DreamHost Wins Challenge Against DOJ's Overbroad Data Demands

DreamHost has been fighting the DOJ and its breathtakingly-broad demand for information on all visitors to an anti-Trump website. This has gone on for a few months now, but the origin of the DOJ's interest in the DreamHosted disruptj20.org site traces all the way back to protests during Trump's inauguration.

Here's what the DOJ demanded DreamHost hand over:

a. all records or other information pertaining to that account or identifier, including all files, databases, and database records stored by DreamHost in relation to that account or identifier;

b. all information in the possession of DreamHost that might identify the subscribers related to those accounts or identifiers, including names, addresses, telephone numbers and other identifiers, e-mail addresses, business information, the length of service (including start date), means and source of payment for services (including any credit card or bank account number), and information about any domain name registration;

c. all records pertaining to the types of service utilized by the user,

d. all records pertaining to communications between DreamHost and any person regarding the account or identifier, including contacts with support services and records of actions taken.

These demands conceivably applied to every single one of the site's 1.2 million visitors. The DOJ scaled back some of its demands a week later, but also stated its attempt to "converse" (read: talk DreamHost into compliance) had been rebuffed, with the hosting company stating its desire to continue challenging the subpoena.

This demand for information would be in addition to a warrant it served to Facebook, seeking everything ever from the accounts of more than 6,000 users. This was served to Facebook, along with a gag order -- something the DOJ conveniently dropped the night before oral arguments, perhaps sensing it might be in for an unfavorable precedential ruling.

Chief Judge Morin of the DC Superior Court has issued a ruling on the DreamHost-targeting subpoena, and it's good news for everyone but the overreaching DOJ. DreamHost reports on the judge's order:

Under this order, we now have the ability to redact all identifying information and protect the identities of users who interacted with disruptj20.org before handing over any data to the court.

[...]

We are now required to hand over a drastically reduced amount of data to the government and will redact any identifying information from every scrap of it that relates to non-subscribers.

On top of that, the DOJ will have to submit search protocols and procedures to the court for approval before demanding further site visitor info and limit its requests to info it can show the court is linked to actual criminal activity (violations of DC's rioting statutes). The DC Superior Court will make final determinations on the validity of the government's data requests before any identifying information is released by DreamHost.

As the court notes in its order [PDF], it's not interested in assisting the government with its fishing expeditions.

Because of the potential breadth of the government's review in this case, the Warrant in its execution may implicate otherwise innocuous and constitutionally protected activity. As the Court has previously stated, while the government has the right to execute its Warrant, it does not have the right to rummage through the information contained on DreamHost's website and discover the identity of, or access communications by, individuals not participating in alleged criminal activity, particularly those persons who were engaging in protected First Amendment activities.

And this still may not be the end of the DOJ's problems. Even if revised info demands are approved by the court, there are still a handful of potential investigation targets (site visitors and owners) readying their own challenges of the government's data requests. At this point, site visitors who've already attempted to challenge the subpoena obviously don't know if they're actually targeted by the DOJ. The court has dismissed their appeals without prejudice, which will allow them to refile if they make the government's final cut.

This is good news for everyone who avails themselves of third-party services (which is pretty much everybody). A little pushback sometimes goes a long way. Anyone seeking to keep their private info private should be taking note on who's willing to challenge the government's overreach and who's willing to act as little more than a data broker for law enforcement agencies.