ai, 2, 10 - american civil liberties union · ai, 2, 10 - 4018 - the verizon wireless ... the...

(

Verizon Court Order & Subpoena Compliance Team

Vonage AT&T Sprint Metro PCS T-Mobile

AI, 2, 10 - 4018 -

The Verizon Wireless

Court Order & Subpoena

Compliance Team is

relocating to Bedminster,

New Jersey.

Court Order & Subpoena Compliance Team

- 4019 -

Our Mission The Verizon Wireless Court Order & Subpoena Compliance Team is dedicated to responding to all lawful process for business and customer information. The team assists the law enforcement community in a professional, knowledgeable and expeditious manner, while maintaining the privacy and security of business and customer information.

Our Responsibilities

E2f Ensuring all court orders, search warrants and subpoenas are processed confidentially and in compliance with all applicable laws.

0' Providing 24/7 technical assistance for exigent situations and electronic surveillances.

0' Ensuring CALEA compliance, both technically and procedurally.

E2f Providing educational presentations for law enforcement organizations and associations, to further demonstrate our commitment to and support of public safety.

E2f Coordinating court appearances for Verizon Wireless Custodian of Records.

Our Contact Information

Option 1: Mailing Address & Fax Numbers

Option 2: Subpoenas & Search Warrants

Option 3: Court Ordered Surveillances

Option 4: 9-1-1 or life Threatening Emergencies

Our Fax Numbers Subpoena Team Court OrderTeam

911!Exigent ONLY

Our Mailing Address

Hours of Operation The Court Order & Subpoena Compliance Team is available seven days a week, 7:00AM to 8:00PM. Option 4, for 9-1-1 or Life Threatening Emergencies, is available 24 hours!7 days a week.

- 4020 -

IMMEDIATE THREAT/PUBLIC SAFETY

MADE PURSUANT TO 18 U.S.c. 2702 (c) AND/OR STATE STATUTE: ______ _

TO: Cellco Partnership d/b/a Verizon Wireless Custodian of Records

Fax:

RE: Cellular No: ( ) __ _

Call to: ( ) --::-c--::---

Destination Number _____ on =--____ at = __ ~ ____ _

Date Time

Our agency is handling a situation involving the immediate danger of death or serious physical injury to a person. Accordingly, I request a copy of the Verizon Wireless information to be immediately sent as instmcted below.

Information for verification purposes:

Name: ________________ RankiTitle: _____________ _

Law Enforcement Agency: ___________________________ _

Address: _________________________________ _

Phone No: ______________ _ Fax No: ______________ _

Please provide the following information to the above fax number as soon as possible:

By signing this form, I swear to the facts contained herein.

Requesting officer/agent signature:, ________________ _ Date: ____ _ - 4021 -

SWITCH DATE TIME ORIG CIG

This is the This is the date This is the start This is valid eel! switch that the of the call time of the call site for outgoing call is hitting off calls. Valid onlv of on MO calls

,

Explanation Form For Calls With Cellsites

TERM CIG DIR MDN

This is valid cell MO=Outbound This is your site for an call target # incoming call. Valid only on MT calls

MT Incoming call

MF-Incoming call to Yoicemail In rare cases, it CQuld be mobile forwarding

MM-Mobile to Mobile call LL, eN, TR all pertain to routing information and will not be relevant to your investigation

Codes: *86 is voice mail retrieval

#225 is checking account balance #646 is checking minutes #777 is data/web services

#738 is prepaid voicemail retrieval #729 is adding minutes for prepaid '67 is used to block the mobile #

'82 is used to unblock the mobile #

CALLED # CPN SZR

If the call was This is the This is the an out going calling party # duration of the call=then the cal! in seconds outgoing # that your target dialed will be in this column If the call was If the call was an incoming an outgoing #=then your ca!l=then your target # will target # will be appear this in this column column

If the call was an incoming call=then the incoming # to your target will appear in this column

- 4022 -

Explanation Form For Historical Records

Network Element name

This Is the switching equipment that transacted the call. A switch Is nambed by the basic geographic area it covers, Switches rout calls for hundreds of cell sites.

This Is This is the number your target dialed to Initiate the # call. For Inbound calls

this number will be the same as the CUST ACCT column and for outbound calls this Is the number your target dialed.

Codes;

'""86 is voicemall retrieval

#225 Is checkIng account balance

#64615 checking minutes

#777 Is data/web services

#73B Is prepaid volcemaU retrIeval

#729 Is adding minutes for prepaid

*6715 used to block the mobile #

"'82 Is used to unblock the mobile #

This Is the type of caU, this Is the exact This is the This Is the cell site # for This;s the cell site # for This IS the calling party e.g. inbound. date and time of duration of the OUTGOING calls ONLY INCOMMING cans that Initiated the can. If outbound, or the start of each call In seconds ONLY the call is outbound this volcemail. cal! column will be the same inbound calis display as the CUST ACeT the following numbers: number. If the call is o & 6. Calls to inbound, this is the volcemall display the number that diated your !eUer nF." target.

Call DlrecfIon Seizure nt Tm Seizure Duration First Servlna Cell Slte Last ~ervtna Cell Site Callinn Parfv Numher

Outbound calls display the following numbers: 1 & 3 Mobile to Mobile calls do not capture cell sites and display the number 2. Any other laUer or number Is a routing or unknown cal1 type and does not detail actual transactional data for a completed call.

- 4023 -

Law Enforcement Resource Team .•

(lERT) FBI TICTU

Spring 2008 '., .. - .'" '-- '

- 4024 -

Company Overview • Verizon Wireless began its coast-to-coast

venture on April 4, 2000 by combining the domestic US operations of Bell Atlantic Mobile, AirTouch Communications and PrimeCo Personal Communications

• On June 30, 2000 Bell Atlantic and GTE merged completing the creation of Verizon Wireless by adding GTE wireless assets

• Verizon Wireless is headquartered in Basking Ridge, NJ

Duplicate Limited to (name of agency)

Distribution Limited to the Law Enforcement Community

- 4025 -

Faets-at-a -G la nee

• Wireless Phone Customers - 65.7 Million • Employees - 69,000 • U.S. Market Coverage - 49 of top 50 and 97 of top •...

100 • Digital Network Technology - Code Division

Multiple Access (COMA) • Stores & Kiosks - 2,400 • Switching Centers - 170+



- 4026 -

Leader in Ire .. __ Voice & Data Services

• Built the nation's first wide-area wireless broadband network

• Delivered the nation's first wireless consumer 3G multimedia service

• Launched the most comprehensive mobile music service in the world

• Has the highest customer loyalty in the industry based on lowest-in-industry churn



." {"''''''.' ": - .

- 4027 -

law Enforcement Resource Team

The LERT is centralized and handles all requests from local, state, county and federal law enforcement nationwide



, -" ...

- 4028 -

lERT Mission \ ... ' , .-'

The Verizon Wireless LERT is dedicated to responding to all lawful process for business and customer information. We assist law enforcement personnel and members of the legal community in a professional, knowledgeable and expeditious manner while maintaining the privacy and security of business and customer information. We provide informational presentations for law enforcement organizations and associations to further demonstrate our commitment and support of

Public safety Duplicate Limited to (name of • agency)


- 4029 -

lERT Responsibilities • Ensuring all court orders, search warrants and

subpoenas are processed confidentially and in compliance with all applicable laws and company policies

• Providing 24x7x365 technical assistance for electronic surveillances

• Providing 24x7x365 support for exigent situations • Ensuring CALEA compliance both technically and

procedurally • Coordinating court appearances for a Verizon Wireless

Custodian of Records • Providing informational presentations for law

enforcement org~~at~q~t~'tbqn~s;gciations agency)


- 4030 -

General Information • Company Name: Cellco Partnership d/b/a Verizon

Wireless • Mailing Address:

Verizon Wireless

• Normal Hours of Operation: 7am-8pm Sun-Sat • Exigent Situations: 24x7 on-site (prompt "4/1, should

also be used for emergencies that may result in loss of information)



- 4031 -

LERT Hotline

- Prompt 1: General Information - Prompt 2: Subpoenas & Search Warrants - Prompt 3: Court Ordered Surveillances - Prompt 4: Exigent (24x7)



- 4032 -

lERT Fax Numbers

• Subpoenas & Search Warrants:

• Court Orders:

• Eyi(l~nt·

Duplicate Limited to (name agency)


- 4033 -

Contact Information • Supervisor - Subooenas & Search W~rr;mts:

• Supervisor - Court Orders/Exigent Situations:

• Associate Director - Law Enforcement Resource Team:

• ~r. Ana Iyst - CALEA: .

• Manager - CALEA:

• Director - Law Enforcement Resource Team:



'". "."i':' - 4034 -

Court Order roup

• Staffed on-site 24x7 • Responsible for all surveillances, per court order

requests, exigent situations, requests for location information and any content requests (Le., text messages)

• Goals -Exigent Situations - immediately -Surveillances - same day -Per Court Order Requests - within 24 to 48 hours



- 4035 -

Court Ordered Surveillances

• Fax required worksheet along with court order -Names of authorized points of contact -Address (street, city, state and zip code) -Billing contact name and number

• All court orders must have a complete worksheet with set-up and billing information when faxed in order to be processed in a timely manner



- 4036 -

Exigent Situations

• Complete, sign and fax exigent formjletter*

• Call • Release of information

• LEA to follow-up with legal process, dependent on situation

*If fax is unavailable because the officer/agent is in the field, we will use a call back verification process.



- 4037 -

Tracki ng I Location Information

• Cell site and sector information is available for completed calls and text messages

• Approximate distance from cell site is available for Lucent and Motorola switches, Nortel currently limited to cell and sector

• 9-1-1 calls are Phase II compliant but output delivered is dependent on the answering point's equipment

• Cannot obtain information in a timely manner for a call in progress if the mobile number is unknown

• Cells are 1 sector throuah 6 sector and vary th h t tw ..DJllilicatei.imited to (name of

roug ou ne or 1\ agency)


- 4038 -

- 4039 -

CALEA

• VZW Law Enforcement Resource Team is centralized and· responsible for all surveillances

• VZW Delivery Functions and the various Intercept Access .•• Points are geographically diverse for load-sharing and . redundancy

• Delivery methods -Circuit Switched audio: dial-out from all switch

platforms -Data delivery: VPN or Frame Relay



- 4040 -

CALEA (cont'd) • Switched Services

• include Nortel, Lucent and Motorola . • Call Identifying Information, Call Content, Short

Message Service, Dial-up Data and WAP 1.0 are subject to surveillance from the switch or an adjunct platform

• Broadband Services • VZW provides lawful intercept for Broadband Services • The intercept access pOints provide the Delivery

Function a copy of all packets to and from the target based on the IP assigned to the MIN of target



- 4041 -

CALEA (cont'd)

• Web-based services are intercepted the same as Broadband Services

• Push to talk over cellular services (PoC) • VZW does offer PoC services • VZW provides lawful intercept solution for PoC • Intercepted the same as any other service using the

packet data network as its transport • TIA-1072 formatting applied at DF



- 4042 -

Circuit Switched

J-STD-025

Punch list capability

J-STD-025A

Packet Data

J-STD-025B

Push to Talk over Cellular

l1A-1072

implemented by Verizon Wireless

June 30, 2004 May 2004

May 14, 2007 March 2005

May 14, 2007 December 2006

icate Limited to (name of agency)


.. , ::-: ...

- 4043 -

Subpoena G··········

• Responsible for all subpoenas, search warrants and the coordination of court appearances

• Goals -Subpoenas & Search Warrants - 14 days or within compliance time frame -To accommodate same or next day emergency requests (volumes permitting)



. '";"-... - " ..

- 4044 -

Termlno

• Subscriber - name, address, contact numbers, activation date, and number of mobiles on the account for the most current customer unless a timeframe is provided

• Social Security Number - the social security number of the subscriber (not available or valid on most prepaid accounts)

• Tolls - date, time and length of call for outgoing calls, only nonrestricted inbound

• Call Detail Records - date, time and length of call for outgoing and incoming calls; captures outbound digits and incoming numbers

• Features - list of the features subscribed to by the customer • ESN - electronic serial number of the phone • Payment History - date, source and amount of payments • Calls to a Number - date, time and length of calls for all mobiles

that called a specific destination number • Location - cell site that handl...led the c;:all (requires a court order)

-U-uplfcate Imlted to (nam~ of agency)


- 4045 -

Available Information Type of information Current Retention

Subscriber - post paid Typically 3-5 yrs*

Call detail records/cell sites 1 rolling year

Text message detail 1 rolling year

Text message content 3-5 days

IP session information 1 rolling year

IP destination information 30 days

Pictures only if on web site**

Bill copies - post paid Last 12 months

Payment history - postrfDaj(fj Limited tc (I¥~lIy 3-5 yrs* *ma va b former com an y ry y p y C:lgc[](;Yeustomer can add or delete pictures at any time


- 4046 -

Information Stored In the phones

• Dependent in some cases on make and model

• Managed by person in possession of phone

• Types of information: - Text messages

- Contact list/information

- Calendar/schedule

- Pictures

- Downloads from internet (Le., games, ring tones)

- Dialed numbers

- Incoming numbers Duplicate Limited to (name of

agency)


- 4047 -

Sample Ca e w I Cell Sites

Switch Date Time Orig C/G Term C/G Dir MDN Called # ESN CPN Szr Plymouth_Meeting2 7/13/2006 11:10:32 0 640 MF 6103607662 6103607662 2aOab6c3 6103607662 43 •.. Branchburg1 7/13/2006 11:10:26 292 1900 MO 6103607662 *86 2aOab6c3 6103607662 44. Branchburg1 7/13/2006 11:00:45 250 292 MT 6103607662 6103607662 2aOab6c3 6103609438 24 Plymouth_Meeting2 7/13/2006 11:00:45 0 640 MF 6103607662 6103607662 2aOab6c3 6103609438 71

Branchburg1 7/12/2006 16:07:42 126 1901 MO 6103607662 6103609438 2aOab6c3 6103607662 4665 7/11/2006 18:09:39 250 292 MT 6103607662 6103607662 2aOab6c3 6103609438 3347 •

7/11/2006 15:31:31 294 689 MO 6103607662 9083067788 2aOab6c3 6103607662 98 7/11/2006 15:31:04 294 603 MO 6103607662 9083097788 2aOab6c3 6103607662 2 7/11/2006 15:30:27 294 603 MO 6103607662 9083097788 2aOab6c3 6103607662 24 7/11/2006 15:30:11 294 602 MO 6103607662 9085913523 2aOab6c3 6103607662 5 7/11/2006 10:03:15 250 292 MT 6103607662 6103607662 2aOab6c3 9088126899 1538 7/11/2006 9:27:30 250 292 MT 6103607662 6103607662 2aOab6c3 9083067496 15

agency)


- 4048 -

;"

Description ()'f·Ca Detail

• Switch: The switch the call is hitting • Date: The date of the call • Time: The time of the start of the call (based on the switch) • Orig C/G: Valid cell site for outgoing calls (Only for MO calls) • Term C/G: Valid cell site for incoming calls (Only for MT calls) • Dir:

- MO=Outgoing - MT =Incoming - MF=Incoming to voicemail and in rare cases, mobile forwarding

• MDN: Your target number • Called #: If outgoing, this is the number your target dialed • ESN: Electronic Serial Number of your target • CPN: If incoming, this is the number that called your target • Szr: Duration of the call iFi~~I'\lI;I~ited to (name of

agency)


- 4049 -

"5'" ,",> ,:"" "':<'/

ampe Message Detail

MDN MSG SND DT TM MSG DLVR DT TM ORIG ADDR DEST ADDR - - - --6103607662 5/15/2006 7:25 5/15/20067:25 1111 6103607662 6103607662 5/16/2006 8:27 5/16/20068:27 1111 6103607662 :,. 6103607662 5/16/20067:15 5/16/2006 7: 15 1111 6103607662 6103607662 5/31/200616:00 5/31/200616:01 1111 6103607662 ,i

6103607662 6/4/2006 9:56 6/4/2006 9:56 [email protected] 6103607662 : 6103607662 6/8/2006 6: 56 6/8/2006 6:56 1111 6103607662 ' 6103607662 6/12/200614:40 6/12/200614:42 6103609438 6103607662 6103607662 6/13/20068:12 6/13/20068:12 1111 6103607662 : 6103607662 6/13/2006 17:20 6/13/200617:20 6103607662 6103609438 . 6103607662 6/13/2006 17:49 6/13/2006 17:49 6103607662 6103609438 6103607662 6/13/2006 20:21 6/13/2006 20:21 [email protected] 6103607662 ' 6103607662 6/13/20067:52 6/13/20067:52 1111 6103607662 6103607662 6/13/20067:52 6/13/2006 7:52 1111 6103607662

agency


- 4050 -

Useful Websites

• www.arin.net - registry for internet numbers

• www.searchbug.com - land or cell number, company

• www.verizonwireless.com - phone and equipment manuals - user guides

• www.npac.com - number portability administration center

• www.askcalea.net government website for CALEA



- 4051 -

About Vonage:

Vonage is a leading provider of broadband telephone services with over 2.2 million subscriber lines as of December 31,2006. Vonage's VolP technology enables anyone to make and receive phone calls with a touch tone telephone almost anywhere a broadband Internet connection is available.

Vonage Service:

Vonage provides service to 3600+ of the 18,549 US rate centers, offering local numbers in approximately 250 area codes. Vonage customers can make VolP calls using traditional phones (corded or cordless), connected to an Adapter or Wi-Fi router/adapter or from non-traditional devices and services, such as a Wi-Fi phone, V-Phone or soft phone service on a computer.

Vonage and Law Enforcement:

Vonage supports the efforts of law enforcement and can quickly provide subscriber date and historical call information in response to a subpoena or evidence of exigent circumstances or immediate threat to life. Additionally, by May 14, 2007, Vonage intends to support FCC mandated electronic' surveillance requirements.

Verify Vonage:

Vonage has created a way for LEAs to verify that a phone number in question belongs to a Vonage customer. Simply dial and follow the voice prompts. After entering the ii-digit (including leading 1) telephone number to verify, an automated response will let you know whether the number is being utilized by a Vonage customer.

Subscriber Data and Gall Records:

In response to a subpoena, Vonage can provide subscriber's name, address, telephone number and account start and end date, billing name and address, shipping name and address, E911 address, credit card and checking account information, call detail records (which includes session times), types of services utilized, Internet-Protocol (IP) Address, Media Access Control (MAC) address, email address and contact information.

Non-Emergency Subpoena Requests:

Hours of Operation: 8:30 AM to 5:30 PM (Monday - Friday - ET) Response time for valid subpoena requests: 3-5 days

Emergency Requests (Immediate TIHeat to Life):

Emergency (life-threatening situation) Requests must be followed by the proper legal demand within 48 hours. We will verbally provide the information, and once we have received the proper legal demand, we will follow-up with a hard copy.

Hours of Operation: 2417 Phone: : Please state immediately that you are from a LEA with an emergency threat to life situation. - 4052 -

Electronic Surveillance:

Vonage will use a Trusted Third Party solution provided by VeriSign's NetDiscovery service for CALEA compliant lawful interception of communications by May 2007.

VeriSign's NetDiscovery network thus becomes the demarcation point for law enforcement agencies to access intercepted call data and call content. Law enforcement agencies must contact VeriSign, and are urged to coordi~ nate connectivity as early as possible to allow adequate time for change management processes and testing. Additionally, most LEA Collection Systems will need to complete development or configuration changes to decode VolP call content. Law enforcement agencies are urged to contact their Collection System vendors as soon as possible.

Call Data and Content Delivery:

Vonage's intercepted call data is transmitted to Veri Sign's NetDiscovery network for mediation and delivery to law enforcement.

Vonage's intercepted call content (voice) is transmitted to Veri Sign's NetDiscovery network for correlation with call data and delivery to law enforcement. Intercepted call content is delivered in EIAITIA Tl.678 VolP format which requires a TCP/!P transport facility for delivery to law enforcement.

VeriSign supports a variety of TCP/IP connection options for law enforcement agencies to use for interconnect.

l!I Virtual Private Networks (VPNs) - are the preferred method of connectivity. VPNs can be established in a relatively short period of time, and offer a considerable level of security. VPN Specifications:

Authentication Method: Encryption Scheme: Diffe-Hellman Group: Encryption Algorithm: Hashing Algorithm: Main or Aggressive Mode: Lifetime (for renegotiation):

Pre-Shared Key or I PSEC Certificates IKE Group 2 3DES SHA-l Main Mode 86400 seconds

m Private circuits - such as frame relay and point~to~point circuits may also be used for call content delivery, but typically take longer to implement, and involve recurring provider fees. Law enforcement agencies are responsible for submitting provisioning requests for private circuits and paying all associated fees.

Frame Relay Specifications: Provider: CIR:

Poi nt -to-poi nt Fractional T-l

Sprint or AT&T 56K (Per Intercept, Call Data), 256k (Per Intercept, Call Content)

56k (Call Data) 512K (Call Content)

II Dial-up circuits - may used for cal! data delivery only, but have inherent bandwidth limitations and have proven to be less reliable than other methods. Toll charges may also apply. *Note: Dial-up circuits do not offer adequate bandwidth for transporting call content.

Connectivity Contact Information:

Please contact VeriSign NetDiscovery Security Office' connectivity if you have not already done so.

Electronic Surveillance Requests:

to request assistance in coordinating

Prior to May 2007, Vonage will publish a complete LEA Support Services guide similar in format to that recommended by the FBI. This guide will provide additional information on how to contact Vonage with an electronic surveillance request. To request a copy of this guide when available, please email: [email protected]. - 4053 -

FS-Referral rev. 07108 NEUSTAR'

NeuStar, Inc.

Legal Process (Subpoena, Court Order, Search Warrant Statutory Authorization, Emergency Situations or Written Certification)

Contact Instructions

LAW ENFORCEMENT REFERRAL GUIDE , ,

Instructions for Record Production & Technical Assistance

+ For prompt handling, ALL Legal Process should be made out to the appropriate Service Provider but faxed, mailed, or delivered to the NeuStar's Fiduciary Compliance office.

+ Legal Process must include return instructions, contact information (contact name, return address & contact telephone number(s)) in order to ensure timely and accurate responses.

+ Emergency situations or calls after business hours should be directed to (Option 1).

+ The following contact numbers are available on business days, from 8:30 a.m. to 5:00 p.m. (Eastern Time)

For ... + Records Production

Subpoenas, Court Orders Search Warrants Statutory Authorizations

~Technical Assistance for Electronic Surveillance

Court Orders Written Certifications

~ Emergency and After Hours Requests- Records Production or Technical Assistance

Then Refer To ...

Mailing Address NeuStar, Inc.

,

- 4054 -

~: at&t

- 4055 -

Day to Day Operations at the Nee

A call rings into AT&T Mobility's National Compliance Center (NCC) in North Palm Beach Florida. It's 6:51 AM and the 911 operator on the line advises they have just received a callfirom a customer whose home is in the process of being burglarized. As officers arrive on the scene, they realize the customer has been abducted. Assistance from an NCC analyst provides law enforcement with information that quickly helps them determine which direction the car is traveling. They are able to get ahead of the car and make a traffic stop. They discovered the victim handcuffed and duct taped. In addition, the attacker had two loaded guns in the car. San Bernadino Sheriff's Office credits assistance ji-om AT&T with saving this woman's life.

10: 45 PM an individual calls 911 and tells them their friend is tlying to commit suicide. The NCC is able to provide location information that helps the Florida Highway Patrol locate the victim and get her to the hospital in time to save her life.

Unfortunately these calls are typical - the NCC receives an average of 1 00 life/death emergency calls each day.

2007 -142K calls, 150K requests, 500K records produced

- 4056 -

LOCATOR TOOL

Available in near real time in areas with strong coverage AND e-9JJ Phase II capability

Phone 111ust be on

Results may be e-mailed at pre-determined intervals

Costs will apply in non emergency situations for this .

serVIce

Location orders or Exigent Circumstances - Require paperwork

- 4057 -

Dobson Communications 1.7 M Subscribers

AT&T Mobility Compliance Center assumed all requests as of 317108 - Court Ordered surveillance work was assumed in early February

Provisioning on both networks when applicable -Maintain those connections to the Dobson legacy network until further notice .

Planned l1'zigration to AT&T billing systeln early SUlnmer

TDMA Network has been turned dOlivn

- 4058 -

Dobson

Network nligration still in planning stages

Market Areas

AK, AZ, KS, KY, MD, MI, MO, NY, OR, OI( P A, VA, WI, WV

- 4059 -

TDMA Network

AT&T Mobility TDMA network turned down early March 2008

TDMA phones are no longer able to call 911 for assistance unless they pick up another carrier's network

- 4060 -

Packet Data

Ongoing testing with Quantico

3 Switch Vendors: Lucent, Ericsson, Nokia

3 unique streanlS of data to LEA connection

AT&T Mobility is pursuing different solutions and working with vendors to fine tune data streams

All network elements are provisioned due to capacity for each surveillance

- 4061 -

Requests Pursuant to Court Orders

Order is received with a request for subscriber/toll information

Records are sent with a response requesting that future requests are forwarded without an additional copy of the court order and a reference to the AT&T internal file nLllnber.

Future requests pursuant to court orders are sent in referencing the AT&T Mobility File number.

Following these steps will assist in a more timely response for all future requests.

- 4062 -

Encrypted E-Mail Responses

Voltage used by AT&T Mobility to send encrypted email responses to your agency

Silnple registration required with Voltage for first time users.

Agency e-mail must have the ability to validate the encryption keys via the internet.

- 4063 -

Contact Information

AT&T Mobility's Compliance Center is staffed

24X7-365

Option 1 - Subpoena

Option 2 - Court Orders

Nationwide cell site lists are sent monthly to Quantico and placed on internal web site for field offices.

- 4064 -

cricket Subpoena Compliance

Law Enforcement Hotline:

To obtain records/information or provision an Interception, serve:

Cricket Communications, Inc. or on behalf of Leap Wireless International, Inc., Hargray Wireless, LLC, or LCW Wireless, LLC: on our Registered Agent for

Service of Process in the applicable state.

Transmittal options to Subpoena Compliance: Mailing Address: Custodian of Records

Cricket Communications. Inc.

Pen register/trap & trace or Wiretap, email or scan (.pdf or .tit) to:

(follow with mailed hard copy of order) General subpoenas, orders, or search warrants, email or scan (.pdf or .tit) to:

Or, request may be faxed to:

Response time is approximately 2-3 weeks. A fee may be assessed for production of requested information. PLEASE INCLUDE A SECURE RETURN EMAIL ADDRESS FOR RESPONSE.

EXPEDITE FEES: (These are in addition to any charges for production of records) AUTHORIZATION FOR THE SPECIFIC EXPEDITE SERVICE DESIRED MUST BE INDICATED PROMINENTLY ON THE FAX COVER SHEET OR THE SUBJECT LINE OF THE EMAIL SUBMISSION - For example, "One business day expedite authorized"

FEES: One Cricket Business Day turnaround: $lOOlrequest 2-3 Cricket Business Days tumaround: $SOIre.quest One Cricket Business Week turnaround: $2S/requcst. REQUESTS VVILL BE COMPLETED BY 5:30 PM Pacific Time ON THE FINAL DAY OF THE EXPEDITED TURN-AROUND TIME (for example, a one day expedite request received Monday moming will be completed by 5:30 pm Pacific Time Tuesday evening). REQUESTS RECEIVED AFTER 5:30 PM Pacific Time of a Cricket business day WILL BE ENTERED AS BEING RECEIVED AT 7:00 AM Pacific Time ON THE NEXT BUSINESS DAY (for example, a one day expedite request received at 6 pm Pacific Time on Monday evening will be completed by 5 :30 pm Pacific Time Wednesday evening).

THIS MESSAGE IS INTENDED ONLY FOR THE USE OF THE INDIVIDUAL TO WHOM IT IS ADDRESSED AND CONTAINS INFORMATION THAT IS PRIVILEGED, CONFIDENTIAL AND EXEMPT FROM DISCLOSURE UNDER APPLICABLE LAW, If the reader of this message is not the'intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, lease notify us immediately. TI1~_~_k you!

- 4065 -

metmPCSe Permission to speak freely, Cl

l.aw Enforcement Agencies: Welcome to metroPCS.! Please read for new information!!!

MetroPCS gives its customers Permission to speak freely." with unlimited calls for one flat fee pa'ld 'In advance of service. MetroPCS currently operates in the greater metropolitan areas of Atlanta, Dallas/Ft. Worth, Detroit, Sacramento and San Francisco as well as central and southern Florida.

The Subpoena Compliance Group consists of a Manager, one Supervisor and four Excellent Compliance Analysts. We receive, review, and process all law enforcement requests centrally in the Corporate Office in Dallas, TX. We handle 911 calls, exigent/emergency situations, routine subpoena and court order requests, pen registers, Title III wiretaps and fraud cases. We represent MetroPCS in all state and federal trials as evidentiary witnesses/custodians of records.

MetroPCS retains call detail records for up to 6 months; after which they are no longer available. Because MetroPCS allows its customers unlimited use of its service, call detail reports are typically much more voluminous than reports by other carriers. Therefore, beginning April 15, 2006 MetroPCS will charge $50 for call detail records for more than 15 days. Call detail records without cell site location can be obtained with a subpoena. Call detail records with cell site location will require a court order.

MetroPCS is highly motivated to attain its goal of responding as quickly as possible to legal requests, however, technical issues do arise that sometimes lead to delays. To further assist us in expediting your request, please provide contact information, fax number and an email address with your subpoena. Email is the fastest method of receiving results.

Voicemail: Voicemails are kept for approximately seven (7) days unless deleted by the customer. Text Messages: MetroPCS does not store text messages. Cell site location requires a court order. Cell site address lists are updated frequently as sites are added and are available upon request.

MetroPCS charges a fee for some services: • $50 for call detail records for more than 15 days • $50 for each voicemail password reset • Pen Registers: $200 set up fee, plus $20 per day maintenance with

a minimum fee of $500 • Wire Taps: $400 set up fee, plus $40 per day maintenance • Court Ordered Requests for On-going Weekly Call Detail Records:

$200 per target number (e.g., fugitive situations) • $200 for CFID changes for pen registers and/or wire taps

All requests received by fax or email generate an automatic receipt of request. The automatic response will provide a link to a website that has been created for checking status. Email is the fastest method of receiving results. Because MetroPCS allows unlimited calls, a call detail report can easily be too large to fax, so it is advised that you narrow your timeframe as much as possible.

metroPCS® Permission to speak freely.

0

The corporate offices of MetroPCS are located at

- 4066 -

Corporate Security

Law Enforcement Manual

A guide to understanding Sprint's processes and procedures in the compliance with . legal demands

Created on 3/20/200710:12:00 AM

- 4067 -

LEA Manual Outline

- INTRODUCTION

- Important Numbers Reference

- Section 1 (REQUESTS)

- Section 2 (EMERGENCIES)

- Section 3 (EXPEDITED REQUESTS)

- Section 4 (TRIALS & APPEARANCES)

- Section 5 (MISCELLANEOUS REQUESTS)

- Section 6 (Reference Page)

• Frequently Asked Questions • Glossary

- Appendix (Sample Forms)

Created on 3/20/200710:12:00 AM 2

- 4068 -

INTRODUCTION

This handbook was created for law enforcement agenciesto' help clarify the processes and procedures implemented by Sprint for the compliance of legal demands. The handbook includes contact information, billing information, service of legal demands on Sprint, types of legal demands required and miscellaneous general information for your future reference.

With the rapid deployment of new technologies and service areas and the continued growth of our customer base, Sprint looks forward to fostering and maintaining good relationships with law enforcement agencies nationwide. Your comments and suggestions for improvements are appreciated.

Please Note: this handbook is created to assist LAW ENFORCEMENT. Please do not release any information to customers that is not specified in the customer request section.

Created on 3/20/200710:12:00 AM 3 - 4069 -

IMPORTANT PHONE NUMBERS

Corporate Security

Subpoena Compliance

Electronic Surveillance

Emergency Line for PSAPS

Exigent Line for Law Enforcement direct

Subpoena Compliance Fax

Electronic Surveillance Fax

Trial Line

E-Compliance

Immediate Response Request

Created on 3/20/200710:12:00 AM 4 - 4070 -

SECTION 1

REQUESTS

SUBPOENA COMPLIANCE

'Subpoena Compliance responds to requests of a historical nature, as described in the table below, When responding to requests, the delivery methods supported by Subpoena Compliance are Fax, email, US mail, FedEx (your acct number needed). With some request types, a fee is involved.

Reguest tlllH~ Reguired legal Results Wording demand

SUBSCRIBER SUBPOENA OR Name, Address, Date account Please provide INFORMATION COURT ORDER was opened, ESN (Electronic subscriber information Basic Serial Number). pertaining to this

number from to

. [If no time frame is given, you will receive the most current informationl

SUBSCRIBER SUBPOENA OR Name, Address, SSN, DSL, Please provide INFORMATION COURT ORDER DOB, Date account was opened, subscriber information

ESN (Electronic Serial pertaining to this Number), all numbers associated number with the account. from to

. [If no time frame is given, you will receive the most current information]

CDR (CALL SUBPOENA w/out cell Incoming and outgoing digits Please provide all DETAIL site - COURT ORDER w/date & time, for the most incoming and outgoing RECORDS) w/cell site recent 45 days, 'Cell site can be calls for this number

provided if specifically for most recent requested-court order needed* 45 days, *CDR Is only

available for the most recent 45 days*

BILLING SUBPOENA OR Bill reprints, showing all billable Please provide all billing RECORDS COURT ORDER calls including outgoing digits, records for this number

from to

IP REQUESTS SUBPOENA OR Name & time stamps Please provide all COURT ORDER subscriber information

for IP Address: from

to PAYMENT SUBPOENA OR date & time, type of payment, Please provide any & all INFORMATION COURT ORDER account number (other payment information on

information available upon account:

Created on 3/20/200710:12:00 AM 5

- 4071 -

( request).

SHIPPING SUBPOENA OR Information on where the Please provide shipping INFORMATION COURT ORDER account was set up. information for account:

or telephone number:

and where the account was set UP.

Calls to SUBPOENA OR All incoming calls to the Please ru n a reverse Destination COURT ORDER requested number for the number search on this Search specified date & time. number from

to LONG DISTANCE SUBPOENA OR Incoming digits and subscriber Please provide the trace TRACES (LDD) COURT ORDER information on requested calls. results for a call that

was received on this long distance line at this date & time

Tower Search Court Order All calls that utilized a specific Please provide incoming tower during a specific time and outgoing calls on frame cell towers at or near

(address) from __ to Greenwich

Mean Time Retail Store SUBPOENA OR DVD of available video from Please provide available Surveillance COURT ORDER retail store cameras (some video from the Sprint Tapes locations will be on VHS tape retail store located at

and available in store) (address & store number if known) on (date) between the

hours of (start time) and (end time).

Pursuant to Court Order Requested Information as authorized by Court Order

ELECTRONIC SURVEILLANCE

The request types handled by Electronic Surveillance group are stored communication requests and requests that go into the future. With some request types, a fee is involved (see fee schedule).

Reguest tlll2e Reguired legal Additional Results Wording demand Documents

LOCATION BASED COURT ORDER OR Precision GPS coordinates Please provide SERVICES CUSTOMER CONSENT Location form (longitude and GPS, Precision

(Information provided latitude) Location, to LEA) and/or latjlong

coordinates for this number

PEN REGISTER / COURT ORDER Completed Real time Please install a TRAP & TRACE(data, CALEA incoming and Pen Registerj iDen, interconnect, coversheet. outgoing digits Trap & Trace

Created on 3/20/200710:12:00 AM 6 - 4072 -

( PCS, and Readylink)

WIRETAP / TITLE III (T-III) (data, iDen, interconnect, PCS, and Readylink)

CONTEMPORANIOUS BILLING RECORDS

STORED ELECTRONIC COMMUNICATION

*57 for Cable

LEA must have a CALEA feed established.

COURT ORDER Completed CALEA coversheet.

LEA must have a CALEA feed established.

COURT ORDER

COURT ORDER / Stored SEARCH WARRANT/ Communications CUSTOMER CONSENT request form FORM

Customer Consent *57 request form

SECTION 2 EMERGENCIES

(cell site provided on ... (provide if authorized). the telephone

# and Federal/State statute).

Real time Please install a incoming and Wiretep/T-III outgoing digits & on ... (provide a real time audio. minimum of (Cell site, text, the telephone 3G and ready link number & services provided Federal/State if authorized in statute). order and specified on CALEA Coversheet) Incoming and Please provide outgoing digits. contemporaneo (Cell site, text, us billing and ready link reports for this services provided number if specified in for court order). the time frame (THIS IS NOT of to REAL TIME) voice mail Please messages, provide ... (List text/SMS the type of messages, email stored content, electronic photographs, communication videos, web you need. traffic, tower searches

Procedures have been established by Sprint to assist PSAPS and law enforcement during emergency situations. Depending on the situation, we can provide subscriber information, call detail records, cell site information, precision location of mobile device (GPS), real time pen register, or real time audio interception (wiretap).

Emergency Exigent Circumstances Request For Sprint, an exigent circumstance is an IMMEDIATE LIFE OR DEATH situation as

determined by law enforcement that involves a Sprint pes or Nextel mobile device. To initiate the exiaent nrocess, please contact the Electronic Surveillance Unit at

ueated on 3/20/200710:12:00 AM 7

- 4073 -

(

911 Emergency Calls Public Safety Answering Point Officials needing assistance with 911 calls made by

Sprint and Nextel mobile devices or 3rd party 911 calls relating to a Sprint or Nextel customer are to contact the Electronic Surveillance Unit. A 911 call MUST have been placed for information to be released. Please contact the Electronic Surveillance Unit at 866-398-3284 to initiate the 911 Emergency Call procedures.

Section 3

IMMEDIATE RESPONSE REQUESTS

At times there is a need by law enforcement to obtain the requested information in a rushed manner, but the situation is not an emergency. For those circumstances, Sprint created a special process of taking a legal demand out of the normal course of business and expediting it to a response time of four to eight business hours after receiving the legal demand. This is known as our Immediate Response Request (IRR) process.

We charge a nominal fee for expedited responses. Working requests out of order involves additional costs for Sprint due to technical systems issues, additional delays for other requests and more phone calls since older legal demands are delayed. However, no charge is incurred by the requesting agency if no records are found for an expedited request.

This is a premium service and not subject to the confines of 18 USC § 2706 as we are not charging for the records but for the premium expedited service. Because of past difficulties in obtaining reimbursement for this service, our company only releases expedited records upon payment in full for the service.

The IRR group may be reached at and is available Monday - Friday, 8 :00 am - 5: 45 pm, Central time. I ney may also be reached via e-mail at

SECTION 4

TRIALS & APPEARANCES

The Sprint Subpoena Compliance Trial Team offers trained custodians of record to appear and introduce records or explain company policies, practices and procedures at legal proceedings. Only these designated custodians are authorized to give testimony regarding Sprint customer records in most cases. Custodians of record are based out of the Sprint offices in Overland Park Kansas and Reston Virginia. We do not maintain

Created on 3/20/200710:12:00 AM 8 - 4074 -

local representatives in other markets and store personnel lack access to call detail and other frequently asked information required for most appearances.

For occasions where more expert and specific information is needed on the characteristics of individual network elements, the Trial Team coordinates the involvement and appearance of Sprint network engineers.

In addition to appearances at legal proceedings, Sprint subject matter experts may be available for speaking engagements at workshops and seminars. Topics covered include telephone features review, how to request documents/assistance from Sprint and Sprint network capabilities.

Because of Sprint's nationwide network presence, there is a large demand for appearance services. Legal proceeding appearance requests with less than two weeks' notice may not be fulfilled. Seminar and workshop appearance requests with less than four weeks' notice may not be fulfilled. In addition to a subpoena for court appearances, pre-paid travel arrangements must be made by your office in order to guarantee an appearance.

To coordinate an appearance or for more information, please contact the Trial Team at Subpoenas and other documents

may be sent via fax to ,

Section 5 Miscellaneous Requests and Contacts

Personnel records for Sprint employees: call the Sprint Legal Department at for further assistance.

Sprint Legal Department

Fraud Management for Customers

Fraud Management for Law Enforcement

Long Distance Service for Customers

Sprint pes Customer Service

Created on 3/201200710:12:00 AM 9 - 4075 -

SECTION 6

Frequently Asked Questions

What is your legal name? o Sprint Nextel Corporation

What restrictions apply when I want to obtain records via e-mail? o We are only authorized to send Sprint records to a recognized government

e-mail addresses. If the agent does not have a government e-mail address then we cannot send it via e-mail. Any records that are sent via email will be encrypted using Entrust® encryption. Agencies not currently using Entrust® will be required to download a small program from the Entrust® website in order to decrypt the records.

I I Electronic Surveillance Fee Schedule

(NO FEES APPLY FOR PSAP REQUESTS!!!!) Type of Request Fee Notes Pen Register Trap and 1) Implementation fee per Implementation is capped Trace & Wiretaps for: market per technology: @ $2000 for the entire - iDEN voice - $400 (capped @ $2000) surveillance. - iDEN digital dispatch - iDEN packet data 2) Daily maintenance per No cap on daily - cdma voice technology: maintenance. - cdma data - $10

NOTE: If markets or Note: No fee for text Note: No fee for text technology are added after message or Ready Link message or Ready Link initial implementation the intercepts. intercepts. cao of $2000 still aoolies. Late extension to order Applicable implementation Daily fees apply. (requested after initial fee. surveillance has expired) Stored Electronic $120 for pictures and Fee applies for all the Communications videos applicable stored

$60 for e-mail communications per $60 for voicemail mobile number or e-mail $30 for text messages address.

Contemporaneous Billing $50 each time information CDR's will be provided is sent when requested or on an

agreed to interval. Account Takeover $300 per target account LEA takes responsibility for

plus any accrued charges any billed amount on on subject account subject account. Keeps

accou nt from being suspended for non-payment. Not always 100% effective. May not be transparent to subject.

Precision Location / GPS $25 initial pinq + $20 Provides real-time GPS

Created on 3/20/2007 10: 1 2:00 AM 10

- 4076 -

additional ping location information on mobile device.

NOTE: No fee in Exigent, PSAP, or customer consent situation.

Cell Site / Sector $50 per request Provides real-time cell site / sector of requested

NOTE: No fee in Exigent, number. PSAP, or customer consent situation.

How much will it cost to implement my surveillance?

Fee Schedule: Electronic surveillance nationwide for voice or digital dispatch service the fee is $400 per market j MTA. Implementation fee is capped per request at $2000. Per request means each time the requestor initiates a request for service change. Data surveillance is $400. All data surveillances are nationwide implementation. A $10 per day per technology maintenance fee applies for all active surveillances.

No fee to implement text message or Ready Link surveillance unless they are the only surveillance implemented.

Example 1: Initial surveillance request for voice + digital dispatch + text message for a nationwide implementation.

Applicable fees: Initial implementation would be $2000 + $20jday.

Example 2: Initial surveillance request for voice + digital dispatch + data for a nationwide implementation.


Example 3: Initial surveillance request for voice + digital dispatch in 1 market.


Example 4: Initial surveillance request for voice + digital dispatch + data in 1 market.


Created on 3120/200710:12:00 AM 11 - 4077 -

Example 5: Initial surveillance request for voice + digital dispatch + data in 1 market.

2nd request received 2 days after initial surveillance start date to add 3 markets.

Applicable fees: Implementation fee would be $2000. 3 markets x ($400 voice + $400 digital dispatch + $400 data) = $2000 cap + $30jday

Example 6: Initial surveillance request for voice + data + text messages in 2 MTAs.

2nd request received 15 days after initial surveillance start date to add 4 MTAs.

3rd request received 1 day after 2nd request to add 6 MTAs.

Applicable fees: Implementation fee would be $2000 cap. 12 markets x ($400 voice + $400 data) = $2000 cap + $20jday

Example 7: Initial surveillance request for Ready Link + text message nationwide.

Applicable fees: Implementation fee would be $2000 cap + $10jday. Ready Link or text messages are free if included with at least one other implementation fee. It is up to you to decide which service, RL or TM, generated the implementation fee!

GLOSSARY

• T3- Wiretap

• SMS- Short Message Service

• LBS- Location Based Services

• GPS- Global Positioning System

• PSAP- Public Safety Answering Point (911 Centers)

• LDD- Long Distance Division

• CDR- Call Detail Records

Created on 3/201200710:12:00 AM 12 - 4078 -

( • ESN - Electronic Serial Number

• SSN- Social Security Number

• DSL- Driver's License Number

• DOB- Date of Birth

• IRR- Immediate Response Request

Exigent Form

CALEA Coversheet

Stored Communication Request form

Precision Location Request form

*57 Request Form

Subpoena/Court Order Protocol

Created on 3/20/200710:12:00 AM

Appendix

13 - 4079 -

Sprint ~ Together with NEXTEl

Sprint Nextel Corporate Security Electronlc Surveillance

MANDATORY INFORMATION

FOR EXIGENT CIRCUMSTANCE REOUESTS Agency letter head must be faxed with this form

Fax all requests to Sprint at Sprint Corporate Security Emergency Contact:

***PLEASE PRINT*** LAW ENFORCEMENT AGENCY (LEA) ____________________________________ _ ADDRESS OF LEA PHONENUMBERO~F~L~E~A~_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_~FA7X~#===============-----

AGENT'SNAME ______________________________ ~~~~---------AGENT'S TITLE BADGE # SUPER Y ISOR ' S N-:-Ac:M-:E=---------------------;S:::-U::Pc::E-::-R:-:yc;-;IS:::Oc:::-R·' S PH ONE.:-#;;--------

I hereby certify that I have been granted authority by the above-mentioned LEA to determine and declare an exigent situation involving:

a) immediate danger of death or serious bodily injury to any person; b) conspiratorial activities characteristic of organized crime; c) an immediate threat to a national security interest.

Below is my description of the exigent situation that requires Sprint Nextel to respond immediately (please include the Sprint Nextel phone number or any other relevant information):

SPRINT NEXTEL PHONE NUMBER or CUSTOMER NAME:

EXIGENT DESCRIPTION:

I am requesting that Sprint Nextel provide the following service(s) (mark all that apply):

Subscriber Information Call Detail Records (within the past week) Call Detail Records with cell site information (within the past week) Precision Location of mobile device (GPS Location) * Real-time audio interception (wiretap) * * Real-time Pen Register, Trap & Trace * * Other, please specify: _____________________ _

* You must have access to CALEA delivery capability with Sprint.

:f Pursuant to Title 18 United States Code §2518, §270 I, and §3125 all electronic surveillance and location information assistance will terminate if the appropriate legal demand or customer consent is not received within 48 hours. The valid legal demand or customer consent should be faxed to .

SIGNATURE

Created on 3/20/2007 10:12:00 AM

DATE

14

- 4080 -

\~ Sprint ~

Together with NEXTEl

Sprint Nextel

CALEA Coversheet

Corporate Security Electronic Surveillance

PLEASE INCLUDE AGENCY COVER SHEET (Failure may result in delay of implementation)

Target's Telephone Number (please check one) 0 Sprint- MDN , 0 Nextel-PTN:, ___________ _

(To minimize the risk of an account under surveillance being suspended, please contact our office to complete the Account Takeover process - please note $300 fee per target).

Law Enforcement Agency: _____________________________ _

LEA Tech. Agent Name: _______________ Contact phone #(s): _________ _

Alternate Contact: Contact phone #(s): _________ _

Contact fax #: _________ _

CALEA Case ID _______ Ifyou have never been assigned a Case!D, please call

Billing name & address (if purchase order is required, please submit with Court Order):

(Pen) Surveillance Start date: ________ (Pen) Surveillance termination date: __________ _

(Dispatch) Surveillance Start date: (Dispatch) Surveillance Termination date: ________ _

(Audio) Surveillance Start date: (Audio) Surveillance termination date: ________ _

List Market areas for implementation (ie: New York, Miami, Atlanta)

Please provide the following infomlation when requesting assistance to intercept voice communications:

Audio Call Content Delivery: DO POTS 0 Combined 0 Separated ISDN 0 Combined 0 Separated

Dialed Number(s): --;:----::-------:c;---, Rollover? Y N Hunt Group? Y N __ (please indicate # of lines to be used for this surveillance)

Call Identifying Information Delivery:

o CDS (CALEA Delivery System)

Public ROlltable IP Address: ___________ _ Port: 13131

Please provide the following information when requesting assistance to intercept Sprint Ready Link (Push-ta-talk service), Nextel Walkie-Talkie or Sprint Vision packet-mode data services

o Packet-Mode Data Call Content

Public Routable IP Address: ___________ _ Port: 11070

o Packet Mode Data Call Identifying Information

Created on 3120/200710:12:00 AM 1 ')

- 4081 -

( o

Sprint ') Together with NEXTEl

Sorint Coroorate Securitv

MAIN PHONE NUMBER:

I Sprint Analyst: Analyst Name I Sprint Case #: STS case #

Notice of Charges for Stored Communications and Electronic Information Authorized by 18 USC 2706

Sprint PCS MDN and/or Email acct: ________ _ Please mark all requests that apply:

o STORED VOICEMAIL REQUEST (May not be transparent to subscriber)($150.00)

o HISTORICAL SMS/TEXT MESSAGES REQUEST (14 day storage limit) ($150.00)

o HISTORICAL E-MAIL USAGE REQUEST ($150.00)

o STORED PHOTOSNIDEO ($150.00) (Photos stored on web site at the time of request)

o CONTEMPORANEOUS BILLING ($50.00 each time sent)

REQUESTING AGENCY: ________________ _

BILLING ADDRESS (Street): ________________ _

ATTN TO: ___________________________ _

BILLING ADDRESS (City, State, Zip Code): ______________ _

AGENCY FAX #: ______ _ AGENCYPHONE#: _________ __

AGENT AUTHORIZATION: ___________________ _

AGENT TlTLE: ___________ _ BADGE #: ___ _

AGENT CONTACT#: ______ _

AGENT SIGNATURE: ______________ __ DATE: ___ _

Note: These records are not toll, transactional or billing records kept in the normal course of business.

Created on 3/20/200710:12:00 AM 16 - 4082 -

\~ Sprint ~

Together with NEXTEl

PRECISION LOCATION REQUEST FORM

DO NOT FAX BEFORE CALLING THE SECURITY LINE!!!!

Corporate Security FAX all requests to Sprint Corporate Security at:

***Pleasefax in agency coversheet along with thisform ***

***PLEASE PRINT***

LAW ENFORCEMENT AGENCY (LEA): ______________ _ LEA ADDRESS: _______________________ ___

LEA PHONE NUMBER: L-J ____ FAX #: L-J ____ _ AGENT'S NAME: AGENT'S TITLE: -------------BADGE #: ______ _

SUPERVISOR'S NAME: -,,---,------,-______ ___ SUPERVISOR'S PHONE #: L-J __ _

Billing name & address (if purchase order is required, please submit with Court Order or customer approval):

1, agent listed above in AGENT'S NAME, hereby certify that 1 have been granted authority by the abovementioned LEA to authorize Sprint to bill LEA listed above for recovery of administrative fees.

Fee schedule: $25 for initial location plus $20 per additional location provided.

NOTE: Fee applies if location is provided. Location includes cell site, sector, or longitude and latitude regardless of radius of return. Radius of return is the accuracy oflocation provided in meters. No location fees apply when Subscriber Consent Form accompanies this fonn.

Customer phone number: L-J ______ Customer Name: _________ _

NOTE: Real time precision location in(ormation requires a Court Order or customer approval.

The Court Order, Exigent, or Subscriber Consent Fornl for Location MUST BE faxed with this completed form to 913-315-0736 as soon as it is officially signed.

Created on 3/20/2007 10: 1 2 :00 AM 17

- 4083 -

(

Sprint '> Together with NEXTEl

Corporate Security Contact Info

*57 REQUEST FORM

Date: ___ I ___ I __ _ CableCo. __________________________________ __ Analyst Name ( Cable Co ):, ____ -=-----,, __________ _ Telephone: _______________ Fax #: __________ __

Complainant Telephone: _________________ _ Nature of Calls:

Hang-up Computer/Facsimile Obscene Verbal SilenceThreatening Harassment Date of Calls

Kidnapping/Runaway Time of Calls

Police Report Information Required Case #: _________ _

Law Enforcement Agency: ________________ _ Law Enforcement Agent: _________________ _

Law Enforcement Contact Number: _____________ _ Law Enforcement Fax Number: ______________ _

Created on 3/20/2007 10:12:00 AM 18 - 4084 -


1. What types of information can be retrieved from your systems on hand and for what time period is maintained in this manner?

Type of Information Sprint/CDMA Nextel/iDEN

Subscriber Information In perpetuity In perpetuity

Call Detail Information 45 days 18 months

Push to Talk/Direct 45 days 18 months Connect dispatch records

Bill Reprints 7 years 7 years . Payment Information In perpetuity In perpetuity

Cell Site Information 45 days 18 months

Internet history detail 45 days (IP and Web Sites) N/A

IP address customer Depends on type of service: N/A information Broadband Wireless (In

Perpetuity) SprintLink (In Perpetuity) Sprint PCS I.P. 30 days

Shipping information In perpetuity N/A (for telephone/service delivery)

Voicemail Active Accounts Only (can Active Accounts Only only record what is currently (Usua Ily the past 30 days if on the subscriber's voicemail. the messages have not been Deleted VM cannot be deleted. Deleted VM cannot retrieved. be retrieved.

Stored photographs Depends on where the N/A photos are stored. Each request is unique.

Stored video Depends on where the videos N/A are stored. Each request is unique.

Text Messages 14 days 7 days

GPS data Real time only Real time only

2. After the above data is moved or stored in a different manner how long is the period of ultimate retention and what is the expected time frame to retrieve this data?

Only call detail information is stored past the timeframes above. This information is stored on computer backup tapes and is controlled by a third party vendor of Sprint Created on 3/20/200710:12:00 AM 19

- 4085 -

( Subpoena/Court Order Protocol

Nextel. Obtaining those records involves significant cost and time (the average request takes 10-12 weeks). Currently, information is available for the past three years on both networks. However, the information stored may not be complete.

3. What subpoena wording should be used to obtain the following information?

• Current Customer Information with ESN and Features

Please provide any and all subscriber information for telephone number ____ for the following dates: [date] to [date]

[If no time frame is given, you will receive the most current information]

• CDR (Call Detail Records)

Please provide all incoming and outgoing calls for telephone number ____ for the following dates: [date] to [date]

• Direct Connect Records (also known as push-to-talk (PTT) or walkie-talkie or digital dispatch or ReadyLink)

Please provide all push to talk dispatch records for ____ for the following dates: [date] to [date]

[You must indicate your need for push-to-talk records if you wish to receive them as they are covered as calls, tolls or Iuds]

• Bill Reprints

Please provide all billing records for ___ for the following dates: --1[-"d"'a-"'te""]L..-___ to [date]

[If no time frame is given, analyst may contact agent to narrow search which will delay processing].

• Terminating Number Searches

Please provide a reverse number search for telephone number ___ for the following dates: [date] to [date]

• Customer Information with Call Detail Records

Created on 3/20/200710:12:00 AM 20 - 4086 -

( Subpoena/Court Order Protocol

Please provide any and all subscriber information as well as incoming and outgoing calls for telephone number for the following dates: [date] to [date] . [if Push to Talk/Direct Connect detail is needed, it must specifically be mentioned. For example, "Please provide any and all subscriber information as well as incoming and outgoing calls and push to talk dispatch records for telephone number for the following dates: [date] to [date] .].

• IP Information

Please provide any and all subscriber information for IP address ___ for the following dates: [date] to [date] .

[If no time frame is given, you will receive the most current information]

• Payment Types

Please provide any & all payment information for ______ (name, SSN, account number, telephone).

[Will not receive actual check copies unless specifically requested; will receive date and time, type of payment, account number]

• Mobile Numbers Associated with a Target and Address

Please provide any and all accounts and associated telephone numbers for ___ _

[Provide all known identifying information but must have name or SSN as we cannot search by address. If multiple results appear, analyst will contact agent to narrow search which will delay processing].

4. Can you provide guidance that can reduce processing time?

Use specific and plain wording to describe your request (avoid legal or telecommunications jargon). Provide as much identifying information as possible. Make sure the request is appropriately and clearly signed. Do not send multiple requests. Combine related requests (for instance, all pursuant to court order requests for a particular court order may be sent together in one request. Specify date ranges. Do not request information "through the present date." If information through the compliance date is needed, state that in the request. Use the exigent process for emergencies and the immediate response request process for expedited service.

5. Is there a way to expedite requests?

We separate our requests into several priorities to help expedite the production of documents pursuant to court orders and grand jury subpoenas. Beyond this prioritization Created on 3/20/200710:12:00 AM 21 - 4087 -

( , Subpoena/Court Order Protocol

by legal demand, the only fair method for production we have found is to respond in the order received.

Due to the high volume of legal demands and customer requests received by our department, our current processing time for non-Electronic Surveillance issues is approximately 14 - 15 calendar days with grand jury requests being processed within 7-10 days on average. Working requests out of order generally leads to systems concerns for us (we have an automated distribution system for case work which must be overridden), additional delays for some requests and more phone calls since older legal demands may be delayed. All of this involves significant cost to Sprint Nextel.

We offer only two ways to expedite requests. The first is in an exigent circumstance where a law enforcement official has declared the release of information vital to the immediate prevention of serious bodily harm or loss. The second method is through our Immediate Response Request (IRR) process. This is a premium service and not subject to the confines of 18 USC 2706 as we are not charging for the records but for the premium expedited service. Because of past difficulties in obtaining reimbursement for this service, our company only releases expedited records upon payment in full for the service. The charge for this service is $50 per number searched. We verify the existence of records prior to any charges being incurred. The turnaround time for most IRR responses is one to four hours after receiving payment and the legal demand.

The IRR group may be reached at. and is available Monday - Friday, 8:00 am - 5:45 pm, Central time. They may also be reached via e-mail at

6. Should subpoenas specify the individual who must receive the subpoena response?

Not in most cases. Sprint Nextel Corporation is sufficient unless an appearance is needed. For appearances, please send to the Sprint Nextel Corporation, attention: Custodian of Records.

7. Should the subpoena include contact and fax numbers?

Yes. Name, telephone, e-mail and fax are helpful.

8. Should subpoenas include the time frame by which the information is needed?

Not necessary. Subpoenas are worked in order of receipt.

9. Should subpoenas avoid the use of verbiage such as "ASAP", or does your company look for a compliance date?

Created on 3/20/2007 10: 12:00 AM 22

- 4088 -


Subpoenas are worked in order of receipt therefore wording such as "ASAP" is not considered. Use the exigent process for emergencies and the immediate response request process for expedited service.

10.How should Law Enforcement Agencies request customer contract information?

Use this wording: Please provide customer contract information for _____ _ (name, SSN, account number, telephone).

l1.ls there any type of wording that will delay subpoena processing or require the subpoena to be revised?

Do not request information "through the present date." If information through the compliance date is needed, state that in the request. Do not use legal or telecommunications jargon. If Push to Talk/Direct Connect information is needed, specifically request that information.

12.Should Law Enforcement Agencies avoid the use of telecommunications terminology? (i.e., Carriers often use company specific terminology that is not recognized by other carriers.)

Yes. Do not use legal or telecommunications jargon.

13.What are your billing cycles?

Monthly but customer may set day within the month.

14.How long do you maintain customer name, address, and contact numbers?

In perpetuity.

lS.How long are bill copies available? Can some bill copies be retrieved more quickly than others (i.e., more recent information)?

Seven years. Age of bill reprints does not affect retrieval time.

16.Can calling party numbers or cell site information be provided? If so, can the information be provided with dates, times, and duration?

Yes. Location information (such as cell site information) requires a demand signed by a judge (court order or search warrant). Information includes dates, times and duration of

Created on 3/20/2007 10: 12:00 AM 23

- 4089 -


connection. If Push to Talk/Direct Connect information is needed, specifically request that information.

17. Can you provide foundational and expert witnesses for depositions, court appearances or more in depth analysis?

Yes. Please contact our Trial Services Team at

For prepaid services

18.Can you provide inbound and/or outbound call information on prepaid phones?

Yes.

19.Can you identify target numbers that are prepaid phones?

Yes. However, subscriber information is not always accurate on pre-paid accounts.

20.Is international dialing permitted on prepaid phones?

Yes but it is a feature which must be purchased and enabled.

21.Can permanent personal 800 numbers be utilized on prepaid phones?

No.

/

Contact Information

22. Where should subpoenas, search warrants and court orders be sent?

For most criminal matters:

Sprint Nextel Corporation

Created on 3/20/2007 10: 12:00 AM 24

- 4090 -


For criminal matters dealing with Sprint Nextel employee information:

Sprint Nextel Corporation

For all civil matters:

23.What are your company's bUSiness nours?

• Subpoenas: Monday - Friday, 8:30 am - 7:00 pm (ET) • Court Orders & Exigent Situations: always open (365x24x7)

Created on 3/20/2007 10:12:00 AM 25 - 4091 -

T-Mobile USA, Inc. Law Enforcement Relations

Michael McAdoo

Director

- 4092 -

TICTU Conference Cleveland, Ohio

• LER Group - Organization

• NJ Consolidation

- New Products • @Home II

- New Capabilities • Packet Data • E-911 WebMap

• UMTS • X-Mine Data Retention

- 4093 -

Organization

• Closing of Bellevue Office - Efficiency of management

- Efficiency of 24/7/365 coverage

• 30 Personnel - Addition of on-staff attorney

- Tracking toward 120,000 responses/350,000 subscriber records in 2008

- 8,000+ calls per month

• SIR-II System

- 4094 -

@Home - II

• UMA Home-Phone Replacement

• Addition of RJ-11 "cordless" handsets - SIM card for each

• Through existing Alcatel network core

• Fully CALEA-Compliant

- 4095 -

Capabilities Ii Ii "

P ktDtl!

• ac e a al I

~ • E-911 WebNpap

·UMTS • X-Mine Dat~

! ~

Retention i , I,

I i 1 -)

- 4096 -

X Mine Capabilities

• Ability to search SIM-Iess 911 calls

• Ability to retrieve historical cell site information (potentially for up to 6 months) reports can retrieve up to 500 rows of information per request, multiple reports can be compiled,

• Ability to Search Cell Site 10 for active calls (not registration), of any subscribers that utilize T-Mobile network, during a designated time frame.

• Ability to retrieve GPRS connection dates, times, and location of where initial connection took place (cell Site) - Not to include Internet content or IP address

information

- 4097 -

Search for records by Cell 10

• X Mine can conduct searches on particular Cell Sites (and sectors) in a given time frame. The shorter the window requested, the sooner the information can be provided.

• First or last Cell 10 for call activity only. Autonomous registration on the T-Mobile network will not be captured.

• LEA will receive call detail records that occurred on that Cell 10 (and Sector), for the time frame requested.

• The LEA must stipulate whether they demand subscriber information to support those call records

• This search limits the amount of T-Mobile CPNI that is released to the LEA, as it is controlled and filtered according to the LEA's request.

• Fees not yet set

- 4098 -

- 4099 -

Law Enforcement Reference

Dear Law Enforcement Professional,

Welcome to the third edition of the T-Mobile USA, Inc. Law Enforcement Reference Guide. This evolution covers changes brought about by recent corporate mergers, changes to customer service systems and billing system consolidation, emerging packet data and Wi-Fi technology and changes in the law.

T-Mobile USA, Inc. Is a wireless provider of voice and data services. T-Mobile USA is an affiliate of Deutsche Telekom AG (DT), and is made up of the former US operating entities VoiceStream Wireless, Powertel, DIGIPH, Aerial Communications, Omnipoint Communications, PCS One, SOL Communications, and MobileStar Corporation. T-Mobile USA currently employs approximately 22,000 employees in the United States.

T-Mobile USA is the only US operator with a GSM (Global System for Mobile Communications) network across its entire footprint. Currently, T-Mobile USA has over 16 million subscribers in 45 of the nation's top 50 markets. By using GSM-the most widely used wireless technology standard in the world-T-Mobile USA can also offer its customers the ability to use their mobile phones in over 80 countries. Worldwide, the wireless affiliates of DT service over 74 million subscribers. A list of our service areas, products, services and plans can be found at our website at http://www.t-mobile.com/.

In addition to circuit-switched Personal Communications Service (PCS), T-Mobile USA offers two modes of packet-data communication and text messaging. GPRS (General Packet Radio Services) technology is an extension of GSM and provides customers wireless Internet access at speeds that rival or exceed standard wired dial-up offerings. Wi-Fi, also referred to as (802.11 b, is a wireless local area network (LAN) technology offered in hundreds of public locations across the country including airports, airline clubs and select Starbucks coffeehouses, providing high-speed wireless access to the Internet using Wi-Fi enabled laptops and PDAs. Text messaging is available between T-Mobile USA handsets; between T-Mobile USA handsets and text-messaging-capable handsets of other service providers; from our T-Mobile USA website to a wireless handset; and between T-Mobile USA handsets and AOL Instant Messenger (AIM) service.

T-Mobile USA has staffed its Law Enforcement Relations Group with highly trained personnel who are dedicated to offering accurate, thorough, and timely assistance to criminal investigators regarding these technologies. Our staff members are familiar with the technical capabilities of our lawfully authorized electronic surveillance systems and billing systems, and with the evidentiary needs of local, state, and federal officials in our operating areas. We offer this Guide in the hope it will address most questions regarding our services and technology, but we're always available to address more specific questions.

If you have any questions regarding our services for law enforcement, please call our group at

Sincerely,

Ulrector, LER Group - 4100 -

( Law Enforcement Reference ~~.'~ to .,J\ilnl)·ilp,;· 1ll _ \1 _ "..." _ ~ .... ~ ..2 __ .:.. "'_.'_ RESTRICTED DOCUMENT

(=>~t rncre fr"orn! c·~'

NOTICE

The information contained in this reference guide is the confidential and proprietary information of T -Mobile USA. Distribution is strictly restricted to bona-fide law enforcement personnel strictly in support of their official duties.

© 2003 T-Mobile USA, Inc .. All rights reserved. Printed in the USA.

- 4101 -


TABLE OF CONTENTS

Introduction.................................................. ............................................ 5 T-Mobile USA Company History Services GSM: The International Standard What is a Srnart Card? More Privacy Multi-Functionality Two-way Text Essential GSM Terms

Subscriber Information................................................................................. 11 Procedures Basic Subscriber Information Model Clauses for Lawful Process Available Call Detail Record Information

Pen Register Operations .............................................................................. 17 General Capabilities Switch-Based Provisioning Model Clause for Orders Nationwide Scope/Carrier Identification Nationwide Scope / Carrier Narning Location Information Delivery of Call-Related Data Service Disconnection During Surveillance

Wiretaps ................................................................................................... 20 General Capabilities Geographic Provisioning Delivery of Call Content Content Requirements for Wiretap Order Model Clauses for Intercept Order Roving Wiretap Consent Based Wiretaps FISA Location and Tracking Service Disconnection

Exigent Circurnstance ................................................................................. 23

Voicemail Orders ....................................................................................... 24 Voicernail Features Preservation of Voicemail Access to Stored and Non-Stored Voicemail

T-Mobile USA. Inc. Law Enforcement Relations Group - 2/01/04 page: 3 - 4102 -

Requirements for Access

Cloning Capabilities Model Clause for Voicemail Clone Order Implementation of Voice mail Clone

Prepays .................................................................................................. 26 Subscriber Accounts: The "Prepay" Class Suspension of Prepay Accounts Prepay Service Non-Disconnection/Suspension Payment Methods and Prepay Coupons Refund Policy Caution is Urged

Calls to Destination ..................................................................................... 29 Introduction Search Criteria Search Results Model Clauses for Calls to Destination Information Fee Schedule Limitations

Frequently Asked Questions...................... ............................... ........... ...... ... 31 Subscriber Records Call Detail Records Handsets Prepay Subscribers Voicemail Roaming Security Miscellaneous

Fees for Services ....................................................................................... 34

- 4103 -

(

,


1.0 INTRODUCTION

1.1 T ·Mobile USA

T-Mobile USA, Inc. is an indirect subsidiary of Deutsche Telekom AG (NYSE:DT). Deutsche Telekom's subsidiaries and affiliated companies provide wireless services to more than 74 million customers worldwide, making it one of the top 3 global wireless carriers in the world, and the first wireless communications company to offer service on both sides of the Atlantic with a single global brand name and a single digital technology standard - GSM (Global System for Mobile Communications). Based in Bellevue, Washington, T-Mobile USA is one of the fastest growing wireless service providers in the country, currently serving over 16 million customers. A cornerstone of the company's strong consumer appeal has been its strategy to provide customers with the best overall value in their wireless service. Through T-Mobile USA's 'GET MORE' service offerings, customers get more minutes, more features and more service with T-Mobile USA. T-Mobile USA has over 19,000 employees dedicated to delivering its GET MORE promise to customers every day.

Unlike other U.S. wireless operators, T-Mobile USA's entire wireless network is based exclusively on the Global System for Mobile (GSM) communications technology platform. GSM is the most widely used digital standard worldwide, accounting for over 70 percent of the total digital wireless market. T-Mobile USA customers benefit from this global association by having the choice to use their same phone and same phone number when traveling internationally. TMobile USA's World Class roaming rates begin at only 99¢ a minute in 26 European countries -and cover more than 80 countries worldwide.

T-Mobile USA offers consumers and enterprise customers the most advanced mobile communications services available today including voice; two-way text messaging; high-speed GPRS (General Packet Radio Services) wireless data services; and Wi-Fi (802.11 b) wireless broadband service.

1.2 Company History

Through the Federal Communications Commission (FCC) auctions of broadband PCS licenses in 1995, 1997, and 1999, Western Wireless acquired PCS licenses through its VoiceStream Wireless subsidiary. Western Wireless Corp., based in Bellevue, Washington was formed in 1994 through the merger of General Cellular Corporation and Pacific Northwest Cellular, each co-founded by John Stanton. Stanton, also a co-founder of McCaw Cellular Communications, is regarded as a leader and visionary in the wireless industry. John Stanton is currently Chairman of T-Mobile USA and Chairman and CEO of Western Wireless.

T-Mobile USA, Inc. Law Enforcement Relations Group - 2/01/04 page: 5

- 4104 -

VoiceStream launched the first auctioned PCS license in Honolulu, Hawaii on February 29, 1996 and continued to aggressively build out its PCS licenses in the western United States, based on the GSM (Global System for Mobile Communications) technology platform.

On May 3, 1999, VoiceStream Wireless was spun off from its parent company, Western Wireless Corporation. In February and May 2000, VoiceStream completed merger transactions with two

other regional GSM service providers, Omnipoint Communications and Aerial Communications. VoiceStream fully integrated the three companies by the end of 2000, converting to a single customer billing platform, implementing standard business practices and successfully launching the VoiceStream name and 'GET MORE' value proposition in all markets including New York, Philadelphia, Miami, Tampa and Detroit.

On June 1,2001, with Department of Justice approval, Deutsche Telekom AG, based in Bonn, Germany, completed its acquisitions of VoiceStream Wireless Corporation and Powertel, Inc., forming the first transatlantic wireless communications operator utilizing the GSM digital wireless technology standard. In August of 2002, VoiceStream changed its name to T-Mobile USA, Inc. T-Mobile USA and its affiliates own licenses to provide service to 95% of the U.S. population.

1.3 Services

T-Mobile USA offers a variety of rate plans for basic wireless, circuit-switched telephony over its GSM network. GSM technology is described more fully below. In addition to voice service, TMobile USA offers two-way text messaging services and high-speed wireless data services.

1.3.1 Two-way Text Messaging Services

T-Mobile USA offers its customers a variety of options for using SMS text messaging services. Every T-Mobile USA custorner, regardless of handset or rate plan, can send text messages via their handset to friends and farnily, no matter which wireless service provider they use. Additionally, every T-Mobile USA phone number automatically has a corresponding e-mail address ([email protected]) allowing customers and their colleagues to use the Internet to send, receive and respond to text messages back and forth between wireless phones and personal computers.

Finally, T-Mobile USA customers can use the popular AOL® Instant MessengerTM (AIM®) Service and the Buddy ListTM feature to connect with millions of AIM® users worldwide using PCs, wireless phones and other devices. T-Mobile USA offers the AIM® service from every TMobile USA phone, but certain phones have AIM® software built-in to make using it even easier. {

1.3.2 High-Speed Wireless Data Services

Ubiquitous GSM/GPRS Voice/Data Network: GPRS (General Packet Radio Service) is an extension of the GSM network architecture and, through T-Mobile USA's separate data network, provides T-Mobile USA customers with wireless Internet access at speeds that rival or exceed standard dial-up wired solutions. T-Mobile USA wireless Internet is available across the entire T-- 4105 -


"'... :'TICfE'; ~ !-(J ~i Mobi e USA network. Through a series of integrated devices, customers can remotely access the Internet, corporate and personal email, contacts and calendar and popular services like news and information updates, games, AOL® E-Mail and AOL® Instant MessengerTM (AIM®) service. Integrated devices include GPRS enabled phones; PC Internet Cards; and the popular Blackberry 581 Otm wireless handheld e-mail solution with Integrated phone. T-Mobile USA was the first U.S. service provider to introduce the much-anticipated Microsoft® Windows® Powered Pocket PC 2002 Phone Edition in the summer of 2002 in designated markets.

Wi-Fi 'Hot Spots': Additionally, T-Mobile USA offers Wi-Fi (802.11 b) wireless broadband Internet access in hundreds of convenient public locations and 'hot spots' such as airports, airline clubs and select Starbucks Corp's coffeehouses. T-Mobile USA is the exclusive provider of highspeed Internet access for Starbucks, with plans to rapidly build out and market the service I in Starbucks company-operated locations in North America. Unlike some other providers of Wi-Fi service, T-Mobile USA provides full T1 connection to every location where its service is provided. Using either a laptop or PDA that is Wi-Fi (802.11 b) wirelessly-enabled, customers have the speed and bandwidth to access and download large email attachments, watch a live webcast, or listen to streaming audio.

1.4 G5M: The international standard for wireless digital technology

1.4.1 What is G5M?

T-Mobile USA's Wireless network uses GSM technology. "GSM" stands for Global System for Mobile communications, the international digital radio standard. Developed to allow users to roam freely among markets, it has become the internationally accepted standard since the first systems began commercial operation in 1 991. The United States, Canada, Chile and Peru use the 1900 MHz frequency, while most other countries use either the 900 MHz or 1800 MHz frequencies

1.4.2 National and international coverage

T-Mobile USA is a rnember of the North American GSM Alliance LLC, a group of U.S. and Canadian digital wireless carriers. The GSM Alliance helps provide seamless GSM wireless communications for their customers in the U.S., Canada and around the world. Worldwide, the association's members provide digital GSM wireless services to over 500 million customers across five continents. The GSM system accounts for more than 70% of the worldwide digital wireless telephone market.

T-Mobile USA has international roaming agreements with more than 185 of the major operators worldwide, providing service in over 85 countries including: Australia, China, Chile, France, Germany, Greece, Hong Kong, India, Italy, the Netherlands, Russia, Saudi Arabia, Spain, Switzerland, and the United Kingdom. T-Mobile USA will continue to formalize roaming agreements with additional countries to increase international coverage and convenience for customers.

1.4.3 Features unique to G5M

T·Mobile USA, Inc. Law Enforcement Relations Group - 2/01/04 page: 7

- 4106 -

GSM's proven feature-rich, dominant digital technology and use of "smart cards" (a [so known as 8[M cards) provides customers with integrated voice, high speed data, fax, paging and short message service capabilities. With full digitally encrypted, over-the-air, wireless communications, voice and data, calls are kept private and confidential. This security, however, does not interfere with [awfully authorized surveillance nor does it require special equipment or software to effect an interception.

GSM technology offers excellent sound quality. Independent laboratory and field test reports validate near wireline parity. The larger number of vendors making GSM handsets and

infrastructure worldwide, offers competitive, economical ways to keep costs d'own and gives consumers more choices.

1.4.4 About our technology

GSM's proven feature-rich, dominant digital technology and use of "smart cards" (a[so known as S[M cards) enable North American GSM carriers to provide thorough customer service, call privacy, and fraud prevention. Only GSM provides integrated voice, high speed data, fax, paging and short message services capabilities. [n GSM networks, full digitally encrypted wireless communications enhances confidentiality of voice and data calls.

[n addition, North American companies using GSM technology offer excellent voice quality. Independent laboratory and field test reports validate near wire[ine parity. The larger number of vendors making GSM handsets and infrastructure worldwide, offers competitive, economical ways to keep costs down and gives consumers more choices.

1.5 What is the Smart Card?

The smart card is the "brain" of the T-Mobi[e USA digital personal communications services (PCS) phone. It's a card that comes with the T-Mobi[e USA phone, featuring a computer microchip, which can be easily insert into the phone or transfer into other phones, retaining a subscriber's phonebook and personalized service information.

1.5.1 More security

The T-Mobile USA Smart Card prevents cloning fraud and eavesdropping by encoding every voice and data transmission. Each time a T-Mobi[e USA phone is turned on, information on the T-Mobile USA Smart Card is checked to ensure that it is a genuine subscription card. The PIN stored on the Smart Card prevents the use of stolen or lost cards or phones.

1.6 More privacy

[n addition, each transmission is sent using a different random code, making unlawful eavesdropping and over-the-air theft of phone and identification numbers virtually impossible. On[ya genuine T-Mobile USA switch knows which code has been selected and how to read the encoded information, so attempts to break into the system are easily detected and eliminated.

page: 8 T·Moblle USA. Inc. Law Enforcement RAI"tinn<

- 4107 -


1.7 Multi-functionality

T-Mobile USA eliminates the need for multiple communication devices. In addition to making and receiving calls, users can accept FaxMail messages to their phone; send and receive voice, text, numeric, and e-mail messages; even receive personalized news and information services directly from the Internet.

FaxMaillets users receive a fax to their phone. The network will store the fax and allow users to print it at their convenience to the fax number of their choice. If the user's phone is turned off, the T-Mobile USA network will store any type of message and deliver it the next time the phone is turned on.

1.8 Two-Way Text Messaging:

Our two-way text messaging service gives custorners the ability to send and receive e-mail to and from a wireless device. Customers can filter, forward and reply to home or office e-rnail addresses via their wireless phone. Customers can also choose from a broad array of Internet news and information services to be delivered to their wireless phone. Message alerts can include stock prices, sports scores, daily horoscopes, weather and other news services. Customers personally select what information they want and schedule delivery when they want.

1.9 Essential GSM Terms

IMSI pronounced "im'-zee"

MSISDN pronounced flmizz'-denll

SIM Card

International Mobile Subscriber Identity Number The only identifier uniquely associated with a wireless subscriber in the international GSM environment. The 15-digit number contains cornponents which identify the Mobile Country Code (MCC), Mobile Network Code (MNC) and Mobile Subscriber Identity Number (MSIN).

Example: 310160215031658 310

160 215031658

= Mobile Country Code (USA) = Mobile Network Code (T-Mobile USA) = Mobile Subscriber Identity Nurnber

Mobile Subscriber Integrated Services Digital Network The mobile telephone number assigned to a GSM subscriber by the home carrier. In the United States the MSISDN adheres to the North Arnerican Numbering Plan; a 10-digit number including an area code (NPA), exchange (NXX) and four final digits.

Exarnple: (201) 757-2626

Outside of the United States the MSISDN usually conforrns to the numbering plan utilized in the "horne" country. For example, the mobile telephone number of a GSM subscriber in Berlin, Gerrnany rnight be: 030-872121.

Subscriber Identity Module Card Generally, a SIM card must be installed in a GSM handset in order to

- 4108 -

SIMCard (continued)

IMEI pronounced ueye'-me"

facilitate wireless calls. The SIM card electronically stores data related to the subscriber, including the IMSI, option settings, "speed dial" list and PIN codes.

GSM handsets are designed to accept SIM cards in one of two standard sizes. The full-size SIM is similar in size to that of a credit card. The mini or "plug-in" SIM card measures approximately 1" x ;1,," and is simply a punchedout portion of a full-size SIM card. Both are identical in terms of the information stored within the card.

A 81M serial number will appear on the card

International Mobile Equipment Identifier The only identifier uniquely associated with a handset in the international GSM environment. The 15-digit number contains components which identify the Type Approval Code (TAC), Final Assembly Code (FAC), Serial Number (SNR) and a single, spare digit. The IMEI generally appears on a sticker on the handset and is electronically stored within the firmware of the handset.

Example: 010008521959410 or 010008-52-195941-0

If the source of an IMEI is a T-Mobile USA handset, it may be possible to identify the first T-Mobile USA subscriber account associated with that handset.

- 4109 -

;,n. jj " " 1\./i.·; f.)".l.') ; l' ~:.~l!,. ,,' ILu 1~' 1.~. -t. -.l - liL, . .1 Law Enforcement Reference

{=:et ;'·f'!C'i-(::. f((~)(rl,. !;'f

2.0 Subscriber Information

2.1 Procedures

T-Mobile USA has established procedures for expeditiously responding to lawful requests for subscriber information from law enforcement and other authorized governmental agencies.

T-Mobile USA has established the Law Enforcement Relations (LER) Group to respond to requests for subscriber information. This group processes requests for all T-Mobile USA market areas (including the former market areas covered by Omnipoint Communications Inc., Aerial Communications, Powertel, OIGIPH, PCS One, and VoiceStream Wireless)

The LER Group is trained to review lawful authorization for the proper contents and level of authority. In the case of requests for subscriber information, the most common form of request comes in the form of a subpoena, but T-Mobile will respond to other lawful authorization where appropriate such as a search warrant or court order. Because legal authorities vary between state and federal agencies, T-Mobile USA reviews each request carefully.

Our procedures minimize the number of persons involved in response preparation for security purposes and ensure prompt compliance. Under normal circumstances T-Mobile USA returns the requested information within fifteen (15) business days. Requests for some information such as historical call detail records (those over three (3) months old), may require significantly greater retrieval and preparation time. Because T-Mobile USA receives thousands of requests each year from various law enforcement agencies around the country, the LER Group typically responds to requests in the order received with the priority given to requests associated with ongoing electronic surveillance or trial or grand jury proceedings.

2.1.1 Procedure· Service via Facsimile (Fax)

T-Mobile USA does not require "in-person" service of court orders or subpoenas upon a designated employee or corporate representative. There is no requirement for an original or

T·Mobile USA, Inc. Law Enforcement Relations GrOUp - 2/01/04 page: 11 - 4110 -

(

"hard copy" document to follow via regular mail. That option is left to the discretion of the investigative or judicial entity. T-Mobile USA will honor all valid legal process delivered to the LER Group via facsimile transmission. If T-Mobile USA has any question about the authenticity or facial validity of lawful process, when deemed necessary, a member of the LER Group will confirm the request before a response is prepared.

Fax all legal process for subscriber information for T-Mobile USA in the Eastern, Southeastern and Central US markets:

Fax all lawful process for subscriber information for T-Mobile USA markets in the Western US to:

2.1.2 Procedure· Personal Service

Agencies within some jurisdictions serve lawful process on a respondent within the local area. T-Mobile USA discourages this practice as it delays the response and unnecessarily discloses sensitive information to persons outside the LER Group who are not otherwise trained in handling such information. However, to accommodate those instances in which personal service is deemed by the agency to be necessary or required, T-Mobile USA has designated numerous "points of service" where such process can be served. There is at least one point of service within each state in which T-Mobile USA wireless services are commercially available.

For the location of the nearest T-Mobile USA "point of service" call

2.1.3 Procedure· Service via U.S. Mail or Express Delivery

Legal process may also be sent, via the United States Postal Service, comrnercial express delivery services, or couriers to:

For T-Mobile USA East/Central/Southeast:

For T-Mobile USA West:

page: 12 Group

T-Mobile USA, Inc. Law Enforcement Relations - 4111 -


Bellevue, WA 98006

2.1.4 T -Mobile USA Responses

Most subscriber information is provided to the requesting authority via facsimile. If the data is voluminous, the information will be sent by US mail or express delivery services as required.

2.1.5 Confidentiality and Non-Disclosure; Notice

Records documenting the receipt and response to lawful process are maintained by the LER Group in a secure manner. T-Mobile USA does not enter lawful process or law enforcement inquiries into the T-Mobile USA subscriber database or billing system. Access to such information is restricted to the LER Group or those with a need to know and it is treated as confidential information. There is no need to mark a subpoena as confidential or as prohibited notice to third parties.

Although not required by law in the absence of a court order, as a matter of general business practice, members of the T-Mobile USA LER Group will neither confirm nor deny the existence of law enforcement inquiries or lawful process to an inquiring subscriber, third party or other law enforcement agency. Should T-Mobile USA be served with lawful process within the U.S. for the

disclosure of such information, T-Mobile USA will promptly contact the affected investigative agency unless lawfully prohibited.

2.2 Basic Subscriber Information

When available, T-Mobile USA will provide, upon receipt of at minimum a valid subpoena from an appropriate authority, the following general subscriber information:

• Mobile Telephone Number (MSISDN) • Account Number • Account Type • Subscriber Account Name (or "Screen Name")' • Billing Address' • Subscriber's Social Security Number' • Subscriber's Date of Birth' • "Can Be Reached" (CBR) Numbers'

- Home telephone number - Work telephone number

• International Mobile Subscriber Identity (IMSI) • Date Account Established • Date Account Terminated • Means and Source of Payment • IP and Routing Address • Balance on Pre-Paid Accounts

'as provided by the subscriber

Statutes in some states are more restrictive and preclude the release of certain categories of information by subpoena. In some states a Court Order is required to authorize the release of

- 4112 -

(

any subscriber information. T-Mobile USA's response will always be governed by the prevailing federal or state statute.

NOTE: There is no need to identify the specific items of subscriber information. T-Mobile USA will provide all available basic subscriber information in response to such a request.

2.3 Model Clauses for Lawful Process for Basic Subscriber Information

Ideally, lawful process such as a subpoena will (1) clearly provide the criteria upon which a search for subscriber information will be based, and (2) specify the identification being sought. Since terms used in different communications technologies are not interchangeable, the misapplication of terms within lawful process may obscure the search criteria from a legal or practical standpoint. This could delay a response or result in the rejection of the lawful process as deficient. For example, the term "Mobile Identification Number" (or "MIN") is not applicable in the GSM technology deployed by T-Mobile USA, so a subpoena using this term will be rejected.

Sample text on the following page will assist agencies in the proper composition of the most common types of basic subscriber information.

Inquiry Based on Mobile Number (MSISDN)

The most frequent request for basic subscriber information is based upon aT-Mobile USA mobile telephone number, or "MSISDN." Sample:

" ... provide subscriber identification information for the T-Mobile USA subscriber currently associated with the mobile telephone number (MSISDN) of [insert area code and telephone number]."

Inquiry Based on Subscriber Identitv Module (SIM) Serial Number

A subscriber information inquiry may also be based upon the serial number imprinted on a Subscriber Information Module, or "SIM" card. The SIM serial number can be associated with an International Mobile Subscriber Identity number (lMSI) which is permanently linked to an individual subscriber. Sample:

" ... provide subscriber identification information for the T-Mobile USA subscriber currently associated with the Subscriber Identity Module (SIM) card bearing serial number [insert SIM card serial number]."

page: 14 Group

Inquiry Based on International Mobile Subscriber Identitv (lMSI)

A subscriber inforrnation inquiry may be based upon an International Mobile Subscriber Identity number (lMSI) which is permanently linked to an individual subscriber. This

T·Mobile USA, Inc. Law Enforcement Relations - 4113 -

( Law Enforcement Reference

;--i-)(>~"C, fl-()r-rt !~ identifier does not appear on a user's handset or S[M card. NOTE: As a result, it is unlike[y that a law enforcement agent will encounter an [MS[ during a routine investigation Sample:

" ... provide subscriber identification information for the T-Mobile USA subscriber currently associated with the [ntemationa[ Subscriber Identity Number (lMS[) of [inserllMSI number]."

Inquiry Based on International Mobi[e Equipment Identifier ([ME[)

[f a GSM handset was originally sold by T-Mobi[e USA or an authorized reseller it may be possible to associate an [ME[ (or handset serial nurnber) with the original subscriber. After the initial sale by T-Mobile USA, account information is subsequently maintained by a subscriber's account nurnber, rnobile telephone nurnber (MS[SDN) and International Mobile Subscriber Identity (lMS[). The handset itself has no permanent association with an account. [t may be interchangeably used by any number of T-Mobi[e USA subscribers or, in some cases, customers of other GSM carriers. As a result, this type of inquiry is not recommended.

Sample:

"". provide subscriber identification information for the T-Mobi[e USA subscriber originally associated with an T-Mobi[e USA handset encoded with the International Mobile Equipment Identifier ([ME[) of [inserlIMEI]."

2.4 Availab[e Call Detail Record Information

"Call Detail Records" or "CDRs" are itemized records documenting a subscriber's incoming and outgoing calls individually and, at a minimum, provide time, date and rounded up duration information. The LER Group also will also accept [awful process requesting "Toll Records" or "Bill [mages."

2.4.1 Format of Call Detail Records

Call detail records are provided in a laser-printed bill image (a reproduction of the actual invoice received by a T-Mobi[e USA customer a few days following the end of the monthly bi[ling period) or in a laser-printed raw billing report generated by one of several systems used by the LER Group to access out-of-cycle call data. When CDR data is required for dates within a completed billing cycle, the LER Group will forward a duplicate invoice or bill image to the investigative agency. When CDRs are requested for dates falling within multiple completed bi[ling cycles, multiple bill images will be provided. BiI[ images may vary slightly, depending on the system used to process subscriber records in the various T-Mobi[e USA markets.

2.4.2 Model Clauses for CDRs


- 4114 -

~r, ,.,1 " E lljlc.' '~; l-j';'~ '11 p. ,,' UI~ 1%_, )(~Il._ .l._'i,;/

C;et rncre frc)C'n Ef

Lawful process for call detail records should clearly identify (1) the subscriber account number or MSISDN and, (2) the time period, or "window," in which call records are being sought. The subscriber account number is provided in every basic subscriber information response (see section _, above). If you have not yet received basic subscriber information and do not have the account number, you may combine your request for the necessary data by specifying the MSISDN.

As with basic subscriber information requests, terms used by other wireless carriers and in other technologies are incompatible. For example, the phrase "LUDS and MUDS" is not applicable in the T-Mobile USA GSM environment and should be avoided. Collectively, we refer to the itemization of calling activities as "Call Detail Records" and strongly suggest that you utilize this term.

The model clauses that follow will assist agencies in the proper composition of the most common types of subpoenas for call detail records.

2.4.3 Subscriber Information and Specific Call Detail Records

A request for basic subscriber information and call detail records may be combined into a single, properly constructed clause. Sample:

" ... provide all subscriber information for the T-Mobile USA subscriber currently associated with the mobile telephone number (MSISDN) of [insert area code and telephone number 1 and provide call detail records associated with such account for the billing period(s) encompassing [date 1 through [date J."

page: 16 Group

T'Mobile USA, Inc, Law Enforcement Relations - 4115 -


3.0 PEN REGISTER AND TRAP AND TRACE

3.1 General Capabilities

With proper authorization, T-Mobile USA can provide an agency with real-time dialing or signaling information to or from the mobile device of an identified subscriber. At a minimum, such call-related data includes:

• Confirmation of target identity (IMSI or MSISDN) • Date and time of each call or call attempt • Digits dialed to complete the initial call (outgoing calls) • Caller ID for calls to the target handset (incoming calls) if available • Records of SMS text messaging

T-Mobile USA currently utilizes Verint's StarGate system to provide fully J-STD-025 compliant intercept and pen registeritrap and trace operations.

3.2 Switch-Based Provisioning

In order to successfully provision Pen Register and Trap and Trace orders, Law Enforcement must advise T-Mobile USA of the target's anticipated movement within and between T-Mobile USA market areas. This allows T-Mobile USA to provision the necessary switching facilities to provide seamless coverage should target roam outside his "home" area.

3.3 Model Clauses for Pen Register or Trap and Trace Orders

An order directing T-Mobile USA to provide call-related data must uniquely identify the target. NOTE: With GSM technology, the MSISDN and the IMSI are unique account identifiers, but upon the request of a T-Mobile USA customer the mobile telephone number (MSISDN) can easily be changed. Therefore, the LER Group recommends that the requesting agency use the target's International Mobile Subscriber Identity number (IMS!), and the mobile telephone number, as unique target identifiers.

Sample:

"".Ordered that for a period of [insert duration j days T-Mobile USA shall furnish all information, facilities and technical assistance necessary to accomplish the installation and use of a pen register / trap & trace device which shall; (1) register numbers dialed or pulsed in order to

process outgoing (mobile originating) calls; (2) register source telephone numbers, as available, associated with incoming (mobile terminating) calls, and (3) register the date, time and duration of all call activities that are associated with the International Mobile Subscriber Identity (IMSI) of [insert IMS/j. This IMSI is currently associated with a rnobile telephone nurnber of [insert MSISON j; however, this Order shall also apply to any other mobile number(s) which may be associated with this IMSI. Such installation and use shall be conducted in a manner so as to rninimize any interference with the services that are accorded the person(s) to whom the installation and use is to take place."

- 4116 -

3.4 Nation-wide Scope I Carrier Identification

T-Mobile USA accepts nation-wide application of any federal pen register or trap or trace order regardless of the district in which the order was issued and will deliver call-related data to any location as directed. Upon appropriate certification of the serving agency, T-Mobile USA will accept a federal order addressed to "any telecommunications service provider providing service to {identifier].

State orders do not enjoy the same nation-wide scope as federal orders. Devices are limited to installation and use within the jurisdiction of the state court. T-Mobile USA currently defines the site of first access by the monitoring law enforcement agency as the area of installation and use.

3.5 Location Information

T-Mobile USA will not provide real-time location or tracking information based on a pen register I trap and trace order. Location information will only be provided based on a T-III order or a pen register I trap and trace order combined with a "specific and articulable facts" or "18 USC 2703( d)" reference.

3.6 Delivery of Call-Related Data

Delivery is done via dedicated circuit or Virtual Private Network connection. Dedicated circuit can be anything from an analog two-wire circuit to T1, depending on the bandwidth needs of the monitoring agency. VPN connection is provided with a VPN "Branch Office" account using VPN hardware connections such as the Nortel Contivity system.

*T-Mobile USA does not suppon "dial-up" lines for delivery of CDC.

*T-Mobile USA no longer suppons local access for CDC intercept circuit installation.

The terminating address for any dedicated circuit being ordered should be given as follows:

T-Mobile USA. Inc.

3.7 Service Disconnection During Surveillance

Law Enforcement agents may request that T-Mobile USA refrain from disconnecting the service on accounts subject to surveillance for reasons such as non-payment, or on accounts that have been identified as fraudulent.

T-Mobile USA always strives to assist law enforcement to the extent possible. However, any effort to prevent accounts receivable or fraud department personnel from disconnecting the non-

page: 18 Group

T-Mobile USA, Inc. Law Enforcement Relations - 4117 -


paying customer's service creates a security risk of compromise and may violate the Federal Communications Commission's System Integrity and Security Rules. Further, the interception may no longer be transparent and unobtrusive as to the target. Accordingly, T-Mobile USA will not automatically, without further instructions from and coordination with law enforcement, take steps to prevent disconnection. We view any court order including a non-disconnect provision to be an instruction to further coordinate with law enforcement.

Should T-Mobile USA receive an order requiring uninterrupted service on fraudulent accounts or accounts in a non-payment status, T-Mobile USA also requires from the requesting agency (and may seek the assistance of the court to obtain) a statement that T-Mobile USA is absolved of responsibility for the security of the surveillance. With this statement in hand, the LER Group will cause the customer care records (which are accessible by all Customer Care, Financial, and Fraud representatives) to be annotated in a way to express law enforcement interest and preclude disconnection without further coordination.

T-Mobile USA also requires that requesting agency pay outstanding unpaid balances during the duration of the intercept operation.

T-Mobile USA, Inc. Law Enforcement Relations Group - 2/01/04 page: 19

- 4118 -

(

4.0 WIRETAPS

4.1 General Capabilities

The LER Group provides full "Title III" wiretap support in response to lawful authorization and will deliver call content to a designated monitoring facility.

4.2 Geographic Provisioning

In order to successfully provision a wiretap, the requesting agency must advise the LER Group of the target's anticipated movement within and between T-Mobile USA market areas. This allows the LER Group to provision the necessary switching facilities, ensuring seamless coverage should target roam outside his "home" area.

4.3 Delivery of Call Content

The "content" of a wiretap includes audio ("speech") generated by all participants in the call. Such conversations are passed, or "bridged," to the monitoring facility of the law enforcement agency through the public switched telephone network (PSTN). Call content delivery is "oneway," that is, audio that might be generated at the monitoring center cannot be transmitted into the ongoing conversation of the target. T-Mobile USA switching equipment initiates this bridge using a "ring-out" feature and does not require local installation of trunks or other dedicated circuits.

In most cases, the Call Content Channel (CCC) or "speech" is delivered in a combined, fullduplex bridge to the monitoring center. In the case of certain call scenarios such as third-party calls, conference calls, unanswered and forwarded calls (such as calls forwarded to voicemail), or data calls, the CCC will be bridged in separated (transmit and receive) channels or in multiple calls to the same monitoring center number. In the case of separated CCC or multiple bridges, the monitoring center will be required to have a "roll-over" or "hunt-group" system in order to capture all available CCC intercept.

Upon issuance of the intercept order, T-Mobile USA must be provided with the monitoring center "C number." Once the affected switches have been provisioned. all subsequent calls will be bridged to this "C number." From an operational perspective, this means that as a target's outgoing or incoming call is processed. the T-Mobile USA switching equipment instantly generates a simultaneous call to the monitoring center. T -Mobile USA requires that the HC number" be provided in writing on agency letterhead or fax cover sheet, in order to avoid confusion regarding the desired delivery point of intercepted CCC.

- 4119 -


c:t rc-:cp;-: fr-C)lYh i; It is the responsibility of the monitoring authority to provide and maintain the PSTN circuit and any ancillary equipment (i.e., latching relay, recorder interface, recorder, etc.) that may be needed to support the intercept operation.

4.4 Content Requirements for a Wiretap Order

Each wiretap order authorizing interception of any communication should specify the following:

• The identity of the person, if known, whose communications are to be intercepted • The nature and location of the communication facilities where the interception will take

place • A particular description of the type of communication to be intercepted and a statement

of the particular offense to which it relates • The identity of the agency conducting the surveillance and of the person authorizing the

application • The duration of the interception and whether or not the interception will automatically

terminate when the communication has been obtained • A direction that T-Mobile USA provide the technical assistance required • The date the order was issued.

In some cases, however, when a wiretap order contains sensitive information about an ongoing criminal investigation, an agency may serve T-Mobile USA with a redacted order. A redacted order still should contain at least the following:

• The nature and location of the communications facilities where the interception will take place (i.e. MSISDN iIMSI)

• The identity of the agency conducting the surveillance and the person authorizing the application

• The duration of the intercept • A direction that T-Mobile USA provide the necessary technical assistance • The date the order was issued

4.5 Model Clauses for Wiretap Orders

Legal authorities and requirement may vary from state to state and often differ from the federal requirements under Title 18 of the United States Code. Therefore, this Guide only provides illustrative examples to satisfy the identification elements of wiretap orders. NOTE: Remember that a wiretap order must uniquely identify the target. Since a target's mobile telephone number (MSISDN) can easily be changed the order must ref/ect the target's International Mobile Subscriber Identity number (lMSI) and mobile telephone number, as unique target identifiers.

Sample:

T-Mobile USA, Inc. Law Enforcement Relations Group - 2/01/04 paqe: 21

- 4120 -

(

" ... Ordered that for a period of [inserl duration] days T-Mobile USA shall furnish all inforrnation, facilities and technical assistance necessary to surreptitiously intercept all cornrnunication activities that are associated with the International Mobile Subscriber Identity (lMSI) of [inserl IMS/]. This IMSI is currently associated with a rnobile telephone nurnber of [inserl MSISDN]; however, this Order shall also apply to any other rnobile nurnber(s) which may be associated with this IMS!. Such installation and use shall be conducted in a manner so as to rninimize any interference with the services that are accorded the person(s) to whom the installation and use is to take place."

4.6 Roving Wiretaps

T-Mobile USA will execute federally authorized "roving" wiretaps to intercept the communications of a target who is attempting to thwart surveillance by changing facilities or phones often. TMobile USA will notify the requesting agency promptly if more information is needed or if it is not possible to implement the wiretap within the requested period of time.

4.7 Consent-based Wiretaps

T-Mobile USA will honor consent-based wiretap orders issued by an appropriate magistrate or court of competent jurisdiction. T-Mobile USA will not implement any consent-based wiretap without such an order.

4.B FISA Interceptions

T-Mobile USA currently has three members (one in Bellevue, WA; two in Parsippany, NJ) cleared to handle FISA orders, as well as National Security Letters.

4.9 Location and Tracking Information

T-Mobile USA understands all T-III orders to inciude authorization for real-time cell-tower 10 information.

4.10 Service Disconnection

Law Enforcement agents may request that T-Mobile USA refrain from disconnecting the service on accounts subject to surveillance for reasons such as non-payment, or on accounts that have been identified as fraudulent.

T-Mobile USA always strives to assist law enforcement to the extent possible. However, any effort to prevent accounts receivable or fraud department personnel from disconnecting the nonpaying customer's service creates a security risk of compromise and may violate the Federal Communications Commission's System Integrity and Security Rules. Further, the interception may no longer be transparent and unobtrusive as to the target. Accordingly, T-Mobile USA will not automatically, without further instructions from and coordination with law enforcement, take

page: 22 Group

T·Mobile USA, Inc. Law Enforcement Relations - 4121 -


;";'-]c;.(C:'. f((Jn'-~ !\fc,' steps to prevent disconnection. We view any court order including a non-disconnect provision to be an instruction to further coordinate with law enforcement.

Should T-Mobile USA receive an order requiring uninterrupted service on fraudulent accounts or accounts in a non-payment status, T-Mobile USA also requires from the requesting agency (and may seek the assistance of the court to obtain) a statement that T-Mobile USA is absolved of responsibility for the security of the surveillance. With this statement in hand, the LER Group will cause the customer care records (which are accessible by all Customer Care, Financial, and Fraud representatives) to be annotated in a way to express law enforcement interest and preclude disconnection without further coordination.

T-Mobile USA also requires that requesting agency pay outstanding unpaid balances during the duration of the intercept operation.

5.0 EXIGENT CIRCUMSTANCE

5.1 Basic Subscriber Information

While T-Mobile USA is generally prohibited from disclosing subscriber information to the government without proper legal authorization, the law permits disclosure in certain emergency cases. T-Mobile USA may, in its sole discretion, disclose such information to law enforcement, E911 Center personnel or other government agencies if the the LER Group reasonably believes that an emergency involving imrnediate danger of death or serious physical injury to any person requires disclosure of the information without delay.

In most cases, T-Mobile USA will request that the agency fax a request for assistance on agency letterhead in order to verify the identity as a law enforcement official. It is not unusual for stalkers, creditors, spouse abusers, etc. to call claiming to be law enforcement or 911 ernergency officials, in order to determine the location of a subscriber without proper documentation. For this reason, T-Mobile USA takes extreme care to deterrnine the identity of callers requesting emergency assistance. If faxing is not feasible due to time constraints or location of the caller, we will take additional steps to assure ourselves to the extent possible of the caller's identity.

5.2. Location Information

Again, when a reasonable belief exists that an emergency exists involving irnmediate danger of death or serious physical injury to any person, T-Mobile USA may provide law enforcement officials, Public Safety Answering Point (PSAP) personnel or other government agencies with cell 10 and sector 10 for a registered T-Mobile USA subscriber.

T-Mobile USA also may provide real time location information via Pen Register eqUipment during on-going exigent situations such as kidnappings. Exigent provision of real-time location information will always require the requesting agency to provide a faxed letterhead request.

5.3 Emergency Surveillance Requests

T·MObile USA. Inc. Law Enforcement Relations Group - 2/01/04 page: 23

- 4122 -

(

T-Mobile USA will support law enforcement requirements for electronic sUNeiliance including pen register, trap and trace, location or wiretaps based on a declaration of exigent circumstance by competent authority. In all such cases requiring real-time location / tracking information, Pen Register, or Voice Intercept (T-1I1 Operations), T-Mobile USA requires that law enforcement follow-up with an appropriate court order for the type of operation conducted within 48 hours of the declaration of exigent circumstance.

6.0 VOICEMAIL ORDERS

6.1 Voicemail Features

Voicemail is a feature enjoyed by all T-Mobile USA customers. The scope of voice mail capabilities varies according to the package to which the customer subscribes -- Basic, or Enhanced. However, even the Basic plan includes common "answering machine" capabilities. Similarly, all subscribers have control over which calls will be directed to their voicemail "mailbox." A user can specify:

• All incoming calls, or • Calls received when the subscriber's handset is "busy," and/or • Calls which are unanswered, and/or • Calls received when the subscriber is "unreachable" (out of range or handset turned

"off").

In addition, most handsets support the redirection of individual incoming calls to voicemail after the user views the "Caller ID" display. This provides an effective means of screening calls.

6.1.1 Basic Voicemail Accounts Storage

Basic seNice subscribers are allowed a total of 15 messages in their voice mail account. All messages, either stored (un-played) and non-stored (played and saved) are deleted 14 days after original deposit to the voicemail account. Once deleted by the voicemail system's autopurge feature, these messages cannot be recovered.

6.1.2 Enhanced Voice mail Accounts Storage

Enhanced seNice subscribers are allowed a total of 45 messages in their voicemail account. Stored (un-played) messages are deleted after 14 days and non-stored (played and saved) - 4123 -


(~:.; e t n ~j C) n:? f r" () (-ri !;: fe' messages are deleted 30 days after deposit to the account. Once deleted by the voicemail system's auto-purge feature, these messages cannot be recovered.

6,2 Preservation of Voicemail

In areas on the Glenayre Voicemail platform, LER can cause copies of Voicemail messages to be moved and saved in a secure storage area of the voicemail platform. This storage is not subject to auto-purge. When saved in this secure area, however, the voicemail message is given a date/time stamp for the time it was copied and saved to the new location. This could impact on the evidentiary value of the voicemail message and should be considered prior to requesting this service.

6.3 Access to Stored and Non-Stored Voicemail Messages

6.3.1 Direct Access to Subscriber Voicemail Account

Upon presentation of a proper court order or warrant, T-Mobile USA will change the PIN number for the subscriber's voicemail account and provide law enforcement with the dial-in number and PIN. Law enforcement can then review, save, and or delete any messages in the subscriber's account. Once changed, the PIN cannot be reset to the original PIN. Also, once reviewed, all voicemails will be set as non-stored (played and saved). Be aware that this action will potentially alert the subscriber to activity on his voicemail account.

6.3.2 Access to a Copy of the Subscriber Account

Upon presentation of a proper court order or warrant, T-Mobile USA will copy all messages in the original account into a separate account. A dial-in number and PIN for the separate account will be provided to law enforcement, and law enforcement may review, save, or delete any message in that account without the subscriber's knowledge. All copied messages will be annotated with a date/time of deposit from the time they are moved to the separate account; not with the original date/time of deposit into the subscriber's account. These messages will not be subject to auto-purge.

6.4 Requirements for Access to Stored and Non-Stored Voicemail

Because all T-Mobile USA voice mail is stored for less than 180 days, law enforcement must produce a search warrant issued under the Federal Rules of Criminal Procedure, or equivalent state warrant to obtain the contents of stored electronic communications. T-Mobile USA requires a search warrant for all voicemail access, because we cannot differentiate access to stored and non-stored communications.

6.5 Cloning Capabilities - Voicemail Messages - 4124 -

The "cloning" of a subscriber's voicemail is an investigative tool that may be enabled pursuant to an appropriate authorization issued by a court of competent jurisdiction. This voicemail surveillance feature can be applied to any account, surreptitiously duplicating each incoming voice message left for the targeted subscriber. A twin message is simultaneously deposited in a special mailbox assigned to the designated investigating agency. Password-controlled access to the special mailbox supports message retrieval at any time. When used as directed, the targeted subscriber is given no indication that mailbox activities are being monitored.' A wiretap order is required for voicemail cloning.

6.6 Model Clause for Voicemail Clone Order

The requesting agency must produce a wiretap order for provisioning of a voicemail clone.

Some fundamental elements should be included in the order regardless of jurisdiction. Here are some suggestions to consider:

• Include the International Mobile Subscriber Identity (IMSI) of the target. For carriers deploying the GSM technology the IMSI is the only truly unique and permanent identifier associated with a subscriber account.

• Indicate the mobile telephone number currently associated with the target along with" any mobile telephone number and voicemail service which may, during the duration of this Order, be associated with the IMSI [insert IMSI ]. .. " This prevents the interruption of voicemail cloning should a subscriber request a change in their mobile telephone number.

6.7 Implementation for Voicemail Clone

Upon service of an appropriate order, T-Mobile USA will enable the voicemail surveillance' feature for the specified target and assign a "clone" mailbox to the investigating agency. TMobile will provide an authorized agent with instructions as to how to access the clone mailbox.

page: 26 Group

T-Mobile USA, inC. Law Enforcement Relations - 4125 -


7.0. PREPAY ACCOUNTS

7.1 Subscriber Accounts: The "Prepay" Class

The "Prepay" account class is often selected by people who have a limited credit history, do not want to overextend their present credit indebtedness, or simply wish to keep better control of their communications expenses. This type of subscriber account may be established with an initial payment of $50.00 and maintained with subsequent payments of $10.00 or more. Charges for the selected monthly feature package, as well as the cost of calls and supplemental services, are applied against the subscriber's running credit balance.

When the credit balance of a prepay subscriber's account drops to a specified level, a short text message is sent to the handset. Payments can easily be made in various forms; credit card, cash, check, money order or Prepay Coupons available through T-Mobile USA retailers.

Due to the "cash-up-front" nature of Prepay accounts, subscriber identifying data is not as detailed as on post-pay accounts. In many cases, while subscribers are urged to provide name and contact numbers, many choose to provide nothing. At a minimum, our response to subpoenas requesting information on a Prepay account will include MSISDN, IMSI, date of activation, date of last credit, and-if applicable-date of termination. Call detail records are available from Prepay accounts.

7.2 Suspension of Prepay Accounts

Should the balance of a prepay subscriber be exhausted, service is temporarily suspended. This suspension can occur even during an active call. All subsequent outgoing call attempts are routed to the T-Mobile USA Customer Care Center and incoming calls are met with a recorded announcement. Suspension is an automated function which cannot be disabled on an individual subscriber basis. Within minutes from the time that an adequate payment is made, restrictions will be removed and normal incoming and outgoing services will be restored.

7.3 PrePay Service Non-Disconnection/Suspension

Orders to refrain from disconnecting or suspending prepay service can be implemented only by actually paying for more service on behalf of the target. This process obviously has consequences for an investigation and it's important to understand how the automatic suspension procedure can be avoided (or removed) by applying a coupon payment to the account of the targeted subscriber. The case officer or agent must carefully consider how this action might jeopardize an ongoing investigation. The decision as to whether or not to apply an anonymous coupon payment, as well as the actual coupon payment process itself, rests sole/y with the law enforcement agency.

7.4 Payment Methods and Prepay Coupons

A subscriber may make a deposit to his account in a variety of ways: he can visit aT-Mobile USA store and make a payment by credit card, cash or check. Another flexible option, especially well-suited for an anonymous credit, is the prepay coupon.


- 4126 -

/

Prepay coupons may be purchased at T-Mobile USA retail stores and at many authorized retailers by credit card, cash or check. They are available in denominations of $10.00, $25.00, $50.00, $100.00, and $200.00. An agency may wish to keep a number of non-expiring coupons on hand so that they can be applied to an account expeditiously.

7.5 Refund Policy

All payments, including prepay coupons that may be utilized by a law enforcement agency, are nonrefundable .. As such, subsequent refunds cannot be made to a third party. If an account has a credit balance when it is permanently closed only the subscriber of record may apply for a refund for the remaining balance.

7.6 Caution is Urged

It is important to note that account adjustments, including coupon payments, are reflected in the subscriber's account record. It is not possible to suppress the inclusion of this information in the account record or on the monthly statement, so if a subscriber calls our Customer Care Center and inquires about his account, the Prepay Coupon credit may be disclosed. However, the subscriber record does not identify the purchaser of the prepay coupon.

Please consider these facts and the potential impact that the disclosure of unexpected coupon payments may have on the investigation. In some cases, it may be preferable to avoid any manipulation of the target's account.

D~f'10· ')Q

- 4127 -


8.0. CALLS TO DESTINATION

8.1 Introduction

T-Mobile USA makes available a "Calls to Destination" search capability as an investigative tool for the law enforcement community. This function itemizes calls processed by the T-Mobile USA network made to a telephone number provided by the investigating agency. A request for this service, for which a fee is charged, must be supported by an appropriate judicial authorization (subpoena or court order).

8.2 Search Criteria

The "Calls to Destination" search request may be focused on any domestic or intemational telephone number. This "destination number" need not be associated with a T-Mobile USA subscriber. However, the number provided by the investigating agency must be complete. Domestic numbers, conforming to the North American Numbering Plan, must include the full ten digits. Searches based on an intemational number require the complete country and city codes. Variations of a "destination number," if needed, must be specified within the legal process served on T-Mobile USA and will be searched individually.

Examples: Domestic destination number: International destination number:

(212) 555-3923 011-49-30-872324

Variation of domestic number: (212) 555-3291,3292 or 3293 (3 searches)

8.3 Search Results

The destination number is searched against all the individual call records processed within the T-Mobile USA network during the previous thirty (30) days. The thirty-day parameter is a fixed value that cannot be modified. Only outbound calls are included in the report. For each "hit," the following information will be provided:

• Calling Party's name, if given (see Prepay Accounts) • Calling Party's MSISDN (telephone number) • Calling Party's IMSI (International Mobile Subscriber Identity number) • Date and time that call started • Call Duration (in seconds) • Number called (the "destination" number)

If the MSISDNIIMSI is that of a T-Mobile USA account, and if authorized by the subpoena or court order, the pertinent subscriber identification information will also be provided.

8.4 Model Clauses for Calls to Destination Information

It is critical that the lawful process clearly identify the information being sought. The legal process must specify the destination number and, if needed, specify that subscriber information be provided for each T-Mobile USA subscriber disclosed by the search.

T-Mobile USA,lnc. Law Enforcement Relations Group - 2/01/04 Paqe: 29

- 4128 -

Examples:

" ... perform a "Calls to Destination" search, identifying any and all outbound/originating calls made to [insert destination number] which were processed by the T-Mobile USA network during the thirty (30) days preceding such search. "

" ... (1) Perform a "Calls to Destination" search, identifying any and all outbound/originating calls made to [insert destination number] which were processed by the T-Mobile USA network during the thirty (30) days preceding such search. (2) For each T-Mobile USA MSISDN/IMSI identified as the originator of such a call, supply subscriber identification information applicable at the time the outbound/originating call was placed."

8.5 Fee Schedule

The fee for each number searched is $100.00, irrespective of the results of the search. This amount minimally reflects the cost of the application software, infrastructure, personnel and other expenses associated with this feature. The requesting agency is expected to provide necessary billing and "accounts payable" contact information before the search is conducted. Invoices are generated shortly after the results are provided and are payable at net, 30 days from the date of the invoice. The availability of subpoena-based "Calls to Destination" searches may be denied to an agency which is delinquent in their payment(s) for law enforcement support services. Please note the sample "Billing Information Form" on the following page.

8.6 Limitations

Individual call detail records, on which a "Calls to Destination" search is based, are generated by the hundreds of thousands. Because they are so voluminous this type of search is extremely resource intensive. Raw data files which have aged more than thirty (30) days are unavailable for searching.

T-Mobile USA reserves the right to reject any "Calls to Destination" search that, by it's nature or scope, would place an unreasonable demand on our processing systems or in anyway jeopardize the efficiency of our telecommunications network.

- 4129 -


, 9.0 FREQUENTLY ASKED QUESTIONS

Subscriber Records

What subscriber search capabilities does T-Mobile USA have? The most common search is based on a T-Mobile USA mobile telephone number. We can also search by subscriber or company name, account number, SIM serial number, or IMSI.

Can you search by the general or specific address of a subscriber? No; address searching is not available at the present time.

Call Detail Records

Do T-Mobile USA call detail records identify the location of the handset when a wireless call was made or received?

No. Call detail records reflect date, time and rounded up duration information and, for outgoing calls, the called number. Information identifying the location of the handset or the base station is not a factor in the computation of charges and is not included in bill images or on-line call detail reports.

Will call detail records include the number of the person calling a T-Mobile USA subscriber? In most cases, but not always. Normal call detail, or bill images, show incoming caller 10, as well as most out of billing cycle call detail reports such as PrePay records, Unbilled Calls spreadsheets, and Fraud Centurion reports. Calling party identification is included, whenever available, on pen register reports.

For how long a period does T-Mobile USA retain call detail records? On-line access to post-pay account call detail records is retained for two years. Online access to Prepay call detail is limited to 120 days. Retrieval of older records is still possible but a significantly longer processing time is required. T-Mobile USA has agreed to Department of Justice requests to retain subscriber and call detail records for a period of two (2) years past date of activity.

Handsets

We recovered a T-Mobile USA handset. Can we determine the phone number? If the handset is fully operational we suggest you call another phone equipped with "Caller 10" services (i.e. another T-Mobile USA handset). The mobile number will be displayed on the "CalierID" screen, unless the "Block All Caller ID" feature has been enabled.

- 4130 -

r,F " m J\'10 bil e ill (=;et rnere' f!~()n-t life,,"

We recovered a handset equipped with a T-Mobile USA SIM card, but the phone doesn't work, How can we qet more information?

T-Mobile USA can perform a subscriber record search based on the serial number printed on the SIM card, If no authorization is available we will, on request, attempt to contact the subscriber most recently associated with the SIM card and ask them to contact you, A subpoena or court order may be required.

We recovered a T-Mobile USA handset that has no SIM card. How can we qet more information?

Every GSM handset has a unique serial number, known as an International Mobile Equipment Identity (IMEI) number. T-Mobile USA can perform a search based on the IMEI to determine the IMSI that was originally installed in the handset. If this search is successful, the original T-Mobile USA subscriber may be identifiable. A subpoena or court order may be required. This is the least desirable method of search, and does not always yield results.

We recovered a SIM-Iess handset that bears the logo of another carrier. We have the IMEI. Can you help?

No. Our database includes records of IMEls associated with T-Mobile USA subscribers only.

We recovered a handset with the SIM card intact. What information might we be able to retrieve?

page: 32

Depending upon the make and model, it is likely that you may be able to identify the source telephone of recently "missed" or unanswered calls, short text messages that have not been deleted, and the "speed dial" numbers that have been user-programmed and stored in memory on the SIM card.

Prepay Subscribers

What are the roaming limitations on prepay subscribers? Currently, prepay subscribers are not permitted to roam outside of the T-Mobile USA network of initial registration.

How can a prepay subscriber make a payment to his account? Prepay Coupons may be redeemed and credited to a subscriber account at any time of the day or night. Payments are also accepted at T-Mobile USA Centers.

Voicemail

Our agency recovered a T-Mobile USA handset. There is an indication that there are voicemail messages waiting to be retrieved. How can we recover those messages?

Voicemail falls under the category of "stored electronic communications." Access to such information requires the presentation of an appropriate court order or subpoena, depending on the status of the message.

Roaming

T·Mobile USA, Inc. Law Enforcement Relations

- 4131 -


If we are conducting a court-authorized pen register or intercept operation on aT-Mobile USA subscriber, what will happen if the target "roams" into another portion of the TMobile USA network?

Pen register and intercept operations require special programming on a switchby-switch basis. These switches serve defined geographical areas. Therefore, if the subscriber is in an area served by a T-Mobile USA switch that has not been programmed, no data or content will be available. Once upgraded to CALEA

systems are deployed, regional intercepts will be possible.

If we are conducting a court-authorized pen register or intercept operation on aT-Mobile USA subscriber, what will happen if the target "roams" into the network of another GSM carrier?

T-Mobile USA has no access to the content or data associated with aT-Mobile USA subscriber who is operating on another GSM network. However, it may be possible to identify another GSM network in which the targeted subscriber is currently "registered."

Once fully CALEA-compliant systems are deployed, HLR information which identifies the roaming partner will be available.

Security

Can GSM phones be cloned? . No. Some researchers claim the ability to copy information from a Subscriber Identity Module (SIM) card, but duplicating a SIM card is not cloning. A GSM network can preclude the simultaneous use of multiple SIM cards.

Does this mean that a SIM card can be duplicated "over the air?" No. To duplicate a SIM card requires physical possession of the card.

Do conversations remain secure? Yes. The tactics used by these researchers do not affect the sophisticated encryption scheme that protects conversations from eavesdropping.

Miscellaneous

Does T-Mobile USA support the "SMART System" used by some wireless carriers? No.

Can a subscriber block "Caller 10" like wireline service providers? Yes. A subscriber may block calling party identification on all outgoing calls by making a request to the Customer Care Center. Blocking of individual calls can be implemented through a handset function. Note that blocking of "Caller 10" will not affect pen register operations.

T·Mobile USA, Inc. Law Enforcement Relations Group - 2/01/04

- 4132 -

~ ~ "1\1obile'" We're preparing a pen register (or lawful intercept) order for the approval of the court. How can T-Mobile USA help?

page: 34

T-Mobile USA can assist by reviewing a draft of your efforts in advance, ensuring that the critical identifying terms are valid and properly applied. For security reasons, specific target information may be omitted from the draft document.

T-Mobile USA. Inc. Law Enforcement Relations

- 4133 -


10.0 FEES FOR SERVICES

10.1 Authorization

Telecommunications carriers are entitled under federal and state statutes to be compensated for reasonable expenses incurred in providing the "information, facilities and technical assistance" necessary for pen register or lawful intercept activities. T-Mobile USA's fee schedule reflects the cost of switch application software, infrastructure, personnel and other costs incurred in providing such services pursuant to court order.

10.2 Pen Register and Pen Register/Intercept Orders

• A flat fee of $250.00 per switch applies to each International Mobile Subscriber Identity (IMSI) number targeted by a Pen Register or Pen Register/Intercept Order. This fee covers the first thirty (30) day period specified in the original court order.

• Should the Pen Register or Pen Register/Intercept activity continue beyond thirty (30) days (under the terms of the original order or any extension thereof), a fee of $50.00 per switch will apply to each subsequent and continuous period of thirty (30) days or part thereof.

• Costs associated with any temporary or permanent leased circuits (Le. ISDN, T1, etc.), ancillary equipment (Le. routers) and/or software application(s) are the sole responsibility of the law enforcement agency administering the court-authorized activity.

• In areas with multiple switches, such as New York Metro and Southern California, T-Mobile USA caps its fee at $2,500 for the first 30 days, and $500 for each 30 day extension.

10.3 Pen Register/Intercept Orders - Additional Charges

• Intercept Orders are subject to an additional flat fee of $100.00 per 30 day period, or part thereof. This charge offsets the cost of call bridging services and delivery of the voice content, via the public switched telephone network, to an agency's /ocal monitoring facility.

• On full intercepts, the fee cap also applies. The addition of audio will not take the fee in excess of the $2500/$500 limit.

10.4 Cloning of a Subscriber's Voicemail

• A flat fee of $150.00 per voice mailbox applies to the "cloning" of a subscriber's voicemail services. The flat fee applies to each period of ninety (90) days or part thereof.

10.5 Calls to Destination - 4134 -

(- ,

.,PJT --' '-' \..

• A flat fee of $100,00 per destination phone number searched,

10.6 Billing Practices

The Law Enforcement Relations Group is most cognizant of the sensitive nature of all courtordered pen register and intercept activities, At the commencement of a court-sanctioned operation, the law enforcement agency will be asked to provide billing account and contact information for later use.

In order to minimize knowledge of such carrier-supported operations, billing activities are generated until the pen register or intercept activities have been concluded, This includes any court-authorized renewal periods, Further, no target-identifying information, other than an agency assigned tracking or case number, will appear on the actual invoice.

Page: 36 T·Mobile USA. Inc. Law Enforcement Rel8tion<

- 4135 -