AUTOMATIC MESSAGE ACCOUNTING (AMA) An overview This article is meant to provide an explanation of Automatic Message Accounting (AMA) and how it was/is used in the past and present. All information included in this file is correct to my knowledge, however, if anyone notices any errors or has anything interesting to add, try to get in touch with me one way or another and let me know. Hopefully this article will clear up any misconceptions about AMA that have been circulating around on bulletin boards and by word of mouth. Keep in mind, however, that the information here may not be applicable to your specific area or telco. The information contained herein generally applies to the BOC's, and if you are served by an independent telco, your method of billing may differ. This article is aimed more towards the more experienced telecommunications enthusiast. People with limited knowledge may have a hard time understanding the information presented here. However, if you can contact me I will try to answer any questions or clarify anything included in this article that isn't understood. Information will be included in this article concerning the use of AMA in the past. This is being done for people in older areas or areas served by an independent telco that may still be using the old technology. HISTORY ------- In the past, Call Detail Record (CDR) information was collected and recorded by cordboard operators in a process known as manual ticketing. The operator recorded this information by writing it down manually upon a formatted record called a ticket. These tickets were sent to the appropriate office where billing was handled. This manual ticketing process was time-consuming, and was phased out with the introduction of electromechanical switching. Before the advent of AMA, a magnetically operated counter called a message register was associated with each subscribers line in a given central office. This counter was responsible for counting the number of calls that each subscriber made, for billing purposes. This message register was caused to operate one or more times when the called party answered the telephone. The way this works is when the called party answers, a reverse battery signal was sent back over the trunk circuit to activate a relay in the originating office which was responsible for the application of a 48-volt battery to advance the message register the appropriate number of units. A local call is/was usually one message unit, regardless of how long the call lasted. Local calls to further away areas were/are usually two message units. Long distance calls were handled either by cordboard operators, using manual ticketing, or by a method not involving operators known as zone registration. With zone registration, calls to different zones would cause the message register to operate two or more times per time period. This would make the cost higher for longer calls, and less for shorter calls. At the end of the billing period, each message register had to be manually photographed to keep track of the number of calls made by that specific subscriber. These photos were taken by a 35 millimeter camera that was known as a Traffic Usage Recorder, and then sent to the same place that manual tickets (prepared by operators) were. However, this method of billing soon grew costly and inefficient, so a new method, LAMA (Local Automatic Message Accounting) was developed. Additional and more specific information shall be included later in the article. In the late 1940's, the Bell System developed LAMA, which recorded the billing information in a much more efficient manner. However, some end offices did not have enough call traffic to warrant the installation of LAMA equipment. To solve this problem, CAMA (Centralized Automatic Message Accounting) was developed in the mid 1950's. CAMA was different from LAMA in that it was based in a toll or tandem office and could record the AMA information for every end office that it served. More on LAMA and CAMA will be included later in the article. Another development concerning AMA is the computerization of the system, named LAMA-C or CAMA-C, for 'LAMA-Computerized' or 'CAMA-Computerized'. CAMA had used paper tape perforators for a time before the magnetic tape method was introduced with CAMA-C. LAMA-C is a computerized version of LAMA which also uses magnetic tape (LAMA-C is still used today). LAMA and LAMA-A (previous versions) used paper tape, although LAMA-A was more efficient. LAMA, LAMA-A, CAMA, and CAMA-C were all part of the AMARS, the Automatic Message Accounting Recording System. However, a newer term for more modern setups is the AMACS, for Automatic Message Accounting Collection System. The AMACS includes end office AMA systems, a recent introduction called the AMARC (AMA Recording Center), AMARC sensors from end offices to the AMARC, the data links used to transmit billing information, and data recievers located at the AMARC site. The AMARC is a product of the new age of computerized technology as it applies to the telecommunications systems used in our society. Still, LAMA and CAMA and their different versions shall be described and explained to help people understand how they were/are used. LAMA ---- LAMA is described by Notes on the Network (1983) as 'A process using equipment located in a local office for automatically recording billing data for message rate calls and for customer-dialed station to station toll calls'. What this is means is that if your CO uses LAMA, and you are on a single party line (most people are), all 1+ toll calls will be billable by LAMA equipment, and all calls coming from message rate lines. A message rate line, for those of you not familiar with the term, is a telephone line that has the ability to receive incoming calls, but all outgoing calls will cost the subscriber. The subscriber pays for basic service (the ability to receive calls) with the consideration that all other calls (even local ones) will cost a certain amount of money per call. Many subscribers in several major cities get this feature automatically, and thus phone bills are generally higher in these areas. LAMA originally recorded billing information on punched paper tape, in a version known as LAMA-A, but now magnetic tape is generally the format used in places where LAMA-C equipment is used. The paper tape perforators that recorded the CDR data in LAMA-A were noisy, and they needed maintenance due to their electromechanical construction. The magnetic tape method is much more reliable, and quieter as well. If a persons End Office uses LAMA, then all toll calls from all lines and all local calls from metered rate lines are recorded on the LAMA tape, with a few exceptions. LAMA can only be used to record AMA information for one and two party lines. On other party lines such as three and four party, the originating caller has his/her number identified by an operator via the ONI (Operator Number Identification) method. It is not been determined by the author if the BOC (Bell Operating Company) operators such as TOPS (Traffic Operator Position System, made by Northen Telecom Inc. of Canada) or MPOW (Multi-Purpose Operator Workstation, by US West) operators would be used for this ONI or not. I would guess that AT&T TSPS operators would handle an inter-LATA toll call, and that the BOC TOPS/MPOW operators would handle the ONI for an intra-LATA call (my reasoning behind this statement is the fact that whenever I have had an ONI due to equipment failure, which is similar to ONI needed, only the ANI outpulsing was garbled, the called number was still transmitted in the correct fashion. I am assuming that the end office switching system would route the call to the correct operator position by matching the NPA-NXX with some sort of internal table which makes a distinction between intra and inter-LATA calls). Anyway, these calls had their AMA information sent from the appropriate operator position to the toll office that served the 3+ party line, onto CAMA tape. Another instance in which a LAMA office may use CAMA instead is when an ANIF (ANI Failure) occurs. If the ANIF is sent to TSPS, then that TSPS will record billing information upon CAMA tape by using ONI. It seems that AMA information that has been recorded by an operator is buffered and stored until it is time to send the information to the appropriate places for processing. In the case of AT&T TSPS operators, the TSPS had it's own magnetic tape which was sent to the RAO (Regional Accounting Office, formerly called Revenue Accounting Office) on a regular basis. I am not sure if this method is still used or if TSPS AMA has been updated or enhanced in some way. EXAMPLES OF LAMA USAGE ---------------------- The following is the call flow procedure in a LAMA-A (paper tape) system. After a customer completes dialing, the dialed number (the called number), the originating class of service, Line Equipment Number (LEN), and call type are sent from the switch to the AMA equipment. Translations, such as figuring the billing telephone number from the Line Equipment Number, are done. The information that comes from the translations procedures determines which paper tape perforator shall be used to record the data for this specific call. A record of the initial information gathered is called the initial entry. The last line of the initial entry contains a two digit code called a Call Identity Index, which identifies telco equipment such as the trunk or district junctor that will be used for that call. When the call is answered, another entry is made, called the answer entry. This entry is a single line on the paper tape and has the CII and the exact time that the call was answered on it. The last entry on the paper tape is known as the disconnect entry. This entry contains the CII and the exact time that the call ended. The CII is important because it is what the RAO used to group together all the data about a given call. Entries are recorded at different times in a LAMA system, they are not in sequential order, so the CII makes it easier to find all three entries for a specific call. This method of recording AMA information required the RAO to 'unshuffle the deck' when it came time to organize the AMA information. The variations in the AMA recording formats used by different switching systems eventually led Bellcore to develop a standard AMA format, named the Bellcore AMA Format (BAF). More information will be included about this format later in the article. In a No. 5 Crossbar switching system, the AMA setup used special purpose 3 inch wide paper tape on which AMA records were recorded by CO equipment. This method of recording is for the stone ages, as it has been phased out by almost every BOC. Similar to the LAMA-A call flow, this method of AMA used three AMA entries. The first one was the customers service information, which included the calling and called telephone numbers, the second one was recorded when the telephone was answered, and the third one was recorded at disconnect. This also made the job at the RAO a bit harder, as again, they had to 'unshuffle the deck'. The No. 2 ESS introduced the latest magnetic tape recording technology that was available at that time. The 2E used 200 BPI, 7 track mag tapes, and it introduced special data coding conventions. It's technology and conventions are still in use today, but I think that the BPI and number of tracks have been increased. The 2E mimics the No. 5 Crossbar AMA method by recording three entries and interleaving them on the magnetic tape. Data common to all calls on a tape (such as date, CO info, etc.) are recorded in special tape headers. The No. 2B ESS was introduced with the same AMA technology as the 2E, but a 2B that provides equal access capabilities for interexchange carriers adds a new data entry to the three used by the 2E. This new entry reports the time of connection of a carrier to the local network, which is needed for carrier access billing. The No. 1 ESS modernized the AMA process even more. The 1E used 200 BPI, nine track tape. The 1E provides data collection memory registers for AMA information on applicable calls. A register is assigned to an AMA call and kept open for the call's duration. This register collected most of the billing data that was needed. The AMA information was then written to magtape at the time of disconnect. This made it easier for the RAO to process. The AMA format used by the 1E uses variable length records whose fields occur for the most part in a general, preset pattern. Eventually, though, even the 1E AMA method was found to be slightly faulty. This was due to high processing costs at the RAO and the problem of tape headers getting erased from the tape. The BAF was made to solve the problems that are associated with other AMA setups. An update to the BAF is called the EBAF, or Extended Bellcore AMA Format. The main difference between the BAF and EBAF is that EBAF is more flexible and can be used easier, as the BAF uses a defined structure for storing data. The EBAF can append other information to the end of an AMA record, and this makes it more flexible. ANI FORMATS ----------- The ANI formats outpulsed in a LAMA arrangement are as follows (assume that the call being shown for an example is being dialed from a home telephone, as dialing from coinphones would cause different ST signals to be sent; also the type of signaling in this case is SF in-band): CALLED number:KP+(NPA)+NXX+XXXX+ST CALLING number:KP+I+NXX+XXXX+ST The second format is the ANI associated with LAMA and is sent to the LAMA equipment after the ANI receiving trunk winks. The NPA included in this example is optional and only needed if the subscriber is making a call to a Foreign NPA (FNPA). The complete called number is not included in all cases, as when an AMA setup is configured for bulk-billing. In bulk-billing, the entire called number is not recorded, but just enough for billing purposes. The CALLING number is the number that the subscriber is dialing from. These two numbers are sent in Multi Frequency (MF) tones to MF receivers located within a CO. The I in the ANI is an information digit, and these shall be explained later in the article. One may wonder how a CO knows which lines it serves are message rate lines and which are flat rate. On electromechanical switches such as Step by Step, No. 1 and No. 5 Crossbar (it should be noted that there are no remaining panel switches within the Bell System), there is an electronic line card associated with each Directory Number which holds information relevant to that line. These cards have to have any type of change hardwired into them. However, in digital/ electronic switching systems, there are Line Class Codes which reflect information about each subscribers line. There are many, many of these codes. Some of the more common and interesting ones are listed below: LCC EXPLANATION --- ----------- 1FR Single party Flat rate Residential line 1MR Single party Metered rate residential line 1CF Single party Coin First coin telephone 1OF Single party Official (telco) line 1FB Single party Flat rate Business line 1MB Single party Metered rate Business line These codes can be found for a line in several places, such as certain fields in telco computer output reports. COSMOS and LMOS are two such computers that hold this information. If you find COSMOS printouts or have access to COSMOS, these Line Class Codes will be listed under the 'LCC' field in an ISH, INQ, or other inquiry. Sometimes the data in the LCC field will match or be similar to the data in the US field, which is a USOC (Universal Service Order Code). A USOC and an LCC aren't the same thing though. CAMA ---- CAMA operates along the same basic principle that LAMA does, except that CAMA is based in a toll or tandem office (class 4). CAMA is made to be used in areas where it would be costly to implement a LAMA arrangement for each and every class 5 office. This is because some end offices did not have enough traffic to warrant the cost and work required to install LAMA equipment. LAMA setups can/could be found in abundance in rural areas near large cities. The first letter in each of the acronyms (L)AMA and (C)AMA describes the usage of each. (L)AMA, for Localized, in a local central office, and (C)AMA for Centralized, in a toll office. The outpulsing formats to CAMA are similar to the LAMA ANI outpulsing. The outgoing trunk to the serving CAMA office from the end office sends the called DN in the format of KP+(NPA)+NXX+XXXX+ST. Next, the incoming CAMA trunk requests the end office to send the calling number. This is sent as KP+I+(NPA)+NXX+XXXX+ST, where the I is an information digit which gives information about the status of the process, and the NPA may or may not be needed, depending upon the setup. The information digits that follow are used in ANI outpulsing to Local and Centralized AMA. They are: 0-Automatic Identification (a normal call, with no special treatment); 1-Operator Identification (ONI-call is sent to an operator who requests the customer to give the number they are calling from); 2-Identification Failure (ANI Failure, handled the same way as ONI). The ONI due to ANIF and normal ONI which is used on certain party lines are kept track of. If too many ANI Failures happen, then a report will be generated indicating this fact. ONI needed is more standard and ordinary, and thus safer for the telecommunications enthusiast. This information can be put to a good use, as if you find an outgoing CAMA trunk when you are boxing, you can place calls over it by using the above CAMA formats. The only limiting factor is that the NXX of the calling number that you sent for ANI must be an office that is served by the particular CAMA offices trunk that you are using. Note that CAMA is not used much anymore, it was mainly used with Electro- Mechanical toll switches such as the No. 4A Crossbar, and the Crossbar Tandem (XBT). I don't think there are any XBTs or 4As in operation in the AT&T toll network, but CAMA may be used by independent telcos, or by telcos in rural areas that serve only a small number of central offices. In an independent telco setup, a CAMA arrangement may be used, but not in the same way as AT&T has used it. The centralized location may not be a toll office, it may just be the largest CO in that companies network. There can be several variations. CAMA was originally introduced to work with and in conjunction with ANI, thus the original term for the process, CAMA/ANI. For a complete description of ANI in electromechanical switching systems, see one of the older issues of Phrack Inc. newsletter for a file written by Doom Prophet and myself, titled 'Automatic Number Identification'. I have seen CAMA mentioned in recent telco information, so I assume that CAMA is still in use, at least in some places. Supposedly a way to determine if you are on CAMA is to dial local numbers, and send 2600Hz. If you can seize a trunk, then it is likely that you are served by CAMA. You can then pick local exchange codes, (NXX), dial them, seize a trunk, and then MF using the CAMA format included above, sending a false ANI for one of the local exchanges. If you do this, I suggest that you don't send the ANI of a resident. Use non-working numbers, disconnected numbers, payphone numbers. I am not sure if there is any check done upon the number sent in ANI by the toll office or not, but it is probable that the local switch is responsible for screening out invalid numbers and such. So if you can get on a CAMA trunk then you have the power to bill calls to anyone else who is served by a CO that homes in on the same toll office and uses the same CAMA equipment. The standard AT&T Toll office switch, the No. 4 ESS, is also equipped to handle CAMA if necessary. The CAMA procedure is as follows: Call data for the CAMA call is kept in a buffer (technically called an Accounting Block (AB)) which then stores the entry upon a nine track 800-bpi (bits per inch) AMA tape (note: the information used in research for this part of the article was rather old, so the bits per inch has probably increased). The data that are kept in this buffer and put on the tape are as follows: the calling DN, the called DN, answer and disconnect times accurate to 0.1 second, and other misc. information. The callers DN can be entered into the 4ESS in two ways, ANI or ONI. ANI is of course the normal method for identifying a callers DN for billing purposes. ONI is used when there is an ANIF, or when it is needed (the other equipment cannot get the DN with ANI). When the 4E gets an ANIF or an ONI needed, it sends the call to a TSPS operator, who should ask the caller for their number. When an operator gets an ONI situation 'from' a 4E, she uses two types of trunks, a talking trunk, and a keying trunk. The talking trunk is what the subscriber comes in upon and is the line over which the operator asks for the callers DN. The keying trunk originates at the 4E and terminatates at TSPS, and is what is used to send the callers DN (in MF) to the 4ESS office. The operator has access to both trunks at the same time, thus she can enter the number in a quick and orderly fashion. When a line classification does not fit into the 'one information digit' (KP+I+NNX+XXXX+ST) category, two information digits are used. When two are used, they are called screening codes. Screening codes are outpulsed along with the ANI for certain types of telephone lines, and when ANI is being sent to an alternate carrier via 'Equal Access' (Feature Group D, 1+ dialing). These screening codes are two digits and precede the subscribers DN. An example of screening code outpulsing is as follows: KP+II+NNX+XXXX+ST The II represents two information digits that precede the callers number. Some of the more common screening codes are as follows: KP+00+NXX+XXXX+ST Normal telephone call, identified POTS line; KP+01+NXX+XXXX+ST ONI needed on a multiparty line; KP+02+NXX+XXXX+ST ONI needed due to ANI Failure; KP+07+NXX+XXXX+ST Hospital, inmate type telephone; KP+08+NXX+XXXX+ST Line restricted from dialing inter-LATA; KP+10+NNX+XXXX+ST Telco test call; KP+20+NNX+XXXX+ST Automatic Identified Outward Dialing centrex call; KP+27+NNX+XXXX+ST Coin telephone call. These double digit outpulsing formats are used in Equal Access areas, and a similar method of outpulsing is used when customers deal with TSPS operators. For more information, see the July, 1987 issue of 2600 Magazine, an article entitled 'How phreaks are caught'. AMARC ----- The AMARC, or Automatic Message Accounting Recording Center, is a fairly modern development toward recording billing information. It offers the telco several advantages to the older electromechanical setups, such as increased revenue (always a plus in their eyes), reduced RAO processing costs, a new computerized format that stores data on 1600 bpi, industry compatible magnetic tape, elimination of loss due to paper tapes being destroyed, and elimination of per-office paper tape pickup and delivery. THE NO. 1 AMARC --------------- The first version of the AMARC was the No. 1 AMARC, which received billing data on a real-time basis over dedicated data links. It was based on two DEC PDP-11/40 minicomputers. The No. 1 AMARC controls and recieves data from a maximum of thirty dedicated channels. A channel consisted of a dedicated line (probably a Private Line service) equipped with a 202T data set, operating asynchronously at 1.2 kbps. The No. 1 AMARC had a feature which allowed it to call, over the DDD network, a backup channel in case one of the normal channels experienced a failure. This backup channel could be reached by anyone who had the phone number. It has not been determined by the author if there was/is any security on these backup channels. THE NO. 1A AMARC ---------------- Eventually, it was decided that more data channels were needed, and that the AMARC computer could be centralized, and not clustered in administrative centers, as was the procedure. The No. 1A AMARC fulfilled the telco's needs. The No. 1A AMARC uses a higher capacity minicomputer, the DEC PDP-11/70, and Western Electric peripheral equipment to provide ninety input channels, improved maintenance capabilities, and room for growth in several areas. The first No. 1A AMARC began operation in 1981 in the Chicago area. An important feature common to both the No. 1 and No. 1A AMARC was the ability to recieve billing information electronically over dedicated lines from central office switches. Equipment located in central offices called sensors send this data. There are different types of sensors for different types of switching equipment, but the most common AMARC sensors shall be listed here. The Call Data Transmitter (CDT). The newest AMARC sensor. The CDT is a microprocessor based system which is used to collect data from No. 5 crossbar offices. It is designed to be used in systems that do not have LAMA-A and do not have enough traffic to warrant the expense of installing the No. 5 ETS. It can be used with other sensors, and is not the only kind used in No. 5 crossbars. The first one was cut over in Illinois in 1980. The Call Data Accumulator (CDA). Similar to the CDT, but uses wired logic control. The CDA, which collects AMA information from SxS switches, was the first sensor to be made for use with the AMARC. This sensor is connected to the ring, tip, and sleeve leads in a SxS switch, probably at the MDF. The first CDA was cut over into service in New York in 1975. The Billing Data Transmitter (BDT). Used in electromechanical offices, such as the Nos. 1, 5, 4, and 4A Crossbar, SxS CAMA, and the Crossbar Tandem (XBT). The BDT replaced up to 10 paper tape perforators that were previously used. Provides a newer alternative to LAMA-A. The BDT recieves billing data from the older LAMA-A paper tape recorder circuits and sends them to the AMARC. The first BDT was cut over in New York in 1976. The No. 5 Electronic Translator System (ETS). The No. 5 ETS was added to No. 5 Crossbar systems to provide some electronic switching functions that were not present before. These functions are things such as line, trunk, and routing translations provided by software methods rather than wired cross connections. The No. 5 ETS consists of duplicated Western Electric 3A auxillary processors with associated scanners and distributors. The first No. 5 ETS was installed in Ohio in 1977. VIDAR, a special sensor used in Crossbar No. 1 offices. VIDAR does not interface with the AMARC but instead sends data to it's own tape. This tape is then sent to the RAO on a regular basis. These various sensors are specially designed electronic units which are part of or connected to class 5 offices. These sensors collect and generate billing data from the office they are used with. The billing data consist of answer and disconect times, call type, and the amount of measured local and toll calls made. Some offices have added sensors, but exceptions include several ESS systems which use SPC (Stored Program Control) to send data to the AMARC. SPC means that the sensor is built into the switch software and that no other equipment is needed. An example of this is the NTI DMS-100 switch. Nos. 2, 2B, 3, 3B, and No. 5 ESS also do not have special AMARC sensors, but send data to the AMARC over a synchronous connection via a SPUC/DL (Serial Peripheral Unit Controller /Data Link) at speeds of 2.4 and 4.8 kbps. There is another part in the 2B ESS AMARC data link, called the AMARC Protocol Converter (APC). The APC is a medium between the SPUC/DL and the AMARC. The No. 4 ESS, TSPS, 1ESS, 1AESS, and 2ESS switches don't have AMARC sensors, and aren't even connected to the AMARC. These switches all have their own AMA systems, from which the data is sent to the RAO regularly. Another exception is the DMS-10 Remote Switch, which is connected to a device at the RAO called a collector. There are other options possible when dealing with AMA collection, such as the Distributed Call Measurement System (DCMS) made by a telco equipment vendor, which acts like a mini-AMARC, and Northern Telecom's Distributed Processing Peripheral system, which is used to collect billing data from NTI's DMS switches. These systems can be used where applicable. RECENT DEVELOPMENTS ------------------- In places where magnetic tape has been phased out, a new method of storing the AMA data called AMA TeleProcessing Systems (AMATPS) has been implemented. AMATPS overcomes the disadvantages of magnetic tape (such as the sequential way the data is recorded, the high-density data losses that may happen, and the sometimes unseen problems with the tape unit) by using random access disk drives. AMATPS also adds some new system parts which can make the job easier. Still, some AMATPS are not used to their full capability and can still present problems to the telco. One of the parts that AMATPS adds to the overall AMACS is the use of AMA Transmitters (AMAT's). These transmitters are added to the sensors, and increase the power of the overall setup by providing things such as temporary storage areas and programming applications. AMAT's are generally PC-sized machines with two disk drives, and 50-150 megabyte hard disks. The second important addition is the collector. The collector acts like the AMARC by polling the AMAT over data links. The collector, like AMARC, is a centrally located computer system, usuallly running on an IBM Series 1, an HP-1000, or an AT&T 3B5. Teleprocessing systems are made to understand a common AMA language format made by Bellcore, the Bellcore AMA Format and Extended Bellcore AMA Format. These were mentioned in part A of this article. BOC/AT&T INTERACTION -------------------- Since the majority of people are served by AT&T, one may wonder how inter- LATA call data gets to the given Inter-LATA Carrier (IC), in this case, AT&T. AT&T has its own AMA collection system, which is called BILDATS (BILling DATa System), and this is what collects the AT&T data. I would guess that each AT&T toll office has some sort of interface with this computer system, but I have no solid proof of this. It has also been suggested to me from a reliable source that AT&T sends each BOC their own magnetic tapes, which the BOC's then fill with AT&T's billing information. I am not sure which of these methods is used. The BOC billing information takes a different route, however. On a regular basis (I believe each day), AMARC tapes are sent to the Regional Accounting Office (RAO) or billing office, where each customers intra-LATA traffic is calculated and their telephone bill printed and mailed. The customer then recieves the bill and goes about whatever method of payment he chooses. Telephone bills can usually be paid in person in many different places in large cities, or they can be mailed in directly if the customer wishes. In my area, the customer pays once, which is a total of his AT&T and BOC bill. This is payable to the BOC, and AT&T then gets their payment from the BOC. In the case of independent carriers such as US Sprint, MCI, ALC Communications, and the like, I cannot say for sure what they all do as there seems to be no standard procedure for this interaction, but in two instances, two specific RBOC's (US West and BellSouth) handle FG-D Equal Access style billing for MCI throughout their serving areas. There is a computer system involved in this alternate carrier billing cycle, called the Carrier Access Billing System (CABS). This system calculates the prices bases on tariffs in use, and bills the carriers on a monthly basis accordingly. I am not sure how widespread the use of this sytem is, though. When the customer receives his MCI bill along with his BOC bill he can pay them both at once. I would imagine that the larger long distance services would be able to afford getting this service from the RBOC's, while the smaller ones with less money would do it by themselves, which would probably be a slow, drawn out process. In some cases, dialing via an alternate carrier (other then your primary one) will cause the billing cycle to take anywhere up to three months to complete, or even more. Another interesting note about alternate carrier dialing, some carriers do not start billing until a specific amount of time has elapsed. This is known as buffer-zone billing. I know of one company that uses a 45 second buffer zone, but I am not sure what the other companies use. You can find this information out by talking to a customer service department, however some companies CS departments either don't know, or they do not wish to tell the customer (or 'potential' customer). With buffer zone billing (assume 45 seconds in this case), you will be billed for the call if you let the phone ring, listen to a busy signal, etc. if the duration of the call is greater than or equal to 45 seconds. Many of the ICs that use this type of billing do not have the equipment to detect answer supervision, so if you can keep a conversation very short, you may get away with a free call, without breaking any laws. CALL CREDITING -------------- When you receive credit for improperly placed long distance calls from an operator or a telco business office (after you receive your phone bill) certain things happen. Operator crediting involves the operator entering a special flag on an AMA tape to deduct the specific amount of given charge from the subscriber's telephone number. I believe that this process involves (with AT&T TSPS) the KP TRBL key, and (with NTI's TOPS) the KP TRBL and the CHG ADJ (charge adjust) keys. Business office crediting happens when you call the business office and talk to a BOC 'service representative'. This person will then enter your telephone number into a terminal, using the DOE (Direct Order Entry) system, which is in use in my area. The billing record information comes from a computer called CRIS (Customer Record Information System), which is accessed by BOSS (Billing and Order Support System). BOSS has a link to computer systems at the RAO, as this is how the customer's toll data gets to the business office. A service representative can then pull up your toll charges and correct them with appropriate credit entries. SECURITY (EVERYONE READ THIS PART) ----------------------------------- There have been several rumors going around about AMA and it's relation to people who commit toll fraud, and I will attempt to clarify these rumors. It is possible that a billing tape could be used to try to find out who called a certain number at a given time. Another way AMA tapes/disks could be used as a record of someone committing toll fraud would be if this person would happen to be under a newer switch, such as the DMS-100, and they attempted to use a blue box without knowing the dangers of it (I will speak only on the DMS-100 because when a older switching system is replaced with a new one, the most common replacements are the AT&T No. 5 ESS and the Northern Telecom DMS-100 Family of switching systems). DMS-100 does indeed have the capability to record a blue boxer's MF tones in an AMA record if the boxer doesn't know what he is doing. 1AESS also has blue box detection features. I am not sure about other switching systems, but I would guess that most of the newer switches have some sort of blue box fraud detection features, of course the end user of these switches (the telco) does not have to use them. However it is difficult to find out if your CO uses anything of this nature unless you are a good social engineer or have access in some way to the switch or switch output messages and know what to look for. For instance on the Northern Telecom DMS-100 switching system, there are a series of reports known as BLUEBOX reports which (if in use) will inform the telco of blue boxing activity. The DMS-100 also has AMA options that can detect certain forms of electronic toll fraud, such as black and blue boxing. These options can be set any way the telco wants. These AMA options can be printed on a DMS-100 switching system,onto hardcopy terminals, or onto a data channel which may send the Output Messages (OMs) to a telco computer system such as the Switching Control Center System (SCCS). These options are printed in an AMA118 OM at midnight. If an AMA option is in use by that particular switching system, after the name of the option will be a data field that says ACTIVE. If the option is not in use, the field will say INACTIVE. An example of an AMA118 OM is reproduced here. AMA118 JUL23 12:00:00 2234 INFO AMA-OPTIONS AUDIT: ACTIVE CALL-FWD: ACTIVE CDAR: INACTIVE CHG411: ACTIVE CHG555: ACTIVE COIN: INACTIVE DA411: ACTIVE ENFIA-B-C: INACTIVE FREECALL: INACTIVE HIGHREV: INACTIVE INWATS: ACTIVE LNID: INACTIVE LOGAMA: INACTIVE LOGOPT: ACTIVE LONGCALL: ACTIVE LUSORIG: INACTIVE LUSTERM: INACTIVE OBSERVED: INACTIVE OCCOVFL: ACTIVE OCCTERM: ACTIVE OUTWATS: ACTIVE OVERFLOW: ACTIVE SST: ACTIVE TIMECHANGE: ACTIVE TRACER: ACTIVE TRKID: INACTIVE TWC: INACTIVE UNANS-LOCAL: INACTIVE UNANS-TOLL: ACTIVE The most important ones for phreaks to know about are INWATS, LONGCALL, SST, UNANS-LOCAL, and UNANS-TOLL. INWATS means that calls to 800 numbers are noted in an AMA record. As far as I know, this option is a required one, at least since Bulk Change Supplement 23 (BCS23). LONGCALL will flag long calls in an AMA record. So if it seems to the switch that someone has been on the phone for a long time, this will be logged. A possible use for this would be to detect trouble conditions. This option, used in past switching systems, may have been the cause of many blue box busts. Someone would box for several hours using the same number (for instance, Directory Assistance) and this may have been noted by the switch. Another way I think old time boxers may have been nailed is from boxing off of DA. As you can see in the above listing, there are several options that probably make AMA entries for calls to DA. If the length of a call to DA lasts longer than a certain amount of time, the telco could possibly detect this and attach a monitoring device upon the suspected persons telephone line. The AMA option 'SST' may also be responsible for blue box busts in the recent past. SST stands for Short Supervisory Transition, and an SST is known to the phreak world as a wink. SSTs are generated when a blue boxer seizes a trunk. The switch can detect these and log them in an AMA record if the option is set to ACTIVE. SSTs are not solely caused by boxers, though, as equal access offices can generate a lot of SSTs in normal operation. I believe that trunking arrangements with ICs (InterLATA Carriers) are often responsible for trigge