SUPERIOR COURT OF THE DISTRICT OF COLUMBIA CRIMINAL DIVISION - FELONY BRANCH IN THE MATTER OF THE SEARCH OF WWW.DISRUPTJ2O.ORG THAT IS STORED AT PREMISES OWNED, MAINTAINED, CONTROLLED, OR OPERTED BY DREAMHOST Special Proceedings No. l7 CSW 3438 GOVERNMENT'S REPLY IN SUPPORT OF ITS MOTION TO SHOW CAUSE, AND MOTION TO MODIFY ATTACHMENT B OF THE SEARCH WARRANT The United States, by and through its attomey, the United States Attomey for the District of Columbia, respectfully submits this reply brief in support its motion to show cause and respectfu[y moves this Court modifr Attachment B of the search warrant in light of factual revelations since July, 2017. ln support of its position, the United States relies on the following points and authorities, and such other points and authorities as may be cited at a hearing on the motions. BACKGROUND On July 12, 2017, a Judge of this Court issued a valid search warrant (hereinafter, the "Warrant") that directed DreamHost Inc. ("DreamHost") to provide specific, pa(icularized categories of information associated with the website disrupti20.orq. The affidavit submitted in support ofthe search warrant (the "Affidavit") demonstrated that the website disruptj20.ore was used to organize a riot that took place in the District of Columbia on the moming of January 20, 2017 . The rioters weapons - - some of them armed with hammers, crow bars, wooden sticks and other moved as a cohesive unit for approximately thirty (30) minutes, traveling more than a dozen city blocks, as individual participants engaged in violence and destruction that caused hundreds ofthousands of dollars'worth ofprope(y damage and left civilians and officers injured. The govemment values and respects the First Amendment right of all Americans to participate in peaceful political protests and to read protected political expression online. This Warrant has nothing to do with that right. The Warrant is focused on evidence of the planning, coordination and participation in a criminal act - that is, a premeditated riot. The First Amendment does not protect violent, criminal conduct such as this. When the Warrant was issued, it was supported by probable cause and it met all other legal and constitutional requirements. The Wanant - like the govemment's investigation into the criminal conduct that occuned on January 20,2017 in the District of Columbia - was specifically directed at evidence of a crime (violations of D.C. Code S 22-1322) "involving the individuals who participated, planned, or incited the January 20 riot." The Warrant is part of the on-going criminal investigation that has resulted in nineteen guilty pleas and almost two hundred other pending criminal cases against individuals charged (by an indictment issued by a Grand Jury) for their role and participation in the January 20th riot. The Affidavit establishes probable cause to believe that, before January 20,2017, disruotj20.ore was used by a small and focused group of individuals. The Website was not just a means to publicly disseminate information (as many websites are designed to do), but was also used to coordinate and to privately communicate among a focused group of people whose intent included planned violence. For example, as shown in the Affidavit, the site was even used to verify the identity ofpeople in closely-held meetings that were not open to the media or public, where organizers required attendees to log-in to the website to prove their credentials. The website does not appear to have been updated since the first week of February 2017 , and the vast majority of information on the website appears to pre-date January 20,20t7. 2 The Warrant-like the criminal investigation-is singularly focused on criminal activity. It will not be used for any other purpose. Contrary to DreamHost's claims, the Warrant was not intended to be used, and will not be used, to "identift the political administration[.]" (Opp. at l.)r dissidents of the current Nor will it be used to "chill[ ] free association and the right of free speech afforded by the Constitution."2 In fact, as discussed further below, after conducting a careful search and seizing the evidence within the scope ofthe Warrant, law enforcement will set aside any information that was produced by DreamHost but is outside the scope of the Warrant; will seal that information; and it will not revisit that information without it a further court order. The govemment is acutely aware that criminal investigations involving electronic evidence present unique challenges. One of those challenges is that some of the evidence full scope of the evidence - will be hidden from the govemment's - particularly the view unless and until the govemment obtains a court order or search warrant. That is an important part of the history in this case because much of DreamHost's challenge to the Warrant is based on information that was not known (and would not reasonably have been known) to the govemment when the Warrant was applied for and obtained. What the govemment did not know when it obtained the Warrant it could not have reasonably known - was the extent extends beyond the govemment's singular locus - what ofvisitor data maintained by DreamHost that in this organization, and pa(icipation in the January 20,2017 case riot. of investigating the planning, The govemment has no interest in I It is disingenuous lor DreamHost to characterize the individuals behind "DisruptJ20" merely as opponents ofthe current President ofthe United States. The DisruptJ20 organizers have publicly stated that they "would be dissatisfied with any U.S. leader," that they began planning the DisruptJ20 events when "Hillary Clinton was the clear front-runner," and they "protested President Barack Obama's second inauguration, too." Perry Stein, What Drows Americans to Anarchy? It's more than just smashing windows, Washington Post, August 10, 2017, available at https://www.washingtonpost.com,/local/public-safety/ (last visited Aug. 15, 2017). 2 See DreamHost, tle Fight for the (Jsers, DreamHost.blog (last visited August 15, 201 7). ) records relating to the 1.3 releases and Opposition discussed in the million lP addresses that are mentioned in DreamHost's numerous brief. The govemment's investigation is focused on the violence Affidavit. Consistent with that focus, a new Attachment press the govemment is asking this Court to enter B to the Warrant, and remains committed to minimizing the information that is ultimately seized for the govemment's criminal investigation. Notably, the government has attempted to have a dialogue with DreamHost about these matters. Regrettably, those attempts have proven unproductive because DreamHost maintains that the Warrant is improper and that the Court lacks jurisdiction to issue the Warrant. (Mot. at Ex. G.) As recently as this past week, DreamHost told the govemment that it would provide no information about the Website without further legal process and-somewhat incompatibly-told the govemment that DreamHost would only discuss limiting the production of information called for by the Wanant if the govemment first withdrew the Warrant in its entirety. (Ex. 1.)3 The govemment requests that the Court take two steps to resolve this matter. First, the Court should reject DreamHost's legal arguments that question the Court's legal authority to issue the Warrant and challenge the la*firlness of the two-step process being used in this case. Second, the govemment requests that the Court amend the Warrant with the new proposed Attachment B. Based on new information presented by DreamHost in response to the Motion to Show Cause (and I These recent communications from DreamHost are simply the latest example in a months-long attempt to avoid compliance with lawfirt Court orders. DreamHost refused to honor a grand jury subpoena unless it was served upon them personally; then, once a copy ofthe subpoena was handserved (on February 8,2017), DreamHost informed the govemment that they were working on compliance. Weeks later (and after multiple inquiries by the govemment and promises by DreamHost that this was in the "queue" and that they were working on production), DreamHost refused to comply with the subpoena because the retum date had passed. (Ex. 2). Personal service was effected a second time with a new subpoena calling for precisely the same records as the first subpoena. More recently, the general counsel of the company promised to provide "production information and instructions" to the govemment in response to the Warrant by July 20, 2017, but then one day later told the government-through outside counsel-that the Warrant was invalid. 4 in DreamHost's press release), the govemment has refined and modified Attachment B. The govemment submits that this modified Attachment B renders moot the remaining arguments advanced by DreamHost.a With the modified Attachment B, the vatid and lawful Warrant (for which probable cause was found and still plainly exists) should be enforced. ARGUMENT I. The Search Warrant is Neither Extraterritorial Nor Unlawful DreamHost challenges this Court's jurisdiction to issue any search warrant under the Stored Communications Act ('SCA') 27 U.S.C. $ 2701, et seq, claiming that the Warrant is an unlawtrrl extraterritorial search warrant under the D.C. Code. In advancing this argument, DreamHost demonstrates that it has a fundamental misunderstanding of search warrants under the SCA, the D.C. Code, and the D.C. Superior Court Rules of Criminal Procedure. A Under the SCA, this Court has the Authority to Issue Search Warrants Directed at U.S. Providers of Electronic Communication Services and Remote Computer Services, Regardless of the Providers' Location As recently explained by Chief Judge Howell in In re Search of Information Associated with [redactedJ@gmail.com that is Stored at Premises Conlrolled by Google Inc. ("Google"), 2017 WL 344634 (D.D.C. July 31, 2017), rhe "SCA regulates how stored wire and electronic communications may be lawfirlly accessed or disclosed. Among other things, the SCA's $ 2703, permits the government, in specified circumstances, to compel service providers to disclose records or information pertaining to their customers as well as the contents of their customers' stored electronic communications." An SCA search warrant is a "distinct procedural mechanism a As noted in Section lll, infra, the Warrant (with the original Attachment B) is valid and enforceable. In crafting the modified Attachment B, the govemment has done what it tried to do informally (and unsuccessfully) with DreamHost - that is, focus on potential evidence of the criminal offenses under investigation based on all the information now known to the govemment. 5 from a traditional Rule 41 search warrant," ld., and, "in particular, by 2001 , Congress ensured that an SCA warrant was not bound by Rule 41(b)'s venue restrictions" by clarifting that federal magistrate judges were authorized to issue SCA warrants to providers located in other judicial districts, and by authorizing state courts to issue SCA warrants to U.S. providers without any geo graphic restriction. Specifically, Section 2703 of the SCA permits any "court of competent jurisdiction" to issue SCA legal process, and Section 2711 defines "court of competent jurisdiction" to include: (A) any district court of the United States (including a magistrate judge ofsuch a court) or any United States court ofappeals that(i) hasjurisdiction over the offense being investigated; (ii) is in or for a district in which the provider of a wire or electronic communication service is located or in which the wire or electronic communications, records, or other information are stored; or (iii) is acting on a request for foreign assistance pursuant to section 3512 of this title; or (B) a court ofgeneral criminal jurisdiction ofa State authorized by the law ofthat State to issue search wanants[.] l8 U.S.C. $ 271l(3). The term "State," &e l8 U.S.C. $ 2711(1) wiri as used in the SCA, includes the District of Columbia. 18 U.S.C. $ 2s10(3). The SCA does impose some limitations on SCA warrants issued by federal district courts. Primarily, federal courts must either have 'Jurisdiction over the offense being investigated," or be "in ... a district in which the provider is located." 18 U.S.C. $ 2711(3XA). However, as DreamHost acknowledges (at 18 n.7), the SCA imposes no such limits on State courts. Thus, the SCA empowers any State "court of general criminal jurisdiction" that is "authorized by law .. . to issue search warrants" to issue SCA warrants, without any additional geographic requirement. That federal grant ofauthority was sufficient to authorize this Court to issue SCA warrants, even without any further action by the District of Columbia. While D.C. Code $ 23-521(a) states that the Cou( "may" issue warrants that "authorize a search to be conducted anywhere in the 6 District of Columbia," it does not in any way purport to limit the Court's powers under the SCA. Similarly, while D.C. Superior Cou( Rule of Criminal Procedure 4l(f)(2) states that D.C. Code search warrants "may be executed anywhere within the District of Columbia," that rule does not purport to modiff the scope of the SCA - and DreamHost has not identified any authority that supports its claim to the contrary. DreamHost has not cited aly case concluding that any State court of general jurisdiction lacks authority to issue SCA search warrants. In fact, in its brief discussion ofthe issue (at 17- 18), DreamHost relies entirely on cases that reach the opposite result. See In re Search ll'arrantfor Recordsfrom AT&7,2017 WL2511269 at *4, -- A.3d -- (N.H. 2017) (upholding circuit court's authority to issue search warrant to AT&T in Florida); Oregon v. Rose, 330 P.3d 680, 686 (Ore. 2014) (finding that Oregon law "authorizes an Oregon court to issue a search warrant to be executed on a business outside of Oregon so long as the court has personal jurisdiction over the recipient business"); Hubbard v. Myspace, Inc., 788 F. Supp. 2d 3 19 (SCA search warrant was valid, even though it exceeded the "ordinary territorial authority" ofthe issuing state court). DreamHost's jurisdictional challenge should be rejected on that basis alone. B. In This Case, Neither The Execution Nor the Search Are Extraterritorial Finally, nothing in D.C. Code $ 23-521(a) and Rule 4l(f)(2) suggests the Cou( lacks authority to issue the Warrant, as both the execution and the search authorized by the Warrant in this case are actions within the District ol Columbia, and none of the relevant conduct is "extraterritorial." The Warrant was issued in the District of Columbia, it was executed in the District of Columbia, it was served on a provider ',,rith contacts in the District ol Columbia, and the search will be conducted in the District of Columbia. DreamHost's contrary conclusion depends on a fundamental misunderstanding ofSCA 7 search warrant law and procedure. The procedure for implementing SCA search warrants differs from the procedure for traditional premises and property search warrants, which typically must be executed by law enforcement officers, and which commonly authorize law enforcement officers to enter private property without the consent of the owner or occupant. In contrast, SCA search warrants are executed by simply serving the search warrant upon the designated provider, an act which is typically accomplished by e-mail, fax, or other electronic delivery. This manner of execution does not require law enforcement officers physically to enter upon the property ofthe provider; it can be accomplished remotely. Indeed, the Wanant in this case specifically authorized the Metropolitan Police Department to "execute" the Warrant "by emailing or faxing" the provider. An SCA warrant so executed then requires the designated provider to disclose information to law enforcement, and then authorizes law enforcement to search that information for evidence. The "search" thus occurs when-and where-law enforcement reviews the information provided. This process was recently explained by Chief Judge Howell in the Google decision. As the court explained, []n the context of electronic information, when Google queries its database, finds the communications in question, and retrieves it for storage on its local servers in the United States, Google does not "search" or "seize" the communications in a Fourth Amendment sense. The Fourth Amendment protects two types of expectations, one involving 'searches' the other 'seizures.'. . ._A 'search' occurs when an expectation ofprivacy that society is prepared to consider reasonable is infringed. . . . A 'seizure' of property occurs when there is some meaningful interference with an individual's possessory interests in that property." 2017 WL3445634at + 16 (citations omitted). The court further explained that a provider's intemal handling of subscriber information - wherever that occurs - "does not amount to a "search" or a "seizure" in any meaningful sense, because such providers routinely control that information without infringing on "any expectation of privacy" or "meaningfully interfere[ing] with the 8 customer's possessory interests." privacy - Id. Critical to that decision, the impingement on subscriber that is, the constitutional "search" and "seizure" that is the subject of a search warrant - occurs in the location where law enforcement reviews that subscriber's information. Thus, in this case, the search will occur within the District of Columbia, when the Metropolitan Police Department reviews the information disclosed by DreamHost. While D.C. Code $ 23-521(a) states that the Cou( "may" issue warrants that "authorize search to be conducted anywhere in the District a of Columbia, it does not in any way purport to limit the Court's powers under the SCA, and in any event, the SCA search at issue will, in fact, "be conducted ... in the District of Columbia." Similarly, while the D.C. Superior Court Rule of Criminal Procedure 4l (f)(2) specifies that D.C. Code search warrants "may be executed anywhere within the District of Columbia," that rule does not purport to modiff the scope of the SCA, and in any event, the execution specified in the Warrant actually took place in the District of Columbia. IL The Warrant's Two-Step Disclose-and-Search Process Is Reasonable, Appropriate, and Entirely Lawful. The two-step procedure incorporated into the Warrant is a practical necessity for search warrants directed at electronically stored information. It has been approved by cou(s around the country, including every federal appellate court that has examined the issue. See United States v. Evers, 669 F.3d 645, 652 (6th Cir. 2012) ("[t]he federal courts are in agreement that a warrant authorizing the seizure of a defendant's home computer equipment and digital media for a subsequent off-site electronic search is not unreasonable or overbroad, as long as the probablecause showing in the warrant application and affidavit demonstrate a 'sufficient chance offinding some needles in the computer haystack."'); United States v. Stabile,633 F.3d 219,233-34 (3dCir. 2011) ("practical realities of computer investigations preclude on-site searches"); United States v. Grimmett,439 F.3d 1263,1268-70 (101h Cir. 2006) (search warrant for "any and all" computer 9 hardware and software for child pomography authorized both the seizure and subsequent search ofthe defendant's computer files); Guest v. Leis,255 F.3d 325, 335 (6th Cir. 2001) ("Because of the technical difficulties of conducting a computer search in a suspect's home, the seizure ofthe computers, including their content, was reasonable in these cases to allow police to locate the offending frles;'); United States v. Hay,23l F.3d 630,637-38 (9th Cir. 2000) (off-site search was appropriate "because of the time, expertise, and controlled environment required for a proper analysis"); United States v. Upham, 168 F .3d 532, 535 (I st Cir. 1999) ("the seizure and subsequent off-premises search of the computer and all available disks was about the narrowest definable search and seizure reasonably likely to obtain the images [ofthe child pomography sought]."). The two-step procedure is appropriate for electronic device search warrants, but it is padcularly applicable to search warrants issued under the SCA. See, e.9., United States v. Bach, 310 F.3d 1063, 1065 (8th Cir. 2002) (upholding as consistent with the Fourth Amendment a procedure in which "Yahoo! technicians retrieved all ofthe information from Bach's account" and then did "not selectively choose or review the contents of the named account."); United Stotes Patel,No. l6-CR-798 (KBF),2017 WL3394607, at *4 (S.D.N.Y. Aug. 8,2017) ("the v. above principles make clear that executing authorities may obtain the entire contents ofan email account in an effort to search for a more limited set of emails"); In the Matter of a lydtant for All Content & Other Info. Associated $)ith the Email Account xxxxxxx gmailcom Maintained at Premises Controlled By Google, Inc.,33 F. Supp. 3d 386, 394 (S.D.N.Y. 2014), as amended (Aug. 7,2014) ("Notably, every case of which we are aware that has entertained a suppression motion relating to the search ofan email account has upheld the Govemment's ability to obtain the entire contents of the email account to determine which particular emails come within the search warrant."). The district court's decision in In the Matter of the Search of 10 Information Associated with [redacted]@mac.com that is Stored at Premises Controlled by Apple, ("Apple II') ]rc., 13 F.Supp.3d 157 (D.D.C. 2014), is instructive. The search warrant in that case required Apple to produce information without first screening it for evidentiary value, and it authorized the government to search that information. The court found that this procedure was both reasonable and consistent with the requirements of the Fourth Amendment. The court also explained the "nettlesome problems" of permitting providers to filter data before disclosing it to the govemment: []t would be unworkable and impractical to order Apple to cull the e-mails and related records in order to find evidence that is relevant to the govemment's investigation. To begin with, non-govemmental employees untrained in the details of the criminal investigation tikely lack the requisite skills and expertise to determine whether a document is relevant to the criminal investigation. Moreover, requiring the government to train the electronic service provider's employees on the process for identiffing information that is responsive to the search warrant may prove time-consuming, increase the costs of the investigation, and expose the govemment to potential security breaches. Id. at 166-167 . Finally, the court emphasized the Supreme Court's instruction that, although the search would always be subject to subsequent judicial review, a "search warrant's execution is 'generally left to the discretion ofthe executing officers to determine the details ofhow best to proceed with the performance ofa search authorized by warrant[.]"' Id. (citing Dalia v. United States,44l U.S. 238, 257 (1979)). DreamHost ignores the emerging consensus on these points. DreamHost fails to cite any case showing that evidence was suppressed based on the application of the two-step procedure, and instead locuses on cases showing that a few magistrate judges have denied search wanant applications that employ the procedure. The cases DreamHost cites are obvious outliers - and they either involve factors not present in this case, or they have been vacated or superseded by subsequent case law. For example, In the Matter of the Search of Information Associated with [redacted] @mac.com that is Stored at Premises Controlled by Apple, Inc.,25 F.Supp.3d I ("Apple 1l /) (D.D.C. 2014), was vacated by the decision in Apple 1L Similarly, In re Search of Premises Known as Three Hotmail Email Accounts,2016 WL 1239916 (D. Kan. 2016), was ovemrled in relevant part by In re Search of Information Associated lVith Email Addresses Stored At Premises Controlled By Microsoft,2l2 F. Supp. 3d 1023 ("Microsoft") (D. Kan. 2016) - and ir Microsoft, the district court expressly held that the two-step procedure for the search of e-mail accounts complied with the Fourth Amendment. Id. al 1030. DreamHost likewise fails to mention that 1n re: [Redacted]@gmail.com,62 F. Supp. 3d I100 Qll.D. Cal. 2014) , involved strikingly different circumstances, addressing (1) a warrant which had already been denied in the District of Columbia "for the reasons stated in" Apple I, which has since been ovemrled; and (2) which was then represented, without modification, in the Northem District of Califomia; and (3) the govemment had made no commitment to set aside items that were outside the scope of the warrant. Id. al 1104. The govemment in this case has not engaged in any similar conduct - and, as noted above, the govemment is committed to sealing and setting aside any information that is not within the scope ofPart II of Attachment B and has proposed significant refinements to Attachment B as discussed below. Finally, and more fundamentally, DreamHost has not provided any basis to believe that the two-step procedure is unreasonable in this case - and it has not provided any basis to believe that an altemative procedure is even practical. There is no evidence that DreamHost personnel can adequately search DreamHost records to determine "whether a [particular] document is relevant to the criminal investigation." Apple II at 166-167. DreamHost simply asserts, without more, that the two-step procedure is "not without controversy." Opposition at 11. That is not the standard. For all of the foregoing reasons, the two-step procedure is appropriate, reasonable, and tawful t2 under the Fourth Amendment - and it is the only workable method of identifuing the evidence that is the subject of the Warrant. III, The Court Should Enforce the Warrant with the Government's Proposed Modified Attachment B. A. The Warrant The Judge who issued the Warrant in Jdy 2017 correctly found probable cause to believe that evidence relevant to the govemment's criminal investigation into the riot that occurred on January 20, 2017, would be found within the "lnformation to be Disclosed" that is described in Part I of Attachment B of the Warrant. The resulting Warrant (l) required DreamHost to disclose the "Information to be Disclosed" to law enforcement, and (2) authorized law enforcement to search the information disclosed by DreamHost and to seize the described in Part Attachment "lnformation to be Seized" that is II of Attachment B. The "lnformation to be Seized" described in the original B must meet three specific criteria. It must: (l) constitute fruits, evidence and instrumentalities of violations of D.C. Code 22-1322 (rioting statute); (2) involve the individuals who participated, planned, organized or incited the January 20 riot; and (3) retate to the development, publishing, advertisement, access, use, administration or maintenance of disruptj20.ors. The Warrant identifies the specific property to be searched by describing the particular account information that DreamHost must disclose (in Attachment Attachment B), and Attachment B), it A and Part I of then specifies the particular information to be seized (in Part II of ie., records and files that constitute fruits, evidence or instrumentalities of a specific criminal offense (22 D.C. Code, Section 1322) that was committed on a specific date (lanuNy 20,2017). 13 B. The Government Requests that Attachment B of the Warrant Be Modified in Light of DreamHost's Recent Disclosures, As noted above, the Warrant was properly issued by the Court and contains appropriate and recognized procedures. Over the past week, DreamHost has made numerous public statements and made many statements in its opposition brief which provide information about the website that were unknown to the govemrnent and the Court at the time that the Warrant was issued. Both the government and the Court are now aware ofthe following: . "During the time period January 23,2017 to January 28,2017, DreamHost has maintained HTTP logs for over 1,300,000 IP addresses of visitors to the website" which is a time period after the riot at issue in the govemment's case. (Fry Decl. fl s.) o "DreamHost maintains emails associated with the Website, including emails of third parties." (Fry Decl. tf 6.) "The Website proposes several email addresses within the disruptj2O.org domain name and invites conespondence." (Opp. at 8.) o "DreamHost maintains membership lists for several email discussion lists, from a number ofdifferent email accounts sponsored by the website." (FryDect.fl7.) o "DreamHost maintains over 2,000 images related to the Website. (Fry Decl. fl 8.) o DreamHost maintains some "unpublished" materials such as "draft blog posts" and "hundreds of images." (Fry Decl. flfl 10, I I.) To re-iterate: these additional facts were unknown to the govemment at the time it applied for and obtained the Warrant; consequently, the govemment could not exclude from the scope of the Warrant what it did not know existed. The Affidavit, the indictment that was retumed by a Grand Jury, and the govemment's repeated statements made during public hearings in the pending criminal cases make clear that the govemment is focused on the criminal acts of defendants and 14 their co-conspirators, and not their political views - and certainly not the lawfirl activities of peaceful protesters. Similarty, the government is focused on the use of the Website to organize, to plan, and to effect a criminal act - that is, a riot. The govemment has no interest in seizing data from the Website that does not relate to this limited purpose. Committed to the limited purpose ofinvestigating the criminal conduct involved in the organization, planning, and execution of a riot on January 20, 2017, the govemment has taken the new information provided by DreamHost and modified Attachment B to carve out data and information that the govemment does not seek.5 s Although, based on the new information provided by DreamHost, the govemment seeks to refine Attachment B, the original Attachment B was nonetheless lawful and appropriate. The original Attachment B specifically identified the property to be searched by describing (in Attachment A and Part I of Attachment B) the particular account information that DreamHost must disclose, and it then specifies (in Part II of Attachment B) the pa(icular information to be seized: records and files that constitute fruits, evidence or instrumentalities of a specific criminal offense that was committed on a specific date. These specifications, together with description of the offenses in the Affidavit (which is attached to the Warrant), satisfy the Fourth Amendment. Compare Microsoft,212 F. Supp. 3d 1023,1026-1027 (upholding search warrant that sought all information associated with particular Microsoft accounts, without any date limitation for the information to be disclosed; identified relevant criminal statutes and the dates of the violations; and then authorized the recovery of, among other things, "Evidence indicating the email account owner's state of mind as it relates to the crime under investigation."). Moreover, in addition to the three limitations in Part II of Attachment B, the original Warrant described specific types of files that the govemment seeks to seize, and the Affidavit provided additional context and clarity for the scope of the Warrant as a whole, including the limitations in Part II of Attachment B. The Affidavit, attached to the Warrant, demonstrated that the original Warrant concems information related to the specific crimes that led up to, and constituted, the January 20,2017 riot. See United States v. Moore,263 A.2d 652 (D.C. 1970) (finding that warrant described the place to be searched with sufficient particularity, where "the affidavit was attached to the warrant and sufficiently relened to therein to enable the officers executing the warrant to look at the affidavit and determine the place intended"). Cf. Apple II, 13 F. Supp. 3d at 164 (noting that the affidavit included "additional background information on the particular types of records that must be disclosed, the specific crimes for which the government seeks evidence, and the targeted entities and individuals," and emphasizing that, "when read together with the affidavit, the govemment's application provides detailed information of the alleged criminal scheme and a thorough explanation for why evidence relevant to the investigation is likely to be found in e-mail records and other data related to the target email account"). l5 Part I of the modified Attachment B (the information to be disclosed by DreamHost) has been refined in the following ways: (l) DreamHost should only provide content and transactional information for the time period from July 1, 2016, though and including January 20,2017,which covers the time frame described in the Warrant, Affidavit, the date when the site was purchased, and the public statements made by organizers of DisruptJ20 regarding the timing of the organization and planning (Ex. 3 at l.a.); (2) DreamHost should not disclose the contents of unpublished draft publications, including images and their metadata (Ex.3 at I.e.); and (3) DreamHost should not disclose records that constitute HTTP request and error logs (Ex. 3 at I.f.). Part II of the modified Attachment B (the information to be seized by the govemment) also provides more detailed descriptions regarding the types of information that will be seized by the govemment. Part III ofthe modified Attachment B (procedures for handling information disclosed by DreamHost) also sets forth what will happen to the evidence that is not seized by the govemment during its search of the materials provided by DreamHost - that is, the govemment will have such information placed under seal with the Court and will not copy or retain such information for any further purpose. (Ex. 3 hereto at II.B.) The govemment believes that, collectively, these modifications to Attachment B minimize the disclosure of data that is not directly related to the criminal investigation, thereby reducing the burden on DreamHost to disclose information and reducing the burden on the govemment to conduct its search. Such modifications should amply address the First Amendment/Fourth Amendment reasonableness concems raised by DreamHost. Similarly, the government's modifications are designed to clarify that the government is not seeking access to l6 any "work product" that is potentially covered by the Privacy Protection Act, as that term is defined in 42 U.S.C. $ 2000aa-7(b). CONCLUSION For the foregoing reasons and any other reasons that may be cited at a hearing on this motion, the government requests that the Cou( amend the Warrant with the government's proposed modified Attachment B, and grant the govemment's request that DreamHost be compelled to comply with the Warrant. Respectfu lly submitted, CHANNING D. PHILLIPS LINITED STATES ATTORNEY /s/ Jennifer A. Kerkhoff Jennifer A. Kerkhoff John W. Borchert Assistant United States Attomeys United States Attomey's Office lor the District of Columbia 555 Fourth Street, N.W. Washington, D.C. 20530 By: August 21, 2017 17 CERTIFICATE OF SERVICE I hereby certify that copy olthe foregoing was delivered via electronic mail to counsel for DreamHost this 2l st day ofAugust 2017. /s/ Jennifer A. Kerkhoff Jennifer A. Kerkhoff Assistant United States Attomey l8 EXHIBIT 1 From: To: Aghaian, Raymond Cc: Kerkhoff. lennifer (USADC) RE: DreamHost matt€r Thursday, August 17,2017 1:37:56 Pl4 Borchert lohn Subject: Oatel fUSADC') H ioh n, Your question below about the website is seeking information that is governed by the Stored Communications Act. We cannot readily give the government such information without a proper request. Moreover, we were trying to discuss the issue of narrowing the scope of your search warrant to provide you with records as expeditiously as possible before you went silent and filed the motion to compel. Happy to have such a discussion, once the motion and search warrant are withdrawn. Ray Raymond O. Aghaian Kilpatrick Townsend & Stockton LLP 9720 Wilshire Blvd PH I Beverly Hills. CA 90212-2018 office 310 310 7010lfax 310 388 1198 ragharan(Okrloatflcktownsend.com I My Profile I vcard From: Borchert, John (USADC) [mailto:]ohn.Borchert@usdoj.govl sent: wednesday, August 16, 20U 10:07 Al'4 To: Aghaian, Raymond Cc: Kerkhoff, Jennifer (USADC) Subject: DreamHost matter Hello, Ray - We noticed in your opposition that "[d]uring the time period January 23, 2017 to Janu a(y 28, 2011 DreamHost has maintained HTTP logs for over 1,300,000 lP addresses of visitors to the website." How many visits were there to the website prior to January 21, 2017? That information might be helpful in narrowinB the issues for the court to consider. Also, assuming that the Court determines that its search warrant is valid, are there any materials called for by the warrant that DreamHost does not object to producing to the government? Regards, John W. Borchert Deputy Chief - Felony Major Crimes Trial Section Misdemeanor Trial Unit Joh n U.S. Attorney's Office for the , District of Columbia Oesk:202-252-767 9 Mobile: 202-870-607 t ioh n. horchert @ usdoi.gov Confidentialty Notice: This communication constitutes an electronic communication wthin the meaning of lhe Electronic Communicatrons Privacy Acl, 18 U.S C Section 2510, and its disclosure is slrictly limited to the recipient intended by the sendar of this message. This transmission, and any attachments, may contain confdenlial atlorney-client pnvileged informaiion and atlomey work product. lfyou are not the intended recipient, any disclosure, copying, distribution or use of any ofthe information contained in or attached to this lransmission is STRICTLY PROHIBITED. Please contact us immediately by retum e-mailor at 404 815 6500, and destroy the originaltransmission and ils attachments without reading or saving in any manner "'OISCLAIMER"' Per Treasury Department Circular 230: Any U.S. federal tax advice contained in this communication (including any atlachmenls) is nol intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties underthe lntemal Revenue Code or (ii) promoting, markeling or recommending to another party any lransaction or matter addressed herein. EXHIBIT 2 From To: Kari Fry Borchert. John rUSADC); leoal(odreamhost.com O"Rourke- Allen (USADC); (glIorllen-0ifel1lr$Qo; Re: Dreamhost - Preservation Request (LGL-53782) wednesday, February 22, 2017 7:53:59 PM Cc: subject: Date: christopher.ohazarian(Odreamhost.com HiJohn, Thank you for your ongoing patience. We're still processing our queue and haven't been able to address this subpoena yet. ln reviewing the subpoena we've noticed that the production date is February 6th, while the subpoena itself was served on February 8th (after the date of production). We kindly ask that you issue another subpoena with a proper deadline (2 weeks is acceptable). We will accept service by email this time. Than k you, Karl Fry DreamHost Compliance Team http://www.dreamhost.com On 2/22/17 I :59 PM, Borchert, John (USADC) wrote: Hello, Karl - lthought I should circle back. Can you update us? Regards, .lohn loh n W. Borchert Assistant United States Attorney Attorney's Office for the District of Columbia U.S. D esk: 202-252-1 61 9 Mobi le: 202-87 0-607 1. iohn.borchert2@usdoi.gov From: Karl Fry lmaLjlo:karlfu!@_drcanha$rcn0] Sent: Thursday, February 76,2017 2:31, PM To: Borchert, John (USADC) ; legal@dreamhost.com Cc: O'Rourke, Allen (USADC) ; Kerkhoff, Jennifer (USADC) ; christopher.ghazariar't @dreamhost.com Subiect: Re: Dreamhost - Preservation Request (LGL-53782) HiJohn, Thank you for writing. lt's looking like early next week at this point. We've had an usually large volume of issues for our team lately. We appreciate your patience in the meantime. Sincerely, Karl Fry DreamHost Compliance Team htto ://www.drea mhost.conl On 2/16/77 11:23 AM, Borchert, John (USADC) wrote: Hello, Karl with the Rega su Can you give us a sense of where you stand with complying bpoena? rds, lohn From: Karl Fry [mailto:karl.f rv@d reamhost.com] Sent: Tuesday, February !4,2017 6:11 PM To: Borchert, lohn (USADC) ; legal@dreamhost.com Cc: O'Rourke, Allen (U5ADC) ; Kerkhoff, (USADC) ; christooher.ghazarian@dreamhost.com Subject: Re: Dreamhost - Preservation Request (LGL-53782) John, Thanks for writing. Yes, we were served by hand last week. lt is in our queue for the week and I will get back to you as soon as I have more information. Thank you for your patience in the meantime. Sincerely, Karl On 2/1.0/11 10:14 AM, Borchert, John (USADC) wrote: Hello, Karl - { believe you have now been served by hand. The effective preservation date should be January 27, which was the date of the preservation request. please let me know if you have any concerns complying with the su bpoena. Regards, John From: Borchert,.lohn (USADC) Sent: Thursday, February 2, 2017 1:15 PM To: Karl Fry ; legal@d reamhost.com Cc: O'Rourke, Allen (USADC) ; Kerkhoff, .Jen nifer (USADC) <]Kerkhoff @ usa.doi.gov>; ristopher.ghazaria n @d rea mhost.com Subject: RE: Dreamhost - Preservation Request (LGL-53782) ch I understand how you plan to proceed From: Karl Fry Imailto:karl.f ry@dreamhost.com] Sent: Thursday, February 2, 2017 7:1-2 PM To: Borchert, lohn (USADC) legal@drea mhost.com ; Cc: O'Rourke, Allen (USADC) ; Kerkhoff, lennifer (USADC) ; christooher.ghazarian@dreamhost.com Subject: Re: Dreamhost - Preservation Request (LGL-53782) .lohn, will proceed with the preservation, but again -- we will have to notify our customer that we are preserving data since we I are not compelled by a 2705(b) non-disclosure order. Please confirm that you understand we will be proceeding with notification. The preservation will be effective as of Jan 28 if we proceed Karl On 2/2/77 10:03 AM, Borchert, John (USADC) wrote: Karl - Please proceed with the preservation. The preservation request was sent last week, so assume that your prese,vation will be effective I as of that date. I understand ls that cor.ect? your request regarding service and we are working on that. Regards, lohn From: Karl Fry Imailto:karl.fry@dreamhost.com] Sent: Thursday, February 2, 2017 f2:51 PM To: Borchert, John (USADC) ; Jegal@d reanrhost.com Cc: O'Rourke, Allen (USADC) ; Kerkhoff, Jennifer (USADC) ; ch ristooher.ghazaria n @drea mhost.com Subject: Re: Dreamhost - Preservation Request (rG L-s3782) .lo h n, Than k you for your patience on this issue. After review, we've determined that in this case we would be required to notify our customer if we proceed with the preservation as our non-disclosure is merely requested and not required by law. Likewise, I should note, the subpoena you previously emailed us that we weren't able to comply with due to serviceof-process issues did not include a 2705(b) non-disclosure order. will not notify our customer at this point unless you request us to proceed with the preservation without a valid 2705(b) nonI disclosure order. Also, if you do ultimately serve us with a production order, you'll likely want such a nondisclosure order attached if you do not want us to disclose to our customer. Again I apologize for the time it took to review this issue. lf you have any questions please let me know and I will expedite your request. Thank you, Karl Fry DreamHost Compliance Team htto:/,/www.drea mhosl.com On L/29/I7 L1:03 AM, Borchert, John (USADC) wrote: Thank you very much. Please don't hesitate to reach out if you any questions. Regards, John .lohn W. Borchert Assistant U nited States Attorney United States Attorney's Office for the District of Columbia Desk: (202) 252-7679 Mobile: (202) 870-6071 From: Karl Fry Imailto:kar].frv@dreamhost.coml Sent: Saturday, January 28,2077 6:51 PM To: Borchert, John (USADC) ; legal@dreamhost.com Subject: Re: Dreamhost Preservation Request (LGL-53782) Than k you for writing. I just wanted to let you know that we are in receipt of your preservation request and discussed it with our General Counsel on Friday. We will have further response for you on Monday. Thank you for your patience in the meantime. Sin cerely, Karl Fry DreamHost Compliance Team h tt o://www. d rea m h ost. com On L127/t7 10:54 AM, Borchert, John (USADC) wrote: Please see attached. lohn W. Borchert Assistant United States Attorney United States Attorney's Office for the District of Columbia Desk: {202) 2527 679 Mobile: (202) 8706071- EXHIBIT 3 ATTACHMENT B Particular Things to be Seized I. lnformation to be Disclosed by DreamHost To the extent that the information described in Attachment A ("the Account") is within the possession, custody, or control of DreamHost, including any messages, records, files, logs, or information that have been deleted but are still available to DreamHost, or have been preserved pursuant to a request made under 18 U.S.C. $ 2703(0, DreamHost is required to disclose the following information to the govemment for the Account: a. for the time period from July 1, 2016, through and including all of January 20,2017 (Eastern Time), all records or other information, pertaining to the Account, including all files, databases, and database records stored by DreamHost in relation to that Account; AND b. all information in the possession of DreamHost that might identify the DreamHost subscribers related to the Account, including names, addresses, telephone numbers and other identifiers, e-mail addresses, business information, the length of service (including start date), means and source of payment for services (inctuding any credit card or bank account number), and information about any domain name registration; AND c. all records pertaining to the types of service utilized by the user; AND d. all records pertaining to communications between DreamHost and any regarding the account person or identifier, including contacts with support services and records of actions taken; EXCEPT e' DreamHost shall not disclose the content of any unpublished draft publications (e.g., draft blog posts), including images (and metadata for those images) that were associated with draft publications. f. DreamHost shall not disclose records that constitute HTTP request and error logs. II. Information to be Seized by the Government A. Description of the Evidence The govemment may seize all information described above in Section I that constitutes evidence of the violations of D.C. Code S5 22-1322,22-1805a, and 22-303, that are described in the Affidavit attached to this Warrant and that are (or have been) the subject of the criminal prosecutions (described in paragraph l1 of the Affidavit), including: (a) evidence conceming the nature, scope, planning, organization, coordination, and carrying out ofthe above-described offenses; (b) communications relating to the planning, organization, coordination, and carrying out of the above-described offenses; (c) evidence, including Intemet Protocol ("1P") addresses, e-mail addresses, and any other evidence that will help identifr individuals who participated in the above- described offenses, planned for the above-described offenses, organized the abovedescribed offenses, or incited the above-described offenses; and (d) evidence about the state of mind of individuals who pa(icipated (or, knowing about planned violence, refused to participate) in the above-described offenses, planned for the above-described offenses, organized the above-described offenses, or incited the above-described offenses. B. Types of Information Within the Scope of Part (II)(A) For evidence that is within the scope of Part II(A) of this Attachment B, the government may seize all information relating to the development, publishing, advertisement, access, use, administration or maintenance of any website enumerated in Attachment A, including: 1. files, databases, and database records stored by DreamHost on behalf of the subscriber or user operating the Account, including: a. HTML, CSS, JavaScript, image files, or other files; b. SSH, FTP, or Telnet logs showing connections related to the website, and any other transactional information, including records of session times and durations, log files, dates and times of connecting, methods of connecting, and ports; c. MySQL, PostgresQl, or other databases related to the website; d. The contents of e-mail accounts that are within the @disruptj2O.org domain (including info@disruptj 20.org). 2. DreamHost subscriber information for the Account, to include: a. Names, physical addresses, telephone numbers and other identifiers, email addresses, and business information; b. Length of service (including start date), types source of payment for of service utilized, means and services (including any credit card or back account number), and billing and payment information; c. The date that the domain name disruptj20.ors was registered, the registrant information, administrative contact information, the technical contact information and billing contact used to register the domain and the method tendered to secure and register the Intemet domain name. of payment Subject to the procedures discussed in Part III of this Attachment B, the govemment is authorized to retain a digitat copy of all information disclosed by DreamHost, for as long as it is necessary for purposes of authentication at trial, III. Procedures for Handling Information Disclosed by DreamHost The govemment will conduct a search of the information produced by DreamHost and determine which inlormation is within the scope of the information to be seized specified in Section II. That information that is within the scope of Section II may be copied and retained by the United States. Law enforcement personnel will then seal any information from DreamHost that does not fall within the scope of Section II and will not further review the information absent an order of the Court.