SUPERIOR COURT OF TIIE DISTRICT OF'COLUMBIA CRIMINAL DI\TSION - F'ELONY BRANCH IN THE MATTER OF THE SEARCH OF WWW.DISRIIPTJ2O.ORG THAT IS STORED AT PREMISES OWNED, MAINTAINED, CONTROLLED, OR OPERTED BYDR.EAMHOST <- Special Proceedings Nos. 17 CSW 3438 r.) GJ HEARING RE,QUESTED CJ (,1 UNITED STATES'S MOTION F'OR DREAMHOST TO SHOW CAUSE The United States of America, by and through its attomey, the United States Attomey for the District of Columbia, hereby moves the Court to order DreamHost, Inc. ("DreamHost"), to show cause why DreamHost should not be compelled to comply with a warrant issued by this Court on July 12,2017, No. 17 CSW 3438, pursuant to 18 U.S.C. $ 2703(a), and ordered immediately to provide to the govemment certain records and information specified within Attachment B to that warant that are within the possession, custody. or control of Dreamhost, regardless of where such records or information may be stored. BACKGROTIND On July 12, 2017, this Court authorized a search warrant pursuant to 18 U.S.C. $ 2703(a), commanding DreamHost to disclose to the govemment records and information associated with the website www.disruptj20.org, including communications and content associated with the account. (Ex. A.) That website was used in the development, planning, advertisement, and organization of a violent riot that occr.rred in Washington, D.C., on January 20,2017 . Attachment A to the warrant identified the particular customer account that is the subject ofthe wanant, which was www.disruptj20.org. (Ex. A.) Attachment B, Subsection I, of the warrant, titled "Information to be disclosed by Dreamhost," ordered Dreamhost to disclose the following information for that account: a all records or other information pertaining to that account or identifier, including all files, databases, and database records stored by DreamHost in relation to that account or identifier; b all information in the possession of DreamHost that might identiry the subscribers related to those accounts or identifiers, including names, addresses, telephone numbers and other identifiers, e-mail addresses, business information, the length of service (including start date), means and source of payment for services (including any credit card or bank account number), and information about any domain name registration; c all records pertaining to the tlpes of service utilized by the user; d. records pertaining to communications between DreamHost and any person regarding the account or identifier, including contacts with support services and all records of actions taken. (Ex. A.) Attachment B, Subsection II of the warrant limited the govemment's seizure to "[a]ll information described above . . . that constitutes fruits, evidence and instrumentalities of violations of D.C. Code $ 22-13221.1" on Friday, July 14,2017,the government sent a copy ofthe court's search warrant and its attachments to DreamHost by email. (Ex. B.) DreamHost responded that same day acknowledging that it was in receipt of the search warrant but requested that the govemment personally serve a copy of the court's search warrant on DreamHost in califomia. (Ex. B.) On Monday, l[lly 17,2017,an agent from the Federal Bureau of Investigation personally delivered a copy of the search warrant to DreamHost.l (Ex. C.) DreamHost acknowledged being personally served in an email message dated July 18, r The govemment also sent copies f*-r.rii." ofthe Court's 2017' (Ex. C') search warrant to Dreamllost and to DreamHost's registered agent required.at delivery' The of pro""ss in Califomia via Federal Express ovemight delivery with signature on July 18, 2017 delivered were they that indicates packagis ;"cking information for each of tirose i.;;;;i;pd. 2 On July 19, 2017, +he goverffnent requested that DreamHost begin an immediate production of materials in response to the Court's search warrant. (Ex. D.) The govemment also cautioned DreamHost that if DreamHost did not begin to comply with the Court's search warrant, the govemment may need to seek relief from the Court. (Ex. D.) That same day, the General Counsel for DreamHost replied to the govemment that DreamHost could not respond to the Court's seruch warrant at tlut time because "the entire company" had convened at an "offsite . . . dayJong meeting" and "we're all out of the offrce." (Ex. E.) However, the General Counsel for DreamHost promised that "we will have an update for you (likely tomorrow [July 20]) with production information and instructions'" (Ex. E.) On July 20, 2017, the govemment again contacted DreamHost to request that the company begin a rolling production of materials responsive to the Court's search warrant. (Ex. F.) Later that day, the govemment received an email message from Ral.rnond Aghaian, Esq., an attomey representing DreamHost, who requested to have a telephone call with the govemment to discuss the court's search warrant. @x. F.) Later that day, the government unsuccessfully tried to reach Mr. Aghaian on the telephone to discuss this matter. (Ex. G.) The govemment also tried to reach Mr. Aghaian-again without success-the next moming, July 21,2017. (Ex. G.) on July 2 1 , 2017 , the govemment received an email message from Mr. Aghaian stating four "concems" with the Court's search warrant: There is some uncertainty as to the language in [Attachment B] Section II, pNagraph 2, that we would like to clarifu and get a better understanding of what exactly is requested. Moreover, we need to be able to inform the subscriber about the warrant, but it is difficult to do so without knowing specifically which accounts or I . domains are at issue. 2. The DC Code is very specific about the Superior Court's jurisdictional limit in issuance of search warrants within DC' Since ih" ,a*"rt containing the records at issue here are located in J Portland, Oregon, instead of DC, we would like to ask that you seek the warrants from the appropriate court. 3. Some of the requested information likely falls under the protected category of information under the Privacy Protection Act and is not subject to search and seizure pursuant to a search warrant; 4. Some ofthe information requested appears overbroad, requesting what amounts to all data without any limitations or a specified timeframe, likely constituting an overseizure [sic]. For instance, in one of the requests, the warrant seeks the IP addresses of over 1,000,000 visitors to the website. (Ex. G.) To date, DreamHost has not produced any materials to the govemment responsive to the Court's search wanant. ARGUMENT I. DreamHost has No Legal Basis for Failing to Produce Materials in Response to the Court's Search Warrant The Fourth Amendment provides that "no warrants shall issue, but upon probable cause, supported by oath or affrrmation, and particularly describing the place to be searched, and the persons or things to be seized." A search pursuant to a search warrant is presumed lawful. Franks v. Delaware,438 U.S. 154,156 (1978). The Court's search warrant in this case is no exception to these legal standards. On July 12, 2017, this Court determined that there was probable cause to believe that "in the premises controlled by DreamHost, Inc., there is now being concealed property, namely stored electronic communications including but not limited to digital files, records, messages, and photographs as set forth more fully in Attachments A and A.) The B." (Ex. ,'[t]his warrant applies to information associated v/ith court specified that www.disruptj20.org that is stored at premises owned, maintained, controlled, or operated by DreamHost[.]" (Ex. A, Attach. A.) The court also specified the types of information that the 4 Court ordered DreamHost to produce in response to the search warrant. (Ex. A, Attach. B, I.) Section The Court's search warrant further specified that the government could only seize information that constituted "evidence, contraband, instrumentalities, or fruits ofviolations of D.C. Code 5 22-1322." (Ex. A, Attach. B, Section IL) And the search warrant application was itself supported by the swom affidavit of Detective Greggory Pemberton of the Mehopolitan Police Department. D.C. Code $ 23-521(a) (a judicial officer may issue a search warrant upon application of a law enforcement officer or prosecutor). Thus, there should be no dispute that the Court's search warrant was properly issued and that DreamHost must comply with the Court's warant. DreamHost's suggestion in Mr. Aghaian's July 20 email message that the Court's search warrant runs afoul of "the Superior Court's jurisdictional limits" is misguided. This Court has jurisdiction to issue search warrants requiring the provider of electronic communication services to produce records because it is "a court of competent jurisdiction" as defined by 18 U.S.C. $2711. 18U.S.C. $$ 2703(a),(bx1XA)&(cX1XA). Specifically,theCourtis"acourtof general criminal jurisdiction ofa state authorized by the law of that state to issue search warrants." 18 U.S.C. $ 2711(3XB). See 18 U.S.C. $ 2510 (defining "State" to include "the District of Columbia"); 18 U.S.C. $ 2711(1) (adopting the definitions of $ 2510 for purposes of s5 2701-27t2). II. DreamHost's Other Objections to Production are without Merit The other concems stated in Mr. Aghaian's July 20 email do not afford DreamHost with any.justification for refusing to comply with the Court's order. First, DreamHost's claim that there is,,uncertainty as to the language. . . of what is requested" in Attachment B, Part II, is wholly irrelevant. That portion ofthe Court's search warrant sets forth the information to be 5 seized by the government after DreamHost co mplies with the Court's order to produce the information described in Attachment B, Part I. part of the Court's search warrant that would justi! Consequently, there is no "uncertainty" with that DreamHost in refusing to comply with the warrant Second, DreamHost's objection that some of the information that DreamHost must produce pwsuant to the Court's order is "protected . . . under the Privacy Protection Act [42 U.S.C. $ 2000aa, ("PPA")1," and therefore is "not subject to search and seizure" pursuant to a search warrant also lacks merit. As a factual matter, the Court's search warrant identifies the precise categories of information that DreamHost must provide to the govemment and precise limitations on the information that the govemment may seize during its search. (Ex. A, Attach. B.) DreamHost has offered nothing-not even a proffer-to substantiate its concems that any the information the court has required DreamHost to produce would meet the PPA standard ,,protected,, materials. But even if DreamHost could satisff that factual threshold, the PPA of of does not as a factual matter preclude the govemment from searching and seizing electronic information----even "protected" materials-pursuant to a search warrant. Quite to the contraly, the PPA provides that the exclusive remedy for a person "aggrieved by a search for or seizure of U.S.C. materials in violation of [the PPA]- shall be "a civil cause of action for damages[.]" 42 $ 2000aa-6(a). The PPA further provides "[e]vidence otherwise admissible in a proceeding shall Thus, not be excluded on the basis of a violation of [the PPA]." 42U.S.C. $ 2000aa-6(e)' DreamHost's ..concem" regarding the PPA does not provide DreamHost with a proper basis for refusing to comply with the Court's search warrant' Third, DreamHost has raised a concem that the court's search warrant is "overbroad" and may result in an..overseizure [sic]." This is simply not a suffrcient 6 basis for DreamHost to refuse to comply with the warrant. The Court has already imposed limitations on the materials that DreamHost is required to produce and on the materials that the govemment may seize. (Ex. A, Attach. B.) Accordingly, DreamHost's opinion of the breadth of the warrant does not provide it with a basis for refusing to comply with the Court's search warrant and begin an immediate production.2 CONCLUSION For the foregoing reasons, the govemment asks that the Court issue an order to DreamHost to show cause why DreamHost should not be compelled to comply with the warrant issued by this Cou( on July I2,2O17,and ordered immediately to provide to the govemment all of the records and information in Attachment B to the warrant that are within the possession, custody, or control of DreamHost. The govemment requests that a hearing be schedule in this matter for the week of July 3l, 2017 . ResPectfu llY submitted, CHANNING D. PHILLPS T]NITED STATES ATTORNEY By: er Kerkhoff Johr W. Borchert (D. C. Bar No. 4'72824) Assistant United States AttomeYs United States Attomey's OfIice for the District of Columbia 555 Fourth Street, N.W. Washington, D.C. 20530 (202)2s2-7679 luly 28,2017 2 It govemment in respons€-io_a s:pamte is worth nothing that DreamHost has already produced documents to the ."qr.ritfr"t irJf"# October 2016-less than a that the domain name www.iisruptj2O.org was registered in or about year ago. 7 CERTIFICATE OF SERVICE I hereby certify that copy ofthe foregoing was delivered to counsel for DreamHost this 28th day ofJuly 2017. W. Borchert United States Attomey 8 EXHIBIT A l? cs'"'-/ 3q3f SUPERIOR COURT OF THE DISTRTCT OF COLUMBIA SEARCH WARRANT TO OFFICER CHIEF OF POLICE OR ANY OTHER LAW ENFORCEMENT Poli- &p"E&d d dhe rLl'Ei"d la'nc}) (sF.i6c Ils Edolr:dld Ofia e cll$i6ou6 ofoln€ oft!. n{a6Poli.& .A.FFIDAVIT, herervith attached. haYlng been made before me by Detective Gresgory Pemberton (D2-1645) that he has probable cause to believe thal in the oremises controlled by DreamHost Inc., there ted b ications c rc co stored is now being concealed fu fo h 111 reco hereto and incorporated herein. di tal /\ITAC A a-nd B attached that *rere is probable cause S 22-1322 and as I am satisfied electronic storaqe and designated above the ed in conceal being to believe that the property so described is exist, \1'arrant ofthe issuance grounds for remote computing service and that the foregoing WHICH IS i:r violation of D.C. Code to of this warrant. YOU ARE HEREBY AUTHORIZED, WithiN 10 dAY s of the date of issuance and remote storase electonic designated warrant to the execute this rvarrant by emailing or faxi ng this and if specified. data e lectronic for the files tins se ce for execution of a search of its elecronic a the electronic data be found there, SUCH Dreamllost, iS ORDERED TO ASSIST LAW ENFORCEMENT AND PRODUCE and Penbertor:, Gregg.on' Deteotive B, to ELECTRONIC OatA, as detailed in Attachments A and llx n- l.\ YoUAREFURTHERCoMVANDEDtofileacopyofthiswarrantarrdretumwiththeCourt on the next Court dav aier ils execution t\ Issued this -P day of 20J1 I J IZ lfut- 20- I received dre above warrant on executed it as follorvs: and have M , I electronically submitted the warrant to DIg@EgslL at On , 20of i:s electronic files and produce the requested. -a ..*t"a rf**tr" **iO.r.["ut. ".&ch (as the Attachments, attached herewith, to the undelsigned law i detailed dzta infomration and electrcnic enforcement officer on or before 'fhe undersigned officer.$'ill supplement this retum rvith an inventory ofthe infomation ald electronic data produced by DreamHost, within days. Ex.cuiing - Subscribed and srvom to before me this day Omc, of \J rl \ JudEc, Sup.rior Court ITETTIRN J : O AUSA lohn Borchert { r d.. 20 ludBc, SLrp.no. Coun ofthcDtstncl ofColumbia '3 L_l c) ATTACHMENT A Property to Be Searched This rvarrant applies to information associated with wrvw.disruptj20.org that is stoled at premises omed, maintained, controlled, or operated by Drearnllost. a company headquartered at 707 Wilshire Blvd., Suite 5050, Los Angeles, Califomia 90017' -(ff. ci>- -{l .E_{yd \l s P ! -.] J ATTACHMENT B Particular Things to be Seized I. Information to be disclosed by Dreamllost To the extent that the information described in Attachrnent A is within the possession, information that custody, or control of Dreamilos! including any messages, records, files, logs, or pursuant to a requesl have been deleted but are still available to DreamHost, or have been preserved made under l8 U.S.C. $ 2703(0, DreamHost is required to disclose the following lnlormation to the government for each account or identifier listed in Attachment A: all records or other information pertaining to that account or identifier, including in relation to that account or a.ll files, databases. and database records stored by Dreamllost a. identifier; b.allinformationinthepossessionofDreamHostthatmightidentifuthesubscribers numbers and other related to those accounts or identifiers, includiag names, addresses, telephone date)' business information, the length of service (including start identifiers, e-mail addresses, card or bank account number), and means and source ofpayment for services (including any credit information about any domain name registration; c. d. c) i* __: r\ all records peftaining to the types of service utilized by the user' all records pertaining to communications -t) {-f- betrveen DreamHost and any person services and records ofactions regarding the account or identifier, including contacts with support i( q t, taken. II. Information to be seized by the goverment Al1 information described above in Section I that constitutes fruits, evidence and who participated, instn]rrrentalities of viotatioas of D.C. Code g 72-1322 nvol'tlrilg the individuals 2 planed, organized, or inciled the January 20 riot, relating advertisement, access, use, adminishation Attachment A, including l. or maintenance to the developmen! publishing' of any rvebsite enumerated in : Files, databases, and database records stored by DreamHost on behalf of the subscriber or user operating the website, including: or process requests made via web a. programming code used to serve b. HTML, CSS, JavaScript, image files, or other files; browsers; L c. d. IITTP request and error logs; SSH, FTP, or TeLnet logs showing connections related to the website' and log files, any other aransactional information, including records of session times and dwations, dates and times of eonnectiag, methods e. of connecting, and ports; MySQL, PostgreSQl, or other databases related to the website; f'.emailaccountsandthecontents&ereof,associatedwiththeaccount; 2.SubscriberinformationrelatedtotheaccouatsestablishedtohosttheSite enumerated in Attachment A, to include: a.Names,physicaladdresses,telephonenumbersandotheridentifiers,email addresses, and business infomration; b. means and Length of service (including start date), t)?es of service ut'ilized' back account number), and source of payment for services (including any credit card or billing and payment informalion; c. If a domain name was registered on behalf of the subscriber' the date that information, adminjstrative contact the domaia was registered, the domain name, the registrant the domain and the technical contact information and billing contact used to register information. domaio name' the method ofpalT nent tendered to secure and register the Intemet DreamHost shall deliver the information email to set forth above via United states mail, courier, or tle following: John W. Borchert Assistant U.S. AttorneY U.S. Attomey's Offrce for the District of Columbia 555 Fourth Street, N.W. Washington, D.C. 20530 Email : John.Borchert@usdoj.gov r5> Telephone: 202-252-7 67 9 ) r- 4 -_l 2 .-D cf) -ss. s,} ,l x ! EXHIBIT Borchert, John (USADC) Karl Fry < karl.fry@dreamhost.com > Friday, July 14, ?017 7:56 PM From: Sent: To: Borchert, John (USADC); legal@dreamhost.com Re: Search Warrant and Preservation (tGL-74338) Subject: HiJohn, Just as a reminder DreamHost does not accept substituted service for production orders. We respectfully request that such orders be served either in person at our downtown Los Angeles location, or with our registered service agent CT Corporation. The addresses for both can be found on our website, here: - https://www.d ream host.com /!eea l/eover nment-requests/ lf you already intend to serve in person as well, please disregard. Thanks, Karl Fry DreamHost Compliance Team httg / I www.d rea mhost.com On7/14177 1:49 PM, Borchert, John (USADC) wrote: Hello, Karl - attached a search warrant that we have obtained for the disruptj2o website. Our preservation for this account dates back to January 17. I am also attaching an additional preservation letter dated today. Please let me know if you have any questions. I have Regards, John John W. Borchert Deputy chief - Felony Ma.ior Crimes Trial Section Misdemeanor Trial Unit office for the District of columbia Desk:202-252-7679 Mobile: 202-87 0-607 hert usdo OV ohn.b U.S. Attorney's 7 1 EXHIBIT Borchert. John (USADC) From: Sent: To: Karl Fry < karl.fry@dreamhost.com > Tuesday, July 18, 2017 8:31 PM Borchert, lohn (USADC); legal@dreamhost.com Cc: Kerkhoff, Jennifer (USADC) Re: Search Warrant and Preservation (LGL-74338) subject: Hi Johr, week, we are in receipt of the warrant that was served yesterday; thank you. we have quite abit going on this hut I will be in touch as soon as I have more information for you' We do appreciate your patience in the meantime. Sincerely, Karl Fry DreamHost ComPliance Team http:/lwrrv drea:.nh ost. co111 onTl18lfT 10:45 AM, Borchert, John (USADC) wrote: Hello, Karl - production You were personally served by the FBI yesterday. Can you please make a to us today? Regards, .John John W. Borchert Deputy Chief - Felony Major Crimes Trial Section Misdemeanor Trial Unit U.S. Attorney's Office for the District of Columbia Desk: 207-252-7 679 Mobile: 202-87 0-607 L usdo h n. borc reamhost. ilto:ka rl.f From: Karl Fry Sent: Friday, July 14,2OL7 7:56 PM To: Borchert, John (usADc) leea Subject: Re: Search Warrant and Preservation (LGL-74338) I d reamhost.com Hi Joh n, DreamHost does not accept substituted service for production orders. We respectfully request that such orders be served either in person at our downtown Los Angeles location, or with our registered service agent cT corporation. The addresses for both can be found on our Just as a reminder - 1 website, here: httos://www. dreamhost.com /lesa l/eovernme nt -reouests/ lf you already intend to serve in person as well, please disregard. Thanks, Karl Fry DreamHost Compliance Team .com .dream http:// On7 /L4117 1:49 PM, Borchert, John (USADC) wrote: Hello, Karl - attached a search warrant that we have obtained for the disruptj2o website. our preservation for this account dates back to January 17. I am also attachin8 an additional preservation letter dated today. Please let me know if you have any questions' I have Regards, John John W. Borchert Deputy Chief - Felony Major Crimes Trial Section Misdemeanor Trial Unit U.S. Attorney's Office for the District of Columbia Deski 202-252-7 679 Mobile: ioh n.borchert@usdoi.sov 2O2-A7 0-607 t 2 EXHIBIT Borchert, John (USADC) Borchert, John (USADC) Wednesday, July 19,2017 9:05 AM legal@dreamhost.com Kerkhoff, Jennifer (USADC) RE: Search Warrant and Preservation (LGL-74338) From: Sent: To: Cc: Subject: Hello, Karl Thanks for your response. I sent a courtesy copy of the wa rra nt to you last week, and you've had the data preserved sinceJanuary. Can you please provide the materia ls to us today? lf not, we may need to seek relief from the Court' Regards, lohn From: Karl Fry [mailto:karl.fry@dreamhost.com] Sent: Tuesday, July 18, 2017 8:31 PM To: Borchert, John (USADC) ; legal@dreamhost com Cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation (LGL-74338) HiJohn, We are in receipt of the warrant that was served yesterday; thank you. We have quite a bit going on this week, but I will be in touch as soon as I have more information for you We do appreciate your patience in the meantime. Sincerely, Karl Fry Dream Host Compliance Team htto://www.d reamhost-com On7/78/17 10:45 AM, Borchert, John (USADC) wrote: Hello, Karl - you were personally served by the FBI yesterday. Can you please make a production to us today? Regards, John John W. Borchert Deputy Chief Felony Major Crimes Trial Section Misdemeanor Trial Unit : 1 U.S. Attorney's Office for the District of Columbia Desk 202-252-7 679 Mobile: 202-870-6071 ohn. rche rt u sdo mhost.com ilto:ka rl.f From: Karl Fry Sent: Friday, July 14,2077 7:56PM To: Borchert, John (USADC) ; legal@dreamhost com Subiect: Re: Search Warrant and Preservation (LGL-74338) Hi John, DreamHost does not accept substituted service for production orders. we respectfully request that such orders be served either in person at our downtown Los Angeles location, or with our registered service agent cT corporation. The addresses for both can be found on our Just as a reminder - website, here: https://www.dream h com/leeal/ overnment-re ouests/ lf you already intend to serve in person as well, please disregard. Thanks, Karl Fry DreamHost Compliance Team htto:/,/www.d reamho st.com On7l74/!7 1:49 PM, Borchert, John Hello, Karl (USADC) wrote: - attached a search warrant that we have obtained for the disruptj20 website. our preservation for this account dates back to January 17. I am also attaching an additional preservation letter dated today. Please let me know if you have any q uestions' I have Rega rds, John John W. Borchert Deputy Chief - Felony Major Crimes Trial Section Misdemeanor Trial Unit U.S. Attorney's Office for the District of columbia Desk: 202-252-7 679 Mobile: 202-870-607 iohn. rchert@usdo Lgov 7 2 EXHIBIT Borchert, John USA > Christopher Ghazarian wrote On Jul 19, 2Ot7 , at 6:04 ANL Borchert, John (USADC) Hello, Ka rl - Thanksforyourresponse.lsentacoudesycopyofthewarranttoyoulastWeek,andyou,Vehadthe not, we may need to data preserved since January. can you please provide the materials to us today? lf seek relief from the Court. Regards, lohn From: Karl Fry [mailto:karl.frv@dreamhost.coml Sent: Tuesday, JulY 18, 2017 8:31 PM To: Borchert, John (USADC) ; lesa l@dream host.com 1 cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation (LGL-74338) Hi John, going on we are in receipt ofthe warrant that was served yesterday; thank you. we have quite a bit you' for this week, but I will be in touch as soon as I have more information We do appreciate your patience in the meantime. Sincerely, Karl Fry DreamHost ComPliance Team d rea m host.com http: On 7 /78/17 10:45 AM, Borchert, John (USADC) wrote: Hello, Karl - production to You were personally served by the FBI yesterday. Can you please make a us today? Regards, lohn John W. Borchert Deputy Chief - Felony Major Crimes Trial Section Misdemeanor Trial Un:t U.S. Attorney's Office for the District of Columbia Desk: 202-252-7 679 Mobile: 202'870-601 1 iohn .bo rchear(a usdoi gov host.com dre rl-f From: Karl Fry mailto PM Sent: Friday, July L4,2077 7:56 To: Borchert, John (USADC) ; lesal@dreamhost com Subiect: Re: Search Warrant and Preservation (LGL-74338) Hi John, Just as a reminder - DreamHost does not accept substituted servlce for production orders. We respectfully request that such orders be served either in person at our downtown Los Angeles location, or with our registered service agent CT Corporation. The addresses for both can be found on our website, here: httos://www.d reamhost.co m/leeal/ ernme nt-reouests/ lf you already intend to serve in person as well, please disregard' 2 Tha nks, Karl Fry DreamHost Compliance Team .com .dreamh http: on7/14/L7 1:49 PM, Borchert, John Hello, Karl (USADC) wrote: - attached a search warrant that we have obtained for the disruptj2o website. Our preservation for this account dates back to January 17. I am also attaching an additional preservation letter dated today. Please let me know if you have any questions. I have Regards, Joh n John W. Borchert Deputy Chief - Felony Major Crimes Trial Section Misdemeanor Trial Unlt U.S. AttorneYs Office for the District of Columbia Desk: 202-252-7 679 Mobile: 202-87 0-607 7 iohn.borchert@usdoi.sov 3 EXHIBIT Borchert, John (USADC) From: Sent: To: Subject: Aghaian, Raymond < RAghaian@kilpatricktownsend.com > Thursday, July 20, 2017 6:22 PM Borchert, John (USADC) RE: RE: search Warrant and Preservation (LGt-74338) HiJohn, I have a number questions I represent DreamHost and I have just been retained in the above referenced matter. please let me know your availa bility to regarding the search warrant that lwould like to discuss with you. can you you' discuss for either tomorrow afternoon or sometime on Monday? Thank Ray Raymond O. Aghaian Kilpatrick Townsend & Stockton LLP 97i0 wilshire Blvd PH I Beverlv Hills, CA90212-2018 offrce 310 310 7010lfax 310 388 1198 .aohaian@kilpatricktownsend.com I Mv Profle I vcard From: "Borchert, John (USADC)" Date: Jul 20,2017 4:05 AM Subject: RE: Search Warrant and Preservation (LGL-743 3 8) To: "ChristoPher Ghazarian" , "Kerkhoff, Jennifer ([JSADC)' Cc: "le l would expect you have chris. Please go ahead a nd begin a "rolling" production of what you have ready now that wrong' some materials that you could produce today, but let me know if I have Thanks, Regards, John From: Christopher Ghazarian Imailto:christopher.ghazarian @d ream host com] Sent: Wednesday, JulY 19, 2017 1:57 PM To: Borchert, John (USADC) gov> cc: lepal@dream host.com; Kerkhoff, Jennifer (USADc) wrote: Hello, Karl - 2 Thanks for your response. lsentacourtesycopyofthewarranttoyoulastweek,andyou'vehadthe need to data preserved since January. can you please provide the materials to us today? lf not, we may seek relief from the Court- Regards, John From: Karl Fry [mailto:ka rl.fry@drea mhost.coml Sent: Tuesday, JulY 18,2017 8:31 PM To: Borchert, John (USADC) ; leeal@ d ream host.com Cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation (tGL-74338) Hl John, quite a blt going on we are in receipt ofthe warrant that was served yesterday; thank you. we have you' this week, but I will be in touch as soon as I have more information for We do appreciate your patience in the meantime. Sincerely, Karl Fry DreamHost ComPliance Team http://www. dre amhost.com on 7 llSlU 10:45 AM, Borchert, John (USADC) wrote: Hello, Karl - You were personally served by the FBI yesterday. Can you please make a production to us today? Rega rds, 3 John Joh n W. Borchert Deputy Chief - Felony Major Crimes Trial Section Misdemeanor Trial Unit U.S. AttorneY's Office for the District of Columbia Desk:20 2-?52-7 io h n.bo rc he 67 9 N,4obile: 202-87 L rt @usdoi gov . From: Karl Fry [mailto:ka rl.frv@d reamhost'coml Sent: Friday, JulY f4,2OL7 7:56 PM qov>; lega 1,6 drea mhost.com To: Borchert, John (USADC) Friday, luly 21,2017 1 :43 PM Borchert, John (USADC) Kerkhoff, Jennifer (USADC) RE: Search Warrant and Preservation (LGL-74338) From: Sent: To: Cc: Subject: John, sorry I missed your call this morning, busy morning. There are a few concerns and we would like to resolve as expeditiously as possible to get you the production. My concerns consist of the following: that we would like to clarify and get a to inform the subscriber about the better warrant, but it is difficult to do so without knowinS specifically which accounts or domains are at issue. 1. There is some uncertainty as to the language in Section ll, paragraph 2, understanding ofwhat exactly is requested. Moreover, we need to be able limit in issuance of search warrants of withln DC. Since the servers containing the records at issue here are located in Portland, Oregon, instead we would like to ask that you seek the warrants from the appropriate court' 2. The DC Code is very specific about the Superior Court's jurisdictional DC, the Privacy 3. Some of the requested information likely falls under the protected category of information under protection Act and is not subject to search and seizure pursuant to a search warrant; without any 4. Some of the information requested appears overbroad, requesting what amounts to all data the requests, one ofthe limitations or a specified timeframe, likely constituting an overseizure. For instance, in warrant seeks the lP addresses of over 1,000,000 visitors to the website' making the My suggestion would be to resolve concerns 1 and 2 first and then allow DreamHost to begin expeditiously before roilin;;roduction to either the court or a special master for the records at issue so we can resolve the concerns Thank proceed accordingly. we your can thoughts and making the production to the government. Please let me know you. Ray Raymond O. Aghaian Kilpatrick Townsend & Stockton LLP 9720 Wilshire Blvd PH I Beverly Hills, CA 90212-2018 office 310 310 7010 fax 310 388 1198 raghaian@kilpatricktownsend.com I www.kilpatricktownsend.com ---Original Message--From: Borchert, John (USADC) [mailtolohn.Borchert@usdoj.Bov] Sent: Friday, Juty 21, 2017 10:04 AM To: Aghaian, Raymond cc: Kerkhoff, Jennifer (USADC) Subject: RE: Search Warrant and Preservation (LGL-74338) Hello, Ray - ljust tried again to reach you on the phone and left another 1 message. Can a rolling production start today? Rega rds, Joh n ---Original Message----From: Borchert, .,ohn (USADC) Sent: Friday, July 21, 2017 6:59 AM To: Aghaia n, Raymond Cc: Kerkhoff, Jennifer (USADC) Subject: Re: Search Warrant and Preservation (LGt-74338) Great. I'm not certain l,ll have ready now is fine. beoutofcourtatthattime. What are the concerns? A rolling production ofwhateverthey Sent from my iPhone > on Jul 21, 20L7, at7:37 AM,Aghaian, Raymond Wrote: for the response. They would like to comply and produce, but I have I can callyou at 11:30 a.m. PST, if you are available then. Thanks' > John - Thanks a few concerns I would like discuss' > Ray > Raymond O. Aghaian > Kilpatrick Townsend & Stockton LLP gOZLz-zOtg > 9720 Wilshire Blvd PH I Beverly Hills, CA > office 310 310 7010 fax 310 388 1198 raghaian @kilpatricktownsend'com > www.kllpatricktownsend.com > :--Original Message--- > From: Borchert, lohn (USADC) [mailto:John.Borchert@usdoj'gov] > Sent: Thursday, July 20,2017 4:57 PM To: Aghaian, Raymond > Cc: Kerkhoff, Jennifer (USADC) > Subject: Re: Search Warrant and Preservation (LGL-74338) > > Hello, Ray- lf your client is unwilling > I just trled to reach you. please call me as soon as possible at either of my numbers below. begin an immediate rolling production, I will need to seek relief from the Court' > Regards, > John > Sent from my iPhone 2 to > On Jul 20, 20f7, at 6:22 PM, ABhaian, Raymond > wrote: > Hi John, questions > I represent DreamHost and I have just been retained in the above referenced matter. I have a number your availability to regarding the search warrant that I would like to discuss with you. Can you please let me know discuss for either tomorrow afternoon or sometime on Monday? Thank you' > Ray > Raymond o. Aghaian > Kilpatrick Townsend & Stockton LLP > 9720 Wilshire Blvd PH I Beverly Hills, cA 90212-2018 office 310 310 > 7010 fax 310 388 1198 > raghaian @kilpatricktownsend.com> lMy > Profile als/A/AghaianRaymondOl668l.aspx> > vCardchttp://www.kilpatricktownsend.com/-assets/vcards/professionals/A > ghaianRaymondO.vcf> > From: "Borchert, John (USADC)" > > > Date: Jul 20,20L7 4:05 AM > Subject: RE: Search Warrant and Preservation (LGL-74338) > To: "christopher Ghazarian" > mhost.com>> > Cc: "legal@dreamhost.com" > >, " Kerkhoff, Jennifer > (usADc)" > expect you have chris. Please go ahead and begin a "rolling" production of what you have ready now l would wrong' some materials that you could produce today, but let me know if I have that > Thanks, > Regards, > John > From: ChristoPher Ghazarian > [mailto:christopher.ghazarian@dreamhost.com a n@dreamhost.com>] > Sent: WednesdaY, JulY 19, 2ot7 7:57 PM > To: Borchert, John (USADC) > > > cc: legal@dreamhost.com; Kerkhoff, > Jennifer (USADC) > > Subject: Re: Search Warrant and Preservation (LGL-74338) 3 > Hi John, > DreamHost is havinB its annual "All Hands" meeting; the entire company gathers offsite for a day-long meeting, and we're all out ofthe office in orderto attend. you asked Karl about producing the data immediately since it has been "preserved since January." After reviewing the warrant, it looks like you are requesting additional data that wasn't included in the preservations ("any messages, for us records, files, logs, or information that have been deleted but are still available to DreamHost...."). Thus, in order to com ply with your warrant, Karl is pulling all of the new information from our database. > We kindly request additionaltime to put together what you're asking for once we're back in the office, and we will have an update for you as soon as possible (likely tomorrow) with production information and instructions' > > Best, > Chris Ghazarian I General Counsel > 273.7 87 .44oL > chris@dreamhost.com I > chris.law > 707 Wilshire Blvd, Suite 5050, Los Angeles, CA 90017 > on Jul 1g, 2017, at 6:04 AM, Borchert, John (USADC) > wrote: > > Hello, Karl - preserved for your response. lsenta courtesy copy of the warrant to you last week, and you've had thedata relieffrom the court' since January. Can you please provide the materials to us today? lf not, we may need to seek > Thanks > Regards, > John > From: Karl Fry [mailto:karl.fry@dreamhost.com] > Sent: Tuesday, luly 18,2017 8:31 PM > To: Borchert, John (USADC) > >; > legal@dreamhost.com > Cc: Kerkhoff, Jennifer (USADC) Kerkhoff @usa.doj.gov> > Subject: Re: Search Warrant and Preservation (LGt-74338) > Hi John, we are In receipt ofthe warrant that was served yesterday; thank you. we have quite a bit goin8 on this week, but will be in touch as soon as I have more information for you. > I > We do appreciate your patience in the meantime. > Sincerely, > Karl Fry > DreamHost Compliance Team > http://www.dreamhost.com > On7/18/17 10:45 AM, Borchert,.lohn (USADC) wrote: > Hello, Karl > You were personally served by the FBI yesterday. Can you please make a production to us today? > Regards, > John > John W. Borchert - > Deputy Chief Felony Major Crimes Trial Section Misdemeanor Trial > unit u.s. Attorney's office for the District of columbia > Desk: 202-252-7 67 9 Mobile: > 202 -87 O - 607 1 > john.borchert@usdoj.Sov > From: Karl Fry [mailto:karl.fry@dreamhost.com] > Sent: Friday, July t4,2077 7:56 PM > To: Borchert, John (USADC) > ; > legal@dreamhost.com > Subject: Re: Search Warrant and Preservation (LGL-74338) > Hi John, reminder -- DreamHost does not accept substituted service for production orders. We respectfully request that such orders be served either in person at our downtown Los Angeles location, or with our registered service agent CT Corporation. The addresses for both can be found on our website, here: > Just as a > https://www.dreamhost.com/legal/government-requests/ > lf you already intend to serve in person as well, please disregard. > Thanks, > Karl Fry > DreamHost Compliance Team > http://www.dreamhost.com > on 7 h4/17 1:49 PM, Borchert, John (usADc) wrote: > Hello, Karl > I have attached a search warrant that we have obtained for the disruptj2o website. Our preservation for this account dates back to January 17. lam also attaching an additional preservation letter dated today. Please let me know if you have any questions. 5 > Regards, > John > John W. Borchert > Deputy Chief Felony Major Crimes Trial Section Misdemeanor Trial > Unit U.S. Attorney's Office for the District of Columbia - > Deski 202-252-7 679 Mobile: > 202-87 0-607 1 > john.borchert@usdoj.govcmailto:john.borchert@usdoj.gov> confidentiality Notice: Communications > This communication constitutes an electronic communlcation within the meanlng of the Electronic sender of this by the intended recipient to the limited privacy Act, 1g U.S.C. Section 2510, and its disclosure is strictly privileged and information message. This transmission, and any attachments, may contain confidential attorney-client of any of the attorney work product. lf you are not the intended recipient, any disclosure, copying, distribution or use by us immediately Please contact PROHIBITED. information contained in or attached to this transmission is STRICTLY in or saving reading return e-mail or at 404 815 6500, and destroy the original transmission and its attachments without > any manner. > ***DISCLAIMER*++ per Treasury Department Circular 230: Any U.S. federal tax advice contained in this (including any attachments) is not intended or written to be used, and cannot be used, for the purpose communication to another of (i) avoiding penalties under the lnternal Revenue Code or (ii) promoting, marketing or recommending party any transaction or matter addressed herein. 6