ORIN KERR: A closer look at DOJ’s warrant to collect website records.

The Hill is getting a lot of attention in privacy circles with a story headlined “Justice demands 1.3M IP addresses related to Trump resistance site.” . . .

First, it’s not obvious to me whether the warrant is problematic. Attachment B tells Dreamhost to turn over records to the government relating to “each account and identifier listed in Attachment A.” Notably, Attachment A doesn’t list any specific user accounts: It just lists the specific website. So the warrant seems to be telling Dreamhost to turn over pretty much everything it has on that website. I understand this to be Dreamhost’s objection. Dreamhost thinks the warrant should only require it to hand over specific records about specific users.

What makes this tricky, I think, is that Dreamhost is only involved in the initial search stage of a two-stage warrant. Computer warrants are ordinarily executed in two stages. First, the government gets access to all the electronic records. Next, the government searches through the records for the particularly described evidence. Courts have broadly allowed the government to follow this two-step procedure, in which they get all the stuff in the initial stage of electronic evidence warrants so that they can search it for the relevant evidence. Given that, Dreamhost’s objection is slightly off. As I read it, Dreamhost is essentially challenging the widely accepted two-stage warrant practice. Some federal magistrate judges in the “magistrate’s revolt” have made that argument, but they generally have been overruled at the district court level.

With that said, there’s an interesting and unresolved issue presented here: What’s the correct level of particularity for a website? Courts have allowed the government to get a suspect’s entire email account, which the government can then search through for evidence. But is the collective set of records concerning a website itself so extensive that it goes beyond what the Fourth Amendment allows?

Some decent privacy legislation would be helpful here, but don’t hold your breath.