Seems like it was fly.io, since they got the user IP from there and it would make sense they would have the session logs.
Cloud equals not your computer, folks. Any cloud company can be legally subpoenaed and required to hand over any data they have, and they can also be legally gagged from telling anyone about it. Doesn't matter if they support it or not, they are a corporation subject to the laws of their jurisdiction and disobeying can expose the directors personally to civil or criminal penalties. Every corp will comply with a legal subpoena, and those are often easier to get than warrants.
For you they at least require a warrant. Usually. Unless you're crossing the border or are undocumented or something.
indeed, the actual case report (https://www.documentcloud.org/documents/28831278-govuscourts...) states:
"technical and network-activity records from fly.io included:
SSH session logs (CSV format) listing multiple "New SSH session" entries for <redacted> with verified=true between approximately 2026-03-26 and 2026-04-01, timestamped in UTC.
outbound-connection records (CSV format) reflecting numerous TCP port 443 connections originating from internal fly.io addresses <redacted> to external IP addresses attributed to AMAZON-02 (Amazon Web Services) in the US and Cloudflarenet (Cloudflare)".
Tech companies used to demand warrants/subpoenas for these kinds of things. Now it seems they just gladly hand it over with a wide smile on their face. Am I the only one to notice this shift?