Europe increasingly requires their ISPs to track "IP detail records" (IPDRs) summarizing network activities into/out-of/within their networks using products suc

Europe increasingly requires their ISPs to track "IP detail records" (IPDRs) summarizing network activities into/out-of/within their networks using products such as SenSage (http://www.sensage.com/solutions/cdr.php http://www.sensage.com/solutions/cdr.php). A number of telcos/ISPs acknowledge using the product (see http://www.sensage.com/customers/index.php http://www.sensage.com/customers/index.php), and many more likely do. No matter what you think of censorship, it will be interesting to see how law enforcement starts using gathered data to track down origins of attacks. Given a number of identified attacking zombie computers serviced by a several (regulation-complying) ISPs, network forensic detectives will increasingly manage to trace back activities through the event-funnel/layers to the computer of origin. You need not have recorded all intervening links for all zombies ... I'm sure heuristics will be developed to identify with high confidence the computer(s) of origin. A natural rebuttal: "no set of DBs can possibly have stored so much data that they have the full network capture to trace back attacks." SenSage & competing products don't store the full network capture, but just enough info to figure out the temporal/topological aspects of an attack. That still requires many terabytes per telco for several years of data, but the products can crunch that data real fast. Here comes the knock on the door ... you ready?