“Team Cymru, the company ultimately selling this data to the FBI, obtains it from deals with ISPs by offering them threat intelligence in return.”
The FBI’s Cyber Division paid tens of thousands of dollars for two months of netflow data. ISPs trade their customers’ traffic records for threat intelligence, and Team Cymru resells them to the government. It even markets the ability to track traffic through VPNs. No warrant needed when you can just buy it.