2

I know most, if not all, ISPs log the IPs you had tied to your network, but do ISPs keep logs of the IPs you have tried to connect to? For example, let's say I went to google.com, would the ISP be able to go through their logs and find whether I have ever connected to that site?

  • 1
    Replaced "Let's say I want to go to google.com, can my ISP see it in logs?" with "Let's say I went to google.com, can my ISP see it in logs?". This is not thoughtcrime we're talking about ;) – Luc Jan 9 '14 at 23:59
3

I cannot give a source nor which ISP this concerns since someone accidentally crossed their NDA by telling me this, but I think it should be known that there are ISPs that, at least in the Netherlands, log all DNS requests. This would mean that any hostname you ever looked up will be logged, including google.com, regardless of whether you really connected to the associated IP addresses. It is very reasonable to assume that a judge might find it convincing evidence that you really did visit the website. (Sidenote: DNS traffic that was merely passing through, not actually directed at the ISP's own DNS servers, was probably not logged, though this is not certain.)

The ISP in question tried to log as little as possible simply because it costs them money, but they are required to do this in order to comply with the law in the Netherlands. They (nor any other ISP) don't mention anything at all about what kind of data they log, they merely tell you in the terms of service that they log "as much as required by law".

I never thought they would log each and every DNS request, and I'm fairly sure that people here also wouldn't like it if they knew that they are indiscriminately being tapped 24/7. On Google I can't find any mention of that ISP doing that, nor any other Dutch ISP, so I'm not sure this information is public. I myself knew such information had to be logged about phones, the law is very clear in that sense (it mentions exactly which data needs to be logged), but logging DNS goes further in my opinion. Anyhow, this discussion gets political very fast.

More to the point, yes your ISP can do this and might even be required to do this by law, regardless of whether the police (or intelligence agency) placed a tap on your connection. In the Netherlands ISPs are required to store the logs for 6 months, but this may vary per country.

They can also, though probably not legally or without telling you, tap your connection's contents. This means not only which domains you looked up or which IPs you connected to, but also the data that was sent to them. This usually only happens in the event of a tap, or possibly when they themselves detect some sort of abuse. It might also be that they automatically process all data in search for keywords or certain protocols, such as bittorrent handshakes or Tor traffic. However legal or not, they have the technical capability to do this without anyone knowing.

  • 3
    Because of the EU data retention directive, any ISPs in the European Union are required by law to log all connections for at least 6 months for law enforcement purposes (The only exception is currently still Germany, but the newly elected German government have already announced that they are going to follow the directive). – Philipp Jan 10 '14 at 13:23
  • That statement is not entirely correct. ISP's need to keep track of which user uses which IP (DHCP/radius/static assignments) and of email traffic (sender, recipient). They are not required to log which websites you visit or other types of connections. – Teun Vink Jan 11 '14 at 23:57
  • @TeunVink For the CIOT database (linking IP to a name and address), sure, and e-mail too, but beyond that I thought they also had to log more. At least the example from this ISP shows that they were required to; they didn't want to log anything because it simply costs money to maintain. That is, if the story I heard is true, and I think so (but I can't elaborate on why I believe the person because that might give too much info about them). – Luc Jan 12 '14 at 13:19
  • I'm 100% certain ISP's are not required to log more than that. I've worked for two Dutch ISP's and have been involved in implementing these requirements at both. – Teun Vink Jan 12 '14 at 13:49
  • @TeunVink Okay, thanks for the follow up. Weird that I heard a different story, or perhaps the ISP is not as benign as they seem (or they have a misconception of what's required, though it seems odd). Well I'm just speculating now. Thanks for the additional info anyway! – Luc Jan 13 '14 at 0:37
0

OfCourse, that's almost their purpose... your connection before reaching google.com passes through their servers... that's why you need an ISP, therefore they're able to see everything that you do online, unless you use a VPN or somekind of proxy, the ISP could still see the proxy/VPN but your ISP won't know what you did while using the proxy/VPN, in that case only the proxy/VPN would know.

0

A lot of ISP's use tools like Netflow for generating statistics of traffic on their network. This statistics can be used for route optimization and DDoS mitigation for example. Often sampling is used, so data of one in every few hundred packets is inspected, but it is possible to do 1:1 sampling on some equipment.

Netflow data can contain source and destination IP addresses and TCP/UDP port numbers, so it could be used by an ISP which deploys netflow to analyse your browsing behaviour.

0

Yes, they can and often do log such things. This has been a big deal among the community of people who use VPNs to attempt to be anonymous. Many VPN providers claim they don't log your activity so the activity cannot be obtained by law enforcement. Whether the VPN provider keeps logs may not be true but you don't only have to worry about your VPN provider logging your activity but their upstream provider as well. This guy got arrested over this very issue:

https://www.bestvpn.com/blog/8383/earthvpn-user-arrested-cops-find-logs/

At my company we keep DNS logs, sflow logs, web proxy logs, as much data as possible. Logstash and Hadoop make it easy to keep terabytes of logs for years. But our users don't want to be anonymous and don't want to interact with anyone anonymously.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.