In 2001, the USA PATRIOT Act (P.L. 107-56) amended the Pen Register and Trap and Trace Statute (pen/trap statute), 18 U.S.C. § 3121 et seq., to clarify that courts may issue pen/trap orders to collect the non-content information associated with Internet communications. One issue that has been raised in this regard is whether a pen register order may be used to collect (URLs), the terms that a person uses to request information on the World Wide Web (e.g., www.cybercrime.gov/PatriotAct.htm). Because of privacy and other concerns relating to the use of pen register orders in this fashion, use of pen registers to collect all or part of a URL is prohibited without prior consultation with CCIPS. Among the factors that should be considered in deciding whether to apply for such a pen register are (1) the investigative need for the pen register order, (2) the litigation risk in the individual case, (3) how much of any given URL would be obtained, and (4) the impact of the order on the Department's policy goals.

Consultation with CCIPS can help resolve these issues, as well as ensuring that the contemplated use of a pen register would be consistent with the Deputy Attorney General's May 24, 2002 Memorandum on "Avoiding Collection and Investigative Use of 'Content' in the Operation of Pen Registers and Trap and Trace Devices."

This policy does not apply to applications for pen register orders that would merely authorize collection of Internet Protocol (IP) addresses, even if such IP addresses can be readily translated into URLs or portions of URLs. Similarly, this policy does not apply to the collection, at a web server, of tracing information indicating the source of requests to view a particular URL using a trap and trace order.

No employee of the Department will use the pen register authority to collect URLs without first consulting with the CCIPS of the Criminal Division. Absent emergency circumstances, such an employee will submit a memorandum to CCIPS that contains (a) the basic facts of the investigation, (b) the proposed application and order, (c) the investigative need for the collection of URLs, (d) an analysis of the litigation risk associated with obtaining the order in the context of the particular case, and (e) any other information relevant to evaluating the propriety of the application. In an emergency, such an employee may telephone CCIPS at (202) 514-1026 or, after hours at (202) 514-5000, and be prepared to describe the above information.

[new September 2003]