[omgitstom]

TL;DR

Twitter gave the police information about the phone number which registered the account that sent the seizure-triggering gif

AT&T gave the police information that is was a Tracfone prepaid account with an associated toll record that was an iphone

Apple gave them access to his cloud account which had all the incriminating details needed including email / picture of him with his drivers license and data about the victim

[colmvp]

It should be noted that in the document, Twitter and Apple were provided search warrants whereas AT&T received a "request."