IMPORTANT INFO: Updated T-Mobile Cost Reimbursement Rate Schedule to Include New Fee for Timing Advance Records

As of May 20, 2022, T-Mobile updated their Cost Reimbursement Rate Schedule, which reflects adjusted pricing on some already charged for services, but this form now has a new service type reimbursement rate not seen in the past, that frankly is rather troubling.

Timing Advance (TDOA/PCMD) record requests will now require submission of their Timing Advance Billing Request Form, which requires ones agreement and consent to be charged $25 per target phone number, no matter if they have responsive records or not.

T-Mobile is claiming the request for historical Timing Advance (TDOA) records from their timing advance system in response to a search warrant or probable cause order is “burdensome and involves large amounts of information”.  They also claim these fees are associated with the “time and technology used to provide the response, not the production of the records.”

T-Mobile is saying they will not provide Timing Advance records unless the form is completed, signed and sent back (along with the legal demand), indicating your agreement and consent to be charged as indicated “for research, regardless of record availability.”

Our staff reached out to T-Mobile and spoke to supervision at the compliance center who provided additional information:

– This new fee for Timing Advance records went into effect on May 20th, 2022.
– No demands for Timing Advance will be filled without this new form filled out, signed and returned with the legal demand.
– Upon receipt of a legal demand (without the form), they will preserve the TDOA records for two years, but will not release them without this completed form.
– Once they receive the form, they will run the records and then bill the agency.
– It is $25 dollars per each target number for up to 90 Days-worth of records.  The 7-day increment is no longer in play.
– Exigent records will continue to be provided with no fee as long as the request meets the exigent requirements.

So I guess the good news out of all this is we don’t have to worry about the 7-day increments anymore and can get 90-days worth, if still available based on their TDOA retention schedule.

T-Mobile seems to be hanging their hat on 18 USC 2706(a), which on the federal side does allow for cost reimbursement under certain circumstance (“…shall pay to the person or entity assembling or providing such information a fee for reimbursement for such costs as are reasonably necessary and which have been directly incurred in searching for, assembling, reproducing, or otherwise providing such information. Such reimbursable costs shall include any costs due to necessary disruption of normal operations of any electronic communication service or remote computing service in which such information may be stored.”)

However, in 18 USC 2706(c) [Exception], it states, “The requirement of subsection (a) of this section does not apply with respect to records or other information maintained by a communications common carrier that relate to telephone toll records and telephone listings obtained under section 2703 of this title.  The court may, however, order a payment as described in subsection (a) if the court determines the information required is unusually voluminous in nature or otherwise caused an undue burden on the provider.”

Per subsection (c), it seems to me that it is the Court who can order the payment; not the carrier taking the initiative to create a fee schedule.  The federal statute specifies that the amount of the fee is to be mutually agreed upon, and if no agreement is reached, the Court that issued the order for production or the Court where the criminal prosecution would be brought determines the cost (18 USC 2706(b)).

You should check your local state laws on this issue as well, especially if you are obtaining the records under state law and not federal law; there may be an out.

For those in California, this was specifically addressed in the California statute, which limits required reimbursement to service providers to only wiretapping, pen register, and trap and trace orders. These statutes provide only for compensation that is “reasonable” for the expenses incurred in providing assistance in the interception for the requested communications (see CA Penal Code 629.90 and 638.52 (j)).

This is a little dated, but still relevant to this topic specific to California.  “The court in In re Marriage of Stephens (1984) 156 Cal.App.3d 909, clarified the issue by stating that the custodian is not allowed to charge for computer costs of retrieving data.  Additionally, the court found that a corporation is not permitted to pass along, as a cost of retrieval, a charge made by one of its own divisions. Significantly, the court noted that the legislature by setting reasonable costs was providing greater consumer protection, uniformity and simplicity of determination.”

Any cost that deviates from the formula found within CA Evidence Code 1563(b)(1), would not be reasonable and are subject to dispute.

So in the end, you will most likely get a bill and do you simply ignore it, dispute it, or pay the bill?  Before responding to the service provider, check with your prosecutors office and see what they think, but in the meantime, the Timing Advance records remain an extremely valuable piece of evidence that we just can’t do without, so complete the form and send with your legal demand so you get the records you need to make your case or find a missing person.

I’m sure there will be more information on this topic as it spreads across the country and starts impacting the ability to pursue justice or save a life.

 

Note: Information was obtained from a variety of sources, to include a document prepared by California Assistant Attorney General Robert Morgester (ret.) with California Department of Justice.  Click here to read the document in its entirety.  Also included in the document is an example dispute letter.

Big Win for South Carolina Law Enforcement

Thurs. Apr 14, 2022 | By Justia US Law |

Prior to this case, South Carolina law enforcement (state peace officers) were struggling with the issue of obtaining Cell Site Location Information (CSLI) records from cell service providers where the compliance center was not in their state.  South Carolina law (Section 17-13-140), says, “…any court of record of the State having jurisdiction over the area where the property sought is located, may issue a search warrant…”.

The primary focus of the dispute before the trial court over the validity of this warrant was whether an Anderson County (SC) magistrate had the authority to issue the warrant to an out-of-state entity for records that are not physically located in South Carolina.

T-Mobile’s compliance center is located in New Jersey and not in South Carolina, and the Court assumed the data was stored in New Jersey.  The important fact is T-Mobile clearly does business in South Carolina, in particular, in Anderson County, as evidenced by the defendants CSLI records in this case. The Court found that T-Mobile, therefore, is subject to the jurisdiction of an Anderson County (SC) magistrate.

Justia Opinion Summary:

Justin Jamal Warner was convicted by jury of murder, attempted armed robbery, and possession of a weapon during the commission of a violent crime. The court of appeals affirmed. The South Carolina Supreme Court granted Warner’s petition for a writ of certiorari to address: (1) whether the trial court was correct to deny Warner’s motion to suppress cell-site location information (CSLI) seized from his cell phone service provider; and (2) whether an out-of-court viewing by Warner’s probation officer of a crime-scene video and the officer’s identification of Warner as the man in the video required a hearing under Neil v. Biggers, 409 U.S. 188 (1972). The Supreme Court found the trial court correctly ruled the identification made from the video did not require a Biggers hearing. As to the CSLI, the Court held the warrant the trial court found invalid because the warrant sought information stored in another state was not – at least for that reason – invalid. The Supreme Court affirmed the court of appeals as to the Biggers issue and remanded to the trial court for further proceedings as to Warner’s motion to suppress CSLI.

Link to the online version and a downloadable PDF

Sprint & T-Mobile Merger Update

Hawk Analytics continues to closely assess the ever-changing dynamics of the Sprint & T-Mobile merger. Here is what we have learned most recently:

  • The Sprint CDMA (aka 3G) network will likely be shut down in early 2022.  All legacy Sprint customers will be switched over to the T-Mobile network.  This will result in all call detail records for Sprint and T-Mobile customers to be provided in the standard T-Mobile “CDR Mediations” report format.
  • The Sprint L-Site will remain for the foreseeable future.  Access to the L-Site is still being granted and managed.
  • All of the Sprint fax numbers have been decommissioned.  You will need to submit requests through T-Mobile’s fax and/or email addresses, which are available on the Hawk Toolbox Compliance Center website. (https://support.hawkanalytics.com/resources/compliance-centers/)
  • Timing Advance information is being provided in two report formats.
    1. The more common version is the typical T-Mobile Timing Advance file with several header rows at the top with the T-Mobile logo. These records are provided in UTC.
    2. The less common Excel file we’ve seen since the merger was generated by a system called “Quantum”. The Quantum system is no longer in use, but T-Mobile still occasionally provides Timing Advance information in an Excel spreadsheet with only one header row (beginning with columns for “imei” and “imsi”). Typically the information in this file should also be provided in UTC. However, sometimes the data is given in local time.  Hawk Analytics strongly encourages you to follow up with T-Mobile to verify the time zone of the records when you see this file format before you upload the report and begin your analysis.
  • We continue to see call detail records provided in both the typical Sprint and T-Mobile report formats. More importantly, we are increasingly seeing cell site location information from both networks in the same record.  You will need to refer to cell site lists from both Sprint and T-Mobile in order to correctly map all of the data. Some files make it more obvious to determine if a cell site occurs on the T-Mobile or Sprint network, while other files give no indication at all.  You will need to review the records carefully to ensure all of the mappable data is mapped.  If you are a CellHawk customer, the File Upload Report can assist you with this.  Hawk Support has several white papers for the different file types that can help you load the records so all of the mappable information shows up on the map in CellHawk.

As always, if you have any questions, please contact us at support@hawkanalytics.com

To 4G, or Not to 4G – That is the Question

What You Need to Know About Sprint Pings

Law enforcement has long been able to ping cell phones to obtain specialized location information in exigent situations or with legal demand.  The power of the ping has been a tremendous help in finding missing persons, helping in active kidnapping cases, and even finding very dangerous people, not to mention helping in surveillance work.  But what is happening when you don’t get consistent Sprint email pings every 15 minutes, or you get pings with no geo-location data?

This can jeopardize your investigation and perhaps even delay your efforts in locating the device in a timely manner.  We’re going to dive a little deep into the Sprint pings and review important information that very few may be aware of.

So why is this happening?  There could be several reasons for this:  The phone was turned off or in airplane mode or the battery was dead; or simply the phone is out of coverage area.  A more common reason, albeit probably not very well known, is it could be the phone is using the 4G LTE network.  Yes, you read that right – interpreted – Sprint is not providing automated email pings (every 15 minutes) if the target device is “sitting” on the 4G LTE network – what???  How can this be?  The short answer is the 4G LTE ping is still available, however not in the automated, every 15-minute, ping emails.

Click on the image to visit Sprint’s coverage map to check your area. You can also check specific devices to see what network they are compatible with.

Before we talk about how to get a device ping which is “sitting” on the 4G LTE network, let’s first go over some information to put things in perspective.

If you were to look at the Sprint coverage map, the majority of the urban areas within the U.S. are well built out now with 4G LTE.  Take Orange County (CA) for example.  Notice all the YELLOW.  This represents Sprint’s 4G LTE coverage area and the RED is non-LTE (3G CDMA/EVDO) coverage.  The RED really only appears in the canyons and mountains in more of the rural parts of the OC, otherwise 4G LTE is the predominant network for the region.

To put this in perspective, when looking at some of the most popular smartphones, all iPhones since the iPhone 5 (released in Sept. 2013) have been compatible with Sprints 4G LTE network.  On the Android side of the fence, the Samsung Galaxy S5 (released in Apr. 2014) has also been compatible with Sprints 4G LTE network.  Both devices mentioned also came standard with radios for the 3G CDMA/EVDO networks.

Now fast-forward several years, and as Sprint continued to build out their LTE network, the compatible devices started primarily communicating on 4G LTE with a fail-over (fallback) to the 3G CDMA/EVDO network in the absence of a 4G LTE signal/frequency.  Even today’s low-end smartphones (burners) will have both 3G and 4G capabilities.

Sprint has long been one of the easiest providers to work with when it comes to email pings simply because of their L-Site portal where setting up the ping is streamlined.   Sprint’s L-Site is an interactive web tool for law enforcement.  If you’re unfamiliar with the L-Site and wish to obtain further information, you can send an email to:  L-Site@Sprint.com.  However, with no information readily available to inform law enforcement that their email pings do not include 4G LTE, it leaves one to wonder what we are actually missing when chasing phones.

Now for the work-around.  If you believe the device is “sitting” on, or is using the 4G LTE network, investigators can call the Sprint Compliance Center at (800) 877-7330 (option 3) and have them ping the device manually.  They use a different tool to handle the 4G LTE pings, which is a manual process and it does not interact with the L-Site every 15-minute ping email system, thus the reason you may be getting limited daily pings from a Sprint phone (only getting 3G pings).

So, the question is how does one know if the phone is “sitting” on the 4G LTE or the 3G CDMA/EVDO network?

You don’t really know this answer, but knowing the device make and model could help.  For example, if you are pinging a target phone and only get pings with geo-locations on occasion and the device is 3G only, then something else is going on (e.g. turning the phone off or it’s out of the coverage area).  If you learn the device is 4G LTE compatible and is in a 4G LTE built-out region, now you can call the compliance center to get the manual 4G LTE pings.

How can one determine if the device is 3G and/or 4G compatible?

Working with the ESN/MEID/IMEI Number:

We first need to know what the device ESN/MEID is.  One way to get the ESN/MEID is if you’re going after live pings via a legal demand, be sure to always include a section in your search warrant requesting the, “Make, Model, serial number, IMEI, ESN, MEID, and MAC address associated with the listed target number including any and all equipment or SIM card changes for the life of the account.”  That way you can get this information from the compliance center when you provision your live ping.

If you have the CDRs for your target number, you can find the ESN/MEID in the Subscriber Information sheet (.rtf file) under the EQUIPMENT section.  Now that I mention it, you should be reviewing the CDRs if you are on a man hunt or working surveillance, to identify pattern of life and possible locations where they lay their head at night.  Examining the CDRs will also help to understand what network they are predominantly using during their normal, daily usage activity.

Now that you have the ESN/MEID, how does one identify the make and model of the device?  This gets a little confusing, but hopefully will all make sense in the end.

First an ESN (Electronic Serial Number) and MEID (Mobile Equipment Identifier) are essentially the same thing as it relates to Sprint.  ESNs were what Sprint called the device serial number 10 years ago and were specific to their 3G CDMA network, however fast-forward to today and Sprint still refers to them as ESNs when in reality the industry has transitioned to MEIDs.  You may see them listed both ways in the returns.

Searching the ESN/MEID to get the device make and model first depends on if the number identifier needs to be converted from a decimal to a hexadecimal number.  Counting the total number of digits will determine the next step.

For example, if the number is 18 digits, the first step is to convert the ESN from a decimal number to a hex number. If the ESN/MEID is either 14 or 15 digits, skip to the next section.

Working with the 18-Digit Number:

Here is an example Sprint 18-digit ESN/MEID – 089555431301520150

  • – Use this site https://www.esnconverter.com for the 18-digit conversion. The site converts the Sprint ESN to a 14-digit Hex ESN/MEID – 35611309173216

In order to search for the device make and model, the ESN/MEID needs to be a 15-digit number.  This ESN/MEID is only 14-digits and is missing the last digit.  This last digit is known as the check-digit so we need to calculate for the last digit.

Working with the 14-Digit Number:

To get that last digit, we need to run the 14-digit Hex ESN/MEID 35611309173216 in a MEID Calculator.   The calculator will convert that for you and provide you the results of the check-digit.

  • – Use this site https://www.imei.info/calc to calculate the check-digit of the 14-digit ESN/MEID
  • – Copy and paste 35611309173216 into the calculator and it will automatically provide you the check-digit.  For this example number the check-digit is 5
  • – Check “I’m not a robot” and click CHECK to run the true ESN/MEID
  • – You now should get a report of the device make and model and what networks the device supports

Working with the 15-Digit Number:

If you have an ESN/MEID that is already 15 digits, it may already contain the check-digit.

  • – Use this site https://www.imei.info/ to run the 15-digit number
  • – Check “I’m not a robot” and click CHECK to run the true ESN/MEID
  • – You now should get a report of the device make and model and what networks the device supports

If this gets confusing or you need assistance in navigating this process, don’t hesitate to reach out to Hawk Support for assistance.  As always, the support staff at Hawk Analytics are always standing at the ready to assist any law enforcement agency with a critical missing person investigation or high-profile violent crime (pro bono).  You will never receive a bill for our expertise when we assist with an exigent case.

I’m sure there’s a burning question as you’re reading.  What about the T-Mobile – Sprint merger?  The companies referred to it as “Day Zero” for the merger, which was August 1, 2020, and at this point people are still not sure how this will affect CDR returns that pre-date August 1st.  As for the compliance centers, right now they are operating two different offices.  It’s anticipated that at some point they will merge, but right now their first priority is getting Sprint customers switched over to the T-Mobile’s network, so everything will be under the T-Mobile corporate umbrella.

What about the L-Site?  As it stands now, our contacts in Sprint tell us there is no decision yet on what will happen with the L-Site.  It’s simply too soon in the merger to know what all will change moving forward, so stay tuned and we will surely bring it to you when we hear something.  So for now it’s business as usual for the Sprint compliance center.

If you need to reach out to Hawk Support, you can contact us by sending an email to support@hawkanalytics.com or by calling us at (469) 373-HAWK (4295) option 1.  If your case is exigent and you need emergency assistance, use option 4.  We have subject matter experts on call 24/7/365.

Author: Tom Bruce, Cmdr (ret.) | Director of Technical Operations, Sr. SME
Phone: 469-373-4295, ext. 703 (PDT)
Email: tom@hawkanalytics.com