The Anarchist Cookbook (53 page)

report that he had located a group of defective long-distance trunks, and to complain again

about the New Hampshire/Missouri WATS problem. Joe always liked Ma Bell's lines to be

clean and responsive. A suspicious switchman reported Joe to the security agents who

discovered that Joe had never had a long-distance call charged to his name.

Then the security agents learned that Joe was planning one of his phone trips to a local

switching office. The security people planted one of their agents in the switching office.

He posed as a student switchman and followed Joe around on a tour. He was extremely

friendly and helpful to Joe, leading him around the office by the arm. When the tour was

over he offered Joe a ride back to his apartment house. On the way he asked Joe -- one

tech man to another -- about "those blue boxers" he'd heard about. Joe talked about them

freely, talked about his blue box freely, and about all the other things he could do with

the phones.

The next day the phone-company security agents slapped a monitoring tape on Joe's line,

which eventually picked up an illegal call. Then they applied for the search warrant and

broke in.

In court Joe pleaded not guilty to possession of a blue box and theft of service. A

sympathetic judge reduced the charges to malicious mischief and found him guilty on that

count, sentenced him to two thirty-day sentences to be served concurrently and then

suspended the sentence on condition that Joe promise never to play with phones again. Joe

promised, but the phone company refused to restore his service. For two weeks after the

trial Joe could not be reached except through the pay phone at his apartment house, and

the landlord screened all calls for him.

Phone-phreak Carl managed to get through to Joe after the trial, and reported that Joe

sounded crushed by the whole affair.

"What I'm worried about," Carl told me, "is that Joe means it this time. The promise. That

he'll never phone-phreak again. That's what he told me, that he's given up phone-phreaking

for good. I mean his entire life. He says he knows they're going to be watching him so

closely for the rest of his life he'll never be able to make a move without going straight to

jail. He sounded very broken up by the whole experience of being in jail. It was awful to

hear him talk that way. I don't know. I hope maybe he had to sound that way. Over the

phone, you know."

He reports that the entire phone-phreak underground is up in arms over the phone

company's treatment of Joe. "All the while Joe had his hopes pinned on his application for

a phone-company job, they were stringing him along getting ready to bust him. That gets

me mad. Joe spent most of his time helping them out. The bastards. They think they can

use him as an example. All of sudden they're harassing us on the coast. Agents are jumping

up on our lines. They just busted ------'s mute yesterday and ripped out his lines. But no

matter what Joe does, I don't think we're going to take this lying down."

Two weeks later my phone rings and about eight phone phreaks in succession say hello from

about eight different places in the country, among them Carl, Ed, and Captain Crunch. A

nationwide phone-phreak conference line has been reestablished through a switching

machine in --------, with the cooperation of a disgruntled switchman.

"We have a special guest with us today," Carl tells me.

The next voice I hear is Joe's. He reports happily that he has just moved to a place called

Millington, Tennessee, fifteen miles outside of Memphis, where he has been hired as a

telephone-set repairman by a small independent phone company. Someday he hopes to be an

equipment troubleshooter.

"It's the kind of job I dreamed about. They found out about me from the publicity

surrounding the trial. Maybe Ma Bell did me a favor busting me. I'll have telephones in my

hands all day long."

"You know the expression, 'Don't get mad, get even'?" phone-phreak Carl asked me. "Well,

I think they're going to be very sorry about what they did to Joe and what they're trying

to do to us."

151.The History of British Phreaking by Lex Luthor

Note: The British post office, is the US equivalent of Ma Bell. In Britain, phreaking goes

back to the early fifties, when the technique of 'toll a drop back' was discovered. Toll a

was an exchange near St.Pauls which routed calls between London and nearby non-London

exchanges. The trick was to dial an unallocated number, and then depress the receiver-

rest for « second. This flashing initiated the 'clear forward' signal, leaving the caller with

an open line into the toll a exchange. They could then dial 018, which forwarded him to the

trunk exchange at that time, the first long distance exchange in Britain and follow it with

the code for the distant exchange to which he would be connected at no extra charge.

The signals needed to control the UK network today were published in the "Institution of

Post Office Engineers Journal" and reprinted in the Sunday times (15 Oct. 1972).

The signaling system they use: Signaling system No.3 uses pairs of frequencies selected

from 6 tones separated by 120hz. With that info, the phreaks made "bleepers" or as they

are called here in the US "blue box", but they do utilize different MF tones then the US,

thus, your US blue box that you smuggled into the UK will not work, unless you change the

frequencies.

In the early seventies, a simpler system based on different numbers of pulses with the

same frequency (2280hz) was used. For more info on that, try to get a hold of: Atkinson's

"Telephony and Systems Technology".

In the early days of British phreaking, the Cambridge university Titan computer was used

to record and circulate numbers found by the exhaustive dialing of local networks. These

numbers were used to create a chain of links from local exchange to local exchange across

the country, bypassing the trunk circuits. Because the internal routing codes in the UK

network are not the same as those dialed by the caller, the phreaks had to discover them

by 'probe and listen' techniques or more commonly known in the US -- scanning. What they

did was put in likely signals and listened to find out if they succeeded. The results of

scanning were circulated to other phreaks. Discovering each other took time at first, but

eventually the phreaks became organized. The "tap" of Britain was called "undercurrents"

which enabled British phreaks to share the info on new numbers, equipment etc.

To understand what the British phreaks did, think of the phone network in three layers of

lines: Local, trunk, and international. In the UK, subscriber trunk dialing (std), is the

mechanism which takes a call from the local lines and (legitimately) elevates it to a trunk

or international level. The UK phreaks figured that a call at trunk level can be routed

through any number of exchanges, provided that the right routing codes were found and

used correctly. They also had to discover how to get from local to trunk level either

without being charged (which they did with a bleeper box) or without using (std). Chaining

has already been mentioned but it requires long strings of digits and speech gets more and

more faint as the chain grows, just like it does when you stack trunks back and forth

across the US. The way the security reps snagged the phreaks was to put a simple

'printermeter' or as we call it: A pen register on the suspects line, which shows every digit

dialed from the subscribers line.

The British prefer to get onto the trunks rather than chaining. One way was to discover

where local calls use the trunks between neighboring exchanges, start a call and stay on

the trunk instead of returning to the local level on reaching the distant switch. This again

required exhaustive dialing and made more work for titan; it also revealed 'fiddles', which

were inserted by post office engineers.

What fiddling means is that the engineers rewired the exchanges for their own benefit.

The equipment is modified to give access to a trunk without being charged, an operation

which is pretty easy in step by step (SxS) electro-mechanical exchanges, which were

installed in Britain even in the 1970's (Note: I know of a back door into the Canadian

system on a 4A Co., so if you are on SxS or a 4A, try scanning 3 digit exchanges, i.e.: dial

999,998,997 etc. And listen for the beep-kerchink, if there are no 3 digit codes which

allow direct access to a tandem in your local exchange and bypasses the AMA so you won't

be billed, not have to blast 2600 every time you wish to box a call.

A famous British 'fiddler' revealed in the early 1970's worked by dialing 173. The caller

then added the trunk code of 1 and the subscribers local number. At that time, most

engineering test services began with 17X, so the engineers could hide their fiddles in the

nest of service wires. When security reps started searching, the fiddles were concealed by

tones signaling: 'Number unobtainable' or 'Equipment engaged' which switched off after a

delay. The necessary relays are small and easily hidden.

There was another side to phreaking in the UK in the sixties. Before STD was widespread,

many 'ordinary' people were driven to.

Occasional phreaking from sheer frustration at the inefficient operator controlled trunk

system. This came to a head during a strike about 1961 when operators could not be

reached. Nothing complicated was needed. Many operators had been in the habit of

repeating the codes as they dialed the requested numbers so people soon learnt the

numbers they called frequently. The only 'trick' was to know which exchanges could be

dialed through to pass on the trunk number. Callers also needed a pretty quiet place to do

it, since timing relative to clicks was important. The most famous trial of British phreaks

was called the old Baily trial. Which started on Oct. 3rd, 1973. What the phreaks did was

dial a spare number at a local call rate, but involving a trunk to another exchange then

they sent a 'clear forward' to their local exchange, indicating to it that the call was

finished; but the distant exchange doesn't realize because the caller's phone is still off

the hook. They now have an open line into the distant trunk exchange and sent to it a

'seize' signal: '1' which puts him onto its outgoing lines now, if they know the codes, the

world is open to them. All other exchanges trust his local exchange to handle the billing;

they just interpret the tones they hear. Meanwhile, the local exchange collects only for a

local call. The investigators discovered the phreaks holding a conference somewhere in

England surrounded by various phone equipment and bleeper boxes, also printouts listing

'secret' post office codes. (They probably got them from trashing?) The judge said:

"Some take to heroin, some take to telephones." for them phone phreaking was not a crime,

but a hobby to be shared with phellow enthusiasts and discussed with the post office

openly over dinner and by mail. Their approach and attitude to the worlds largest

computer, the global telephone system, was that of scientists conducting experiments or

programmers and engineers testing programs and systems. The judge appeared to agree,

and even asked them for phreaking codes to use from his local exchange! !

152.Bad as Shit by The Jolly Roger

Recently, a telephone fanatic in the northwest made an interesting discovery. He was

exploring the 804 area code (Virginia) and found out that the 840 exchange did something

strange.

In the vast majority of cases, in fact in all of the cases except one, he would get a

recording as if the exchange didn't exist. However, if he dialed 804-840 and four rather

predictable numbers, he got a ring!

After one or two rings, somebody picked up. Being experienced at this kind of thing, he

could tell that the call didn't "supe", that is, no charges were being incurred for calling

this number.

(Calls that get you to an error message, or a special operator, generally don't supervise.) A

female voice, with a hint of a Southern accent said, "Operator, can I help you?"

"Yes," he said, "What number have I reached?"

"What number did you dial, sir?"

He made up a number that was similar.

"I'm sorry that is not the number you reached." Click.

He was fascinated. What in the world was this? He knew he was going to call back, but

before he did, he tried some more experiments. He tried the 840 exchange in several

other area codes. In some, it came up as a valid exchange. In others, exactly the same

thing happened -- the same last four digits, the same Southern belle. Oddly enough, he

later noticed, the areas worked in seemed to travel in a beeline from Washington DC to

Pittsburgh, PA.

He called back from a payphone. "Operator, can I help you?"

"Yes, this is the phone company. I'm testing this line and we don't seem to have an