So, it was very easy to search the logs and see who was using an IP at a given time in the past (assuming we still had the logs).
Except the ISP had forgotten to take into account daylight savings time and given the police the wrong customer's details. Oops.
More proof dates aren't easy.
(1) Unambiguous: a time in the past that is represented by the number of seconds since the epoch, Jan 1 1970. When coupled with a location/jurisdiction, they can be converted into a wall-clock time like “1:23pm 04 May 2006 Europe/Paris.”
(2) Ambiguous (but semantically meaningful): a time in the future that would be shown on a clock at the location of the event.
The logging of IP addresses would use the former.
The upcoming trial date for illegal torrenting would use the latter.
1 hour should be plenty to identify who is currently running some network attack, and arguably an ISP doesn't have a legit reason for keeping private data longer than necessary to be an ISP under the GDPR .