FBI 2011 Domestic Investigations and Operations Guide- Post Cut Through Dialed Digits

fr?A' - if?? It . . .. h-U? 18.6.9.10 (U) Posr CUT-THROUGH. Drawn DIGITS 18.6.9.10J (U) OVERVIEW Telecommunication networks provide users the ability to engage in extended I dialing and/or signaling (also known as "post cut-through dialed digits" or which to some circumstances are simply call-routing information and. in others, are call content. [for example, non-content may be generated when a party places a calling card, credit card, or collect call by ?rst dialing a long-distance carrier access number and then, after the initial call is ?cut through,? dialing the telephone number ofthe destination party. In other instances. may represent call content. such as when a party calls an automated banking service and enters an account numbers calls a pharmacy?s automated prescription refill service and enters prescription information, or enters a call-back number when prompted by a voice mail service. See United States Telecom Assn v. Federal Communications Commission. 227 F.3d 450, 462 (DC. Cir. 2000). After the initial "cut?through,? a pen register and the equipment that supports it cannot tell the difference between digits that are dialed to connect a call and those that would otherwise be considered content. The de?nition of both a pen register device and a trap and trace device provides that the information collected by these devices "shall not include the contents of any communication." See 18 U.S.C. 3127(3) and (4). In addition. 18 U.S.C. 3l2l(c) makes ewiicit the requirement to "use technology reasonably available" that restricts the collection ?if information "so as not to include the contents of any wire or electronic communications." Tomcat" includes any information concerning the substance, purport, or meaning of a communication. See l8 U.S.C. 2510(8). When the pen register de?nition is read in .ceerjunction with the limitation provision, however, it suggests that although a device may not be used for the express purpose of collecting content, the incidental collection of content may occur despite the use of "reasonably available" technology to minimize, to the esteni feasible. any possible over collection of content while still allowing the device to .- 4 it nt?ft all of the dialing and signaling information authorized. 18-129 .. . .1 UNCLASSIFIED FOR OFFICIAL use ONLY

UNCLASSIFIED - FOR OFFICIAL USE ONLY ?18 Domestic Investigations and Operations Guide In addition to this statutory obligation. DOJ has issued a directive in the form of a DAG Memo (see below paragraph) to all DOJ agencies requiring that no. af?rmative investigative use may be made of incidentally collected that constitutes 1; content, except in cases of emergency-40 prevent an immediate danger of death. serious a physical injury, or harm to the national security Although the DAG Memo, dated May 24, 2002 on ?Avoiding Collection and investigative Use of "Content" in the Operation of Pen. Registers and Trap and Trace Devices,? as written, applies only to the issuance of criminal pen register orders pursuant to 18 U.S.C. 3121 et seq., the potential collectionof PCTD'D?content also exists for pen registers authorized under PISA. As such, the principles outlined in the DAG Memo apply to pen registers authorized pursuant to the FISA as well as pen registers authorized pursuant to Title 18 of the United States Code. In instances in which are collected pursuant to FISA. the government may not make any af?rmative investigative use of the information, even in cases of emergency. without authorization from the FISC. Any such emergency use must be recorded in the respective investigative ?les. 18. 6. 9.1 0.2 (U) COLLECTION OF When requesting pen register collection, the field of?ce case agent must af?rmatively decide whether to receive during the course of a pen register collection. If no selection is made. the default is set not to collect A) The case agent shall, consistent with Section 18.6.9.10.1, submit an electronic technical request form that states whether are to be collected?-?-?-- for example, when the order authorizes the "recording or decoding of all dialing, routing, addressing! or signaling information." This selection is accomplished by marking the "Post Cut through Dialed Digits Authorized" check box for each monitored target. 11? this selection is not made, the will not be collected or presented in any collection report. B) The case agent shall advise the technically trained agent (TTA) upon learning that a particular pen register order expressly prohibits the collection or retention of The technical agent shall then take all reasonable steps to ensure compliance with the restrictive order, including coordinating with the service provider and with OTD personnel regarding the use of technology reasonably available to avoid the collection of all 18.6. 9.10.3 (U) Us}: If information is collected pursuant to an authorized pen register, the following steps must be taken by all FBI personnel when rcviewin pen register derived information to avoid the use of the contents of communications that may be contained within the string of digits: A) Prior to examining any identify-mthrough use of administrative subpoena or other investigative means?the subscriber of the phone number to whom the initial connection was made the origination number). 1) If the origination number does not appear to be pertinent to the investigation. no examination of any associated with that initial phone number shall be made, absent an investigative need to examine the 18-130 ,1 if; ?ff; UNCLASSIFIED FOR OFFICIAL USE ONLY

UNCLASSIFIED - FOR OFFICIAL USE ONLY Domestic Investigations and Operations Guide ?13 2) If the initial connection is determined to be to a ?nancial institution as de?ned In the Right to Financial Privacy Act, 12 U.S.C. 3401(1), PCT DD may not be examined, because there is reason to believe that the may contain the contents of a communication, such as a bank account number. 3) The fact that the target called the bank. however. can be used for investigative i 0r intelligence purposes, such as to subpoena bank records associated with the target; but any cannot be used in the subpoena (such as a bank account number) or later to con?rm information received from the bank. 4) If the initial connection is determined to be an entity for which it is reasonable to believe that the PC TDD would contain dialing or signaling information, such as a calling card number. a call spoof card service, a company otherwise providing direct access to a telephone service, or a business entity, the PCT DD may be examined to identify the ultimate destination of the call, or any other associated signaling or routing information, such as a calling card PIN or calling card account number. if the initial connection is to a business entity, like a hotel, for example, the may be examined to determine if an extension number was dialed. 5) If, when examining numbers are encountered that constitute ?content? of a communication, except as provided below, those numbers may not be used for any af?rmative investigative purpose. in essence, those numbers must be treated as though they did not exist and cannot be used for any purpose. To the extent the information is included in any document for analytic or investigative use, the numbers that constitute ?content? must be redacted. B) Emergenq' Use: In an emergency, that constitutes content may be used as necessary in criminal investigations to prevent immediate danger of death, serious physical injury, or harm to the national security. In instances in which are collected pursuant to FISA, the government may not make any affirmative investigative use of the information, even in cases of emergency, without authorization from the ISC. l) approval.- In criminai investigations only. an SSA or who reasonably determines that an emergency situation exists that requires the use of content relating to the emergency, may approve the use of such without delay. 2) (UHFOUO) Noti?cation.- Within ?ve (5) business days ofsuch emergency use, the use of the particular content must be documented in an EC to the appropriate investigative ?les the investigation in which the pen register information was derived and the investigation in which it was used) with notification to the CDC and the FBI General Counsel. OGC investigative Law Unit for criminal pen registers and National Security Law Branch for PISA pen registers). 2.3.6. 9. I 0. 4 (U) WHA CONSTITUTES CONTENT FOLD) in applying the above, the term "content" is interpreted to mean ?any information - the substance, purport, or meaning of a communication? as de?ned in 18 U.S.C. 5. Questions concerning whether speci?c are content as opposed to dialing, I addressing, or signaling information should be addressed to the CDC or OGC for accident/xenon with DUI as necessary. ZititiJO} fireman}: This policy does not pertain to e-mail or Internet account pen register because such electronic communications do not generate Nor does the pertain to obtained pursuant to a Title or electronic surveillance 18-13] UNCLASSIFIED - FOR OFFICIAL use ONLY i (li'trilgi-r Quill}

- . FOR 1,.le L535 ONLY ?518 Domestic lm-?cstigations and Operations Guide because such orders authorize the interception associated with the targeted phone