****************************************
*      ==========================      *
*      =BASIC TELECOMMUNICATIONS=      *
*      ==========================      *
****************************************


PREFACE

IN THIS COURSE, I PLAN TO COVER AS MUCH MATERIAL AS POSSIBLE RELATING TO
TELECOMMUNICATIONS. FIRST, IN THE SYLLABUS ARE THE LONG-DISTANCE SERVICES,
WHICH IS THE TOPIC OF PART I. IN FUTURE ISSUES, SUCH SUBJECTS AS THE BELL
NETWORK, COLORED BOXES, TELEPHONE ELECTRONICS, CENTRAL OFFICE EQUIPMENT,
COMPUTER HACKING, AND MUCH, MUCH MORE WILL BE COVERED.

LONG-DISTANCE SERVICES

IN AN ATTEMP TO OFFER LOW PRICES, ALTERNATIVES TO BELL HAVE BEEN SET UP.
SERVICES SUCH AS SPRINT, METROFONE, ITT, MCI, TRAVELNET, AND MANY OTHERS
ARE ALL FAMILIAR TO US.

THE BASIS OF ALL THESE SERVICES ARE THAT THEY OWN THEIR OWN SWITCHING
EQUIPMENT. FIRST, WE WILL LOOK AT THOSE SERVICES THAT USE LOCAL DIAL-UP.
THE PRINCIPAL OF THESE ARE:
   1) YOU DIAL THE LOCAL #
   2) WHEN IT PICKS UP YOU GET A 2ND DIAL TONE, YOU THEN ENTER THE CODE
   3) YOU THEN ENTER THE # AND WHALLA, YOU'RE CONNECTED, A FREE CALL!

NEXT, WE WILL LOOK AT SEVERAL OF THESE SERVICES

SPRINT

SPRINT, ALSO KNOWN AS SPC, WAS ONE OF THE FIRST LD SERVICES.

MANY BOARDS CONTAIN SPC #'S AND I PLAN TO INCLUDE A LIST OF THEM AS AN
APPENDIX TO THIS COURSE SO YOU CAN FIND YOUR LOCAL #

THE CODES FOR SPC ARE 8 DIGITS LONG, SPC IS NOT CONSIDERED SAFE, SINCE
MANY PEOPLE HAVE BEEN BUSTED ON IT! IT IS COMMON KNOWLEDGE THAT SPRINT
HAS DECLARED WAR ON PHONE PHREAKS SO, FIGHT BACK.(WITH CARE)

914 DIAL-UP-->(914)997-1616

METROFONE

METROFONE, OWNED BY WESTERN UNION, IS VERY POPULAR AMONG PHONE PHREAKS
DUE TO THE LARGE ABUNDANCE OF CODES AND IT(AT THE TIME OF THIS WRITING)
IS CONSIDERED FAIRLY SAFE.

THE CODE IS 6 DIGITS LONG

TO FIND THE LOCAL DIAL-UP FOR YOUR AREA, JUST CALL (800)325-1403 AND ASK
THE "NICE LADY" FOR THE # FOR YOUR AREA
   FORMAT: AT TONE-->CODE+AREA CODE
   (NPA)+DESTINATION #

NOTE: NPA & A/C ARE ABBREVIATIONS FOR AREA CODE

ITT

ITT IS A LITTLE DIFFERENT IN THAT UPON HEARING THE DIAL TONE AFTER CALLING
THE LOCAL ACCESS #, YOU ENTER THE A/C AND THEN THE #. YOU WILL THEN HEAR A
SHORT TONE, YOU THEN IMMEDIATELY ENTER YOUR 7 DIGIT ACCESS CODE

DIAL-UPS: (212)248-0151, (914)997-8576

   FORMAT: AT TONE, DESTINATION # + 7 DIGIT ACCESS CODE


==============
=950 EXCHANGE=
==============

THE 950 EXCHANGE IS A NATIONWIDE ACCESS EXCHANGE, IN MOST AREAS, THAT
INCLUDES SUCH SERVICES AS SKYLINE, LEXITEL, ALLNET AND OTHERS. ALL
SERVICES ON THIS EXCHANGE ARE CONSIDERED DANGEROUS DUE TO THE FACT THAT
THEY HAVE THE TRACED!

SKYLINE

SBS SKYLINE IS A NEW SERVICE OWNED BY IBM, COMSAT AND AETNA IT HAS THE
SAME LOCAL ACCESS # ACROSS THE COUNTRY: 950-1088. IT IS SUPPOSED TO HAVE
6(POSSIBLY 8) DIGIT CODES AND IS ALLEGED TO BE VERY DANGEROUS.

ALLNET

ALLNET IS AT 950-1044. IT HAS 6 DIGIT CODES.


===============
=CALLING CARDS=
===============

CALLING CARDS ARE BELL'S VERSION OF SPRINT, MCI, ETC. CALLING CARDS ARE
USED PRIMARILY FROM PAY FONES THE FORMAT IS:

NPA-NXX-XXXX-CCCC

NPA IS USUALLY THE AREA CODE OF THE BILLED # THAT THE CALL IS TO BE BILLED
TO, THIS MAY BE REPLACED BY A 3 DIGIT RAO CODE IN SOME AREAS.

NXX-XXXX IS THE NUMBER THAT THE CALL IS BILLED TO.

CCCC IS A CHECKCODE<OR PIN--PERSONAL IDENTIFICATION NUMBER> THAT ADDS THE
SECURITY TO CALLING CARDS. THE CODES USED TO BE PREDICTABLE UNTIL 1983.
NOW CCCC APPEARS TO BE SEQUENTIALLY GENERATED SO THE CODES CANNOT BE
CALCULATED FROM A FORMULA!

THE EASIEST WAY TO FIND THESE CODES ARE IN BUSY AIRPORTS OR COLLEGE WHERE
THEY ARE USED ALOT. JUST GET CLOSE AND COPY DOWN SOMEONES CODE (IF YOU
ARE THAT UNSCRUPULOUS!) DON'T RIP OFF POOR PEOPLE; GO FOR THE RICH PIGS!

YOU USUALLY CALL THE OPERATOR TO MAKE A CC CALL BUT ON SOME FORTRESS FONES,
YOU CAN DIAL 0+THE NUMBER YOU WANT TO CALL AND YOU WILL GET A RECORDING
& TONE WHERE YOU ENTER YOUR CALLING CARD # BY PRESSING THE # SIGN<OCTOTHORPE>
AFTER EACH CALL INSTEAD OF HANGING UP, YOU CAN MAKE MANY CALLS AT ONCE
WITHOUT HAVING TO RETYPE THE CC # EACH TIME THIS IS GOOD FOR BUSY NUMBERS.
ALSO, IF YOU WANT TO CALL THE # OF THE CARD, IE THE BILLED #, YOU JUST
HAVE TO ENTER THE LAST 4 DIGITS OF THE CC # AT THE TONE.

NOW, SUPPOSE YOU GET A REAL OPERATOR. SINCE MOSTLY BUSINESS PEOPLE USE
CALLING CARDS, IT IS SUGGESTED THAT YOU ACT A LITTLE LIKE A BUSINESS
PERSON, IE, RUSHED, OLDER, BUSINESSLIKE, AND SLIGHTLY PISSED AT THE
OPERATOR (KEYWORD: SLIGHTLY). ALL YOU HAVE TO DO IS TELL HER THE CC #.
IF SHE ASKS YOU FOR THE NUMBER YOU ARE CALLING FROM TELL HER BUT CHANGE
THE LAST 2 DIGITS. IF SHE ASKS YOU MORE QUESTIONS, SHE IS PROBABLY
SUSPICIOUS, HANG UP. ALTHOUGH, YOU SHOULD MAKE SOME ANSWERS TO CERTAIN
QUESTIONS TO SATISFY THE OPERATOR THAT YOU ARE LEGIT. THE MOST IMPORTANT
THING YOU SHOULD KNOW WHEN MAKING A CC CALL IS THE AREA CODE AND THE
CITY OF THE CARD.

FINALLY, IN CASE THE OPERATOR IS LISTENING, ALWAYS TALK BUSINESSLIKE
FOR THE FIRST FEW SECONDS UNTIL THE OPERATOR CLICKS OFF (THEY HAVE BEEN
KNOWN TO LISTEN IN ON CALLS (UNDERSTATEMENT)). ALSO, ALWAYS USE CC'S
FROM PAY FONES OR CHARGE-A-CALL FONES ONLY!

CAUTION: ALL THE CC CODES ARE NOW RAPIDLY CHECKED DUE TO CCIS (COMMON
CHANNEL INTER-OFFICE SIGNALLING) AND ESS (ELECTRONIC SWITCHING SYSTEM)
IF YOU TRY TO HACK CC CODES YOU CAN BE FAIRLY SURE THAT BELL SECURITY
(AFFECTIONALLY KNOWN AS THE GESTAPO IN THE PHREAKING WORLD) WILL GET
A MESSAGE FROM THE CO (CENTRAL OFFICE, IE, EXCHANGE)!


==============
=800 SERVICES=
==============

YOU ARE ALL PROBABLY FAMILIAR WITH WATS. WATS #'S (WIDE AREA TELEPHONE
SERVICE,
OTHERWISE KNOWN AS 800 #'S) ARE VERY POPULAR DUE TO THE FACT THAT THEY ARE
TOLL-FREE. THEY OFTEN CONTAIN WATS EXTENDERS. EXTENDERS WERE ORIGINALLY USED
BY SALESMEN IN THE FIELD WHO CALLED UP THEIR COMPANY'S 800 # (INWATS #) AND
THEN USED THE COMPANY'S LOW PRICED OUTWATS LINE TO MAKE THE CALL. THIS IS
CHEAPER TO THE COMPANY THAN USING BELL CALLING CARD WHICH HAS A SURCHARGE.

ON THE ORIGINAL EXTENDERS THERE WERE NO CODES! COMPANIES SOON REALIZED THAT
THEIR #'S WERE BEING USED AND ADDED THE PRESENT DAY SECURITY CODES. THE
SALESMAN WOULD THEN DIAL THE 800 NUMBER AND ENTER THE CODE (USUALLY 4 DIGITS),
HE WOULD THEN RECEIVE A SECOND DIAL TONE FROM THE COMPANIES PBX (PRIVATE
BRANCH EXCHANGE - THEIR OWN SWITCHING EQUIPMENT - IE, SWITCHBOARD). HE
WOULD THEN ACCESS THE OUTWATS LINE BY DIALING AN 8 OR 9 AND THEN THE #.
THESE CODES WERE ORIGINALLY HAND-HACKED, BUT SOME PIONEER PHREAK ADDED AN
INTERFACE TO CHARLIE, HIS APPLE II COMPUTER, WHICH WAS CAPABLE OF GENERATING
DTMF TONES (DUAL-TONE-MULTI-FREQUENCY - IE, GENERIC NAME FOR TOUCH-TONE (TM))
AND TRYING ALL THE CODES. THE ONLY PROBLEM WAS THAT MA BELL GOT SUSPICIOUS
WHEN THEY SAW THAT SOMEONE CALLED THE JOE BLOW RUBBER COMPANY 800 # IN
CALIFORNIA 4,568 TIMES AT 2 AM AND EACH CALL LASTED FOR ONLY 1 SECOND!

TRAVELNET

TRAVELNET IS A SERVICE THAT USES WATS AS WELL AS LOCAL ACCESS #'S.

THE 800 # IS (800)521-8400.

AFTER THE TONE ENTER THE 8 DIGIT CODE, IF THE CODE WAS RIGHT YOU'LL GET AN
AUTHORIZATION #, PLEASE." YOU THEN SAY EACH DIGIT SLOWLY. IT WILL BEEP AFTER
YOU EACH DIGIT. AFTER EACH GROUP OF DIGITS, IT WILL REPEAT WHAT YOU HAVE SAID
.
SAY YES IF IT IS RIGHT, OTHERWISE, SAY NO. IF THE AUTHORIZATION CODE IS
CORRECT, IT WILL SAY THANK YOU AND IT'LL THEN ASK FOR THE DESTINATION #.
FOLLOW THE SAME PROCEDURE AS ABOVE. THE VOICE SYSTEM IS VERY USER FRIENDLY
AND YOU SHOULD HAVE NO PROBLEMS WITH IT.

TEL-TEC

TEL-TEC IS AT (800)323-3026. IN MY EXPERIENCES, YOU USUALLY GET A VERY
SHITTY CONNECTION. THIS I USE FOR LAST RESORTS.

   FORMAT: 6 DIGIT CODE + DEST. #

CAUTION: LIKE THE 950 EXCHANGE, 800 NUMBERS CAN BE EASILY TRACED. THIS
DOESN'T MEAN THAT THEY TRACE EVERYTHING, THOUGH.

OTHERS

THERE ARE MANY OTHER 800 SERVICES AND PBX'S (SUCH AS THE DIMENSION 2000 AT
800-848-9000). THER IS JUST NOT ENOUGH ROOM TO DISCUSS THEM ALL. AS YOU
HAVE PROBABLY NOTICED, I HAVE POSTED NO CODES. CHECH THE PHREAK SECTION
OF VARIOUS BBS'S TO FIND THE LATEST CODES OR HACK THEM YOURSELF. HAND-HACK
GOOD POSSIBILITIES OR USE A "SMART" MODEM WITH A HACKING PROGRAM (CONTACT
YOUR LOCAL PIRATE).

HOW MA BELL CATCHES PHONE HACKERS

BESIDES SUSPICION AND RANDOM CHECKS, MA BELL SETS UP "TRAP NUMBERS". TRAP
NUMBERS WERE SET UP ON CERTAIN DIAL-UPS SUCH AS SPRINT, MCI, ETC. WHENEVER,
THE DIAL-UP IS CALLED A "TROUBLE CARD" IS DROPPED AT THE CENTRAL OFFICE.
THIS MEANS THAT A RECORD OF THE CALLED #, THE CALLERS # AND THE TIME ARE
PRINTED OUT. THESE CARDS (OR PRINTOUTS IN AN ESS CO) ARE USUALLY IGNORED
UNLESS SPC OR SOMEBODY DETECTS FRAUD, IE, UNAUTHORIZED USE OF A CUSTOMERS
ACCT., THEN THEY CALL BELL AND FIND OUT THE NAME AND THE NUMBER AND INSTANTLY
NAIL THE PHREAK WHO MADE THE CALL. THEY THEN EITHER DEMAND THAT YOU PAY
SOME ENORMOUS FEE AND THEY'LL FORGET THE WHOLE MATTER; GIVE THEM INFO ON
OTHER PHREAKS, BOARDS, ETC.; OR PERSECUTE YOU ON THE FEDERAL RAP OF THEFT
OF COMMUNICATIONS SERVICES, WHICH CARRIES FINES OF UP TO 10 YEARS IN JAIL
AND/OR $10,000. THEY USUALLY DON'T GO FOR LEGAL ACTION FIRST, THOUGH.

WHY DOES BELL HELP THEIR COMPETITION?
ACTUALLY, IT IS RATHER SIMPLE. PEOPLE WERE USING SPRINT TO BREAK INTO BELL'S
ESS COMPUTERS. BELL COULD ONLY TRACE THE CALL BACK TO SPRINT. SO, SPRINT
HELPS BELL CATCH THE PEOLPE IT WANTS AND VICE-VERSA. ("YOU RUB MY BACK
AND I'LL RUB YOURS" TYPE OF DEAL)

BY THE WAY TRAP NUMBERS ARE ALSO HOW BELL CATCHES PEOPLE WHO MAKE HARRASING
PHONE CALLS TO PRIVATE RESIDENCES.

FINALLY, DO NOT FORGET THAT THESE SERVICES HAVE A COPY OF THE NUMBER THAT
YOU CALLED. SO, IF A CUSTOMER SAYS HE DIDN'T CALL A CERTAIN #, THEY WILL
USUALLY CALL UP THAT # AND TRY TO FIND OUT WHO DID CALL AT THAT TIME.

SO, TO BE SAFER ON SPC, MCI, AND OTHERS, FOLLOW THE FOLLOWING SUGGESTIONS:

1) USE A FORTRESS FONE (PAY FONE) WHENEVER POSSIBLE. ALTHOUGH, THEY HAVE
BEEN KNOWN TO STAKE OUT PAY FONES. JUST DON'T USE THE SAME FONE OVER
AND OVER AGAIN. IN OTHER WORDS, MOVE AROUND.

2) ONLY CALL INSTITUTIONAL SWITCHBOARDS, BUSINESS THAT HAVE NO RECORD OF
YOUR CALL, AND FRIENDS WHO ARE INSTANT AMNESIACS.

3) TRY TO KEEP ALL CALLS UNDER 15 MINUTES WHEN POSSIBLE.

NOTE: NO SYSTEM IS TOTALLY SAFE! WHEN I CLASSIFY SOMETHING AS SAFE OR
DANGEROUS, THAT IS JUST WITH RESPECT TO MY OPINION AS WELL AS THAT OF
SEVERAL OTHER PHREAKS. THESE OPINIONS ARE BASED ON HOW MANY PEOPLE HAVE
BEEN BUSTED ON THEM, WHAT TYPE OF EQUIPMENT THEY ARE USING, AND INSIDE
INFORMATION. I CANNOT POSSIBLY GUARANTEE THAT YOU WILL OR WILL NOT GET
CAUGHT. ACTUALLY, WITH CCIS AND ESS NOTHING IS REALLY SAFE ANYMORE.
BESIDES, WHAT PHUN WOULD THERE BE IN LIFE WITHOUT RISKS!

AT THIS POINT I WOULD LIKE TO MENTION THE "OFFICIAL" PHREAK NEWSLETTER,
TAP. TAP CONTAINS MUCH INFO ABOUT PHONE PHREAKING AND OTHER ILLEGAL
ACTIVITIES. SEND A SASE FOR THEIR INFO SHEET, "WHAT THE HELL IS TAP?"
THEIR ADDRESS IS:

   TAP
   ROOM 603
   147 WEST 42 STREET
   NEW YORK, NY 10036



COMING SOON

IN PART II, WE WILL LOOK AT SPECIAL BELL NUMBERS SUCH AS CN/A, ATT NEWSLINES,
LOOPS, ANI, RINGBACK, AND 99XX SCANNING.

UNTIL NEXT TIME, I WOULD LIKE TO LEAVE YOU WITH A QUOTE FROM THE MAGICIAN:

"MANY PEOPLE THINK OF PHONE PHREAKS AS SLIME, OUT TO RIP OF BELL FOR ALL SHE
IS
WORTH. NOTHING COULD BE FARTHER FROM THE TRUTH! GRANTED, THERE ARE SOME WHO
GET THERE KICKS JUST BY MAKING FREE CALLS, HOWEVER THEY ARE NOT TRUE PHONE
PHREAKS. REAL PHONE PHREAKS ARE "TELECOMMUNICATIONS HOBBYISTS" WHO EXPERIMENT,
PLAY WITH AND LEARN FROM THE PHONE SYSTEM. OCCASIONALLY THIS EXPERIMENTING,
AND A NEED TO COMMUNICATE WITH OTHER PHREAKS (WITHOUT GOING BROKE), LEADS
TO FREE CALLS. THE FREE CALLS ARE BUT A SMALL SUBSET OF A TRUE PHONE PHREAKS
ACTIVITIES."

PREFACE:

IN PART II, WE WILL EXPLORE THE VARIOUS SPECIAL BELL #'S, SUCH AS:

CN/A, AT&T NEWSLINES, LOOPS, 99XX #'S, ANI, RINGBACK, AND A FEW OTHERS.

CN/A: -----

CN/A, WHICH STANDS FOR CUSTOMER NAME AND ADDRESS, ARE BUREAUS THAT EXIST SO
THAT AUTHORIZED BELL EMPLOYEES CAN FIND OUT THE NAME AND ADRESS OF ANY
CUSTOMER IN THE BELL SYSTEM.  ALL #'S ARE MAINTAINED ON IE INCLUDING UNLISTED
#'S.  HRE'S HOW IT WORKS:

 1) YOU HAVE A # AND YOU WANT TO FIND OUT WHO OWNS IT, E.G. (914) 555-1234.

 2) YOU LOOK UP THE CN/A # FOR THAT NPA IN THE LIST BELOW.  IN THE EXAMPLE,
THE NPA IS 914 AND THE CN/A # IS 518-471-8111.

 3) YOU THEN CALL UP THE CN/A # (DURING BUSINESS HOURS) AND SAY SOMETHING
LIKE, "HI, THIS IS JOHN JONES FROM THE RESIDENTIAL SERVICE CENTER IN MIAMI.
CAN I HAVE THE CUSTOMER'S NAME AT 914-555-1234.  THAT # IS 914-555-1234."
MAKE UP YOUR OWN REAL SOUNDING NAME, THOUGH.

 4) IF YOU SOUND NATURAL & CHEERY, THE OPERATOR WILL ASK NO QUESTIONS.


HERE'S THE LIST:

    NPA        CN/A #                     NPA         CN/A #
    ---  ------------                     ---  ------------
    201  201-676-7070                     517  313-232-8690
    202  202-384-9620                     518  518-471-8111
    203  203-789-6800                     519  416-487-3641
    204  ****N/A*****                     601  601-961-0877
    205  205-988-7000                     602  303-232-2300
    206  206-382-8000                     603  617-787-2750
    207  617-787-2750                     604  604-432-2996
    208  303-232-2300                     605  402-345-0600
    209  415-546-1341                     606  502-583-2861
    212  518-471-8111                     607  518-471-8111
    213  213-501-4144                     608  414-424-5690
    214  214-948-5731                     609  201-676-7070
    215  412-633-5600                     612  402-345-0600
    216  614-464-2345                     613  416-487-3641
    217  217-525-7000                     614  614-464-2345
    218  402-345-0600                     615  615-373-5791
    219  317-265-7027                     616  313-223-8690
    301  301-534-1168                     617  617-787-2750
    302  412-633-5600                     618  217-525-7000
    303  303-232-2300                     701  402-345-0600
    304  304-344-8041                     702  415-546-1341
    305  912-784-9111                     703  804-747-1411
    306  ****N/A*****                     704  912-784-9111
    307  303-232-2300                     705  416-487-3641
    308  402-345-0600                     707  415-546-1341
    309  217-525-7000                     709  ****N/A*****
    312  312-769-9600                     712  402-345-0600
    313  313-223-8690                     713  713-658-1793
    314  314-436-3321                     714  213-995-0221
    315  518-471-8111                     715  414-424-5690
    316  816-275-2782                     716  518-471-8111
    317  317-265-7027                     717  412-633-5600
    318  318-227-1551                     801  303-232-2300
    319  402-345-0600                     802  617-787-2750
    401  617-787-2750                     803  912-784-9111
    402  402-345-0600                     804  804-747-1411
    403  403-425-2652                     805  415-546-1341
    404  912-784-9111                     806  512-828-2502
    405  405-236-6121                     807  416-487-3641
    406  303-232-2300                     808  212-226-5487
    408  415-546-1341                       BERMUDA ONLY
    412  412-633-5600                     809  212-334-4336
    413  617-787-2750                     812  317-265-7027
    414  414-424-5690                     813  813-228-7871
    415  415-546-1132                     814  412-633-5600
    416  416-487-3641                     815  217-525-7000
    417  314-436-3321                     816  816-275-2782
    418  514-861-6391                     817  214-948-5731
    419  614-464-2345                     819  514-861-6391
    501  405-236-6121                     901  615-373-5791
    502  502-583-2861                     902  902-421-4110
    503  503-241-3440                     903  ****N/A*****
    504  504-245-5330                     904  912-784-9111
    505  303-232-2300                     906  313-223-8690
    506  506-657-3855                     907  ****N/A*****
    507  402-345-0600                     912  912-784-9111
    509  206-382-8000                     913  816-275-2782
    512  512-828-2501                     914  518-471-8111
    513  614-464-2345                     915  512-828-2501
    514  514-861-6391                     916  415-546-1341
    515  402-345-0600                     918  405-236-6121
    516  518-471-8111                     919  912-784-9111


BELL USES THESE #'S MAINLY TO FIND OUT WHO OWNS A # THAT A CUSTOMER CLAIMS HE
NEVER CALLED.

NOTE:  THIS IS THE MOST COMPLETE LIST OF CN/A #'S IN MY POSSESSION (WITH ONLY
5 #'S NOT AVAILABLE) THIS LIST WAS COPYRIGHTED IN 1982 BY "JUDAS GERARD" AS
IT ORIGINALLY APPEARED IN TAP ISSUE #78.  (TAP, ROOM 603, 147 W 42ND ST, NEW
YORK, NY 10036--SUBSCRIPTIONS $10/YR.)

AT&T NEWSLINES: ---------------

NEWSLINES ARE RECORDINGS THAT BELL EMPLOYEES CALL UP TO FIND OUT THE LATEST
INFO ON STOCK, TECHNOLOGY, ETC.  CONCERNING THE BELL SYSTEM.

HERE ARE THE #'S THAT ARE CURRENTLY KNOWN TO PHREAKS (AT LEAST ME, ANYWAY):


201-483-3800 NJ        513-421-9060 OH
203-771-4920 CT        516-234-9914 NY
212-393-2151 NY        518-471-2272 NY
213-621-4141 CA        617-955-1111 MA
213-829-0111 CA (GTE)  702-789-6711 NV
213-449-8830 CA        713-224-6116 TX
312-368-8000 IL        714-238-1111 CA
313-223-7223 MI        717-255-5555 PA
314-247-5511 MO        717-787-1031 PA
408-493-5000 CA        802-955-1111 VE
412-633-3333 PA        808-533-4426 HI
414-678-3511 WI        813-223-5666 FL
416-929-4323 ONT.      914-948-8100 NY
503-228-6271 OR        916-480-8000 CA

======= =LOOPS= =======

FIRST OF ALL, YOU MUST UNDERSTAND THE CONCEPT OF LOOPS.  I THINK THAT THE
BEST WAY THAT THIS IS UNDERSTOOD IS THE WAY THAT PHRED PHREEK EXPLAINED IT...

"NO SELF-RESPECTING PHONE PHREAK CAN GO THROUGH LIFE WITHOUT KNOWING WHAT A
LOOP IS, HOW TO USE ONE, AND THE TYPES THAT ARE AVAILABLE.  THE LOOP IS A
GREAT ALTERNATIVE COMMUNICATION MEDIUM THAT HAS MANY POTENTIAL USES THAT
HAVENT'T EVEN BEEN TAPPED YET.  IN ORDER TO EXPLAIN WHAT A LOOP IS, IT WOULD
BE HELPFUL TO VISUALIZE TWO PHONE NUMBERS (LINES) JUST FLOATING AROUND IN THE
TELCO CENTRAL OFFICE (CO).  NOW, IF YOU (AND A FRIEND PERHAPS) WERE TO CALL
THESE TWO NUMBERS AT THE SAME TIME, POOOOPFFF!!!, YOU ARE NOW CONNECTED
TOGETHER.  I HEAR WHAT YOU'RE SAYING OUT THERE..., "BIG DEAL" OR "WHY SHOULD
MA BELL COLLECT HERE TWO MSU'S (MESSAGE UNITS) FOR ONE LOUSY PHONE CALL!?"
WELL... THINK AGAIN.  HAVEN'T YOU EVER WANTED SOMEONE TO CALL YOU BACK BUT,
WERE RELUCTANT TO GIVE OUT YOUR HOME PHONE NUMBER (LIKE THE LAST TIME YOU
TRIED TO GET YOUR  FRIEND'S UNLISTED # FROM THE BUSINESS OFFFICE)?  OR HOW
ABOUT A COLLECT CALL TO YOUR FRIEND WAITING ON A LOOP, WHO WILL GLADLY ACCEPT
THE CHARGES?  OR BETTER YET, STUMBLING UPON A LOOP THAT YOU DISCOVER THAT HAS
MULTI-USER CAPABILITY (FOR THOSE LATE-NIGHT CONFERENCES).  BEST OF ALL IS
FINDING A NON-SUPERVISED LOOP THAT DOESN'T CHARGE ANY MSU'S OR TOLLS TO ONE
OR BOTH PARTIES.  EXAMPLE:  MANY MOONS AGO, A LOOP AFFECTIONATELY KNOWN AS
'THE 332 LOOP' WAS NON-SUP (IE, NONSUPERVISED) ON THE TONE SIDE.  I HAD MY
FRIEND IN CALIFORNIA DIAL THE FREE (NON-SUP) SIDE, (212) 332-9906 AND I
DIALED THE SIDE THAT CHARGED, 332-9900.  AS YOU CAN SEE, I WAS CHARGED ONE
MSU, AND MY FRIEND WAS CHARGED ZILCH, FOR AS LONG AS WE WISHED TO TALK!!!"

*****

AHHH...HAVE I PERKED YOUR INTEREST YET?  IF SO, HERE IS HOW TO FIND A LOOP OF
YOU VERY OWN.  FIRST, DO ALL OF YOU LOOP SEARCHING AT NIGHT!  THIS IS BECAUSE
THE LOOPS SERVE A GENUINE TEST FUNCTION WHICH TELCO USES DURING THE DAY.  (WE
DON'T WANT TO RUN INTO AN IRATE LINEMAN NOW, DO WE?)  TO FIND A LOOP, HAVING
2 #'S IS A DEFINITE PLUS.  IF NOT, HAVE A FRIEND TO DIAL #'S AT HIS LOCATION.
 LAST RESORT, TRY DIALING FROM TWO ADJACENT PAY PHONES.  NOW GET YOUR TRUSTY
WHITE PAGES (*), AND TURN TO THE PAGE WHERE IT LISTS THE # OF MSU'S FROM YOUR
EXCHANGE (OR EXCHANGES IN YOUR PRIMARY CALLING AREA) THE IDEA IS TO FIND A
LOOP THAT IS WITHIN YOUR PRIMARY CALLING AREA OR IS ONLY 1 MSU IN YOUR AREA
(CALL AREA A).  THIS IS SO YOU DON'T GO BANKRUPT TRYING TO FIND A LOOP.
WRITE DOWN ALL OF THESE EXCHANGES AND DO A 99XX SCAN OF THOSE EXCHANGES (99XX
SCANNING WILL BE DISCUSSED SHORTLY).

BEFORE WE GET UP TO 99XX SCANNING, WE WILL LOOK AT SOME OTHER LOOP INFO:
LOOPS ARE FOUND PAIRS WHICH ARE USUALLY CLOSE TO EACH OTHER.  FOR EXAMPLE, IN
NPA 212, WHERE THE INFAMOUS LOOPS ARE FOUND, THERE IS A STANDARD LOOP FORMAT:

MANHATTAN & BRONX-------NNX-9977/9979 BROOKLYN & QUEENS-------NNX-9900/9906

NNX IS THE EXCHANGE TO BE SCANNED. HERE ARE SOME LOOPS THAT HAVE BEEN FOUND
IN NYC.  THESE ARE USED MOSTLY BY PHREAKS AND CALL-IN LINES FOR PIRATE RADIO
STATIONS:
212-220-9900/9906
212-283-9977/9979
212-352-9900/9906
212-365-9977/9979
212-529-9900/9906
212-562-9977/9979
212-982-9977/9979
212-986-9977/9979

THE LOWER # IS THE TONE SIDE (SINGING SWITCH).  THE HIGHER # IS ALWAYS SILENT
.  THE TONE DISAPPEARS ON THE LOWER # WHEN SOMEBODY DIALS IN THE OTHER SIDE
OF THE LOOP.  IF YOU ARE ON THE HIGHER #, YOU'LL HAVE TO LISTEN TO THE CLICKS
TO SEE IF SOMEBODY DIALED-IN.  THE NYC 982 & 986 LOOPS ARE DIFFERENT FROM
OTHERS. USUALLY WHEN YOU PARK ON A LOOP, YOU WILL HEAR WHO EVER CALLS IN ON
THE OTHER HALF.  WHEN THEY'RE DONE, THE NEXT CALLER (IF ANY) WILL BE QUEUED
IN, ONE AFTER ANOTHER.  ON THE NYC 982 & 986, YOU SOMETIMES CAN'T GET ANY
MORE CALLERS IN AFTER THE FIRST.  FURTHERMORE, IF YOU PARK ONE OF THESE LOOPS
AND THERE IS NOBODY ON THE OTHER END FOR MORE THAN 4 MINUTES, YOU MAY BE
AUTOMATICALLY DISCONNECTED.  THESE LOOPS ARE GOOD FOR BACK-UP PURPOSES WHEN
ALL OTHER LOOPS ARE BUSY.


99XX SCANNING: --------------
MOST EVERY EXCHANGE IN THE BELL SYSTEM HAS A WIDE VARIETY OF TEST #'S AND
OTHER "GOODIES," SUCH AS LOOPS.

THESE "GOODIES" ARE USUALLY FOUND BETWEEN 9900 AND 9999 IN YOUR LOCAL
EXCHANGE.  IF YOU HAVE THE TIME AND INITIATIVE, SCAN YOUR EXCHANGE AND YOU
MAY BECOME LUCKY!

HERE ARE MY FINDINGS IN THE 914-268:
9901 - VERIFICATION (RECORDING OF A/C AND EXCHANGE)
9936 - VOICE # TO THE TELCO CO
9937 - VOICE # TO THE TELCO CO
9941 - CARRIER
9960 - OSC. TONE (TONE SIDE LOOP)
9963 - TONE (STOPS:  MUTED)
9966 - CARRIER
9968 - TONE THAT DISAPPEARS--RESPONDS TO CERTAIN
       TOUCH-TONE KEYS

MOST OF THE #'S BETWEEN 9900 & 9999 WILL RING, BE BUSY, GO TO A SPECIAL
INTERCEPT OPERATOR ("WHAT #, PLEASE?") , OR WILL GO TO A "THE # YOU HAVE
REACHED..." RECORDING.  WHAT YOU FIND DEPENDS UPON THE SWITCHING EQUIPMENT IN
THE EXCHANGE AND THE TELCO OPERATING COMPANY.

WHEN SEARCHING FOR LOOPS, YOU MAY FIND ONE OF THE FOLLOWING POSSIBILITIES
WHEN YOU FIND ONE:

1.  YOU CAN HEAR THROUGH THE LOOP (NOT MUTED), BUT THERE
    IS A 1/2 SECOND CLICK EVERY 10 SECONDS THAT INTERRUPTS
    THE AUDIO.  THIS TYPE IS GOOD FOR BACK-UP USE BUT THE
    %$#'&" CLICK IS SUPER ANNOYING.

2.  ONE SIDE OF THE LOOP IS BUSY; TRY IT AGAIN LATER.

3.  THE TONE DISAPPEARS, BUT YOU CANNOT HEAR THROUGH IT
    (THE LOOP IS MUTED, TRY AGAIN IN A MONTH OR SO)

4.  YOU GET "THE # YOU HAVE REACHED RECORDING."  NO LOOP THERE!

MOST LOOPS ARE MUTED (#3), BUT THEIR STATUS DOES CHANGES FROM TIME-TO-TIME.
IT ALL DEPENDS IF THE TELCO MAINTENANCE PERSONNEL REMEMBER TO "THROW THE
SWITCH", IE, TURN OFF THE LOOP.

SINCE I HAVE DONE THE ABOVE 914-268 99XX SCAN, CONGERS (268) HAS INSTALLED
NEW SWITCHING EQUIPMENT (DMS100).  SOME OF THE NUMBERS ARE THE SAME, BUT I
HAVE NOTICED THAT ON THE DMS100, THE RECORDINGS ARE ALSO STORED IN THIS AREA.
 268-9903, 9906, 9909, & 9912 ARE ALL DIFFERENT RECORDINGS.  ALSO, THERE ARE
2 FORTRESS FONE RECORDINGS AT 268-9911 (DEPOSIT 5 CENTS OR ELSE) AND 268-9913
(DEPOSIT 10 CENTS).  NONE OF THESE RECORDINGS SUPE AND ALOT OF OTHER 99XX #'S
DON'T SUPE EITHER.

IN SOME AREAS (LIKE MD), 9906-7 IS RINGBACK.  IN WASHINGTON, THERE IS A SWEEP
TONE TEST AT (202) 560-9944.  IN NYC (212), YOU'LL FIND THE INFAMOUS LOOP
LINES (AS MENTIONED ABOVE).

IT WILL BE EASIER TO SCAN YOUR EXCHANGE IF YOU MAKE UP A CHART LIKE THE ONE
BELOW:


NPA-NNX-99XX SCAN

--------------------------------------
!99X X>:0 :1 :2 :3 :4 :5 :6 :7 :8 :9 !
--------------------------------------
!990   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!991   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!992   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!993   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!994   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!995   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!996   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!997   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!998   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------
!999   :  :  :  :  :  :  :  :  :  :  !
--------------------------------------

THIS LEAVES YOU WITH 100 BOXES (1 FOR EACH # BETWEEN 9900 & 9999).  YOU
SHOULD MAKE YOUR BOXES BIG ENOUGH SO YOU CAN WRITE SOME SORT OF SHORTHAND IN
THEM.  FOR EXAMPLE:

B - BUSY   (TRY AGAIN AT ANOTHER TIME)
R - RINGS  (TRY AGAIN AT ANOTHER TIME)
O - INTERCEPT OPERATOR ("WHAT # YOU CALLING?)
R1- RECORDING 1 (MAKE A MARGIN NOTE OF THE TYPES OF REORDINGS
    YOU GET)
T - TONE   ] TONE AT A LOWER # + IGNORE
I - IGNORE ] AT A HIGHER # = LOOP
V - VOICE # TO TELCO CO - THEY USUALLY ANSWER WITH THE
    CITY NAME OR AREA.
C - CARRIER

THERE WILL BE OTHERS AND YOU SHOULD USE OTHER CHARACTERS THAT YOU CAN
UNDERSTAND.  NOW, BACK TO LOOPS!  AS YOU MAY HAVE NOTICED IN MY 914-268 SCAN,
I FOUND A MUTED LOOP AND A TONE SIDE.  914-268 FAILED TO COME UP WITH THE
SILENT SIDE OF A LOOP!  THEREFORE, THERE IS NO LOOP IN THAT EXCHANGE.  I THEN
SCANNED ANOTHER EXCHANGE IN MY PRIMARY CALLING AREA (914-634) AND I FOUND A
LOOP!!

    (914) 634-9923/9924

SO, IF AT FIRST YOU DON'T SUCCEED, MOVE ONTO ANOTHER EXCHANGE.

IF YOU USE THE BOX METHOD THAT I HAVE OUTLINED ABOVE, YOU WILL SEE A T & I
NEXT TO EACH OTHER FOR A LOOP.

SOME EXCHANGES ARE SPECIAL.  FOR EXAMPLE, 914-623 IS A TESTING BUREAU.  IN
THIS EXCHANGE, NOT ONLY DID I FIND A LOOP, BUT I ALSO FOUND SEVERAL
INTERESTING TONES, NOISES, AND OTHER TEST FUNCTIONS.  ALSO, THE MORE
IMPORTANT THE EXCHANGE IS, THE MORE YOU WILL FIND.  FOR EXAMPLE, IN 914-623,
I FOUND WELL OVER 10 VOICE #'S!

ALSO, LOOPS ARE USUALLY, BUT NOT EXCLUSIVELY, FOUND IN THE 99XX SERIES.
FOR EXAMPLE:

    (713) 324-1799/1499

IS A LOOP.

THE PERFECT LOOP?  HERE IS WHAT I WOULD LOOK FOR:

 1.  NON-SUP ON ONE OR BOTH SIDES.  TO CHECK FOR A NON-SUP LOOP, GO TO A TONE
-FIRST FORTRESS FONE AND DIAL THE #.  IF IT ASKS FOR A DIME, IT IS SUPERVISED
.  IF THE CALL GOES THROUGH, THEN IT IS NON-SUPED!

 2.  800 LOOPS WOULD BE A PLUS.  THEY ARE NOT NECESSARILY FOUND BETWEEN 9900
& 9999 THOUGH.  I WOULD CHECK THE 1XXX SERIES FIRST.

 3.  MULTI-USER LOOPS ARE ALSO A PLUS FOR THOSE LATE NIGHT CONFERENCES.

FINALLY, REMEMBER IT IS ONLY A LOCAL CALL TO FIND OUT WHAT YOU CO HAS IN
STORE FOR YOU.  IF YOU FIND ANYTHING INTERESTING, BE SURE TO DROP ME A LINE.


NOTE:  YOUR LOCAL WHITE PAGES CAN BE A VALUABLE ASSET.  YOU CAN ALSO ORDER
OTHER FONE BOOKS FROM YOUR BUSINESS OFFICE (USUALLY FREE FOR BOOKS WITHIN
YOUR OPERATING COMPANY'S DISTRICT).  A LARGE FONE BOOK, SUCH AS MANHATTAN,
CONTAINS MUCH MORE INFO IN THE FIRST FEW PAGES THAN OTHER BOOKS.

=====
=ANI=
=====

AUTOMATIC NUMBER IDENTIFICATION (ANI), IS A NUMBER THAT YOU CALL UP THAT WILL
TELL YOU WHAT # YOU ARE CALLING FROM.  THIS HAS A FEW USES.  FIRST, WERE YOU
EVER SOMEWHERE AND THE FONE DIDN'T HAVE A # PRINTED ON IT?  OR PERHAPS YOU
WERE FOOLING AROUND IN SOME CANS (THOSE LARGE BOXES ON FONE POLES THAT
CONTAIN TERMINALS FOR LINEMAN USE--TO BE DISCUSSES IN A FUTURE CHAPTER.) AND
YOU WANT TO KNOW WHAT WHAT THE LINE # IS.

IN NPA 914, THE ANI IS 990.  IN NPA'S 212 & 516, ANI IS 958.  THIS VARIES
FROM AREA TO AREA.  HERE ARE SOME OTHER ANI'S THAT I HAVE SEEN:

890-751-5191 2022222222 1-XXX-1111  (IN SOME 914 AREAS, ESP.
             UNDER STEP-BY-STEP SWITCHING EQUIPMENT, YOU
             WILL HAVE TO DIAL 1-990-1111)
                   TO FIND ANI FOR OTHER AREAS, CHECK 3 DIGITS #'S FIRST,
USUALLY IN THE 9XX SERIES (EXCLUDING 911).  IN AREAS UNDER STEP-BY-STEP (TO
BE DISCUSSED IN THE NEXT PART), TRY 1-9XX-1111.  ANI MAY ALSO BE IN 99XX.
LAST RESORT, TRY TO GET FRIENDLY WITH YOUR NEIGHBOR WHO WORKS FOR THE FONE
COMPANY.


RINGBACK: ---------

RINGBACK, AS ITS NAME IMPLIES, CALLS BACK THE # YOU ARE AT WHEN YOU DIAL THE
RINGBACK #.

RINGBACK, IN NPA 914, IS 660.  YOU DIAL 660+THE LAST 4 DIGITS OF THE FONE.
YOU WILL THEN GET A TONE, HANG-UP QUICKLY AND PICK-UP IN ABOUT 2 SECONDS.
YOU WILL THEN GET A SECOND TONE, HANG-UP AGAIN AND THE FONE WILL RING.  IN
NYC, IT IS ALSO 660, BUT YOU MAY HAVE TO PRESS 6 OR 7 BEFORE YOU HANG UP FOR
THE FIRST TIME (IE, AT THE FIRST TONE).

OTHER RINGBACK #'S THAT I HAVE SEEN ARE:

26011 - THIS 5 DIGIT FORMAT IS USED PRIMARILY ON STEP-BY-STEP.
        THE LAST 2 DIGITS (11) ARE DUMMY DIGITS.
890-897-XXXX - XXXX ARE THE LAST 4 DIGITS OF THE FONE #.

119911/11911/1199911 - GTE

NNX-9906/9907 - NPA 301, NNX IS THE EXCHANGE


THE REASON YOU GET THE TONE WHEN YOU PICK-UP AFTER IT RINGS IS BECAUSE IN
SOME AREAS, PEOPLE WERE USING RINGBACK AS AN IN-HOUSE INTERCOM.  THEY WOULD
DIAL RINGBACK, AND WHEN IT STOPPED RINGING, THEY WOULD PICK-UP & TALK WITH
THE PERSON WHO PICKED UP THE OTHER EXTENSION.  BELL DIDN'T LIKE THIS SINCE
THERE IS USUALLY ONLY 1 PIECE OF EQUIPMENT IN EACH EXCHANGE THAT DOES THE
RINGBACK.  WHEN PEOPLE USED THIS AS AN INTERCOM, LINEMEN & REPAIRMEN COULN'T
GET THROUGH!  IN SOME AREAS, ESPECIALLY THOSE UNDER STEP-BY-STEP, RINGBACK
CAN STILL BE USED AS AN INTERCOM.  ALSO, UNDER STEP-BY-STEP, THE RINGBACK
PROCEDURE IT USUALLY SIMPLE.  FOR EXAMPLE, IN ONE AREA YOU WOULD DIAL 26011
AND HANG-UP; IT WOULD THEN RINGBACK.

TOUCH-TONE TEST:
----------------

IN AREAS THAT HAVE A TOUCH-TONE TEST, YOU DIAL THE RINGBACK #.  AT THE FIRST
TONE, YOU TOUCH-TONE DIGITS 1-0.  IF THEY ARE CORRECT IT WILL BEEP TWICE.

I HAVE ALSO SEEN A TT TEST IN SOME AREAS AT:  890-751-5191

COMING SOON: ------------

IN THE NEXT PART, WE WILL LOOK AT VARIOUS SWITCHING EQUIPMENT AND THE NETWORK.


BREAK UP OF BELL: -----------------

THE OPERATING COMPANIES ARE NOT GOING TO CHANGE ALL THE SWITCHING EQUIPMENT
AROUND.  WHILE THERE WILL BE SOME CHANGES, MOST OF THE INFORMATION PROVIDED
HERE WILL REMAIN PERTINENT AFTER JANUARY 1, 1984.
JUST SUBSTITUTE THE WORD "FONE NETWORK" FOR BELL SYSTEM.

PREFACE:

IN PART III, WE WILL DISCUSS THE DIALING PROCEDURES FOR DOMESTIC AS WELL AS
INTERNATIONAL DIALING.  WE WILL ALSO TAKE A LOOK AT THE TELEPHONE NUMBERING
PLAN.

===============================
=NORTH AMERICAN NUMBERING PLAN=
===============================

IN NORTH AMERICA, THE TELEPHONE NUMBERING PLAN IS AS FOLLOWS:

     A) A 3 DIGIT NUMBERING PLAN AREA (NPA) CODE, [IE, AREA CODE]
     B) A 7 DIGIT TELEPHONE # CONSISTING OF A 3 DIGIT CENTRAL OFFICE
        (CO) CODE PLUS A 4 DIGIT STATION #.

THESE 10 DIGITS ARE CALLED THE NETWORK ADDRESS OR DESTINATION CODE.  IT IS IN
THE FORMAT OF:

        AREA CODE   TELEPHONE #
        ---------   -----------

           N*X        NXX-XXX
   WHERE:  N = A DIGIT FROM 2-9
           * = THE DIGIT 0 OR 1
           X = A DIGIT 0-9

AREA CODES:
-----------

CHECK YOUR TELEPHONE BOOK OR THE SEPARATE LISTING OF AREA CODES FOUND ON MANY
BBS'S.  HERE ARE THE SPECIAL AREA CODES (SAC'S):

     510 - TWX (USA)
     610 - TWX (CANADA)
     700 - NEW SERVICE
     710 - TWX (USA)
     800 - WATS
     810 - TWX (USA)
     900 - DIAL-IT SERVICES
     910 - TWX (USA)

THE OTHER AREA CODES NEVER CROSS STATE LINES, THEREFORE EACH STATE MUST HAVE
ATLEAST ONE EXCLUSIVE NPA CODE.  WHEN A COMMUNITY IS SPLIT BY A STATE LINE,
THE CO #'S ARE OFTEN INTERCHANGABLE (IE, YOU CAN DIAL THE SAME # FROM 2
DIFFERENT AREA CODES)


TWX:

TWX (TELEX II) CONSISTS OF 5 TELETYPE-WRITER AREA CODES.  THEY ARE OWNED BY
WESTERN UNION.  THESE SAC'S MAY ONLY BE REACHED VIA OTHER TWX MACHINES.
THESE RUN AT 110 BAUD.  BESIDES THE TWX #'S, THESE MACHINES ARE ROUTED TO
NORMAL TELEPHONE #'S.  TWX MACHINES ALWAYS RESPOND WITH AN ANSWERBACK. FOR
EXAMPLE, WU'S FYI TWX # IS (910) 988-5956, THE CORRESPONDING REAL NUMBER TO
THIS IS (201) 279-5956.  THE ANSWERBACK FOR THIS SERVICE IS "WU FYI MAWA."

IF YOU DON'T WANT TO BUY A TWX MACHINE, YOU CAN STILL SEND TWX MESSAGES USING
EASYLINK [800/325-4112 - SEE TUC'S AND MY ARTICLE ENTITLED "HACKING WESTERN
UNION'S EASYLINK]

700:

AT THE TIME OF THIS WRITING, THE 700 EXCHANGE DOES NOT YET EXIST.  AT&T PLANS
TO USE IT SOON THOUGH.  THEY PLAN TO MAKE IT A TYPE OF FANCY CALL FORWARDING
SERVICE.  IT WILL BE TARGETED TOWARDS SALESMEN ON THE RUN.

TO UNDERSTAND HOW IT WORKS, I'LL EXPLAIN IT WITH AN EXAMPLE.  LET'S SAY JOE Q
. SALESPIG WORKS FOR AT&T SECURITY AND HE IS ON THE RUN CHASING A PHREAK
AROUND THE COUNTRY WHO ROYALLY SCREWED UP AN IMPORTANT COSMOS SYSTEM.  LET'S
SAY THAT JOE'S 700 # IS (700) 382-5968.  EVERYTIME JOE GOES TO A NEW HOTEL,
HE DIALS A SPECIAL 700 #, ENTERS A CODE, AND THE # WHERE HE IS STAYING.  NOW,
IF HIS BOSS RECEIVED SOME IMPORTANT INFO, ALL HE WOULD DO IS DIAL (700) 382
-5968 AND IT WOULD RING WHEREVER JOE LAST PROGRAMMED IT TO.  NEAT, HUH?

800:

THIS SAC IS ONE OF MY FAVORITES SINCE IT ALLOWS FOR TOLL-FREE CALLS.

INWARD WATS (INWATS):  INWARD WIDE AREA TELECOMMUNICATIONS SERVICE IS THE 800
#'S THAT WE ARE ALL FAMILIAR WITH.  800 #'S ARE SET UP IN SERVICE AREAS OR
BANDS.  THERE ARE 6 OF THESE.  BAND 6 IS THE LARGEST AND YOU CAN CALL A BAND
6 # FROM ANYWHERE IN THE US EXCEPT THE STATE WHERE THE CALL IS TERMINATED
(THIS IS WHY MOST COMPANIES HAVE ONE 800 # FOR THE COUNTRY AND THEN ANOTHER
FOR JUST ONE STATE).  BAND 5 INCLUDES THE 48 CONTIGUOUS STATES.  ALL THE WAY
DOWN TO BAND 1 WHICH INCLUDES ONLY THE STATES CONTIGUOUS TO THAT ONE.
THEREFORE, LESS PEOPLE CAN REACH A BAND 1 INWATS # THAT A BAND 6 #.

INTRASTATE INWATS #'S (IE, YOU CAN CALL IT FROM ONLY 1 STATE) ALWAYS HAVE A 2
AS THE LAST DIGIT IN THE EXCHANGE (IE, 800-NX2-XXXX).  THE NXX ON 800 #'S
REPRESENT THE AREA WHERE THE BUSINESS IS LOCATED.  FOR EXAMPLE, A # BEGINNING
WITH 800-431 WOULD TERMINATE AT A NY CO

800 #'S ALWAYS END UP IN A HUNT SERIES IN A CO.  THIS MEANS THAT IT TRIES THE
FIRST # ALLOCATED TO THE COMPANY FOR THEIR 8P0 LINES; IF THIS IS BUSY IT WILL
THEN TRY THE NEXT #, ETC).  YOU MUST HAVE A MINIMUM OF TWO LINES PER EACH 800
#.  FOR EXAMPLE. TRAVELNET USES A HUNT SERIES.  IF YOU DIAL (800) 521-8400,
IT WILL FIRST TRY THE # ASSOCIATED WITH 8400; IF IT IS BUSY IT WILL GO TO THE
NEXT AVAILABLE PORT, ETC.  INWATS CUSTOMERS ARE BILLED BY THE # OF HOURS OF
CALLS THAT ARE MADE TO THEIR #.

OUTWATS (OUTWARD WATS):  OUTWATS ARE FOR MAKING OUTGOING CALLS ONLY.  LARGE
COMPANIES USE OUTWATS SINCE THEY RECEIVE BULK-RATE DISCOUNTS.  SINCE OUTWATS
# CANNOT HAVE INCOMING CALLS, THEY ARE IN THE FORMAT OF:
     (800) *XX-XXXX

WHERE * IS THE DIGIT 0 OR 1 WHICH CANNOT BE DIALED UNLESS YOU BOX THE CALL.
THE *XX IDENTIFIES THE TYPE OF SERVICE AND THE AREAS THAT THE COMPANY CAN
CALL.

REMEMBER: INWATS + OUTWATS = WATS EXTENDER (SEE PART I)

900:

THIS DIAL-IT SAC IS A NATIONWIDE DIAL-IT SERVICE.  IT IS USED FOR TAKING
TELEVISION POLLS AND OTHER STUFF.  THE FIRST MINUTE CURRENTLY COSTS AN
OUTRAGEOUS 50 CENTS AND EACH ADDITIONAL MINUTE COSTS 35 CENTS.  BELL TAKES IN
ALOT OF REVENUE IN THIS WAY.

DIAL (900) 555-1212 TO FIND OUT WHAT IS CURRENTLY ON THE SERVICE.


CO CODES: ---------

THESE IDENTIFY THE SWITCHING OFFICE WHERE THE CALL IS TO BE ROUTED.

THE FOLLOWING CO CODES ARE RESERVED NATIONWIDE:

     555 - DIRECTORY ASSISTANCE
     844 - TIME    ] THESE ARE NOW IN
     936 - WEATHER ] THE 976 EXCHANGE
     950 - FUTURE SERVICES
     958 - PLANT TEST
     959 - PLANT TEST
     970 - PLANT TEST (TEMPORARY)
     976 - DIAL-IT SERVICES

ALSO, THE 3 DIGIT ANI & RINGBACK #'S ARE REGARDED AS PLANT TEST AND ARE THUS
RESERVED.  THESE NUMBERS VARY FROM AREA TO AREA.

950:

[ALSO SEE PART I]

HERE ARE THE SERVICES THAT ARE CURRENTLY ON THE 950 EXCHANGE:

     1000 - SPC
     1022 - MCI EXECUNET
     1033 - US TELEPHONE
     1044 - ALLNET
     1066 - LEXITEL
     1088 - SBS SKYLINE

THESE SCC'S (SPECIALIZED COMMON CARRIERS) ARE FREE FROM FORTRESSES!

PLANT TESTS:

THESE INCLUDE ANI, RINGBACK, AND OTHER VARIOUS TESTS.

976:

DIAL 976-1000 TO SEE WHAT IS CURRENTLY ON THE SERVICE.  ALSO, MANY BBS'S HAVE
A LISTING OF THESE #'S.


N11 CODES:
----------

BELL IS TRYING TO PHASE SOME OF THESE OUT, BUT THEY STILL EXIST IN MANY AREAS.

     011 - INTERNATIONAL DIALING PREFIX
     211 - COIN REFUND OPERATOR
     411 - DIRECTORY ASSISTANCE
     611 - REPAIR SERVICE
     811 - BUSINESS OFFICE
     911 - EMERGENCY


=======================
=INTERNATIONAL DIALING=
=======================

WITH INTERNATIONAL DIALING, THE WORLD HAS BEEN DIVIDED INTO 9 NUMBERING ZONES.

TO MAKE AN INTERNATION CALL, YOU MUST DIAL:
     INT. PREFIX + COUNTRY CODE + NAT. #

IN NORTH AMERICA, THE INTERNATIONAL DIALING PREFIX IS 011 FOR STATION-TO
-STATION CALLS AND 01 FOR OPERATOR-SERVICED CALLS.  IDDD STANDS FOR
INTERNATIONAL DIRECT DISTANCE DIALING.

THE COUNTRY CODE, WHICH VARIES FROM 1 TO 3 DIGITS, ALWAYS HAS THE WORLD
NUMBERING ZONE AS THE FIRST DIGIT.  FOR EXAMPLE, THE COUNTRY CODE FOR THE
UNITED KINGDOM IS 44, THUS IT IS IN WORLD NUMBERING ZONE 4.  SOME BOARDS MAY
CONTAIN A COMPLETE LISTING OF OTHER COUNTRY CODES, BUT HERE ARE A FEW:

     1 - NORTH AMERICA (US, CANADA,ETC)
    20 - EGYPT
   258 - MOZAMBIQUE
    34 - SPAIN
    49 - GERMANY
    52 - MEXICO (SOUTHERN PORTION)
    61 - AUSTRALIA
     7 - USSR
    81 - JAPAN
    98 - IRAN

IF YOU CALL FROM AN AREA OTHER THAN NORTH AMERICA, THE FORMAT IS GENERALLY
THE SAME.  FOR EXAMPLE, LET'S SAY YOU WANTED TO CALL THE WHITE HOUSE FROM
SWITZERLAND.  FIRST YOU WOULD DIAL 00 (THE SWISS INTERNATIONAL DIALING PREFIX
), THEN 1 (THE US COUNTRY CODE), FOLLOWED BY 202-456-1414 (THE NATIONAL # FOR
THE WHITE HOUSE).

ALSO, COUNTRY CODE 87 IS RESERVED FOR MARITIME MOBILE SERVICE, IE CALLING
SHIPS:

     871 - MARISAT (ATLANTIC)
     872 - MARISAT (PACIFIC)
     873 - MARISAT (INDIAN)

INTERNATIONAL SWITCHING:

IN NORTH AMERICA, THERE ARE CURRENTLY 7 NO. 4 ESS'S THAT PERFORM THE DUTY OF
ISC (INTERNATION SWITCHING CENTERS).  ALL INTERNATIONAL CALLSDIALED FROM
NUMBERING ZONE 1 WILL BE ROUTED THROUGH ONE OF THESE "GATEWAY CITIES."  THEY
ARE:

     182 -  WHITE PLAINS, NY
     183 -  NEW YORK, NY
     184 -  PITTSBURGH, PA
     185 -  ORLANDO, FL
     186 -  OAKLAND, CA
     187 -  DENVER, CO
     188 -  NEW YORK, NY

THE 18X SERIES ARE OPERATOR ROUTING CODES FOR OVERSEAS ACCESS (TO BE FURTHER
DISCUSSED WITH BLUE BOXES).  ALL INTERNATIONAL CALLS USE A SIGNALING SYSTEM
CALLED CCITT.  IT IS AN INTERNATIONAL STANDARD FOR SIGNALING.

PREFACE:
--------

   PART IV WILL DEAL WITH THE VARIOUS TYPES OF OPERATORS, OFFICE HIERARCHY, &
SWITCHING EQUIPMENT.

OPERATORS:
----------

   THERE ARE MANY TYPES OF OPERATORS IN THE NETWORK AND THE MORE COMMON ONES
WILL BE DISCUSSED.
TSPS OPERATOR:
--------------
   THE TSPS (TRAFFIC SERVICE POSITION SYSTEM) OPERATOR IS PROBABLY THE BITCH
(OR BASTARD FOR THE PHEMALE LIBASTARD EQUIPEMENT FAILURES OR IF THE OFFICE IS
NOT EQUIPPED FOR CAMA (MOST ARE).

<I ONCE HAD AN EQUIPMENT FAILURE HAPPEN TO ME & THE TSPS OPERATOR CAME ON AND
SAID, "WHAT # ARE YOU CALLING FROM?"  OUT OF CURIOSITY, I GAVE HER THE # TO
MY CO, SHE THANKED ME & THEN I WAS CONNECTED TO A CONVERSION THAT APPEARED TO
BE BETWEEN A FRAMEMAN & HIS WIFE.  THEN IT STARTED RINGING THE PARTY I
ORIGINALLY WANTED TO CALL & EVERYONE PHREAKED OUT (EXCUSE THE PUN).  I
IMMEDIATELY DROPPED THIS DUAL LINE CONFERENCE!> YOU SHOULDN'T MESS WITH THE
TSPS OPERATOR SINCE SHE KNOWS WHERE YOU ARE CALLING FROM.  SHE ALSO KNOWS
WHETHER OR NOT YOU ARE AT A FORTRESS FONE & SHE CAN TRACE CALLS QUITE READILY
.  OUT OF ALL THE OPERATORS, SHE IS ONE OF THE MOST DANGEROUS.

INWARD OPERATOR:
----------------

   THIS OPERATOR ASSISTS YOUR LOCAL TSPS ("O") OPERATOR IN CONNECTING CALLS.
SHE WILL NEVER QUESTION A CALL AS LONG AS THE CALL IS WITHIN HER SERVICE AREA
.  SHE CAN ONLY BE REACHED VIA OTHER OPERATORS OR BY A BLUE BOX.  FROM A BB,
YOU WOULD DIAL KP+NPA+121+ST FOR THE INWARD OPERATOR THAT WILL HELP YOU
CONNECT ANY CALLS WITHIN THAT NPA AREA ONLY.  (BLUE BOXING WILL BE DISCUSSED
IN A FUTURE PART OF BASIC TELCOM)

DIRECTORY ASSISTANCE OPERATOR:
------------------------------

   THIS IS THE OPERATOR THAT YOU ARE CONNECTED TO WHEN YOU DIAL:  411 OR NPA
-555-1212.  SHE DOES NOT READILY KNOW WHERE YOU ARE CALLING FROM.  SHE DOES
NOT HAVE ACCESS TO UNLISTED #'S, BUT SHE DOES KNOW IF AN UNLISTED # EXISTS
FOR A CERTAIN LISTING.

   THERE IS ALSO A DIRECTORY ASSISTANCE FOR DEAF PEOPLE WHO USE
TELETYPEWRITERS IF YOU MODEM CAN TRANSFER BAUDOT (THE APPLE CAT CAN), THEN
YOU CAN CALL HER UP AND HAVE AN INTERESTING CONVERSATION WITH HER.  THE # IS:
 800- 855-1155.  SHE USES THE STANDARD TELEX ABBREVIATIONS SUCH AS GA FOR GO
AHEAD.  THEY TEND TO BE NICER & WILL TALK LONGER THAN YOUR REGULAR OPERATORS.
 ALSO, THEY ARE MORE VULNERABLE INTO BEING TALKED OUT OF INFORMATION THROUGH
THE PROCESS OF "SOCIAL ENGINEERING" AS CHESHIRE CATALYST WOULD PUT IT.

   OTHER OPERATORS HAVE ACCESS TO THEIR OWN DA BY DIALING KP+NPA+131+ST (MF).

   THIS IS A LITTLE OUT OF THE SCOPE OF THIS TUTORIAL, BUT MANY TELCO'S ARE
NOW CHARGING FOR CALLS TO DIR. ASST.  YOU CAN BEAT THIS BY:

(1) COUNT HOW MANY CALLS YOU MAKE TO DIRECTORY ASSISTANCE IN A BILLING PERIOD
.  GO TO A FORTRESS FONE & DIAL DA.  WHEN THE OPERATOR COMES ON, GIVE HER A
NAME THAT YOU KNOW HAS AN UNLISTED # OR ASK FOR A TOWN THAT ISN'T IN THE NPA.
 SHE WILL THEN ASK FOR YOUR # SO SHE CAN CREDIT THE CALL TO YOU.  GIVE HER
YOUR HOME #; SHE DOESN'T KNOW THAT YOU ARE MAKING A FREE CALL FROM THE
FORTRESS.  JUST MAKE SURE THAT YOU DON'T CREDIT YOURSELF FOR MORE CALLS THAN
YOU ACTUALLY MADE OR YOU MIGHT HAVE A FEW PROBLEMS!

(2) IF YOU HAVE A BAUDOT TERMINAL, USE THE 800 #; IT'S FREE & THERE IS ONE #
FOR ALL REQUESTS.

C/NA OPERATORS:
---------------

   C/NA OPERATORS ARE OPERATORS THAT DO EXACTLY THE OPPOSITE OF WHAT
DIRECTORY ASSISTANCE OPERATORS ARE FOR.  SEE PART II, FOR MORE INFO ON C/NA &
#'S.  IN MY EXPERIENCES, THESE OPERATORS KNOW MORE THAN THE DA OP'S DO & THEY
ARE MORE SUSCEPTIBLE TO "SOCIAL ENGINEERING." IT IS POSSIBLE TO BULLSHIT A C
/NA OPERATOR FOR THE NON-PUB DA # (IE, YOU GIVE THEM THE NAME & THEY GIVE YOU
THE UNLISTED #).  THIS IS DUE TO THE FACT THAT THEY ASSUME YOUR ARE A PHELLOW
COMPANY EMPLOYEE.

INTERCEPT OPERATOR:
-------------------

   THE INTERCEPT OPERATOR IS THE ONE THAT YOU ARE CONNECTED TO WHEN THERE ARE
NOT ENOUGH RECORDINGS AVAILABLE TO TELL YOU THAT THE # HAS BEEN DISCONNECTED
OR CHANGED.  SHE USUALLY SAYS, "WHAT # YOU CALLIN'?" WITH A FOREIGN ACCENT.
THIS IS THE LOWEST OPERATOR LIFEFORM.  EVEN THOUGH THEY DON'T KNOW WHERE YOU
ARE CALLING FROM, IT IS A WASTE OF YOUR TIME TO TRY TO VERBALLY ABUSE THEM
SINCE THEY USUALLY UNDERSTAND VERY LITTLE ENGLISH.

OTHER OPERATORS:
----------------

   AND THEN THERE ARE THE:  MOBILE, SHIP-TO-SHORE, CONFERENCE, MARINE VERIFY,
"LEAVE WORD & CALL BACK," ROUT & RATE (KP+NPA+141+ST), & OTHER SPECIAL
OPERATORS WHO HAVE ONE PURPOSE OR ANOTHER IN THE NETWORK.

   PROBLEMS WITH AN OPERATOR?  ASK TO SPEAK TO THEIR SUPERVISOR... WHICH IS
THE EQUIVALENT OF THE MADAME IN A WHOREHOUSE (IF YOU WILL EXCUSE THE ANALOGY).

   BY THE WAY, SOME CO'S THAT WILL ALLOW YOU TO DIAL A 1 OR 0 AS THE 4TH
DIGIT, WILL ALSO ALLOW YOU TO CALL SPECIAL OPERATORS WITHOUT A BLUE BOX.
THIS IS VERY RARE THOUGH!  FOR EXAMPLE, 212-121-1111 WILL GET YOU A NY INWARD
OPERATOR.


==================
=OFFICE HIERARCHY=
==================


   EVERY SWITCHING OFFICE OFFICE IN NORTH AMERICA (THE NPA SYSTEM), IS
ASSIGNED AN OFFICE NAME & CLASS.  THERE ARE FIVE CLASSES OF OFFICES NUMBERED
1 THROUGH 5.  YOUR CO IS MOST LIKELY A CLASS 5 OR END OFFICE.  ALL LONG
-DISTANCE (TOLL) CALLS ARE SWITCHED BY A TOLL OFFICE WHICH CAN BE A CLASS 4,
3, 2, OR 1 OFFICE.  THERE IS ALSO A 4X OFFICE CALLED AN INTERMEDIATE POINT.
THE 4X OFFICE IS A DIGITAL ONE THAT CAN HAVE AN UNATTENDED EXCHANGE ATTACHED
TO IT (KNOWN AS A REMOTE SWITCHING UNIT-RSU).

   THE FOLLOWING CHART WILL LIST THE OFFICE #, NAME, & HOW MANY OF THOSE
OFFICES EXISTED IN NORTH AMERICA IN 1981.

CLASS       NAME       ABB  # EXISTING
----- ---------------- --- ------------
  1   REGIONAL CENTER  RC         12
  2   SECTIONAL CENTER SC         67
  3   PRIMARY CENTER   PC        230
  4   TOLL CENTER      TC      1,300
  4P  TOLL POINT       TP
  4X  INTERMEDIATE PT  IP
  5   END OFFICE       EO     19,000
  R   RSU              RSU

   WHEN CONNECTING A CALL FROM ONE PARTY TO ANOTHER, THE SWITCHING EQUIPMENT
USUALLY TRIES TO FIND THE SHORTEST ROUTE BETWEEN THE CLASS 5 END OFFICE OF
THE CALLER & THE CLASS 5 END OFFICE OF THE CALLED PARTY.  IF NO INTER-OFFICE
TRUNKS EXIST BETWEEN THE 2 PARTIES, IT WILL THEN MOVE UPTO THE NEXT HIGHEST
OFFICE FOR SERVICING (CLASS 4).  IF THE CLASS 4 OFFICE CANNOT HANDLE THE CALL
BY SENDING IT TO ANOTHER CLASS 4 OR 5 OFFICE, IT WILL BE SENT TO THE NEXT
OFFICE IN THE HIERARCHY (3).  THE SWITCHING EQUIPMENT FIRST USES THE HIGH
-USAGE INTEROFFICE TRUNK GROUPS, IF THEY ARE BUSY IT THEN GOES TO THE FINAL
TRUNK GROUPS ON THE NEXT HIGHEST LEVEL.  IF THE CALL CANNOT BE CONNECTED THEN
, YOU WILL PROBABLY GET A RE-ORDER (120IPM BUSY SIGNAL) SIGNAL.  AT THIS TIME
, THE GUYS AT NETWORK OPERATIONS ARE PROBABLY SHITTING IN THEIR PANTS AND
TRYING TO AVOID THE DREADED NETWORK DREADLOCK (AS SEEN ON TV!).

   IT IS ALSO INTERESTING TO NOTE THAT 9 CONNECTIONS IN TANDEM IS CALLED RING
-AROUND-THE ROSY AND IT HAS NEVER OCCURRED IN TELEPHONE HISTORY.  THIS WOULD
CASE AN ENDLESS LOOP CONNECTION.

[ A NEAT WAY TO REALLY SCREW-UP THE NETWORK]

   THE 10 REGIONAL CENTERS IN THE US & THE 2 IN CANADA ARE ALL INTERCONNECTED
.  THEY FORM THE FOUNDATION OF THE ENTIRE TELEPHONE NETWORK.  SINCE THERE ARE
ONLY 12 OF THEM, THEY ARE LISTED BELOW:

CLASS 1 REGIONAL OFFICE LOCATION    NPA
----------------------------------  ---
DALLAS 4 ESS                        214
WAYNE, PA                           215
DENVER 4T                           303
REGINA NO.2 SP1-4W   [CANADA]       306
ST. LOUIS 4T                        314
ROCKDALE, GA                        404
PITTSBURGH 4E                       412
MONTREAL NO.1 4AETS  [CANADA]       504
NORWICH, NY                         607
SAN BERNARDINO, CA                  714
NORWAY, IL                          815
WHITE PLAINS 4T, NY                 914

   THE FOLLOWING DIAGRAM DEMONSTRATES HOW THE VARIOUS OFFICES MAY BE
CONNECTED:

      ^----------^----------^ REGIONAL
     __        __        __OFFICES
1 <----> 1 <----> 1
     ---        ---        ---
                              OTHERS\/
-^-------^-------^------^---------^
__     __     __    ___      __
2     3     4    4P      5
---     ---     ---    -^^-      ---

 ^----^       ^----^
__  __    ___  __
3  4    4X  5   ^-----^
---  -^-    ----  ---  ___  __
      ^                4X  5
    ___               ----  ---
    5R -------------^
    -^^-      /-----------------\
     __      __     __      ___
     R      4     5      5R
     ---      ---     ---      ----


*** NOTE:  THE PRECEDING DIAGRAM USED CERTAIN LOWER CASE CHARACTERS THAT MAY
NOT BE VIEWED AS I INTENDED THEM IF YOU ARE NOT USING AS LOWER CASE TERMINAL.


=====================
=SWITCHING EQUIPMENT=
=====================


   IN THE NETWORK, THERE ARE 3 MAJOR TYPES OF SWITCHING EQUIPMENT.  THEY ARE
KNOWN AS:  STEP, CROSSBAR, & ESS.

STEP-BY-STEP (SXS)

   THE STEP-BY-STEP, A/K/A THE STROWGER SWITCH OR TWO-MOTION SWITCH, WAS
INVENTED IN 1889 BY AN UNDERTAKER NAMED ALMON STROWGER.  HE INVENTED THIS
MECHANICAL SWITCHING EQUIPMENT BECAUSE THE FELT THAT THE BIASED OPERATOR WAS
ROUTING ALL REQUESTS FOR AN 'UNDERTAKER' TO HER HUSBAND'S BUSINESS.

   BELL STARTED USING THIS SYSTEM IN 1918 & AS OF 1978, OVER 53% OF THE BELL
EXCHANGES USED THIS METHOD OF SWITCHING.

   STEP-BY-STEP SWITCHING IS CONTROLLED DIRECTLY BY THE DIAL PULSES WHICH
MOVE A SERIES OF SWITCHES (CALLED THE SWITCH TRAIN) IN ORDER.  WHEN YOU FIRST
PICK UP THE FONE UNDER SXS, A LINEFINDER
ACKNOWLEDGES THE REQUEST (SOONER OR LATER) BY SENDING A DIAL TONE.  IF YOU
THEN DIALED 1234, THE ESUIPMENT WOULD FIRST FIND AN IDLE SELECTOR SWITCH.  IT
WOULD THEN MOVE VERTICALLY 1 PULSE, IT WOULD THEN MOVE HORIZONTALLY TO FIND A
FREE SECOND SELECTOR, IT WOULD THEN MOVE 2 VERTICAL PULSES, STEP HORIZONTALLY
TO FIND THE NEXT SELECTOR, ETC.  THUS THE FIRST SWITCH IN THE TRAIN TAKES NO
DIGITS, THE SECOND SWITCH TAKES 1 DIGIT, THE THIRD SWITCH TAKES 1 DIGIT, &
THE LAST SWITCH IN THE TRAIN (CALLED THE CONNECTOR) TAKES THE LAST 2 DIGITS &
CONNECTS YOUR CALLS.  A NORMAL (10,000 LINE) EXCHANGE REQUIRES 4 DIGITS (0000
-9999) TO CONNECT A LOCAL CALL & THUS IT TAKES 4 SWITCHES TO CONNECT EVERY
CALL (LINEFINDER, 1ST & 2ND SELECTORS, & THE CONNECTOR) .

   WHILE IT WAS THE FIRST, SXS SUCKS FOR THE FOLLOWING REASONS:

[1] THE SWITCHED OFTEN BECOME JAMMED THUS THE CALLS OFTEN BECOME BLOCKED.

[2] YOU CAN'T USE DTMF (DUAL-TONE MULTI-FREQUENCY A/K/A TOUCH-TONE) DIRECTLY.
 IT IS POSSIBLE THAT THE TELCO MAY HAVE INSTALLED A CONVERSION KIT BUT THEN
THE CALLS WILL GO THROUGH JUST AS SLOW AS PULSE, ANYWAY!

[3] THEY USE A LOT OF ELECTRICITY & MECHANICAL MAINTENANCE. (BAD FROM TELCO
POINT OF VIEW)

[4] EVERYTHING IS HARDWIRED.  THEY CAN STILL HOOK UP PEN REGISTERS & OTHER
SHIT ON THE LINE SO IT IS NOT EXACTLY A PHREAK HAVEN.  YOU CAN IDENTIFY SXS
OFFICES BY:

(A) LACK OF DTMF OR PULSING DIGITS AFTER DIALING DTMF.

(B) IF YOU GO NEAR THE CO, IT WILL SOUND LIKE A TYPEWRITER TESTING FACTORY.

(C) LACK OF SPEED CALLING, CALL FORWARDING, & OTHER CUSTOMER SERVICES.

(D) FORTRESS FONES THAT WANT YOUR MONEY FIRST (AS OPPOSED TO DIAL TONE FIRST
ONES).

   THE PRECEDING DON'T NECESSARILY IMPLY THAT YOU HAVE SXS BUT THEY SURELY
GIVE EVIDENCE THAT IT MIGHT BE.  ALSO, IF ANY OF THE ABOVE CHARACTERISTICS
EXIST, IT CERTAINLY ISN'T ESS!  ALSO, SXS HAVE PRETTY MUCH BEEN ERADICATED
FROM LARGE METROPOLITAN AREAS SUCH AS NYC (212).

CROSSBAR:
---------

   THERE ARE 3 MAJOR TYPES OF CROSSBAR SYSTEMS CALLED:  NO. 1 CROSSBAR (1XB)
,NO. 4 CROSSBAR (4XB), & NO. 5 CROSSBAR (5XB).  5XB HAS BEEN THE PRIMARY END
OFFICE SWITCH OF BELL SINCE THE 60'S AND THUS IT IS IN WIDE-USE.

   CROSSBAR USES A COMMON CONTROL SWITCHING METHOD.  WHEN THERE IS AN
INCOMING CALL, A STORED PROGRAM DETERMINES ITS ROUTE THROUGH THE SWITCHING
MATRIX.

   IN CROSSBAR, THE BASIC OPERATION PRINCIPLE IS THAT A HORIZONTAL & A
VERTICAL LINE ARE ENERGIZED IN A MATRIX KNOWN AS THE CROSSPOINT MATRIX.  THE
POINT WHERE THESE 2 LINES MEET IN THE MATRIX IS THE CONNECTION.


+===+
=ESS=
+===+

   ELECTRONIC SWITCHING SYSTEM (ESS) THE PHREAK'S NIGHTMARE COME TRUE (OR
ORWELL'S PROPHECY AS 2600 PUTS IT)

   ESS IS BELL'S MOVE TOWARDS THE AIRSTRIP ONE SOCIETY DEPICTED IN ORWELL'S
1984.  WITH ESS, EVERY SINGLE DIGIT THAT YOU DIAL IS RECORDED--EVEN IF IT IS
A MISTAKE.  THEY KNOW WHO YOU CALL, WHEN YOU CALL, HOW LONG YOU TALKED FOR, &
PROBABLY WHAT YOU TALKED ABOUT (IN SOME CASES).  ESS CAN (AND IS) ALSO
PROGRAMMED TO PRINT OUT #'S OF PEOPLE WHO MAKE EXCESSIVE CALLS TO 800 #'S OR
DIRECTORY ASSISTANCE.  THIS IS CALLED THE "800 EXCEPTIONAL CALLING REPORT."
ESS COULD ALSO BE PROGRAMMED TO PRINT OUT LOGS OF WHO CALLS CERTAIN #'S--LIKE
A BOOKIE, A KNOWN COMMUNIST, A BBS, ETC THE THING TO REMEMBER WITH ESS IS
THAT IT IS A SERIES OF PROGRAMS WORKING TOGETHER.  THESE PROGRAMS CAN BE VERY
EASILY CHANGED TO DO WHATEVER THEY WANT IT TO DO.  ONE PHREAK WHOM I KNOW HAS
SOOE ESS SOURCE CODE LISTING WHICH IS INCREDIBLY COMPLEX (AS WELL AS
DOCUMENTED--GRACIAS DIOS).  THIS SYSTEM MAKES THE JOB OF BELL SECURITY, THE
FBI, NSA, & OTHER ORGANIZATIONS THAT LIKE TO INVADE PRIVACY INCREDIBLY EASY.

   WITH ESS, TRACING IS DONE IN MICROSECONDS (EINE AUGENBLICK) & THE RESULTS
ARE PRINTED AT THE CONSOLE OF A BELL GESTAPO OFFICER.  ESS WILL ALSO PICK UP
ANY "FOREIGN" TONES ON THE LINE SUCH AS 2600 HZ!

   BELL PREDICTS THAT THE COUNTRY WILL BECOME TOTALLY ESS BY THE 1990'S.

   YOU CAN IDENTIFY ESS BY THE FOLLOWING WHICH ARE USUALLY ESS FUNCTIONS:

[1] DIALING 911 FOR HELP.

[2] DIAL-TONE-FIRST FORTRESSES.

[3] CUSTOM CALLING SERVICES SUCH AS:  CALL FORWARDING, SPEED DIALING, & CALL
WAITING.  (ASK YOUR BUSINESS OFFICE IF YOU CAN GET THESE.)

[4] ANI (AUTOMATIC NUMBER IDENTIFICATION) ON LD CALLS.

   PHREAKING DOES NOT COME TO A COMPLETE HALT UNDER ESS THOUGH--JUST BE VERY
CAREFUL, THOUGH!!!

   DUE TO THE FACT THAT ESS SENDS A COMPUTER GENERATED "ARTIFICIAL RING,"
WHERE THE VOICE IS NOT CONNECTED DIRECTLY TO THE CALLED PARTIES LINE UNTIL HE
PICKS UP, BLACK BOXES & INFINITY TRANSMITTERS WILL NOT WORK!

*** NOTE:  ANOTHER INTERESTING WAY TO FIND OUT WHAT TYPE OF EQUIPMENT YOU ARE
ON IS TO RAID THE TRASH CAN OF YOU LOCAL CO--THIS ART WILL DISCUSSED IN A
SEPARATE ARTICLE SOON.

COMING SOON:
------------

   IN THE PART V, WE WILL START TO TAKE A LOOK AT TELEPHONE ELECTRONICS.

FURTHER READING:
----------------

   FOR MORE INFORMATION ON THE ABOVE TOPICS, I SUGGEST THE FOLLOWING:

NOTES ON THE NETWORK, AT&T, 1980.

UNDERSTANDING TELEPHONE ELECTRONICS, TEXAS INSTRUMENTS, 1983.

   AND SUBSCRIPTIONS TO: TAP, ROOM 603, 147 W 42 ST, NEW YORK, NY 10036.
SUBSCRIPTIONS ARE $10/YEAR.  BACK ISSUES ARE $0.75.  THE CURRENT ISSUES IS
#90 (JAN/FEB 1984) 2600, BOX 752, MIDDLE ISLAND, NY 11953.  SUBSCRIPTIONS ARE
$10/YEAR.  BACK ISSUES ARE $1 EACH.  THE CURRENT ISSUE IS #4 (APRIL 1984).

   THEY ARE BOTH EXCELLENT SOURCES OF ALL SORTS OF INFORMATION (PRIMARILY
PHREAKING/HACKING).

PREFACE:

PREVIOUS INSTALLMENTS OF THIS SERIES WERE FOCUSED ON TELEPHONY FROM A NETWORK
POINT-OF-VIEW.  PART V WILL DEAL WITH TELEPHONE ELECTRONICS FOCUSING
PRIMARILY ON THE SUBSCRIBER'S TELEPHONE.  HEREINAFTER SIMPLY REFERRED TO AS
"FONE."

WIRING:
-------

ASSUMING A STANDARD ONE-LINE FONE, THERE ARE USUALLY 4 WIRES THAT LEAD OUT OF
THE FONE SET.  THESE ARE STANDARDLY COLORED RED, CREEN, YELLOW, & BLACK.  THE
RED & GREEN SIRES ARE THE TWO THAT ARE ACTUALLY HOOKED UP TO YOUR CO.  THE
YELLOW WIRE IS SOMETIMES USED TO RING DIFFERENT FONES ON A PARTY LINE (IE,
ONE #, SEVERAL FAMILIES--FOUND PRIMARILY IN RURAL AREAS WHERE THEY PAY LESS
FOR THE SERVICE AND THEY DON'T USE THE FONE AS MUCH); OTHERWISE, THE YELLOW
IS USUALLY JUST IGNORED.  ON SOME TWO-LINE FONES, THE RED & GREEN WIRES ARE
USED FOR THE FIRST FONE # AND THE YELLOW & BLACK ARE USED FOR THE SECOND LINE
.  IN THIS CASE THERE MUST BE AN INTERNAL OR EXTERNAL DEVICE THAT SWITCHES
BETWEEN THE TWO LINES AND PROVIDES A HOLD FUNCTION.  (SUCH AS RADIO SHACK'S
OUTRAGEOUSLY PRICED 2 LINE & HOLD MODULE9.

IN TELEPHONY, THE RED & GREEN WIRES ARE OFTEN REFERRED TO AS TIP (T) & RING
(R).  THE TIP IS USUALLY THE MORE POSITIVE OF THE TWO WIRES.  THIS NAMING
GOES BACK TO THE OLD OPERATOR CORD BOARDS WHERE ONE OF THE WIRES WAS THE TIP
OF THE PLUG AND THE OTHER WAS THE RING (OF THE BARREL).

A ROTARY FONE (AKA DIAL OR PULSE) WILL WORK FINE REGARDLESS WHETHER THE RED
(OR GREEN) WIRE IS CONNECTED THE TIP(+) OR RING(-).  A TOUCH-TONE (TM) FONE
IS A DIFFERENT STORY, THOUGH.  IT WILL NOT WORK EXCEPT IF THE TIP(+) IS THE
GREEN WIRE.  [ALTHOUGH, SOME OF THE MORE EXPENSIVE DTMF FONES DO HAVE A
RECTIFIER BRIDGE WHICH COMPENSATES FOR POLARITY REVERSAL.]  THIS I WHY UNDER
CERTAIN (NON-DIGITAL) SWITCHILG EQUIPMENT YOU CAN REVERSE THE RED & GREEN
WIRES ON A TOUCH-TONE FONE AND RECEIVE FREE DTMF SERVICE.  EVEN THOUGH IT WON
'T BREAK DIAL TONE, REVERSING THE WIRES ON A ROTARY LINE ON A DIGITAL SWITCH
WILL CAUSE THE TONES TO BE GENERARTED.

VOLTAGES, ETC.
--------------

WHEN YOUR TELEPHONE IS ON-HOOK (IE, HUNG UP) THERE IS APPROXIMATELY 48 VOLTS
OF DC CURRENT (VDC) FLOWING THROUGH THE TIP & RING.  WHEN THE HANDSET OF A
FONE IS LIFTED A FEW SWITCHES CLOSE WHICH CAUSE A LOOP TO BE CONNECTED (KNOWN
AS THE "LOCAL LOOP") BETWEEN YOUR FONE & THE CO.  ONCE THIS HAPPENS DC
CURRENT IS ABLE TO FLOW THROUGH THE FONE WITH LESS RESISTANCE.  THIS CAUSES A
RELAY TO ENERGIZE WHICH CAUSES OTHER CO EQUIPMENT TO REALIZE THAT YOU WANT
SERVICE.  EVENTUALLY, YOU SHOULD END UP WITH A DIAL TONE.  THIS ALSO CAUSES
THE 48 VDC TO DROP DOWN INTO THE VICINITY OF 13 VOLTS.  THE RESISTANCE OF THE
LOOP ALSO DROPS BELOW THE 2500 OHM LEVEL.

AS OF NOW, YOU ARE PROBABLY SAYING TO YOURSELF THAT THIS IS ALL NICE AND
TECHNICAL BUT WHAT THE HELL GOOD IS THE INFORMATION.  WELL, ALSO CONSIDER
THAT THIS VOLTAGE (& RESISTANCE) DROP IS HOW THE CO DETECTS THAT A FONE WAS
TAKEN OFF HOOK (PICKED UP).  IN THIS WAY, THEY KNOW WHEN TO START BILLING THE
CALLING NUMBER.  NOW WHAT DO YOU SUPPOSE WOULD HAPPEN IF A DEVICE SUCH AS A
RESISTOR OR A ZENER DIODE WAS PLACED ON THE CALLED PARTIES LINE SO THAT THE
VOLTAGE WOULD DROP JUST ENOUGH TO ALLOW TALKING BUT NOT ENOUGH TO START
BILLING?  FIRST OFF, THE CALLING PARTY WOULD NOT BE BILLED FOR THE CALL BUT
CONVERSATION COULD BE PERSUED.  SECONDLY, THE CO EQUIPMENT WOULD THINK THAT
THE FONE JUST KEPT ON RINGING.  THE TELCO CALLS THIS A "NO-NO" (TOLL FRAUD TO
BE MORE SPECIFIC) WHILE PHONE PHREAKS AFFECTIONATELY CALL THIS MUTE A BLACK
BOX.

THE FOLLOWING ARE INSTRUCTIONS ON HOW TO BUILD A SIMPLE BLACK BOX.  OF COURSE
, ANYTHING THAT PREVENTS THE VOLTAE FROM DROPPING WOULD WORK.

YOU ONE OR TWO PARTS:  A SPST TOGGLE SWITCH AND A 10,000 OHM (10 K), 1/2 WATT
RESISTOR.  ANY ELECTRONICS STORE SHOULD STOCK THESE PARTS.  NOW, CUT 2 PIECES
OF WIRE (ABOUT 6 INCHES LONG) AND ATTACH ONE END OF EACH WIRE TO ONE OF THE
TERMINALS ON THE SWITCH.  NOW TURN YOUR K500 (STANDARD DESK FONE) UPSIDE DOWN
AND TAKE OFF THE COVER.  LOCATE THE 2 SCREWS ON THE NETWORK BOX LABELED >F<
AND >RR<.  WRAP THE RESISTOR BETWEEN THE 2 SCREWS MAKING SURE THAT IT DOESN'T
TOUCH ANY OTHER TERMINALS!.  NOW CONNECT ONE WIRE FROM THE SWITCH TO THE RR
TERMINAL.  FINALLY, ATTACH THE REMAINING WIRE TO THE GREEN WIRE (DISCONNECT
IT FROM ITS TERMINAL).  NOW BRING THE SWITCH OUT THE REAR OF THE FONE AND
REPLACE THE COVER.

PUT THE SWITCH IN A POSITION WHERE YOU RECEIVE A DIAL TONE.  MARK THIS
POSITION NORMAL.  MARK THE OTHER SIDE FREE.

WHEN YOUR PHRIENDS CALL (AT A PREARRANGED TIME), QUICKLY LIFT & DROP THE
RECEIVER AS FAST A POSSIBLE.  THIS WILL STOP THE RINING (DO IT AGAIN IF IT
DOESN'T) WITH OUT STARTING THE BILLING.  IT IS IMPORTANT THAT YOU DO IT
QUICKLY (LESS THAN ONE SECOND THEN PUT THE SWITCH IN THE FREE POSITION AND
PICK UP THE FONE.  KEEP ALL CALL SHORT AND PREFERRABLY UNDER 15 MINUTES.

NOTE:  IF ANYONE PICKS UP AN EXTENSION IN THE CALLED PARTIES HOUSE AND THAT
FONE IS NOT SET FOR FREE THEN BILLING WILL START.

NOTE #2:  AN OLD WAY OF SIGNADLING A PHRIEND THAT YOU ARE ABOUT TO CALL IS
MAKING A COLLECT CALL TO A NON-EXISTANT PERSON IN THE HOUSE.  SINCE YOUR
FRIEND WILL NOT ACCEPT THE CHARGES, HE WILL KNOW THAT YOU ARE ABOUT TO CALL
AND THUS PREPARE THE BLACK BOX (OR VISA VERSA).

WARNING:  THE TELCO CAN DETECT BLACK BOXES IF THEY SUSPECT ONE ON YOUR LINE.
THIS IS DONE DUE TO THE PRESENCE OF AC VOICE SIGNAL AT THE WRONG DC LEVEL!

PICTORAL DIAGRAM:
(STANDARD ROTARY K500 FONE)

---------------------------------------
!                                     !
***BLUE WIRE**>>F<                    !
!            *   *                    !
**WHITE WIRE**   *                    !
!                *                    !
!            REISTOR                  !
!                *                    !
!                *                    !
!              >RR<*******SWITCH****  !
!                                  *  !
****GREEN WIRE**********************  !
!                                     !
---------------------------------------

NOTE:  THE BLACK BOX WILL NOT WORK UNDER ESS OR OTHER SIMILAR DIGITAL
SWITCHES SINCE ESS DOE NOT CONNECT THE VOICE CIRCUITS UNTIL THE FONE IS
PICKED UP (& BILLING STARTS).  INSTEAD, ESS USES AN "ARTIFICIAL" COMPUTER
GENERATED RING.

RINGING:
--------

TO INFORM A SUBSCRIBER OF AN INCOMING CALL, THE TELCO SENDS 90 VOLTS (RMS) OF
AC CURRENT DOWN THE LINE (AT AROUND 15 TO 60 HZ)  IN STANDARD FONES, THIS
CAUES A METAL ARMATURE TO BE ATTRACTED ALTERNATELY BETWEEN TWO ELECTRO
-MAGNETS THUS STRIKING 2 BELLS.  OF COURSE, THE STANDARD BELL (PATENTED IN
1878 BY TOM A. WATSON) CAN BE REPLACED BY A MORE MODERN ELECTRONIC BELL OR
SIGNALING DEVICE.

ALSO, YOU CAN HAVE LIGHTS AND OTHER SIMILAR DEVICES IN LIEU OF (OR IN
CONJUNCTION WITH) THE BELL.  A SIMPLE NEON LIGHT (WITH ITS CORRESPONDING
RESISTOR) CAN SIMPLY BE CONNECTED BETWEEN THE RED & GREEN WIRES (USUALLY L1 &
L2 ON THE NETWORK BOX) SO THAT IT LIGHTS UP ON INCOMING CALLS.  A REGULAR 60
WATT LIGHT BULB CAN ALSO BE HOOKED UP USING A SIMPLE (120 VAC) RELAY.

WARNING:  90 & 120 VAC CAN GIVE QUITE A SHOCK.  EXERCISE EXTREME CAUTION IF
YOU WISH TO FURTHER PERSUE THESE TOPICS.

ALSO INCLUDED IN THE RINGING CIRCUIT IS A CAPACITOR TO PREVENT THE DC CURRENT
FROM INTERFERRING WITH THE BELL [A CAPACITOR WILL PASS AC CURRENT WHILE IT
WILL PREVENT DC CURRENT FROM FLOWING (BY STORING IT)].

ANOTHER REASON THAT THE TELCO HATES BLACK BOXES IS BECUASE RINGING USES ALOT
OF COMMON-CONTROL EQUIPEMET, IN THE CO, WHICH USE ALOT OF ELECTRICITY.  THUS
THE RINGING GENERATORS ARE BEING TIED UP WHILE A FREE CALL IS BEING MADE.
USUALLY CALLS THAT ARE ALLOWED TO RING FOR A LONG PERIOD OF TIME MAY BE
CONSTRUED AS SUSPICIOUS.  SOME OFFICES MAY BE SET UP TO DROP A TROUBLE CARD
FOR LONG PERIODS OF RINGING THEN A "NO-NO" DETECTION DEVICE MAY BE PLACED ON
THE LINE.

INCIDENTALLY, THE TERM "RING TRIP" REFERS TO THE CO PROCESS INVOLVED TO STOP
THE AC RINGING SIGNAL WHEN THE CALLING FONE GOES OFF HOOK.

NOTE:  IT IS SUGGESTED THAT YOU ACTUALLY DISSECT FONES TO HELP YOU BETTER
UNDERSTAND THEM.  IT WILL ALSO HELP YOU TO BETTER UNDERSTAND THE CONCEPTS
HERE IF YOU ACTUALLY PROVE THEM TO YOURSELF.  FOR EXAMPLE, ACTUALLY TAKE THE
VOLTAGE READINGS ON YOUR FONE LINE [ANY SIMPLE MULTI-TESTER (A MUST) WILL DO.
] PHREAKING IS AN INTERACTIVE PROCESS NOT A PASSIVE ONE!

DIALING:
--------

ON A STANDARD FONE, THERE ARE TWO COMMON TYPES OF DIALING:  PULSE & DTMF.  OF
COURSE, SOME PEOPLE INSIST UPON BEING DIFFERENT AND DON'T USE THE DT THUS
LEAVING THEM WITH MF (MULTI FREQUNCY, AKA OPERATOR, BLUE BOX) TONES.  THIS IS
ANOTHER "NO-NO" AND THE TELCO SECURITY GENTELMEN HAVE A SPECIAL KNACK FOR
DEALING WITH SUCH "PHREAKS" ON THE NETWORK.

WHEN YOU DIAL ROTARY, YOU ARE ACTUALLY RAPIDLY BREAKING & RECONNECTING
(MAKING) THE LOCAL LOOP ONCE FOR EVERY DIGIT DIALED.  SINCE THE PHYSICAL
CONNECTION MUQT BE BROKEN, YOU CANNOT DIAL IF ANOTHER EXTENSION (OF THAT #)
IS OFF-HOOK.  NEITHER OF THE FONES WILL BE ABLE TO DIAL PULSE UNLESS THE
OTHER HANGS UP.

ANOTHER TERM OFTEN REFERRED TO IN TELEPHONE ELECTRONICS IS THE BREAK RATIO.
IN THE US, THERE ARE 10 PULES PER SECOND (MAX).  WHEN THE CIRCUIT IS OPENED
IT IS CALLED THE BREAK INTERVAL.  WHEN IT IS CLOSED IT IS CALLED THE MAKE
INTERVAL.  IN THE US, THERE IS A 60 MILLISECOND (MS) BREAK PERIOD AND A 40 MS
MAKE PERIOD.  (60+40=100 MS = 1/10 MINUTE).  THIS IS REFERRED TO AS A 60%
BREAK INTERVAL.  SOME OF THE MORE SOPHISTICATED ELECTRONIC FONES CAN SWITCH
BETWEEN A 60% & A 67% BREAK INTERVAL.  THIS IS DUE TO THE FACT THAT MANY
FOREIGN NATIOS USE A 67% BREAK INTERVAL.

HAVE YOU EVER BEEN IN AN OFFICE OR A SIMILAR FACILITY AND SAW A FONE WAITING
TO BE USED FOR A FREE CALL BUT SOME ASSHOLE PUT A LOCK ON IT TO PREVENT
OUTGOING CALLS?

WELL, DON'T FRET PHELLOW PHREAKS, YOU CAN SIMULATE PULSE DIALING BY RAPIDLY
DEPRESSING THE SWITCHOOK.  (IF YOU DEPRESS IT FOR LONGER THAN A SECOND IT
WILL BE CONSTRUED AS A DISCONNECT.)  BY RAPIDLY SWITCHOOKING YOU ARE CAUSING
THE LOCAL LOOP TO BE BROKEN & MADE SIMILAR TO ROTARY DIALING!  THUS IF YOU
CAN MANAGE TO SWITCHOOK RAPIDLY 10 TIMES YOU CAN REACH AN OPERATOR TO PLACE
ANY CALL YOU WANT!  THIS TAKES ALOT OF PRACTICE, THOUGH.  YOU MIGHT WANT TO
PRACTICE ON YOUR OWN FONE DIALIN A FRIEND'S # OR SOMETHING ELSE.
INCIDENTALLY, THIS METHOD WILL ALSO WORK WITH DTMF FONES SINCE ALL DTMF LINES
CAN ALSO HANDLE ROTARY.

ANOTHER PROBLEM WITH PULSE DIALING IS THAT IT PRODUCES HIGH-VOLTAGE SPIKES
THAT MAKE LOUD NOISES IN THE EARPIECE AND CAUSE THE BELL TO "TINKLE."  IF YOU
NEVER NOTICED THIS THEN YOUR FONE HAS A SPECIAL "ANTI-TINKLE" & EARPIECE
SHORTING CIRCUIT (MOST DO).  IF YOU HAVE EVER DISSECTED A ROTARY FONE (A MUST
FOR ANY SERIOUS PHREAK) YO WOULD HAVE NOTICED THAT THERE ARE 2 SETS OF
CONTACT THAT OPEN AND CLOSE DURING PULSING (ON THE BACK OF THE ROTARY DIAL
UNDER THE PLASTIC COVER).  ONE OF THESE ACTUALLY OPENS AND CLOES THE LOOP
WHILE THE OTHER MUTES THE EARPIECE BY SHORTING IT OUT.  THE SECOND CONTACTS
ALSO ACTIVATES A SPECIAL ANTI-TINKLE CIRCUIT THAT PUTS A 340 OHM RESISTOR
ACROSS THE RINGING CIRCUIT WHICH PREVENTS THE HIGH VOLTAGE SPIKES FROM
INTERFERRING WITH THE BELL.

DUAL TONE MULTI FREQUENCY (DTMF) IS A MODERN DAY IMPROVEMENT ON PULSE DIALING
IN SEVERAL WAYS.  FIRST OF ALL, IT IS MORE CONVENIENT FOR THE USER SINCE IT
IS FASTER AND CAN BE USED FOR SIGNALING AFTER THE CALL IS COMPLETED (IE,
SCC'S, COMPUTERS, ETC.).  ALSO, IT IS MORE UPTO PAR WITH MODERN DAY SWITCHING
EQUIPMENT (SUCH AS ESS) SINCE PULSE DIALING WAS DESIGNED TO ACTUALLY MOVE
RELAYS BY THE NUMBER OF DIGITS DIALED (IN SXS OFFICES).

EACH KEY ON A DTMF KEYPAD PRODUCES 2 FREQUENCIES SIMULTANEOUSLY (ONE FROM THE
HIGH GROUP AND ANOTHGR FROM THE LOW GROUP).

          -------------------------
LOW GROUP !  Q  ! ABC ! DEF !     !
   697 HZ-!  1  !  2  !  3  !  A  !
          !     !     !     !     !
          !-----!-----!-----!-----!
          ! GHI ! JKL ! MNO !     !
   770 HZ-!  4  !  5  !  6  !  B  !
          !     !     !     !     !
          !-----!-----!-----!-----!
          ! PRS ! TUV ! WXY !     !
   852 HZ-!  7  !  8  !  9  !  C  !
          !     !     !     1     !
          !-----!-----!-----!-----1
          !     ! OPER!     !     !
   941 HZ-!  *  !  0  !  #  !  D  !
          !     !  Z  !     !     !
          !-----!-----!-----!-----!
           1209  1336  1477  1633
             (HIGH GROUP--IN HZ)

A PORTABLE DTMF KEYPAD IS KNOWN AS A WHITE BOX.

THE FOURTH COLUMN (1633 HZ) IS NOT NORMALLY FOUND O REGULAR FONES BUT IT DOES
HAVE SEVERAL SPECIAL USES.  FOR ONE, IT IS USED TO DESIGNATE THE PRIORITY OF
CALLS ON AUTOVON, THE MILITARY FONE NETWORK.  THESE KEY ARE CALLED:  FLASH,
IMMEDIATE, PRIORITY, & ROUTINE (WITH VARIATIONS) INSTEAD OF ABCD.  SECONDLY,
THESE KEYS ARE USED FOR TESTING PURPOSES BY THE TELCO.  IN SOME AREA YOU CAN
FIND LOOPS AS WELL AS OTHER NEAT TESTS (SEE PART II) ON THE 555-1212
DIRECTORY ASSISTANCE EXCHANGE.  FOR THIS, YOU WOULD CALL UP AN DA IN CERTAIN
AREAS [THAT HAVE AN AUTOMATIC CALL DISTRIBUTOR (ACD)] AND HOLD DOWN THE "D"
KEY WHICH SHOULD BLOW THE OPERATOR OFF.  YOU WILL THEN HEAR A PULSING DIAL
TONE WHICH INDICATES THAT YOU ARE IN THE ACD INTERNAL TESTING MODE.  YOU CAN
GET ON ONE SIDE OF A LOOP BY DIALING A 6.  THE OTHER SIDE IS 7.  SOME PHREAKS
CLAIM THAT IF THE PERSON ON SIDE 6 HANGS UP, OCCASIONALLY THE EQUIPMENT WILL
SCREW UP AD START DIRECTING DIRECTORY ASSISTANCE CALLS TO THE OTHER SIDE OF
THE LOOP.  ANOTHER ALLEGED TEST IS CALLED REMOB WHICH ALLOWS YOU TO TAP INTO
LINES BY ENTERING A SPECIAL CODE FOLLOWED BY THE 7 DIGIT NUMBER YOU WANT TO
MONITOR.  THEN THERE IS THE POSSIBILITY OF MASS CONFERENCING.

ACD'S ARE BECOME RARE THOUGH.  YOU WILL PROBABLY HAVE TO MAKE SEVERAL NPA-555
-1212 CALLS BEFORE YOU FIND ONE.

YOU CAN MODIFY REGULAR FONES QUITE READILY SO THAT THEY HAVE A SWITCH TO
CHANGE BETWEEN THE 3RD AND 4TH COLUMNS.  THIS IS CALLED A SILVER BOX (AKA
GREY BOX) AD PLANS CAN BE FOUND IN TAP AS WELL AS ON MANY BBS'S.


TRANSMITTER/RECEIVER:
---------------------

WHEN YOU TALK INTO THE TRANSMITTER, THE SOUND WAVES FROM YOUR VOICE CAUSE A
DIAPHRAGM TO VIBRATE AND PRESS AGAINST THE CARBON GRANULES (OR ANOTHER
SIMILAR SUBSTANCE).  THIS CAUSES THE CARBON GRANULES TO COMPRESS AND CONTRACT
THUS CHANGING THE RESISTANCE OF THE DC CURRENT FLOWING THROUGH IT.  THEREFORE
, YOUR AC VOICE SIGNAL IS SUPERIMPOSED OVER THE DC CURRENT OF THE LOCAL LOOP.
 THE RECEIVER WORKS IN A SIMILAR FASHION WHERE THE SIMPLE TYPES UTILIZE A
MAGNET, ARMATURE, & DIAPHRAGM.

HYBRID/INDUCTION COIL:
----------------------

AS YOU MAY HAVE NOTICED, THERE ARE TWO WIRES FOR THE RECEIVER AND TWO FOR THE
TRANSMITTER IN THE FONE, YET THE LOCAL LOOP CONSISTS OF 2 WIRES INSTEAD OF 4.
 THIS 4-WIRE TO 2-WIRE CONVERSION IS DONE INSIDE THE FONE BY A DEVICE KNOWN
AS AN INDUCTION COIL WHICH USES COUPLING TRANSFORMERS.

THE REASON 2 SIRES ARE USED ON THE LOCAL LOOPS ARE BECAUSE IT IS ALOT CHEAPER
FOR THE TELCO.  ALTHOUGH, ALL OF THE INTER-OFFICE TRUNKS UTILIZE 4 WIRES.
THIS IS NECESSARY FOR FULL DUPLEX (IE, SIMULTANEOUS CONVERSATION ON BOTH
SIDES) AND FOR AMPLIFICATION DEVICES.  THERE ARE SIMILAR DEVICES IN THE CO'S,
KNOWN AS A HYBRID, THAT COUPLE THE 4-WIRE TRUNKS TO THE 2-WIRE LOCAL LOOPS
AND VISA-VERSA.

MISCELLANEOUS:--------------

IN THE TELEPHONE, THERE IS ALSO A BALANCING NETWORK CONSISTING OF A FEW
CAPACITORS & RESISTORS WHICH PROVIDE SIDETONE.  SIDETONE ALLOWS THE CALLER TO
HEAR HIS OWN VOLUME IN THE RECEIVER.  HE CAN THEN ADJUST HIS VOICE
ACCORDINGLY.  THIS PREVENTS PEOPLE FROM SHOUTING OR SPEAKING TOO SOFTLY
WITHOUT NOTICING IT.

HOLD:

WHEN A TELEPHONE GOES OFF HOOK, THE RESISTANCE DROPS BELOW 2500 OHMS.  AT
THIS POINT, THE TELCO WILL SEND A DIAL TONE.  TO PUT SOMEONE ON HOLD YOU MST
PUT A 1000 OHM RESISTOR (1 WATT) ACROS THE TIP & RING BEFORE IT REACHES THE
SWITCHOOK.  IN THIS WAY, WHEN THE FONE IS HUNG UP (FOR HOLD) THE RESISTANCE
REMAINS BELOW 2500 OHMS WHICH CAUSES THE CO TO BELIEVE THAT YOU ARE STILL OFF
-HOOK.

PREFACE:

THIS ARTICLE WILL FOCUS PRIMARILY ON THE STANDARD WESTERN ELECTRIC SINGLE-
SLOT COIN TELEPHONE (AKA FORTRESS FONE) WHICH CAN BE DIVIDED INTO 3 TYPES:

- DIAL-TONE FIRST (DTF)

- COIN-FIRST (CF):  (IE, IT WANTS YOUR $ BEFORE YOU RECEIVE A DIAL TONE)

- DIAL POST-PAY SERVICE (PP): (YOU PAY AFTER THE PARTY ANSWERS)


DEPOSITING COINS (SLUGS):
-------------------------

ONCE YOU HAVE DEPOSITED YOUR SLUG INTO A FORTRESS, IT IS SUBJECTED TO A GAMUT
OF TESTS.

THE FIRST OBSTACAL FOR A SLUG IS THE MAGNETIC TRAP.  THIS WILL STOP ANY LIGHT
-WEIGHT MAGNETIC SLUGS AND COINS.  IF IT PASSES THIS, THE SLUG IS THEN
CLASSIFIED AS A NICKEL, DIME, OR QUARTER.  EACH SLUG IS THEN CHECKED FOR
APPROPRIATE SIZE AND WEIGHT.  IF THESE TESTS ARE PASSED, IT WILL THEN TRAVEL
THROUGH A NICKEL, DIME, OR QUARTER MAGNET AS APPROPRIATE.  THESE MAGNETS SET
UP AN EDDY CURRENT EFFECT WHICH CAUSES COINS OF THE APPROPRIATE
CHARACTERISTICS TO SLOW DOWN SO THEY WILL FOLLOW THE CORRECT TRAJECTORY.  IF
ALL GOES WELL, THE COIN WILL FOLLOW THE CORRECT PATH (SUCH AS BOUNCING OFF OF
THE NICKEL ANVIL) WHERE IT WILL HOPEFULLY FALL INTO THE NARROW ACCEPTED COIN
CHANNEL.

THE RATHER ELABORATE TESTS THAT ARE PERFORMED AS THE COIN TRAVELS DOWN THE
COIN CHUTE WILL STOP MOST SLUGS AND OTHER UNDESIRABLE COINS, SUCH AS PENNIES,
WHICH MUST THEN BE RETRIEVED USING THE COIN RELEASE LEVER.

IF THE SLUG MIRACULOUSLY SURVIVES THE GAMUT, IT WILL THEN STRIKE THE
APPROPRIATE TOTALIZER ARM CAUSING A RATCHET WHEEL TO ROTATE ONCE FOR EVERY 5
-CENT INCREMENT (EG, A QUARTER WILL CAUSE IT TO ROTATE 5 TIMES).

THE TOTALIZER THEN CAUSES THE COIN SIGNAL OSCILLATOR TO READOUT A DUAL
-FREQUENCY SIGNAL INDICATING THE VALUE DEPOSITED TO ACTS (A COMPUTER) OR THE
TSPS OPERATOR.  THESE ARE THE SAME TONES USED BY PHREAKS IN THE INFAMOUS RED
BOXES.

FOR A QUARTER, 5 BEEP TONES ARE OUTPULSED AT 12-17 PULSES PER SECOND (PPS).
A DIME CAUSES 2 BEEP TONES AT 5 - 8.5 PPS WHILE A NICKEL CAUSES ONE BEEP TONE
AT 5 - 8.5 PPS.  A BEEP CONSISTS OF 2 TONES:  2200 + 1700 HZ.

A RELAY IN THE FORTRESS CALLED THE "B RELAY" (YES, THERE IS ALSO AN 'A RELAY'
) PLACES A CAPACITOR ACROSS THE SPEECH CIRCUIT DURING TOTALIZER READ- OUT TO
PREVENT THE "CUSTOMER" FROM HEARING THE RED BOX TONES.

IN OLDER 3 SLOT PHONES:  ONE BELL (1050 -1100 HZ) FOR A NICKEL, TWO BELLS FOR
A DIME, AND ONE GONG (800 HZ) FOR A QUARTER ARE USED INSTEAD OF THE MODERN
DUAL-FREQUENCY TONES.

=============
=TSPS & ACTS=
=============

WHILE FORTRESSES ARE CONNECTED TO THE CO OF THE AREA, ALL TRANSACTIONS ARE
HANDLED VIA THE TRAFFIC SERVICE POSITION SYSTEM (TSPS).  IN AREAS THAT DO NOT
HAVE ACTS, ALL CALLS THAT REQUIRE OPERATOR ASSISTANCE, SUCH AS CALLING CARD
AND COLLECT, ARE AUTOMATICALLY ROUTED TO A TSPS OPERATOR POSITION.

IN AN EFFORT TO AUTOMATE FORTRESS SERVICE, A COMPUTER SYSTEM KNOWN AS
AUTOMATED COIN TOLL SERVICE (ACTS) HAS BEEN IMPLEMENTED IN MANY AREAS.  ACTS
LISTENS TO THE RED BOX SIGNALS FROM THE FONES AND TAKES APPROPRIATE ACTION.
IT IS ACTS WHICH SAYS, "TWO DOLLARS PLEASE (PAUSE) PLEASE DEPOSIT TWO DOLLARS
FOR THE NEXT TEN SECONDS" (AND OTHER VARIATIONS).  ALSO, IF YOU TALK FOR MORE
THAN THREE MINUTES AND THEN HANG-UP, ACTS WILL CALL BACK AND DEMAND YOUR
MONEY.  ACTS IS ALSO RESPONSIBLE FOR AUTOMATED CALLING CARD SERVICE.

ACTS ALSO PROVIDE TROUBLE DIAGNOSIS FOR CRAFTSPEOPLE (REPAIRMEN SPECIALIZING
IN FORTRESSES).  FOR EXAMPLE, THERE IS A COIN TEST WHICH IS GREAT FOR TUNING
UP RED BOXES.  IN MANY AREAS THIS TEST CAN BE ACTIVATED BY DIALING 09591230
AT A FORTRESS (THANKS TO KARL MARX FOR THIS INFORMATION).  ONCE ACTIVATED IT
WILL REQUEST THAT YOU DEPOSIT VARIOUS COINS.  IT WILL THEN IDENTIFY THE COIN
AND OUTPULSE THE APPROPRIATE RED BOX SIGNAL.  THE COINS ARE USUALLY RETURNED
WHEN YOU HANG UP.

TO MAKE SURE THAT THERE IS ACTUALLY MONEY IN THE FONE, THE CO INITIATES A
"GROUND TEST" AT VARIOUS TIMES TO DETERMINE IF A COIN IS ACTUALLY IN THE FONE
.  THIS IS WHY YOU MUST DEPOSIT AT LEAST A NICKEL IN ORDER TO USE A RED BOX!

GREEN BOXES:
------------

PAYING THE INITIAL RATE IN ORDER TO USE A RED BOX (ON CERTAIN FORTRESSES)
LEFT A SOUR TASTE IN MANY RED BOXER'S MOUTHS THUS THE GREEN BOX WAS INVENTED.
 THE GREEN BOX GENERATES USEFUL TONES SUCH AS COIN COLLECT, COIN RETURN, AND
RINGBACK.  THESE ARE THE TONES THAT ACTS OR THE TSPS OPERATOR WOULD SEND TO
THE CO WHEN APPROPRIATE. UNFORTUNATELY, THE GREEN BOX CANNOT BE USED AT A
FORTRESS STATION BUT IT MUST BE USED BY THE CALLED PARTY.

HERE ARE THE TONES:

     COIN COLLECT       700 + 1100 HZ
     COIN RETURN       1100 + 1700 HZ
     RINGBACK           700 + 1700 HZ

BEFORE THE CALLED PARTY SENDS ANY OF THESE TONES, AN OPERATOR RELEASED SIGNAL
SHOULD BE SENT TO ALERT THE MF DETECTORS AT THE CO.  THIS CAN BE ACCOMPLISHED
BY SENDING 900 + 1500 HZ OR A SINGLE 2600 HZ WINK (90 MS) FOLLOWED BY A 60 MS
GAP AND THEN THE APPROPRIATE SIGNAL FOR AT LEAST 900 MS.

ALSO, DO NOT FORGET THAT THE INITIAL RATE IS COLLECTED SHORTLY BEFORE THE 3
MINUTE PERIOD IS UP.

INCIDENTALLY, ONCE THE ABOVE MF TONES FOR COLLECTING AND RETURNING COINS
REACH THE CO, THEY ARE CONVERTED INTO AN APPROPRIATE DC PULSE (-130 VOLTS FOR
RETURN & +130 VOLTS FOR COLLECT).  THIS PULSE IS THEN SENT DOWN THE TIP TO
THE FORTRESS.  THIS CAUSES THE COIN RELAY TO EITHER RETURN OR COLLECT THE
COINS.

THE ALLEGED "T-NETWORK" TAKES ADVANTAGE OF THIS INFORMATION.  WHEN A PULSE
FOR COIN COLLECT (+130 VDC) IS SENT DOWN THE LINE, IT MUST BE GROUNDED
SOMEWHERE.  THIS IS USUALLY EITHER THE YELLOW OR BLACK WIRE.  THUS, IF THE
WIRES ARE EXPOSED, THESE WIRES CAN BE CUT TO PREVENT THE PULSE FROM BEING
GROUNDED.  WHEN THE THREE MINUTE INITIAL PERIOD IS ALMOST UP, MAKE SURE THAT
THE BLACK & YELLOW WIRES ARE SEVERED; THEN HANG UP, WAIT ABOUT 15 SECONDS IN
CASE OF A SECOND PULSE, RECONNECT THE WIRES, PICK UP THE FONE, HANG UP AGAIN,
AND IF ALL GOES WELL IT SHOULD BE "JACKPOT" TIME.

PHYSICAL ATTACK:
----------------

A TYPICAL FORTRESS WEIGHS ROUGHLY 50 LBS. WITH AN EMPTY COIN BOX.  MOST OF
THIS IS ACCOUNTED FOR IN THE ARMOR PLATING.  WHY ALL THE SECURITY?  WELL,
BELL CONTRIBUTES IT TO THE FOLLOWING:

  "SOCIAL CHANGES DURING THE 1960'S MADE THE MULTISLOT COIN STATION A PRIME
TARGET FOR:  VANDALISM, STRONG ARM ROBBERY, FRAUD, AND THEFT OF SERVICE.
THIS BROUGHT ABOUT THE INTRODUCTION OF THE MORE RUGGED SINGLE SLOT COIN
STATION AND A NEW ENVIRONMENT FOR COIN SERVICE."

AS FOR PICKING THE LOCK, I WILL QUOTE MR. PHELPS:  "WE OFTEN FANTASIZE ABOUT
'PICKING THE LOCK' OR 'GETTING A MASTER KEY.'  WELL, YOU CAN FORGET ABOUT IT.
 I DON'T LIKE TO DISCOURAGE PEOPLE, BUT IT WILL SAVE YOU FROM WASTING ALOT OF
YOUR TIME--TIME WHICH CAN BE PUT TO BETTER USE (HEH, HEH)."

AS FOR PHYSICAL ATTACK, THE COIN PLATE IS SECURED ON ALL FOUR SIDE BY
HARDENED STEEL BOLTS WHICH PASS THROUGH TWO SLOTS EACH.  THESE BOLTS ARE IN
TURN INTERLOCKED BY THE MAIN LOCK.

ONE PHREAK I KNOW DID MANAGE TO TAKE ONE OF THE 'MOTHERS' HOME (WHICH WAS
ATTACHED TO A PIECE OF PLYWOOD AT A CONSTRUCTION SITE; OTHERWISE, THE
PERMANENT ONES ARE A BITCH TO DETACH FROM THE WALL!).  IT TOOK HIM ALMOST TEN
HOURS TO OPEN THE COIN BOX USING A POWER DRILL, SLEDGE HAMMERS, AND CROW BARS
(WHICH WAS EMPTY -- PERHAPS NEXT TIME, HE WILL DEPOSIT A COIN FIRST TO HEAR
IF IT SLUSHES DOWN NICELY OR HITS THE EMPTY BOTTOM WITH A CLUNK.)

TAKING THE FONE OFFERS A HIGHER MARGIN OF SUCCESS.  ALTHOUGH THIS MAY BE
DIFFICULT OFTEN REQUIRING BRUTE FORCE AND THERE HAS BEEN SEVERAL CASES OF
BACK AXLES BEING LOST TRYING TO TAKE DOWN A FONE!  A QUICK AND DIRTY WAY TO
OPEN THE COIN BOX IS BY USING A SHOTGUN.  IN DETROIT, AFTER ECOLOGISTS
CLEANED OUT A MUNICIPAL POND, THEY FOUND 168 COIN PHONE RIFLED.

IN COLDER AREAS, SUCH AS CANADA, SOME SHREWD PEOPLE TAPE UP THE FONES USING
DUCT TAPE, POUR IN WATER, AND COME BACK THE NEXT DAY WHEN THE WATER WILL HAVE
FROZE THUS EXPANDING AND CRACKING THE FONE OPEN.

IN ONE CASE, "UNAUTHORIZED COIN COLLECTORS" WHERE CAUGHT WHEN THEY BROUGHT $6
,000 IN CHANGE TO A BANK AND THE BANK BECAME SUSPICIOUS...

AT ANY RATE, THE MAIN LOCK IS AN EIGHT LEVEL TUMBLER LOCATED ON THE RIGHT
SIDE OF THE COIN BOX.  THIS LOCK HAS 390, 625 POSSIBLE POSITIONS (5 ^ 8,
SINCE THERE ARE 8 TUMBLERS EACH WITH 5 POSSIBLE POSITIONS) THUS IT IS HIGHLY
PICK RESISTANT!  THE LOCK IS HELD IN PLACE BY 4 SCREWS.  IF THERE IS
SUFFICIENT CLEARANCE TO THE RIGHT OF THE FONE, IT IS CONCEIVABLE TO PUNCTURE
IT.

PREFACE:

     AFTER MOST NEOPHYTE PHREAKS OVERCOME THEIR FASCINATION WITH METRO CODES
AND WATS EXTENDERS, THEY WILL USUALLY SEEK TO EXPLORE OTHER AVENUES IN THE
VAST PHONE NETWORK.  OFTEN THEY WILL COME ACROSS REFERENCES SUCH AS "SIMPLY
DIAL KP + 2130801050 + ST FOR THE ALLIANCE TELECONFERENCING SYSTEM IN LA."
NUMBERS SUCH AS THE ONE ABOVE WERE INTENDED TO BE USED WITH A BLUE BOX; THIS
ARTICLE WILL EXPLAIN THE FUNDAMENTAL PRINCIPLES OF THE FINE ART
OF BLUE BOXING.

GENESIS:
--------

     IN THE BEGINNING, ALL LONG DISTANCE CALLS WERE CONNECTED MANUALLY BY
OPERATORS WHO PASSED ON THE CALLED NUMBER VERBALLY TO OTHER OPERATORS IN
SERIES.  THIS IS BECAUSE PULSE (AKA ROTARY) DIGITS ARE CREATED BY CAUSING
BREAKS IN THE DC CURRENT (SEE BASIC TELCOM V).  SINCE LONG DISTANCE CALLS
REQUIRE ROUTING THROUGH VARIOUS SWITCHING EQUIPMENT AND AC VOICE AMPLIFIERS,
PULSE DIALING CANNOT BE USED TO SEND THE DESTINATION NUMBER TO THE END LOCAL
OFFICE (CO).

     EVENTUALLY, THE DEMAND FOR FASTER AND MORE EFFICIENT LONG DISTANCE (LD)
SERVICE CAUSED BELL TO MAKE A MULTI-BILLION DOLLAR DECISION.  THEY  HAD TO
CREATE A SIGNALING SYSTEM THAT COULD BE USED ON THE LD NETWORK.  BASICALLY,
THEY HAD TWO OPTIONS:

[1] TO SEND ALL THE SIGNALING AND SUPERVISORY INFORMATION (IE, ON & OFF HOOK)
OVER SEPARATE DATA LINKS.  THIS TYPE OF SIGNALING IS REFERRED TO AS OUT-OF
-BAND SIGNALING.
                 -OR-
[2] TO SEND ALL THE SIGNALING INFORMATION ALONG WITH THE CONVERSATION USING
TONES TO REPRESENT DIGITS.  THIS TYPE OF SIGNALING IS REFERRED TO AS IN-BAND
SIGNALING.

     BEING THE CHEAP BASTARD THAT THEY NATURALLY ARE, BELL CHOSE THE LATTER
(AND CHEAPER) METHOD -- IN-BAND SIGNALING.  THEY EVENTUALLY REGRETTED THIS,
THOUGH (HEH, HEH)...

IN-BAND SIGNALING PRINCIPLES:
-----------------------------

     WHEN A SUBSCRIBER DIALS A TELEPHONE NUMBER, WHETHER IN ROTARY OR TOUCH
-TONE (AKA DTMF), THE EQUIPMENT IN THE CO INTERPRETS THE DIGITS AND LOOKS FOR
A CONVENIENT TRUNK LINE TO SEND THE CALL ON ITS WAY.  IN THE CASE OF A LOCAL
CALL, IT WILL PROBABLY BE SENT VIA AN INTER-OFFICE TRUNK; OTHERWISE, IT WILL
BE SENT TO A TOLL OFFICE (CLASS 4 OR HIGHER -- SEE TELCOM IV) TO BE PROCESSED.

     WHEN TRUNKS ARE NOT BEING USED THERE IS A 2600 HZ TONE ON THE LINE; THUS
, TO FIND A FREE TRUNK, THE CO EQUIPMENT SIMPLY CHECKS FOR THE PRESENCE OF
2600 HZ. IF IT DOESN'T FIND A FREE TRUNK THE CUSTOMER WILL RECEIVE A RE-ORDER
SIGNAL (120 IPM BUSY SIGNAL) OR THE "ALL CIRCUITS ARE BUSY..." MESSAGE.   IF
IT DOES FIND A FREE TRUNK IT "SEIZES" IT -- REMOVING THE 2600 HZ.  IT THEN
SENDS THE CALLED NUMBER OR A SPECIAL ROUTING CODE TO THE OTHER END OR TOLL
OFFICE.

     THE TONES IT USES TO SEND THIS INFORMATION ARE CALLED MULTI-FREQUENCY
(MF) TONES.  AN MF TONE CONSISTS OF TWO TONES FROM A SET OF SIX MASTER TONES
WHICH ARE COMBINED TO PRODUCE 12 SEPARATE TONES.  YOU CAN SOMETIMES HEAR
THESE TONES IN THE BACKGROUND WHEN YOU MAKE A CALL BUT THEY ARE USUALLY
FILTERED OUT SO YOUR DELICATE EARS CANNOT HEAR THEM. THESE ARE NOT THE SAME
AS TOUCH-TONES.

     TO NOTIFY THE EQUIPMENT AT THE FAR END OF THE TRUNK THAT IT IS ABOUT TO
RECEIVE ROUTING INFORMATION, THE ORIGINATING END FIRST SENDS A KEY PULSE (KP)
TONE.  AT THE END OF SENDING THE DIGITS, THE ORIGINATING END THEN SENDS A
START (ST) TONE. THUS TO CALL 914-359-1517, THE EQUIPMENT WOULD SEND KP +
9143591517 + ST IN MF TONES.  WHEN THE CUSTOMER HANGS UP, 2600 HZ IS ONCE
AGAIN SENT TO SIGNIFY A DISCONNECT TO THE DISTANT END.

HISTORY:
--------

     IN THE NOVEMBER 1960 ISSUE OF THE BELL SYSTEM TECHNICAL JOURNAL, AN
ARTICLE ENTITLED "SIGNALING SYSTEMS FOR CONTROL OF TELEPHONE SWITCHING" WAS
PUBLISHED.  THIS JOURNAL, WHICH WAS SENT TO MOST UNIVERSITY LIBRARIES,
HAPPENED TO CONTAIN THE ACTUAL MF TONES USED IN SIGNALING.  THEY APPEARED AS
FOLLOWS:

   DIGIT                TONES
   -----                -----
     1              700 +  900 HZ
     2              700 + 1100 HZ
     3              900 + 1100 HZ
     4              700 + 1300 HZ
     5              900 + 1300 HZ
     6             1100 + 1300 HZ
     7              700 + 1500 HZ
     8              900 + 1500 HZ
     9             1100 + 1500 HZ
     0             1300 + 1500 HZ
     KP            1100 + 1700 HZ
     ST            1500 + 1700 HZ
     11  (*)        700 + 1700 HZ
     12  (*)        900 + 1700 HZ
     KP2 (*)       1300 + 1700 HZ

(*)  USED ONLY ON CCITT SYSTEM 5 FOR SPECIAL INTERNATIONAL CALLING.

BELL CAUGHT WIND OF BLUE BOXING IN 1961 WHEN IT CAUGHT A WASHINGTON STATE
COLLEGE STUDENT USING ONE.  THEY ORIGINALLY FOUND OUT ABOUT BLUE BOXES
THROUGH POLICE RAIDS AND INFORMANTS.  IN 1964, BELL LABS CAME UP WITH
SCANNING EQUIPMENT, WHICH RECORDED ALL SUSPICIOUS CALLS, TO DETECT BLUE BOX
USAGE.  THESE UNITS WERE INSTALLED IN CO'S WHERE MAJOR TOLL FRAUD EXISTED.
AT&T SECURITY WOULD THEN LISTEN TO THE APES TO SEE IF ANY TOLL FRAUD WAS
ACTUALLY COMMITTED.  OVER 200 CONVICTIONS RESULTED FROM THE PROJECT.
SURPRISINGLY ENOUGH, BLUE BOXING IS NOT SOLELY LIMITED TO THE ELECTRONICS
ENTHUSIAST; AT&T HAS CAUGHT BUSINESSMEN, FILM STARS, DOCTORS, LAWYERS,
COLLEGE STUDENTS, HIGH SCHOOL STUDENTS AND EVEN A MILLIONAIRE FINANCIER
(BERNARD CORNFELD) USING THE DEVICE.  AT&T ALSO SAID THAT NEARLY HALF OF
THOSE THAT THEY CATCH ARE BUSINESSMEN.

OF COURSE, PHONE PHREAKS HAVE ACHIEVED AN ALMOST CULT STATUS.  THEY HAVE ALSO
HAD THEIR FAIR SHARE OF MEDIA.  IN OCTOBER 1971, ESQUIRE PUBLISHED THE
INFAMOUS "SECRETS OF THE LITTLE BLUE BOX" ARTICLE WHICH FEATURED PHREAKS SUCH
AS CAPTAIN CRUNCH, WHO TOOK HIS NAME FROM THE CEREAL WHICH ONE GAVE AWAY
WHISTLES THAT PRODUCED A PERFECT 2600 HZ PITCH; JOE ENGRESSIA, THE BLIND
PHREAK; AND MARK BERNAY, ONE OF THE NATION'S FIRST AND OLDEST PHREAKS.
OTHERS SUCH AS APPLE COMPUTER CO-FOUNDERS STEVE WOZNIAK & STEVE JOBHAVE ALSO
HAD BLUE BOP BACKGROUNDS.  1971 ALSO SAW THE PUBLICATION OF THE FIRST ISSUE
OF YIPL, THE PHONE PHREAK NEWSLETTER, (NOW TAP) UNDER THE EDITORSHIP OF
SUPREME YIPPIE ABBIE HOFFMAN.

USAGE:
------

     TO USE A BLUE BOX, ONE WOULD USUALLY MAKE A FREE CALL TO ANY 800 NUMBER
OR DISTANT DIRECTORY ASSISTANCE (NPA-555-1212).  THIS, OF COURSE, IS
LEGITIMATE.  WHEN THE CALL IS ANSWERED, ONE WOULD THEN SWIFTLY PRESS THE
BUTTON THAT WOULD SEND 2600 HZ DOWN THE LINE.  THIS HAS THE EFFECT OF MAKING
THE DISTANT CO EQUIPMENT THINK THAT THE CALL WAS TERMINATED AND IT LEAVES THE
TRUNK HANGING.  NOW, THE USER HAS ABOUT 10 SECONDS TO ENTER IN THE TELEPHONE
NUMBER HE WISHED TO DIAL -- IN MF, THAT IS.  THE CO EQUIPMENT MERELY ASSUMES
THAT THIS CAME FROM ANOTHER OFFICE AND IT WILL HAPPILY PROCESS THE CALL.
SINCE THERE ARE NO RECORDS (EXCEPT ON TOLL FRAUD DETECTION DEVICES!) OF THESE
MF TONES, THE USER IS NOT BILLED FOR THE CALL.  WHEN THE USER HANGS UP, THE
CO EQUIPMENT SIMPLY RECORDS THAT HE HUNG UP ON A FREE CALL.

DETECTION:
----------

     BELL HAS HAD 20 YEARS TO WORK ON DETECTION DEVICES; THEREFORE, IN THIS
DAY AND AGE, THEY ARE RATHER WELL REFINED.  BASICALLY, THE DETECTION DEVICE
WILL LOOK FOR THE PRESENCE OF 2600 HZ WHERE IT DOES NOT BELONG.  IT THEN
RECORDS THE CALLING NUMBER AND ALL ACTIVITY AFTER THE 2600 HZ.  IF YOU HAPPEN
TO BE AT A FORTRESS FONE, THOUGH, AND YOU MAKE THE CALL SHORT, YOUR CHANCES
OF GETTING CAUGHT ARE SIGNIFICANTLY REDUCED (SEE TELCOM VI).  INCIDENTALLY,
THERE HAVE BEEN RUMORS OF CERTAIN TEST NUMBERS (SEE TELCOM II) THAT HOOK
DIRECTLY INTO TRUNKS THUS AVOIDING THE NEED FOR 2600 HZ AND DETECTION!

     ANOTHER WAY THAT BELL CATCHES BOXERS IS TO EXAMINE THE CAMA (CENTRALIZED
AUTOMATIC MESSAGE ACCOUNTING) TAPES.  WHEN YOU MAKE A CALL, YOUR NUMBER, THE
CALLED NUMBER, AND TIME OF DAY ARE ALL RECORDED.  THE SAME THING HAPPENS WHEN
YOU HANG UP.  THIS TAPE IS THEN PROCESSED FOR BILLING PURPOSES.  NORMALLY,
ALL FREE CALLS ARE IGNORED.  BUT BELL CAN PROGRAM THE BILLING EQUIPMENT TO
MAKE NOTE OF LENGTHY CALLS TO DIRECTORY ASSISTANCE.  THEY CAN THEN PUT A PEN
REGISTER (AKA DNR) ON THE LINE OR AN ACTUAL FULL-BLOWN TAP.  THIS DETECTION
CAN BE AVOIDED BY MAKING SHORT-HAUL (AKA LOCAL) CALLS TO BOX OFF OF.

     IT IS INTERESTING TO NOTE THAT NPA+555-1212 ORIGINALLY DID NOT RETURN
ANSWER SUPERVISION.  THUS THE CALLS WERE NOT RECORDED ON THE AMA/CAMA TAPES.
AT&T CHANGED THIS THOUGH FOR "TRAFFIC STUDIES!"

CCIS:
-----

     BESIDES DETECTION DEVICES, BELL HAS BEGUN TO GRADUALLY REDESIGN THE
NETWORK USING OUT-OF-BAND SIGNALING.  THIS IS KNOWN AS COMMON CHANNEL INTER
-OFFICE SIGNALING (CCIS).  SINCE THIS SIGNALING METHOD SENDS ALL THE
SIGNALING INFORMATION OVER SEPARATE DATA LINES, BLUE BOXING IS IMPOSSIBLE
UNDER IT.

     WHILE BEING IMPLEMENTED GRADUALLY, THIS MULTI-BILLION DOLLAR PROJECT IS
STILL STRANGLING THE FINE ART OF BLUE BOXING.  OF COURSE UNTIL THE PROJECT IS
TOTALLY COMPLETE, BOXING WILL STILL BE POSSIBLE.  IT WILL BECOME
PROGRESSIVELY HARDER TO FIND PLACES TO BOX OFF OF, THOUGH.  IN AREAS WITH
CCIS, ONE MUST FIND A DIRECTORY ASSISTANCE OFFICE THAT DOESN'T HAVE CCIS YET.
 AREA CODES IN CANADA AND PREDOMINATELY RURAL STATES ARE THE BEST BETS.  WATS
NUMBERS TERMINATING IN NON-CCIS CITIES ARE ALSO GOOD PROSPECTS.

PINK NOISE:
-----------

     ANOTHER WAY THAT MAY HELP TO AVOID DETECTION IS TOO ADD SOME "PINK NOISE
" TO THE 2600 HZ TONE.

     SINCE 2600 HZ TONES CAN BE SIMULATED IN SPEECH, THE DETECTION EQUIPMENT
MUST BE CAREFUL NOT TO MISINTERPRET SPEECH AS A DISCONNECT SIGNAL.  THUS A
VIRTUALLY PURE 2600 HZ TONE IS REQUIRED FOR DISCONNECT.

KEEPING THIS IN MIND, THE 2600 HZ DETECTION EQUIPMENT IS ALSO PROBABLY
LOOKING FOR PURE 2600 HZ OR ELSE IS WOULD BE TRIGGERED EVERY TIME SOMEONE HIT
THAT NOTE (HIGHEST E ON A PIANO = 2637 HZ).  THIS IS ALSO THE REASON THAT THE
2600 HZ TONE MUST BE SENT RAPIDLY; SOMETIMES, IT WON'T WORK WHEN THE OPERATOR
IS SAYING "HELLO, HELLO."  IT IS FEASIBLE TO SEND SOME "PINK NOISE" ALONG
WITH THE 2600 HZ.  MOST OF THIS ENERGY SHOULD BE ABOVE 3000 HZ.  THE PINK
NOISE WON'T MAKE IT INTO THE TOLL NETWORK (WHERE WE WANT OUR PURE 2600 HZ TO
HIT) BUT IT SHOULD MAKE IT PAST THE LOCAL CO AND THUS THE FRAUD DETECTORS.

CONSTRUCTION:
-------------

     WHILE STEP-BY-STEP DETAILS FOR THE CONSTRUCTION OF A BLUE BOX IS BEYOND
THE SCOPE OF THIS TUTORIAL, IT IS WORTHWHILE TO MENTION SOME OF THE DETAILS.

     FIRST THERE ARE SOME ALTERNATIVES BUT THEY ARE NOT AS GOOD AS AN ACTUAL
BLUE BOX.  MANY COMPUTERS ARE CAPABLE OF GENERATING MF TONES.  THUS, YOUR
LOCAL PHRIENDLY SOFTWARE PIRATE SHOULD HAVE A PROGRAM COMPATIBLE FOR YOUR
COMPUTER.

     HOWEVER, IT IS HIGHLY ADVISABLE NOT TO BOX FROM HOME AS STATED IN THE
TEN COMMANDMENTS (AS INTERPRETED FOR PHREAKS BY FRED STEINBECK -- TAP #86).

I.  BOX THOU NOT OVER THINE HOME
    TELEPHONE WIRES, FOR THOSE WHO
    DOEST MUST SURELY BRING THE FULL
    WRATH OF THE CHIEF SPECIAL AGENT
    DOWN UPON THY HEADS.

     ANOTHER ALTERNATIVE THAT HAS A MODERATE SUCCESS RATE INVOLVES RECORDING
THE TONES FROM A PHRIEND WITH A BOX OR COMPUTER ONTO A CASSETTE TAPE.  THEY
CAN THEN BE USED AT A FORTRESS.

     AS FOR ACTUAL CONSTRUCTION TECHNIQUES, TAP HAS DEVOTED MANY ISSUES TO
BLUE BOXING.  BASICALLY, A BLUE BOX IS MERELY A DEVICE CAPABLE OF GENERATING
TWO DIFFERENT TONES SIMULTANEOUSLY.  THERE ARE TWO BASIC CONSTRUCTION METHODS
THAT I WILL OUTLINE BELOW FOR THE ELECTRONICS HOBBYIST.

     THE FIRST INVOLVES THE USE OF TWO 555 TIMER CHIPS (OR A 556 -- I.E., TWO
555'S IN ONE CHIP).  IT OFFERS EXCELLENT FREQUENCY AND VOLTAGE STABILITY.
ALSO, IT DOES NOT NEED A DIODE MATRIX KEYPAD BUT USED DOUBLE-POLE SWITCHES
INSTEAD.  SCHEMATICS FOR THIS TYPE OF BOX CAN BE FOUND IN TAP ISSUE #29.

     THE OTHER COMMON BOX MAKES USE OF TWO INTERSIL 8038CC FUNCTION
GENERATORS.  IT ALSO REQUIRES A DIODE MATRIX KEYPAD, POTENTIOMETERS, AN LM
-100 VOLTAGE REGULATOR, A 741 OP-AMP, AND A HANDFUL OF OTHER PARTS.  THE
SCHEMATICS FOR THIS TYPE OF BLUE BOX CAN BE FOUND IN TAP #26.

     BOTH DESIGNS DRAW ABOUT 20 MA OF CURRENT.

     ALSO, MOST BLUE BOXES USE TELEPHONE EARPIECES (WITH THE VARISTOR REMOVED
) FOR SPEAKERS.  THESE CAN BE EASILY LIBERATED FROM FORTRESS FONES WITH A
SMALL COPING SAW.

     USUALLY, THE HARDEST PART ABOUT BUILDING A BLUE BOX IS THE CALIBRATION.
A FREQUENCY COUNTER IS A MUST AND AN OSCILLOSCOPE WON'T HURT.

     SOME BOXES ALSO TAKE TIMING INTO ACCOUNT.  IT IS FEASIBLE ON THE ESS
SYSTEMS THAT THEY CHECK TO SEE IF THE DIGITS ARE OF UNIFORM LENGTH.  IF THEY
AREN'T, THEY ARE PROBABLY FROM A BLUE BOX AND A TROUBLE CARD MAY BE DROPPED.
WITH THIS IN MIND, THE BELL STANDARD FOR MF PULSES AND INTERDIGIT INTERVALS
IS AROUND 75 MS.  IT VARIES WITH THE EQUIPMENT USED SINCE ESS CAN HANDLE
HIGHER SPEEDS AND DOESN'T NEED INTERDIGIT INTERVALS.

APPLICATIONS:
-------------

     BESIDES DIALING NORMAL CALLS FREE, I.E., KP+NPA+NNX+XXXX+ST, BLUE BOXES
OFFER THE ENTIRE NETWORK FOR EXPLORATION.  EMERGENCY BREAK-INS, SERVICE
MONITORING (AKA TAPS), STACKING TANDEMS (THE ART OF BUSYING OUT ALL TRUNKS
BETWEEN TWO POINTS), RE-ROUTING CALLS, CONFERENCE CALLS, AND MUCH, MUCH MORE
ARE ALL FEASIBLE.  ALTHOUGH, BELL FREQUENTLY CHANGES THESE CODES DUE TO
PHREAKS.

     HERE ARE SOME STANDARD ONES, THOUGH:


OPERATOR & OTHER CODES:
-----------------------

     (AN OPTIONAL NPA MAY PROCEED ALL OF THE NUMBERS; OTHERWISE, YOU WILL
REACH THE ONE LOCAL FOR THE AREA WHERE THE CALL IS ORIGINATED)

001      --  TRUNK ACCESS SYSTEM

009      --  RATE QUOTE SYSTEM

101      --  TOLL OFFICE TEST BOARD

121      --  INWARD OPERATOR

     THIS OPERATOR ASSISTS THE LOCAL "0" OPERATOR IN COMPLETING CALLS.  (S)HE
WILL DO VIRTUALLY ANYTHING FOR YOU PROVIDING IT IS WITHIN HER NPA.

131      --  OPERATOR DIRECTORY
             ASSISTANCE

141      --  ROUT & RATE

     (141 DEFUNCT -- USE KP + 800 + 141 + 1212 + ST)

     THESE OPERATORS ARE VERY USEFUL IF YOU KNOW HOW TO MUMBLE A FEW CRYPTIC
PHRASES AS COMPILED BELOW (WITH THANKS TO FRED STEINBECK):

TO FIND OUT...

...AREA CODES

     FOR EXAMPLE SAY , "MIAMI, FLORIDA, NUMBERS ROUTE, PLEASE."  THE R&R
OPERATOR WILL TELL YOU "305 PLUS," MEANING THAT 305 PLUS THE SEVEN DIGIT
NUMBER WILL GET YOU MIAMI.

... INWARD OPERATOR CITY CODES

     USUALLY, THE INWARD OPERATOR FOR AN AREA IS SIMPLY KP + NPA + 121 + ST.
IN SOME AREA CODES, THOUGH, THERE ARE SEVERAL LARGE CITIES AND THUS SEVERAL
INWARDS.  TO FIND THE INWARD FOR A SPECIFIC CITY, YOU WOULD SAY "916 756,
OPERATOR ROUTE, PLEASE" TO THE R&R OPERATOR WHO WILL THEN TELL YOU "916 PLUS
001 PLUS."  THIS MEANS THAT KP + 916 + 001 + 121 + ST WILL GET YOU AN INWARD
FOR SACRAMENTO, CA (916-756).

... CITY NAMES

     IF YOU WANT TO KNOW THE CITY THAT CORRESPONDS TO AN AREA CODE AND
EXCHANGE, YOU SIMPLY TELL THE R&R, "PLACE NAME, 914 390, PLEASE."  IN THIS
EXAMPLE, THE R&R OPERATOR WILL RESPOND WITH "WHITE PLAINS, NY."

... INTERNATIONAL DIRECTORY ASSISTANCE

     IF YOU NEED A DIRECTORY ROUTE FOR LONDON, YOU COULD SAY "INTERNATIONAL,
LONDON, ENGLAND.  TSPS DIRECTORY ROUTE, PLEASE."  THE R&R OPERATOR WILL
RESPOND WITH "DIRECTORY TO LONDON, ENGLAND.  COUNTRY CODE 44 PLUS 1 PLUS 986
PLUS 3611." THEREFORE TO GET A DA OPERATOR IN LONDON, YOU WOULD ROUTE
YOURSELF TO AN INTERNATIONAL SENDER AND KP + 04419863611 + ST.

... COUNTRY & CITY CODES

     IF YOU NEED TO KNOW THE COUNTRY AND CITY CODE FOR AN INTERNATIONAL
NUMBER YOU CAN SAY "INTERNATIONAL, SYDNEY, AUSTRALIA, TSPS NUMBERS ROUTE,
PLEASE" AND GET "COUNTRY CODE 61 PLUS 2."

... INTERNATIONAL INWARDS ROUTES

     TO GET ROUTING CODES FOR INTERNATIONAL INWARDS SAY "INTERNATIONAL,
LONDON, ENGLAND, TSPS INWARD ROUTE, PLEASE."  THE R&R OPERATOR WILL RESPOND
WITH "COUNTRY CODE 44 PLUS 121."

     FINALLY, TO GET LANGUAGE ASSISTANCE FOR COMPLETING A FOREIGN CALL YOU
CAN TELL THE FOREIGN INWARD, "UNITED STATES CALLING.  LANGUAGE ASSISTANCE IN
COMPLETING A CALL TO (CALLED PARTY) AT (CALLED NUMBER)."


151      --  OVERSEAS INCOMING (212 + & 914+)

160-XX0  --  VARIOUS OVERSEAS OPERATORS

161      --  TROUBLE REPORTING OPERATOR (DEFUNCT)

181      -- COIN REFUND OPERATOR

18X      -- OVERSEAS SENDERS

     TO MAKE AN INTERNATIONAL CALL, ONE WOULD KP + 011 + 0CC + ST WHERE CC IS
THE COUNTRY CODE.  THIS WILL ROUTE YOU TO THE APPROPRIATE OVERSEAS SENDER.
YOU WILL THEN RECEIVE A 480 HZ DIAL TONE.  HERE YOU ENTER KP + 0CC + CITY
CODE + LOCAL NUMBER + ST AND THE CALL IS ON ITS WAY.

     COUNTRY CODES CAN BE EITHER 1, 2, OR 3 DIGITS BUT THEY MUST BE PADDED
FOR THREE DIGITS TO CREATE A PSEUDO-COUNTRY CODE WITH EXTRA ZERO'S IF
NECESSARY.  FOR EXAMPLE, ENGLAND, COUNTRY CODE 44, BECOMES 044.

     TO SEE WHICH INTERNATIONAL SENDER A CERTAIN COUNTRY (LETS USE FRENCH
GUIANA, COUNTRY CODE 594, FOR EXAMPLE) GOES THROUGH, YOU CAN DIAL KP + 011 +
594 + ST, WAIT FOR THE PROCEED TO SEND TONE THEN KP + 000 + 0000 + ST AND YOU
WILL RECEIVE A RECORDING SAYING WHICH ISC (INTERNATIONAL SWITCHING CENTER) IT
IS.  FOR THE EXAMPLE IT WILL SAY, "THIS IS THE INTERNATIONAL SWITCHING CENTER
IN PITTSBURG, PA -- THIS IS A RECORDING - 4121."  YOU CAN ACTUALLY ROUTE
CALLS TO CERTAIN SENDERS YOURSELF (KP + NPA + 18X + ST) BUT IT IS BETTER OFF
NOT TO SINCE IT MAY LOOK SUSPICIOUS IF A CALL IS SENT THROUGH A SENDER THAT
IT SHOULDN'T GO THROUGH.  HERE ARE THE SENDERS:

182  -- WHITE PLAINS, NY
183  -- NEW YORK, NY
184  -- PITTSBURG, PA
185  -- ORLANDO, FL
186  -- OAKLAND, CA
187  -- DENVER, CO
188  -- NEW YORK, NY

     ALSO, THERE TENDS TO BE ALOT OF TALK ABOUT THE CODE 11, CODE 12, KP2,
STP, ST3P, & ST2P KEYS.  WHILE THEY DO EXIST THE BLUE BOXER NEED NOT CONCERN
HIMSELF WITH THEM.  THE FIRST THREE ARE USED ON CCITT SYSTEM 5.  THIS IS THE
SIGNALING SYSTEM THAT THE INTERNATIONAL SENDERS USE TO SEND INFORMATION TO
OTHER COUNTRIES.  THESE CODES ARE USUALLY ADDED AUTOMATICALLY JUST LIKE THE
LANGUAGE ASSISTANCE DIGIT [WHICH DISTINGUISHES OPERATOR (OR BLUE BOX) DIALED
CALLS FROM CUSTOMER DIALED CALLS].  THE STP, ST3P, & ST2P TONES  ARE USED
WHEN EQUIPMENT IS COMMUNICATING WITH THE TSPS.  THESE ALSO ARE AUTOMATICALLY
ADDED WHEN NEEDED IN MOST CASES.

[SEE TELCOM III FOR MORE ON INTERNATIONAL SWITCHING CENTERS (ISC)]


11XXX    -- MISCELLANEOUS OPERATORS

11501    -- UNIVERSAL CORDBOARD OPERATOR
11511    -- CONFERENCE OPERATOR
11521    -- MOBILE OPERATOR
11531    -- MARINE OPERATOR
11541    -- LD INCOMING SWITCHBOARD
11551    -- LEAVE WORD FOR TIME & CHARGES (NEAT STUFF)
11561    -- SAME AS 11551 BUT FOR HOTEL/MOTELS
11571    -- OVERSEAS OPERATORS -- LANGUAGE ASSISTANCE

     THE 11XXX SERIES IS INTERESTING SCANNING MATERIAL.

MISCELLANEOUS ROUTING CODES :
-----------------------------

     ALLIANCE TELECONFERENCING HAS SEVERAL NUMBERS, A FEW OF WHICH ARE LISTED
BELOW:

KP + 213 047 XXXX + ST
KP + 305 025 XXXX + ST
KP + 312 001 XXXX + ST

XXXX = 1050, 1100, OR A FEW OTHERS

     ALSO, AT KP + 317 009 + ST THERE IS A MF TONE CHECKER.  AFTER THE BEEP
-KERCLUNK, DIAL IN KP + 999 1234567 890 + ST AND IT WILL REPEAT THE DIGITS
THAT YOU PULSED IF THEY ARE OF THE RIGHT FREQUENCY.

TANDEM SCANNING:
----------------

     TO FIND ALL SORTS OF INTERESTING THINGS, YOU MUST LOOK.  BEGIN SCANNING
THREE DIGIT CODES IN YOUR AREA (I.E., KP + 000 + ST, KP + 001 + ST, ETC.).
KEEP TRACK OF ALL OF YOUR RESULTS.  SOMETIMES YOU MUST PROBE THINGS, SEND
ADDITIONAL DIGITS AND SEE WHAT HAPPENS, SEND TOUCH-TONE, SEND IT 2600 HZ, RIP
IT APART.  YOU NEVER KNOW, YOU MAY RUN INTO SOMETHING PHUN, LIKE A COMPUTER
THAT CHECKS CC NUMBERS.

     INCIDENTALLY, IN SOME EXCHANGE YOU CAN DIAL INWARDS AND OTHER BOX CODES
DIRECTLY!  FOR EXAMPLE, 914-121-1111 WILL GET YOU A NY INWARD.  THE ONLY
PROBLEM IS THAT A 0 OR 1 AS THE FIRST DIGIT OF THE EXCHANGE IS USUALLY
*PROHIBITED IN CUSTOMER DIALING.  SOMEBODY MAY HAVE "ACCIDENTALLY" CHANGED
THIS SCREENING CODE ON YOUR ESS'S COMPUTER, THOUGH -- YOU NEVER KNOW AND IT
CAN'T HURT TO TRY.  WATS TRANSLATION NUMBERS ALSO TAKE UP SOME OF THE 0XX &
1XX CODES.

     FINALLY, CERTAIN TONES ON THE BLUE BOX CAN ALSO BE USED FOR OTHER
PURPOSES.  AN MF "2" CORRESPONDS TO COIN COLLECT WHILE "KP" CORRESPONDS TO
COIN RETURN.  THUS EVERY BLUE BOX IS ALSO A GREEN BOX (SEE TELCOM VI).