Suppose that someone hacks a website, and suppose that the police find what the hacker's IP address was at the time of hack, and they contact the Internet Service Provider to resolve the IP address to the real person behind it.

Phase 1: Now, for this, the police need to submit a subpoena to the ISP. After this, the ISP would search which one of its subscribers was using the IP address (submitted by the police) at the time mentioned by the police (the time of the hack). The ISP would find the subscriber and submit it to the police.

Phase 2: The police will have the address of the subscriber (the hacker) and arrest him/her.

I want to get a general idea as to what is the maximum possible time that Phase 1 should usually take. How long could "the search for someone by their IP address by their ISP" take, assuming that merely submitting a subpoena itself is a very very short process (1-5 days; but do correct me if I am wrong)?

Is the "searching for the person from their IP address by their ISP" a quick process like searching for a Wikipedia article about Stack Exchange? Or is it a time consuming process?

  • 1
    This seems like a technical question, not a legal one. An ISP with a decent logging system could look this up in a few milliseconds if they wanted to. If they drag their feet or don't get around to it or challenge the subpoena or are incompetent, it could take an almost unlimited amount of time. Nov 8, 2020 at 16:58
  • 1
    @NateEldredge Thank you for your valuable input. So it is technically a matter of a few seconds (like searching for a Wikipedia article) if the ISP coordinates nicely. Are you 100% sure on this that it is a matter of seconds?
    – Jay Shah
    Nov 8, 2020 at 17:04
  • Moreover, what do you mean by "incompetent"? I don't get in what respect ISPs could be incompetent in this context?
    – Jay Shah
    Nov 8, 2020 at 17:05
  • 1
    I’m voting to close this question because it's not a question of law; move to security.stackexchange.com Nov 8, 2020 at 17:12
  • @BlueDogRanch But is security SE an appropriate place for this question? I thought to post it there but I thought that people with knowledge of law would be familiar with these kind of cases.
    – Jay Shah
    Nov 8, 2020 at 17:16

1 Answer 1


Here is the form, for US District courts. It starts by saying

YOU ARE COMMANDED to produce at the time, date, and place set forth below the following books, papers,documents, data, or other objects

It is basically irrelevant how many nanoseconds it takes to obtain the data being subpoenaed. Legally relevant variables are (1) whether a motion to quash the subpoena is filed – if so, step 1 takes a long time, (2) whether the ISP is cooperative or not. Apparent non-cooperation by the ISP can take many forms, for example they may be mostly cooperative but they receive thousands of subpoenas every day and it takes a few days to get to any particular subpoena. Alternatively, the ISP may be actively resistant and file motions, which will delay the process. Other variables are the "caution" used by the ISP (verifying the LEA, method of supplying the results, extent of the search actually required, e.g. "all users in the Atlanta airport" versus "this residential user"). If the specified due date is unreasonable, the ISP can make the case in court; if they don't comply in a timely fashion, they might be found in contempt, but that is not automatic. There might also be a jurisdiction-specific timeline.

What you want is not a legal answer, but an empirically-derived "typical timeframe".

As for why an ISP would require a subpoena or resist police requests for information, there are numerous political reasons (either they resist the government's underlying agenda, or they know that over-voluntary compliance will be unpopular and detrimental to their business). The main legal reason is that they may have a contractual duty to protect customers' information to the full extent of the law. They will never have a legal obligation to violate the law to protect information, so ultimately they will have to give in if their motion to quash is not granted. In the US, there is no obligation to delete data, but there may be such an obligation in other jurisdictions, so there's possibly a complex interaction between subpoena law and GDPR in the EU, which is a separate question.

  • (1) But if ISPs do not cooperate, or try to quash the subpoena, the date for data deletion would likely arrive, and the subpoena would go in vain. Why would ISPs do this at all? I don't get why won't they coordinate. What's there for them to challenge the subpoena?
    – Jay Shah
    Nov 8, 2020 at 17:47
  • (2) Is the data of the person in question legally supposed NOT to be deleted on the due deletion date when the ISP is not very cooperative or challenges or delays responding?
    – Jay Shah
    Nov 8, 2020 at 17:48

Not the answer you're looking for? Browse other questions tagged .