Burned limoCarol Guzy/ZUMA Press/NewscomA judge has added new limits to a warrant the Justice Department is using to try to track down the anti-Trump activists who disrupted Inauguration Day activities.

As part of an effort to identify any protester who did anything illegal in D.C. the day Donald Trump was sworn in as president, the Department of Justice served a warrant against the web host DreamHost. The warrant was absurdly broad, attempting to get private data on anybody who had so much as visited DisruptJ20.org, a site used to organize anti-Trump protests. According to the company, the warrant as initially submitted would have required it to hand over the IP addresses of more than a million visitors to the site.

DreamHost announced it was resisting the warrant, calling it an overly broad fishing expedition and a threat to free speech. It certainly could cause a chilling effect if the government were able to simply demand the names of anyone who visited a website critical of the president. Just today, Trump was pretty clearly suggesting that he’d like to find some way to retaliate against media outlets whose reporting he dislikes.

The Department of Justice then retreated and said it would refine the request. Superior Court Judge Robert E. Moran approved a more limited warrant and ordered the Justice Department to put protocols in place to limit access to private information that had nothing to do with a criminal investigation.

Yesterday Judge Moran put out a final order that made it clear he’s not going to let the Justice Department just wade through personally identifiable private information without any probable cause. DreamHost will be permitted to redact user information, and the Department of Justice won’t be able to access it unless it can show that a particular user is suspected of criminal activity.

“While the government has the right to execute its warrant,” Moran noted in his order, “it does not have the right to rummage through the information contained on DreamHost’s website and discover the identity of, or access communications by, individuals not participating in alleged criminal activity, particularly those persons who were engaging in protected 1st Amendment activities.”

Kudos to DreamHost for putting up a fight here. As a third party host, it’s not the one being investigated for misconduct, but it’s using the revenue it earns from its customers to help protect those customers’ privacy from an overreaching government.