“In this case, however, PSF determined with the advice of counsel that our only course of action was to provide the requested data.”
The Justice Department sent the Python Software Foundation three subpoenas for five PyPI usernames and gave no reason. It asked for names, IP addresses, payment records and IP download logs of every package those accounts uploaded. The download logs reach everyone who installed those packages, not only the five targets. PyPI handed it all over and only now is writing a data retention policy. Data you keep is data the government can take.