Pen register and trap and trace orders are the surveillance instruments most often misunderstood by recipients, because they impose an ongoing obligation rather than a one-time production. Answering one is not a task you close; it is a capability you have to operate.
What they capture
The terms are historical, from telephone-era devices. In modern practice both refer to real-time collection of non-content addressing data:
- Pen register: outgoing addressing information from a target account.
- Trap and trace: incoming addressing information to a target account.
In both cases the statute is explicit that the information captured must not include the contents of any communication. The line between addressing data and content is not always crisp in modern protocols, and that ambiguity is where most of the legal argument lives.
The standard, and why it is low
| Pen/trap order | Wiretap order | |
|---|---|---|
| What it captures | Addressing information | Communication content |
| Standard | Certification of relevance | Probable cause, plus necessity |
| Judicial weighing of facts | Minimal | Substantial |
| Typical duration | 60 days | 30 days, renewable |
| Notice to the target | Generally delayed or none | Required after the fact |
The certification standard means the judge’s role is closer to confirming the application was properly made than to independently assessing whether the intrusion is justified. That design reflects a judgement, made decades ago, that addressing data is meaningfully less sensitive than content, a judgement considerably more contested now than when it was made, given how much can be inferred from communication patterns alone.
What it means for a company receiving one
- Understand it is ongoing. The obligation runs for the order’s duration and needs an owner, a mechanism, and an end date.
- Scope the capture to addressing data. Where a protocol blurs the line, err toward the narrower reading and raise the ambiguity rather than over-collecting.
- Diarise the expiry. Collection must stop when the order lapses. Continuing past expiry is unauthorised interception.
- Check for an accompanying non-disclosure order. These are typically paired.