|i 1 at&t
* Please do not send Internet related requests to the Telephone Subpoena Compliance Center or Telephone related requests to the Internet Subpoena Compliance Centers. Please address subpoenas to the proper regions name, and fax to the proper regions fax number. Improperly routed requests will be forwarded but will create unnecessary delays in processing your requests.
i p h o n e Entities:
AT&T S o u t h w e s t " S B C " (Missouri, O k l a h o m a , K a n s a s , A r k a n s a s & T e x a s ) Address the subpoena to: AT&T Southwest - Custodian of Records Phone:(800)291-4952 Fax: (248)552-1764 208 S. Akard Street, 10th Floor Dallas, TX 75202 AT&T S o u t h e a s t "BellSouth" ( A l a b a m a , Mississippi, Louisiana, Kentucky, T e n n e s s e e , Georgia, Florida, South Carolina and North C a r o l i n a ) Address the subpoena t o : AT&T Southeast - Custodian of Records Phone:(800)291-4952; , Fax: (248)395-4398 208 S. Akard Street, 10th Floor Dallas, TX 75202 AT&T W e s t (California & N e v a d a ) Address the subpoena t o : AT&T Pacific Bell or Nevada Bell - Custodian of Records Phone: (800)291-4952 / Fax:(248)552-1793 208 S. Akard Street, 10th Floor Dallas, TX 75202 AT&T Midwest " S B C / A m e r i t e c h " ( I l l i n o i s , Michigan, I n d i a n a , Ohio a n d W i s c o n s i n ) Address the subpoena t o : AT&T Midwest - Custodian of Records Phone;(800)291-4952 Fax:(248)552-3201 208 S. Akard Street, 10th Floor Dallas, TX 75202 AT&T E a s t (Connecticut) Address the subpoena t o : AT&T East - Custodian of Records Phone: ,(800)291-4952 Fax: (248)552-1764 208 S. Akard Street, 10th Floor Dallas, TX 75202 AT&T Corp "Pre-Merger AT&T" ( A L L other s t a t e s ) Address the subpoena t o : AT&T Corp - Custodian of Records Phone:; (800)291-4952 Fax: (248)552-3236 ' 1
208 S. Akard Street, 10th Floor Dallas, TX 75202
A T&T Southeast
AT&T Southeast Additional Telephone Subpoena Guidelines; * Please address the Subpoena to the proper legal entity *
Legal Process Contents The body o f t h e legal process request must include the following information: 1. ) Full description of information requested 2. ) Complete Telephone number including area code 3. ) Toll, Local Calls, Subscriber, Credit, Custom 4. ) Calling Features 5. ) Time Frame of information requested
How Should Records be provided? 1. ) Court Appearance 2. ) Mailed or Fax Recommended Wording: In Lieu of A p p e a r a n c e , records m a y be mailed to: a. b. c. d. e. g.
Name of officer Full address and zip code Fax number Contact for Requesting Officer Case Number Non Disclosure Statement.
Non-Disclosure statement (Not applicable to Grand Jury Subpoenas') 1.) Customer must be notified if the Non-Disclosure statement is not in the subpoena a. E x a m p l e : You are requested not t o disclose the existence of this request. Any such disclosure could impede the criminal investigation being conducted and thereby interfere with the enforcement of the law.
Fax Transmittal Content Requirements 1. ) 2. ) 3. ) 4. )
Requesting Agency and Originating Officer's Name and Contact Number Subject of the Request Originator's Fax Number Brief Description of Communication Faxed
Recommended Wording 1. ) Subscriber / Billing / Credit Only a. Please provide billing and subscriber information for the following telephone number(s) xxx-xxx-xxxx. 2. ) Subscriber / Local / Long Distance a. Please provide Subscriber Information and Records of L o c a l * * and Long Distance Calls for telephone number(s) xxx-xxx-xxx. Include the "from and to" time frames o f t h e records requested (Example: From Dec 2001 to Feb 2002).
Note: Please do not call the Subpoena Center to check on delivery. This will not expedite processing. Your fax transmittal confirmation will serve as proof of delivery.
For specific q u e s t i o n s not a n s w e r e d , p l e a s e contact the ( a l l - r e g i o n s ) T e l e p h o n e Subpoena Compliance C e n t e r at 1 ( 8 0 0 ) 2 9 1 - 4 9 5 2 . Thank you.
AT&T Southeast AT&T w I re) ess ( C I n g ul_ac3 r e m a i n s i AT&T w i r e l e s s ( C i n g u l a r ) Subpoena Compliance Address t o : AT&T - Custodian of Records Phone: ((800)635-6840 Fax: (888)938-4715 P.O. Box 24679 West Palm Beach, FL 33416-4679
* All IP related requests m u s t contain the date, time, and time zone reference configuration of the event log in the s e a r c h criteria of the s u b p o e n a . Please s e e t h e last page of this document: for explanations and e x a m p l e s . *
AT&T I n t e r n e t (SSC Region I P s a n d D o m a i n s ) r e m a i n s : Domains: sbcglobal.net, ameritech.net, pacbell.net, nvbell.net, snet.net, swbell.net, prodigy.net, flash.net, ans.net * att.net domain could be any of the 3 ISP regions, but can be initially sent to San Antonio for compliance* Most IP addresses currently advertised as: AT&T I n t e r n e t S e r v i c e s S B C I S / AT&T I n t e r n e t S e r v i c e s AT&T I n t e r n e t S e r v i c e s S u b p o e n a Compliance Address t o : AT&T Internet Services - Custodian of Records Phone:(210)351-3216 Fax: (210)370-1073 130 E. Travis Street Room 3-P-01 San Antonio, TX 78205 J
A T & T I j i t e r n e t ( B e l l S o u t h R e g i o n I P s an„dj D o m a i n s ) r e m a l n s i Domains: BellSouth.net Most IP addresses currently advertised as: BellSouth.net I n c . AT&T I n t e r n e t S e r v i c e s S u b p o e n a Compliance Address t o : AT&T Internet Services Southeast - Custodian of Records Phone:(404)499-5211 Phone: (404)499-5217 Fax: (404)499-5222 575 Morosgo Drive Suite 5D42 Atlanta, GA 30324
AT&T I n t e r n e t f AT&T World Net Region I P s a n d D o m a i n s ) remains: Domains: worldnet.att.net, att.com, attglobal.net, attens.com, prserv.net Most IP addresses currently advertised as: AT&T World Net S e r v i c e s AT&T I n t e r n e t S e r v i c e s S u b p o e n a Compliance Address to: AT&T Internet Services - Custodian of Records Phone:(919)319-8182 Fax: (919)319-8154 1800 Perimeter Park Drive suite 100 Morrisville, NC 27560
ALL AT&T ENTITIES, REGIONS AND SERVICES EMERGENCY CONTACT: Emergency (Normal Business Hours} Law Enforcement Emergency (After Hours) Law Enforcement Hotline: 800-807^205 Option 3
AT&T Court Order Bureau (Landline and Broadband Intercepts): Court Order & GALEA requests: 1-800-813-6442
A T&T Southeast
AT&T Southeast Additional I n t e r n e t Subpoena i n f o r m a t i o n :
legal obtaining info rev 6.5.0...
To expedite your request please ensure it contains the following contact information: • Contact name, contact telephone number, fax number, and email address All • • • •
Internet related requests must include at least one or more of the following: AT&T allocated IP address with a specific date and time (including a time zone reference) AT&T Email address or BellSouth Username Full name of AT&T subscriber (common names accompanied by other identifying information) AT&T telephone number
Required information needed for all IP related requests • AH IP address related requests must include a single specific date and time (including the time zone reference). If a specific date and time (including the time zone reference) is not included we will be unable to process your request. Please reference the following example:
22.214.171.124 on January 16, 2007 at 18:35:22 EST
AT&T Southeast Internet Records Available • Customer Account Records - A c c o u n t owner, contact information, service type, service location, email addresses, etc. • IP Address Assignment Records - Dynamic IP assignment records are available for approximately 1 year (retention may vary) AT&T Southeast Internet Records Not Available • Historical Email (headers and/or content) • Internet Activity (surfing, downloading, instant messaging, etc)
A T&T Southeast
What is a time, date and time zone reference? How do I obtain them? The time, date and time zone reference is the exact second the IP record was created or generated, also commonly referred to as an "event log".
Time - Can be in 12 hour (AM/PM) or 24 hour (military) Date — Specific date o f t h e incident (event) Time Zone Reference — Time Zone (Configuration)
used by the hardware or software (server, firewall, email header, etc) that captured or created the record. It is not the local time zone where incident occurred. Time zones can be commonly used examples such as Eastern Standard Time (EST) or can be provided as a numeric figure relative to Greenwich Mean Time (GMT) such as GMT -0500.
Example of a complete event log: 126.96.36.199 on Tuesday January 16. 2007 at 18:35:22 EST (GMT -0500)
Why is a time, date, or time zone reference required? Dynamic IP Addresses The majority of AT&T customers are assigned dynamic IP addresses. Dynamic IP assignment provides individual customers a temporary IP address that changes each time they log on to AT&T. When that customer terminates that internet session, that specific IP address goes back into an IP pool and is then reassigned to completely different customer.
Static IP Addresses Static IP assignment provides individual customers an IP address that does not change each time they log on to BellSouth. However, static IP addresses are not permanently assigned to a single customer forever and may be provided to other customers as needed. An example being; a previous customer was assigned Static IP 188.8.131.52 but cancelled service several months ago. Since 184.108.40.206 is now available it can be reassigned to a completely different customer. If no time, date, or time zone reference is provided, AT&T is unable to determine which customer is your true target.
I do not have the time, date and time zone reference. What do I do? You must contact the original provider ofthe IP logs. They will have the additional information that's required. There are very, very rare instances in which an exact time, date, and time zone reference is not available.