What if you had a security vulnerability on a server which contains a record of NSL's/subpoenas (for administration purposes), which is conveniently exposed on the internet. A customer could "hack" your server, and obtain the information, thus it isn't the ISP's fault - in fact, the isp claims no knowledge of this vulnerability at all.