Online crime, subpoena, search, and arrest [closed]

Question

Suppose that someone hacks a website, and suppose that the police find what the hacker's IP address was at the time of hack, and they contact the Internet Service Provider to resolve the IP address to the real person behind it.

Phase 1: Now, for this, the police need to submit a subpoena to the ISP. After this, the ISP would search which one of its subscribers was using the IP address (submitted by the police) at the time mentioned by the police (the time of the hack). The ISP would find the subscriber and submit it to the police.

Phase 2: The police will have the address of the subscriber (the hacker) and arrest him/her.

I want to get a general idea as to what is the maximum possible time that Phase 1 should usually take. How long could "the search for someone by their IP address by their ISP" take, assuming that merely submitting a subpoena itself is a very very short process (1-5 days; but do correct me if I am wrong)?

Is the "searching for the person from their IP address by their ISP" a quick process like searching for a Wikipedia article about Stack Exchange? Or is it a time consuming process?

Answer 1

Here is the form, for US District courts. It starts by saying

YOU ARE COMMANDED to produce at the time, date, and place set forth below the following books, papers,documents, data, or other objects

It is basically irrelevant how many nanoseconds it takes to obtain the data being subpoenaed. Legally relevant variables are (1) whether a motion to quash the subpoena is filed – if so, step 1 takes a long time, (2) whether the ISP is cooperative or not. Apparent non-cooperation by the ISP can take many forms, for example they may be mostly cooperative but they receive thousands of subpoenas every day and it takes a few days to get to any particular subpoena. Alternatively, the ISP may be actively resistant and file motions, which will delay the process. Other variables are the "caution" used by the ISP (verifying the LEA, method of supplying the results, extent of the search actually required, e.g. "all users in the Atlanta airport" versus "this residential user"). If the specified due date is unreasonable, the ISP can make the case in court; if they don't comply in a timely fashion, they might be found in contempt, but that is not automatic. There might also be a jurisdiction-specific timeline.

What you want is not a legal answer, but an empirically-derived "typical timeframe".

As for why an ISP would require a subpoena or resist police requests for information, there are numerous political reasons (either they resist the government's underlying agenda, or they know that over-voluntary compliance will be unpopular and detrimental to their business). The main legal reason is that they may have a contractual duty to protect customers' information to the full extent of the law. They will never have a legal obligation to violate the law to protect information, so ultimately they will have to give in if their motion to quash is not granted. In the US, there is no obligation to delete data, but there may be such an obligation in other jurisdictions, so there's possibly a complex interaction between subpoena law and GDPR in the EU, which is a separate question.