Naked Security Naked Security

Judge scales back data demand on inauguration riot-related web host

DreamHost says the narrowing of scope is a 'huge win' for online privacy

The US government really, really wants to know about the people who planned protests on the day of Donald Trump’s inauguration as president in January. Now, after a legal tug-of-war and dialing back its demands, it won victory, though the judge’s go-ahead has shaved its demands back further still.

On July 17, the government had served the far-reaching search warrant (PDF) on DreamHost. That’s the hosting company used by disruptj20.org: a site that helped co-ordinate the Inauguration Day protest.

This week, for reasons it didn’t make clear, the government sharply dialed down its demands. DreamHost in essence said, “Well, that’s what we were after from the get-go,” (though it still has First and Fourth Amendment problems with the warrant), and a Washington DC judge on Thursday approved the warrant…

…with yet more restrictions on the data demand, mind you. As Reuters reports, Chief Judge Robert Morin, who will oversee review of the data, said the government has to specify what protocols will be put place to keep prosecutors from seizing the data of “innocent users”.

As we reported last week, DreamHost initially refused to comply with the warrant — compliance that, it said, would involve handing over the IP addresses of 1.3m visitors to the site, their contact information, their email content, and photos of thousands of people, all “in an effort to determine who simply visited the website”.

In its opposition motion (PDF), DreamHost said the warrant’s breadth violated the Fourth Amendment because it failed to describe with “particularity” the items to be seized. Asking for “all records or other information” pertaining to the site, including “all files, databases and database records” is far too broad, the company said. Complying with the warrant would also have First Amendment implications, given that it would give the government information on protesters and thus might lead to a chilling of free speech and association, DreamHost argued.

On Inauguration day, some rioters were armed with hammers, crow bars, wooden sticks and other weapons. Says the government, they

… moved as a cohesive unit for approximately thirty (30) minutes, traveling more than a dozen city blocks, as individual participants engaged in violence and destruction that caused hundreds of thousands of dollars’ worth of property damage and left civilians and officers injured.

According to the Washington Post, the cost of damage was actually in the tens of thousands. Six police officers were injured. More to the point, it was violent, people got hurt, and, understandably, the government wants to find those responsible.

Nineteen guilty pleas have resulted from the ongoing criminal investigation, and 200 charges are pending.

Well, we don’t know precisely what coffee the Department of Justice woke up and smelled, but on Tuesday, it filed a reply brief in response to DreamHost’s challenge to the search warrant, in which it walked back its information demand.

In its reply, the government said that yes, of course it respects Americans’ First Amendment rights to protest – peacefully – and to read “protected” political expression online. Online expression that the First Amendment doesn’t protect:

  1. Obscenity
  2. Fighting words
  3. Defamation (including libel and slander)
  4. Child pornography
  5. Perjury
  6. Blackmail
  7. Incitement to imminent lawless action
  8. True threats
  9. Solicitations to commit crimes

The warrant is specifically looking to sniff out evidence of incitement to break the law or solicitations to commit the crime of rioting, the DOJ said in the reply brief.

The Warrant is focused on evidence of the planning, coordination and participation in a criminal act that is, a premeditated riot. The First Amendment does not protect violent, criminal conduct such as this.

The DOJ insisted that there was nothing wrong with the warrant, which covered emails between the site’s organizers and people interested in attending the protests, any deleted messages and files, subscriber information including names and addresses, and even unpublished photos and blog posts.

Without giving detail, the DOJ said that since the warrant was issued in July, it’s come into possession of new facts. It still wants pretty much all the information it initially requested with the search warrant, but in the reply brief, it promised to carve out and set aside information outside of the warrant, to seal it, and to leave it be, barring any future court order to the contrary.

It’s not going to identify political dissidents. Nor is it going to use the DreamHost data to chill free association or speech, the DOJ says, taking a jab at how vociferous DreamHost has been about its refusal to comply:

The Warrant… is singularly focused on criminal activity…

The government has no interest in records relating to the 1.3m IP addresses that are mentioned in DreamHost’s numerous press releases and Opposition brief.

The government submitted an amended list of what it wants to seize. Basically, it still wants everything, it said: it just planned to ignore whatever’s not related to criminal rioting. That means excluding the following from its original records request:

  • Any unpublished media, including both text and photographs that may appear in blog posts that were drafted but never made public.
  • Any HTTP access and error logs, meaning that “visitors’ IP addresses are largely safe,” DreamHost said on Tuesday.

At a hearing on Thursday, Morin acknowledged the tension between free speech rights and law enforcement’s need to search digital records for evidence. His order granting the government’s request for information therefore contains more safeguards than those the government had suggested. Besides requiring details on the protocols to protect innocent disruptj20 visitors, he also curtailed the time frame for records to those generated from October to Inauguration Day. The original scope of records demanded was from July 1 2016 to Inauguration Day on January 20.

Morin also instructed the prosecutors to explain exactly why anything they want to seize is relevant to the investigation.

After the government’s reply brief had scaled back data demands earlier in the week, DreamHost said that it saw the narrowing of scope as a “huge win” for internet privacy.

We absolutely appreciate the DOJ’s willingness to look at and reconsider both the scope and the depth of their original request for records. That’s all we asked them to do in the first place, honestly.

It may be a huge win, but it’s not a perfect win. DreamHost planned to submit filings to address outstanding First and Fourth Amendment issues at the Thursday hearing.

Reuters quoted Raymond Aghaian, DreamHost’s lawyer, following Morin’s addition of more privacy safeguards:

It’s a tremendous step in terms of further limiting what the government can do.

It’s not all sunshine and roses yet, though, Aghaian said: the company still has concerns about the chilling effect of data being turned over for government review and is considering an appeal, Reuters reports.