Legal Definitions - Pen register

A pen register is a law enforcement device or process used to record outgoing communication data from a specific phone or computer. It captures information like dialed phone numbers or internet addresses contacted, but it does not record the actual content of the communications.

A pen register is a technological tool or process, frequently employed by law enforcement, designed to record the identifying information of outgoing communications from a specific telephone or computer. It essentially creates a log of where a person's communications are directed. This includes details like the phone numbers dialed, the IP addresses contacted, or the domain names visited. Crucially, a pen register collects only this "metadata" about the communication's destination; it does not capture the actual content of the communication itself, such as the words spoken during a phone call, the text of an email, or the specific data exchanged during an internet session.

• Imagine law enforcement suspects an individual is coordinating illegal activities using a particular mobile phone. With a court order, they could deploy a pen register on that phone line. The register would then record every phone number the suspect calls or texts, providing a comprehensive list of all outgoing communication destinations. It would show, for example, that the suspect called "555-123-4567" at 10:15 AM and texted "555-987-6543" at 11:00 AM. However, it would not reveal what was said during the call or the content of the text messages. This illustrates how the device traces outgoing signals (calls/texts) to their destination (other phone numbers) without capturing the substantive information.

• Consider a scenario where investigators believe a person is using their home computer to access specific websites or communicate with co-conspirators online as part of a cybercrime operation. If authorized by a court, a pen register could be applied to the suspect's internet connection. This would log the IP addresses or domain names of all external servers and websites that the suspect's computer initiates connections with. For instance, it might show that the computer connected to "malicious-server.com" or accessed a specific IP address associated with a known illicit forum. What it would not reveal is the specific web pages viewed on those sites, the content of any messages sent through those connections, or any files downloaded. This demonstrates its application to internet traffic, tracing outgoing connections to their online destinations without capturing the data exchanged.