SparkFun Gets A Subpoena

Can you fail PCI compliance if you're able and do this? What if you use a third party system such as Stripe where you have no access to the full credit card number?

I understand where you're coming from, but think it's entirely ungrounded in this case. We actively work with the DHS on export control. There is a very real risk involved in selling the products we do, but I don't think that should stop us from our goal of education and - right there at the bottom of every page on our site - sharing ingenuity.

Nope. The subpoena is in the public record. The data SparkFun sent in response to the subpoena is not in the public record. It will just go to the investigators who are trying to track down the credit card thieves.

If the investigation leads to someone being charged with a crime, and that leads to a trial, the proceedings of that trial will be in the public record, but there would be no reason for the information for the customers NOT charged with the crime to be entered into the record at that trial.

I doubt that anyone will be harassed over this, unless we use a very loose definition of harassment. Most likely the investigators will take the list of customers, look up these people to see if any of them have a record of prior criminal activity, and concentrate on those.

If they do question the rest, mostly likely the investigators will simply ask them what they purchased the board for. The customer will then enthusiastically launch into a description of the neat gadget they built and insist on showing it to the investigator and explaining in excruciating detail exactly how it works. The investigator will see the SparkFun board, see that the device is obviously not a credit card scanner, and try to figure out how to escape the enthusiastic hobbyist without being rude to him.

Or other things. Was someone who's name was on the list seen hanging around the places where the skimmers were installed lots? Was the money being sent (however roundabouty) to anyone on the list? etc.

https://en.wikipedia.org/wiki/Telecommunications_data_retent... (concerns telcos, e-mail hosts, and web-hosts)

The USA doesn't have a law like that, but it doesn't have a right to privacy either (there is a law about the privacy of correspondence that the NSA and telcos have ignored), so this sort of data retention law is sidestepped by a few large actors “voluntarily” collecting and sharing information. National security letters, gag orders, and whatever power incited AT&T to first do large scale warrantless interception mean that there can be a lot of abuse with little consequences for the participants. This might also apply to smaller actors, although less publicised (I don't know if there's any bad publicity the US government would care about). If you collect it, you might end up sharing it.