The day of President Donald Trump’s inauguration was met by protests in the United States. Now, the Department of Justice (DOJ) is demanding the IP addresses of all of the visitors who visited the website – disruptj20.org – that helped organise the anti-Trump rally. This equates to some 1.3 million.

On top of the IP addresses, DreamHost said that the DOJ wanted the more details of thousands of visitors, including contact information, email content and photos.

>See also: What Trump means for technology

DreamHost, the web service provider, is refusing to agree to the DOJ request and will be in court later this month. A hearing on the issue is due on 18 August.

The question remains, why are these IP addresses being demanded?

“The website was used in the development, planning, advertisement and organisation of a violent riot that occurred in Washington DC on January 20, 2017,” the DOJ wrote in its motion to the Superior Court of the District of Columbia.

It also suggested that “a particular customer” was the subject of the warrant, but does not explain why it needed the information of 1.3 million visitors.

>See also: The state of global tech hiring in the Trump era

This request is nothing new and DreamHost made this clear. It noted in a blog post that many web service providers are regularly approached by law enforcement to help in criminal investigations.

The Electronic Frontier Foundation, the Civil liberties group helping DreamHost fight the case, said: “No plausible explanation exists for a search warrant of this breadth, other than to cast a digital dragnet as broadly as possible.”