UNCLASSIFIED¶
FD-1035 (REV 2019-05-20)¶
U.S. DEPARTMENT OF JUSTICE/FEDERAL BUREAU OF INVESTIGATION¶
SUBPOENA¶
Subpoena number: 561616 When responding please reference this subpoena number.¶
In the matter of case number(s): 031E-NY-3027571¶
TO:¶
TELEPHONE:¶
ADDRESS: 4 Sylvan Way¶
| Name | Location |¶
| :--- | :--- |¶
| Parsippany, NJ | 07054 |¶
FAX:¶
GREETING:¶
By the service of this subpoena upon you by , who is authorized to serve it, you are hereby commanded and required to disclose to a representative of the FBI, the following information for the period 2019-07-05 to 2019-10-23 or the billing cycle including the requested time period: Customer or subscriber name, address of service, and billing address; Length of service (including start date and end date); Local and long distance telephone connection records (examples include: incoming and outgoing calls, push-to-talk, and SMS/MMS connection records); Means and source of payment (including any credit card or bank account number); Records of session times and duration for Internet connectivity; Telephone or Instrument number (including IMEI, IMSI, UFMI, and ESN) and/or other customer/subscriber number(s) used to identify customer/subscriber, including any temporarily assigned network address (including Internet Protocol addresses); Types of service used (e.g. push-to-talk, text, three-way calling, email services, cloud computing, gaming services, etc.) which may be relevant to an authorized law enforcement inquiry, involving the following: - Continued on Attachment A.¶
Please see the attached page explaining some terms that may be used in this demand. All time values are in the US/Eastern time zone, unless otherwise indicated.¶
THE INFORMATION SOUGHT THROUGH THIS SUBPOENA RELATES TO A FEDERAL CRIMINAL INVESTIGATION BEING CONDUCTED BY THE FBI.¶
YOUR COMPANY IS REQUIRED TO FURNISH THIS INFORMATION.¶
YOU ARE REQUESTED NOT TO DISCLOSE THE EXISTENCE OF THIS SUBPOENA INDEFINITELY AS ANY SUCH DISCLOSURE COULD INTERFERE WITH AN ONGOING INVESTIGATION AND ENFORCEMENT OF THE LAW.¶
Compliance must be made by personal appearance or production of records no later than the 22nd day of November, 2019 at 09:00 o’clock AM, at 26 Federal Plaza, 23rd Floor, New York, NY 10278-0004.¶
In lieu of a personal appearance, the information can be provided, via facsimile, marked to the attention of telephone number¶
In lieu of a personal appearance, the information can be provided, via email, marked to the attention of following email¶
If you refuse to obey this subpoena, the United States Attorney General may invoke the aid of a United States District Court to compliance. Your failure to obey the resulting court order may be punished as contempt.¶
Issued under authority of Public Law No. 106-544, §5(a)¶
(18 U.S.C. §3486)¶
ORIGINAL¶
Signature: S/¶
Name: □¶
Title: Supervisory Special Agent¶
Issued this 23rd day of October, 2019¶
UNCLASSIFIED¶
EFTA00153453¶
Case number: S) 3210816 Public Law 544 - 100th Congress 2nd Session, H.R. 3048, AN ACT¶
(a) Authorization—(1)(A) In any investigation of— (i)(I) a Federal health care offense; or (II) a Federal offense involving the sexual exploitation or abuse of children, the Attorney General; or (i) an offense under section 871 or 879, or a threat against a person produced by the United States Secret Service under paragraph (S) (6) of section 3056, if the Director of the National Security Agency is involved in the threat against the person protected is imminent, the Secretary of the Treasury, may issue in writing and cause to be served a subpoena requiring the production and testimony described in subparagraph (B). (B) Except as provided in subparagraph (C), a subpoena issued under subparagraph (A) may require— (i) the production of any records or other things relevant to the investigation; and (i) testimony by the custodian of the things required to be produced concerning the production and authenticity of those things. (C) A subpoena issued under subparagraph (A) with respect to a provider of electronic communication service or remote computing service, in an investigation of a Federal health care offense, requires the information specified in section 270(3)(c), which may be relevant to an authorized law enforcement inquiry; or (i) requiring that provider to disclose the information specified in section 270(3)(c), which may be relevant to an authorized law enforcement inquiry; or (i) requiring a custodian of the records that provide to give testimony concerning the production and authentication of such records or information. (D) As used in this paragraph, the term “Federal offense involving the sexual exploitation or abuse of children” means an offense under section 1201, 1591, 2241(c), 2242, 2251, 2251A, 2252, 2252A, 2260, 2421, 2422, or 2423, in which the victim is an individual who has not attained the age of 18 years. (A) Subpoena under this subsection shall describe the objects required to be produced and prescribe a return date within a reasonable period of time within which the objects required to be produced are recorded for the health care offense shall not be required under this section at any place more than 500 miles distant from the place where the subpoena for the production of such records is served. (B) The production of records relating to a health care offense shall be paid the same fees and mileage that are paid witnesses in the courts of the United States. (A) A United State district court for the district in which the summons is or will be served, upon application of the United States, may issue an ex parte question that no person or entity do business or reside, petition for an order in modifying or setting aside the summons, or a prohibition of disclosure ordered by a court under paragraph (6). (A) A United State district court for the district in which the summons is or will be served, upon application of the United States, may issue an ex parte question that no person or entity do business or reside, petition for an order in modifying or setting aside the summons, or a prohibition of disclosure ordered by a court under paragraph (6). (B) Such order may be issued on a showing that things being sought may be relevant to the investigation and there is reason to believe that such disclosure may result in— (i) endangerment to the life or physical safety of any person; (i) right to violate protection; (i) destruction or tampering with evidence; or (i) intimidation of potential witnesses. (C) An order under this paragraph may be renewed for additional periods of up to 90 days upon a showing that the circumstances described in subparagraph (B) continue to exist. (A) A summons issued under this section shall not require the production of anything that would be protected from production under the standards applicable to a subpoena issued by a court of the United States. (A) As soon as practicable following the issuance of the records or other things pursuant to this section within a reasonable time after those records or things are produced, the agency to which those records or things were delivered shall, upon written demand made by the person producing those records or things, return them to that person, except where the production was only of copies rather than originals. (A) A subpoena issued under paragraph (1)(A)(i)(A)(i)(A)(i) may require processing as soon as possible, but in no event less than 24 hours after service of the subpoena. (A) As soon as practicable following the issuance of the records or other things pursuant to this section within a reasonable time after those records or things are produced, the agency to which those records or things were delivered shall, upon written demand made by the person producing those records or things, return them to that person, except where the production was only of copies rather than originals. (A) A subpoena issued under paragraph (1¶
UNCLASSIFIED¶
EFTA00153454¶
UNCLASSIFIED¶
| Case number(s): 031E-NY-3027571 | ATTACHMENT A | Subpoena number: 561616 |
| All information to included, but not limited to, subscriber records, local, long distance and international toll records, and internet connectivity for T-Mobile user account number 89880537. | ||
UNCLASSIFIED¶
EFTA00153455¶
UNCLASSIFIED¶
| Subpoena number: 561616 | |
| TERMINOLOGY | |
| IMPORTANT NOTE This part is not a demand but an explanation of some terms used in the subpoena and some suggestions to help with compliance. The actual information demanded by this subpoena is set forth on the front of the subpoena or in Attachment A, if so indicated on the first page. The terms explained here may or may not be part of the information demanded. | |
| > If the subpoena makes a demand for "local and long distance connection records, or records of session times and durations" for telephone or cell phone service, that means to include the following records if your company maintains these records--- | |
| · Incoming and outgoing local, regional, long distance, international, wholesale, cellular, paging, toll free, and prepaid connection records; · Credit card calls (including, but not limited to, calls made through major credit card companies); and · Alternate billed number calls (calls billed to third parties, collect calls, and calling card calls for calls through cards issued by the communications carrier originating from the foregoing telephone number(s) or terminating at the foregoing telephone numbers(s)). | |
| > If the subpoena makes a demand for "length of service," include the start date and the close date if the account closed. | |
| > If the subpoena makes a demand for customer or subscriber address, include both the postal address and physical address, if known. | |
| > If the subpoena makes a demand for "means and source of payment" that means-- · Method of payment to initiate and maintain service; and · Any available identification numbers for method of payment, including credit card numbers or prepaid calling card numbers. | |
| > We are not directing that you provide, and you should not provide, information pursuant to this subpoena that would disclose the content of any wire communication. That means you should not disclose "any information concerning the substance, purport, or meaning of" a communication, as defined in Title 18 United States Code, Section 2510(8). Subject lines of e-mails are content information and should not be provided in response to this subpoena. | |
| > If the records provided are particularly large we request that you provide this information in electronic format preferably on a CD-ROM. | |
UNCLASSIFIED¶
EFTA00153456¶
Interpreting Call Detail Records¶
Your response includes Call Detail Records (CDR) either with or without location. Our query results in an Excel file with multiple columns. This is a combined report of calls and messages. Each row represents one call on the T-Mobile network. Some fields only appear in reports with location information. T-Mobile does not retain the content of text messages.¶
Calls made while roaming also do not appear on this report.¶
Entries with outgoing calls to 8056377249 indicate incoming calls that are forwarded (out) to the voicemail system. Entries with outgoing calls to 8056377243 = 805-MESSAGE indicate voicemail retrieval.¶
Please remember that T-Mobile CDR systems natively use Coordinated Universal Time (UTC). By default, that means a day of call detail records are taken from 00:00:01 to 23:59:59 UTC which may differ from your intended time range due to your time zone. If specific times other than our default are important to your inquiry, please submit legal demands with the date range/time frame adjusted for UTC to avoid delay or confusion. We are unable to convert the time displayed in the records to the local time of the handset.¶
The columns present on your CDR may be:¶
| COLUMN NAME | DESCRIPTION | LOCATION RPT ONLY? | NOTES |
|---|---|---|---|
| Date | Date format mm/dd/yyyy | NO | |
| (UTC) Time | 24 hour time format - hh:mm:ss in UTC | NO | In UTC time |
| Duration | Duration in seconds | NO | |
| Call Type | Type of call: callForwarding = Forwarded Call; mSOriginating = Outgoing Voice Call; mSTerminating = Incoming Voice; mSOriginatingSMSiNMSC = Outgoing SMS; mSTerminatingSMSiNMSC = Incoming SMS; moc=Mobile Originating Call; mtc=Mobile Terminating Call; SMSc = text message; RCS-iMChat = rich content message, multimedia and text | NO | Cell Site location is not available for Call Types SMSc and RCS-iMChat For SMSc messaging, T-Mobile provides record of any activity between the requested target number and any other customers utilizing the T-Mobile network for the time and date range requested regardless if the target number currently is/was assigned to T-Mobile or a T-Mobile wholesale partner. |
| Direction | Outgoing or Incoming to the target telephone number | NO | |
| Calling Number | Phone number that initiated the call | NO | |
| Dialed Number | Dialed digits | NO | |
| Called Number | Phone number that received the call | NO | |
| Destination Number | The final destination number to which the network has connected the call (might be different from the one dialled by subscriber if network translation was applied) | NO | |
| IMSI | International Mobile Subscriber Identity of the target number, if present | NO | |
| IMEI | International Mobile Equipment Identity of the target number, if present | NO | |
| Completion Code | Completed successfully or Abnormal Completion (network interruption). Abnormal completion calls display on this report but may or may not show on a customer's bill. | NO | |
| Service Code | 11 Calling line identification presentation 12 Calling line identification restriction 13 Connected Line ID Presentation 20 All Call Forwarding Services 21 Call Forwarding Unconditional (CFU) 28 All Cond Call Forwarding Services 29 Call Forwarding on Mobile Subscriber Busy (CFB) 2A Call Forwarding on No Reply (CFNRy) 2B Call Forwarding on Not Reachable (CFNRc) 31 Explicit Call Transfer (ECT) 42 Call Hold 41 Call waiting 51 Multi-Party (MPTY) | NO |
T···Mobile·¶
Legal Affairs – Law Enforcement Relations v. 170711¶
metroPCS.¶
EFTA00153457¶
| Switch Name | Name of the switch which was used to deliver the call to the target number. | NO | This is NOT an indication of the location of the device. |
|---|---|---|---|
| 1st LTE Site ID | EnodeBid value in decimal | YES | Only present if the call was over LTE |
| 1st LTE Sector ID | ID of the first sector used if the site is an LTE site | YES | Only present if the call was over LTE |
| 1st LAC | 1st LAC value in decimal | YES | Not present if the call was over LTE |
| 1st Cell ID | 1st Cell Site ID value in decimal | YES | Not present if the call was over LTE |
| 1st Tower Azimuth | Location: Azimuth orientation of antenna serving user if available (see note below) | YES | |
| 1st Tower LAT | Latitude of 1st cell tower used. | YES | |
| 1st Tower LONG | Longitude of 1st cell tower used. | YES | |
| 1st Tower Address | Street Address of the 1st serving tower if available | YES | |
| 1st Tower City | City of the 1st serving tower if available | YES | |
| 1st Tower State | State of the 1st serving tower if available | YES | |
| 1st Tower Zip | ZIP of the 1st serving tower if available | YES | |
| Last LTE Site ID | EnodeBid value in decimal | YES | Only present if the call was over LTE |
| Last LTE Sector ID | ID of the last sector used if the site is an LTE site | YES | Only present if the call was over LTE |
| Last LAC ID | Last LAC value in decimal | YES | Not present if the call was over LTE |
| Last Cell ID | Last Cell Site ID value in decimal | YES | Not present if the call was over LTE |
| Last Tower Azimuth | Azimuth orientation of antenna serving user if available (see note below) | YES | |
| Last Tower LAT | Latitude of last cell tower used. | YES | |
| Last Tower LONG | Longitude of last cell tower used. | YES | |
| Last Tower Address | Street Address of the last serving tower if available | YES | |
| Last Tower City | City of the last serving tower if available | YES | |
| Last Tower State | State of the last serving tower if available | YES | |
| Last Tower Zip | ZIP of the last serving tower if available | YES |
A NOTE ON AZIMUTH: The azimuth listed is the center compass degree facing of the identified sector of the tower. Generally, the coverage of a tower is circular and divided in three equal pieces (each 120 degrees wide). Due north is 0, due south is 180. However, not every tower is aligned with the first sector starting at 0. Using the listed azimuth, rough direction from the tower can be calculated for a call. The center degree of the sector’s facing is indicated in this field. For example, if a facing has a listed orientation of 90, the center of the coverage is pointed at 90 degrees but the sector will cover traffic from roughly 60 degrees on either side (thus 30 to 150 degrees in this example).¶
For more information on UTC, please visit: http://www.timeanddate.com/time/aboututc.html. To convert records to your local time, you will need to use a converter such as http://www.worldtimeserver.com/convert_time_in_UTC.aspx.¶
Legal Affairs – Law Enforcement Relations v. 170711¶
EFTA00153458¶