Investigators Guide: Telephone Records
Requesting, Obtaining and Analyzing in Support of Criminal Investigations

The purpose of this guide is to provide investigators with a quick guide to assist them in the process of requesting, obtaining and analyzing telephone records

Investigators are faced with increasingly complex investigations every day. Many of those investigations require the use of telephone, particularly wireless telephone, records and information. Whether its incoming & outgoing calls, text messages, cell tower registrations or anything else that a cell phone can do, you may find that your investigation may benefit from that informa6 STEP tion. If you have a lot of experience requesting, obtaining and analyzing telephone records then you surely know it is a time consuming and complex process. If you are just starting out you will quickly learn a few things right away. The process of requesting and obtaining the records you need can take weeks to several months and in some instances you may never get the records for various reasons.

very important information that will avoid unnecessary delays, return requests for legal authority or worse, loss of information. The concepts in this Quick Guide also pertain to Internet investigations in many ways. Below are the six proven steps to requesting and obtaining telephone records in support of criminal investigations.

PROCESS— STEP 1 Determine what information you need

1. Determine what information you need 2. Make sure you have the correct provider

Knowing what you need will dictate what and how much 3. Send preservation letyou ask for and often depends ter immediately on the type of case you are 4. Ask for everything working. that you may need If you are working a major case such as a homicide in5. Obtain proper legal vestigation or some other maauthority jor crime you will likely be requesting everything you can 6. Analyze the data to get, hopefully without incurdevelop evidence ring a lot of cost to your agency. Other cases may only Cost to your agency require basic information such as account may be a significant factor when requestsubscriber. Most of the records you will be ing records as well. Generally speaking, seeking are from wireless providers and the for routine requests for records you should technologies and terminology used are often not incur any cost. You will also learn, if complex and require some research. Reyou haven't already, that providers do not member that you are requesting historical have law enforcement interests at heart records and not real time records. If you and will very often be less cooperative have a need for real time records you will than expected. This Guide is designed to provide some
(Continued on page 2)

PAGE 1

INVESTIGATORS GUIDE: TELEPHONE RECORDS
(Continued from page 1)

need a Pen Register, which is beyond the s c o p e o f t h i s g u i d e . What you are going to ask for? The basic categories of information are: Account information, Calls In/Out, Text messaging, Internet access/use and Tower/ sector. Account information may include all or some of the following: account initiation / termination, account holder, address information, alternate phone numbers, payment methods, device information, previous numbers, ported from/to, etc. Incoming and outgoing calls are just that and don't mean much with out date/time of the call (s) and sometimes the duration of the call. Be sure to spell out everything that you are in need of to further your investigation. Text messages and Internet records are so specific to the individual provider that you must reference their Law Enforcement guide and/or contact them directly to find out what is available and for how long. Tower and sector records are the specific locations where the device (cellular phone) registered and it used to be available easily but, based on case law, now requires a higher burden request than a subpoena (i.e. search warrant or court order). There is also more information available such as signal strength, direction, multiple tower/sector data or even near exact location. The amount and type of information, depending on the provider, is changing all of the time. One particular tool that is often unknown to the investigator is the availability of tower registration data or "tower dumps" as they are often called. Essentially it is information about every device that registered to a specific tower for a period of time. It can be very valuable if you are

looking to learn of all of the devices that were in a particular area at a given period of time. Learn what is available and what to ask for. You can do this by contacting the provider legal compliance department directly, using a good past example of a request and obtain and use the Law Enforcement Guides put out by most of the major providers. What period your are requesting? Different records are kept different lengths of time and varies by the type of information and the provider. For example incoming and outgoing calls are routinely kept for 180 days or more. Conversely text messages, if kept at all, are only available for a couple days to a week. You should reference the Law Enforcement guide or contact the providers legal compliance department to determine what window you are operating in. If you are going to be doing any computerized analysis of the telephone records received then you will likely want to get at least 180 days of data.

STEP 2 Make sure you have the correct provider
This can be one of the biggest problems to the telephone records aspect of your investigation. As of November 2003, wireless telephone numbers could be ported, or transferred, to another company for service. This is seen as a great option for consumers but an added hurdle for law enforcement. Prior to the implementation of Number Portability, if you had a phone number you could look up in a master database and determine unequivocally who was providing the telephone service. One of the best tools available for this
(Continued on page 3)

PAGE 2

INVESTIGATORS GUIDE: TELEPHONE RECORDS
(Continued from page 2)

information was FoneFinder http:// w w w . f o n e f i n d e r . n e t . Today it is not so easy because your target phone number may have started with any provider and now could have been ported two, three, four times. To address this issue the federal government has placed a company called Neustar in charge of the Number Portability program and Neustar offers tools to law enforcement to identify who the current provider of a phone number is. The first is IVR (http://www.npac.com/ lawenforcement/ivr.shtml) and it is an automated phone system that allows queries for telephone numbers to determine if the number is ported and which Service Provider currently holds the number. It is free to use but only allows you to check one number at a time over the phone. The second tool is their Local Number Portability Enhanced Analytical Platform or LEAP (http://leap.neustar.biz/). It is a fee based systems that allows a law enforcement agency to upload all of their target numbers and will provide the current provider and previous provider if applicable. The importance of LEAP will become apparent if your case requires you to identify the subscribers behind a series of telephone numbers. You will be able to then request subscriber information from the correct provider thereby eliminating potential delays from requesting from the previous or native provider. LEAP is not free and the cost range is $50-$1,600 per year depending on what plan you use.

of information you are requesting and how far back you want to go, the telephone service provider may or may not keep the information. For example, text message, if retained by the provider at all, are only kept for a couple of days to a week. To improve your chances of obtaining the information you need for your case, it is now generally recommended that you create a form letter that you send to the provider to advise them that you are seeking authorization to obtain information from their company and are asking them to preserve the information until such time that they receive the appropriate authority to provide you the information. This is called a Preservation Letter and should become a routine practice each and every time you are seeking information from a provider whether it is for telephone records or Internet records. The Preservation Letter can be in plain language and state:
"I am Detective Jones of the Town Hall Police Department, I am in the process of seeking legal authorization for records held by your company pertaining to telephone number 630-377-1234. Please retain all available records as of this date for a period of thirty days to allow me to secure the necessary authorization. Please confirm receipt of this request and forward any inquiries to me at 847-931-4000 or email at detjones@townhallpd.gov."

It can also be as specific or technical as you may need. It is also a good time to include a generic request for any available or updated Law Enforcement Guides to be emailed to you. It is often the case that the legal compliance person that handles your preservation letter will be the one assigned to assist you throughout your request process. This is a good time to build a relationship with them and let them help educate you on what may be available from their company. Be aware that
(Continued on page 4)

STEP 3 Send preservation request immediately
Depending on the provider and the type

PAGE 3

INVESTIGATORS GUIDE: TELEPHONE RECORDS
(Continued from page 3)

Ask for as much as you can justify This is important because it will hopefully limit the number of times you may have to obtain legal authority to seek records. Just because you get the authority to obtain all the information available to the provider does not mean you have to follow through and request all of it from the provider. A very well written document outlining all of the information that you are entitled to receive will send a message to the providers legal compliance person handling the request that you know what you are doing. Also, making it clear in a cover letter that you are not requesting everything that you could but only are asking for a subset of information to limit the burden on the provider and will request any additional information as needed. Follow-on authority The typical request process usually requires legal authority to obtain records from a provider for a target number. Once the target number records are received it usually becomes necessary to identify the subscriber for some or all of the numbers that were in contact with your target. That inturn requires you to obtain legal authority for each number and then grouped into one request per provider. A new and effective technique is to request all of the information in one legal authority. Essentially you are requesting all of the needed information on your target number and inclusive of that request your are requesting the subscriber information from any U.S. provider for the numbers contacted by your target. Electronic format It is not unusual for legal compliance requests to be ten or more pages and to have hundreds or even thousands of records of activity. Requests received in paper format or any other format that does not allow you
(Continued on page 5)

there are usually only a handful of legal compliance personnel working for these companies and they deal with thousands of requests each year. They typically are not intimidated by police or fearful of being "hauled into court" so tailor your conversation appropriately since they are the gatekeeper to the information that you need. It is important to note as well, that your submission for information must go through the legal compliance department for the provider. A local providers retail store will not provide the information you are seeking.

STEP 4 Ask for everything that you may need.
Language in your request like, "Any and all records" will result in the most basic information from the providers. If you rely on someone else to write your request or you use the terminology "any and all records" and you think that will get you everything you need you are about to make your first mistake. First, you should write your own request and hopefully do so from a very good example used in the recent past. Your request will probably not will not be one page either. It will likely need to be more than one page to ensure that it is clear and concise on what information you are requesting. The terminology "any and all records pertaining to..." seems like a great catch all to have in your request but the over use of this term has caused the providers to consider it overly vague and broad and will typically only provide the basic information for your request. Meaning that you will likely get the name on the account and the last 30 days of incoming and outgoing calls, that's it!

PAGE 4

INVESTIGATORS GUIDE: TELEPHONE RECORDS
(Continued from page 4)

to import it into a computer application will seriously hamper your ability to analyze the data. It is imperative for true analysis of the data that you receive it in a electronic format to allow you to mine the data. Without out it you will be relegated to several hours of staring at numbers and probably not getting all that could get. Electronic records need to be requested, and clearly spelled out, in your legal authority to receive them in electronic format. The records received need to be able to be imported into a spreadsheet such as Microsoft Excel or any other. The most universally acceptable format is Comma Separated Value (CSV). Just asking for the information in "electronic format" is not good enough and what that most often will result in is a PDF file which is in an "electronic format" but is difficult at best to import into your spreadsheet application. The recommended language for your legal authorization is: “records shall be provided in a standard electronic format such as Comma Separated Value (CSV) or other format that can be directly imported into a spreadsheet application".

need. Depending on your County's Grand Jury process, it may take a couple weeks to a month or more to get your subpoena for the information that you need. Many jurisdictions are now going to affidavit submissions to the Grand Jury to avoid having to appear, which certainly saves some time, but Grand Jury Subpoenas are not the only legal authority to obtain the records you are in need of to support your investigation. As an alternative to the Grand Jury you may be able to use a Search Warrant, Court Order or even Customer Consent to obtain the information. Search Warrants may be used when you have Probable Cause showing that the information held by the provider will provide evidence of a crime. Search Warrants will be required if you are seeking tower/sector/ location information from a provider. Search Warrants can usually be prepared in a couple of hours and can be served via U.S. Mail however the Probable Cause burden may make it difficult to obtain. Search Warrants can be sealed to protect the investigative process. Court Orders may be used as well but are more often used when a subject has been charged/indicted with a crime and requires a motion in front of a judge to evaluate the request. The Defense may also be a party to the motion and you will be required to testify and will lose any anonymity with the process. Customer consent is a lesser known provision of the law. Under United States Code you are authorized to obtain consent from a customer for the provider to provide law enforcement the necessary records to carry out the investigation. Of course this has limited application since you must get the target to consent to providing the records but in instances of threats, kidnapping, stolen phone, missing person, etc where you have a customer who has the le(Continued on page 6)

It is also a best practice to request the response sent to your official law enforcement agency email address instead of a personal email address like yahoo or hotmail.

STEP 5 Use the proper legal authority to obtain the information needed
You may have requested telephone records a dozen times ,or maybe you are doing it for the first time, but odds are you have used a Grand Jury Subpoena each time to request the information that you

PAGE 5

INVESTIGATORS GUIDE: TELEPHONE RECORDS
(Continued from page 5)

gal authority to give it they can authorize you to obtain their records. You would then send it directly to the provider and not need any legal authority beyond their consent. Exigent request - when someone’s life is endangered the law allows law enforcement to get information from the providers in an expedited fashion. The process can provide you near-real-time location information of a cellular device which is intended to mitigate the risk to life. The process has been abused by law enforcement and is not to be used when there is not legitimate life endangerment. Pen Register/Trap and Trace - Is the process of capturing in real time the numbers dialed by a target phone and the numbers and caller ID of the persons calling the target phone. The pen register/trap and trace provisions of the law have been used successfully by Federal law enforcement and others for a very long time. Unfortunately the cost and process of implementing a Pen Register has prohibited it from becoming a mainstream law enforcement tool. In recent years the costs have come down considerably and the process is easier. It is likely that the use of Pen Registers will increase by mainstream law enforcement in the future.

format and the second is that there is a training gap about what is available and what to do with the information once you do obtain it. In most cases, records are obtained in a non-electronic format so there isn't much that can be done with it anyways. If all you are intending to do is identifying or highlighting some numbers during a date range or event time then you probably don't need to do much else with your records, but, if you want to glean more data, and hopefully evidence, from your telephone data then you will need to get it in an electronic format and then you can begin to analyze the data you have obtained. Analysis does appear very complicated and time consuming to the untrained investigators but with some preparation and training any investigator can begin to analyze their telephone records. You may be looking to analyze a small subset of information such as a particular day or event or you may be looking to develop patterns of contact or use on a case. In either case, the principles are the same, get the information into a format where you can analyze the data, perform your analysis and document the steps you took to come to your conclusions. Analysis starts with the computer application. Unless you have a commercially available data analysis program like Penlink, I2 Analyst Notebook or Threads, you will probably be using a spreadsheet to perform your analysis on the data. It is important to note that most of the analysis can be done with a spreadsheet application such as Microsoft Excel or even free spreadsheet applications like Open Office or Google Spreadsheets. Once you import the data into your spreadsheet then you can conduct frequency analysis, event analysis, link analysis and geographic analysis. You can sort, clean, highlight, pivot, batch and even add to the data.
(Continued on page 7)

STEP 6 Analyze the data to develop evidence
There is a significant amount of untapped information available from telephone records and most investigators do not do much, if any, in-depth analysis of the information they receive. There are two primary reasons I have seen for this - first is that the information received prevents any real analysis when it is obtained in paper

PAGE 6

INVESTIGATORS GUIDE: TELEPHONE RECORDS
(Continued from page 6)

Frequency Analysis— is done by looking at how often, what interval or pattern the numbers called or received are contacted which indicates types of relationships between the parties. Event Analysis— is the process of analyzing what call activity or sequences occurred during a specific period of time.

and important of an identifier as a full name, date of birth, social security number or criminal history identification number. Developing a program to routinely collect and use those numbers by all officers can prove to be an immensely powerful intelligence tool, particularly if it is linked up with other agencies or centralized with a Sheriff’s Office or Prosecutors Office.

Link Analysis— is the process of identifySheriff’s Offices with jail telephone systems ing numbers/subjects and their intercan be even more valuable relations to each other. since they typically record Link Analysis does require Agencies that are all outgoing calls and can the records of two or more access telephone number subjects/phones to deterlooking for a low cost and subscriber information. mine the links between the tool to improve their activities. The telephone number daGeographic Analysis—is the process of listing or plotting the location information to provide proximal relationships for investigative leads. Cell tower & sector information is the primary information used but area code can be used with the assumption that the caller was actually in that area.

use of telephone records data can implement or that cies. an in-house Database System easily be Telephone Pointer can

linked to other agenThe results can be a time and money

tabase when setup at its most basic level becomes a pointer system for law enforcement. It is impractical to call every law enforcement agency near your jurisdiction to inquire if they had contact with a subject or telephone number, but, if there was an established pointer system you could check all submitting agencies with one cell phone number inquiry.

saving intelligence The resulting information Telephone Pointer Syscould avoid un-necessary system that helps tem—Agencies that are investigative delays of waitlooking for a low cost tool ing on subpoenaed phone solve cases! to improve their use of records and can literally telephone records can imhelp solve cases and those plement an in-house telephone database or cases could be a routine case, homicide or pointer system. even a terrorism case.
Statistics show that nearly everyone law enforcement encounters has a cell phone, and as a result, an individual cell phone number. That cell phone number can be as unique

Investigation Technologies, LLC www.investigation-technologies.com Email: invetech@gmail.com

PAGE 7