I was thinking the exact same thing. Firewalls block specific network functions not query functions in a database. That's done by ACLs and basic user security as far as I know. I guess they could of set things up in a funky database where the DNC stores the most basic info in a core database that has sim links to each campaigns individualized data in their private networks. I guess you could block what is being viewed that way by preventing the main database from even reaching the individual sub-databases held by each campaign. In the most basic sense I guess you could use a firewall for that. Seems clunky though. Then again I am not a database person.