Strategies for enforcing/tracking DMCA/Copyright notices in a (semi) medium scale NAT

Hi all,

I assist with running a small (200 users) internet provider that provides internet as a free service as a charity. We do have a bit of community funding, which allows us a 500Mbps symmetric connection, some Fortigate routers, and decent HP switches. However, our ISP is stingy about IP addresses and certainly wouldn't give us as many as we would need to issue public IPs to our users, so we are doing NAT.

This works great, however, more recently we have been receiving DMCA/copyright notices from our ISP. Generally our policy has been to discard these, however, we want to put something in place to ensure we can at least associate the infringement with a particular user, in case enforcement is required.

I'm struggling with how this would be implemented though. On a network where users have WAN IPs, we could inquire against DHCP logs even if the IPs were dynamic to figure out who had an IP at a particular time. In this case, though, the notices do not provide us with enough information to really determine the offender.

The ideas I've had are using DLP with an extensive log (30 days or more?), but I'm struggling with how this would be implemented on the hardware side of things. My experience with Fortigate doesn't really render an obvious solution. Besides the processing capacity required to do this DLP, would it even be useful vs Bittorrent clients that utilize encryption?

I'd be interested in hearing anyone's insight about this. I've done some reading and come up pretty empty.

Thanks to everyone who can shed any light, and to all who contribute here - you have a great community from which I've learned a lot.

Cheers!