Still "Penned" In: Seventh Circuit Holds IP Address Pen Register Orders Still Constitutional After Carpenter

• Published date: 01 October 2021
• Subject Matter: Government, Public Sector, Media, Telecoms, IT, Entertainment, Privacy, IT and Internet, Data Protection, Privacy Protection, Constitutional & Administrative Law
• Law Firm: Arnold & Porter
• Author: Mr Elliot S. Rosenwald, Jayce Born and Ronald D. Lee

In 2016, Edward Soybel, a disgruntled former employee, began perpetrating cyberattacks against his former employer, W.W. Grainger, Inc. (Grainger), an industrial supply company. One of Grainger's key service offerings, KeepStock, uses large database tables stored on Grainger's computers to help its customers keep track of their inventory. By remotely logging into KeepStock and deleting millions of records, Soybel effectively rendered KeepStock useless for several days until Grainger was able to restore the data.

Grainger called in the FBI, which determined that the IP address from which the attacks had been perpetrated belonged to the master router used for all outgoing internet traffic from the large Chicago apartment building in which Soybel resided. To identify which unit in the building had generated the attacks, the FBI had to obtain information from the master router itself, so it sought to place two tracking devices: one to track what IP addresses the master router accessed, and another to track what IP addresses Soybel's unit accessed (like the Seventh Circuit, we'll refer to these two devices collectively as a "pen register"). After showing that the IP address information was "relevant to an ongoing investigation," the FBI obtained an order pursuant to the Pen Register Act and installed the pen register.

By correlating the timing of the IP address data derived from the pen register-but without having access to the contents of the transmissions-the FBI determined that the attacks had emanated from Soybel's unit. Soybel was arrested and charged with 12 counts of violating the Computer Fraud and Abuse Act and ultimately was convicted by a jury on all 12. On appeal, Soybel argued that the FBI's use of the pen register without a warrant, which would have required the government to show probable cause rather than just that the information was "relevant" to an investigation, violated his Fourth Amendment rights. In a September 8, 2021 opinion, the Seventh Circuit rejected this argument and affirmed Soybel's conviction.

Soybel grounded his appeal in the Supreme Court's landmark Fourth Amendment decision Carpenter v. United States, 138 S. Ct. 2206 (2018), which issued while Soybel's charges were pending. In Carpenter, the Court held unconstitutional a statutory scheme that permitted access to historical cell site location information (CSLI) by court order and without a warrant, similar to the Pen Register Act. Soybel argued that the evidence from the pen...