A judge in Washington, D.C., has approved a government request to access data from a website used to organize protests against President Trump's inauguration — with the caveat that the Department of Justice must establish "additional protections" to safeguard users' privacy and right to free speech.
The DOJ already had a warrant approved by a judge to search records related to the site DisruptJ20.org, which organized protests on Jan. 20. More than 200 protesters were charged with rioting, and the Justice Department is looking for evidence in some of those cases. But the Web hosting company DreamHost, which holds the records, challenged the government's request, calling it overly broad and saying it threatens privacy and free speech.
D.C. Superior Court Chief Judge Robert Morin told lawyers for the Justice Department that they could proceed with a narrower version of their warrant. But the government needs to develop a plan to "minimize" the exposure of "innocent users," as he put it.
The U.S. government had already scaled back the scope of its request before Thursday's hearing.
The original request would have compelled DreamHost to disclose 1.3 million IP addresses, which could reveal information about visitors to the protest-organizing site, the Web hosting company says.
DreamHost took the Department of Justice to court to challenge the scope of that request. Earlier this week, the government agreed to drop the request for visitor data en masse and also exclude data from after Jan. 20 and unpublished drafts of the website.
DreamHost welcomed that as a victory but still expressed concerns over the revised warrant.
In the hearing on Thursday, lawyers for the Web hosting company highlighted the fact that the warrant still asks for content from all email accounts on the DisruptJ20.org domain. Raymond Aghaian, representing DreamHost, compared that request with searching every apartment in a building with a single search warrant.
DreamHost also objected to the "two-step" process for executing the warrant. That is one way that law enforcement searches for evidence in digital files.
Step one is to acquire a large pool of data, which will include items that have no connection to a criminal case; step two is to filter out the innocuous content and only "seize" the relevant evidence. In the DreamHost matter, for instance, emails about hosting visitors to D.C. might be set aside, but an email arranging to bring crowbars to a protest might be kept. Everything not seized as evidence is then sealed.
"The fact that an FBI agent will be sitting there and actually reviewing the emails and knowing who this person is ... is an issue in and of itself," Aghaian told NPR. Even if a person's data is ultimately never seized, the fact that it was provided to the government in the first place could still have a "chilling effect," he said. For instance, someone who wants to email an advocacy group might decide not to, knowing their email might later be accessible by the government under a search warrant.
The judge said he had to balance two legitimate interests — free speech and law enforcement needs — and ultimately ruled for a two-step warrant process with additional safeguards.
He said the Department of Justice will need to specify in advance which people would have access to the data, describe how they would be filtering or searching through it and present the courts with a detailed list of what they had seized and why.
The Department of Justice would also be barred from sharing the data with anyone else, including other government agencies, and would need to design and present a system to "minimize" the impact on users not charged with crimes. It's not clear what such a system would look like.
In the meantime, DreamHost is supposed to pull all the data together and deliver it to the government; the Department of Justice will agree to not search through the data until they have the go-ahead from the courts.
Lawyers for DreamHost say they are evaluating their options, including the possibility of appeal. The Department of Justice declined to comment on a pending case.
ROBERT SIEGEL, HOST:
Now a court decision in a case that pits president Trump's Justice Department against a web hosting company whose services were used by anti-Trump activists. The company DreamHost challenged the U.S. government over what it saw as an excessive request for information. Well, today a federal judge sided mostly with the government but not entirely. And here to walk us through this case is NPR's Camila Domonoske. Hiya.
CAMILA DOMONOSKE, BYLINE: Hi. How are you?
SIEGEL: This story's a bit complicated, so remind us how it began.
DOMONOSKE: So back before the inauguration, this website disruptj20.org was organizing protests. And then on the day of the inauguration, more than 200 people were arrested, charged with felony rioting. Nearly 200 of those cases are still pending. And the Department of Justice has asked for records relating to that website - lot of data from DreamHost, the company that hosted the website. And they have resisted. They've challenged that in court.
SIEGEL: Yeah. Last week, our co-host Audie Cornish spoke with the CEO of DreamHost, and he said that the company's objection to the warrant wasn't political. So what is the problem with the request?
DOMONOSKE: Well, they had real concerns about privacy and free speech. Initially DreamHost was particularly concerned about the fact that the request from the government would require them to disclose 1.3 million IP addresses. And you could use that information to get some information about the visitors to the website. So they fought that really fiercely. And earlier this week, the Department of Justice decided to narrow its request and no longer seek those visitor logs.
SIEGEL: Why did they agree to do that?
DOMONOSKE: Well, the Department of Justice said that they didn't realize how much information DreamHost had, so they didn't know how much they were asking for. Lawyers for DreamHost are a little skeptical of that explanation. They say that they told the Department of Justice very early on what this meant.
SIEGEL: Well, in that case, what is the issue now?
DOMONOSKE: Well, there's still a lot of data that the government is asking permission to look through, including email accounts associated with the organization. And they're asking for the ability to search through, find what's significant and then basically set the rest of this information aside. Now, lawyers for DreamHost say that's still problematic. I talked to Raymond Aghaian.
RAYMOND AGHAIAN: The fact that an FBI agent will be sitting there and actually reviewing and reading the emails and knowing who this person is is the issue in and of itself.
DOMONOSKE: Basically before they can decide that something's not relevant to a court case, you still have the Department of Justice looking at it. And DreamHost says that that could have a chilling effect on speech.
SIEGEL: And presented with these problems, what did the judge decide?
DOMONOSKE: Basically he said that DreamHost should hand over that big pool of data to the government and let the government search through it to find the evidence that it's looking for. But at the same time, the judge said that there are serious concerns about privacy and free speech. And as a result, the Department of Justice has to come up with some procedures to minimize the exposure of, quote, "innocent users." That's what the judge called them.
We don't know exactly what that would look like. And in the meantime, DreamHost is supposed to hand over all of this data to the government, and the Department of Justice will wait until they've got the go-ahead to actually filter through it. Lawyers for DreamHost are evaluating their options. That includes a possible appeal. The Department of Justice won't comment on a pending case.
SIEGEL: NPR's Camila Domonoske, thanks.
DOMONOSKE: Thank you. Transcript provided by NPR, Copyright NPR.