11/13/2002 1:21 PM Page 1 of 1

11/13/2002 1:21 PM Page 2 of 2

Table of Contents

1. Introduction – Purpose of the manual & brief overview of our group.

2. Contacts - Phone numbers for Corporate Security (LEA use only)

2.1 Emergency Hotline / When to use

2.1.1 Emergency Request Form sample

2.1.2 911 Request for Information Form sample

3. Legal Demands

3.1 Court Order requirements

3.2 CALEA cover sheet

3.3 Fee schedule- Billing

4. CALEA delivery path, diagram, cell site sector map

4.1 J-STD-025 Delivery Options

4.1.1 Secure Virtual Private Network (VPN)

4.1.2 Private Line Circuit

4.1.3 SINS

4.2 LAES messages and IAP list

4.3 Audio Delivery Options

4.4 Cell Site Sectors

5. Viador explanation (0,1,2,3)

6. Hotline information & account takeover information

7. Voice mailbox options

8. PCS New and Future capabilities

11/13/2002 1:21 PM Page 3 of 3

1.0 Introduction

The goal of Sprint’s Electronic Surveillance Group is to comply with the laws governing access to private information entrusted to Sprint PCS by its customers. The Electronic Surveillance Group also understands the importance of assisting law enforcement during emergency situations. This manual clarifies many issues surrounding electronic surveillance and exigent circumstances as they pertain to Sprint PCS and it’s policies. 2.0 Contacts – Contact numbers for all departments are being updated. Please refer

to page 4.

2.1 Emergency Hotline and when to use it The Emergency Hotline was established by Sprint to assist Law Enforcement in

exigent situations such as kidnappings, hostage situations, suicide attempts, etc. where someone’s life is in immediate danger. It can also be used for exigent-life or death conspiratorial activities that threaten national security, or involve organized crime. It is not intended to supply subscriber information in other types of situations such as prior to a controlled drug buy.

2.1.1 Emergency Exigent Circumstance Request Form An exigent circumstance is one that involves an immediate life or death situation. A sample of our exigent form is located on page 5. You must call the Hotline to get a true copy of this form for every emergency situation. The form must be filled out entirely and faxed to 913-315-0736. This must be followed by the proper legal documentation within the allotted time as attested by your signature.

This option is only to be used in the event of a true exigent circumstance.

Exigent = An immediate life or death situation.

2.1.2 Emergency 911 Request for Information Form This form is used by 911 operators to identify Sprint PCS customers who call for emergency assistance. A sample of this form is located on page 6. This is only a sample and cannot be used in future requests. At the request of law enforcement personnel, a true copy will be faxed. Although this true form can be copied by law enforcement personnel, a call to the Emergency Hotline must be made prior to faxing in the completed form.

11/13/2002 1:21 PM Page 4 of 4

Contacts Corporate Security Menu Options Main Number(s): 800-877-7330 888-877-7330 Local Number: 913-315-0699 Fax Number: 913-315-0736 We are currently in the process of updating the decision tree associated with the corporate security main number. When calling in, please listen carefully as the menu may have changed.

11/13/2002 1:21 PM Page 5 of 5

MANDATORY INFORMATION FOR EXIGENT CIRCUMSTANCE REQUESTS Pursuant to Title 18 United States Code, § 3125 and § 2518

FAX all requests to Sprint PCS – 913-315-0736 – ATTN: _____________ Sprint Corporate Security Emergency Contact: 1-888-877-7330 Option 1

Please be sure to fax in agency coversheet along with this form

***PLEASE PRINT*** LAW ENFORCEMENT AGENCY (LEA) _____________________________________________ ADDRESS OF LEA ______________________________________________________________

______________________________________________________________________ PHONE NUMBER OF LEA ______________________________FAX #_____________________ AGENT’S NAME ______________________________________________________ AGENT’S TITLE ____________________________________________BADGE #_______________ SUPERVISOR’S NAME __________________________SUPERVISOR’S PHONE #_____________

I hereby certify that I have been granted authority by the above-mentioned LEA to determine and declare an Exigent Emergency involving

(1) immediate danger of death (i.e., murder, hostage situation or kidnapping) (2) conspiratorial activities threatening the national security interest (i.e., a terrorist

bomb or plot), or (3) immediate life or death conspiratorial activities characteristic of organized crime.

Below is my description of the Exigent Emergency that requires Sprint PCS to respond immediately (please include the Sprint PCS phone number or any other known relevant information): SPCS PHONE NUMBER or ESN or Customer NAME: EXIGENT DESCRIPTION:

I am requesting that Sprint PCS provide the following service(s) (mark all that apply): ____ Subscriber Information (Subpoena Required)

____ Call Detail Records (within the past week) (Subpoena Required) ____ Live audio interception (wiretap) (Title III Court Order Required) ____ Live Pen Register/Trap & Trace (Court Order Required) _____ Call Detail Records with cell site information (Search warrant or court order required)

____ Real Time Cell Site Information (Court Order Required) I further certify that the required Legal Demand documents will be provided to Sprint within the following time frames: Subpoena (within 48 hours), Pen Register/Trap & Trace Court Order (within 24 hours), Title III Court Order (within 48 hours) after Sprint PCS has installed electronic surveillance or has provided other requested service(s). The Legal Demand should be addressed to SPRINT PCS, 6480 Sprint Parkway, Overland Park, KS 66251, and may be faxed to the above-listed number as soon as it is officially signed. Please note that all Pen Register/Trap & Trace Surveillance will terminate in 24-hours and all Wiretap Surveillance will terminate in 48 hours if the appropriate Legal Demand is not received by that time. __________________________________________________ _________________ SIGNATURE DATE

11/13/2002 1:21 PM Page 6 of 6

Sprint PCS

Sprint Corporate Security

KSOPHM0206 6480 Sprint Parkway

Overland Park, KS 66251 EMERGENCY CONTACT NUMBER: 1-888-877-7330

Attention: ______________ WIRELESS 9-1-1 EMERGENCY INFORMATION REQUEST FORM

1) CONTACT SPRINT PCS: 1-888-877-7330 2) FAX COMPLETED EMERGENCY REQUEST FORM TO: 913-315-0736

AGENCY REQUESTING INFORMATION: AGENCY ADDRESS (Street): AGENCY ADDRESS (City, State, Zip Code): AGENCY FAX #: AGENCY PHONE #: EMPLOYEE REQUESTING INFORMATION: EMPLOYEE TITLE: BADGE #: EMPLOYEE SIGNATURE: DATE: RE: Emergency Request for Information on Sprint PCS Wireless Number: – – . This agency received a 9-1-1 emergency call for assistance from the above Sprint PCS telephone number: Date of Call: Time of Call: a.m./p.m. Dispatch Log #: Nature of call:

Based on that telephone call, we believe a situation exists that requires emergency assistance from Sprint PCS. We request that you promptly provide the following information necessary to initiate the appropriate response.

___ subscriber name, billing address, home/business phone numbers for the above Sprint PCS telephone number ___ cell site or location information for the 9-1-1 call from this Sprint PCS phone number

11/13/2002 1:21 PM Page 7 of 7

3.0 Legal Demands

Below are the minimum legal demand requirements for information requested from Sprint PCS. As noted below cell site addresses can only be retrieved via a Search Warrant or Court Order and that is because they are considered to be locations of Sprint PCS real property.

Subscriber information ……………………….Subpoena required Call detail information without cell site…. Subpoena required Stored voice mail retrieval …………………...Search Warrant required Call detail information with cell site………….Search Warrant required Real time cell site information ……………….Court Order required Pen Register Trap and Trace………………..Court Order required Contemporaneous Billing…………………….Court Order required Ghost Voice Mail Box…………………………Title III Court Order required Wiretap (Audio interception)………………….Title III Court Order required

3.1 Court Order Requirements –Our requirements are specified below. In certain situations, the requirements may be slightly different. Also, each specific judge may have his or her own legal requirements.

3.2 CALEA Coversheet – A printable sheet is located on page 8. To ensure timely implementation, the CALEA coversheet as well as your agency coversheet needs to be filled out completely and faxed in with every Court Order request. 3.3 Fee Schedule / Billing – Please see page 9 for a description of our fees.

Title III Order requirements

1) The order must be timely.

2) The requesting agent is authorized. 3) The order unambiguously identifies

the communications facilities to be intercepted.

4) The order must provide a

permissible duration for the interception. (i.e. 30 days)

Pen Register/Trap and Trace Orders

1) The order unambiguously identifies the communication facilities to be tracked.

2) The order provides a permissible duration (60 days). 3) The order provides the geographical

limits of the order. 4) Sprint specific information is provided (target phone number).

11/13/2002 1:21 PM Page 8 of 8

CALEA Coversheet ALL LEGAL DEMANDS SHOULD BE FAXED TO : 913-315-0736

MAIN NUMBER : 1-888-877-7330 Sprint PCS

Sprint Corporate Security KSOPHM0206, 6480 Sprint Parkway, Overland Park, KS 66251

PLEASE INCLUDE AGENCY COVER SHEET

(Failure to include cover sheet may result in delay of implementation) Please complete this form and include with your agency coversheet and all Court Orders Target #: Court Order #:

County of Order: Judge’s name:

LEA Tech. Agent name:

LEA Agency: _______________________________________ ______________

Contact phone #:

Contact fax #:

Agency “SINS” Login ___________________________

Billing contact name:

Billing contact phone #:

Billing address (if purchase order is required, please submit with Order): Surveillance Start date: Termination date:

**Note: If you are implementing a T3 we will need a DN or you will not receive audio **

Audio Delivery: Combined Separated Dialed Number(s): CDC Delivery: o CDS (Calea Delivery System)

Public Routable IP Address: Port: 13131

11/13/2002 1:21 PM Page 9 of 9

3.2 Fees Sprint’s fee schedule reflects the cost of switch application software, infrastructure, personnel, and required CALEA software, hardware and upgrades.

• Initial charge for Pen Register/ Trap and Trace or Title III Wiretap - $250 per target per MTA This $250 charge covers the cost of installation of the MIN (mobile identification number) or target number in the switches of its home market area. In the event that the law enforcement agency requests that the MIN be implemented in a switch outside of that market (i.e. target is traveling), Sprint will charge an additional $250 install fee per target - per market area outside of their home market area. It is a CALEA requirement that the target at least be built in the home market for call processing purposes. In the event a Court Order is extended and the Extension order is sent in on time - no installation fees will be billed for the Extension order. If the Extension order is sent in after the expiration of the original Court Order, installation fees will be billed for the Extension order.

• Daily maintenance fee for Pen Register/ Trap and Trace or Title III Wiretap - $25 per day per target This $25 fee applies for each day the Court Order is in effect, and call detail and/or call content is being intercepted on the MIN (Mobile Identification Number).

• Ghost Voice Mailbox setup on a Subscriber’s Voice Mail or Stored Voicemail Access- $150 A flat fee of $150 per Ghost Voice mailbox applies to the duplication of a subscriber’s voicemail. This flat fee applies to each (60) day period or per Court Order. A flat fee of $150.00 applies per subscriber per request for stored voicemail.

• Court Ordered Telecommunications Records and/or Contemporaneous Billing Records (USC 2703) - $300.00 per target The records will be provided on a reasonable schedule and the flat fee will cover each (60) day period or per Court Order.

• Account Takeover Fees $300.00 per target ◊ If account is already “HOTLINED” or suspended ◊ (Please refer to pg. 21 for the definition of Hotline)

Although it can be done, we do not recommend an account takeover at this point because it could impede your investigation. The subscriber knows the service is suspended for non-payment and could become suspicious when it becomes operational when no payment has been made. The fee for this is $300.00 plus the difference in the account balance between the start of surveillance period and the time of takedown.

◊ If account is not currently “HOTLINED” Due to the automated system features and the number of individuals involved in collections, finance and fraud, Sprint PCS cannot guarantee that an account will remain active once this procedure has taken place. The fee for this is $300.00 plus the difference in the account balance between the start of surveillance period and the time of takedown.

• Billing

◊ Billing Period The billing period is on a per court order basis. For example, when your original PTT Order is extended, you will receive an invoice for the original 60 days, and later, after the extension terminates, you will receive a second invoice for the 60 days of the extension Order.

◊ Invoice Information The information on the invoice will include all of the following: The type of service provided, the length of time that service was provided for, and the last four digits of the target number for your reference. If you need more information on a specific invoice, please contact either the analyst who worked the case or the Electronic Surveillance group at 913-315-0661.

◊ Who is billed If two agencies are monitoring one target, both agencies will be billed. The invoices will be sent to the billing addresses specified on the CALEA cover sheet.

11/13/2002 1:21 PM Page 10 of 10

4 CALEA With the proper legal documentation, Sprint Corporate Security can provide law enforcement J-STD-025 messages as mandated by CALEA. In accordance with CALEA, Sprint worked aggressively to deliver surveillance data from its network to local, state and federal law enforcement agencies in an efficient manner. To accommodate this need, Sprint has developed the Sprint CALEA Delivery System (CDS). Located in Lee’s Summit, Missouri, the CDS was developed to permit access to all Sprint internal wireless and wireline networks. It’s sole purpose is to provide law enforcement a single point of access to their surveillance data regardless of the Sprint product or target’s geographic location.

4.1 J-STD-025 Delivery Options

Sprint allows for two methods of obtaining surveillance data from the Sprint CALEA Delivery System: Secure Virtual Private Network (VPN) and Private Line Circuit

11/13/2002 1:21 PM Page 11 of 11

Sprint CALEA Delivery System

4.1.1 Secure Virtual Private Network (VPN) Sprint CALEA IP VPN product suite offers law enforcement a cost-effective and flexible access solution that matches the security of a private line. Please allow a minimum of 30 days for VPN Delivery

• Fully Managed VPN connectivity • Customer Managed IP VPN service

Fully Managed CALEA IP VPN Service Sprint provides an industry leading, comprehensive IP VPN Solution using innovative technology and expert support. We implement your IP VPN solution and deliver real results:

• IP VPN technology provides you with a high quality, secure data networking solution. • Sprint provides everything you need with industry-best connectivity options and

management. • Sprint delivers the highest levels of security experience and management services.

11/13/2002 1:21 PM Page 12 of 12

Sprint's Managed IP VPN solution is designed to meet the needs of any law enforcement agency, whether or not they have any existing network infrastructure or expertise. Sprint will provide, configure, and manage a complete solution. The standard IP VPN implementation will have the following components:

• Nortel Networks Contivity 600 IP VPN hardware to purchase or lease. • Optional V.35 (T1) WAN Interface on Contivity for a direct Internet connection • Hardware installation, configuration, and maintenance • 24x365 Contivity device monitoring and management

Sprint can also provide dedicated internet access. Requirements Internet access must be dedicated. No dial-up access allowed. The Contivity 600 must have 2 public routable IP addresses. The Collection Device must have a public routable IP address. PROS: Fully managed by Sprint on a proactive basis. A single point of contact for all troubleshooting issues. Immediate response and customer support. Available security expertise. Top grade connection reliability. Sprint can also manage any other tunnels on that Contivity device if desired. Fully secure connection. Undetectable from any outside snooping. CONS: More expensive than the Customer Managed IP VPN Service. Customer Managed IP VPN Service Many law enforcement agencies may already own a Nortel Contivity device for their CALEA access and have the technical expertise available to provide local management. Sprint offers support of a “co-managed” environment where Sprint will maintain and operate the Sprint CDS environment while law enforcement will own and maintain it’s equipment. Requirements Law Enforcement must own a Nortel Contivity VPN device. Internet access must be dedicated. No dial-up access allowed. The Collection Device must have a public routable IP address. PROS: Less expensive Full customer control of their network and VPN environment. Fully secure connection. CONS: Higher risk of outage due to configuration errors of other law enforcement VPN devices. Sprint troubleshooting capabilities restricted to one-half of the VPN tunnel. To ORDER Sprint CALEA IP VPN: Ask for CALEA IP VPN

NOTE: Please allow a minimum of 30 Days for Sprint VPN Delivery

Call Stephen Grimm at 913-315-7682

11/13/2002 1:21 PM Page 13 of 13

4.1.2 Private Line Circuit Sprint recognizes that some law enforcement agencies will want their own dedicated circuit for their surveillance activities. As a result, Sprint will allow the following circuits to be terminated at the Lee’s Summit Data Center facility: Maximum: T1 Minimum: Frame Relay (56k minimum. It is recommended for 128K or higher) **Note: No ISDN circuits allowed. Terminating Circuit Equipment Due to space and management limitations, Sprint can only allow the following equipment in the Lee’s Summit Data Center circuit room:

• A rack-mountable Cisco 26xx router that is no more than 1 unit high with an internal CSU/DSU modem card.

Please Note: Space at the Lee’s Summit Data Center is limited. As a result, rack space is at a first-come-first-serve basis. Prior to ordering a circuit, please contact Corporate Security.

Equipment Management Since the Sprint CALEA Delivery System is located at the very core of Sprint’s network, law enforcement will not be allowed access to any of their terminating circuit equipment (router). As a result, Sprint will allow two environments for managing the law enforcement routers: Law Enforcement Managed • All law enforcement owned equipment must be pre-configured and shipped to the Lee’s Summit Data

Center. • Sprint will only be responsible for providing power, rack mounting and plugging in network cables to the

router. • Sprint will not manage this equipment or the corresponding circuit. In the event of a failure, it is strictly the

responsibility of law enforcement to provide a response. • In the event of a failure, Sprint will only provide troubleshooting capabilities to the last element of the shared

Sprint network. • It is the responsibility of law enforcement to take the necessary security precautions for their own

network(s). • For hands-on management, Sprint will ship the equipment in law enforcement provided boxes to whatever

location law enforcement determines. • Law enforcement must use only publicly routable IP addressing. No private addresses will be used. Vendor Managed Many law enforcement agencies may find it difficult to manage their own equipment at the Lee’s Summit Data Center. Sprint offers the services of three long and trusted vendors that have assisted Sprint in many critical network projects. A Sprint-approved vendor will have the ability to: • Get escorted access to the law enforcement equipment at the Lee’s Summit Data Center. • Provide 7x24 response to all access failure events. • Pro-actively monitor the end-to-end health of the law enforcement connection. • Assist in any other networking or security needs. Please review the attached pamphlets provided by the approved vendors: Tri-Tek 314-275-7900 Getronics 978-858-6083 Netcadence 913-451-6999 Note: Sprint does not have any business arrangements with any of the approved vendors for this CALEA project. Any services, pricing or other agreements are strictly between the law enforcement agency and their selected vendor.

11/13/2002 1:21 PM Page 14 of 14

4.1.3 SINS The Sprint Integrated Network Surveillance (SINS) solution will continue until December 2, 2002 to provide those law enforcement agencies that have yet to install a CALEA solution. Data from a CALEA compliant Sprint switch may look a bit different, but it will still be available for a limited time via a dial-up or Internet connection. Please note: The SINS website will be retired on December 2, 2002. All law enforcement agencies requiring surveillance from Sprint must convert to the CALEA compliant equipment to receive electronic surveillance data. 4.2 LAES messages and Serving System list The table below explains the CALEA messages you will see from our CALEA Delivery System. Answer Acknowledges a call attempt associated with the target has been

answered CC Close Reports end of call content delivery CC Open Triggers when circuit mode call content delivery begins Change Reports a change in circuit mode call identities, especially when

merging or splitting calls Origination Reports a call origination attempt (outgoing) Packet Envelope Conveys data packets over the CDC as they are detected Redirection Reports a target termination attempt has been redirected Release Reports the release of the resources used for a circuit mode call Serving System Identifies the TSP authorizing and/or providing service Termination Attempt Reports a call termination attempt Connection Test A manually triggered message intended for link validation J-STD Message Example Message Type: Originate CaseIdentity: Example4838 IAPSystemIdentity: 4139-10-0 (See next page for reference list) Date Stamp: 20021025 Time Stamp: 101510.285-0600 CallIdentity: sequenceNumber: 131086 calling_PartyIdentity: esn: fe643ad7 min: 9131234838 dn: 9131233796 userInput: 9135434251 Location: 10 TransitCarrierIdentity: 0177 BearerCapability: speech

11/13/2002 1:21 PM Page 15 of 15

CALEA IAP (Intercept Access Point) Switch Reference List for J-STD messages

Switch Name MSCID ESID Vendor Hor-Waynesboro 1 04379-03 0-3-4379 Nortel Hor-Charleston 1 1760-01 0-1-1760 Lucent Global Roam 31103-200 0-8-31103 Tekelec LAU-Montgomery 1 4103-01 0-1-4103 Nortel Brm-Birmingham 1 4103-21 0-5-4103 Nortel Bos-Wapole 1 4106-01 0-1-4106 Lucent Bos-Woburn 1 4106-02 0-2-4106 Lucent Bos-Woburn 2 4106-03 0-3-4106 Lucent IWO-Albany 2 4106-04 0-4-4106 Lucent IWO-Londonderry 1 4106-06 0-6-4106 Lucent Con-Wallingford 3 4106-07 0-7-4106 Lucent Bos-Walpole 2 4106-08 0-8-4106 Lucent NY-Manhattan T1 4106-10 0-10-4106 Lucent Roc-Rochester 1 4107-01 0-1-4107 Lucent Buf-Cheektowaga 1 4107-02 0-2-4107 Lucent NY-Westbury T1 4107-10 0-10-4107 Lucent Dal-Fort Worth 2 4120-06 0-6-4120 Nortel Dal-Dallas 1 4120-61 0-13-4120 Nortel Aus-Austin 1 4120-62 0-14-4120 Nortel Dal-Fort Worth 1 4120-63 0-15-4120 Nortel Dal-Dallas 2 4120-64 0-0-4120 Nortel Ala-Lubbock 1 4120-66 0-2-4120 Nortel Aus-Austin 2 4120-68 0-4-4120 Nortel Den-Englewood 1 4121-01 0-1-4121 Lucent Den-Englewood 2 4121-04 0-4-4121 Lucent Ala-Colorado Springs 1 4121-60 0-12-4121 Nortel Dsm-Urbandale 1 4124-31 0-15-4124 Nortel Det-Detroit 1 4126-01 0-1-4126 Lucent Det-Detroit 2 4126-02 0-2-4126 Lucent Lan-Lansing 1 4126-05 0-5-4126 Lucent Hon-Moanalua 1 4132-69 0-5-4132 Nortel Ubq-Evansville 1 4135-01 0-1-4135 Lucent Ind-Indianapolis 1 4135-31 0-15-4135 Nortel KC-Lenexa 1 4139-41 0-9-4139 Nortel KC-Lenexa 2 4139-42 0-10-4139 Nortel KC-Independence 1 4139-43 0-11-4139 Nortel Lit-North Little Rock 1 4144-41 0-9-4144 Nortel SD-San Diego 1 4145-01 0-1-4145 Lucent LA-Irvine 1 4145-02 0-2-4145 Lucent LA-Irvine 2 4145-03 0-3-4145 Lucent LA-Burbank 1 4145-04 0-4-4145 Lucent LA-Ontario 1 4145-05 0-5-4145 Lucent LV-Las Vegas 4145-06 0-6-4145 Lucent SD-Carlsbad 1 4145-07 0-7-4145 Lucent

11/13/2002 1:21 PM Page 16 of 16

LA-Burbank 2 4145-08 0-8-4145 Lucent Ubq-Reno 1 4145-12 0-12-4145 Lucent LA-Ontario 2 4145-13 0-13-4145 Lucent LA-Sante Fe Springs 1 4145-15 0-15-4145 Lucent Lou-Louisville 1 4148-21 0-5-4148 Nortel Mia-Miami 1 4151-21 0-5-4151 Nortel Mia-Deerfield Beach 1 4151-22 0-6-4151 Nortel Mia-Miami 2 4151-25 0-9-4151 Nortel Mil-New Berlin 1 4153-01 0-1-4153 Lucent Ala-Appleton 1 4153-02 0-2-4153 Nortel Nor-St. Cloud 1 4155-05 0-5-4155 Nortel Min-Minneapolis 1 4155-31 0-15-4155 Nortel Min-Minneapolis 2 4155-32 0-0-4155 Nortel Swf-Brookings 1 4155-34 0-2-4155 Nortel Nas-Nashville 1 4157-21 0-5-4157 Nortel NO-Kenner 1 4159-41 0-9-4159 Nortel NY-Teterboro 1 4162-01 0-1-4162 Lucent NY-Westbury 1 4162-02 0-2-4162 Lucent NY-Westbury 2 4162-03 0-3-4162 Lucent Con-Wallingford 1 4162-04 0-4-4162 Lucent IWO-Albany 1 4162-05 0-5-4162 Lucent NY-Teterboro 2 4162-08 0-8-4162 Lucent NY-Manhattan 2 4162-10 0-10-4162 Lucent NY-Manhattan 1 4162-12 0-12-4162 Lucent Con-Wallingford 2 4162-14 0-14-4162 Lucent NY-Branchburg 1 4162-15 0-15-4162 Lucent OKC-Oklahoma City 1 4164-41 0-9-4164 Nortel SW-Oklahoma City 1 4164-43 0-11-4164 Nortel Oma-Omaha 1 4166-51 0-3-4166 Nortel Phl-Philadelphia 1 4168-01 0-1-4168 Lucent Phl-Philadelphia 2 4168-04 0-4-4168 Lucent Phl-Pennsauken 1 4168-08 0-8-4168 Lucent Phx-Phoenix 1 4170-01 0-1-4170 Lucent Phx-Phoenix 2 4170-02 0-2-4170 Lucent Ala-Phoenix 1 4170-04 0-4-4170 Nortel Pit-Pittsburgh 1 4171-01 0-1-4171 Lucent Pit-Pittsburgh 2 4171-02 0-2-4171 Lucent Prt-Tigard 1 4174-01 0-1-4174 Lucent Prt-Tigard 2 4174-02 0-2-4174 Lucent SLC-Salt Lake City 1 4180-01 0-1-4180 Lucent RGV - McAllen 1 4181-44 0-12-4181 Nortel SA-San Antonio 1 4181-61 0-13-4181 Nortel SA-San Antonio 2 4181-62 0-14-4181 Nortel Ala-Laredo 1 4181-69 0-5-4181 Nortel SF-Brisbane 1 4183-02 0-2-4183 Lucent SF-Brisbane 2 4183-03 0-3-4183 Lucent SF-Oakland 1 4183-04 0-4-4183 Lucent Sac-Sacramento 1 4183-05 0-5-4183 Lucent

11/13/2002 1:21 PM Page 17 of 17

SF-Santa Clara 1 4183-08 0-8-4183 Lucent SF-Santa Rosa 1 4183-09 0-9-4183 Lucent CWP-Fresno 1 4183-14 0-14-4183 Lucent SD-Carlsbad 2 4183-15 0-15-4183 Lucent Sea-Redmond 1 4186-01 0-1-4186 Lucent Sea-Redmond 2 4186-02 0-2-4186 Lucent WOW-Beaver Creek 1 4186-08 0-8-4186 Lucent Ubi-Spokane 1 4188-01 0-1-4188 Lucent Ubq-Boise 1 4188-02 0-2-4188 Lucent RW-Jefferson City 1 4190-12 0-12-4190 Lucent Stl-Maryland Heights 1 4190-41 0-9-4190 Nortel Stl-Maryland Heights 2 4190-42 0-10-4190 Nortel DC-Hanover 1 4195-01 0-1-4195 Lucent DC-Beltsville 1 4195-02 0-2-4195 Lucent DC-Beltsville 2 4195-03 0-3-4195 Lucent DC-Beltsville 3 4195-06 0-6-4195 Lucent She-Edinburgh 1 4195-08 0-8-4195 Lucent Geo-Macon 1 4274-01 0-1-4274 Lucent Ent-Columbus 1 4274-18 0-2-4274 Lucent Atl-Roswell 1 4274-21 0-5-4274 Nortel Atl-Roswell 2 4274-22 0-6-4274 Nortel Atl-Norcross 1 4274-23 0-7-4274 Nortel Ala-Albuquerque 1 4274-60 0-12-4274 Nortel Ala-El Paso 1 4274-68 0-4-4274 Nortel GLF-Baton Rouge 1 4304-01 0-1-4304 Lucent Air-Greenville 1 4376-01 0-1-4376 Lucent Air-Columbia 1 4376-02 0-2-4376 Lucent Air-Columbia 2 4376-03 0-3-4376 Lucent Air-Greenville 2 4376-08 0-8-4376 Lucent Ral-Morrisville 1 4376-22 0-6-4376 Nortel Chr-Charlotte 1 4376-26 0-10-4376 Nortel Chi-Bridgview 2 4384-01 0-1-4384 Nortel Ill-Kentwood 1 4384-06 0-6-4384 Lucent Ill-Davenport 1 4384-08 0-8-4384 Nortel Chi-Aurora 1 4384-12 0-12-4384 Nortel Chi-Arlington 1 4384-32 0-0-4384 Nortel Ill-Gridley 1 4384-34 0-2-4384 Nortel Chi-Bridgeview 1 4384-36 0-4-4384 Nortel Chi-Arlington 2 4384-39 0-7-4384 Nortel Hor-Ft. Wayne 1 4389-03 0-3-4389 Nortel Hor-Erie 1 4389-04 0-4-4389 Nortel Hor-Johnson City 1 4389-06 0-6-4389 Nortel Hor-Chillicothe 1 4389-10 0-10-4389 Motorola Cin-Sharonville 1 4390-37 0-5-4390 Nortel Clv-Cleveland 1 4396-38 0-6-4396 Nortel Col-Worthington 1 4418-39 0-7-4418 Nortel Hou-Fallstone 2 4622-04 0-4-4622 Nortel Hou-Vantage 1 4622-65 0-1-4622 Nortel

11/13/2002 1:21 PM Page 18 of 18

Hou-Vantage 2 4622-66 0-2-4622 Nortel Hou-Fallstone 1 4622-67 0-3-4622 Nortel Jax-Jacksonville 1 4654-21 0-5-4654 Nortel Knx-Knoxville 1 4694-24 0-8-4694 Nortel LAU-Jackson 1 4812-01 0-1-4812 Lucent Mem-Memphis 1 4812-41 0-9-4812 Nortel Ric-Richmond 1 4982-23 0-7-4982 Nortel FM-Ft. Myers 1 5116-02 0-2-5116 Nortel Orl-Orlando 2 5116-20 0-4-5116 Nortel Orl-Orlando 1 5116-27 0-11-5116 Nortel Tam-Tampa 1 5116-28 0-12-5116 Nortel PR-Bayamon 1 5142-20 0-4-5142 Nortel SM-Santa Maria 1 5186-01 0-1-5186 Lucent LAU Shreveport 1 6082-01 0-1-6082 Lucent LAU Shreveport 2 6082-02 0-2-6082 Lucent

11/13/2002 1:21 PM Page 19 of 19

4.3 Audio Delivery Options Sprint will not allow dedicated lines to any of its switching facilities. For ease of use and a true cost reduction solution, Sprint will automatically dial any validated law enforcement phone number in the North American dial plan for each Title III surveillance. In anticipation, each Title III demand must come with a dialed number to send the audio and a request for either a combined or separated calling party audio channel delivery. This information is requested on the CALEA fax coversheet. Failure to provide such information can only result in delayed surveillance provisioning. 4.4 Cell Site Sectors

The face of the cell appears as an X, Y, or Z in Nortel CALEA records. It does not appear in Lucent CALEA Records. In the Call Detail Report, the face of the cell is designated as 1,2,or 3 in the Nortel market and 2,3,and 4 for the Lucent Market for Alpha, Beta, and Gamma respectively.

Alpha 0 degrees North Nortel X

Gamma 240 Southwest Nortel Z

Beta 120 Southeast Nortel Y

11/13/2002 1:21 PM Page 20 of 20

5. Call Detail Report explanation (0,1,2,3) & *codes

Call Detail or Viador reports are sent only in Emergency situations or in

instances when Pen Register data was not sent to Law Enforcement due to a problem

on the Sprint Network. They are not sent for the convenience of Law Enforcement. Key to Understanding Viador Reports

Column A: Calling number. This column reflects the number placing the call. If the call is outgoing, this will be the Sprint PCS number. Column B: Called number. This column reflects the number actually sent. In most cases this number will be the same as the number in Column C. If the number has been forwarded, or if there is a routing number, then this will be reflected. Column C: Dialed digits. This column reflects the number that the caller enters into the keypad of the phone. If the call is incoming, this will be the Sprint PCS phone. Column D: M R# -Mobile Role (Type of Call). See key in lower left-hand corner of

report Column E: Start date and time. Column F: End date and time. Column G: Duration of call in seconds. Column H: Repoll number. This reflects which switch is being used. In cities such

as New York, Boston, and St. Louis, where there are multiple switches, this is very important. In the header of the cell site listings the correlating repoll numbers are listed.

Column I: Specific cell site in which the call was initiated. The last 3 digits

represents the cell site number. The first digit reflects the sector. (See attached “Three Sector Layout” page for sector orientation) For example, if the number in the column reads 2083, the cell site is 083 and the sector is 2.

Column J: Specific cell site in which the call was terminated

11/13/2002 1:21 PM Page 21 of 21

Star Codes

(The Star key (*) shows up as the letter B on all Viador reports)

*18- ping the nearest tower, call delivery activate *180-Call delivery deactivate *2- Customer Care *3- Payment Center *31- Three Way Calling *4- Account information *5- Spanish Customer care *67- Caller ID block *68- Override caller ID block *70- Cancel call waiting for that call *711-Customer Care *72- call forwarding *720- clears call forwarding *73-Call forwarding no answer *74-Call forward busy *811-Customer Care *82- Override caller ID block- for that call *911- 911 *073- Cancel call forward no answer *074- Cancel call forward busy 411-Directory assistance 611-Customer Care 711-Telecommunications Relay Service(hearing impaired) 911 (can also dial 911,0911,1911) C777-Web Browsing

11/13/2002 1:21 PM Page 22 of 22

6. Hotline info

When a subscriber has gone over his minutes, failed to make a payment, or is past due, Sprint will “hotline” the phone and it will temporarily be shut off due to lack of payment. Corporate Security has no control over this. The phone will be shut off until the subscriber makes a payment. The Sprint Fraud Department also reserves the right to Hotline a phone at any time for reasons of suspected fraud. If Law Enforcement wants to takeover the account to avoid a future shut off then charges will apply and a “takeover” processing fee will apply (see fee schedule for charges).

7. Voicemail

Stored Voicemail: Sprint PCS subscriber voicemail capacity is: a maximum of 30 voicemail messages with a maximum length per message of 4 minutes. The maximum total mailbox length of 2 hours. If the voicemail has reached capacity, no new messages can be added. Saved messages are deleted after 30 days and unsaved messages are deleted after 20 days from the date they are received. In order to access stored voicemail, the subscriber’s password must be reset/changed by Sprint. When the password is changed, the subscriber will not be able to access his/her voicemail and this procedure is not transparent to the subscriber. The fee for Sprint to reset/change the subscriber’s password in order for LEA to access the subscriber’s voicemail and download the stored communications is $150.00 per target per request. A stored voicemail authorization form, available upon request, as well as a court order or search warrant is required for stored voicemail. Ghost Voice mailbox: A ghost voice mailbox is used to capture future messages and will capture voicemail from implementation forward. A ghost voice mailbox does not capture stored voicemails prior to implementation. The fee for this service is $150 per target per court order. LEA will assign their own password to the ghost voice mailbox and Sprint will not have access to the LEA password. A Title III Court Order is required for a Ghost Voice mailbox setup.

8. PCS capabilities

Push to Talk – Much like a walkie-talkie, Push to Talk will allow the user to instantly connect to another individual or group 2G data - Sprint is currently working on capturing 2G data. All traffic originating from or terminating to the target will be duplicated by the processing Inter-Working Function (IWF). The content of these packets will not be altered by the IWF in any fashion. The IWF will forward the data to the CDCManager via IP. (CDCManager is a data collection server provided by SS8, Inc. that receives the data from multiple IWFs.) Packets under surveillance will be “encapsulated” in a J-STD-025A packet envelope record by CDCManager. The act of surveillance will be invisible to the target and all other participating parties engaged in the communication. No service degradation (from the customers point of view) will be detected. All target communications will have two additional messages provided by IWF to CDCManager signifying begin and ending dates/times of the communication. These additional messages will act as “bookends” to the packets involved in the actual

11/13/2002 1:21 PM Page 23 of 23

communication sessions. The CDCManager will format these additional messages into the approved J-STD-025A format. All data will be sent from the CDCManager to Sprint’s CALEA Delivery System (CDS) via streaming IP. The CDS will forward the data to law enforcement. 3G data - Sprint is currently evaluating methods on how to best capture 3G data. More information will be forthcoming. Wireless Local Number Portability (WLNP) FCC mandate of 11/24/02 Wireless Local Number Portability is defined in the Telecommunications Act of 1996 as “the ability of users of telecommunications services to retain, at the same location, existing telecommunications numbers without impairment of quality, reliability, or convenience when switching from one telecommunications carrier to another”

Number portability provides end-users the capability to change service providers, location, and/or service type without having to change their phone number.

Questions?

Call Sprint Corporate Security at 800-877-7330 Option 2, Option 2, Option 4 Or email us at Sprint.CALEA@mail.sprint.com

(request to be on our email announcement list)