AT&T August 2020

AT&T August 2020 Transparency Report

© 2020 AT&T Intellectual Property. All rights reserved. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property. Introduction At AT&T, we take our responsibility to protect your information and privacy very seriously. You can learn more here.

This Report Like all companies, we are required by law to provide information to government and law enforcement entities, as well as parties to civil lawsuits, by complying with court orders, subpoenas, lawful discovery requests and other legal requirements. This AT&T Transparency Report provides (1) specific data regarding the number and types of legal demands to which we responded for the first half of 2020 that compelled AT&T to provide information about (a) communications or (b) our customers, as well as (2) information permitted by law to be disclosed about Foreign Intelligence Surveillance Act demands for the second half of 2019. The Transparency Report also provides information about legal demands that were partially or completely rejected, demands for location information, emergency requests and international legal demands. In this report, “AT&T” includes all of AT&T’s operating units: • AT&T Communications provides mobile, broadband, video and other communications services to U.S.-based consumers and nearly 3 million companies globally — from the smallest business to nearly all the Fortune 1000. • WarnerMedia is a leading media and entertainment company that creates and distributes premium and popular content from a diverse array of talented storytellers and journalists to global audiences through its consumer brands, including: HBO, HBO Max, Warner Bros., TNT, TBS, truTV, CNN, DC Entertainment, New Line, Cartoon Network, Adult Swim, Turner Classic Movies and others. • AT&T Latin America offers mobile services to people and businesses in Mexico and digital entertainment services in South America and the Caribbean. • Xandr provides marketers with advanced advertising solutions enhanced with valuable customer insights from AT&T’s TV, mobile and broadband services, combined with extensive ad inventory including WarnerMedia’s cable networks and premium content from third-party media brands.

National Security Letters Jan.–June 2020 Total Received 000–499 Customer Selectors Targeted 3,000–3,499 Foreign Intelligence Surveillance Act July–Dec. 2019 Total Content 0–499 Customer Selectors Targeted 9,500–9,999 Total Non-Content 0–499 Customer Selectors Targeted 0–499

Total U.S. Criminal & Civil Demands

Total Demands Jan.–June 2020 (Federal, State and Local; Criminal and Civil) 133,176 Subpoenas 102,315 Criminal 94,179 Civil 8,136 Court Orders (General) 10,021 Historic 6,755 Real-Time (Pen registers) 3,266 Search Warrants/Probable Cause Court Orders Historic 13,795 Stored Content 5,449 Other 8,346 Real-Time 7,045 Wiretaps 1,019 Mobile Locate Demands 6,026

©2020 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 08/20/2020 3 Demands Rejected/Partial or No Data Provided (Breakout detail of data included in Total U.S. Criminal & Civil Demands) Jan.–June 2020 Total 61,071 Rejected/Challenged 3,696 Partial or No Information 57,375

Location Demands (Breakout detail of data included in Total U.S. Criminal & Civil Demands) Jan.–June 2020 Total 48,030 Historic 37,983 Real-Time 8,573 Cell Tower 1,474

Emergency Requests Jan.–June 2020 Total 62,314 911 48,972 Exigent 13,342

Criminal proceedings include actions by National Security government entities — whether at the federal, Demands state or local level — against an individual arising from an alleged violation of criminal law. Because National Security Letters (NSL) are administrative federal, state and local investigating authorities subpoenas issued by the U.S. Federal Bureau in the U.S. may each initiate criminal proceedings, of Investigation to compel production of we receive demands from thousands of different information regarding counterterrorism or law enforcement entities. counterintelligence investigations. NSLs are Civil actions include lawsuits involving private limited to non-content information, such as parties (e.g., a personal liability case, divorce a list of phone numbers dialed or subscriber proceeding or disputes between private information. Legal demands issued pursuant companies or individuals). In addition, civil to the Foreign Intelligence Surveillance Act proceedings include investigations by (FISA) may direct us to provide content and governmental regulatory agencies such as non-content data related to national security the Securities and Exchange Commission, the investigations, such as international terrorism or Federal Trade Commission and the Federal espionage. Communications Commission. Our reporting on NSLs and FISA orders (collectively referred to as “National Security Our Process Demands”) is governed by U.S. law.¹ By statute, we are permitted to report data of demands We receive multiple types of legal demands, served on us and the “customer selectors including subpoenas, court orders and search targeted” by those respective demands in warrants. Before we respond to any legal specifically defined numeric ranges and for only demand, we determine that we have received the certain time periods. correct type of demand based on the applicable law for the type of information sought. For instance, in some states we must supply call Total U.S. Criminal & detail records if we receive a subpoena. In other states, call detail records require a probable cause Civil Demands court order or search warrant. If the requesting This number includes demands to which we agency has failed to send the correct type of responded in connection with criminal and civil demand, we reject the demand. litigation matters. This category doesn’t include demands reported in our National Security Demands table.

1 See 50 U.S.C. § 1874, as added by the USA Freedom Act (Public Law 114-23 of June 2, 2015).

©2020 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 08/20/2020 5 Types of Legal Demands The reporting category “Total U.S. Criminal & Civil Demands” reflects the type of demand with the information requested, particularly relating to General Court Orders and search warrants.

Subpoenas don’t usually General Court Orders are Search Warrants and require the approval of a judge signed by a judge. We consider Probable Cause Court and are issued by an officer “general” court orders to be Orders are signed by a judge, of the court, e.g., an attorney. all orders except those that and they are issued only upon They are used in both criminal contain a probable cause a finding of “probable cause.” and civil cases, typically to finding. In a criminal case, for To be issued, the warrant or demand (1) testimony or example, a judge may issue a order must be supported written business documents, court order on a lesser by sworn testimony and such as calling records and standard than probable sufficient evidence to believe client contracts, (2) basic cause, such as “relevant to an the information demanded is subscriber information, such ongoing criminal investigation.” evidence of a crime. Probable as the name and address listed on the billing account, In criminal cases, court orders cause is viewed as the and (3) data related to are also used to demand highest standard to demand advertising transactions real-time, pen register/“trap evidence. Except in emergency conducted using our and trace” information, which circumstances, a search advertising technology. provides phone numbers warrant or probable cause and other dialed information court order is required for all for all calls as they are made real-time precise location or received from the device information (like GPS) and real- identified in the order. In a time content (such as content civil case, a court order may obtained through wiretaps). be issued on a “relevant” or Stored content (like stored text “reasonably calculated to lead and voice messages) generally to the discovery of admissible also requires a warrant. evidence” standard. In both the criminal and civil context, general court orders have been used to demand historic information, like billing records or records relating to usage of a wireless device.

©2020 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 08/20/2020 6 Foreign-Originated Demands • We had no information that matched the customer, equipment or other information for Information about a U.S. provided in the demand. Consumer or Business Location Demands If we receive an international demand for information about a U.S. customer, whether an Our “Location Demands” category breaks out individual or business, we refer the requester the number of civil and criminal legal demands to that country’s Mutual Legal Assistance we received by the type of location information Treaty (MLAT) process. We did not receive any (historic or real-time) demanded. Demands international demands for information about for location information seek precise GPS a U.S. customer from a country that does not coordinates of the device or call detail records have an MLAT process. The FBI ensures that that reflect the location of any cell site processing we receive the proper form of U.S. process a call. We also get demands for cell tower (e.g., subpoena, court order or search warrant), searches, which ask us to provide all telephone subject to the limitations placed on discovery numbers registered on a particular cell tower for in the U.S., and that cross-border data flows a certain period of time. We do not keep track of are handled appropriately. All international the number of telephone numbers provided to originated demands that follow an MLAT law enforcement in connection with cell tower procedure are reported in our Total Demands searches. category. A single cell tower demand may cover multiple towers. We disclose both the total number of Demand Rejected/Partial demands and the total number of cell tower searches. For instance, if we received one court or No Data Provided order that included two cell towers, we count In this category, we include the number of times that as one demand for two searches. For the we rejected a demand or provided only partial 1,474 cell tower demands during this reporting information or no information in response to a period, we performed 3,150 searches. The demand. Here are a few reasons why certain average time period that law enforcement demands fall into this category: demanded for a cell tower search was 2 hours and 4 minutes for this reporting period. • The wrong type of demand is submitted by law enforcement. For instance, we will reject Like all companies, we are required by law to a subpoena demanding a wiretap, because provide information to law enforcement and either a probable cause court order or other government entities by complying with search warrant is required. court orders, subpoenas and lawful discovery requests. In all cases, we review requests to • The demand has errors, such as missing determine whether they are valid. We require pages or signatures. a search warrant based on the probable • The demand was not correctly addressed cause standard for all demands for real-time to AT&T. or historical location information, except in emergency situations. • The demand did not contain all the elements necessary for a response.

©2020 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 08/20/2020 7 risk of death or serious injury before we will share Emergency Requests information sought by an exigent request. The numbers provided in this category are the total of 911-originated inquiries and exigent requests that we processed during this reporting International Demands period. 911-originated inquiries are those that The “International Demands” category represents help locate or identify a person in need of the number of civil and criminal legal demands emergency assistance. “Exigent requests” are originating outside the U.S. and related to AT&T’s emergency requests from law enforcement operations in foreign countries. These demands working on kidnappings, missing person cases, are for (i) historic subscriber information about attempted suicides and other emergencies. consumers who reside in other countries and In order to protect your privacy, we require a businesses that operate in other countries; and certification from a law enforcement agency (ii) URL/IP (website/internet address) blocking confirming they are dealing with a case involving demands from foreign governments.

The Diverse Services AT&T Provides Internationally Affect the Types and Volume of Demands We Receive

Business Services: AT&T provides Xandr: Outside of the United States, Xandr telecommunications and IT services to the (through its operating companies and foreign offices of large multi-national business subsidiaries) provides marketers and publishers customers. In all foreign countries where AT&T with advanced advertising technology solutions supports these customers, AT&T primarily and facilitates access to advertising inventory receives demands for historic subscriber for marketers, including premium content from information. In those countries where AT&T also premium media brands. provides internet access service, it may also have Mexico is the received demands for IP or URL blocking. Consumer Mobility Services: only country outside of the U.S. where AT&T WarnerMedia: Outside of the United provides consumer mobility service. Accordingly, States, WarnerMedia (through its operating AT&T received legal demands similar to those companies and subsidiaries) owns and operates it receives in the U.S., including demands for entertainment services, including basic tier and subscriber information, location information, premium television networks and direct-to- real-time content and wiretaps. consumer streaming services, as well as news and information services, which are distributed VRIO: In all Latin American countries where through a variety of platforms. WarnerMedia AT&T’s affiliate VRIO provides consumer satellite companies also engage in the production, television service, we primarily receive demands distribution and licensing of feature films, for subscriber information regarding our DIRECTV television programming, comic books, video and SKY Brasil branded services. In those Latin games and other products in a variety American countries where VRIO also provides of formats, including licensing to theaters, pay- broadband service, we also received demands for television services, broadcast and cable networks, IP or URL blocking. on-demand services and distribution by means of physical discs and electronic sell-through.

©2020 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 08/20/2020 8 demands from foreign governments to block A Few Additional Points access to websites in their countries during • Historic Subscriber Information is this reporting period, we did not receive information such as the name and address demands to remove content from websites listed on the billing account or the types of (nor would we be able to do so). During this services purchased from AT&T. reporting period, we did not receive any demands from any foreign governments to • The IP or URL blocking demands come produce any stored content. from countries that require us to block access to websites that they deem offensive, • Finally, the laws governing the international illegal, unauthorized or otherwise demands that we receive differ by country. inappropriate. These demands are listed We respond to these demands based on 2 separately from the demands for historic each country’s laws. subscriber information. • While AT&T may provide internet access in 2 India, for example, does not permit publication some foreign countries, we do not have the of demands. ability to control the content of any websites other than AT&T’s own sites. Accordingly, while we did receive and comply with

Total International Demands Jan.–June 2020 Argentina Historic: Subscriber Information 272 Brazil Historic: Subscriber Information 142 IP/URL Blocking 3 Chile Historic: Subscriber Information 9 Colombia Historic: Subscriber Information 964 Cyprus Historic: Subscriber Information 1 Ecuador Historic: Subscriber Information 26 France Historic: Subscriber Information 3 Germany Historic: Subscriber Information 1 Israel IP/URL Blocking 9 Italy Historic: Subscriber Information 1 Peru Historic: Subscriber Information 3 Romania IP/URL Blocking 7

3 Countries where “0” has been reported have been removed from this chart. We will add countries back in future reports should we receive new requests in any of those countries. And following the May 19, 2020, closure of DIRECTV Latin America operations in Venezuela, there will be no reporting from that country.

Historic: Subscriber Information 1 Turkey IP/URL Blocking 7,017 United Kingdom Historic: Subscriber Information 3 Uruguay Historic: Subscriber Information 1

©2020 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 08/20/2020 11 Mexico Wiretaps The laws applicable to demands received Legal framework in Mexico are listed below. Political Constitution of the United Mexican States, article 16, paragraph 12 General Information Federal Criminal Procedure Code, article 291 Requirements Federal Law against Organized Crime, article 16 Legal framework Law on General Channels of Communications, Federal Telecommunications and Broadcasting article 122 Law, article 190 Federal Criminal Procedure Code, article 303

Types of Legal Demands In Mexico, there is no distinction between Subpoenas and General Court Orders, as in the U.S., because the law provides that all demands for customer data must be reviewed and authorized by a judge. The legal demands are classified as follows:

Historic Information. In a Location Information in Court Order for Wiretaps. criminal case, court orders are Real-Time. Legal demands In Mexico, there is a special used to demand subscriber for this information must be procedure for these types information, call detail records, reviewed and authorized by a of legal demands, and a cell site location information, judge, whose ruling must be judge may authorize the and identification data of premised on relevant criminal wiretap order, if certain legal mobile devices. In a civil case, investigations and national standards are met and the court orders may only be security. Demands for location matter is related to a criminal used to demand subscriber information seek precise GPS investigation or national information. coordinates of the device or security. call detail records that reflect the location of any cell site processing a call. We also get demands for cell tower searches, which ask us to provide all telephone numbers registered on a particular cell tower for a certain period. We do not keep track of the number of telephone numbers provided to law enforcement in connection with cell tower searches.

©2020 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 08/20/2020 12 Jan.–June 2020 Mexico Historic: Subscriber Information/Call Detail Records 10,277 (Includes judicial authorities and national security) Location Information (Cell Site) 8,935 Real-Time 1,688 Wiretaps 701 Location Information (Precise) 987 Demands Rejected/Partial or No Data Provided 840 (Breakout detail of data included in Total Mexico Demands) Rejected/Challenged 245 Partial or No Information 595

• Our issue brief on Privacy.

• Our issue brief on Freedom of Expression.