Editorial: Justice Department’s overly broad warrant request reined in

A federal judge ruled last week that DreamHost, a Los Angeles Web hosting provider, must provide the U.S. Department of Justice with email addresses and other data records from visitors to a website, Disruptj20.org, that was used to help organize protests against President Trump’s January inauguration.

The ruling, by Judge Robert Morin of the District of Columbia Superior Court, was closely watched by Internet privacy experts. It represents a limited win for the Justice Department — but in some ways, it was also a win for DreamHost, Internet users and everyone who cares about online privacy.

Originally, the Justice Department had obtained a warrant compelling DreamHost to turn over all data and records pertaining to Disruptj20.org, including information about site visitors.

Prosecutors said they were looking for information on people who rioted in Washington, D.C., on Jan. 20, causing hundreds of thousands of dollars’ worth of damage. Almost 200 people have been charged in that case, and 19 have already pleaded guilty.

But DreamHost balked at the government’s request. It contended that the request was so broad that it could result in the exposure of the identities of the 1.3 million people who had visited the site, the vast majority of whom had probably done nothing more serious than look at it.

A public outcry ensued as soon as DreamHost went public with the government’s request. Sixty organizations dedicated to civil liberties and related causes sent Attorney General Jeff Sessions a letter expressing concern about the request and the precedent it could set for others who disagree with the administration.

Lawyers for DreamHost argued that turning over all the records, giving the Justice Department access to information on so many people who were unlikely to be suspects in the riots, but who probably did oppose the Trump administration, was an important test of the First Amendment.

Justice Department prosecutors quietly amended their request in response to the outcry last week, saying they would no longer request unpublished media and IP addresses from the site.

But that wasn’t quite enough for Judge Morin. While he did approve the warrant, he did so with a list of caveats: The data release will only include information from October 2016 until Jan. 20, any information unrelated to the rioting will have to be sealed, and the Justice Department isn’t allowed to share any information with any other government agency.

On its blog, DreamHost cast the decision as a victory for all Internet users: “If we had simply remained silent and handed over the data at the first sign of the warrant, investigators today would be sitting on a pile of information that could be used to track down and identify tens of thousands of individual web users who are themselves accused of no crime.”

DreamHost is still weighing an appeal. For now, it can take heart in the fact that it was right to fight this overly broad request, and the Justice Department was wrong to make it.

This commentary is from The Chronicle’s editorial board. We invite you to express your views in a letter to the editor. Please submit your letter via our online form: SFChronicle.com/letters.

This commentary is from The Chronicle’s editorial board. We invite you to express your views in a letter to the editor. Please submit your letter via our online form: SFChronicle.com/letters.