reflect that legal difference? – chao-mu Jul 18 '12 at 19:44
up vote 4 down vote

Yes. ISPs do store all DHCP ip assignment logs. They know exactly who and when had what IP address. For them is it a legal obligation to harvest this information to facilitate any legal queries and investigations. In US they have to follow The Federal Communications Commission (FCC) regulations.

In US ISPs keep track of these items (as available) associated from IP assignment logs and their billing system records for any IP address they assign -

  • Subscriber's name
  • Subscriber's billing address, and service address
  • Subscriber's contact number, phone and email whichever are available
  • Date and time range of when a particular IP address was assigned to the subscriber
  • Service account number and account status any particular time frame, along with their hardware details (modem etc).

They do not keep track of who accessed what site or what IP address and when, no tracking of subscriber's online activities/traffic. It is against privacy laws.

ISP are obligated to provide this information to Law Enforcement Agencies (Police, FBI etc) for any given investigations of frauds, hacking, online crimes, threats to the society and to prevent loss of a life.
Every ISP has their own procedure to provide this information to law enforcement agencies, some do it quicker, some take longer time.

Also take a look at Customer Proprietary Network Information (CPNI). It is a compliance requirement for all ISPs to protect network propitiatory information of every subscriber. It includes, call records, IP address, service details and also Personally Identifiable Information (PII) to some extent.

EDIT: To add more into this, A good example is - ISP has all subscriber IP information, If a subscriber uploads a pirated content on a site, or make it freely available on internet, the content owner can request investigation on this to the ISP and the ISP will dig through their DHCP lease history and actually send the subscriber a Piracy Act violation notice.

EDIT: A correction - For them is it a legal obligation to harvest this information is wrong. I couldn't find any document to support this. Thou from my day to day experience I know almost all ISPs harvest client IP information.

share|improve this answer
"They do not keep track of who accessed what site or what IP address and when" are you refering to the IP address of the website (etc.) they visited or their own ip address? – Celeritas Jul 17 '12 at 5:46
Website's IP address that they visited. Not their own IP. – Kapish M Jul 17 '12 at 5:48
Even if the ISP's were not required to keep this information for legal reasons, they likely would still keep said logs, for the simple fact they would want to be able to track this information for quality control reasons. – Ramhound Jul 17 '12 at 11:28
@KapishM "the ISP will dig through their logs and actually send the subscriber a Piracy Act violation notice."? What information are they consulting? Just DHCP lease records? – chao-mu Jul 17 '12 at 12:45
1  
@Ramhound Citation? No offense intended, it is a claim I have seen frequently. – chao-mu Jul 17 '12 at 12:48
show 6 more comments
up vote 1 down vote

You need to specify the legal jurisdiction, when asking a question about the law.

In the US, I do not know of any legal requirement to record and retain this information (there have been some proposals but I do not believe any were enacted into law), but I believe most ISPs do anyway. In the EU, I believe there is a requirement to retain and record this information.

For further information:

share|improve this answer
I'm in Canada but interested of anywhere. – Celeritas Jul 17 '12 at 18:25
up vote -5 down vote

Your ip address is associated with your bill. If somebody reports your ip address, they will send you a warning, cut you off, the other company will setup a lawsuit, eventually if the hacked site was police, you will be jailed, and depending on how serious it was, you will get either fine or up to 5 year meditation, depends on the country.

share|improve this answer
But is there a way for them to know who had which IP address? I mean do they know which modem is getting assigned a particular IP address and then they can cross reference the owner of the modem? Typically a persons is identified by there IP address while online but how can a persons name be associated with that IP address? You say your ip address is associated with your bill but are you thinking of only static IP addresses? – Celeritas Jul 16 '12 at 23:30
2  
This is a horrible answer. You talking about being "jailed" yet there is very little you can do on the internet itself will result in that sort of action. You talk about 5 year meditation but don't describe what crime they would have to perform, again, there is only a very small subset of actions thats will result in actual jail time. – Ramhound Jul 17 '12 at 11:31
2  
@Andrew, Consider deleting answers which are found to be non-helpful. This prevents anyone else from seeing, and it will restore lost reputation points. – George Bailey Jul 17 '12 at 16:55
3  
@Andrew, You have added significant content to this site. Some of it has been helpful and useful information. Other parts of your contributions are wrong, or less than useful. (you can tell by the up or down votes) I would suggest you delete content where you are mistaken. There are delete links on all your questions, answers, and comments. – George Bailey Jul 18 '12 at 20:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.