Court filings say HSI subpoenaed REI for every Minneapolis-St. Paul buyer of a dark green beanie

A beanie leaves almost nothing behind at the till. What it leaves in the warehouse depends on decisions someone made in a sprint: whether the order row keeps the SKU, whether it keeps the store and the timestamp, whether it keeps a member number or an email for the digital receipt, and how long all of that survives a purge job. A demand for the transaction information of "all persons" in one metro area who bought one type of hat since 2024 hits exactly those columns ^[1].

No judge saw that query first. HSI issued the subpoena itself under 19 U.S.C. 1509 ^[6], a customs authority that Techdirt says exists for questions like import and export fees and the provenance of goods entering the country ^[7]. The case underneath it is a protest inside a church whose pastor was also an ICE officer ^[9]. Prosecutors have not managed to charge Don Lemon, formerly of CNN, or independent journalist Georgia Fort, and Techdirt says the Justice Department pressed on after two consecutive federal court rulings forbade their arrest ^[10][11].

Volume matters to whoever would have to staff a response. The REI demand was one of 92 subpoenas in the same investigation ^[3], and REI is the only recipient the filings identify by name; the other 91 recipients go unnamed ^[12]. REI did not respond to questions about whether it complied or how many customers would be affected if it did ^[2].

One demand went past stored records. The filings allege a subpoena to an unnamed airline asked for a defendant's past flights and also asked the airline to run a standing alert on that named individual, a "lookout notification" about their future travel ^[5].

Two questions per field will sort most order-history schemas. Does a user-visible feature break within thirty days if this column is dropped or truncated? Returns, warranty claims, reorder, and tax records give real answers there. Can this column, joined to one other, identify a person from a behaviour? Fields that fail the first test and pass the second are the ones to cut, and the fields that pass both should live as long as the feature needs.

A merchant can also write the subpoena against itself, borrowing the shape from the filing: all persons in one metro area who bought one SKU since a year two years back ^[1]. Running that query against production returns a row count. The count is how many customers the merchant would be naming, and shortening the retention window is the only change that lowers it before a demand arrives.