Just read the affidavit and the way it played out in that case was this:With all due respect, an IP address can also be assigned to your wireless router, and multiple devices can be logged on simultaneously. MAC addresses are assigned to individual devices, but they ARE accessible, by google, and LE.
There is a current case involving the FBI regarding this subject. However the redacted affidavit contains such disturbing details, I can't link it. The complaintant was able to enlist the FBI's help after receiving these messages on a social networking site - and the MAC address was traced.
Besides, with a subpoena, and the inherent make-up of the OSI model, this makes sense. You'd be surprised how much data and metadata are stored, ESPECIALLY by google, aka "Scroogled."
Do a search on "badgerherald.com FBI Special Agent Malia Pereira Ragsdale" if you want to find the affidavit PDF.
- They got the IP address from ask.com, where the threat was posted
- They traced that IP address down to a block owned by the University and contacted the administrative contact for that CIDR block
- The university traced their logs and crossreferenced it to a university user account that was using that IP at the same time
- LE used this to obtain a search warrant for his premesis
Regarding the OSI model, MAC is at layer 2 (data link) and IP is at layer 3 (network). Servers do receive a MAC address as part of every frame, but it will be the MAC address of the last router that passed the packet. In the above case ask.com wouldn't have been able to give the MAC address, but they led LE to the university who could, because the student was behind the campus network router.
I suspect LE worked Relisha's case through the same method as above: They first asked Google for the IP addresses used by Kahlil, found out who was responsible for administering those blocks, then contacted them and made a request for their logs. Google will not be able to give LE any of Kahlil Tatum's MAC addresses (though they may have them from finding devices in the home search), but it tells them who else to ask for MAC addresses. They would very likely not need a warrant to follow up with a hotel or internet cafe, because these places are much more cooperative with LE/the government than Google.
I wouldn't be surprised to find out that the reason they got some of this hotel footage was because logs from Google led them to various hotels, which they then asked for evidence.