United States v. Forrester
The Ninth Circuit decision extending Smith v. Maryland's pen-register reasoning to Internet addressing information—holding that government monitoring of email to/from addresses, IP addresses of websites visited, and total data volume did not constitute a Fourth Amendment search while carefully distinguishing communications content and potentially content-revealing URLs.
Executive Summary
Federal investigators examining a large Ecstasy-manufacturing conspiracy obtained court-authorized computer surveillance associated with Dennis Alba's Internet account. The challenged surveillance revealed the to/from addresses of Alba's emails, the Internet Protocol addresses of websites he visited, and the total volume of information transmitted to and from his account. It did not reveal the contents of the emails or the particular web pages viewed. Applying Smith v. Maryland, the Ninth Circuit held that this surveillance was not a Fourth Amendment search. Internet users necessarily expose addressing information to Internet service providers and other network intermediaries so their communications can be routed, just as telephone users expose dialed numbers to telephone companies. The court emphasized the narrowness of the holding. It expressly warned that more intrusive surveillance—especially technology revealing complete URLs, search terms, or other content information—could present a different constitutional question. It also declined to decide whether the surveillance fell within the then-applicable federal pen-register statute, holding that suppression was not available even if a statutory violation had occurred.
United States v. Forrester is the Ninth Circuit's principal case translating Smith v. Maryland from the telephone network to Internet metadata. The opinion's value lies as much in what it excludes as in what it permits.
The court approved surveillance of specific addressing information: email to/from addresses, website IP addresses, and aggregate transmission volume. Those items were treated as analogous to the numbers dialed through a telephone pen register.
The court did not approve warrantless acquisition of email content, search queries, full URL paths, page-level browsing details, keystrokes, screen images, or other information revealing the substance of communications. Indeed, the opinion expressly identified full URLs as potentially more constitutionally problematic because the path after a domain can reveal the particular document or search term viewed by the user.
That distinction is critical in 2026. Modern network logs can be vastly more detailed than the IP-level data in Forrester, and AI can convert seemingly modest metadata into social, behavioral, location, and investigative intelligence. Carpenter also instructs courts not to apply third-party doctrine mechanically to every category of digital information.
Key Holdings at a Glance
Facts and Procedural Context
Forrester and Dennis Alba were prosecuted for participating in a large conspiracy to manufacture and distribute Ecstasy. Investigators developed extensive evidence concerning a major laboratory operation, precursor chemicals, equipment, and plans for large-scale production.
The published appellate case addressed several issues. Forrester challenged his waiver of the right to counsel. The Internet-surveillance Fourth Amendment issue was raised by co-defendant Alba.
Investigators first obtained surveillance revealing specified non-content Internet information. Later, the government obtained a warrant for more intrusive imaging and keystroke-monitoring techniques. Alba did not challenge the legality of those later warranted techniques themselves on appeal.
What the Challenged Surveillance Collected
The challenged computer surveillance disclosed three principal categories:
- the to/from addresses associated with Alba's email messages;
- the IP addresses of websites or servers accessed; and
- the total amount of data transmitted to or from the Internet account.
The court repeatedly emphasized what the surveillance did not capture. It did not disclose the text of email messages or the particular pages within a website that the user viewed.
The Smith v. Maryland Analogy
Forrester relied directly on Smith v. Maryland, where the Supreme Court held that a telephone user lacked a reasonable expectation of privacy in numbers dialed and exposed to the telephone company's switching equipment.
The Ninth Circuit found two important parallels.
Third-Party Routing
Internet communications necessarily travel through provider and network equipment. Addressing information must be exposed to those systems so messages and requests can be routed to their destinations.
Addressing Rather Than Content
A telephone number identifies the destination of a call but not the conversation. Similarly, the to/from field of an email identifies correspondents without revealing the message body.
Email To/From Addresses
The court treated email to/from addresses as closely analogous to information written on the outside of an envelope or numbers dialed through the telephone network.
Knowing that one account communicated with another can be revealing, but it does not disclose the substance of the message.
Forrester therefore held that the Fourth Amendment did not protect those addressing fields from the particular monitoring used in the case.
Website IP Addresses
The Ninth Circuit also held that the IP addresses of websites Alba accessed were not protected by the Fourth Amendment under the facts before it.
The court reasoned that an IP address identifies a network destination but ordinarily does not identify the particular page or document a user viewed within a website.
For example, knowing that a user connected to the server hosting a newspaper is less revealing than knowing the title and URL of the exact article read.
Full URLs, Query Strings, and Content
One of the most important passages in Forrester is its limitation concerning URLs.
A URL can contain far more than a website's domain or IP address. The path after the domain may identify a particular document, article, product, medical page, account action, or other resource. Query parameters can reveal search terms or user-entered information.
The Ninth Circuit expressly stated that surveillance revealing URLs might be more constitutionally problematic because it can reveal the particular information a person viewed.
| Data | Illustrative Information Revealed | Forrester Treatment |
|---|---|---|
| IP address | Network host / server destination | Addressing information on facts of case |
| Domain | Website or service | Often closer to addressing than content, but context matters |
| Full URL path | Specific page or document | Expressly identified as potentially more constitutionally problematic |
| Query string | Search term or user input | Can reveal content |
| Email body | Substance of communication | Outside Forrester's non-content holding |
Total Data Volume
Forrester also approved monitoring of the total volume of information transmitted to and from the account.
The court analogized that information to a telephone pen register's ability to reveal how many calls were placed. Volume does not itself disclose the content of communication.
Modern analytics, however, can use traffic volume and timing to infer activity patterns. That inferential capability should be considered when agencies aggregate or fuse network metadata with other investigative datasets.
The Physical Mail Analogy
The Ninth Circuit also compared email to physical mail.
The contents of a sealed letter receive constitutional protection, while information exposed on the exterior of an envelope is visible to postal intermediaries and generally receives different treatment.
Forrester treated email similarly:
- the message body resembles the contents of a sealed letter;
- the to/from addresses resemble information on the envelope; and
- the size or volume of the transmission resembles outward package characteristics.
This analogy later complements Warshak's recognition that provider-hosted email content itself remains private.
The Pen Register Statute and Suppression
Alba also argued that the surveillance exceeded the scope of the version of the federal pen-register statute then applicable.
The Ninth Circuit did not resolve that statutory question.
Instead, it held that even if the surveillance violated the statute, suppression was not an available remedy because the relevant statutory scheme did not provide for exclusion of evidence.
Forrester and United States v. Warshak
Forrester and Warshak form a useful content-versus-addressing pair.
| Case | Information | Fourth Amendment Treatment |
|---|---|---|
| Forrester | Email to/from addresses, website IP addresses, data volume | No search under Ninth Circuit's Smith analogy |
| Warshak | Contents of private emails stored with provider | Warrant generally required in Sixth Circuit |
The two decisions illustrate why investigators should never request "email records" without specifying whether they seek content, addressing data, account records, IP logs, or other provider information.
Forrester After Carpenter
Carpenter v. United States did not overrule Forrester. Carpenter addressed historical cell-site location information and expressly declined to apply Smith and Miller mechanically to that highly revealing digital record.
The cases therefore should be read together rather than as mutually exclusive rules.
Forrester remains strong authority in the Ninth Circuit for the particular Internet addressing information it actually considered. Carpenter warns against automatically extending that rule to every provider-held digital dataset merely because the user exposed some information to network infrastructure.
Second: ask whether scale, aggregation, automatic generation, location, or informational depth makes Carpenter relevant.
Applying Forrester to Modern Internet Metadata
DNS Queries
Domain Name System records can show what hostnames a device sought to resolve. Depending on specificity, such records can disclose more than a bare IP address.
Device and Session Logs
Providers may maintain device identifiers, browser information, timestamps, authentication records, and session histories. These fields can support identity attribution and behavior analysis but were not directly decided in Forrester.
Cloud Audit Logs
Enterprise systems can record document access, file downloads, searches, logins, and administrative actions. Such logs may describe user behavior much more precisely than the Internet routing information at issue in Forrester.
Application Telemetry
Modern applications may generate detailed event data describing button presses, navigation, searches, and feature use. Calling those records "metadata" does not determine their constitutional status.
Encrypted Internet Traffic
Encryption can conceal content while leaving some routing, timing, destination, or traffic characteristics observable. Agencies should identify precisely what the surveillance reveals rather than relying on broad labels such as "encrypted metadata."
Forrester, AI, and Metadata Analytics
AI can extract significant meaning from datasets that Forrester considered individually non-content.
Social Graphs
Email addressing records can identify central actors, clusters, recurring contacts, and communication patterns.
Behavioral Inference
Timing and data volume can reveal working hours, activity bursts, travel, and unusual behavior.
Website Categorization
IP or domain destinations can be automatically categorized by subject matter, potentially revealing interests even without page-level URLs.
Cross-Dataset Fusion
Internet metadata can be combined with ALPR, location, financial, communications, and camera data to generate a more detailed profile than any source alone.
Technology in 2026
Forrester's core content/addressing distinction remains useful, but the Internet has changed dramatically since the surveillance in the case.
Shared Infrastructure Complicates IP Meaning
Cloud hosting and content-delivery networks can cause many unrelated services to share infrastructure, while dedicated addresses can reveal a much more specific destination. The informational value of an IP address is context-dependent.
URLs Can Carry Sensitive Content
Full URL paths and query strings may expose medical topics, search terms, account actions, products, documents, or other highly specific activity. Forrester expressly reserved that problem rather than deciding it in the government's favor.
Providers Collect More Fields
Modern cloud and Internet platforms may retain detailed access logs, device information, session identifiers, authentication events, and behavioral telemetry. These are not necessarily constitutional equivalents of the limited records Forrester approved.
AI Makes Aggregation Powerful
Machine analysis can turn millions of routing records into associations, routines, and predictions. Agencies should expect defense counsel and courts to focus increasingly on the practical information revealed by the dataset as a whole.
Carpenter Is the Necessary Companion
A contemporary analysis should not stop at Smith and Forrester when digital records create a detailed retrospective account of movement or other sensitive behavior.
Practical Guidance for Law Enforcement Agencies
1. Name the Data Field Precisely
Do not write requests or affidavits seeking generic "Internet metadata." Identify the specific provider records or surveillance outputs.
2. Separate Addressing From Content
Email addresses and IP destinations are analytically different from message bodies, search terms, full URLs, and page contents.
3. Inspect Full URLs Carefully
Determine whether the path or query portion reveals content before treating URL data as ordinary addressing information.
4. Use Current Statutory Process
Forrester's statutory discussion involved an older version of federal law. Consult the current Pen Register Act, Stored Communications Act, provider requirements, and state law.
5. Account for Carpenter
Highly revealing or aggregated digital records may require analysis beyond classic third-party doctrine.
6. Document the Collection Technology
Record whether information comes from provider records, a network device, a pen-register system, packet capture, forensic extraction, or another source.
7. Minimize Content Capture
When authority is limited to addressing information, configure systems and requests to avoid collecting content fields.
8. Govern Metadata Analytics
Define permissible uses for relationship analysis, categorization, enrichment, and cross-dataset correlation.
9. Preserve Technical Documentation
Maintain field definitions, system logs, provider explanations, timestamps, and technical descriptions sufficient to show exactly what the tool captured.
10. Check State Constitutional Law
State courts may provide greater protection for Internet records or aggregated metadata.
Internet Metadata Investigative Checklist
| Question | Why It Matters |
|---|---|
| What exact data field is sought? | Forrester is field-specific, not a blanket metadata rule. |
| Does it reveal message content? | Content lies outside Forrester's holding. |
| Does it reveal a full URL or query term? | The court expressly reserved more revealing URL surveillance. |
| Is the record provider-generated? | Relevant to third-party analysis. |
| How was the data generated? | Automatic system generation may matter after Carpenter. |
| How long a period is sought? | Aggregation can increase informational depth. |
| Can it reveal location? | Carpenter or related doctrine may become relevant. |
| What statutory authority governs? | Fourth Amendment and statutory analysis are independent. |
| Will AI classify or enrich the records? | Secondary analysis can expose additional facts. |
| Does state law provide greater protection? | Federal precedent is not always the ceiling. |
Litigation Checklist for Agency Counsel and Prosecutors
- Define every surveillance output precisely.
- Establish whether the system captured content.
- Distinguish IP-level information from domain, URL-path, and query data.
- Develop technical testimony explaining what each field reveals.
- Apply Smith and Forrester to genuinely analogous addressing records.
- Analyze Carpenter separately for more revealing digital datasets.
- Identify current statutory authority rather than relying on the statute discussed in the 2008 opinion.
- Preserve court orders, applications, system configurations, and logs.
- Document minimization or technical exclusion of content where relevant.
- Explain any AI, enrichment, or correlation performed after acquisition.
- Check controlling state constitutional authority.
- Separate constitutional violation, statutory violation, and suppression remedy.
Frequently Asked Questions
What did United States v. Forrester hold?
The Ninth Circuit held that monitoring the to/from addresses of emails, IP addresses of websites visited, and total data volume did not constitute a Fourth Amendment search because those records were analogous to telephone addressing information under Smith v. Maryland.
Did Forrester involve the content of emails?
No. The challenged surveillance did not disclose the substance of the emails.
Did the court approve collection of full browsing URLs?
No. The court expressly said that surveillance revealing full URLs may be more constitutionally problematic because URLs can identify the particular documents or pages viewed and can reveal content.
Who raised the Internet-surveillance challenge?
Co-defendant Dennis Alba. The published case caption is United States v. Forrester, but the metadata holding arose from Alba's Fourth Amendment argument.
Did the court decide whether the surveillance complied with the federal pen-register statute?
No. It assumed for argument that a statutory violation might exist but held that suppression was not an available remedy under the statutory scheme.
Does Forrester mean all Internet metadata is unprotected?
No. Its holding is limited to the particular addressing and volume information before the court. Modern records may be more revealing, and Carpenter requires caution with broad third-party analogies.
How does Forrester relate to Warshak?
Forrester addresses non-content Internet addressing information. Warshak recognizes a reasonable expectation of privacy in provider-hosted email content.
How does Carpenter affect Forrester?
Carpenter did not overrule Forrester, but it cautions against applying third-party doctrine mechanically to highly revealing digital information. Agencies should determine whether the new dataset is genuinely analogous to the records Forrester addressed.
Are IP addresses the same as URLs?
No. An IP address generally identifies network infrastructure or a host. A full URL can identify a specific page, document, search, or other content-level activity.
Can AI change the constitutional significance of metadata?
AI can make metadata far more informative through aggregation, categorization, and relationship analysis. Whether that changes the legal result is context-specific, but it is a reason not to treat "metadata" as a constitutional conclusion.
Primary Authorities
Published Ninth Circuit decision addressing email addressing information, website IP addresses, Internet data volume, and related issues.
Read United States v. Forrester
Supreme Court pen-register decision underlying Forrester's Internet-addressing analysis.
Read Smith v. Maryland
Supreme Court decision limiting mechanical application of third-party doctrine to highly revealing digital information.
Read Carpenter v. United States
Final Assessment
Forrester remains an important Internet-surveillance case, but its usefulness depends on precision.
The Ninth Circuit did not hold that online activity is categorically exposed to government. It held that specific addressing information—email to/from fields, website IP addresses, and total data volume—was constitutionally analogous to information exposed through a traditional telephone pen register.
At the same time, the court drew a meaningful line around content. Email substance was outside the holding. Full URLs were expressly identified as potentially more constitutionally problematic because they can reveal the particular information viewed. The opinion also made clear that more intrusive computer surveillance could present different questions.
That narrow reading is even more important today. Network records are richer, cloud platforms are more integrated, and AI can derive relationships and behavior from enormous metadata collections. Carpenter further instructs that third-party possession is not always dispositive when digital records become sufficiently revealing.