AT&T February 2019 Transparency Report

© 2019 AT&T Intellectual Property. All rights reserved. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property. Introduction At AT&T, we take our responsibility to protect your information and privacy very seriously as set out in our Privacy Policy, which you can findhere .

This Report Like all companies, we are required by law to provide information to government and law enforcement entities, as well as parties to civil lawsuits, by complying with court orders, subpoenas, lawful discovery requests and other legal requirements. This AT&T Transparency Report provides specific data regarding the number and types of legal demands to which we responded for the second half of 2018, as well as Foreign Intelligence Surveillance Act demands for the first half of 2018. For comparison purposes, we have included data from our prior report. In this report, “AT&T” refers to the AT&T Communications and AT&T Latin America operating units; it does not include the WarnerMedia or Xandr operating units.

National Security Demands National Security Letters Jan.–June 2018 July–Dec. 2018 Total Received 500–999 500–999 Customer Selectors Targeted 2,500–2,999 2,500–2,999

Foreign Intelligence Surveillance Act July–Dec. 2017 Jan.–June 2018 Total Content 0–499 0–499 Customer Selectors Targeted 8,000–8,499 13,500–13,999 Total Non-Content 0–499 0–499 Customer Selectors Targeted 0–499 0–499

Total U.S. Criminal & Civil Demands Total Demands Jan.–June 2018 July–Dec. 2018 (Federal, State and Local; Criminal and Civil) 121,498 120,434

Subpoenas 92,620 93,077 Criminal 83,047 83,228 Civil 9,573 9,849

Court Orders (General) 10,034 9,727 Historic 7,090 6,613 Real-Time (Pen registers) 2,944 3,114

Search Warrants/Probable Cause Court Orders Historic 12,499 11,056 Stored Content 4,104 3,954 Other 8,395 7,102 Real-Time 6,345 6,574 Wiretaps 1,137 1,140 Mobile Locate Demands 5,208 5,434

©2019 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 2/12/2019 3 Demands Rejected/Partial or No Data Provided (Breakout detail of data included in Total U.S. Criminal & Civil Demands) Jan.–June 2018 July–Dec. 2018 Total 58,152 59,692 Rejected/Challenged 3,411 3,116 Partial or No Information 54,741 56,576

Location Demands (Breakout detail of data included in Total U.S. Criminal & Civil Demands) Jan.–June 2018 July–Dec. 2018 Total 42,180 42,145 Historic 32,830 32,549 Real-Time 8,184 8,275 Cell Tower 1,166 1,321

Emergency Requests Jan.–June 2018 July–Dec. 2018 Total 67,759 68,094 911 54,153 56,675 Exigent 13,606 11,419

Criminal proceedings include actions by National Security government entities — whether at the federal, Demands state or local level — against an individual arising from an alleged violation of criminal law. Because National Security Letters (NSL) are administrative federal, state and local investigating authorities subpoenas issued by the U.S. Federal Bureau in the U.S. may each initiate criminal proceedings, of Investigation to compel production of we receive demands from thousands of different information regarding counterterrorism or law enforcement entities. counterintelligence investigations. NSLs are limited to non-content information, such as Civil actions include lawsuits involving private a list of phone numbers dialed or subscriber parties (e.g., a personal liability case, divorce information. Legal demands issued pursuant proceeding or disputes between private to the Foreign Intelligence Surveillance Act companies or individuals). In addition, civil (FISA) may direct us to provide content and proceedings include investigations by non-content data related to national security governmental regulatory agencies such as investigations, such as international terrorism the Securities and Exchange Commission, the or espionage. Federal Trade Commission and the Federal Communications Commission. Our reporting on NSLs and FISA orders (collectively referred to as “National Security Demands”) is governed by U.S. law.¹ By statute, Our Process we are permitted to report data of demands We receive multiple types of legal demands, served on us and the “customer selectors including subpoenas, court orders and search targeted” by those respective demands in warrants. Before we respond to any legal specifically defined numeric ranges and for only demand, we determine that we have received the certain time periods. correct type of demand based on the applicable law for the type of information sought. For instance, in some states we must supply call Total U.S. Criminal & Civil detail records if we receive a subpoena. In other Demands states, call detail records require a probable cause court order or search warrant. If the requesting This number includes demands to which we agency has failed to send the correct type of responded in connection with criminal and civil demand, we reject the demand. litigation matters. This category doesn’t include demands reported in our National Security Demands table.

1 See 50 U.S.C. § 1874, as added by the USA Freedom Act (Public Law 114-23 of June 2, 2015).

©2019 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 2/12/2019 5 Types of Legal Demands The reporting category “Total U.S. Criminal & Civil Demands” reflects the type of demand with the information requested, particularly relating to General Court Orders and search warrants.

Subpoenas don’t usually General Court Orders are Search Warrants and require the approval of a judge signed by a judge. We consider Probable Cause Court and are issued by an officer “general” court orders to be Orders are signed by a judge, of the court, e.g., an attorney. all orders except those that and they are issued only upon They are used in both criminal contain a probable cause a finding of “probable cause.” and civil cases, typically to finding. In a criminal case, for To be issued, the warrant or demand testimony or written example, a judge may issue order must be supported business documents, such a court order on a lesser by sworn testimony and as calling records, and basic standard than probable sufficient evidence to believe subscriber information, such cause, such as “relevant to an the information demanded is as the name and address listed on the billing account. ongoing criminal investigation.” evidence of a crime. Probable In criminal cases, court orders cause is viewed as the are also used to demand highest standard to demand real-time, pen register/“trap evidence. Except in emergency and trace” information, which circumstances, a search provides phone numbers warrant or probable cause and other dialed information court order is required for for all calls as they are made all real-time precise location or received from the device information (like GPS) and identified in the order. In a real-time content (such as civil case, a court order may content obtained through be issued on a “relevant” or wiretaps). Stored content “reasonably calculated to lead (like stored text and voice to the discovery of admissible messages) generally also evidence” standard. requires a warrant. In both the criminal and civil context, general court orders have been used to demand historic information, like billing records or records relating to usage of a wireless device.

©2019 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 2/12/2019 6 Foreign-Originated Demands • We had no information that matched the customer or equipment information for Information about a U.S. provided in the demand. Consumer or Business If we receive an international demand for Location Demands information about a U.S. customer, whether an individual or business, we refer the requester Our “Location Demands” category breaks out to that country’s Mutual Legal Assistance the number of civil and criminal legal demands Treaty (MLAT) process. We did not receive any we received by the type of location information international demands for information about (historic or real-time) demanded. Demands a U.S. customer from a country that does not for location information seek precise GPS have an MLAT process. The FBI ensures that we coordinates of the device or call detail records receive the proper form of U.S. process (e.g., that reflect the location of any cell site processing subpoena, court order or search warrant), subject a call. We also get demands for cell tower to the limitations placed on discovery in the U.S., searches, which ask us to provide all telephone and that cross-border data flows are handled numbers registered on a particular cell tower for appropriately. Thus, any international originated a certain period of time. We do not keep track demands that follow an MLAT procedure are of the number of telephone numbers provided reported in our Total Demands category because to law enforcement in connection with cell we can’t separate them from any other FBI legal tower searches. demand we may receive. A single cell tower demand may cover multiple towers. We disclose both the total number of demands and the total number of cell tower Demand Rejected/Partial searches. For instance, if we received one court Or No Data Provided order that included two cell towers, we count that as one demand for two searches. For the 1,321 In this category, we include the number of times cell tower demands during this reporting period, we rejected a demand or provided only partial we performed 3,179 searches. The average time information or no information in response to period that law enforcement demanded for a cell a demand. Here are a few reasons why certain tower search was 2 hours and 42 minutes for this demands fall into this category: reporting period. • The wrong type of demand is submitted by Like all companies, we are required by law to law enforcement. For instance, we will reject provide information to law enforcement and a subpoena demanding a wiretap, because other government entities by complying with either a probable cause court order or court orders, subpoenas, and lawful discovery search warrant is required. requests. In all cases, we review requests to • The demand has errors, such as missing determine whether they are valid. We require pages or signatures. a search warrant based on the probable cause standard for all demands for real-time • The demand was not correctly addressed or historical location information, except in to AT&T. emergency situations. • The demand did not contain all the elements necessary for a response.

©2019 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 2/12/2019 7 Emergency Requests International Demands The numbers provided in this category are the The “International Demands” category represents total of 911-originated inquiries and exigent the number of civil and criminal legal demands requests that we processed during this reporting originating outside the U.S. and related to AT&T’s period. 911-originated inquiries are those that operations in foreign countries. These demands help locate or identify a person in need of are for (i) historic subscriber information about emergency assistance. “Exigent requests” are consumers who reside in other countries and emergency requests from law enforcement businesses that operate in other countries; and working on kidnappings, missing person cases, (ii) URL/IP (website/Internet address) blocking attempted suicides and other emergencies. demands from foreign governments. In order to protect your privacy, we require a certification from a law enforcement agency confirming they are dealing with a case involving risk of death or serious injury before we will share information sought by an exigent request.

The Diverse Services AT&T Provides Internationally Affect the Types and Volume of Demands We Receive

Business Services: AT&T Consumer Mobility Services: VRIO: In all Latin American provides telecommunications Mexico is the only country countries where AT&T’s affiliate and IT services to the foreign outside of the U.S. where VRIO provides consumer offices of large multi-national AT&T provides consumer satellite television service, we business customers. In all mobility service. Accordingly, primarily receive demands foreign countries where AT&T received legal demands for subscriber information AT&T supports these similar to those it receives in regarding our DIRECTV and customers, AT&T primarily the U.S., including demands SKYBrasil branded services. receives demands for historic for subscriber information, In those Latin American subscriber information. In location information and countries where VRIO also those countries where AT&T real-time content. provides broadband service, also provides internet access we also received demands for service, it may also have IP or URL blocking. received demands for IP or

URL blocking.

©2019 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 2/12/2019 8 demands from foreign governments to block A Few Additional Points access to websites in their countries during • Historic Subscriber Information is this reporting period, we did not receive information such as the name and address demands to remove content from websites listed on the billing account or the types of (nor would we be able to do so). During this services purchased from AT&T. reporting period, we did not receive any demands from any foreign governments to • The IP or URL blocking demands come produce any stored content. from countries that require us to block access to websites that they deem offensive, • Finally, the laws governing the international illegal, unauthorized or otherwise demands that we receive differ by country. inappropriate. These demands are listed We respond to these demands based on separately from the demands for historic each country’s laws.2 subscriber information.

• While AT&T may provide internet access in 2 India, for example, does not permit publication some foreign countries, we do not have the of demands. ability to control the content of any websites other than AT&T’s own sites. Accordingly, while we did receive and comply with

©2019 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 2/12/2019 9 International Demands3 Total International Demands Jan.–June 2018 July–Dec. 2018 Argentina Historic: Subscriber Information 481 484 Belgium Historic: Subscriber Information 0 1 IP/URL Blocking 3 3 Brazil Historic: Subscriber Information 438 347 Chile Historic: Subscriber Information 16 59 Colombia Historic: Subscriber Information 1,181 1,395 IP/URL Blocking 2 2 Ecuador Historic: Subscriber Information 70 115 Germany Historic: Subscriber Information 0 1 Israel IP/URL Blocking 6 7 Peru Historic: Subscriber Information 5 10 Russia IP/URL Blocking 175 183 Slovakia IP/URL Blocking 4 3 Turkey IP/URL Blocking 8,523 5,980 United Kingdom Historic: Subscriber Information 0 2 Uruguay Historic: Subscriber Information 4 3 Venezuela Historic: Subscriber Information 781 176

3 Countries where “0” has been reported for two consecutive reporting periods (12 months) have been removed from this chart. We will add countries back in future reports should we get new requests in any of those countries.

Interceptions of Communications Legal framework Political Constitution of the United Mexican States, article 16, 12nd paragraph Federal Criminal Procedure Code, article 291 Federal Law against Organized Crime, article 16

Metadata Legal framework Federal Telecommunications and Broadcasting Law, article 190 Federal Criminal Procedure Code, article 303 Law on General Channels of Communications, article 122

Total International Demands Jan.–June 2018 July–Dec. 2018 Mexico Historic: Subscriber Information/Call Detail Records 6,691 6,847 Location Information (Cell Site) 5,410 5,998 Real-Time 680 686 Pen Registers/Wiretaps/Cell Site 383 445 Location Information (Precise) 297 241 Demands Rejected/Partial or No Data Provided 1,497 853 (Breakout detail of data included in Total Mexico Demands) Rejected/Challenged 322 114 Partial or No Information 1,175 739 A

©2019 AT&T Intellectual Property. All rights reserved. AT&T Transparency Report | 2/12/2019 11 Additional Resources You’ll find more on our commitment to privacy in: • Our Privacy Policy • Our issues brief on Privacy • Our issues brief on Freedom of Expression