Exposing IP is dangerous more because the risk of troll stalking of script-kid hacker willing to "make a name"... now that part about FBI and such made me laugh as if they depend on those statistics to "get their man"... or something like this I don't know how to express in your particular jargon or language. You can laugh if you want, but they acutally do use IP information. Official requirements for data retention (dhcp lease/mac/user account) are not there, but unofficially in the industry you will get a heads-up from a law-enforcement agency that they want you to begin retaining records on a particular item (user account, ip, etc.). It is expected that you begin retaining for up to 90 days prior to them actually obtaining a warrant. However, that doesn't apply to DOMSEC (Department of Homeland Security). Under the real-word implementation of the Patriot Act (and all of its unintended consequences) all they have to do is state that they are investigating something that may be related to a terrorist investigation, and they get whatever data they want. They can enter a public library and request the checkout and/or search records for a patron, and the library is prohibited from even telling you they had to hand them over. Same for banking, medical, ISP, etc. DomSec doesn't need a warrant. That reflects a common misapprehension from end users. It is very easy (click of a couple buttons, couple additions to a user account config) to assign a 'DHCP' pool of addresses to a specific user account that will ONLY be handed out to that user account. So a user under investigation does a release/renew or reboots their modem/router and voila, they have a new IP. What they don't realize is that they now have a private pool of say 50 addresses assigned to them. They will be the ONLY account that will get assigned those addresses. So IP address rotation isn't quite as secure as it seems. A number of TOR exit nodes are run by various government agencies. If using TOR you should never allow exit nodes in your ip's country of origin. Actually not entirely true, you should selectively allow exit nodes in your COO depending in your activity. And what does having a password have to do with you being on a router? You seem to have at least a basic understanding of some safe internet practices, but I don't think you really understand the architecture of the internet or how ISPs actually work. And anti-virus/personal security (kapersky, etc) doesn't offer any protection against the initial concern the OP brought up. Depends on why you are mining the data. Yes deriving a specific user back from only the nexus stats would be virtually impossible. However depending on the aggregate amount of data being mined it could certainly add to the confidence level if attempting to determine a specific target IP traffic patterns, habits, behaviors, etc. It all depends on what you want the data for. I agree that the OPs concern about being identified as themselves specifically from the web traffic stats is misplaced, but data is data. And all data tells us something if you know what questions to ask.
