April 4, 2000

Pen registers are surveillance devices that capture the phone numbers dialed on outgoing telephone calls; trap and trace devices capture the numbers identifying incoming calls. They are not supposed to reveal the content of communications. They are not even supposed to identify the parties to a communication or whether a call was connected, only that one phone dialed another phone. Nonetheless, in an increasingly connected world, a recording of every telephone number dialed and the source of every call received can provide a very complete picture – a profile – of a person’s associations, habits, contacts, interests and activities. For that reason, pen registers and trap and trace devices are very helpful to law enforcement and pose significant privacy concerns. Much of the current debate over surveillance standards relates to the collection of transactional data by these devices and by other means.

A 1986 federal law requires a court order for use of such devices, but the standard for approval is so low as to be nearly worthless – a prosecutor does not have to justify the request and judges are required to approve every request.

These orders apply to email and other Internet activity, but it is not clear what is the Internet equivalent of the dialing information that must be disclosed. In crucial respects, Internet addressing information can be far more revealing than telephone dialing information – not only does it reveal the precise parties who are communicating, but it can even reveal the meaning or content of communications.

Federal law enforcement agencies conduct roughly 10 times as many pen register and trap and trace surveillances as they do wiretaps. In 1996, the Justice Department components alone obtained 4,569 pen register and trap and trace orders. Most orders covered more than one line: in 1996, 10,520 lines were surveilled by pen registers or trap and trace devices. So much information is collected that Justice Department agencies have developed several generations of computer tools to enhance the analysis and linking of transactional data from pen registers and trap and trace devices.

In response to a Justice Department proposal, legislation has been introduced to authorize judges in one jurisdiction to issue pen register and trap and trace orders to service providers anywhere in the country. S. 2092. Other provisions in the bill could have the effect of greatly expanding the scope of these supposedly limited surveillance devices, allowing the collection of more personally revealing information and imposing expensive burdens on ISPs, portals, and other service providers.