EFTA00133349.pdf

90A-NY-3151227-GJ Serial 1 FD-1057 (Rcv. 5-8-I0) UNCLASSIFIED FEDERAL BUREAU OF INVESTIGATION Electronic Communication Title: (U) Subfile Opening Document Date: 12/03/2019 From: NEW YORK NY-C19 Contact: Approved By: A/SSA Drafted By: Case ID #: 90A-NY-3151227-GJ (U) UNSUB(S); JEFFREY EPSTEIN - VICTIM; DEATH INVESTIGATION Synopsis: (U) Grand Jury Subfile Opening Document Details: Writer requests the opening of a Grand Jury Subfile for Grand Jury information received during this investigation. •• UNCLASSIFIED EFTA00133349  90A-NY-3151227-GJ Serial 2 •1 of 1. FD-302 (Rev. 5-8-10) FEDERAL BUREAU OF INVESTIGATION Date of entry 12/06/2039 Pursuant to a Federal Grand Jury subpoena served by the Southern District of New York, 4Chan provided the attached response, dated August 14, 2019. Investigation on 08 / 1 4/2019 at New York, New York, United States (Email) Fik# 90A-NY-3151227-GJ Date drafted 12/06/2019 by This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents arc not to be distributed outside your agency. EFTA00133350 Report #2093 enerated on 2019-08-14 10:04:26 EDT. Requested b Case ID: 2019R01059. Records provided pursuant to a subpoena. All records made and kept in the regular course of business. This report was generated using the following inputs: Post Numbers: /po1/222520442 /pol/222518349 /po1/222520257 /poU222518664 Associated IPs (2): Post times (4): /po1/222520442 was posted by on 08/10/2019 08:47:56 EDT. /po1/222518349 was posted by on 08/10/2019 08:16:36 EDT. /pol/222520257 was posted by on 08/10/2019 08:44:55 EDT. /po1/222518664 was posted by on 08/10/2019 08:21:58 EDT. Deletion records (1): Deletion #30169564 Cleared: this entry doesn't correspond to a deletion. Cleared on: 08/10/2019 09:46:22 EDT Board: /pol/ Post No.: 222520257 Reply to thread No.: 222518349 Name: Anonymous Subject: Comment: Not saying anything after this pls do not try to dox me but last night after 0415 count they took him medical in a wheelchair front cuffed but not 1 triage nurse says they spoke to him. Next thing we know a trip van shows up? We do not do releases on the weekends unless a judge orders it. Next thing we know, he's put in a single man cell and hangs himself? Heres the thing, the trip van did NOT sign in and we did not record the plate number and a guy in a green dress military outfit was in the back of the van according to the tower guy who let him thru the gate. You guys i am shaking right now but i think they switched him out. EFTA00133351 EFTA00133352 From: 4rhan LEO SUDDOrt To: Ce: Subject: 4chan Subpoena Response (Report #2093) Date: Wednesday, August 19, 2019 10:08:38 AM Attachments: 4rhan Report 2093 (Case ID 2019R010591 pd AngDOLIKL Dear Mr.IM In reference to your subpoena dated 08/14/2019 (Case ID: 2019R01059), please find attached the requested records as file: "4chan Report 2093 (Case ID: 2019R0 I 059).txt" Please be advised that the Custodian of Records for 4chan Community Support LLC is not a US citizen. Is there an alternate form available for certifying records that does not have this requirement, or failing that, can the declaration requirement be waived? Please let us know if you have any additional questions or require further assistance. Regards, 4chan LEO Support EFTA00133353  90A-NY-3151227-GJ Serial 3 •1 of 1. FD-302 (Rev. 5-8-10) FEDERAL BUREAU OF INVESTIGATION Date of entry 12/06/2039 Pursuant to a Federal Grand Jury subpoena served by the Southern District of New York, Apple provided the attached response, dated September 19, 2019. Investigation on 09/19/2019 at New York, New York, United States (Email) Fik# 90A-NY-3151227-GJ Date drafted 12/06/2019 by This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents arc not to be distributed outside your agency. EFTA00133354 From: To: Subject: Apple Response; Case Number: 2019R01059; (19271022) Date: Thursday, September 19, 2019 5:12:17 PM Dear AUSA Pursuant to your legal request, Apple has provided you with a file containing customer personally identifying information (PII). As previously advised, for data security and customer confidentiality purposes, Apple's production of data containing customer Pll is encrypted using GPG encryption software. Law enforcement officers who receive Apple data containing customer Pll must be able to manage production files encrypted with the GPG format without technical assistance from Apple. Technical information relating to GPG encryption software is available at: kluy/AvvAv gng4win orghlorienigng4win-rompentlium Wml. Information in relation to installing GPG on Windows OS is included in this link under the heading 'Installing Gpg4win'. If you require further technical assistance/information, please consult your agency's Information Technology Department. The password for the encrypted file(s): GPG Installation & Decryption Instructions When decrypting the gpg file be sure that you have read write permissions on the drive that you are copying to and that the drive is formatted with NTFS (there are limitations with FAT32 file systems where long file paths are not supported, which will cause expansion of some productions to fail to properly unzip). Access the GPG encrypted file by using the following steps (please note that this should not be considered a comprehensive description of the process as the user rights on the machine may not permit certain steps outlined herein). For Windows: I. Install GPG for Windows (bup•//www gng4win ore) There is a light version of gpg that doesn't include Kleopatra that you can install with this link: Wiwi/filet crig4win orgfrog4win-light-2 I 0 eve 2. Copy the file to a drive that the user can write to 3. If you restart your computer you should be able to double click on the file and it will prompt you for the password, if not: open a command prompt (run cmd.exe) 4. Type: gpg 5. Press the space bar button 6. Drag the file into the command window If done properly your text should look similar to the following: gpg c:/Documents and Settings/myuser/Desktop/Production16000017.zip.gpg 7. Press the "Enter" button 8. Type the password Mac: I. Install MacGPG (Dapyllengtools org) amazonawssonkortools/GPG%20Suite%20- EFTA00133355 %202013 OR 06 (brig] 2. Copy the file to a drive that the user can write to 3. If you restart your computer you should be able to double click on the file and it will prompt you for the password, if not open a Terminal window (/Applicationalltilitiesiferminal.app) 4. Type: gpg -o 5. Press the space bar button 6. Drag the file into the command window 7. Delete ".gpg" from the text string 8. Press the space bar button 9. Type: -d 10. Press the space bar button 11. Drag the file into the command window If done properly your text should look similar to the following: gpg -o /Users/myuseriDesktop/Production16000017.zip -d /Users/myuser/Desktop/Production16000017.zip.gpg 12. Press the "Enter" button 13. Type the password This will decrypt the file to the same location as the file. The file is zipped so you will need to unzip it and the files will be available for viewing. This transmission may contain confidential information intended only for the person(s) named above. Any other distribution, re-transmission, copying or disclosure is strictly prohibited. If you have received this transmission in error, please notify immediately and delete this file/message from your system. EFTA00133356 From: To: Subject: Apple Response; Case Number: 2019R01059; (19271022) Date: Thursday, September 19, 2019 5:11:01 PM Attachments: 12271022EugluclanZlI2M12 Via Email Delivery AUSA United States Attorney's Office One St. Andrew's Plaza New York, NY Dear AUSA Apple Inc. ("Apple") is providing APL000001 through APL000004 in response to the legal request received by Apple on 2019-08-13. These files are true copies of the data Apple has located based on a reasonable search of the last 12 months of its data using the criteria and information provided in the legal request. Said files were prepared by Apple personnel in the ordinary course of business. For data security and customer confidentiality purposes, Apple's production of data containing customer personally identifying information is encrypted using GPG encryption software. Law enforcement officers who receive Apple data must be able to manage production files encrypted with the GPG format without technical assistance from Apple. Technical information relating to GPG encryption software is available at: bttpi/www gpg4win org/doc/en/gRg4win-compendium hull'. Information in relation to installing GPG on Windows OS is included in this link under the heading `Installing Gpg4win'. If you require further technical assistance/information, please consult your agency's Information Technology Department. The password for the GPG file will be provided in a separate email. Please note, any .xls files will need to be opened in "Read Only" mode. You may note entries from IP addresses beginning with "17." and/or "10." for any available connection logs provided. IP addresses beginning with "17." are assigned to Apple and their occurrence in these logs is reflective of activity on Apple internal servers and not an indication of any user connections. IP addresses beginning with "10." in relation to Find My iPhone ("FMIP") logs are also reflective of activity on Apple internal servers and not an indication of any user connections. All evidence preservation pursuant to the herein request response is the responsibility of the requesting law enforcement agency. Sincerely, Ian Apple Privacy & Law Enforcement Compliance EFTA00133357 bttp://www apple com/privacy/ Enclosures For more information about Apple's Legal Process Guidelines for U.S. Law Enforcement, please visit: lutp.//vvv,rw apple.com/legallprivacy/law-enforcement-guidelines-uc pdf ****************************************************************************** This transmission may contain confidential information intended only for the person(s) named above. Any other distribution, re-transmission, copying or disclosure is strictly prohibited. If you have received this transmission in error, please notify immediately and delete this file/message from your system. EFTA00133358  90A-NY-3151227-GJ Serial 4 •1 of 1. FD-302 (Rev. 5-8-10) FEDERAL BUREAU OF INVESTIGATION Date of entry 12/06/2039 Pursuant to a Federal Grand Jury subpoena served by the Southern District of New York, AT&T provided the attached response, dated August 15, 2019. Investigation on 08 / 1 5/2019 at New York, New York, United States (, Other (Unknown)) Fact, 90A-NY-3151227-GJ Date drafted 12/06/2019 by This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents arc not to be distributed outside your agency. EFTA00133359  RESPONSE COVER SHEET AT&T 11760 US HWY 1, SUITE 300 NORTH PALM BEACH FL 33408 Phoneme Facsimile To: AUSA File Code: 2790840 AUSA NEW YORK 10007 I ST ANDREWS PLAZA NEW YORK NY 10007 From: DAD Phone Number: Request Dated: 8!I112019 Number of Page. Fax Number: 1 Received On: 8/15/2019 Date: 8/15/2019 Case Number: Case Name: After conducting a thorough search of all identifiers listed in the legal demand. all :nail:dile information responsive to this demand is enclosed. CONFIDEVEIALITY NOTICE This cover sheet, and any document which may accompany it, contains information from the Global Legal Ikmand Center which is intended for use only by the individual to whom it is addressed, and which may contain information that is privileged, confidential and/or otherwise exempt from disclosure under applicable law. If the reader of this message is not the intended incipient or the person responsible for delivering this message to the intended recipient. any review, disclosure. dissemination, distribution. copying or other use of this message or its substance is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone to arrange for the return of this communication to us at our expense. Thank you. EFTA00133360  Declaration of Custodian of Records Pursuant to 28 U.S.C. § 1746. I, the undersigned. hereby declare: My name is Daniel Dixon maw of declarant) I am a United States citizen and I am over eighteen years of age. I am the custodian of records of the business named below, or I am otherwise qualified as a result of my position with the business named below to make this declaration. I • of a Grand Jur• Subpoena, dated August II, 2019. and signed by Assistant United States Attorney requesting specified records of the business named below. Pursuant to Rules 902(11) and 803(6) of le .e era ules of Evidence. I hereby certify that the records provided herewith and in response to the Subpoena: (I) were made at or near the time of the occurrence of the matters set forth in the records, by. or from information transmitted bs. a person with knowledge of those matters: (2) were kept in the course of regularly conducted business activity: and (3) were made by the regularly conducted business activity as a regular practice. I declare under penalty of perjury that the foregoing is true and correct. Executed on 8/15/2019 (dale) 'Coon. (sign:gun: ordeclarant) Daniel Dixon Compliance Analyst (mane and Itik of*damn° AT&T (03111C of him,le ) 11760 US Highway One STE 300 ihnanc., ,,ddiw) North Palm Beach, FL 33408 Definitions or terms used above: As defined in Fed. R. Evid. 803(6). "record" includes a memorandum, report. record, or data compilation, in any form. °facts. events. conditions. opinions, or diagnoses. The term "business" as used in Fed. R. Evid. 803(6) and the above declaration includes business, institution, association. profession, occupation. and calling of every kind. whether or not conducted for profit. EFTA00133361 2790840 DAD AT&T 11760 US HWY 1. SUITE 300 NORTH PALM BEACH FL 33408 (Fax) CERTIFICATE OF AUTHENTICITY OF DOMESTIC RECORDS PURSUANT TO FEDERAL RULES OF EVIDENCE 902(11) AND 992(13) I, Daniel Dixon, attest, under penalties of perjury by the laws of the United States of America pursuant to 28 U.S.C. § 1746, that the information contained in this certification is true and correct. I am employed by AT&T, and my title is Legal Compliance Analyst. I am qualified to authenticate the records attached hereto because I am familiar with how the records were created, managed, stored, and retrieved. I state that the records attached hereto are true duplicates of the original records in the custody of AT&T. I further state that: a. All records attached to this certificate were made at or near the time of the occurrence of the matter set forth by, or from information transmitted by, a person with knowledge of those matters, they were kept in the ordinary course of the regularly conducted business activity of AT&T , and they were made by AT&T as a regular practice; and b. Such records were generated by AT&T's electronic process or system that produces an accurate result, to wit: I. The records were copied from electronic device(s), storage medium(s), or file(s) in the custody of AT&T in a manner to ensure that they are true duplicates of the original records; and 2. The process or system is regularly verified by AT&T, and at all times pertinent to the records certified here the process and system functioned properly and normally. I further state that this certification is intended to satisfy Rules 902(11) and 902(13) of the Federal Rules of Evidence. August 15, 2019 Date Signature EFTA00133362 Grand Jury Subpoena PtiteboStzxtespistrict Court SOUTHERN DISTRICT OF NEW YORK TO: National Compliance Center AT&T Corporation 11760 U.S. Highway 1 North Palm Beach, FL 33408 GREETINGS: WE COMMAND YOU that all and singular business and excuses being laid aside, you appear and attend before the GRAND JURY of the people of the United States for the Southern District of New York, at the United States Courthouse, 40 Foley Square, Room 220, in the Borough of Manhattan, City of New York, New York, in the Southern District of New York, at the following date, time and place: Appearance Date: August 13, 2019 Appearance Time: 10:00 a.m. to testify and give evidence in regard to an alleged violation of : 18 U.S.C. §§ 371, 1001, 1519 and not to depart the Grand Jury without leave thereof, or of the United States Attorney, and that you bring with you and produce at the above time and place the following: Please see attached rider. Personal appearance is not uired if the requested records are (1) produced on or before the return date to Assistant U.S. Attorney of the United States Attorney's Office, I St. Andrew's Plaza, New York, NY 10007. Tel: , and (2) accompanied by an executed copy of the attached Declaration of Custodian of Records. RefNo. JE08112019. Failure to attend and produce any items hereby demanded will constitute contempt of court and will subject you to civil sanctions and criminal penalties, in addition to other penalties of the Law. DATED: New York, New York August 11, 2019 640 Cfa-SS, Fbes-v% Ltlfir GEOFFREY S. BERMAN At" UnitedStates Attorneyfor the Southern District ofNew York Assistant United States Attorney One St. Andrew's Plaza New York, New York 10007 Telephone: Email: rev. 02.01.12 EFTA00133363  RIDER (Grand Jury Subpoena to AT&T, dated August 11, 2019) Ref. No. JE08112019 REOUEST: For the following telephone numbers: • Please provide any and all documents, to include, but not limited to those identified below, for the period July 6, 2019 until the present: I. All subscriber identifying information, including, but not limited to, name(s), address(es), date of birth, social security number(s), email addresses, and secondary telephone number; 2. All billing identifying information, including, but not limited to, name(s), address(es), date of birth, social security number(s), email addresses, secondary telephone number, and method of payment; 3. Physical location or intemet protocol ("IP") address where the account was registered; 4. Phone type (e.g. cellular, payphone, calling card, land line); 5. Electronic Serial Number ("ESN"), International Mobile Equipment Identity rimEn, International Mobile Subscriber Identity ("IMSI"), Media Access Control ("MAC") address, SIM number, ICCID number, UDID number, and/or device serial number; 6. All call detail information, including, but not limited to, local, long distance and toll records, including incoming and outgoing calls; 7. Toll information for text messages (timing and numbers associated with incoming and outgoing text messages); 8. All other telephone numbers registered to or listed on the same account; 9. Length of service, including the date the account was established and the date the account was disconnected, if applicable. In lieu of an appearance you may comply with this subpoena by providing the requested information, alon with a business records certification pursuant to Fed. R. Evid. 803(6) to Assistant U.S. Attorney of the United States Attorne 's Office, 1 St. Andrew's Plaza, New York, NY 10007. Tel: , email: EFTA00133364  RESPONSE COVER SHEET AT&T 11760 US HWY 1, SUITE 300 NORTH PALM BEACH FL 33408 Phoneme Facsimile To: AUSA File Code: 2790842 AUSA NEW YORK 10007 I ST ANDREWS PLAZA NEW YORK NY 10007 From: DAD Phone Number: Request Dated: 8/1412019 Number of Pages: Fax Number: I Received On: 8/142019 Date: 8/1512019 Case Number: Case Name: AT&T is unable to provide any information in response to the Legal Demand because AT&T does not maintain records in the normal course of business that associate individual accounts or devices with wireless dynamic IP addresses. The IP address(es) listed in the Legal Demand is/are allocated to AT&T Mobility LLC, AT&T Global Network Services, and/or Service Provider Corporation in conjunction with AT&T Wireless. These blocks of IP addresses are used by AT&T Wireless for internet access and web based applications for wireless devices (such as web enabled cell phones and air cards). CONFIDEVEIALITY NOTICE This cover sheet, and any document which may accompany it, contains information from the Global Legal Ikmand Center which is intended for use only by the individual to whom it is addressed, and which may contain information that is privileged, confidential and/or otherwise exempt from disclosure under applicable law. If the reader of this message is not the intended incipient or the person responsible for delivering this message to the intended recipient. any review, disclosure. dissemination, distribution. copying or other use of this message or its substance is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone to arrange for the return of this communication to us at our expense. Thank you. EFTA00133365 2790842 DAD AT&T 11760 US HWY I, SUITE 300 NORTH PALM BEACH FL 33408 (Fax) DECLARATION OF AUTHENTICITY OF AT&T RECORDS STATE OF FLORIDA COUNTY OF PALM BEACH My name is Daniel Dixon. I am over the age of 18 and qualified to make this affidavit. I am employed by AT&T as a Compliance Security Analyst and also serve as the Custodian of Records for AT&T. I have been employed by AT&T since 10/12/2009. After a thorough search of the documents relied on in the course of my duties as Custodian of Records and Compliance Security Analyst, I was unable to find any information responsive to your request regarding: Pursuant to 28 U.S.C. Sec.1746, I declare, under penalty of perjury, that the foregoing is true and correct. Executed on August 15, 2019 J nn IX:ren Compliance Security Analyst EFTA00133366 Grand Jury Subpoena Prato,States pistrirt Trani SOUTHERN DISTRICT OF NEW YORK TO: National Compliance Center AT&T Corporation 11760 U.S. Highway 1 North Palm Beach, FL 33408 GREETINGS: WE COMMAND YOU that all and singular business and excuses being laid aside, you appear and attend before the GRAND JURY of the people of the United States for the Southern District of New York, at the United States Courthouse, 40 Foley Square, Room 220, in the Borough of Manhattan, City of New York, New York, in the Southern District of New York, at the following date, time and place: Appearance Date: August 21, 2019 Appearance Time: 10:00 a.m. to testify and give evidence in regard to an alleged violation of : 18 U.S.C. §§ 371, 1001, 1519, 2 and not to depart the Grand Jury without leave thereof, or of the United States Attorney, and that you bring with you and produce at the above time and place the following: Please see attached rider. Personal appeara required if the requested records are (1) produced on or before the return date to Assistant U.S. Attorney of the United States Attorne s Office, 1 St. Andrew's Plaza, New York, NY 10007. Tel: . email: and (2) accompanied by an executed copy of the attached Declaration of Custodian of Records. RefNo. 2019R01059. Failure to attend and produce any items hereby demanded will constitute contempt of court and will subject you to civil sanctions and criminal penalties, in addition to other penalties of the Law. DATED: New York, New York August 14, 2019 6e0C6s-ss• Ltlfir GEOFFREY S. BERMAN At" UnitedStates Attorneyfor the Southern District ofNew York Assistant United States Attorney One St. Andrew's Plaza New York, New York 10007 Telephone: Email: rev. 02.01.12 EFTA00133367  RIDER (Grand Jury Subpoena to AT&T, dated August 14, 2019) Ref. No. 2019R01059 REOUEST: For the Internet Protocol ("IP") addresses listed below at the following dates and times, please provide the following information: on 08/10/2019 08:47:56 EDT on 08/10/2019 08:16:36 EDT on 08/10/2019 08:21:58 EDT I. All subscriber identifying information including, but not limited to: a. Name; b. User name or other subscriber identity or number; c. Address; d. Primary and alternate telephone numbers; e. Primary and alternate email addresses; f. Date of birth; g. Social Security number; h. Any temporarily assigned network address; i. MAC address; and j. Browser and operating system information. 2. Records of session times and durations and any IP addresses used by the subscriber at the beginning, end, and anytime during these sessions. 3. Length of service, including start date and types of service utilized. 4. Means and source of payment for services (including any credit card or bank account numbers). 5. Subscriber's call detail information for the period from January 1, 2014 to the present. 6. Account notes and logs, including any customer service communications or other correspondence with the subscriber. 7. Investigative files or user complaints concerning the subscriber. In lieu of an appearance you may comply with this subpoena by providing the requested information, alon with a business records certification pursuant to Fed. R. Evid. 803(6) to Assistant U.S. Attorney of the United States Attorne 's Office, I St. Andrew's Plaza, New York, NY 10007. Tel: , email: EFTA00133368  AT&T Records key AT&T searches all available databases to ensure all responsive records are provided. Multiple reports may be provided in response to your request. Note: For each record described in this key, all times are stored and provided in UTC AT&T Mobility Voice Descriptions Column/Field Name Description Item Row Number Conn.Date Connection Date. The date of the call. Conn.Time(UTC) Connection Time. The time the call was connected. Time is in UTC. Times is expressed in military time as HH:MM:SS. Conn Date Time Connection date and time- Date and Time the call was connected. Displayed as one column on the Landline Call Detail Records. SeizureTime The time it takes to connect the call measured from the moment the caller presses "Send" to when the call is connected. ET (Elapsed Time) Duration of the transaction. Duration is in NIM:SS Originating The phone number the call/text originated from. For data records, this does not necessarily mean the number originated the data Number transaction. The network constantly communicates with intemet enabled devices and the data records do not indicate if a customer initiated a data transaction. Terminating Number The number the transaction terminated to. DIALED (D) The number that the originating party dialed. Appears in subsequent line of the same row in the Originating Number column. (Note: only appears if the Tennis:ming number Offersfrom the Dialed number) A = *, B = # FORWARDED (F) The number the terminated number forwarded the call to. Appears in subsequent line of the same row in the Originating Number column. TRANSLATED (T) Indicates if a number was translated to a different number. For example, if the number called is 911, then that gets translated to a ten-digit number for routing to a 911 dispatch center. The (T) indicates the number the translation was from, not the number translated to. ORIGINAL Denotes the number that originated the call before call forwarding was invoked. ORIGINATING (00) Appears in subsequent line of the same row in the Originating Number column. ill Represents no record found or available. AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Pagel. of 9 EFTA00133369 IMEI A 15-digit number that uniquely identifies an individual wireless device International Mobile Equipment Identifier Only the IMEI of the number requested is displayed. IMSI The IMSI is a globally-unique code number that identifies a GSM subscriber to the network. The IMSI is linked to your account International Mobile information with the carrier. The IMSI resides in the SIM card which can be moved from one GSM phone to another. Subscriber Identity Only the IMSI of the number requested in the legal demand is displayed. CT (Call Denotes if the leg of a call is an originating leg or terminating leg. Type) Mobile Originating (MO) Mobile Terminating (MT) Service Originating (SO) Service Terminating (ST) A leg of a call represents each time the call is processed through a network switch. Calls may go through several switches in AT&Ts network in order to reach the intended party. A service record is generated when the network generates a leg of a call to reach a service on the network. For example, a leg connecting to the voicemail platform denotes a service invoked on the network and may show up as a service record. Feature This column represents the type of call that occurred as recorded by our network and used for purposes of processing a call on AT&Ts network. These are not necessarily indicative of features on a customer's account or the types of services subscribed too. Make The Make of the handset used in the transaction. Model The Model of the handset used in the transaction. Cell Location Identifiers: 3G Network cell Site= LAC/CID 4G Network Cell Site= ECGI Examples: 3G Network Cell Site. [27077/11621:-80.05629:26.74779:350:90.0] LAC/CID L0NG:LAT Sector:Beamwidth AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 2 of 9 EFTA00133370  4G Network Cell Site M3151247:520122: -96.912452:33.013937:358:4.0 ECGI:ENB-ID LONG:LAT Sector:Beamwidth Definitions: LAC-Location Area Code. This number identifies the specific region a cell tower is located in. The number is used internally in AT&T and for network purposes. CID-Cell Identity. This number identifies the location of the tower within a specified region. The number is used internally in AT&T and for network purposes. ECGI-Enhanced cell global identity. A nine digit number that indicates the location of a cell tower when 4G technology is being used. The number is used internally in AT&T and for network purposes. ENB-ID- Evolved Node B (eNodeB) Hardware connected to the AT&T mobility network that communicates directly with a mobile device. This number is used internally to AT&T to identify a specific antenna on a tower when 4G technology is used. Longitude - A geographic coordinate that specifies an East-West Position of a point on the earth's surface. The Latitude represented is of the cell tower. Latitude - A geographic coordinate that specifies a North-South Position of a point on the earth's surface. The Longitude represented is of the cell tower. Sector-A number out of 360 degrees that indicates the side of the cell site antenna used in processing the call. Beamwidth-A number out of the 360 degrees that specifies the angle of coverage of the RE signal coming from a particular cell site sector. AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 3 of 9 EFTA00133371  Feature Definitions for Mobility Voice Report Features represents the type of call that occurred as recorded by our network and used for purposes of processing a call on AT&Ts network. These are not necessarily indicative of features on a customer's account or the types of services subscribed to. Feature Acronym Feature Definition 'ADD' Unstructured Supplementary Service Data 'CBI' Barring of All Incoming Calls 'CBIOP' Incoming Operator Determined Barring i 'CBIP' Barring of All Incoming Calls Roaming Outside Public Land Mobile Network 'CBIUK' Barring of Incoming Calls 'CBO' Barring of All Outgoing Calls 'CBOI' Barring of All Outgoing Intl Calls 'CROW' Barring of All Outgoing Intl Calls Except to Public Land Mobile Network 'CBOOP' Outgoing Operator Determined Barring 'CBOUK' Barring of Outgoing Calls 'CBUK' All Barring 'CFB' Call Forwarding Subscriber Busy 'CFC' Call Forwarding All Conditional i 'CFNA' Call Forwarding No Reply 'CFNR' Call Forwarding Not Reachable I 'CFO' Call Forwarding in Gateway (Unknown) 'CFU' Call Forwarding Unconditional 'CFUK' All Forwarding 'CGC' a Advice of Charge Charging 'CGI' Advice of Charge Information 'CIAC' Account Code Service 'CICUG' Closed user Groups Service 'CIPCI' Proprietary Customer Information a 'CMH' Call Hold AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page 4 of 9 EFTA00133372 'CMPRL' Proprietary Release Link Trunk Service 'CNIPVAII Proprietary Voice Mail Call Drophack 'CMR' Call Re-origination 'CMRC' Call Re-Origination By Cause 'CMW' Call Waiting 'ECT' Explicit Call Transfer 'GREW Enhanced Multi 'INIOR' Invoke Calling Number Identity Restriction 'MPS' Multiparty Services 'NIND' Proprietary Calling Name Delivery 'NIOP' Calling Number Identity Presentation INIOR' Calling Number Identity Restriction 'NITP' Connected Line Identity Presentation 'NITR' Connected Line Identity Restriction 'NSDA' Directory Assistance Service Call 'OACR' Anonymous Call Rejection 'OEXT' Extension Service 'ONICT' Malicious Call Trace 'O11ISC MSC 'OOW Optimal Routing (of Late Call Forwarding) 'SUBCMH' Call hold Call hold, Invoke, Invoked by Subscriber V2G Volte to 3G. It indicates the call was handed off from one Volte (a VOID call) to the 3G network (circuit switched call) VM Voicemail involved in transaction VCORR 4G Cell site was correlated with additional database FCID "flexible Caller ID" This indicates a secondary device, such as a watch or tablet, originated the call. The number indicated as the Original Originating (00) is the native number belonging to the secondary device that originated the call. AT&T Proprietary The information contained here is for use by authorized persons only and is not for general distribution. Page S of 9 EFTA00133373  Feature Definitions for Mobility Voice and Mobility SMS Report Features represents the type of Call/SMS that occurred as recorded by our network and used for purposes of processing a Call/SMS on AT&Ts network. These are not necessarily indicative of features on a customer's account or the types of services subscribed to. Feature Acronym Feature Definition 'Wi-Fi' Er • This denotes when a Call/SMS was carried over q Wi-Fi. No cell sites or any type of location information is available on these transactions because AT&T does not store this