Cellphone Carriers Retain Customer Data for Up to 7 Years

A leaked document from the Justice Department intended for law enforcement officials describes the length of time major cellphone companies retain sensitive customer data, including text message details and content.

Wired magazine reported that T-Mobile keeps a list of users’ text message recipients for up to five years and AT&T  for up to seven years, according to the Department of Justice (DOJ) document dated August 2010.

Wired lists the retention periods of other carriers’ data, such as who keeps call detail records the longest (AT&T: up to seven years) and post-paid bill copies the longest (AT&T and Sprint: up to seven years).

Verizon Wireless is the only carrier that keeps text contents, although for three to five days.

The document, entitled “ Retention Periods of Major Cellular Service Providers,” was obtained by the American Civil Liberties Union in North Carolina through a Freedom of Information Act request.

Laura Sweeney, spokeswoman for the Justice Department, said the document was drafted “to assist agents and prosecutors, often engaged in time-sensitive matters, in understanding which providers may even plausibly have the records they seek and ensures they don’t waste valuable time seeking the necessary authorizations for records that don’t exist anymore.”

She said communications records, obtained through the legal process mandated by the Electronic Communications Privacy Act, can be “critical” to criminal and national security investigations, as are bank records, tax returns and other forms of documentation.

“Cell phone records, for example, can help investigators determine with whom a known violent gang member is conspiring to commit crimes, by obtaining records of what phones he has called from his cell phone,” she said in an email. “Similarly, if there is reason to believe that someone has taken illegal sexual pictures of children with a phone and distributed them to others, records kept by the communications provider can help to identify that pedophile.”

Jeffrey Nelson, a Verizon Wireless spokesman, said in an email to ABC News that the company would not comment on the details in the report.

But, he said, “Verizon Wireless keeps data for various periods of time in order to provide services to our customers, including responding to customer inquiries about their own accounts.  We take the privacy of our customers very seriously, and have policies and procedures in place to safeguard customer information.”

Mark Siegel, a spokesman for AT&T,  said the company addresses data retention in its privacy policy.

AT&T’s privacy policy states the company retains personal information (including name, address, telephone number, email address, Social Security number and financial account number) “only as long as needed for business, tax or legal purposes, after which we destroy it by making it unreadable or undecipherable.”

Its privacy policy says it may provide personal information to non-AT&T companies or other third parties for purposes such as responding to 911 calls and other emergencies; complying with court orders and other legal process; assisting with identity verification, and to prevent fraud and identity theft; enforcing AT&T’s agreements and property rights; and “obtaining payment for products and services that appear on your AT&T billing statements, including the transfer or sale of delinquent accounts to third parties for collection.”

Jason Gertzen, a spokesman for Sprint, said the company “respects and protects the privacy and security of the personal information of our customers.”

“Responding to public safety or law enforcement requests is not unique to Sprint. We act as good stewards of our customers’ personal information while also meeting our obligations to law enforcement agencies,” he said in an email to ABC News. “Different categories of data are retained for varying lengths of time depending on the type and sensitivity of data, the applicable laws and regulations governing the retention of such data and the business purpose of the data.”

T-Mobile did not immediately return a request for comment.