Document shows how phone cos. treat private data

A document obtained by the ACLU shows for the first time how the four largest cellphone companies in the U.S. treat data about their subscribers' calls, text messages, Web surfing and approximate locations.

The one-page document from the Justice Department's cybercrime division shows, for instance, that Verizon Wireless keeps, for a year, information about which cell towers subscriber phones connect to. That data that can be used to figure out where the phone has been, down to the level of a neighborhood. AT&T has kept the same data continuously since July 2008.

The sheet is a guide for law enforcement, which can request the information from the carriers through legal channels. The North Carolina section of the American Civil Liberties Union obtained it through a Freedom of Information Act request, the ACLU said. Wired.com reported earlier about the document, which is dated Aug. 2010.

The document was released by the ACLU Wednesday, but has been hiding in plain sight on the website of the Vermont public defender's office. It can be found there through a Google search, but only if the searcher knows the exact title of the document.

A few data points from the sheet were known outside law enforcement circles, but wireless carriers have not been open about their policies. They aren't required to keep the data, and they keep the same information for varying lengths of time. Some don't keep data at all that other companies store. For instance, it says T-Mobile USA doesn't keep any information on Web browsing activity. Verizon, on the other hand, keeps some information for up to a year that can be used to ascertain if a particular phone visited a particular Web site.

According to the sheet, Sprint Nextel Corp.'s Virgin Mobile brand keeps the text content of text messages for three months. Verizon keeps it for three to five days. None of the other carriers keep texts at all, but they keep records of who texted who for more than a year.

The document says AT&T keeps for five to seven years a record of who text messages who -and when, but not the content of the messages. Virgin Mobile only keeps that data for two to three months.

The carriers don't have recordings of calls, but keep information about calls that are made and received for at least a year.

The ACLU said it believes people have a right to know how long phone companies keep records of their activities.

Although the sheet is dated August 2010, Tom Slovenski, a private investigator specializing in cellphone data, said it is still accurate.

Sprint spokesman Jason Gertzen said he couldn't comment on the specific figures in the sheet. Normally, he said, a subpoena, court order, or customer consent form from a recognized law enforcement agency is necessary for the carrier to hand out data. However, Sprint also responds to emergency requests, as in missing persons cases, if the police can document their need, he said.

The Department of Justice did not immediately respond to a request for comment.

A bill in Congress would force wired Internet service providers to keep records of the network addresses assigned to each subscriber for 18 months. That would help investigators link online activity to specific homes. But the bill doesn't apply to wireless links. A series of such bills have been proposed over the years, but haven't passed.