You need a bounty of 1000 in each of the following holds, all at the same time:
Falkreath (Falkreath)
Whiterun (Whiterun)
Morthal (Hjaalmarch)
Dawnstar (The Pale)
Winterhold (Winterhold)
Solitude (Haafinger)
Riften (The Rift)
Markarth (The Reach)
Windhelm (Eastmarch)
The two easiest ways to achieve 1000 bounty right away is either to kill a guard or turn into a werewolf. Just remember to run away so you don\'t get caught or accidently kill any witnesses, which will remove the bounty.
If you don\'t get a bounty in Winterhold (outside), simply go into the Jarls house and kill the guard there.