MS should have traceroutes even for the bad IP cases, since until the ISP responds, MS would not know which is good and which is bad.Lots of questions on where the investigations took place, including states where they VPN'ed or tunneled to or from would provide lots of evidence for those going after them for unlicensed investigation.