Pen Registers and Trap-and-Trace: Surveillance a Judge Cannot Refuse

The names are older than the technology. A pen register was a device that recorded the pulses of a rotary dial, capturing the number dialled without capturing the conversation. A trap and trace device did the reverse, identifying the originating number of incoming calls. Both are now defined in United States law at 18 U.S.C. sections 3121 to 3127, and both have been stretched a very long way from the telephone exchange.

The two-tier design

American communications surveillance law splits along a line drawn in the 1970s: content on one side, everything else on the other.

Content, meaning the words of a call or the body of a message, is protected under the Wiretap Act. Getting it requires probable cause, a judicial finding, a showing that other investigative techniques have failed or would be too dangerous, minimisation requirements, periodic reports to the court, eventual notice to the target, and a suppression remedy if the rules are broken. It is one of the most demanding processes in federal criminal procedure.

Non-content, meaning the dialling, routing, addressing and signalling information, sits under the Pen Register Act, and the difference is not one of degree.

An order runs for sixty days and may be extended for further sixty-day periods. The provider is directed not to disclose its existence. There is no notice requirement to the person whose communications are being tracked, and no statutory suppression remedy: evidence obtained under a defective pen register order is generally not excluded from trial, which removes the usual mechanism by which surveillance rules get tested in court.

Why the standard is so low

The constitutional foundation is Smith v. Maryland, decided in 1979. Police asked a telephone company to record the numbers dialled from a robbery suspect's home. No warrant. The Supreme Court held that installing a pen register was not a search under the Fourth Amendment, because a caller voluntarily conveys dialled numbers to the phone company in order to place the call, and therefore has no reasonable expectation of privacy in them.

That is the third-party doctrine, and Congress built the Pen Register Act on top of it. If the Fourth Amendment does not apply, the statutory standard can be whatever the legislature chooses, and what it chose was a certification of relevance.

The reasoning was not unreasonable for a rotary phone in 1979, where the metadata was a handful of ten-digit numbers per day. It has aged badly. A modern device generates a continuous stream of addressing information about which services you use, when you wake up, who you contact and in what order. We have written separately about how far the third-party doctrine has been stretched, and about the wider gaps in the 1986 statute that governs stored communications.

What the PATRIOT Act changed

The original definitions were written for telephone numbers. In 2001 the USA PATRIOT Act rewrote them to cover "dialing, routing, addressing, or signaling information" transmitted by any instrument or facility, while excluding "the contents of any communication."

That single change moved the entire internet under a statute designed for the telephone network, and it left the content boundary to be worked out case by case. Some of the resulting positions are settled and some are not.

• Email to and from headers: treated as addressing information, collectable under a pen register order.
• Subject lines: content, and outside the authority.
• IP addresses you connect to: treated as addressing information.
• Full URLs: contested. A path or query string can reveal what you searched for or read, which is closer to content than to a destination, and courts have not converged.
• Post-cut-through dialed digits: the digits pressed after a call connects, which may be menu selections or may be an account number and PIN. Courts have split, and the practical answer has been internal minimisation policy rather than a clear rule.

That list is the whole problem in miniature. Whether a given fact requires probable cause or a rubber stamp turns on a content classification that the technology stopped respecting decades ago.

Cell-site simulators, and where the limits came from

For years, federal applications for cell-site simulators were often made under pen register authority. The devices impersonate a cell tower, cause nearby handsets to register with them, and collect identifiers, which agencies argued was signalling information rather than content or location tracking. Defence lawyers frequently could not tell from the paperwork that a simulator had been used at all.

In September 2015 the Justice Department issued a policy requiring a search warrant supported by probable cause for cell-site simulator use in most circumstances. That is a policy, not a statute: it binds federal components, has exceptions, and does not by itself constrain the many state and local agencies operating the same hardware.

The Supreme Court moved the line once, in Carpenter v. United States in 2018, holding that acquiring historical cell-site location records is a Fourth Amendment search requiring a warrant. The opinion was deliberately narrow. It did not overrule Smith, did not address real-time collection, and expressly declined to disturb conventional pen register and trap-and-trace practice.

The intelligence-side version

A parallel authority exists in the Foreign Intelligence Surveillance Act at 50 U.S.C. sections 1841 and following, running through the Foreign Intelligence Surveillance Court. The government certifies relevance to an authorised foreign intelligence or terrorism investigation, and the court issues the order.

This authority was the legal basis for a bulk internet metadata program that operated from roughly 2004 until 2011, in which the relevance standard was read to cover collection at enormous scale. That reading became public through the 2013 disclosures and did not survive the ensuing scrutiny. It stands as the clearest available demonstration of what "relevant to an investigation" can be made to mean when no adversary is present to contest it. Related instruments are covered in our pieces on national security letters and Section 702.

The two orders side by side

	Wiretap (Title III)	Pen register / trap and trace
Standard	Probable cause, found by a judge	Prosecutor certifies relevance
Judicial discretion	Yes, the court may refuse	The court shall enter the order
Duration	30 days, extendable	60 days, extendable
Notice to the target	Required after the fact	None
Suppression remedy	Yes	No statutory remedy
Reaches	What was said	Who, when, how often, from where

What follows for anyone building or choosing tools

Encryption matters here, but it only reaches one of the two categories. Content and metadata are defended by different means, and cryptography defends the first far better than the second.

Content encryption is genuinely effective here. A provider compelled to hand over message bodies it cannot read hands over ciphertext. That is a real limit, and it is the reason compelled-access proposals keep returning to breaking or bypassing the encryption itself rather than to the legal process.

Metadata is the harder half. The record of which account contacted which account at what time is produced by the act of delivery, and any system that routes messages generates some version of it. Reducing that record is a design problem, not a policy one: sealed sender constructions, mix networks, cover traffic, and minimal retention all attack it from different angles, at real cost in latency, complexity or reliability.

The reason it deserves the attention is the standard described above. Getting your words takes probable cause and a judge who can say no. Getting the pattern of your associations takes a certification that a judge is required to accept. Under that asymmetry, the engineering priority for a communications system is to generate as little of the second category as it can, because that is the category the law leaves least protected.