90A-NY-3151227-GJ Serial 1

90A-NY-3151227-GJ Serial 1 FD-1057 (Rcv. 5-8-I0) UNCLASSIFIED FEDERAL BUREAU OF INVESTIGATION Electronic Communication Title: (U) Subfile Opening Document Date: 12/03/2019 From: NEW YORK NY-C19 Contact: Approved By: A/SSA Drafted By: Case ID #: 90A-NY-3151227-GJ (U) UNSUB(S); JEFFREY EPSTEIN - VICTIM; DEATH INVESTIGATION Synopsis: (U) Grand Jury Subfile Opening Document Details: Writer requests the opening of a Grand Jury Subfile for Grand Jury information received during this investigation. •• UNCLASSIFIED EFTA00133349 90A-NY-3151227-GJ Serial 2 FD-302 (Rev. 5-8-10) •1 of 1. FEDERAL BUREAU OF INVESTIGATION Date of entry 12/06/2039 Pursuant to a Federal Grand Jury subpoena served by the Southern District of New York, 4Chan provided the attached response, dated August 14, 2019. Investigation on 08/14/2019 at Fik# 90A-NY-3151227-GJ New York, New York, United States (Email) Date drafted 12/06/2019 by This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents arc not to be distributed outside your agency. EFTA00133350 Report #2093 enerated on 2019-08-14 10:04:26 EDT. Requested b Case ID: 2019R01059. Records provided pursuant to a subpoena. All records made and kept in the regular course of business. This report was generated using the following inputs: Post Numbers: /po1/222 520442 /pol/222518349 /po1/222520257 /poU2225 18664 Associated IPs (2): Post times (4): /po1/222520442 was posted by on 08/10/2019 08:47:56 EDT. /po1/222518349 was posted by on 08/10/2019 08:16:36 EDT. /pol/222520257 was posted by on 08/10/2019 08:44:55 EDT. /po1/2225 18664 was posted by on 08/10/2019 08:21:58 EDT. Deletion records (1): Deletion #30169564 Cleared: this entry doesn't correspond to a deletion. Cleared on: 08/10/2019 09:46:22 EDT Board: /pol/ Post No.: 222520257 Reply to thread No.: 222518349 Name: Anonymous Subject: Comment: Not saying anything after this pls do not try to dox me but last night after 0415 count they took him medical in a wheelchair front cuffed but not 1 triage nurse says they spoke to him. Next thing we know a trip van shows up? We do not do releases on the weekends unless a judge orders it. Next thing we know, he's put in a single man cell and hangs himself? Heres the thing, the trip van did NOT sign in and we did not record the plate number and a guy in a green dress military outfit was in the back of the van according to the tower guy who let him thru the gate. You guys i am shaking right now but i think they switched him out. EFTA00133351 EFTA00133352 From: To: Ce: Subject: Date: Attachments: 4rhan LEO SUDDOrt 4chan Subpoena Response (Report #2093) Wednesday, August 19, 2019 10:08:38 AM 4rhan Report 2093 (Case ID 2019R010591 pd AngDOLIKL Dear Mr.IM In reference to your subpoena dated 08/14/2019 (Case ID: 2019R01059), please find as file: "4chan Report 2093 (Case ID: 2019R0 I 059).txt" Please be advised that the Custodian of Records for 4chan Community Support LLC alternate form available for certifying records that does not have this requirement, or requirement be waived? Please let us know if you have any additional questions or require further assistance. Regards, 4chan LEO Support attached the requested records is not a US citizen. Is there an failing that, can the declaration EFTA00133353 90A-NY-3151227-GJ Serial 3 FD-302 (Rev. 5-8-10) •1 of 1. FEDERAL BUREAU OF INVESTIGATION Date of entry 12/06/2039 Pursuant to a Federal Grand Jury subpoena served by the Southern District of New York, Apple provided the attached response, dated September 19, 2019. Investigation on 09/19/2019 at Fik# 90A-NY-3151227-GJ New York, New York, United States (Email) Date drafted 12/06/2019 by This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents arc not to be distributed outside your agency. EFTA00133354 From: To: Subject: Apple Response; Case Number: 2019R01059; (19271022) Date: Thursday, September 19, 2019 5:12:17 PM Dear AUSA Pursuant to your legal request, Apple has provided you with a file containing customer personally identifying information (PII). As previously advised, for data security and customer confidentiality purposes, Apple's production of data containing customer Pll is encrypted using GPG encryption software. Law enforcement officers who receive Apple data containing customer Pll must be able to manage production files encrypted with the GPG format without technical assistance from Apple. Technical information relating to GPG encryption software is available at: kluy/AvvAv gng4win orghlorienigng4win-rompentlium Wml. Information in relation to installing GPG on Windows OS is included in this link under the heading 'Installing Gpg4win'. If you require further technical assistance/information, please consult your agency's Information Technology Department. The password for the encrypted file(s): GPG Installation & Decryption Instructions When decrypting the gpg file be sure that you have read write permissions on the drive that you are copying to and that the drive is formatted with NTFS (there are limitations with FAT32 file systems where long file paths are not supported, which will cause expansion of some productions to fail to properly unzip). Access the GPG encrypted file by using the following steps (please note that this should not be considered a comprehensive description of the process as the user rights on the machine may not permit certain steps outlined herein). For Windows: I. Install GPG for Windows (bup•//www gng4win ore) There is a light version of gpg that doesn't include Kleopatra that you can install with this link: Wiwi/filet crig4win orgfrog4win-light-2 I 0 eve 2. Copy the file to a drive that the user can write to 3. If you restart your computer you should be able to double click on the file and it will prompt you for the password, if not: open a command prompt (run cmd.exe) 4. Type: gpg 5. Press the space bar button 6. Drag the file into the command window If done properly your text should look similar to the following: gpg c:/Documents and Settings/myuser/Desktop/Production16000017.zip.gpg Mac: 7. Press the "Enter" button 8. Type the password I. Install MacGPG (Dapyllengtools org) amazonawssonkortools/GPG%20Suite%20- EFTA00133355 %202013 OR 06 (brig] 2. Copy the file to a drive that the user can write to 3. If you restart your computer you should be able to double click on the file and it will prompt you for the password, if not open a Terminal window (/Applicationalltilitiesiferminal.app) 4. Type: gpg -o 5. Press the space bar button 6. Drag the file into the command window 7. Delete ".gpg" from the text string 8. Press the space bar button 9. Type: -d 10. Press the space bar button 11. Drag the file into the command window If done properly your text should look similar to the following: gpg -o /Users/myuseriDesktop/Production16000017.zip -d /Users/myuser/Desktop/Production16000017.zip.gpg 12. Press the "Enter" button 13. Type the password This will decrypt the file to the same location as the file. The file is zipped so you will need to unzip it and the files will be available for viewing. This transmission may contain confidential information intended only for the person(s) named above. Any other distribution, re-transmission, copying or disclosure is strictly prohibited. If you have received this transmission in error, please notify immediately and delete this file/message from your system. EFTA00133356 From: To: Subject: Apple Response; Case Number: 2019R01059; (19271022) Date: Thursday, September 19, 2019 5:11:01 PM Attachments: 12271022EugluclanZlI2M12 Via Email Delivery AUSA United States Attorney's Office One St. Andrew's Plaza New York, NY Dear AUSA Apple Inc. ("Apple") is providing APL000001 through APL000004 in response to the legal request received by Apple on 2019-08-13. These files are true copies of the data Apple has located based on a reasonable search of the last 12 months of its data using the criteria and information provided in the legal request. Said files were prepared by Apple personnel in the ordinary course of business. For data security and customer confidentiality purposes, Apple's production of data containing customer personally identifying information is encrypted using GPG encryption software. Law enforcement officers who receive Apple data must be able to manage production files encrypted with the GPG format without technical assistance from Apple. Technical information relating to GPG encryption software is available at: bttpi/www gpg4win org/doc/en/gRg4win-compendium hull'. Information in relation to installing GPG on Windows OS is included in this link under the heading `Installing Gpg4win'. If you require further technical assistance/information, please consult your agency's Information Technology Department. The password for the GPG file will be provided in a separate email. Please note, any .xls files will need to be opened in "Read Only" mode. You may note entries from IP addresses beginning with "17." and/or "10." for any available connection logs provided. IP addresses beginning with "17." are assigned to Apple and their occurrence in these logs is reflective of activity on Apple internal servers and not an indication of any user connections. IP addresses beginning with "10." in relation to Find My iPhone ("FMIP") logs are also reflective of activity on Apple internal servers and not an indication of any user connections. All evidence preservation pursuant to the herein request response is the responsibility of the requesting law enforcement agency. Sincerely, Ian Apple Privacy & Law Enforcement Compliance EFTA00133357 bttp://www apple com/privacy/ Enclosures For more information about Apple's Legal Process Guidelines for U.S. Law Enforcement, please visit: lutp.//vvv,rw apple.com/legallprivacy/law-enforcement-guidelines-uc pdf ****************************************************************************** This transmission may contain confidential information intended only for the person(s) named above. Any other distribution, re-transmission, copying or disclosure is strictly prohibited. If you have received this transmission in error, please notify immediately and delete this file/message from your system. EFTA00133358 90A-NY-3151227-GJ Serial 4 FD-302 (Rev. 5-8-10) •1 of 1. FEDERAL BUREAU OF INVESTIGATION Date of entry 12/06/2039 Pursuant to a Federal Grand Jury subpoena served by the Southern District of New York, AT&T provided the attached response, dated August 15, 2019. Investigation on 08/15/2019 at New York, New York, United States (, Other (Unknown)) Fact, 90A-NY-3151227-GJ Date drafted 12/06/2019 by This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents arc not to be distributed outside your agency. EFTA00133359 RESPONSE COVER SHEET AT&T 11760 US HWY 1, SUITE 300 NORTH PALM BEACH FL 33408 Phoneme Facsimile To: AUSA AUSA NEW YORK 10007 I ST ANDREWS PLAZA NEW YORK NY 10007 Phone Number: Fax Number: 1 Case Number: Case Name: File Code: 2790840 From: DAD Request Dated: 8!I112019 Number of Page. Received On: 8/15/2019 Date: 8/15/2019 After conducting a thorough search of all identifiers listed in the legal demand. all :nail:dile information responsive to this demand is enclosed. CONFIDEVEIALITY NOTICE This cover sheet, and any document which may accompany it, contains information from the Global Legal Ikmand Center which is intended for use only by the individual to whom it is addressed, and which may contain information that is privileged, confidential and/or otherwise exempt from disclosure under applicable law. If the reader of this message is not the intended incipient or the person responsible for delivering this message to the intended recipient. any review, disclosure. dissemination, distribution. copying or other use of this message or its substance is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone to arrange for the return of this communication to us at our expense. Thank you. EFTA00133360 Declaration of Custodian of Records Pursuant to 28 U.S.C. § 1746. I, the undersigned. hereby declare: My name is Daniel Dixon maw of declarant) I am a United States citizen and I am over eighteen years of age. I am the custodian of records of the business named below, or I am otherwise qualified as a result of my position with the business named below to make this declaration. I • of a Grand Jur• Subpoena, dated August II, 2019. and signed by Assistant United States Attorney requesting specified records of the business named below. Pursuant to Rules 902(11) and 803(6) of le .e era ules of Evidence. I hereby certify that the records provided herewith and in response to the Subpoena: (I) were made at or near the time of the occurrence of the matters set forth in the records, by. or from information transmitted bs. a person with knowledge of those matters: (2) were kept in the course of regularly conducted business activity: and (3) were made by the regularly conducted business activity as a regular practice. I declare under penalty of perjury that the foregoing is true and correct. Executed on 8/15/2019 (dale) 'Coon. (sign:gun: ordeclarant) Daniel Dixon Compliance Analyst (mane and Itik of *damn° AT&T (03111C of him, le ) 11760 US Highway One STE 300 i hnanc., ,,ddiw) North Palm Beach, FL 33408 Definitions or terms used above: As defined in Fed. R. Evid. 803(6). "record" includes a memorandum, report. record, or data compilation, in any form. °facts. events. conditions. opinions, or diagnoses. The term "business" as used in Fed. R. Evid. 803(6) and the above declaration includes business, institution, association. profession, occupation. and calling of every kind. whether or not conducted for profit. EFTA00133361 2790840 DAD AT&T 11760 US HWY 1. SUITE 300 NORTH PALM BEACH FL 33408 (Fax) CERTIFICATE OF AUTHENTICITY OF DOMESTIC RECORDS PURSUANT TO FEDERAL RULES OF EVIDENCE 902(11) AND 992(13) I, Daniel Dixon, attest, under penalties of perjury by the laws of the United States of America pursuant to 28 U.S.C. § 1746, that the information contained in this certification is true and correct. I am employed by AT&T, and my title is Legal Compliance Analyst. I am qualified to authenticate the records attached hereto because I am familiar with how the records were created, managed, stored, and retrieved. I state that the records attached hereto are true duplicates of the original records in the custody of AT&T. I further state that: a. All records attached to this certificate were made at or near the time of the occurrence of the matter set forth by, or from information transmitted by, a person with knowledge of those matters, they were kept in the ordinary course of the regularly conducted business activity of AT&T , and they were made by AT&T as a regular practice; and b. Such records were generated by AT&T's electronic process or system that produces an accurate result, to wit: I. The records were copied from electronic device(s), storage medium(s), or file(s) in the custody of AT&T in a manner to ensure that they are true duplicates of the original records; and 2. The process or system is regularly verified by AT&T, and at all times pertinent to the records certified here the process and system functioned properly and normally. I further state that this certification is intended to satisfy Rules 902(11) and 902(13) of the Federal Rules of Evidence. August 15, 2019 Date Signature EFTA00133362 Grand Jury Subpoena PtiteboStzxtespistrict Court SOUTHERN DISTRICT OF NEW YORK TO: National Compliance Center AT&T Corporation 11760 U.S. Highway 1 North Palm Beach, FL 33408 GREETINGS: WE COMMAND YOU that all and singular business and excuses being laid aside, you appear and attend before the GRAND JURY of the people of the United States for the Southern District of New York, at the United States Courthouse, 40 Foley Square, Room 220, in the Borough of Manhattan, City of New York, New York, in the Southern District of New York, at the following date, time and place: Appearance Date: August 13, 2019 Appearance Time: 10:00 a.m. to testify and give evidence in regard to an alleged violation of : 18 U.S.C. §§ 371, 1001, 1519 and not to depart the Grand Jury without leave thereof, or of the United States Attorney, and that you bring with you and produce at the above time and place the following: Please see attached rider. Personal appearance is not uired if the requested records are (1) produced on or before the return date to Assistant U.S. Attorney of the United States Attorney's Office, I St. Andrew's Plaza, New York, NY 10007. Tel: , and (2) accompanied by an executed copy of the attached Declaration of Custodian of Records. Ref No. JE08112019. Failure to attend and produce any items hereby demanded will constitute contempt of court and will subject you to civil sanctions and criminal penalties, in addition to other penalties of the Law. DATED: New York, New York August 11, 2019 640 Cfa-SS, Fbes-v% GEOFFREY S. BERMAN At" Ltlfir United States Attorney for the Southern District ofNew York Assistant United States Attorney One St. Andrew's Plaza New York, New York 10007 Telephone: Email: rev. 02.01.12 EFTA00133363 RIDER (Grand Jury Subpoena to AT&T, dated August 11, 2019) Ref. No. JE08112019 REOUEST: For the following telephone numbers: • Please provide any and all documents, to include, but not limited to those identified below, for the period July 6, 2019 until the present: I. All subscriber identifying information, including, but not limited to, name(s), address(es), date of birth, social security number(s), email addresses, and secondary telephone number; 2. All billing identifying information, including, but not limited to, name(s), address(es), date of birth, social security number(s), email addresses, secondary telephone number, and method of payment; 3. Physical location or intemet protocol ("IP") address where the account was registered; 4. Phone type (e.g. cellular, payphone, calling card, land line); 5. Electronic Serial Number ("ESN"), International Mobile Equipment Identity rimEn, International Mobile Subscriber Identity ("IMSI"), Media Access Control ("MAC") address, SIM number, ICCID number, UDID number, and/or device serial number; 6. All call detail information, including, but not limited to, local, long distance and toll records, including incoming and outgoing calls; 7. Toll information for text messages (timing and numbers associated with incoming and outgoing text messages); 8. All other telephone numbers registered to or listed on the same account; 9. Length of service, including the date the account was established and the date the account was disconnected, if applicable. In lieu of an appearance you may comply with this subpoena by providing the requested information, alon with a business records certification pursuant to Fed. R. Evid. 803(6) to Assistant U.S. Attorney of the United States Attorne 's Office, 1 St. Andrew's Plaza, New York, NY 10007. Tel: , email: EFTA00133364 RESPONSE COVER SHEET AT&T 11760 US HWY 1, SUITE 300 NORTH PALM BEACH FL 33408 Phoneme Facsimile To: AUSA AUSA NEW YORK 10007 I ST ANDREWS PLAZA NEW YORK NY 10007 File Code: 2790842 From: DAD Phone Number: Request Dated: 8/1412019 Number of Pages: Fax Number: I Received On: 8/142019 Date: 8/1512019 Case Number: Case Name: AT&T is unable to provide any information in response to the Legal Demand because AT&T does not maintain records in the normal course of business that associate individual accounts or devices with wireless dynamic IP addresses. The IP address(es) listed in the Legal Demand is/are allocated to AT&T Mobility LLC, AT&T Global Network Services, and/or Service Provider Corporation in conjunction with AT&T Wireless. These blocks of IP addresses are used by AT&T Wireless for internet access and web based applications for wireless devices (such as web enabled cell phones and air cards). CONFIDEVEIALITY NOTICE This cover sheet, and any document which may accompany it, contains information from the Global Legal Ikmand Center which is intended for use only by the individual to whom it is addressed, and which may contain information that is privileged, confidential and/or otherwise exempt from disclosure under applicable law. If the reader of this message is not the intended incipient or the person responsible for delivering this message to the intended recipient. any review, disclosure. dissemination, distribution. copying or other use of this message or its substance is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone to arrange for the return of this communication to us at our expense. Thank you. EFTA00133365 2790842 DAD AT&T 11760 US HWY I, SUITE 300 NORTH PALM BEACH FL 33408 (Fax) DECLARATION OF AUTHENTICITY OF AT&T RECORDS STATE OF FLORIDA COUNTY OF PALM BEACH My name is Daniel Dixon. I am over the age of 18 and qualified to make this affidavit. I am employed by AT&T as a Compliance Security Analyst and also serve as the Custodian of Records for AT&T. I have been employed by AT&T since 10/12/2009. After a thorough search of the documents relied on in the course of my duties as Custodian of Records and Compliance Security Analyst, I was unable to find any information responsive to your request regarding: Pursuant to 28 U.S.C. Sec.1746, I declare, under penalty of perjury, that the foregoing is true and correct. Executed on August 15, 2019 Jnn IX:ren Compliance Security Analyst EFTA00133366 Grand Jury Subpoena Prato,States pistrirt Trani SOUTHERN DISTRICT OF NEW YORK TO: National Compliance Center AT&T Corporation 11760 U.S. Highway 1 North Palm Beach, FL 33408 GREETINGS: WE COMMAND YOU that all and singular business and excuses being laid aside, you appear and attend before the GRAND JURY of the people of the United States for the Southern District of New York, at the United States Courthouse, 40 Foley Square, Room 220, in the Borough of Manhattan, City of New York, New York, in the Southern District of New York, at the following date, time and place: Appearance Date: August 21, 2019 Appearance Time: 10:00 a.m. to testify and give evidence in regard to an alleged violation of : 18 U.S.C. §§ 371, 1001, 1519, 2 and not to depart the Grand Jury without leave thereof, or of the United States Attorney, and that you bring with you and produce at the above time and place the following: Please see attached rider. Personal appeara required if the requested records are (1) produced on or before the return date to Assistant U.S. Attorney of the United States Attorne s Office, 1 St. Andrew's Plaza, New York, NY 10007. Tel: . email: and (2) accompanied by an executed copy of the attached Declaration of Custodian of Records. Ref No. 2019R01059. Failure to attend and produce any items hereby demanded will constitute contempt of court and will subject you to civil sanctions and criminal penalties, in addition to other penalties of the Law. DATED: New York, New York August 14, 2019 6e0C6s-ss• GEOFFREY S. BERMAN At" Ltlfir United States Attorney for the Southern District of New York Assistant United States Attorney One St. Andrew's Plaza New York, New York 10007 Telephone: Email: rev. 02.01.12 EFTA00133367 RIDER (Grand Jury Subpoena to AT&T, dated August 14, 2019) Ref. No. 2019R01059 REOUEST: For the Internet Protocol ("IP") addresses listed below at the following dates and times, please provide the following information: on 08/10/2019 08:47:56 EDT on 08/10/2019 08:16:36 EDT on 08/10/2019 08:21:58 EDT I. All subscriber identifying information including, but not limited to: a. Name; b. User name or other subscriber identity or number; c. Address; d. Primary and alternate telephone numbers; e. Primary and alternate email addresses; f. Date of birth; g. Social Security number; h. Any temporarily assigned network address; i. MAC address; and j. Browser and operating system information. 2. Records of session times and durations and any IP addresses used by the subscriber at the beginning, end, and anytime during these sessions. 3. Length of service, including start date and types of service utilized. 4. Means and source of payment for services (including any credit card or bank account numbers). 5. Subscriber's call detail information for the period from January 1, 2014 to the present. 6. Account notes and logs, including any customer service communications or other correspondence with the subscriber. 7. Investigative files or user complaints concerning the subscriber. In lieu of an appearance you may comply with this subpoena by providing the requested information, alon with a business records certification pursuant to Fed. R. Evid. 803(6) to Assistant U.S. Attorney of the United States Attorne 's Office, I St. Andrew's Plaza, New York, NY 10007. Tel: , email: EFTA00133368 AT&T Records key AT&T searches all available databases to ensure all responsive records are provided. Multiple reports may be provided in response to your request. Note: For each record described in this key, all times are stored and provided in UTC AT&T Mobility Voice Descriptions Column/Field Name Description Item Row Number Conn.Date Connection Date. The date of the call. Conn.Time(UTC) Connection Time. The time the call was connected. Time is in UTC. Times is expressed in military time as HH:MM:SS. Conn Date Time Connection date and time- Date and Time the call was connected. Displayed as one column on the Landline Call Detail Records. SeizureTime The time it takes to connect the call measured from the moment the caller presses "Send" to when the call is connected. ET (Elapsed Time) Duration of the transaction. Duration is in NIM:SS Originating Number The phone number the call/text originated from. For data records, this does not necessarily mean the number originated the data transaction. The network constantly communicates with intemet enabled devices and the data records do not indicate if a customer initiated a data transaction. Terminating Number The number the transaction terminated to. DIALED (D) The number that the originating party dialed. Appears in subsequent line of the same row in the Originating Number column. (Note: only appears if the Tennis:ming number Offers from the Dialed number) A = *, B = # FORWARDED (F) The number the terminated number forwarded the call to. Appears in subsequent line of the same row in the Originating Number column. TRANSLATED (T) Indicates if a number was translated to a different number. For example, if the number called is 911, then that gets translated to a ten-digit number for routing to a 911 dispatch center. The (T) indicates the number the translation was from, not the number translated to. ORIGINAL ORIGINATING (00) Denotes the number that originated the call before call forwarding was invoked. Appears in subsequent line of the same row in the Originating Number column. ill Represents no record found or available. AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Pagel. of 9 EFTA00133369 IMEI International Mobile Equipment Identifier A 15-digit number that uniquely identifies an individual wireless device Only the IMEI of the number requested is displayed. IMSI International Mobile Subscriber Identity The IMSI is a globally-unique code number that identifies a GSM subscriber to the network. The IMSI is linked to your account information with the carrier. The IMSI resides in the SIM card which can be moved from one GSM phone to another. Only the IMSI of the number requested in the legal demand is displayed. CT (Call Type) Denotes if the leg of a call is an originating leg or terminating leg. Mobile Originating (MO) Mobile Terminating (MT) Service Originating (SO) Service Terminating (ST) A leg of a call represents each time the call is processed through a network switch. Calls may go through several switches in AT&Ts network in order to reach the intended party. A service record is generated when the network generates a leg of a call to reach a service on the network. For example, a leg connecting to the voicemail platform denotes a service invoked on the network and may show up as a service record. Feature This column represents the type of call that occurred as recorded by our network and used for purposes of processing a call on AT&Ts network. These are not necessarily indicative of features on a customer's account or the types of services subscribed too. Make The Make of the handset used in the transaction. Model The Model of the handset used in the transaction. Cell Location Identifiers: 3G Network cell Site= LAC/CID 4G Network Cell Site= ECGI Examples: 3G Network Cell Site. [27077/11621:-80.05629:26.74779:350:90.0] LAC/CID L0NG:LAT Sector:Beamwidth AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 2 of 9 EFTA00133370 4G Network Cell Site M3151247:520122: -96.912452:33.013937:358:4.0 ECGI:ENB-ID LONG:LAT Sector:Beamwidth Definitions: LAC-Location Area Code. This number identifies the specific region a cell tower is located in. The number is used internally in AT&T and for network purposes. CID-Cell Identity. This number identifies the location of the tower within a specified region. The number is used internally in AT&T and for network purposes. ECGI-Enhanced cell global identity. A nine digit number that indicates the location of a cell tower when 4G technology is being used. The number is used internally in AT&T and for network purposes. ENB-ID- Evolved Node B (eNodeB) Hardware connected to the AT&T mobility network that communicates directly with a mobile device. This number is used internally to AT&T to identify a specific antenna on a tower when 4G technology is used. Longitude - A geographic coordinate that specifies an East-West Position of a point on the earth's surface. The Latitude represented is of the cell tower. Latitude - A geographic coordinate that specifies a North-South Position of a point on the earth's surface. The Longitude represented is of the cell tower. Sector-A number out of 360 degrees that indicates the side of the cell site antenna used in processing the call. Beamwidth-A number out of the 360 degrees that specifies the angle of coverage of the RE signal coming from a particular cell site sector. AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 3 of 9 EFTA00133371 Feature Definitions for Mobility Voice Report Features represents the type of call that occurred as recorded by our network and used for purposes of processing a call on AT&Ts network. These are not necessarily indicative of features on a customer's account or the types of services subscribed to. Feature Acronym Feature Definition 'ADD' Unstructured Supplementary Service Data 'CBI' Barring of All Incoming Calls 'CBIOP' Incoming Operator Determined Barring i 'CBIP' Barring of All Incoming Calls Roaming Outside Public Land Mobile Network 'CBIUK' Barring of Incoming Calls 'CBO' Barring of All Outgoing Calls 'CBOI' Barring of All Outgoing Intl Calls 'CROW' Barring of All Outgoing Intl Calls Except to Public Land Mobile Network 'CBOOP' Outgoing Operator Determined Barring 'CBOUK' Barring of Outgoing Calls 'CBUK' All Barring 'CFB' Call Forwarding Subscriber Busy 'CFC' Call Forwarding All Conditional i 'CFNA' Call Forwarding No Reply 'CFNR' Call Forwarding Not Reachable I 'CFO' Call Forwarding in Gateway (Unknown) 'CFU' Call Forwarding Unconditional 'CFUK' All Forwarding 'CGC' a Advice of Charge Charging 'CGI' Advice of Charge Information 'CIAC' Account Code Service 'CICUG' Closed user Groups Service 'CIPCI' Proprietary Customer Information a 'CMH' Call Hold AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 4 of 9 EFTA00133372 'CMPRL' Proprietary Release Link Trunk Service 'CNIPVAII Proprietary Voice Mail Call Drophack 'CMR' Call Re-origination 'CMRC' Call Re-Origination By Cause 'CMW' Call Waiting 'ECT' Explicit Call Transfer 'GREW Enhanced Multi 'INIOR' Invoke Calling Number Identity Restriction 'MPS' Multiparty Services 'NIND' Proprietary Calling Name Delivery 'NIOP' Calling Number Identity Presentation INIOR' Calling Number Identity Restriction 'NITP' Connected Line Identity Presentation 'NITR' Connected Line Identity Restriction 'NSDA' Directory Assistance Service Call 'OACR' Anonymous Call Rejection 'OEXT' Extension Service 'ONICT' Malicious Call Trace 'O11ISC MSC 'OOW Optimal Routing (of Late Call Forwarding) 'SUBCMH' Call hold Call hold, Invoke, Invoked by Subscriber V2G Volte to 3G. It indicates the call was handed off from one Volte (a VOID call) to the 3G network (circuit switched call) VM Voicemail involved in transaction VCORR 4G Cell site was correlated with additional database FCID "flexible Caller ID" This indicates a secondary device, such as a watch or tablet, originated the call. The number indicated as the Original Originating (00) is the native number belonging to the secondary device that originated the call. AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page S of 9 EFTA00133373 Feature Definitions for Mobility Voice and Mobility SMS Report Features represents the type of Call/SMS that occurred as recorded by our network and used for purposes of processing a Call/SMS on AT&Ts network. These are not necessarily indicative of features on a customer's account or the types of services subscribed to. Feature Acronym Feature Definition 'Wi-Fi' Er • This denotes when a Call/SMS was carried over Wi-Fi. No cell sites or any type of location information is available on these transactions because AT&T does not store this information. q AT&T Mobility SMS Descriptions Column Name Description Originating Number Number that originated the SMS Terminating Number Number that received the SMS Descrip If known, describes the direction of the SMS SMSO (SMS originating) SMST (SMS terminating) AT&T Mobility SMS-Email Descriptions Column Name Description illr—Email address associated Email Status SEND/RCVD MT MO (Mobile originating) (Mobile terminating) AO (Application originating) AT (Application terminating) AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 6 of 9 EFTA00133374 AT&T Mobility Data Descriptions Column Name Description Bytes Up The number of bytes sent from mobile station to the network. Bytes Dn The number of bytes from the network to the mobile station. Originating Number For data records, the Originating Number does not necessarily mean the number originated the data transaction. The network constantly communicates with intemet enabled devices and the data records do not indicate if a customer initiated a data transaction. AT&T Wi-Fi Data Descriptions This report signifies data transactions where the customer is connected to Wi-Fi using AT&T VPN service. Column Name Description Bytes Up The number of bytes sent from mobile station to the network. Bytes Dn The number of bytes from the network to the mobile station. Originating Number For data records. the Originating Number does not necessarily mean the number originated the data transaction. The network constantly communicates with internet enabled devices and the data records do not indicate if a customer initiated a data transaction. AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 7 of 9 EFTA00133375 AT&T Wireline Descriptions Column Name Description Sec. ()rig Secondary Originating Number. A secondary number associated with the call transaction. This number can either be a wireline or mobility number. As an example, if it is a non-mobility number, this could be a number that sits behind a customer's internal phone network such as a PBX. There are other numerous situations when secondary originating numbers are part of a call transaction. C IC Carrier Identification Code. The number in this column translates to identifying the interexchange carrier of the call. A public listing of CIC codes can be found at the following url: http://www.nanpa.com/repons/reports cic.hitni Call Code Represents the type of call that was processed on the wireline network. ()rig. Acc. Originating Access ID. When a call is received from another carrier and traverses AT&Ts VoIP network. This number translates to what carrier sent AT&T the call. AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 8 of 9 EFTA00133376 AT&T International Descriptions Column Name Description Orig Country The country the call originated from based on the NPA-NXX of the party that placed the call. Dial Country The country of the number dialed based on the NPA-NXX of the dialed number. In Country Inbound Country. The country AT&T terminated the call to. This does not necessarily mean the called party is in the listed country. This represents the country that AT&T directed the call to in order to properly route the call to its final destination. Other carriers may pick up the call after the call has left the AT&T network. Out Country Outbound Country. The country AT&T routed the call from. This does not necessarily mean the call originated from the listed country. This represents the country AT&Ts network was used in to properly route the call to its final destination. Ans Ind Indicates if the call was answered. From C PN From Calling Party Number. Indicates if the call originated from the Originating Number. AT&T Common Scenarios I Scenarios Description Zero Duration Calls Voice usage reports showing all calls with zero durations in the Elapsed Time "ET" column indicate calls that were not connected. Numbers such as this are commonly used for routing purposes. AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 9 of 9 EFTA00133377 MOBILITY 2790840 08/15/2019 AT&T has queried for records from 07/06/2019 12:00:00am to 08/11/2019 11:59:59pm AT&T has queried for records using Eastern Time Zone. AT&T's records are stored and provided in UTC. AT&T Run Date: Run Time: Voice Usage For: Item Conn. Date OS/15/2019 Sim Conn. Seizure Time Time (uTc) ET Originating Terminating "CI Number Number INSI CT Feature 1 07/06/19 13:10:44 0:13 1:33 3594090814785818 310410662903025 MT -Pi:NIOP1 APPLE IPHONEX 2 07/06/19 13:10:45 0:00 1:33 MO (1 3 07/06/19 13:14:17 0:00 0:21 MT (1 4 07/06/19 13:14:17 0:00 0:21 MT (1 5 07/06/19 13:14:18 0:11 0:20 ST (NIOP1 6 07/06/19 13:14:18 0:11 0:20 3594090814785818 310410662903025 NO (Ni-ril APPLE IPHONEX 7 07/06/19 14:03:21 0:00 0:52 35940908147858 310410662903025 MT (1 APPLE IPHONEX 8 07/06/19 14:03:21 0:29 0:52 NO (Ni-Pil 9 07/06/19 14:03:21 0:29 0:52 ST (NIOP1 APPLE IPHONEX 10 07/06/19 21:35:13 0:15 1:38 3594090814785818 310410662903025 MT -Pi:NIOP1 APPLE IPHONEX 11 07/06/19 21:35:13 0:16 1:38 MO -Pil 12 07/06/19 22:43:26 0:09 0:20 MO (VCORR1 13 07/06/19 22:43:26 0:09 0:20 3594090814785818 310410662903025 MT -Pi:NIOP1 APPLE IPHONEX 14 07/06/19 23:11:48 0:17 1:16 MT (NIOP:CbM:VCORR1 15 07/06/19 23:11:48 0:18 1:16 3594090814785818 310410662903025 MO —Pil APPLE IPHONEX 16 07/06/19 23:13:38 0:22 0:00 MT (NIOP1 17 07/06/19 23:13:40 0:24 0:02 MT (NIOP:ClNA:VM1 18 07/06/19 23:13:40 0:25 0:02 3594090814785818 310410662903025 MO (Ni APPLE IPHONEX 19 07/06/19 23:14:26 0:30 0:01 ST (NIOP1 20 07/06/19 23:14:29 0:33 0:03 MT (NIOP:ClNA:VM1 21 07/06/19 23:14:29 0:33 0:03 3594090814785818 310410662903025 MO (Ni APPLE IPHONEX AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 1 EFTA00133378 MOBILITY 2790840 08/15/2019 AT&T has queried for records from 07/06/2019 12:00:00am to 08/11/2019 11:59:59pm AT&T has queried for records using Eastern Time Zone. AT&T's records are stored and provided in .....„••••--s`""6 AT&T UTC. Run Date: Run Time: Voice Usage For: Item Conn. Date OS/15/2019 Sim Conn. seizure Time Time (OTC) Cf Originating Terminating ticI Number Number IMFI CT Feature 22 07/06/19 23:17:09 0:11 0:14 I 3594090814785818 310410662903025 NO (Ni-Pi( APPLE IPHONEX 23 07/06/19 23:17:51 0:23 0:00 MT (Ni-Pi:NIOP1 24 07/06/19 23:17:53 0:25 0:01 MT (Ni- ri:NIOP:CPNA:VN1 25 07/06/19 23:17:53 0:25 0:01 3594090814785818 310410662903025 NO (Ni-Pi( APPLE IPHONEX 26 07/06/19 23:28:28 0:23 0:00 MT (Ni-Pi:NIOP1 27 07/06/19 23:28:30 0:25 0:02 MT (Ni-ri:NIOP:CPS:VN1 28 07/06/19 23:28:30 0:25 0:02 3594090814785818 310410662903025 NO (Ni-Pi( APPLE IPHONEX 29 07/06/19 23:34:33 0:23 0:00 MT (NIOP1 30 07/06/19 23:34:34 0:24 0:03 MT (NIOP:CFNA:VN1 31 07/06/19 23:34:34 0:24 0:03 3594090814785818 310410662903025 NO (Ni-Pi( APPLE IPHONEX 32 07/06/19 23:35:06 0:07 0:19 MT (NIOP:VCORR1 33 07/06/19 23:35:06 0:08 0:19 3594090814785818 310410662903025 NO (Ni-Pi( APPLE IPHONEX 34 07/06/19 23:40:35 0:05 0:00 MT (Ni -Pi:NIOP1 35 07/06/19 23:40:37 0:07 0:02 MT (Ni -Pi:NIOP:CPS:VN1 36 07/06/19 23:40:37 0:08 0:02 3594090814785818 310410662903025 NO (Ni-Pi( APPLE IPHONEX 37 07/06/19 23:43:00 0:05 1:47 3594090814785818 310410662903025 MT (Ni -Pi:NIOP1 APPLE IPHONEX 38 07/07/19 00:04:50 0:31 0:02 3594090814785818 310410662903025 NO (Ni-Pi( APPLE IPHONEX 39 07/07/19 00:13:07 0:05 2:18 NO (VCORR1 40 07/07/19 00:13:07 0:05 2:18 3594090814785818 310410662903025 MT (Ni-Pi:NIOP1 APPLE IPHONEX AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 2 EFTA00133379 MOBILITY 2790840 08/15/2019 AT&T has queried for records from 07/06/2019 12:00:00am to 08/11/2019 11:59:59pm AT&T has queried for records using Eastern Time Zone. AT&T's records are stored and provided in OTC. a AT&T Run Date: Run Tine: voice Usage For: Item Conn. Date 08/IS/2019 Conn. Tine (vrc) Seizure Time ET Originating Terminating Number Number IMGI INSI CT Feature 41 07/07/19 00:23:17 0:02 0:03 3594090814785818 310410662903025 MO (Mi-Pil APPLE IPHONEX 42 07/07/19 00:23:54 0:31 0:01 3594090814785818 310410662903025 MO (Mi-Pil APPLE IPHONEX 43 07/07/19 00:25:46 0:05 4:06 3594090814785818 310410662903025 MT (Ni-ri:NIOPI APPLE IPHONEX 44 07/07/19 00:42:31 0:05 2:53 MO (VCORR1 45 07/07/19 00:42:31 0:05 2:53 3594090814785818 310410662903025 MT (Ni-ri:NIOPI APPLE IPHONEX 46 07/07/19 02:23:14 0:06 5:32 MO (1 47 07/07/19 02:23:14 0:06 5:32 3594090814785818 310410662903025 MT (Ni-ri:NIOPI APPLE IPHONEX 48 07/07/19 14:19:42 0:03 0:00 3594090814785818 310410662903025 MT (Mi -Pi:NIOP1 APPLE IPHONEX 49 07/07/19 14:19:43 0:04 0:03 3594090814785818 310410662903025 MT (Ni-ri:NIOP:CPS:VN1 APPLE IPHONEX 50 07/07/19 14:19:43 0:06 0:03 MO (1 51 07/07/19 14:23:22 0:12 40:11 3594090814785818 310410662903025 MO (Mi-Pil APPLE IPHONEX 52 07/07/19 14:23:22 0:05 40:11 MT (NIOP1 53 07/07/19 15:54:24 0:20 0:00 MT (NIOP1 54 07/07/19 15:54:44 0:29 0:00 3594090814785818 310410662903025 MO (Ni-Pil APPLE IPHONEX 55 07/07/19 18:44:06 0:23 0:02 MT (NIOP:CfNA:VN1 56 07/07/19 18:44:06 0:27 0:02 ST (1 57 07/07/19 18:44:06 0:02 0:03 MO (CPNA:VMI 58 07/07/19 18:44:07 0:29 0:01 3594090814785818 310410662903025 MO (Mi-Pil APPLE IPHONEX 59 07/07/19 18:45:20 0:07 0:00 ST (1 60 07/07/19 18:45:24 0:03 0:00 MT (NIOPI AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 3 EFTA00133380 2790840 08/15/2019 MOBILITY illb. AT&T has queried for records from 07/06/2019 12:00:00am to 08/11/2019 11:59:59pm .3/41/4-.t,!•`'s AT&T AT&T has queried for records using Eastern Time Zone. AT&T's records are stored and provided in UTC. Run Date: Run Time: Voice Usage For: Item Conn. Date 08/1S/2019 WNW' Conn. Seizure Tame Time (UTC) BS Originating Terminating Number Number Dal IMSI CT Feature 61 07/07/19 18:45:27 0:08 0:00 3594090914785818 310410662903025 MO (Ni-Fil APPLE IPHONEX 62 07/07/19 21:05:04 0:21 0:00 3594090914785818 310410662903025 MT (Ni-Pi:NIOPI APPLE IPHONEX 63 07/07/19 21:05:05 0:22 0:04 3594090814785818 310410662903025 MT (Wi- APPLE Pi:NIOP:CFNA:VM1 IPHONEX 64 07/07/19 21:58:42 0:07 0:08 3594090814785818 310410662903025 MT (Ni-Pi:NIOP1 APPLE IPHONEX 65 07/07/19 23:03:21 0:10 5:30 3594090914785818 310410662903025 MT (Ni-Pi:NIOP1 APPLE IPHONEX 66 07/07/19 23:03:21 0:10 5:30 MO (VCORRI 67 07/07/19 23:17:18 0:10 1:35 MT (NIOP:VCORR1 68 07/07/19 23:17:18 0:09 0:01 MT (Ni-Pi:NIOPI 69 07/07/19 23:17:19 0:11 1:34 3594090914795918 310410662903025 MO (Ni-Fil APPLE IPHONEX 70 07/07/19 23:32:57 0:03 9:00 3594090914785818 310410662903025 MO (Ni-Fil APPLE IPHONEX 71 07/08/19 08:30:06 0:03 1:35 3594090814785818 310410662903025 MO (Ni-Fil APPLE IPHONEX 72 07/08/19 08:32:12 0:02 0:17 3594090814785818 310410662903025 MO (Ni-Fil APPLE IPHONEX 73 07/08/19 08:32:34 0:03 7:11 3594090814785818 310410662903025 MO (Ni-Fil APPLE IPHONEX 74 07/08/19 13:35:06 0:00 6:37 35940909147958 310410662903025 MT (1 APPLE IPHONEX 75 07/08/19 13:35:07 0:11 6:37 ST (NIOP1 76 07/08/19 14:28:31 0:00 7:05 35940909147958 310410662903025 MO (1 APPLE IPHONEX 77 07/08/19 16:11:02 0:00 0:36 35940908147858 310410662903025 MT (1 APPLE IPHONEX AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 4 EFTA00133381 2790840 08/15/2019 MOBILITY AT&T has queried for records from 07/06/2019 12:00:00am to 08/11/2019 11:59:59pm AT&T has queried for records using Eastern Time Zone. AT&T's records are stored and provided in UTC. 411., &•°.„•""s. AT&T Run Date: Run Tina: Voice Usage For: Item Conn. Date 08/15/2019 WNW' Conn. Seizure Tine Time (OTC) ET Originating Terminating INEI Number Number INS1 CT Feature 78 07/08/19 16:11:04 0:14 0:36 ST (NIOP1 79 07/08/19 18:40:56 0:00 0:45 35940908147858 310410662903025 MT (1 APPLE IPHONEX 80 07/08/19 18:40:57 0:11 0:45 ST (NIOP1 81 07/08/19 19:03:11 0:00 1:29 35940908147858 310410662903025 MT (1 APPLE IPHONEX 82 07/08/19 19:03:12 0:13 1:29 ST (NIOP1 83 07/08/19 19:40:29 0:21 0:02 3594090814785818 310410662903025 NO (Ni-Fil APPLE IPHONEX 84 07/08/19 22:28:52 0:29 0:00 3594090814785818 310410662903025 NO (Ni-Fil APPLE IPHONEX 85 07/08/19 22:33:20 0:04 8:18 3594090814785818 310410662903025 MT (Ni-Pi:NIOPI APPLE IPHONEX 86 07/09/19 09:37:22 0:12 9:58 3594090814785818 310410662903025 MT (Ni-Pi:NIOPI APPLE IPHONEX 87 07/09/19 09:37:22 0:13 9:58 NO (1 88 07/09/19 13:05:41 0:06 0:10 3594090814785818 310410662903025 MT (Ni-Pi:NIOPI APPLE IPHONEX 89 07/09/19 13:15:08 0:00 3:29 35940908147858 310410662903025 NO (1 APPLE IPHONEX 90 07/09/19 13:20:29 0:00 0:54 35940908147858 310410662903025 NO (1 APPLE IPHONEX 91 07/09/19 13:21:47 0:00 2:45 35940908147858 310410662903025 NO (1 APPLE IPHONEX 92 07/09/19 13:57:50 0:00 7:31 35940908147858 310410662903025 MT (1 APPLE IPHONEX 93 07/09/19 13:57:50 0:10 7:31 ST (NIOP1 APPLE IPHONEX 94 07/09/19 14:12:47 0:00 3:08 35940908147858 310410662903025 MT (1 APPLE IPHONEX AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 5 EFTA00133382 MOBILITY 2790840 08/15/2019 AT&T has queried for records from 07/06/2019 12:00:00am to 08/11/2019 11:59:59pm AT&T has queried for records using Eastern Time Zone. AT&T's records are stored and provided in UTC. AT&T Run Dato: Run Time: Voice Usage For: Item Conn. Date 08/15/2019 Conn. Time (UTC) Seizure Time LT Originating Terminating IIQI Number Number INSI CT Feature 95 07/09/19 14:12:48 0:16 3:07 ST (NIOP) APPLE IPHONEX 96 07/09/19 14:17:20 0:00 4:47 35940908147858 310410662903025 NO () APPLE IPHONEX 97 07/09/19 14:36:41 0:00 1:57 35940908147858 310410662903025 NO () APPLE IPHONEX 98 07/09/19 14:38:52 0:00 10:16 35940908147858 310410662903025 NO () APPLE IPHONEX 99 07/09/19 14:51:05 0:00 0:52 35940908147858 310410662903025 NO () APPLE IPHONEX 100 07/09/19 15:08:52 0:00 13:25 35940908147858 310410662903025 NO () APPLE IPHONEX 101 07/09/19 15:28:08 0:00 11:45 35940908147858 310410662903025 NO () APPLE IPHONEX 102 07/09/19 15:45:39 0:00 0:29 35940908147858 310410662903025 NO () APPLE IPHONEX 103 07/09/19 15:46:25 0:00 5:09 35940908147858 310410662903025 NO () APPLE IPHONEX 104 07/09/19 15:52:18 0:00 1:14 35940908147858 310410662903025 NO () APPLE IPHONEX 105 07/09/19 16:17:16 0:00 0:57 35940908147858 310410662903025 NT () APPLE IPHONEX 106 07/09/19 16:17:17 0:20 0:56 ST (NIOP) APPLE IPHONEX 107 07/09/19 17:06:27 0:00 1:19 35940908147858 310410662903025 NT ()