Four days ago, an unidentified Twitter user tweeted a seizure-inducing animation at Newsweek and Vanity Fair writer Kurt Eichenwald, who has epilepsy. Now, Eichenwald has taken the first step toward identifying the user. In response to a civil suit filed by Eichenwald this week in Dallas district court, Twitter has agreed to hand over all relevant subscriber data for the user in question. The attack came in apparent retaliation for Eichenwald’s aggressive coverage of President-elect Trump.

While Eichenwald has yet to file criminal charges, the civil suit was sufficient for an ex parte order from the district judge. Twitter subsequently agreed to expedited relief, declining to challenge the order or demand further evidence from Eichenwald. The next step is likely to be a lawsuit against wireless carriers or service providers implicated by Twitter’s records, who will have records linking IP addresses and other metadata to the attacker’s legal name.

Similar legal cases have met with success in the past. Twitter reserves the right to retain IP addresses and other location data in its privacy policy. If the attacker logs into the same account even once from an identifiable phone or home address, Twitter would be able to use those IP logs to identify them. However, Twitter’s stated policy is to store those logs for only a brief period of time, and it’s unclear how much information of that kind is currently available on the user.

Reached by The Verge, a Twitter representative declined to comment on individual cases, referring questions to the company’s public guidelines for law enforcement requests. According to Twitter’s transparency report, the company received 2,520 such requests in the US in the first half of 2016, and complied with 82 percent of requests.