Pen/Trap Statute: Legal Basis for Collecting Email Metadata
The government can apply for a court order to collect phone numbers and caller ID info under the Pen/Trap Statute, 18 U.S.C. §§ 3121-3127, when the information may be used for an ongoing criminal investigation. The court does not conduct an independent inquiry. District court rulings have found that this statute can apply to communications across computer networks.
A pen register is a device or process that can record numbers made from a phone, while a trap and trace device records numbers and caller ID sent to a phone. According to the Department of Justice's Computer Crime and Intellectual Property Section Criminal Division's manual, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations, "Because Internet headers contain both 'to' and 'from' information, a device that reads the entire header (minus the subject line in the case of email headers) is both a pen register and a trap and trace device, and it is commonly referred to as a pen/trap device." Mobile phones, email accounts, IP addresses, and internet user accounts are covered by the Pen/Trap statute.
An order issued under the Pen/Trap statute can trace communications made through multiple computers that are used in order to transmit data between a victim and a criminal.
An applicant does not need to state specifically what kind of communication information they are seeking, and courts are split over whether an order should specify what types of data (such email subject fields) should not be collected.
18 U.S.C. § 3121 requires that the government use all available technology to avoid collecting the content of communications. The government cannot use any content that it does collect. The courts are also split on whether or not pen/trap devices cannot be used at all if they do collect such content.
'Post-cut-through dialed digits' can be considered content. These are numbers entered after a phone call is connected, such as the password for a voicemail system.