By the Subsentio Compliance Team. Reviewed for accuracy against the federal surveillance statutes (18 U.S.C. 2510 et seq., 2701 et seq., and 3121 et seq.) and CALEA.
TL;DR: Several different kinds of legal demand can land on a carrier's desk, and they do not authorize the same thing. A subpoena, a court order, a pen register, a search warrant, and a wiretap each reach different data under a different legal standard, and each asks something different of you. Two questions sort them all: does it seek content or only metadata, and does it want stored records or a live, going-forward feed? Answer those two, and you know what just arrived, what you may hand over, and whether you are producing records or provisioning an intercept.
Different Papers, Different Powers
To an investigator, these are five distinct tools. To a provider that has not sorted them out in advance, they can blur into one anxious category called "a legal thing I have to respond to." That blur is where mistakes happen, because responding to a wiretap order like a subpoena, or a subpoena like a warrant, means either producing too much or failing to do what the order actually requires.
The good news is that the whole landscape organizes cleanly around two questions.
The Two Questions That Sort Every Order
Content, or only metadata? Content is the substance of a communication, the words of a call, the body of a message. Metadata is the record around it, the numbers, the times, the routing, but not what was said. The law protects content far more strongly than metadata, so the instrument that reaches content is always harder to get.
Stored, or real-time? Some demands ask for records you already hold, a one-time production of what exists. Others ask you to capture communications going forward, a live feed you have to provision and run until the authority ends. Stored is a records task. Real-time is an interception task.
Place any demand on those two axes and it stops being a blur. Here is how the five common instruments fall out, from the lightest legal standard to the heaviest.
The Instruments, From Lightest to Heaviest
Subpoena. Stored, non-content, lowest bar. A subpoena compels basic, already-existing subscriber records, the limited categories the statute lists, such as name, address, and calling records. It does not reach the content of communications.
Court order under 2703(d). Stored, non-content, higher bar. The same statute authorizes a court order that reaches further into non-content transactional records, on a showing of specific and articulable facts that the records are relevant and material to an investigation. More than a subpoena, still not content.
Pen register and trap and trace. Real-time, metadata, low bar but a live task. A pen register and trap and trace order authorizes the going-forward capture of dialing, routing, addressing, and signaling information, the numbers dialed and received, times, and similar routing data, but not content. The legal standard is a certification that the information is relevant to an investigation. What makes it different from a subpoena is not the depth of data but the timing: this is a live feed you have to provision, not a record you pull.
Search warrant. Stored, content, probable cause. A warrant reaches the content of stored communications and location information, on a showing of probable cause. This is the instrument that unlocks substance, not just the record around it.
Wiretap, under Title III. Real-time, content, the heaviest bar there is. A wiretap order authorizes the live interception of the actual content of communications as they happen. It is the hardest order for the government to obtain: it requires probable cause tied to a serious enumerated offense, a showing that ordinary investigative methods have failed or would not work, minimization of what is captured, and it is tightly time-limited. When a wiretap arrives, you are provisioning a live interception of content, the most sensitive thing you can be asked to do.
Why the Difference Lands on You
Knowing which instrument arrived is not legal trivia. It tells you three things you need immediately.
It tells you what you may hand over. A pen register does not entitle anyone to content. A subpoena does not reach a stored message's body. Producing more than the instrument authorizes is not cooperation, it is a violation, and it is your exposure, not the requesting agency's.
It tells you what kind of work you are doing. Subpoenas, 2703(d) orders, and warrants are records production, you are retrieving and delivering what exists. Pen registers and wiretaps are lawful interception; you are provisioning a live feed, which requires the interception capability CALEA obliges covered carriers to maintain. One is a search of your records. The other is a real-time operation on your network.
And it tells you how fast and how carefully you have to move. A live intercept with a running clock is a different urgency than a records request, and the more sensitive the instrument, the less room there is to get the handling wrong.
The carriers that handle these well are the ones that can look at what arrived and immediately place it: content or metadata, stored or real-time, records or intercept. That recognition is the first step, and everything correct follows from it.
A Quick Self-Check
- When an order arrives, can someone on your side identify which of these five it is, quickly and confidently?
- Do you know which instruments you can satisfy from stored records, and which require you to provision a live intercept?
- Can you produce only what the instrument authorizes, and no more?
- If a pen register or a wiretap arrived, do you have the capability, and the people, to stand up a live feed correctly?
If any of those is uncertain, that is the gap to close before an order tests it.
Frequently Asked Questions
What is the difference between a pen register and a wiretap? Both are real-time, but a pen register captures only metadata, the numbers and routing information, on a low legal standard, while a wiretap captures the actual content of communications and is the hardest order for the government to obtain.
Is a subpoena enough to get the content of messages? No. A subpoena reaches basic, non-content records. The content of communications generally requires a search warrant, and real-time content requires a wiretap order.
Which of these require CALEA capability? The real-time ones. Pen register, trap and trace, and wiretap orders require you to provision a live interception, which is exactly the capability CALEA obliges covered carriers to maintain. Subpoenas, 2703(d) orders, and warrants for stored records are records production.
What happens if we hand over more than the order allows? Over-producing is its own liability. The instrument defines the ceiling, and the responsibility for staying within it rests with the provider.
Know What Landed, Before You Act on It
Every one of these demands is manageable when you can identify it on sight and respond to exactly what it authorizes. The trouble comes from treating them as interchangeable. Subsentio helps communications providers recognize and handle the full range, from a subpoena for stored records to a live wiretap, validating what each one authorizes and provisioning the real-time intercepts that CALEA requires. Request a legal-demand readiness review and make sure the next order that lands meets a process, not a scramble.
About Subsentio: Subsentio helps communications providers meet their law enforcement assistance obligations as a trusted third party. It determines CALEA coverage, implements and validates lawful intercept solutions, files and maintains System Security and Integrity plans, and reviews legal demands and manages records production for carriers, broadband providers, and VoIP operators of every size.
