SUPERIOR COURT OF THE DISTRICT OF COLUMBIA f7? CRIMINAL DIVISION FELONY BRANCH IN THE MATTER OF THE SEARCH Special Proceedings Nos. 17 CSW 3438 OF THAT IS STORED AT PREMISES OWNED, HEARING REQUESTED MAINTAINED, CONTROLLED, OR OPERTED BY DREAMHOST . UNITED MOTION FOR DREAMHOST TO SHOW CAUSE The United States of America, by and through its attorney, the United States Attorney for the District of Columbia, hereby moves'the Court to order DreamHost, Inc. (?DreamHost?), to show cause why DreamHost should not be compelled to comply with a warrant issued by this Court on July 12, 2017, No. 17 CSW 3438, pursuant to 18 U.S.C. 2703(a), and ordered immediately to provide to the government certain records and information speci?ed within Attachment to that warrant that are within the possession, custody, or control of Dreamhost, regardless of where such records or information may be stored. BACKGROUND On July 12, 2017, this Court authorized a search warrant pursuant to 18 U.S.C. 2703(a), commanding DreamHost to disclose to the government records and information associated with the website including communications and content associated with the account. (EX. A.) That website was used in the development, planning, advertisement, and organization of a violent riot that occurred in Washington, DC, on January 20, 2017. Attachment A to the warrant identi?ed the particular customer account that is the subject of the warrant, which was (Ex. A.) Attachment B, Subsection 1, of the warrant, titled ?Information to be disclosed by Dreamhost,? ordered Dreamhost to disclose the following information for that account: a. all records or other information pertaining to that account or identi?er, including all ?les, databases, and database records stored by DreamHost in relation to that account or identi?er; b. all information in the possession of DreamHost that might identify the subscribers related to those accounts or identi?ers, including names, addresses, telephone numbers and other identi?ers, e-mail addresses, business information, the length of service (including start date), means and source of payment for services (including any credit card or bank account number), and information about any domain name registration; c. all records pertaining to the types of service utilized by the user; d. all records pertaining to communications between DreamHost and any person regarding the account or identi?er, including contacts with support services and records of actions taken. (Ex. A.) Attachment B, Subsection II of the warrant limited the government?s seizure to ?[a]ll information described above . . . that constitutes fruits, evidence and instrumentalities of violations of DC. Code On Friday, July 14, 2017, the government sent a copy of the Court?s search warrant and its attachments to DreamHost by email. (Ex. B.) DreamHost responded that same day acknowledging that it was in receipt of the search warrant but requested that the government personally serve a copy of the Court?s search warrant on DreamHost in California. (Ex. B.) On Monday, July 17, 2017, an agent from the Federal Bureau of Investigation personally delivered a copy of the search warrant to DreamHost] (EX. C.) DreamHost acknowledged being personally served in an email message dated July 18, 2017. (Ex. C.) 1 The government also sent copies of the Court?s search warrant to DreamHost and to DreamHost?s registered agent for service of process in California via Federal Express overnight delivery with signature required at delivery. The Federal Express tracking information for each of those packages indicates that they were delivered on July 18, 2017. 2 On July 19, 2017, the government requested that DreamHost begin an immediate production of materials in response to the Court?s search warrant. (Ex. D.) The government also cautioned DreamHost that if DreamHost did not begin to comply with the Court?s search warrant, the government may need to seek relief from the Court. (EX. D.) That same day, the General Counsel for DreamHost replied to the government that DreamHost could not respond to the Court?s search warrant at that time because ?the entire company? had convened at an ?offsite . . . day?long meeting? and ?we?re all out of the of?ce.? (Ex. E.) However, the General Counsel for DreamHost promised that ?we will have an update for you (likely tomorrow [July 20]) with production information and instructions.? (Ex. E.) On July 20, 2017, the government again contacted DreamHost to request that the company begin a rolling production of materials responsive to the Court?s search warrant. (Ex. F.) Later that day, the government received an email message from Raymond Aghaian, Esq, an attorney representing DreamHost, who requested to have a telephone call with the govemment to discuss the Court?s search warrant. (Ex. F.) Later that day, the government unsuccessfully tried to reach Mr. Aghaian on the telephone to discuss this matter. (Ex. G.) The government also tried to reach Mr. Aghaian?again without success#the next morning, July 21, 2017. (Ex. G.) On July 21, 2017, the government received an email message from Mr. Aghaian stating four ?concerns? with the Court?s search warrant: 1. There is some uncertainty as to the language in [Attachment Section 11, paragraph 2, that we would like to clarify and get a better understanding of what exactly is requested. Moreover, we need to be able to inform the subscriber about the warrant, but it is dif?cult to do so without knowing speci?cally which accounts or domains are at issue. 2. The DC Code is very speci?c about the Superior Court?s jurisdictional limit in issuance of search warrants within DC. Since the servers containing the records at issue here are located in Portland, Oregon, instead of DC, we would like to ask that you seek the warrants from the appropriate court. 3. Some of the requested information likely falls under the protected category of information under the Privacy Protection Act and is not subject to search and seizure pursuant to a search warrant; 4. Some of the information requested appears overbroad, requesting what amounts to all data without any limitations or a specified timeframe, likely constituting an overseizure [sic]. For instance, in one of the requests, the warrant seeks the IP addresses of over 1,000,000 Visitors to the website. (Ex. G.) To date, DreamHost has not produced any materials to the government responsive to the Court?s search warrant. ARGUMENT I. DreamHost has No Legal Basis for Failing to Produce Materials in Response to the Court?s Search Warrant The Fourth Amendment provides that ?no warrants shall issue, but upon probable cause, supported by oath or af?rmation, and particularly describing the place to be searched, and the persons or things to be seized.? A search pursuant to a search warrant is presumed lawful. Franks v. Delaware, 438 US. 154, 156 (1978). The Court?s search warrant in this case is no exception to these legal standards. On July 12, 2017, this Court determined that there was probable cause to believe that ?in the premises controlled by DreamHost, lnc., there is now being concealed property, namely stored electronic communications including but not limited to digital ?les, records, messages, and photographs as set forth more fully in Attachments A and (Ex. A.) The Court speci?ed that ?[t]his warrant applies to information associated with that is stored at premises owned, maintained, controlled, or operated by (Ex. A, Attach. A.) The Court also speci?ed the types of information that the Court ordered DreamHost to produce in response to the search warrant. (Ex. A, Attach. B, Section I.) The Court?s search warrant further speci?ed that the government could only seize information that constituted ?evidence, contraband, instrumentalities, or fruits of violations of DC. Code 22-1322.? (Ex. A, Attach. B, Section 11.) And the search warrant application was itself supported by the sworn af?davit of Detective Greggory Pemberton of the Metropolitan Police Department. DC. Code 23?521(a) (ajudicial of?cer may issue a search warrant upon application ofa law enforcement of?cer or prosecutor). Thus, there should be no dispute that the Court?s search warrant was properly issued and that DreamHost must comply with the Court?s warrant. DreamHost?s suggestion in Mr. Aghaian?s July 20 email message that the Court?s search warrant runs afoul of ?the Superior Court?s jurisdictional limits? is misguided. This Court has jurisdiction to issue search warrants requiring the provider of electronic communication services to produce records because it is ?a court of competent jurisdiction? as de?ned by 18 U.S.C. 2711. 18 U.S.C. 2703(a), Speci?cally, the Court is ?a court of general criminal jurisdiction of a State authorized by the law of that State to issue search warrants.? 18 U.S.C. See 18 U.S.C. 2510 (de?ning ?State? to include ?the District of Columbia?); 18 U.S.C. 2711(1) (adopting the de?nitions of 2510 for purposes of 2701-2712). 11. DreamHost?s Other Objections to Production are without Merit The other concerns stated in Mr. Aghaian?s July 20 email do not afford DreamHost with any justi?cation for refusing to comply with the Court?s order. ?ir_st, DreamHost?s claim that there is ?uncertainty as to the language . . . of what is requested? in Attachment B, Part II, is wholly irrelevant. That portion of the Court?s search warrant sets forth the information to be seized by the government after DreamHost complies with the Court?s order to produce the information described in Attachment B, Part 1. Consequently, there is no ?uncertainty? with that part of the Court?s search warrant that would justify DreamHost in refusing to comply with the warrant. Md, DreamHost?s objection that some of the information that DreamHost must produce pursuant to the Court?s order is ?protected . . . under the Privacy Protection Act [42 U.S.C. 2000aa, and therefore is ?not subject to search and seizure? pursuant to a search warrant also lacks merit. As a factual matter, the Court?s search warrant identi?es the precise categories of information that DreamHost must provide to the government and precise limitations on the information that the government may seize during its search. (Ex. A, Attach. B.) DreamHost has offered nothing?not even a proffer?to substantiate its concerns that any of the information the Court has required DreamHost to produce would meet the PPA standard of ?protected? materials. But even if DreamHost could satisfy that factual threshold, the PPA does not as a factual matter preclude the government from searching and seizing electronic information?even ?protected? materials?pursuant to a search warrant. Quite to the contrary, the PPA provides that the exclusive remedy for a person ?aggrieved by a search for or seizure of materials in violation of [the shall be ?a civil cause of action for 42 U.S.C. The PPA further provides ?[e]vidence otherwise admissible in a proceeding shall not be excluded on the basis of a violation of [the 42 U.S.C. Thus, DreamHost?s ?concern? regarding the PPA does not provide DreamHost with a proper basis for refusing to comply with the Court?s search warrant. M, DreamHost has raised a concern that the Court?s search warrant is ?overbroad? and may result in an ?overseizure This is simply not a sufficient basis for DreamHost to refuse to comply with the warrant. The Court has already imposed limitations on the materials that DreamHost is required to produce and on the materials that the government may seize. (Ex. A, Attach. B.) Accordingly, DreamHost?s opinion of the breadth of the warrant does not provide it with a basis for refusing to comply with the Court?s search warrant and begin an immediate production.2 CONCLUSION For the foregoing reasons, the government asks that the Court issue an order to DreamHost to show cause why DreamHost should not be compelled to comply with the warrant issued by this Court on July 12, 2017, and ordered immediately to provide to the government all of the records and information in Attachment to the warrant that are within the possession, custody, or control of DreamHost. The govemment requests that a hearing be schedule in this matter for the week of July 31, 2017. Respect?illy submitted, CHANNING D. PHILLIPS UNITED STATES ATTORNEY \Jyhnifer Kerkhoff John W. Borchert (D.C. Bar No. 472824) Assistant United States Attorneys United States Attorney?s Of?ce for the District of Columbia 555 Fourth Street, N.W. Washington, DC. 20530 July 28, 2017 (202) 252-7679 3 It is worth nothing that DreamHost has already produced documents to the government in response to a separate- request that indicate that the domain name was registered in or about October 2016-?1ess than a year ago. 7 CERTIFICATE OF SERVICE I hereby certify that copy of the foregoing was delivered to counsel for DreamHost this ?ght W. Borchert . istant United States Attorney 28th day of July 2017. EXHIBIT A Ll\ Fr 393,?" SUPERIOR COURT OF THE DISTRICT OF COLUMBIA I TO: CHLEF OF POLICE OR ANY OTHER LAW ENFORCEMENT OFFICER (Speci?c law Enforcement 0mm 0: Ciassifiutinn ofOf?t'c: ofthc Metropohtart Poiiu or other Authorized Agency, AFFIDAVIT, herewith attached, having been made before me by Detective Gretta-tow Pemberton that he has probable cause to believe that in the premises controlled bv DreamHost Inc. there is now being concealed mnertv. namely stored electronic communications includiaa but .not limited to digital ?les. records. messages. and photographs as set forth more fullv in Attachments A and B. attached hereto and incorporated herein. WHICH IS in violation ofD.C. Code 3, 22?1322 and as I am satis?ed that there is probable cause to believe that the property so described is being concealed in the above designated electronic storage and remote computing service and that the foregoing grounds for issuance of the warrant exist, YOU ARE HEREBY AUTHORIZED, within _1_0 days of the date of issuance of this warrant, to execute this warrant by emailing or faxing this warrant to the designated electronic storage and remote computing service for execution of a search of its electronic files for the electronic data speci?ed, and if the electronic data be found there, DreamHost, IS ORDERED TO ASSIST LAW ENFORCEMENT AND PRODUCE SUCH QR ELECTRONIC DATA, as detailed in Attachments A and B, to Detective Greaggrv Pemberton, and AUSA John Borchert . e33; YOU ARE FURTHER COMIVIANDED to file a copy of this warrant and return with the Court ?4 1.) on the next Court defender its execution. Issued this (lday of 2V ,20 (7 )8 ludgc, Superior Court ofthc District of Columbia RETURN 1 received the above warrant on 20 and have executed it as follows: On 20 at ., i electronically submitted the warrant to DreamHost, and requested that the provider execute a search of its electronic ?les and produce the requested information and electronic data (as detailed in the Attachments, attached herewith, to the undersigned law enforcement of?cer on or before The undersigned of?cer will supplement this return with an inventory of the information and electronic data produced by Dreaml?lost, within days. Executing Officer Subscribed and sworn to before me this day of . 20 Judge, Superior Court ofthc District of Columbia ?2\lL 1. ATTACHMENT A Property to Be Searched This warrant applies to information associated with that is stored at premises owned, maintained, controlled= or operated by DreamHost, a company headquartered at 707 Wilshire Blvd, Suite 5050, Los Angeles, California 90017. Mule (Wu-fa ?j JV 1 ATTACHMENT Particular Things to'be Seized 1. Information to be disclosed by DreamHost To the extent that the information described in Attachment A is within the possession, custody, or control of DreamHost, including any messages, records, ?les, logs, or information that have been deleted but are still available to Dreamllost, or have been preserved pursuant to a request made under 18 U.S.C. 2703(0, Dreaml?lost is required to disclose the following information to the government for each account or identi?er listed in Attachment A: a. all records or other information pertaining to that account or identi?er, including all ?les, databases, and database records stored by Dreamllost in relation to that account or identi?er; b. all information in the possession of Dreamllost that might identify the subscribers related to those accounts or identifiers, including names, addresses, telephone numbers and other identi?ers, e-mail addresses, business information, the length of service (including start date), means and source of payment for services (including any credit card or bank account number), and information about any domain name registration; 0. all records pertaining to the types of service utilized by the user, d. all records pertaining to communications between Dreaml-lost and any person regarding the account or identi?er, including contacts with support services and records of actions taken. II. Information to be seized by the government All information described above in Section I that constitutes fruits, evidence and instrumentalities of violations of DC. Code 22?1322 involving the individuals who participated, planed, organized, or incited the January 20 riot, relating to the development, publishing, advertisement, access, use, administration or maintenance of any website enumerated in Attachment A, including: 1. Files, databases, and database records stored by Dreaml?Iost on behalf of the subscriber or user operating the website, including: a. programming code used to serve or process requests made via web browsers; b. HTML, CSS, JavaScript, image ?les, or other files; 5W1 c. HTTP request and error logs; d. SSH, FTP, or Telnet logs showing connections reiated to the website, and any other transactional information, including records of session times and durations, log ?les, dates and times ofconnecting, methods of connecting, and ports; c. PostgreSQL, or other databases related to the website; email accounts and the contents thereof, associated with the account; 2. Subscriber information related to the accounts established to host the site enumerated in Attachment A, to include: a. Names, physical addresses, telephone numbers and other identi?ers, email addresses, and business information; b. Length ofservice (including start date), types of service utilized, means and source ofpayrnent for services (including-any credit card or back account number), and billing and payment infomiation; c. If a domain name was registered on behalf of the subscriber, the date that the domain was registered, the domain name, the registrant information, administrative contact information, the technical contact information and billing contact used to register the domain and the method of payment tendered to secure and register the Internet domain name. Dreaml-lost shall deliver the information set forth above via United States mail, courier, or email to the following: John W. Borchert Assistant US. Attorney .S. Attorney?s Office for the District of Columbia 555 Fourth Street, NW. Washington, DC. 20530 Email: Telephone: 202-252-7679 IN.) I) ?96? tint]. ?77? EXHIBIT Borchert, John (USADC) From: Karl Fry Sent: Friday, July 14, 2017 7:56 PM To: Borchert, John (USADC), Subject: Re: Search Warrant and Preservation (LGL-74338) Hi John, Just as a reminder -- DreamHost does not accept substituted service for production orders. We respectfully request that such orders be served either in person at our downtown Los Angeles location, or with our registered service agent CT Corporation. The addresses for both can be found on our website, here: If you already intend to serve in person as well, please disregard. Thanks, Karl Fry DreamHost Compliance Team On 7/14/17 1:49 PM, Borchert, John (USADC) wrote: Hello, Karl I have attached a search warrant that we have obtained for the disruptj20 website. Our preservation for this account dates back to January 17. lam also attaching an additional preservation letter dated today. Please let me know if you have any questions. Regards, John John W. Borchert Deputy Chief -- Felony Major Crimes Trial Section Misdemeanor Trial Unit US. Attorney?s Office for the District of Columbia Desk: 202-252-7679 Mobile: 202-870-6071 iohn.borchert@usdoi.gov EXHIBIT Borchert. John (USADC) From: Karl Fry Sent: Tuesday, July 18, 2017 8:31 PM To: Borchert, John legal@dreamhost.com Cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation (Kit?74338) Hi John, We are in receipt of the warrant that was served yesterday; thank you. We have quite a bit going on this week, but I will be in touch as soon as I have more information for you. We do appreciate your patience in the meantime. Sincerely, Karl Fry DreamHost Compliance Team dreamho s1 .com On 7/18/17 10:45 AM, Borchert, John (USADC) wrote: Hello, Karl You were personally served by the FBI yesterday. Can you please make a production to us today? Regards, John John W. Borchert Deputy Chief Felony Major Crimes Trial Section Misdemeanor Trial Unit US. Attorney?s Office for the District of Columbia Desk: 202-252?7679 Mobile: 202-870-6071 iohn.borchert@usdoi.gov From: Karl Fry Sent: Friday, July 14, 2017 7:56 PM To: Borchert, John (USADC) Subject: Re: Search Warrant and Preservation (LGL-74338) Hi John, Just as a reminder -- DreamHost does not accept substituted service for production orders. We respectfully request that such orders be served either in person at our downtown Los Angeles location, or with our registered service agent CT Corporation. The addresses for both can be found on our 1 website, here: If you already intend to serve in person as well, please disregard. Thanks, Karl Fry DreamHost Compliance Team On 7/14/17 1:49 PM, Borchert, John (USADC) wrote: Hello, Karl have attached a search warrant that we have obtained for the disrupthO website. Our preservation for this account dates back to January 17. lam also attaching an additional preservation letter dated today. Please let me know if you have any questions. Rega rds, John John W. Borchert Deputy Chief Felony Major Crimes Trial Section Misdemeanor Trial Unit U.S. Attorney?s Office for the District of Columbia Desk: 202-252-7679 Mobile: 202-870-6071 iohn.borchert@usdoi.gov EXHIBIT Borchert, John (USADC) From: Borchert, John (USADC) Sent: Wednesday, July 19, 2017 9:05 AM To: legal@dreamhost.com Cc: Kerkhoff, Jennifer (USADC) Subject: RE: Search Warrant and Preservation Hello, Karl - Thanks for your response. I sent a courtesy copy of the warrant to you last week, and you?ve had the data preserved since January. Can you please provide the materials to us today? if not, we may need to seek relief from the Court. Regards, John From: Karl Fry Sent: Tuesday, July 18, 2017 8:31 PM To: Borchert, John (USADC) Cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation (LGL-74338) HiJohn, We are in receipt of the warrant that was served yesterday; thank you. We have quite a bit going on this week, but I will be in touch as soon as I have more information for you. We do appreciate your patience in the meantime. Sincerely, Karl Fry DreamHost Compliance Team On 7/18/17 10:45 AM, Borchert, John (USADC) wrote: Hello, Karl You were personally served by the FBI yesterday. Can you please make a production to us today? Regards, John John W. Borchert Deputy Chief -- Felony Major Crimes Trial Section Misdemeanor Trial Unit US. Attorney?s Office for the District of Columbia Desk: 202?252-7679 Mobile: 202-870-6071 iohn.borchert@usdoi.gov From: Karl Fry Sent: Friday, July 14, 2017 7:56 PM To: Borchert, John (USADC) Subject: Re: Search Warrant and Preservation (LGL-74338) Hi John, Just as a reminder -- DreamHost does not accept substituted service for production orders. We respectfully request that such orders be served either in person at our downtown Los Angeles location, or with our registered service agent CT Corporation. The addresses for both can be found on our website, here: If you already intend to serve in person as well, please disregard. Thanks Karl Fry DreamHost Compliance Team On 7/14/17 1:49 PM, Borchert, John (USADC) wrote: Hello, Karl have attached a search warrant that we have obtained for the disrupthO website. Our preservation for this account dates back to January 17. lam also attaching an additional preservation letter dated today. Please let me know if you have any questions. Regards, John John W. Borchert Deputy Chief Felony Major Crimes Trial Section Misdemeanor Trial Unit US. Attorney?s Office for the District of Columbia Desk: 202-252-7679 Mobile: 202-870?6071 iohn.borchert@usdoj.gg EXHIBIT Borchert, John (USADC) From: Christopher Ghazarian Sent: Wednesday, July 19, 2017 1:57 PM To: Borchert, John (USADC) Cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation (LGL-74338) Hi John, DreamHost is having its annual ?All Hands? meeting; the entire company gathers offsite for a day-long meeting, and we?re all out of the of?ce in order to attend. You asked Karl about producing the data immediately since it has been ?preserved since January.? After reviewing the warrant, it looks like you are requesting additional data that wasn?t included in the preservations (?any messages, records, ?les, logs, or information that have been deleted but are still available to DreamHost. . . Thus, in order for us to comply with your warrant, Karl is pulling all of the new information from our database. We kindly request additional time to put together what you?re asking for once we?re back in the of?ce, and we will have an update for you as soon as possible (likely tomorrow) with production information and instructions. Best, Chris Ghazarian 1 General Counsel 213.?8?.4401 clnis@dreamhost.com chrislaw 707 Wilshire Blvd, Suite 5050. Los Angeies, CA 90017 L. DreamHost' On Jul 19, 2017, at 6:04 AM, Borchert, John (USADC) wrote: Hello, Karl - Thanks for your response. I sent a courtesy copy of the warrant to you last week, and you?ve had the data preserved since January. Can you please provide the materials to us today? If not, we may need to seek relief from the Court. Regards, John From: Karl Fry Sent: Tuesday, July 18, 2017 8:31 PM To: Borchert, John (USADC) Cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation Hi John, We are in receipt of the warrant that was served yesterday; thank you. We have quite a bit going on this week, but I will be in touch as soon as I have more information for you. We do appreciate your patience in the meantime. Sincerely, Karl Fry DreamHost Compliance Team On 7/18/17 10:45 AM, Borchert, John (USADC) wrote: Hello, Karl? You were personally served by the yesterday. Can you please make a production to ustoday? Regards, John John W. Borchert Deputy Chief -- Felony Major Crimes Trial Section Misdemeanor Trial Unit US. Attorney?s Office for the District of Columbia Desk: 202?252-7679 Mobile: 202-870-6071 iohn.borchert@usdoi.g? From: Karl Fry Sent: Friday, July 14, 2017 7:56 PM To: Borchert, John (USADC) legal@dreamhost.com Subject: Re: Search Warrant and Preservation (LGL-74338) Hi John, Just as a reminder -- DreamHost does not accept substituted service for production orders. We respectfully request that such orders be served either in person at our downtown Los Angeles location, or with our registered service agent CT Corporation. The addresses for both can be found on our website, here: If you already intend to serve in person as well, please disregard. 2 Thanks Karl Fry DreamHost Compliance Team On 7/14/17 1:49 PM, Borchert, John (USADC) wrote: Hello, Karl have attached a search warrant that we have obtained for the disruptj20 website. Our preservation for this account dates back to January 17. lam also attaching an additional preservation letter dated today. Please let me know if you have any questions. Rega rds, John John W. Borchert Deputy Chief -- Felony Major Crimes Trial Section Misdemeanor Trial Unit US. Attorney?s Office for the District of Columbia Desk: 202?252-7679 Mobile: 202-870-6071 john.borchert@usdoj.gov EXHIBIT Borchert. John (USADC) From: Aghaian, Raymond Sent: Thursday, July 20, 2017 6:22 PM To: Borchert, John (USADC) Subject: RE: RE: Search Warrant and Preservation (LGL-74338) Hi John, I represent DreamHost and have just been retained in the above referenced matter. I have a number questions regarding the search warrant that I would like to discuss with you. Can you please let me know your availability to discuss for either tomorrow afternoon or sometime on Monday? Thank you. Ray Raymond 0. Aghaian Kilpatriek Townsend 8: Stockton LLP Wilshire PH Beverly Hills, CA 90212-20t8 office 330 310 ?010 I tax 310 388 ?2398 My Profile vCard From: "Borchert, John Date: Jul 20, 2017 4:05 AM Subject: RE: Search Warrant and Preservation To: "Christopher Ghazarian? Cc: "legal@dreamhost.com" "Kerkhoff, Jennifer Thanks, Chris. Please go ahead and begin a ?rolling? production of what you have ready now. 1 would expect you have some materials that you could produce today, but let me know if: have that wrong. Regards, John From: Christopher Ghazarian Sent: Wednesday, July 19, 2017 1:57 PM To: Borchert, John (USADC) Cc: legal@dreamhost.com; Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation (LGL-74338) Hi John, DreamHost is having its annual ?All Hands? meeting; the entire company gathers offsite for a day-long meeting, and we?re all out of the of?ce in order to attend. You asked Karl about producing the data immediately since it has been ?preserved since January.? After reviewing the warrant, it looks like you are requesting additional data that wasn?t included in the preservations (?any messages, records, ?les, logs, or information that have been deleted but are still available to DreamHost. Thus, in order for us to comply with your warrant, Karl is pulling all of the new information from our database. We kindly request additional time to put together what you?re asking for once we?re back in the of?ce, and we will have an update for you as soon as possible (likely tomorrow) with production information and instructions. Best, Chris Ghazarian General Counsel 213.787.4401 1 chris@dreamhost.com chrislaw 707 Wilshire Blvd, Suite 5050, Los Angeles. CA 90017 On Jul 19, 2017, at 6:04 AM, Borehert, John (USADC) wrote: Hello, Karl - Thanks for your response. I sent a courtesy copy of the warrant to you last week, and you?ve had the data preserved since January. Can you please provide the materials to us today? If not, we may need to seek relief from the Court. Regards, John From: Karl Fry Sent: Tuesday, July 18, 2017 8:31 PM To: Borchert, John (USADC) Cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation Hi John, We are in receipt of the warrant that was served yesterday; thank you. We have quite a bit going on this week, but I will be in touch as soon as I have more information for you. We do appreciate your patience in the meantime. Sincerely, Karl Fry DreamHost Compliance Team On 7/18/17 10:45 AM, Borchert, John (USADC) wrote: Hello, Karl You were personally served by the FBI yesterday. Can you please make a production to ustoday? Regards, John John W. Borchert Deputy Chief -- Felony Major Crimes Trial Section Misdemeanor Trial Unit U.S. Attorney?s Office for the District of Columbia Desk: 202-252-7679 Mobile: 202870-6071 iohn.borchert@usdoi.gg From: Karl Fry Sent: Friday, July 14, 2017 7:56 PM To: Borchert, John (USADC) Subject: Re: Search Warrant and Preservation (LGL-74338) Great. l'm not certain I'll be out of court at that time. What are the concerns? A rolling production of whatever they have ready now is fine. Sent from my iPhone On Jul 21, 2017, at 1:37 AM, Aghaian, Raymond wrote: John Thanks for the response. They would like to comply and produce, but I have a few concerns would like discuss. 1 can call you at 11:30 am. PST, if you are available then. Thanks. Ray Raymond O. Aghaian Kilpatrick Townsend Stockton LLP 9720 Wilshire PH Beverly Hills, CA 902122018 office 310 310 7010 fax 310 388 1198 Original Message From: Borchert, John (USADC) Sent: Thursday, July 20, 2017 4:57 PM To: Aghaian, Raymond Cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation (LGL-74338) Hello, Ray- I just tried to reach you. Please call me as soon as possible at either of my numbers below. if your client is unwilling to begin an immediate rolling production, I will need to seek relief from the Court. Regards, >John Sent from my iPhone On Jul 20, 2017, at 6:22 PM, Aghaian, Raymond wrote: Hi John, I represent DreamHost and I have just been retained in the above referenced matter. I have a number questions regarding the search warrant that I would like to discuss with you. Can you please let me know your availability to discuss for either tomorrow afternoon or sometime on Monday? Thank you. Ray Raymond 0. Aghaian Kilpatrick Townsend Stockton LLP 9720 Wilshire PH Beverly Hills, CA 90212-2018 office 310 310 7010 fax 310 388 1198 My ghaianRaymondO.vcf> From: "Borchert, John Date: Jul 20, 2017 4:05 AM Subject: RE: Search Warrant and Preservation To: "Christopher Ghazarian" mhost.com>> Cc: "Kerkhoff, Jennifer Thanks, Chris. Please go ahead and begin a "rolling? production of what you have ready now. I would expect you have some materials that you could produce today, but let me know ifl have that wrong. Regards, >John From: Christopher Ghazarian Sent: Wednesday, July 19, 2017 1:57 PM To: Borchert, John (USADC) Cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation Hi John, DreamHost is having its annual "All Hands? meeting; the entire company gathers offsite for a day-long meeting, and we're all out of the office in order to attend. You asked Karl about producing the data immediately since it has been "preserved since January." After reviewing the warrant, it looks like you are requesting additional data that wasn't included in the preservations (?any messages, records, files, logs, or information that have been deleted but are still available to Thus, in order for us to comply with your warrant, Karl is pulling all of the new information from our database. We kindly request additional time to put together what you're asking for once we're back in the office, and we will have an update for you as soon as possible (likely tomorrow) with production information and instructions. Best, Chris Ghazarian General Counsel 707 Wilshire Blvd, Suite 5050, Los Angeles, CA 90017 On Jul 19, 2017, at 6:04 AM, Borchert, John (USADC) wrote: Hello, Karl - Thanks for your response. i sent a courtesy copy of the warrant to you last week, and you've had the data preserved since January. Can you please provide the materials to us today? If not, we may need to seek relief from the Court. Regards, >John From: Karl Fry Sent: Tuesday, July 18, 2017 8:31 PM To: Borchert, John (USADC) Cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation (LGL-74338) Hi John, We are in receipt of the warrant that was served yesterday; thank you. We have quite a bit going on this week, but I will be in touch as soon as I have more information for you. We do appreciate your patience in the meantime. Sincerely, Karl Fry DreamHost Compliance Team On 7/18/17 10:45 AM, Borchert, John (USADC) wrote: Hello, Karl - You were personally served by the FBI yesterday. Can you please make a production to us today? Regards, >John John W. Borchert Deputy Chief -- Felony Major Crimes Trial Section Misdemeanor Trial Unit US. Attorney's Office for the District of Columbia Desk: Mobile: From: Karl Fry Sent: Friday, July 14,2017 7:56 PM To: Borchert, John (USADC) Subject: Re: Search Warrant and Preservation (LGL-74338) Hi John, Just as a reminder -- DreamHost does not accept substituted service for production orders. We respectfully request that such orders be served either in person at our downtown Los Angeles location, or with our registered service agent CT Corporation. The addresses for both can be found on our website, here: If you already intend to serve in person as well, please disregard. Thanks, Karl Fry DreamHost Compliance Team On 7/14/17 1:49 PM, Borchert, John (USADC) wrote: Hello, Karl - I have attached a search warrant that we have obtained for the disruptj20 website. Our preservation for this account dates back to January 17. I am also attaching an additional preservation letter dated today. Please let me know if you have any questions. Regards, >John John W. Borchert Deputy Chief Felony Major Crimes Trial Section Misdemeanor Trial Unit US. Attorney's Office for the District of Columbia Desk: Mobile: Confidentiality Notice: This communication constitutes an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. Section 2510, and its disclosure is strictly limited to the recipient intended by the sender of this message. This transmission, and any attachments, may contain confidential attorney-client privileged information and attorney work product. If you are not the intended recipient, any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. Please contact us immediately by return e-mail or at 404 815 6500, and destroy the original transmission and its attachments without reading or saving in any manner. Per Treasury Department Circular 230: Any US. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.