He states that only two things are recorded - the time you start using the service, and the time you stop.
I assume the FBI pieced that crime together based on this data. I honestly don't know much more than that, or what he has been up to in the past 2 years. I just know him from previously doing work for him, and thought I could give some insight to who he is and what he's like.
Three things would have to be recorded in that case: the "you" part of the start & stop times, as well as the times themselves.
I'll take your word for it that he's a decent person. I certainly have no reason to think otherwise. But that doesn't change that his service is recording information that it ought not to be.
The way you typically record this is start time, end time, and IP assigned. It's still not enough to identify what sites or traffic was visited, but when you get a spam email forwarded to you by your upstream provider, it's enough to identify a customer.
I assume the FBI pieced that crime together based on this data. I honestly don't know much more than that, or what he has been up to in the past 2 years. I just know him from previously doing work for him, and thought I could give some insight to who he is and what he's like.