The Anarchist Cookbook (47 page)

pay phone is popular with the phone-phreaks network because there are usually people

walking by at all hours who will pick it up and talk for a while.

He presses the lower left-hand corner button which is marked "KP" on the face of the box.

"That's Key Pulse. It tells the tandem we're ready to give it instructions. First I'll punch

out KP 182 START, which will slide us into the overseas sender in White Plains." I hear a

neat clunk-cheep. "I think we'll head over to England by satellite. Cable is actually faster

and the connection is somewhat better, but I like going by satellite. So I just punch out KP

Zero 44. The Zero is supposed to guarantee a satellite connection and 44 is the country

code for England. Okay... we're there. In Liverpool actually. Now all I have to do is punch

out the London area code which is 1, and dial up the pay phone. Here, listen, I've got a ring

now."

I hear the soft quick purr-purr of a London ring. Then someone picks up the phone.

"Hello," says the London voice.

"Hello. Who's this?" Fraser asks.

"Hello. There's actually nobody here. I just picked this up while I was passing by. This is a

public phone. There's no one here to answer actually."

"Hello. Don't hang up. I'm calling from the United States."

"Oh. What is the purpose of the call? This is a public phone you know."

"Oh. You know. To check out, uh, to find out what's going on in London. How is it there?"

"Its five o'clock in the morning. It's raining now."

"Oh. Who are you?"

The London passerby turns out to be an R.A.F. enlistee on his way back to the base in

Lincolnshire, with a terrible hangover after a thirty-six-hour pass. He and Fraser talk

about the rain. They agree that it's nicer when it's not raining. They say good-bye and

Fraser hangs up. His dime returns with a nice clink.

"Isn't that far out," he says grinning at me. "London, like that."

Fraser squeezes the little blue box affectionately in his palm. "I told ya this thing is for

real. Listen, if you don't mind I'm gonna try this girl I know in Paris. I usually give her a

call around this time. It freaks her out. This time I'll use the ------ (a different rent-a-car

company) 800 number and we'll go by overseas cable, 133; 33 is the country code for

France, the 1 sends you by cable. Okay, here we go... Oh damn. Busy. Who could she be

talking to at this time?"

A state police car cruises slowly by the motel. The car does not stop, but Fraser gets

nervous. We hop back into his car and drive ten miles in the opposite direction until we

reach a Texaco station locked up for the night. We pull up to a phone booth by the tire

pump. Fraser dashes inside and tries the Paris number. It is busy again.

"I don't understand who she could be talking to. The circuits may be busy. It's too bad I

haven't learned how to tap into lines overseas with this thing yet."

Fraser begins to phreak around, as the phone phreaks say. He dials a leading nationwide

charge card's 800 number and punches out the tones that bring him the time recording in

Sydney, Australia. He beeps up the weather recording in Rome, in Italian of course. He

calls a friend in Boston and talks about a certain over-the-counter stock they are into

heavily. He finds the Paris number busy again. He calls up "Dial a Disc" in London, and we

listen to Double Barrel by David and Ansil Collins, the number-one hit of the week in

London. He calls up a dealer of another sort and talks in code. He calls up Joe Engressia,

the original blind phone-phreak genius, and pays his respects. There are other calls. Finally

Fraser gets through to his young lady in Paris.

They both agree the circuits must have been busy, and criticize the Paris telephone

system. At two-thirty in the morning Fraser hangs up, pockets his dime, and drives off,

steering with one hand, holding what he calls his "lovely little blue box" in the other.

You Can Call Long Distance For Less Than You Think

"You see, a few years ago the phone company made one big mistake," Gilbertson explains

two days later in his apartment. "They were careless enough to let some technical journal

publish the actual frequencies used to create all their multi-frequency tones. Just a

theoretical article some Bell Telephone Laboratories engineer was doing about switching

theory, and he listed the tones in passing. At ----- (a well-known technical school) I had

been fooling around with phones for several years before I came across a copy of the

journal in the engineering library. I ran back to the lab and it took maybe twelve hours

from the time I saw that article to put together the first working blue box. It was bigger

and clumsier than this little baby, but it worked."

It's all there on public record in that technical journal written mainly by Bell Lab people

for other telephone engineers. Or at least it was public. "Just try and get a copy of that

issue at some engineering-school library now.

Bell has had them all red-tagged and withdrawn from circulation," Gilbertson tells me.

"But it's too late. It's all public now. And once they became public the technology needed

to create your own beeper device is within the range of any twelve-year-old kid, any

twelve-year-old blind kid as a matter of fact. And he can do it in less than the twelve

hours it took us. Blind kids do it all the time. They can't build anything as precise and

compact as my beeper box, but theirs can do anything mine can do."

"How?"

"Okay. About twenty years ago AT&T. made a multi-billion-dollar decision to operate its

entire long-distance switching system on twelve electronically generated combinations of

twelve master tones. Those are the tones you sometimes hear in the background after

you've dialed a long-distance number. They decided to use some very simple tones -- the

tone for each number is just two fixed single-frequency tones played simultaneously to

create a certain beat frequency. Like 1300 cycles per second and 900 cycles per second

played together give you the tone for digit 5. Now, what some of these phone phreaks have

done is get themselves access to an electric organ. Any cheap family home-entertainment

organ. Since the frequencies are public knowledge now -- one blind phone phreak has even

had them recorded in one of the talking books for the blind -- they just have to find the

musical notes on the organ which correspond to the phone tones. Then they tape them. For

instance, to get Ma Bell's tone for the number 1, you press down organ keys F~5 and A~5

(900 and 700 cycles per second) at the same time. To produce the tone for 2 it's F~5 and

C~6 (1100 and 700 cps). The phone phreaks circulate the whole list of notes so there's no

trial and error anymore."

He shows me a list of the rest of the phone numbers and the two electric organ keys that

produce them.

"Actually, you have to record these notes at 3 3/4 inches-per-second tape speed and

double it to 7 « inches-per-second when you play them back, to get the proper tones," he

adds.

"So once you have all the tones recorded, how do you plug them into the phone system?"

"Well, they take their organ and their cassette recorder, and start banging out entire

phone numbers in tones on the organ, including country codes, routing instructions, 'KP' and

'Start' tones. Or, if they don't have an organ, someone in the phone-phreak network

sends them a cassette with all the tones recorded, with a voice saying 'Number one,' then

you have the tone, 'Number two,' then the tone and so on. So with two cassette recorders

they can put together a series of phone numbers by switching back and forth from number

to number. Any idiot in the country with a cheap cassette recorder can make all the free

calls he wants."

"You mean you just hold the cassette recorder up the mouthpiece and switch in a series of

beeps you've recorded? The phone thinks that anything that makes these tones must be

its own equipment?"

"Right. As long as you get the frequency within thirty cycles per second of the phone

company's tones, the phone equipment thinks it hears its own voice talking to it. The

original granddaddy phone phreak was this blind kid with perfect pitch, Joe Engressia, who

used to whistle into the phone. An operator could tell the difference between his whistle

and the phone company's electronic tone generator, but the phone company's switching

circuit can't tell them apart. The bigger the phone company gets and the further away

from human operators it gets, the more vulnerable it becomes to all sorts of phone

phreaking."

A Guide for the Perplexed

"But wait a minute," I stop Gilbertson. "If everything you do sounds like phone-company

equipment, why doesn't the phone company charge you for the call the way it charges its

own equipment?"

"Okay. That's where the 2600-cycle tone comes in. I better start from the beginning."

The beginning he describes for me is a vision of the phone system of the continent as

thousands of webs, of long-line trunks radiating from each of the hundreds of toll

switching offices to the other toll switching offices. Each toll switching office is a hive

compacted of thousands of long-distance tandems constantly whistling and beeping to

tandems in far-off toll switching offices.

The tandem is the key to the whole system. Each tandem is a line with some relays with

the capability of signaling any other tandem in any other toll switching office on the

continent, either directly one-to-one or by programming a roundabout route through

several other tandems if all the direct routes are busy. For instance, if you want to call

from New York to Los Angeles and traffic is heavy on all direct trunks between the two

cities, your tandem in New York is programmed to try the next best route, which may send

you down to a tandem in New Orleans, then up to San Francisco, or down to a New Orleans

tandem, back to an Atlanta tandem, over to an Albuquerque tandem and finally up to Los

Angeles.

When a tandem is not being used, when it's sitting there waiting for someone to make a

long-distance call, it whistles. One side of the tandem, the side "facing" your home phone,

whistles at 2600 cycles per second toward all the home phones serviced by the exchange,

telling them it is at their service, should they be interested in making a long-distance call.

The other side of the tandem is whistling 2600 cps. into one or more long-distance trunk

lines, telling the rest of the phone system that it is neither sending nor receiving a call

through that trunk at the moment, that it has no use for that trunk at the moment.

"When you dial a long-distance number the first thing that happens is that you are hooked

into a tandem. A register comes up to the side of the tandem facing away from you and

presents that side with the number you dialed. This sending side of the tandem stops

whistling 2600 into its trunk line. When a tandem stops the 2600 tone it has been sending

through a trunk, the trunk is said to be "seized," and is now ready to carry the number you

have dialed -- converted into multi-frequency beep tones -- to a tandem in the area code

and central office you want.

Now when a blue-box operator wants to make a call from New Orleans to New York he

starts by dialing the 800 number of a company which might happen to have its

headquarters in Los Angeles. The sending side of the New Orleans tandem stops sending

2600 out over the trunk to the central office in Los Angeles, thereby seizing the trunk.

Your New Orleans tandem begins sending beep tones to a tandem it has discovered idly

whistling 2600 cycles in Los Angeles. The receiving end of that LA tandem is seized, stops

whistling 2600, listens to the beep tones which tell it which LA phone to ring, and starts

ringing the 800 number. Meanwhile a mark made in the New Orleans office accounting

tape notes that a call from your New Orleans phone to the 800 number in LA has been

initiated and gives the call a code number. Everything is routine so far.

But then the phone phreak presses his blue box to the mouthpiece and pushes the 2600-

cycle button, sending 2600 out from the New Orleans tandem to the LA tandem. The LA

tandem notices 2600 cycles are coming over the line again and assumes that New Orleans

has hung up because the trunk is whistling as if idle. The LA tandem immediately ceases

ringing the LA 800 number. But as soon as the phreak takes his finger off the 2600

button, the LA tandem assumes the trunk is once again being used because the 2600 is

gone, so it listens for a new series of digit tones - to find out where it must send the call.

Thus the blue-box operator in New Orleans now is in touch with a tandem in LA which is

waiting like an obedient genie to be told what to do next. The blue-box owner then beeps

out the ten digits of the New York number which tell the LA tandem to relay a call to New

York City. Which it promptly does. As soon as your party picks up the phone in New York,

the side of the New Orleans tandem facing you stops sending 2600 cycles to you and