What Your Phone Number Gives the Government: A Federal Prosecutor’s Three Tools

A phone number is not contact information. In the hands of a federal prosecutor it is a key that opens your legal identity, months of your movement history, and a map of everyone you talk to — and two of those three doors open without a warrant.

That is not a theory. A former federal prosecutor laid out all three methods on camera, in order, using the word she meant: standard. Below is what she described, what the statutes actually say in Texas and in federal court, and the one of the three that the Supreme Court decided the Fourth Amendment reaches.

What the Prosecutor Said on Camera — All 3 Methods, in Order

The clip opens with a former federal prosecutor describing, without hedging, the three things she did with a target’s 10-digit phone number before that target knew an investigation existed. She is not describing a loophole. Every one of the three is a documented, routine step with its own statute and its own paperwork.

Method 1 — The carrier subpoena that returns your identity

“I subpoenaed your carrier with nothing but your phone number,” she says. What came back: legal name, billing address, account start date, and every other number on that account. She then cross-referenced those against financial accounts and social profiles registered to the same number. Her summary: one number, complete identity profile before you even knew you were a target.

Method 2 — Months of cell-site location data

Every time a phone registers with a tower, the carrier logs the tower, the timestamp, and often the sector direction. Pulled in bulk, that log is a movement map: where you work, where you sleep, and whether you were within a few hundred meters of a crime scene at 11:42 p.m. on a Tuesday. In the actual Carpenter case, the FBI obtained 12,898 location points covering 127 days from one man’s carrier records.

Method 3 — A pen register on your live call traffic

The third tool is real-time. A pen register and its mirror image, a trap and trace device, capture the numbers dialed from and to your phone and the time of each connection — not a word of what was said. She calls it “real-time access to your network.” That is the correct description: it builds the association chart, not the transcript.

Method 1 in the Statute Books: A Subpoena, Not a Warrant

The first tool is the one most people assume requires a judge. It does not. Under the Stored Communications Act, 18 U.S.C. § 2703(c)(2) lets the government compel a provider to hand over a specific list with nothing more than an administrative, grand jury, or trial subpoena: your name, address, local and long-distance connection records, session times and durations, length and types of service, telephone number or device identifier, and the means and source of payment — including any credit card or bank account number on file.

Why the billing record is the most underrated item on that list

That last item is the quiet one. A payment method ties your phone to a bank, a bank ties to an address and a signature, and the signature ties to everything else. That is the cross-referencing step she described, and none of it requires probable cause. Contrast it with the phone itself: under Riley v. California, 573 U.S. 373 (2014), police generally need a warrant to search the data inside a phone they have already seized from an arrested person. The record about your phone gets far less protection than the phone.

Texas has its own version, and it is broader than most people expect

Texas codified the same structure in Code of Criminal Procedure Chapter 18B. Article 18B.351(b) allows an authorized peace officer to require a provider to disclose data “revealing the identity of customers” and information about a customer’s use of the service without giving the subscriber any notice — by administrative subpoena, grand jury subpoena, court order, warrant, or consent. Article 18B.451 goes further and names who can sign that administrative subpoena directly: the director of the Department of Public Safety or a designee, the inspectors general of the Texas Department of Criminal Justice and the Texas Juvenile Justice Department, or the sheriff or police chief of a designated agency. No judge is in that sentence.

Method 2 Is the One That Requires a Warrant — Because of One 2018 Case

In Carpenter v. United States, 585 U.S. 296 (2018), the Supreme Court held 5–4 that acquiring historical cell-site location information is a Fourth Amendment search and ordinarily requires a warrant supported by probable cause. Before Carpenter, the government took the position that records held by your carrier were the carrier’s business records and carried no privacy interest at all. The Court rejected that for location specifically, calling the resulting record a “detailed chronicle of a person’s physical presence.”

The 7-day line the opinion actually drew

Read the holding narrowly, because the Court wrote it narrowly. The government in that case obtained seven days or more of location data, and the Court expressly declined to decide whether a shorter pull is a search. It also carved out exigent circumstances — an active shooter, a kidnapping, a bomb threat — along with real-time tower pings and traditional surveillance techniques. Carpenter is a warrant rule for long-range location history, not a general rule that carrier records are private.

What that looks like in a Texas case

In Texas the mechanism is Article 18B.354, which lets a district judge issue a warrant for electronic customer data held by a provider on a showing of probable cause — expressly including data physically stored outside Texas. So when a prosecutor says she used location data to build a timeline, the correct follow-up is not can she do that. She can. The question your lawyer asks is what the affidavit said, whether the probable cause in it was real, and whether the date range on the order matched the date range the carrier actually produced.

Method 3 Needs No Probable Cause at All — Just a Certification

The pen register is the tool with the lowest bar of the three, and almost nobody outside the system knows it. Under 18 U.S.C. § 3122(b)(2), a federal prosecutor does not have to establish probable cause or even reasonable suspicion. The application has to certify that the information likely to be obtained is relevant to an ongoing criminal investigation. If the certification is on the paper, § 3123(a)(1) says the court shall enter the order. The judge is not weighing the evidence; the judge is confirming the certification exists.

60 days, and then another 60

A federal pen register order runs up to 60 days, with extensions of up to 60 days each under § 3123(c). Texas mirrors it: Article 18B.104 caps an order at 60 days from installation or the 10th day after entry, whichever is earlier, renewable in 60-day increments — and stretchable to a full year with the subscriber’s consent. Article 18B.101 covers the pen register and ESN reader; 18B.102 covers the trap and trace side. Under § 3123(d) the carrier is ordered not to tell you, so a year of your call patterns can be charted while your service looks completely normal.

What to Do If You Think Your Number Is Already in a File

Almost everyone in this situation finds out the same way: an agent calls, or knocks, and asks a few friendly questions that sound like they have nothing to do with you. By then the subpoena has already been returned. Five things matter from that moment.

• A contact is not the start of the investigation — it is a later chapter. Subscriber records come back from most major carriers in days to a few weeks. If they are talking to you, the paper usually came first.
• Say one sentence and stop. “I’m not answering questions without my attorney.” You do not have to explain, justify, or soften it, and nothing you add after that sentence helps you.
• Do not consent to anything. Consent is the cheapest tool in the box — it substitutes for the probable cause a warrant would have required, and it cannot be withdrawn after the data is copied.
• Do not wipe, reset, or hand off the phone. Deleting data after you know about an investigation is its own federal exposure under the obstruction statutes, and it does nothing to the carrier-side records that are already produced.
• Write down the date, the agency, and every name and number on the card. Which agency asked, and when, determines which statute governs and whether the date ranges on the order line up.

Where the real defense happens

None of these three tools is challenged on the street. They are challenged later, on paper — in the affidavit behind the warrant, in the date range on the production, in whether an agency used a 60-day pen register order to collect something it should have gotten a probable-cause warrant for. That work requires seeing the file, which requires a lawyer in the case. BJ Kemp is licensed in Texas and Michigan and handles matters where somebody’s records got pulled before they knew there was a case. If a badge has your number, the first call should be to a lawyer, not back to the agent.

The related fraud problem

These same records cut the other way, too. When you are the victim — when somebody used a phone number to run a romance or impersonation scam against you — subscriber and connection records are frequently the only thread that leads anywhere, and they age out of a carrier’s retention window fast. Speed matters in both directions.

Frequently Asked Questions