# What Is a Pen Register and Trap and Trace Order? | Kodex

Source: https://www.kodexglobal.com/glossary/pen-register-trap-and-trace

> Pen register and trap and trace orders capture real-time addressing data, not content. Learn the legal standard and what providers must supply.

Legal Process

## Pen Register and Trap and Trace

A pen register records outgoing addressing information and a trap and trace device records incoming addressing information, prospectively and in real time. Both capture who communicated with whom, not what was said, and both are authorised on a certification standard lower than probable cause.

Also known as
pen/trap, pen register order

Pen register and trap and trace orders are the surveillance instruments most often misunderstood by recipients, because they impose an ongoing obligation rather than a one-time production. Answering one is not a task you close; it is a capability you have to operate.

### What they capture

The terms are historical, from telephone-era devices. In modern practice both refer to real-time collection of non-content addressing data:

- Pen register: outgoing addressing information from a target account.

- Trap and trace: incoming addressing information to a target account.

In both cases the statute is explicit that the information captured must not include the contents of any communication. The line between addressing data and content is not always crisp in modern protocols, and that ambiguity is where most of the legal argument lives.

### The standard, and why it is low

Pen/trap orderWiretap order

What it captures Addressing information Communication content

Standard Certification of relevance Probable cause, plus necessity

Judicial weighing of facts Minimal Substantial

Typical duration 60 days 30 days, renewable

Notice to the target Generally delayed or none Required after the fact

The certification standard means the judge’s role is closer to confirming the application was properly made than to independently assessing whether the intrusion is justified. That design reflects a judgement, made decades ago, that addressing data is meaningfully less sensitive than content, a judgement considerably more contested now than when it was made, given how much can be inferred from communication patterns alone.

### What it means for a company receiving one

- Understand it is ongoing. The obligation runs for the order’s duration and needs an owner, a mechanism, and an end date.

- Scope the capture to addressing data. Where a protocol blurs the line, err toward the narrower reading and raise the ambiguity rather than over-collecting.

- Diarise the expiry. Collection must stop when the order lapses. Continuing past expiry is unauthorised interception.

- Check for an accompanying non-disclosure order. These are typically paired.

FAQ

### Frequently asked questions

How is a pen/trap order different from a wiretap?

A pen/trap captures addressing information: who contacted whom, and when. A wiretap captures the content of the communication itself. Because content is far more intrusive, wiretap orders require a much higher showing, including probable cause and a demonstration that other investigative methods have failed.

What standard does a pen/trap order require?

It is a certification standard rather than a factual showing. The applicant certifies that the information likely to be obtained is relevant to an ongoing criminal investigation, and the court issues the order on that certification. The judge does not independently weigh the evidence the way probable cause requires.

Is a pen/trap order prospective or retrospective?

Prospective. It authorises capturing addressing information going forward, generally for up to 60 days with extensions available. Historical records of past communications are obtained through a subpoena, a 2703(d) order, or a warrant instead.

Glossary

### Related terms

#### Electronic Communications Privacy Act (ECPA)

ECPA is the 1986 US statute governing government access to electronic communications. It has three parts: the Wiretap Act covering interception in transit, the Stored Communications Act covering data at rest, and the Pen Register Act covering real-time addressing data.

#### Court Order

A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires.

#### 2703(d) Order

A 2703(d) order is a court order compelling a provider to disclose transactional records about an account. It requires specific and articulable facts showing the records are relevant to an investigation, which sits above a subpoena’s relevance standard but below a warrant’s probable cause.

See how Kodex manages ongoing collection obligations alongside one-off requests.
Learn more