US Hosting Firm Hails ‘Win’ On Protest Site User Data

US web hosting company Dreamhost said it plans to comply with a US court order to provide information on users of a protest website after the Justice Department reduced the scope of its warrant and the court applied further limitations.

Dreamhost said the outcome was a victory that protected internet users from over-broad federal search warrants while the Electronic Frontier Foundation (EFF), which advised the firm, said the case demonstrated the need for government searches to be narrowly limited in advance.

Disruptive protests

The website in question, disruptj20.org, was used to organise protests on 20 January of this year, presidential inauguration day. The Justice Department has prosecuted hundreds of people it says were involved in violence that occurred at the protests.

The department initially approached Dreamhost shortly after inauguration day for information on the protest site and the firm provided it with “limited customer information” about the site’s owner.

The government returned in July with a much broader warrant demanding every piece of information related to the site, which would have included the IP addresses of 1.3 million visitors, the date and time of the visits and what browser and operating system was used.

Dreamhost challenged that warrant and amidst the ensuing publicity officials narrowed the request to include only the site’s registered users. In court last week the department argued it needed the records to establish how the website was used “to organize, to plan, and to effect a criminal act — that is, a riot”.

However, as the EFF noted, the government has never indicated any of the site’s users were “accused of a specific crime” during the protest – it’s taking the approach of “overseizure of digital information followed by a search of the information for evidence responsive to the warrant”.

Dreamhost argued that meant “many users could find themselves, and their actions online, caught up in an investigation in which they were not the targets”.

In response chief judge Morin of the Superior Court of Washington DC placed further restrictions on how the data could be used.

The Justice Department must present it with a “minimisation plan” giving the names of all those who are to have access to the data and the methods used to gather information from it.

Court oversight

The search will also be overseen by the court, which will evaluate whether the data acquired is covered by the warrant. If it isn’t the court will seal the data and the government will require a court order to access it. The court said even the data found to be covered by the warrant can’t be shared with other government departments.

“The de-scoping of the original warrant, combined with the court’s additional restrictions on the use of, and access to, that data, is a clear victory for user privacy,” Dreamhost said in a blog post.

Dreamhost said it plans to hand the data over to the court, but said it is “considering an appeal” that could temporarily or permanently deny the government access to it.

The EFF, for its part, pointed out that the warrant still involves “overseizure” and argued it would be better for such searches to be “limited in advance”. That could involve the use of a neutral third party who would search the data and hand the information found to be covered by the warrant over to justice officials, the EFF said.

“This is an important step in ensuring judicial oversight of the government’s digital search,” the EFF said in a statement.

The Justice Department didn’t immediately respond to a request for comment.

Do you know all about security in 2017? Try our quiz!