Every TCP/IP packet has a MAC address for the sending device and the next receiving device. I say sending device, rather than just sender, as the MAC address may not be the original sender's MAC address. Every time a packet is received by a device in the chain where it is going the old MAC addresses are stripped from the packet. The device that just received it becomes the sending MAC and the device that is the next hop in the chain to where it is going becomes the destination MAC. The MAC addresses have to change at each hop for them to forward them to the next device along the chain to destination.

Theoretically, you could encrypt a MAC address, but all it would mean is that your packet would go nowhere as your own computer wouldn't even know where to send it. Even when using WEP/WPA/WPA2 the MAC addresses between the devices must be clear text. There is simply no way around that. It does mean that the idea that they just intercepted public signals is entirely accurate if all they did was determine MAC addresses as they are transmitted in the clear with no active attack needed. Heck, every time I open my wifi manager I see the MAC addresses for all neighbours within 500m.

My big question is why is someone's MAC important? I can't see it being a very useful piece of evidence. It isn't end-to-end like IP addresses so I can't see anyway it could be used to track him down. His own ISP probably doesn't even know it since they'll just see the MAC address of the modem he connects through. They are also notoriously easy to change at a seconds notice.