I was reading an article which explained that there is a growing movement to force ISP's to store IP-assignment logs for DHCP connections for longer periods of time in order to fight cyber-crime. However, I don't understand why this is necessary. If an ISP no longer has the information associated with an IP address, why couldn't a company like google be asked what account signed in on a given date, using a given IP address and use that to track someone?


It's certainly possible to do it that way, and indeed investigators will sometimes ask many different parties for information related to a case to piece together scattered evidence, but why would you want to obtain this information from Google when it is much easier and more reliable to obtain it directly from the source (the ISP)? After all, the ISP is the entity that actually assigns IP addresses to its customers, so they're going to be the ones with the most accurate information about who has what IP address at what time. The ISP also has an incentive to identify and remove malicious users from their networks. Asking Google can be hit-or-miss; for example, what if the malicious user's IP address changes right after signing into Gmail but before he performs the illegal activity? Or, more likely, what if he never signs into Gmail or any other service at all around the time of the incident?

Also, think about it from Google's perspective. If the illegal activity neither targeted Google, nor was it performed from Google's network, why should they be willing to get dragged into this and be forced to spend the time and resources necessary to locate the information when the ISP could provide it much more easily? The only relationship Google has with anything is that the person who did it might have an account with them and might have logged in around the time of the incident.

While a court could force them to provide some information about the IP address in many jurisdictions, they're certainly not going to be very happy about it or eager to do it unless it's an extremely serious case and you have evidence that the person is a Google account holder. It's also bad for PR, as tech companies are increasingly trying to demonstrate that they respect privacy after the Snowden leaks. They publish the number of government data requests they receive, and if this number is high, the news media will pick it up and it's bad for business. If you found out that Google is the first source of information authorities turn to in investigations and Google happily hands over anything they ask for, would you still be willing to trust them with your personal data? I certainly wouldn't.

  • Also Another thing is that a account on a website is not some sort of legally binding ID. Accounts can be shared, its not illegal to share accounts for non-illegal activites, and going to third-party sites to find whoever did X can be a very dangerous move. Accounts can also be hacked. Thats why its generally required to have some relationship. A relationship could be as simple as that there was a Google +1 button on a site that was abused for illegal activites, and Google is being asked for which account did load that button. In this case it clear that account was shared for illegal purposes. – sebastian nielsen Jun 3 '15 at 1:59

I live in the Netherlands and we had a storage requirement for 2 years (I believe).

One of the motivation for getting the law was so law enforcement can track a malicious use back from the logs of a server to the ISP, and than (through the courts) get the Name and address of the subscriber.

Asking a third party to correctly and legally identify a person is harder to use for legal actions (simply having a connection to google does not mean that a 'suspect' is actually the one using it.

We have laws in place that make the owner of a contract with a ISP responsible for what happens with there connection.

So having the information of why had what IP and when enables the police and prosecution to legally charge a person with suspected criminal activity. Something that even if you had google's log,

You would still need to trace that back to a legal person.

I know most of this is legal information, and only relevant if your dutch. but you can assume other countries have similar reasons for wanting these systems in place. And I do not touch the area of whether these laws work or should be in place (that is for legal.se)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.