What happens when an ISP who was subpoenaed for an IP doesn&#39;t have their IP logs anymore?
<p>What if police wanted to find a copyright violator or someone who hacked or committed a worse crime in the United States and the ISP in question deleted there IP assignment logs. Then how would they catch them? Would they subpoena/warrant google and social media sites?</p>

<p>Copyright infringement does not involve the police. However, you as copyright owner can subpoena records from a service provider under <a href="https://www.law.cornell.edu/uscode/text/17/512" rel="nofollow noreferrer">17 USC 512(h)</a>. There is no records-retention law in the US, so there may be nothing to subpoena. Furthermore, the law only allows you to subpoena records from the providers that host material, not the "infrastructure" provider, such as Verizon. This was first sorted out in <a href="https://www.epic.org/privacy/copyright/verizon/dc-cir-op.pdf" rel="nofollow noreferrer">RIAA v. Verizon</a>. There is no chance that you could subpoena records from a third party like Google on the chance that they might have some record.</p>

<p>If this is law enforcement seeking evidence of a crime, and not a private party engaging in discovery for a civil suit, law enforcement could subpoena anyone, provided that they can show to a judge probable cause to believe that the person or entity  subpoenaed has relevant evidence of the crime. LE can subpoena a web site operator, an ISP, an infrastructure provider, or anyone else.</p>

<p>However, there is no general law in the US requiring that web sites keep access logs of any type at all, or that if created, such logs be retained for any particular period. A business is free to delete all logs after two weeks, if it so chooses, although most do not so choose.  </p>

<p>However, if a person or business knows that law enforcement is going to subpoena logs (or any other documents)  and it <strong>then</strong> deletes or destroys them, that might be destruction of evidence, which is a serious crime. If it has been officially informed that such a subpoena is pending, via an order of preservation, then any destruction is much more likely to be viewed as criminal.</p>

<p>It often happens that documents demanded under subpoena do not exist, or cannot be found. In such a case the prosecutor must do without them, and try to prove the case anyway, or drop the charges. Unless they were destroyed to avoid producing them, or there was some other legal obligation to retain them (some records are required by law), or possibly the entity lied in saying that they were not available, nothing can be done to the entity who did not produce them. </p>

<p>Instead of issuing a subpoena, a search warrant could be issued and the authorities could search for and seize the relevant documents. This is more often done when the custodian of the documents is an accused party, or closely associated with one, and there is a fear that the documents will be hidden or destroyed if a subpoena is served. But the authorities have a choice of which way to proceed. A search is typically more expensive, and will (may) make the custodian hostile if it was not so before, so a subpoena is often preferred when it is thought sufficient to do the job.  </p>

<p>Note that it is very unlikely that such a subpoena, let alone a warrent, would be issued in a copyright violation case. But it might be when proof of web access would help to establish a serious crime.</p>

united-states internet subpoena