The search warrant is the key to obtaining the cell phone records. Cell phone records, especially with cell tower information, are the property of the carrier, not the customer. Most of the time, carriers will not release the call detail records without a proper legal demand, even with the consent of the customer. In June, 2018, the US Supreme Court ruled the police need warrants to obtain location information for cell phones in the case Carpenter v. United States. As of this writing, the case is still too new to know the impact on law enforcement, but I’ve always recommended using a search warrant rather than a subpoena.

In this post we will cover the following:

• Affidavit
• Order or warrant
• AT&T
• Sprint
• T-Mobile
• Verizon

Cell phone record search warrants are like any other search warrant. They have two parts: the affidavit of probable cause, and the order or warrant.

Tie the phone number to the case. Tying the phone number to the case may be as simple as identifying the victim’s phone number. We would certainly like to know the phone numbers associated with the last calls and text messages before the victim died. Later in the investigation, we may want to get search warrants for these numbers. A Serial number search bar for Scanners with Liens or reported theft. Some functions of Snap-on Diagnostics Product Forums will not be available to you if your are.

Snap On Tool Serial Number Lookup

AFFIDAVIT

The affidavit for probable cause for a search warrant for cell phone records must have the same components of any other search warrant. It must contain the elements of a crime, show probable cause to believe this crime was committed, show the involvement of the phone number for which we are requesting information, and specifically identify all the information we would like from the carrier and why it is valuable.

Tell the story. Tell the known facts about how the crime occurred. Make sure to include the elements of the crime even if the suspect in unknown. For example, in Indiana, the elements of murder state that a person knowingly or intentionally kills another human being. If we state in the affidavit that the police arrived to find the victim suffering from a gunshot wound, from which he later died, and there was no evidence that the wound was self-inflicted, we have met the elements of murder even though we haven’t identified a suspect.

Tie the phone number to the case. Tying the phone number to the case may be as simple as identifying the victim’s phone number. We would certainly like to know the phone numbers associated with the last calls and text messages before the victim died. Later in the investigation, we may want to get search warrants for these numbers. A judge will usually find probable cause since these were the last numbers to communicate with the victim’s phone before he died.

List the location to be searched. The location to be searched is simply the carrier. It would look something like “The records of the Sprint Corporation.”

List what we would like to obtain from the carrier. The information we would like to obtain will vary depending on the phone company. For example, different companies provide cell site locations for different types of communication. Verizon provides cell sites for voice only, Sprint provides cell sites for voice and data, T-Mobile provides cell sites for voice and text, and AT&T provides cell sites for all three. It doesn’t hurt to request cell site locations for text messages from Verizon, but we won’t get it. We will go into what to ask from each carrier in detail later in this book.

Justify why we want the information. We need to tell why we think the information would be valuable to the investigation and what we hope to learn. For example, if we are requesting the records for a known suspect, the cell tower information would likely put the phone in the area of the crime scene.

ORDER OR WARRANT

The order or warrant is composed of two parts: the header and the body. The format of the warrant may vary across jurisdictions, but the header will usually include some way of identifying the case, the phone number and time-frame and time zone to be searched, and the location for the search. The body will include information specific to the carriers.

The header format may vary by jurisdiction, but it should include the following information. There should be some way of identifying the case. We can use the name of the user of the phone, or “Unknown,” if we don’t know the user. State the phone number. Identify the location to be searched, which will usually read, “Located at,” and the name of the phone company. Note the timeframe for the search and the time zone. The timezone is important because AT&T and T-Mobile provide the times in their records in Universal Time Coordinated (UTC). UTC is either four or five hours ahead of Eastern time, depending on daylight savings time. If we mention only the dates and don’t mention the time zone, we may lose four or five hours at the end of our records because the carrier would provide the dates based on UTC. We may lose even more records for Pacific time which is seven or eight hours behind UTC.

The body should include the language “Having found probable cause for the issuance of this search warrant.” Federal criminal code 18 USC § 2703 requires the carriers to provide the phone records upon proper legal demand showing “specific and articulable facts.” Any search warrant will contain probable cause, which is a higher threshold than specific and articulable facts, but the phone companies won’t necessarily receive a copy of the probable cause affidavit. The attorneys for the phone companies may have instructed the analysts not to release the records without probable cause, or at least proof of an affidavit supporting the warrant. Some phone companies release information with subpoenas, and subpoenas don’t always require a supporting affidavit. Including the language “Having found probable cause for the issuance of this search warrant” will make it clear to the phone companies that the judge has seen the specific and articulable facts supporting the warrant. I had a few carriers refuse my search warrants until I started using this language.

Make sure that the requested information is the same as the information listed in the affidavit. The affidavit supports and justifies the warrant. We can’t put information in the warrant unless we first list and justify it in the affidavit.

Request that the carrier preserve the records. Our ultimate goal is to present this information in court if the case makes it to trial. Most jurisdictions will require certification of the records. We may receive the records in digital format through email or download. Receiving the records this way is fine for the investigation, but for the courts to admit the records in some jurisdictions, we need a CD containing the records signed by the analyst along with an affidavit of custodian of records. A detective managing many cases with phone records may not have time to chase down the certification of every set of records. Only a small percentage of records will ever make it into court, and at the time of the warrant, it is impossible to predict whether or not the records will be valuable. Obtaining the certification may fall upon the prosecutor or district attorney as he or she prepares for trial. Including the request for preservation of the records in the warrant will make sure the records are available for reproduction and certification in preparation for trial.

Snap-on Serial Number Lookup

Request the records in digital format. Carriers tend to provide records in reams of printed paper if we don’t specifically request the records in digital format. Carriers tend to send paper records if we are asking for a short time period where the printed records are small enough to put in an envelope. Digital records are much easier and faster to analyze. We could analyze the printed records, but it would take a great deal of time, with a lot of highlighting, notes, and collation.

Each company requires slightly different language. We’ll go through the language for the four major phone companies with national coverage: AT&T, Sprint, T-Mobile, and Verizon. Most phones run on one of these four networks. For example, Boost and Virgin run on the Sprint network, Cricket runs on AT&T, and TracFone uses different networks in different areas. These smaller networks are Mobile Virtual Network Operators (MVNO). The communication records reside in the records of the major carriers while the subscriber and account information resides in the records of the MVNO. In the case when we know the phone is an MVNO phone, we should mention both the MVNO and the major carrier in the warrant. Most of the time, however, our initial search of the phone number will reveal only the major carrier, and the records we receive from the major carrier will instruct us to go to the MVNO for the subscriber information. That would require a second warrant.

There are also smaller providers that own cell sites. An example of this is Bluegrass Wireless, which owns cell sites in the Bowling Green, KY area. When a Bluegrass Wireless phone roams away from its network, it usually uses the Verizon or Sprint networks.

AT&T

AT&T includes Cricket. Address warrants for Cricket phones to AT&T Wireless. AT&T will include cell site information with a subpoena, but I recommend a search warrant. Search warrant returns tend to be quite a bit faster than subpoenas.

Here’s the language preferred for AT&T search warrants:

• Subscriber information
  • Name
  • Address
  • Identifying information
    • Date of birth
    • Driver’s license number
    • Social security number
    • Contact information
      • Email address
      • Contact phone number
    • Billing and credit card information
      • Method and source of payment
        • Credit card numbers
        • Electronic funds transfers
        • Locations of cash payments
        • Any credit report run by the provider
      • Service information
        • Purchase and activation location
        • Types of service subscribed
        • Additional phone numbers on the same account
        • Make, model, and serial numbers (ESN, IMEI, MEID) of the phone
      • Call detail records
        • Cellular voice calls
        • SMS/MMS messages
        • Data communication
        • Tower locations (LAC/CID) and azimuth for the sectors
      • AT&T Cloud
        • SMS, MMS
        • Email communications
      • Location of the phone
        • Network Event Location System – NELOS
        • Mobile Locator Tool
      • Voicemail messages including content
      • A list of all AT&T cell towers with latitude, longitude, address, and, sector directions
      • A detailed definitions page
      • Preserve the records
      • Provide results in the appropriate time zone
      • Provide the records in digital format

SPRINT

Sprint includes both Boost and Virgin. Address search warrants for Boost or Virgin records to the Sprint Corporation. Sprint will honor only a search warrant or court order for cell site locations.

Here’s the language for Sprint search warrants:

• Subscriber information (Expanded)
  • Name
  • Address
  • Identifying information
    • Date of birth
    • Driver’s license number
    • Social Security number
  • Subscriber information
    • Contact information
      • Email address
      • Contact phone numbers
        • Might be different from the cell phone number
      • Billing and credit information (Payment Information)
        • Method and source of payment
          • Credit card numbers
          • Electronic funds transfers
          • Locations of cash payments
        • Credit information
          • Any credit report run by the provider
        • Service information
          • Purchase and activation location
          • Types of service
          • Additional phone numbers on the account
          • Make, model, serial number (ESN, IMEI, MEID)
        • Call Detail Records
          • Cellular calls
          • SMS/MMS messages
          • Data communications (IPDR w/ cell site, web site address report)
          • Tower locations (NEID, cell number, sector number, eNode) and azimuth for sectors
        • Voice mail messages (Stored Voice Mail Reproduction)
        • PCMD (Per Call Measurement Data)
        • A list of all Sprint cell towers with latitude, longitude, address, and sector directions
        • Preserve the records
        • Provide in digital format

T-MOBILE

T-Mobile includes Metro PCS. Address search warrants for Metro PCS records to Metro PCS/T-Mobile USA. T-Mobile will honor only search warrants or court orders for cell site information.

Here’s the language for T-Mobile search warrants:

• Subscriber information
  • Name
  • Address
  • Identifying information
    • Date of birth
    • Driver’s license number
    • Social Security number
  • Contact information
    • Email address
    • Contact phone numbers
  • Billing and credit information
    • Method and source of payment
      • Credit card numbers
      • Electronic funds transfers
      • Locations of cash payments
    • Any credit report run by the provider
  • Service information
    • Purchase and activation location
    • Types of service
    • Additional phone numbers on account
    • Make, model, and serial numbers (ESN, IMEI, MEID)
  • Call detail records
    • Cellular calls
    • SMS/MMS messages
    • Data communications
    • Tower locations (LAC/CID, eNode) and azimuth for the sectors
  • A list of all T-Mobile cell towers with latitude, longitude, address, and sector directions
  • Voicemail messages including content
  • A detailed definitions page
  • Preserve the records
  • Provide records in proper time zone
  • Digital format

VERIZON

Verizon will honor a subpoena for cell site information, but I recommend a search warrant or court order as it will return faster, and there is less chance Verizon will challenge it.

Here is the language for Verizon warrants:

• Subscriber information
  • Name
  • Address
  • Identifying information
    • Date of birth
    • Driver’s license number
    • Social Security number
  • Contact information
    • Email address
    • Contact phone numbers
  • Billing and credit information
    • Method and source of payment information
      • Credit card numbers
      • Electronic funds transfers
      • Locations of cash payments
    • Any credit report run by the provider
    • Payment activity
      • Payment history
      • Auto bill copy
    • Service information
      • Purchase and activation location
      • Types of service
      • Additional phone numbers on account
      • Make, model and serial numbers (ESN, IMEI, MEID)
    • Call detail records
      • Cellular calls (cell-site incoming, outgoing)
      • SMS/MMS messages (historical MMS detail, text message detail, auto text message content, auto picture content, picture content, auto picture detail, picture message detail)
      • Data communications (IP destination, IP session)
      • Tower locations (Switch/Element, cell numbers, sector numbers) and azimuth for the sectors
    • Any data in the Verizon cloud services
      • SMS/MMS
      • Email communications
      • As with the AT&T cloud, I’ve had limited success as most customers use iCloud or Google Drive
    • RTT (Round Trip Time) to include reliability factors
    • Voicemail messages including content (voicemail password reset)
    • A list of all Verizon cell towers with latitude, longitude, address, and sector directions
    • A detailed definitions page
    • Preserve the records
    • Provide the records in digital format

Snap On Serial Number Lookup

Notice the language for all the warrants is similar, but each company requires some unique language. Using that unique language for each company will make sure we get the best information.