The following appeared in Friday’s Washington Post:

The news sounded horrifying: Federal prosecutors last month demanded wide-ranging electronic records regarding anyone who visited disruptj20.org, a website devoted to protesting President Donald Trump’s Jan. 20 inauguration. An astonishing 1.3 million people could be exposed. The website’s host, a Los Angeles company called DreamHost, was fighting the government’s data order. Yet on Thursday, a judge ruled for the government.

Actually, the story is more complicated, particularly after the government offered some needed assurances in a brief it released in advance of Thursday’s ruling.

It should first be clear whom the government is targeting. D.C. prosecutors, technically in the Justice Department but effectively local district attorneys, are investigating rioting that occurred after Trump’s swearing-in. Violent protesters committed tens of thousands of dollars in property damage and assaulted police officers. Some 200 people face charges. If the government were demanding data on the peaceful Women’s March on Washington, that would suggest a crackdown on dissenters. But local prosecutors are investigating serious violations of public order that cannot be considered legitimate dissent in a rule-of-law society.

Moreover, unlike other controversial episodes that have raised concerns about electronic privacy, the government is not operating in secret or behind the back of the judiciary. Rather, investigators obtained a warrant from a Superior Court judge in the District compelling DreamHost to turn over information from a website they have reason to believe was used “to coordinate and to privately communicate among a focused group of people whose intent included planned violence,” according to the government’s brief.

Though the government is asking for a large amount of data on disruptj20.com and its users, that is only the warrant’s first stage. After getting a library of electronic records, the court has authorized prosecutors to seize only particular evidence — only that relating to a crime, the rioting, and associated with those involved in committing that crime. Orin Kerr, a cyberlaw specialist at George Washington University and Post blogger,writes, “Courts have broadly allowed the government to follow this two-step procedure, in which they get all the stuff in the initial stage of electronic evidence warrants so that they can search it for the relevant evidence.”

This does not mean all of DreamHost’s concerns should be ignored. Courts must avoid chilling free speech and free association with overbroad warrants that discourage people from visiting protest websites for fear their data will be revealed and misused. The government is asking for a massive trove of information, much of which will have nothing to do with January’s rioting. The government appropriately narrowed and clarified its information request in its latest brief, assuring that it would seal away any data it collected that is irrelevant to the criminal investigation.

This clarification makes the government’s case substantially stronger, and Thursday’s ruling is reasonable. Yet clarification should not have been necessary. It should have been crystal clear before Thursday that a constitutionally reasonable search would restrict investigators from using incidental information they collected in the first stage of a computer warrant — especially when a lack of such a restriction would discourage free speech and association. The courts and Congress should contemplate how to make this a clear rule of the road.