What records might a telecommunications provider hold?¶

A telephone number or SIM may be central to an investigation.

Evidential caution: that the telecommunications provider can identify the user and supply the content of every communication.

What this means¶

A provider may hold subscriber and account details, billing information, telephone-number allocation, SIM and eSIM records, IMSI and ICCID associations, device identifiers, porting history and customer-service activity.

It may also hold communications data showing calls, SMS events, data sessions, routing or network connections.

The precise records depend on the service, legal basis, system and retention period.

Provider records may identify the subscriber or account holder without identifying the person who actually used the number or device.

For SMS, the provider may record transmission events without retaining readable message content. For internet messaging, the mobile provider may see data connectivity without seeing the application content.

In reports, separate subscriber information, network events, device association and personal attribution.

Where the scope is disputed, record why each requested field is relevant to the investigative question.

What to check or do next¶

• Preserve the number in full international format, relevant date range, provider, SIM identifiers and device identifiers where available.
• Check whether the number was ported or reassigned. Different providers may hold records for different periods.
• Ask for the original fields and definitions, not only a narrative summary.
• Compare provider records with handset data, messaging-account records, possession, location and witness evidence.
• Preserve the source and collection method so another investigator can test the same interpretation.