Still "Penned" In: Seventh Circuit Holds IP Address Pen Register Orders Still Constitutional After Carpenter

• Published date: 01 October 2021
• Law Firm: Arnold & Porter
• Author: Mr Elliot S. Rosenwald, Jayce Born and Ronald D. Lee

In 2016, Edward Soybel, a disgruntled former employee, began perpetrating cyberattacks against his former employer, W.W. Grainger, Inc. (Grainger), an industrial supply company. One of Grainger's key service offerings, KeepStock, uses large database tables stored on Grainger's computers to help its customers keep track of their inventory. By remotely logging into KeepStock and deleting millions of records, Soybel effectively rendered KeepStock useless for several days until Grainger was able to restore the data.

Grainger called in the FBI, which determined that the IP address from which the attacks had been perpetrated belonged to the master router used for all outgoing internet traffic from the large Chicago apartment building in which Soybel resided. To identify which unit in the building had generated the attacks, the FBI had to obtain information from the master router itself, so it sought to place two tracking devices: one to track what IP addresses the master router accessed, and another to track what IP addresses Soybel's unit accessed (like the Seventh Circuit, we'll refer to these two devices collectively as a "pen register"). After showing that the IP address information was "relevant to an ongoing investigation," the FBI obtained an order pursuant to the Pen Register Act and installed the pen register.

By correlating the timing of the IP address data derived from the pen register-but without having access to the contents of the transmissions-the FBI determined that the attacks had emanated from Soybel's unit. Soybel was arrested and charged with 12...