After a US court issued a warrant ordering DreamHost to turn over millions of IP addresses, the web-hosting service claims a reduction in the scope of the ruling is a massive win for everyone on the internet.
In the months leading up to President Donald Trump’s inauguration on 20 January 2017, millions visited the website disruptj20.org. The website's aim, it says, is to "provide the framework needed for mass protests to shut down the inauguration of Donald Trump." Many, including student groups, used the website to find and spread information about the upcoming protests.
Among the largely peaceful demonstrations, a small number of the protesters are alleged to have caused wilful damage to private property, and behaved violently towards law enforcement officers. This resulted in the launch of a Department of Justice (DoJ) investigation.
As part of the investigation, on 12 July the DoJ obtained a warrant to seize information related to disruptj2o.org and its users from the premises of the web hosting service DreamHost. This was much to the annoyance of many in the online community.
The DoJ warrant demanded that DreamHost provide the IP addresses of the 1.3 million users that visited the site leading up to the inauguration. In addition, the warrant called for the names, physical addresses, email addresses, contact information, and even photographs of those suspected of any illegal activity.
Although DreamHost says it has been "working with the Department of Justice to comply with the legal process," the web hosting service decided to make the request for information public, stating that it felt the scope of the warrant was "highly untargeted." In the opposition motion submitted by DreamHost, the company challenged that the warrant violates the fourth amendment, in that "the all-encompassing disclosures it requires are unreasonable."
These claims were backed up by digital civil liberties advocates at Electronic Frontier Foundation, who wrote that "no plausible explanation exists for a search warrant of this breadth."
Under mounting pressure from online privacy groups, journalists, and members of the public, the Department of Justice eventually modified its original request. It stated that it was unaware of the amount of information DreamHost held on users, specifically the IP addresses of the 1.3 million users who visited the site after 20 January. It went on to say that it had no interest in those who visited the site after the protests ended.
Despite hailing this as a huge win for privacy, DreamHost went on to state publicly that the amendments did not go far enough. Many of the visitors to disruptj20.org, it felt, were still being unnecessarily targeted in the investigation, despite not being involved in any illegal activity.
In the latest development, at a Superior Court hearing at on 24 August, Chief Judge Morin confirmed the validity of the warrant and ordered that DreamHost turn over all information requested in the revised DoJ warrant. The investigation, however, was placed under heavy restrictions.
After hearing the concerns of DreamHost, Judge Morin ordered that a minimization plan be put in place to protect those users who it was deemed had no interest in inciting violence at the protest.
The court that the DoJ submit for review a list of the names of all investigators with access to the seized information, along with a details of the methods for combing through the data. It also ruled that the process must be overseen by the court, and that the DoJ will not be allowed to "conduct the investigation in a bubble."
Although DreamHost was eventually ordered to turn over the IP addresses of many who had no involvement in illegal activity, the company are hailing this as a huge victory for online privacy. "We made the internet better," read their latest blog post. Certainly, if they had not challenged the warrant, the private information of many US citizens would now be involved in a case with which they had nothing to do.
Is this as big as victory as DreamHost is claiming? Let us know in the comments.