Justice Department Narrows Request For Visitor Logs To Inauguration Protest Website

The Justice Department is dropping the most controversial part of its demand for records relating to a website used to coordinate protests during the presidential inauguration.

In court filings submitted yesterday, ahead of a hearing Thursday in D.C. Superior Court, the government suggests modifications to the warrant it attained for files from web hosting company DreamHost, which hosted the website DisruptJ20.org.

The change in scope was made "in light of factual revelations since July," the filings state.

"The government has no interest in records relating to the 1.3 million IP addresses that are mentioned in DreamHost's numerous press releases and Opposition brief," according to the filings, which were submitted by Assistant U.S. Attorneys Jennifer Kerkhoff and John Borchert.

The Justice Department goes on to say:

"The government values and respects the First Amendment right of all Americans to participate in peaceful political protests and to read protected political expression online. This Warrant has nothing to do with that right. The Warrant is focused on evidence of the planning coordination and participation in a criminal act - that is, a premeditated riot. The First Amendment does not protect violent, criminal conduct such as this."

Last week, DreamHost revealed that the Justice Department had delivered it a warrant asking for "all files" related to DisruptJ20.org, a site the government says was used to organize a riot in downtown Washington, D.C., during the Inauguration. The Justice Department is pursing felony riot charges against nearly 200 people; 19 others have already pleaded guilty.

"This is a tremendous win for DreamHost, its users and the public," DreamHost counsel Raymond Aghaian said in a statement to NPR. "There remains, unfortunately, other privacy and First and Fourth Amendment issues with the search warrant, which we will address in a separate filing and at the hearing Thursday morning."

The DreamHost matter is complex, and not only because it involves Constitutional issues as well as a lot of technical jargon for all parties to wade through.

Among the "particular things to be seized" from DreamHost in the original warrant: HTML, CSS, JavaScript, image files, or other files; HTTP request and error logs; SSH, FTP, or Telnet logs; MySQL, PostgreSQL, or other databases related to the website.

As New York Times reporter Charlie Savage pointed out, Judge Ronald Wertheim, who granted the warrant, is in his eighties. He has been retired since 1992 but still hears cases occasionally.

A different judge, Robert Morin, will oversee tomorrow's hearing.

One of the challenges of criminal investigations involving electronic evidence, the government said, "is that some of the evidence - particularly the full scope of the evidence - will be hidden from the government's view unless and until the government obtains a court order or search warrant."

In its brief, the Justice Department says it simply didn't realize the depth of the information that DreamHost has, which includes" visitor data maintained by DreamHost that extends beyond the government's singular locus in this case of investigating the planning, organization, and participation in the January 20, 2017 riot."

But in earlier filings, the government had been indifferent to DreamHost's objections, when it explained the extent of its data holdings.

DreamHost attorney Raymond Aghaian told the Justice Department in a July 21 email that the warrant for "all files" related to Disruptj20.org "seems overbroad," and would include "the IP addresses of over 1,000,000 visitors to the website."

In a motion filed a week later, the government said Aghaian's concern about the warrant's breadth was "simply not a sufficient basis for DreamHost to refuse to comply with the warrant."

Mark Rumold, senior staff attorney at Electronic Frontier Foundation, which is advising DreamHost, says the government's new, narrower warrant is an improvement — but problems remain.

"The new warrant excludes most visitor logs from the demand, and it also withdraws the demand for unpublished content, like draft blog posts and photos," Rumold says in an email to NPR. "This was a sensible response on DOJ's part—both legally and politically."

"But the new warrant is not without its flaws," he adds. "Most critically, DOJ is still investigating a website that was dedicated to organizing and planning political dissent and protest. That kind of activity — whether online or off — is the cornerstone of the First Amendment, and DOJ's ongoing investigation should be cause for alarm to anyone, no matter your political party or beliefs."

DreamHost's counsel provided NPR with the document below, showing the modifications to the warrant.

Copyright 2017 NPR. To see more, visit http://www.npr.org/.