It looks to me like the webserver this site is hosted on is in L.A somewhere. If the Feds wanted to they could get a warrant to raid the webhosting company and confiscate the server.
That would give them access to the webserver log files and through a fairly difficult process they could filter through the connections and HTTP requests to build a list of those that posted data on this website.
That said, that is probably not how they would do it. Most E-Crimes labs are horribly undermanned and completely overworked. That is why the Feds do not do it that way unless the webserver is hosted at a private address.
The way they would do it is either serve a warrant on the hosting company to supply a full account of all incoming and outgoing between x.x.x date to x.x.x date to
www.xyz.com website which is hosted on one of their reseller servers.
The hosting company would then have to assign an engineer to troll through and compile a detailed report.
The other way is as an interception warrant where the Feds can serve one on a web hosting company and have them assign an engineer to compile data based around a set of parameters. Interception warrants are more about focussing on certain individuals activities rather than an en mass approach of the search warrant.
The problem with that is collateral damage. Generally more people get caught up in those types of warrants than the ones being focussed on.
Last year in this country the Secret Intelligence Service issued search warrants for certain individuals they thought were participating in a terrorist group on a website that is this countrys version of EBay.
It resulted in the records and personal details of 10,000 users being caught up in the mix, when the warrants were only for something like 8 people.
In general though, if they are after individuals then they already know where they stay, therefore would already have an interception warrant logging all their incoming and outgoing from their home connections at the users internet service provider (ISP), therefore also intercepting data at the webserver end would just be icing on their cake.
Now, how to the Feds make the connection between you connecting to this site and making a post, and the actual details of your post, which the webserver logs do not save. The weblogging systems save the IP address, the action committed i.e. you posted something, the timestamp, the browser type you used, what page if any you were on previous (the referer).
What is doesnt collect is what you send through in your post. That is collected at the database and stored along with a hash code of your IP Address.
So with a copy of the confiscated database tables and content, and a copy of the log file pertaining to this site they could possibly track users to IP addresses and to what they posted.
So ways to make this more difficult.
Prevention before any type of interception is the best policy.
- For the user of this site, if you live in the USA you can use an anonymous proxy from outside the US. That way the IP stored in the webservers database is from a server outside the USA.
- To protect the data on the database, the web admin of this site would have to hack into the script and edit it not to collect IP addresses. That way there is no correlation between server logs and database post logs.
- To protect the users whose connections could be being monitored at their ISP as a part of a sting, the web admin would have to install an SSL certificate so that there is an encrypted connection between your web browser and the Rollitup webserver. Much like what happens when you log into your web banking.
The first option is one anyone can do. There are a myriad of websites on the net offering free anonymous proxys. You can download free proxy testers to make sure the one you choose to use is really anonymous. For people outside the USA I wouldnt worry too much about that anyways.
The next option could be a simple change in code or it could be quite difficult. That is up to the web admins to do.
The third option costs money. SSL certificates are like at least USD$100 a year, not cheap, they also can cause the server load to increase and have to be carefully used so as not to do that. I can understand if the web admins here don't install one for those reasons. They could also be targetted as a grudge match by the Feds for nullifying a technique the Feds thought was bullet proof (ISP side interceptions).