DreamHost Wins Challenge Against DOJ's Overbroad Data Demands

from the the-Man-briefly-experiences-having-it-stuck-to-him dept

DreamHost has been fighting the DOJ and its breathtakingly-broad demand for information on all visitors to an anti-Trump website. This has gone on for a few months now, but the origin of the DOJ's interest in the DreamHosted disruptj20.org site traces all the way back to protests during Trump's inauguration.

Here's what the DOJ demanded DreamHost hand over:

a. all records or other information pertaining to that account or identifier, including all files, databases, and database records stored by DreamHost in relation to that account or identifier;

b. all information in the possession of DreamHost that might identify the subscribers related to those accounts or identifiers, including names, addresses, telephone numbers and other identifiers, e-mail addresses, business information, the length of service (including start date), means and source of payment for services (including any credit card or bank account number), and information about any domain name registration;

c. all records pertaining to the types of service utilized by the user,

d. all records pertaining to communications between DreamHost and any person regarding the account or identifier, including contacts with support services and records of actions taken.

These demands conceivably applied to every single one of the site's 1.2 million visitors. The DOJ scaled back some of its demands a week later, but also stated its attempt to "converse" (read: talk DreamHost into compliance) had been rebuffed, with the hosting company stating its desire to continue challenging the subpoena.

This demand for information would be in addition to a warrant it served to Facebook, seeking everything ever from the accounts of more than 6,000 users. This was served to Facebook, along with a gag order -- something the DOJ conveniently dropped the night before oral arguments, perhaps sensing it might be in for an unfavorable precedential ruling.

Chief Judge Morin of the DC Superior Court has issued a ruling on the DreamHost-targeting subpoena, and it's good news for everyone but the overreaching DOJ. DreamHost reports on the judge's order:

Under this order, we now have the ability to redact all identifying information and protect the identities of users who interacted with disruptj20.org before handing over any data to the court.

[...]

We are now required to hand over a drastically reduced amount of data to the government and will redact any identifying information from every scrap of it that relates to non-subscribers.

On top of that, the DOJ will have to submit search protocols and procedures to the court for approval before demanding further site visitor info and limit its requests to info it can show the court is linked to actual criminal activity (violations of DC's rioting statutes). The DC Superior Court will make final determinations on the validity of the government's data requests before any identifying information is released by DreamHost.

As the court notes in its order [PDF], it's not interested in assisting the government with its fishing expeditions.

Because of the potential breadth of the government's review in this case, the Warrant in its execution may implicate otherwise innocuous and constitutionally protected activity. As the Court has previously stated, while the government has the right to execute its Warrant, it does not have the right to rummage through the information contained on DreamHost's website and discover the identity of, or access communications by, individuals not participating in alleged criminal activity, particularly those persons who were engaging in protected First Amendment activities.

And this still may not be the end of the DOJ's problems. Even if revised info demands are approved by the court, there are still a handful of potential investigation targets (site visitors and owners) readying their own challenges of the government's data requests. At this point, site visitors who've already attempted to challenge the subpoena obviously don't know if they're actually targeted by the DOJ. The court has dismissed their appeals without prejudice, which will allow them to refile if they make the government's final cut.

This is good news for everyone who avails themselves of third-party services (which is pretty much everybody). A little pushback sometimes goes a long way. Anyone seeking to keep their private info private should be taking note on who's willing to challenge the government's overreach and who's willing to act as little more than a data broker for law enforcement agencies.

Filed Under: disruptj20, doj, fishing expedition, inauguration, privacy, protests
Companies: dreamhost

DOJ Walks Back Its Demands For Info On Everyone Who Visited A Trump Protest Site As Some Of Those Visitors Protest Subpoena

from the oops,-didn't-mean-such-blanket-surveillance dept

Last week we wrote about a crazy warrant from the DOJ, effectively demanding information -- possibly identifying information -- on everyone who visited the site disruptj20.org, which had been used by people organizing protests of Trump's inauguration. When we wrote about it, the site's hosting company, DreamHost, had just announced that it was pushing back on the demand in court. On Monday of this week, some of the visitors to the site pushed back too. Public Citizen Litigation Group took on the case of five individuals who had visited the site, asking the court if they could intervene to oppose the warrant.

As Paul Levy, who wrote the briefs, noted in the accompanying blog post, there's a legitimate fear of our President creating an "Enemies List."

Although a warrant this broad would be disturbing in any administration, Internet users have every reason to be concerned in an administration led by a President who has shown intense intolerance for disagreement and a tendency to lash out with raw language and threats directed at political adversaries, and who has urged his supporters to attack protesters. The listing of all those who visited or interacted in any way with this web site could easily form the beginning of an “Enemies List” that would put Richard Nixon to shame.

Our clients in the intervention are five anonymous Internet users who viewed the web site, either to learn more about the protests, to coordinate their own protest activities; one of our clients was also a journalist whose reasons for visiting the site included reporting remotely on the protests. The Does object to allowing federal prosecutors to put their names on a list of potential enemies of the Trump Administration who are to be visited by FBI agents or hauled in for questioning by federal prosecutors. Our argument is based on the First Amendment right to read anonymously — analogous to the right to speak anonymously that we have litigated in many other cases; that right is now broadly accepted as a basis to refuse to enforce discovery to identify online speakers without evidence that the speakers have done something wrong.  The right to read anonymously has been addressed less often, but in drafting our papers on very short notice we were able to draw on an amicus brief we had filed ten years ago in the Maryland Court of Appeals.

However, just a day after those filings, the DOJ itself admitted that perhaps the warrant was a step or two too far and has responded to DreamHost, admitting that the original warrant was too broad and asking to modify the warrant to make it more narrow. The DOJ insists that it is just looking for actual criminal behavior, not building a list of Trump haters.

The Warrant--like the criminal investigation--is singularly focused on criminal activity. It will not be used for any other purpose. Contrary to DreamHost's claims, the Warrant was not intended to be used, and will not be used, to "identify the political dissidents of the current administration[.]"... Nor will it be used to "chill[ ] free association and the right of free speech afforded by the Constitution." In fact, as discussed further below, after conducting a careful search and seizing the evidence within the scope of the Warrant, law enforcement will set aside any information that was produced by DreamHost but is outside the scope of the Warrant; it will seal that information; and it will not revisit that information without a further court order.

The DOJ then suggests that part of the problem was that it didn't quite realize just how much info DreamHost might have had on visitors to this site, and thus it didn't realize that it was actually requesting so much:

The government is acutely aware that criminal investigations involving electronic evidence present unique challenges. One of those challenges is that some of the evidence -- particularly the full scope of the evidence -- will be hidden from the government's view unless and until the government obtains a court order or search warrant. That is an important part of the history in this case because much of DreamHost's challenge to the Warrant is based on information that was not known (and would not reasonably have been known) to the government when the Warrant was applied for and obtained. What the government did not know when it obtained the Warrant -- what it could not have reasonably known -- was the extent of visitor data maintained by DreamHost that extends beyond the government's singular focus in this case of investigating the planning, organization, and participation in the January 20, 2017 riot. The government has no interest in records relating to the 1.3 million lP addresses that are mentioned in DreamHost's numerous press releases and Opposition brief. The government's investigation is focused on the violence discussed in the Affidavit.

And, to make that even more clear, it agrees to amend the warrant:

Consistent with that focus, the government is asking this Court to enter a new Attachment B to the Warrant, and remains committed to minimizing the information that is ultimately seized for the government's criminal investigation.

While I imagine many people won't be willing to give the DOJ the benefit of the doubt here, I think it's entirely possible (and even likely) that the request for so much info was due to confusion and bumbling agents, rather than a nefarious plan to build an enemies list. I still think that there are serious concerns to be had about the warrant -- and it sounds like DreamHost still isn't comfortable with things either:

Notably, the government has attempted to have a dialogue with DreamHost about these matters. Regrettably, those attempts have proven unproductive because DreamHost maintains that the Warrant is improper and that the Court lacks jurisdiction to issue the Warrant... As recently as this past week, DreamHost told the government that it would provide no information about the Website without further legal process and--somewhat incompatibly--told the government that DreamHost would only discuss limiting the production of information called for by the Wanant if the government first withdrew the Warrant in its entirety

You can see the amended warrant at the end of the DOJ's filing. It still feels like a fishing expedition, but it's clearly not nearly as broad as before, where it may have included basically all IP addresses of anyone visiting the site.

Filed Under: 4th amendment, disruptj20, doj, donald trump, fishing expedition, warrant
Companies: dreamhost

DOJ Goes Way Overboard: Demands All Info On Visitors Of Anti-Trump Site

from the the-doj-going-too-far?-what-a-surprise dept

Not all search warrants are bad. Indeed, most of them are perfectly legitimate, and meet the qualifications under the 4th Amendment that there is probable cause of a crime being committed, and the warrant is narrowly tailored to seek out evidence to support that. But... not always. As Ken "Popehat" White explains in a recent blog post, the Justice Department has somehow obtained the mother-of-all bad search warrants while trying to track down people who were involved in protests of Donald Trump's inauguration back in January. The government has brought felony charges against a bunch of protestors from the inauguration, and now it appears the DOJ is going on a big fishing expedition.

As Ken notes, it's quite likely that some protestors committed crimes, for which they can be charged, but prosecutors in the case have decided to go ridiculously overbroad in trying to get any info they can find on protestors. They got a search warrant for the well known hosting company DreamHost, which hosts the site disruptj20.org (as an aside, the fact that a site like that doesn't default to HTTPS for all connections is really, really unfortunate, especially given the rest of this article). The warrant basically demands everything that DreamHost could possibly have on anyone who did anything on disruptj20, including just visiting. As White notes in his post, it's not that unreasonable that the DOJ sought to find out who ran the site, but now they're requesting basically everything, which likely includes the IP addresses of all visitors:

a. all records or other information pertaining to that account or identifier, including all files, databases, and database records stored by DreamHost in relation to that account or identifier;
b. all information in the possession of DreamHost that might identify the subscribers related to those accounts or identifiers, including names, addresses, telephone numbers and other identifiers, e-mail addresses, business information, the length of service (including start date), means and source of payment for services (including any credit card or bank account number), and information about any domain name registration;
c. all records pertaining to the types of service utilized by the user,
d. all records pertaining to communications between DreamHost and any person regarding the account or identifier, including contacts with support services and records of actions taken.

DreamHost, quite reasonably, found this to be somewhat overbroad and refused to immediately reply, instead having a lawyer ask the DOJ to clarify the request, while making it clear it felt the warrant was likely both vague and overlybroad. The DOJ then asked the court to compel the company to hand over the info, insisting there is "no legal basis for failing to produce" the requested information. DreamHost has now responded in court, saying that the warrant violates the 4th Amendment and appears to endanger the 1st Amendment rights of protestors. They also claim that it violates the Privacy Protection Act and that there are some jurisdictional issues with it as well. DreamHost also has a nice blog post about the whole thing:

This is, in our opinion, a strong example of investigatory overreach and a clear abuse of government authority.

Or, as the filing notes:

Where a search warrant endangers First Amendment interests, the warrant must be scrutinized with “particular exactitude” under the Fourth Amendment. See Zurcher v. Stanford Daily, 436 U.S. 547, 565 (1978). “The First Amendment is often inconvenient. But that is beside the point. Inconvenience does not absolve the government of its obligation to tolerate speech.” Int’l Soc’y for Krishna Consciousness, Inc. v. Lee, 505 U.S. 672, 701 (1992) (Kennedy, J., concurring). The government’s search warrant (“Search Warrant”) here requires non-party DreamHost, LLC (“DreamHost”) to turn over every piece of information it has about every visitor to a website expressing political views concerning the current administration. This information includes the IP address for the visitor, the website pages viewed by the visitor, even a detailed description of software running in the visitor’s computer. In essence, the Search Warrant not only aims to identify the political dissidents of the current administration, but attempts to identify and understand what content each of these dissidents viewed on the website. The Search Warrant also includes a demand that DreamHost disclose the content of all e-mail inquiries and comments submitted from numerous private e-mail accounts and prompted by the website, all through a single sweeping warrant.

The Search Warrant cannot survive scrutiny under the heightened particular exactitude standard required by the presence of the First Amendment issues. It fails to identify with the required particularity what will be seized by the government. It also fails to provide DreamHost with any assurance that the government will return or destroy the large portion of the information irrelevant to the government’s criminal case or cases. These features render the Search Warrant unreasonable under the Fourth Amendment. In addition, the Search Warrant violates the privacy protections of the Privacy Protection Act, a statute enacted specifically to address such instances, and is without a jurisdictional basis.

As Ken White points out, this fishing expedition by the DOJ should concern us all:

The Department of Justice isn't just seeking communications by the defendants in its case. It's seeking the records of every single contact with the site — the IP address and other details of every American opposed enough to Trump to visit the site and explore political activism. It seeks the communications with and through the site of everyone who visited and commented, whether or not that communication is part of a crime or just political expression about the President of the United States. The government has made no effort whatsoever to limit the warrant to actual evidence of any particular crime. If you visited the site, if you left a message, they want to know who and where you are — whether or not you did anything but watch TV on inauguration day. This is chilling, particularly when it comes from an administration that has expressed so much overt hostility to protesters, so relentlessly conflated all protesters with those who break the law, and so deliberately framed America as being at war with the administration's domestic enemies.

Of course, the DOJ overreaching is nothing new. We just spent eight years highlighting DOJ overreach during the Obama administration (and another eight of overreach under the Bush administration). But it is particularly scary to see just how far this overreach is and that it's coming from an administration that has shown itself to be significantly less tolerant of the First Amendment rights of protestors than basically any predecessor.

Filed Under: 4th amendment, disruptj20, doj, donald trump, fishing expedition, inauguration, warrant
Companies: dreamhost