Just wanna say HEY! to a few people , family , friends , aquaintences, and even a few ex'es ...adam (bc..'
bud), alan (old times lost), alice (my aunt ), bonnie (an ex), chris (another best bud), christopher (old
friend), connie (and his wife), dad (miss you), damon (shiva rules!), david (hey big bro!), debbie (don' t lik(\
california or sumthin?), ellen (i hear you 're shrinki ng), genevieve (lost love), god , jan (best bud's girl) , jell ,
jeremy, jerome (hi bro!), jesse (how's the ribs?), jim (iimarnrnal ), kristen (love that pony tail), laura (sorry
I keep forgetting to call), lisa (hiya sis) , liz (Iizba) , lori (yet another sis), marion (another aunt ), mom (i OW (
you big time), niel (cool cous in), robyn (leather baby, yeah!), sandra (one of these days i'm gonna look
you up), another sandra , sandy (i have your number but never call), scott (another bro who needs to ge t
his head out from between his girls legs ), another scott ('sup man) , sean (dj, dj, calling dj), shannen
(another leather wench) , tom (theramin man), wendy (introduced me to Pink Floyd).
people that make it happen:
Editor Packing & Distribution
Brian
Skywise
Rendering &
Assistant Editors Raytracing
OJ, Zack Man
Krokus
Photography Office Babes
Pixel God
Jan, Kate, Connie, Alicia
Artwork FOOD
Scribble Dominoes, Jack in the Box
software that makes it happen:
POVRay for Windows, 3D Studio R4, Microsoft Publisher 98, Windows95, WindowsNT, Netscap e
Communicator, Microsoft Internet Explorer, ACDSee, Photoshop 4.0, Corel Draw, Photo Styler,
Quark Express, ICQ, PageMaker, Crystal FTP, mlRC32 and some other mise software.
ISSN XXXX-XXXX (Pending)
2397985356295141-0001
THUD Magazine, Inc.
P.O . Box 2521, Cypress CA, 90630
THUD Magazine (The Hackers Underground Digest) is copyright 1998 by THUD Magazine, Inc.
All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any
means, electronic or mechanical , including photocopying, recording, or by any information storage and .
retrieval system, without express written permission of THUD Magazine, Inc.
The contents of THUD Magazine are for educational purposes only and do not necessarily reflect the
viewpoints of the editors, their staff or the various contributors to the magazine. The information is
provided on an "as is" basis. THUD Magazine, Inc., its owners, its staff, nor its contributors take any
responsibilty for losses incurred, real or otherwise, for use or misuse of the information found in this
publication. Responsibility lies solely with the end user. Many of the articles within this publication discus s
procedures, processes and activities which may be illegal, dangerous, or just plain stupid to actually act
out. We do not recommend that anyone rely on the information contained herein as fact. Use commo n
sense, or if none is available, find someone who has some and borrow it.
Printed in the United States of America
2 Volume 1 Issue 1 - Spring 1998 TH UD
influence:
Another DeeJay Consumertronics
Bill Hayes Dr. Whip
Solar Prophet Telecode
Blacklisted! 411 Shiva
Mycal Oxygene
Iron Feather Journal
Orion and, of course, those wishing to
remain anonymous.
what's inside:
4 Brain Dump (editors letter) 32 Cable Test Chip FAQ - by Telecode
5 Just What is a Hacker? 34 Data Depot (News)
8 Building Your Own Pirate Radio Station 36 Q&A (Letters)
12 Deadline 43 The 555 Timer IC For Dummies
13 The United States Senate 45 Wireless Cable Television FAQ
18 Amusement Park Freqs 50 Acronyms A-B
20 Hack Exchange (Classifieds) 53 Pirate Radio Resources WEB Listings
21 Police Codes 56 Neato Stuph (pics)
22 Cool Edit 96 - Review by Solar Prophet 57 Cool Book List
23 Pager Freqs 58 Driver Bits
24 Stopping Power Meters - Review by Shiva 59 Subscription Info
26 Pyrotechnic Chemicals
other information:
How to contact us: Articles:
THUD Magazine THUD Magazine Articles
P.O. Box 2521 P.O. Box 2521, Cypress, CA 90630
Cypress, CA 90630
Letters:
Subscriptions: THUD Magazine Letters
$20 U.S., $24 Canada, $35 Foreign P.O. Box 2521, Cypress, CA 90630
U.S. funds only.
THUD Volume 1 Issue 1 • Spring 1998 3
Dump
A message from the editor
Welcome, ladiez, gentz, hackerz, phreakerz, wormz, and whachamacallitz. You're staring at the premier issue of
. THUD, The Hackers Underground Digest. First, let me tell you what we're all about. Basically, we're a bunch of twits
who figured we could make our own hacking magazine, and guess what! we did!! Cuz you're looking at it! But
seriously though, we're not a bunch of people who think we can be better than anyone else. I for one hate people like
that. I've been reading magz like 2600 and Blacklisted! 411 forever, and they're both really good. Each has it's strong
points, as well as weaknesses. No publication is perfect, and I'm sure there's gonna be people out there who have
their problems with THUD. Frankly, I'd be upset if people didn't write in spouting off shit about what's wrong with this,
what's fucked up there, and what not. That's called feedback.
But anyway, what I am hoping to do with THUD is to provide yet another source of information for those of you out
there that are into this shit. I am a firm believer in the phrase 'knowledge is power' and when I seek knowledge , I do
not seek it from only one source. I try to corroborate by searching in many places. I would like to provide yet one more
source for you. I would also like to provide more technically detailed information on the subjects we talk about. Oh, of
course we're gonna have the usual shit like lists of freqencies, or what chemicals you 'shouldn't' be playing with and
other general stuph like that. But beyond that, we're going to present to you articles written so that the beginner can
understand, yet provide such a vast amount of information that even more advanced techno-philes should still learn a
thing or two; or maybe to remind them of what they may have forgotten. We're gonna show you pictures, we're gonna
give you schematics, we 're gonna give you part sources, we 're gonna give you assembly instructions, we're gonna
give you operating instructions, we're gonna give you what you need to succeed. All you have to do is pay attention
and understand and learn .
One thing that I've always felt uncomfortable with is the term 'hacker'. If you feel the same way , you can put your mind
at ease by reading Bill Hayes article, "Just What Is A Hacker?" Bills, contribution basically put into words how I feel.
Hackers are not the tongue-pierced , tattooed, only wear black, computer gadget in every pocket, can't live without
electricity, evil malcontents bent on destroying the world by using the worlds electronics networks to wreak havoc on
the unsuspecting public by destroying data and disrupting communications. Sure, I'll admit there are those types out
there and frankly I think they've given the rest of us a bad name. SHAME ON YOU!! But also, much of the blame I
think goes on the media for pushing that image onto the uneducated gullible world. To get a taste of what a REAL
hacker is, read the article. You're gonna be surprised at who some the most famous hackers really are!
There's many fundamentals beginner electronics students learn. Mainly it's how everything is really broken down into
little sections . And it's how to put simple circuits together to perform relatively simple tasks that's really important.
Knowing on a fundamental level how something works, and having practical experience in using that knowledge really
helps. In this issue you're gonna find an excellent article by Orion (gee, that's an obvious alias!) about the 555 timer
IC. I remember when I learned about this little gizmo when I was in tech school. Man, it seemed like there wasn't
anything that couldn't be done with a 555 and a few external components. Well , we present to you here a very in depth
article that just about sums up all the basics of how to use the 555 timer. Oh, and it's well written too. The guy
manages to desribe some of the sticky details , yet in such a way that a beginner shouldn 't be overchallenged, yet it
definately reminded me of some of the things that I learned waaaay back when . (no, I don't feel old....yet) Great article ,
I'm sure we'll have more from Orion in the future.
Ever hated listening to the radio? Turning that knob and checking out your twenty favorite stations ...and even a few
you don't like...and can't find ANYTHING worth listening to? Ever thought, man, if I had my own radion station, I know
what I'd broadcast. Wanna do it? There's a nice little kit from Ramsey Electronics called the FM-10 . It's a small kit, a
low power FM radio broadcaster. That's right you can be your own disc jokey. The FM-10 kit is totally legal when
unmodified. This issue contains an article from Mycal about all sorts of modifications you can make to the FM-10.
Now, I must warn you that many of these modifications when used on the FM-10 and used to broadcast openly could
get you into big trouble with the FCC. But the information is present to you none-the-Iess because knowledge is
power. It is meant for educational purposes for those of us who are curious and want to know how these things work.
Have fun but be careful, you're the one responsible for your own actions.
Anyway, you're also gonna find several other articles of great interest. There's a nifty little program called Cool Edit 96
that was given a great review by Solar Prophet. once I read the article I grabbed a copy myself and love it. There's
also a short about the IRS being unable to prosecute certain individuals. Quite informative. You'll also find a list of all
the U.S. Senators for all those of you who have something to gripe about. Come on, I know you've got a gripe!. We all
do. For all you scanner buffs that also love amusement parks, there 's a nice list of frequencies you'll find at your
favorite entertainment facility. Shoved somewhere in these pages is a list of chemicals used for pyrotechnics, mostly
fireworks . Lotsa info. There's also a short list of police codes. There's also a great review on a book and video about
stopping power meters. Once again this is technically illegal but one can learn a lot about how these things work. And
last but not least, a list of books that should be an excellent source of further information on quite a diverse range of
subjects.
Lastly, I'd like to thank our friends at Blacklisted!411, Iron Feather Journal , those who contributed articles to us and the
members of our staff for all the help in putting the rag together. The teamwork is great and it couldn't have happened
without you. Congrats to all!
4 Volume 1 Issue 1 - Spring 1998 THUD
000 0 0 0 0 0 000 0 000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
o o
o
o
o
Just What Is A Hacker? o
o
o
o By: Bill Hayes o
o 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000 0 0 0 0 0 0 000 0 0 0 0 0 0 0 0 0 0 0 0 0
This magazine is called "THUD - The Hackers Underground Digest," referring of course to "hackers ." Hackers? Most people,
even in 1998, still don't get it. The term, while it refers to most of us who read this magazine (and write for it), was not invented
for the late '70s, when little computers came out, or the '80s, when they started to work well, or the '90s, when a lot of little
computers (I'll define what a "little computer" is later) could outperform mainframes, and the Cray-on-a-desktop dream was a
reality---for a price.
The word "hack" is a pretty old one . Seems the word dates back to the 1920s, when it was applied to quick , and not especially
good, writers. But it was not CODE way back then that they wrote, but words . Journalists, pulp writers, novelist wannabes all
were WRITERS, but some, for various and usually derogatory reasons , were called "hack writers ," later shortened to "hacker."
"Yeah, I gotta hack out last night's crime report for the evening paper ."
The word "hacker" seems to apply to those of us, after about 1975, referring to writing code or doctoring programs. This does
not, however, explain, in our present context, just what a hacker is right now.
When I was invited to write for the lead off issue of this magazine, the editor and I were discussing our own hacking abilities
and likes. I mentioned Thomas Edison as the ultimate hacker; the editor stated his vote was for Alexander Graham Bell. But
just what were these two men? They wrote no code---not the kind we use anyway (telegraphy and encryption "codes" do not
count for this illustration). This is way before the age of the electronic computer. They were tinkerers, and in fact they were
probably the best tinkerers of the 19th century.
Oh, so to be a hacker you must tinker---right? Well, it certainly helps . Is the person who can build a PC from mail-order
components a hacker? Well, yes. Maybe . How about the Mr. Fixit, who never met a Sears tool he didn't like, and can fix any
car or powered device? No. So, what's the difference?
A Hacker (and we deserve this capitalization) refers to electronics, generally computers, but specifically about doing things
that are just not "out of the box." Can you get your just-ordered Dell right out of the box, and put it together and get it to boot
up and run right the very first time? Congratulations , but that's what you're supposed to do. Anyone past tenth grade (at
worst) should be able to accomplish such a "feat." However, can you take a friend 's dead PC, strip it for parts, upgrade your
box, put that bigger transformer on another friend's PC, hook up your sister's old stereo speakers to the sound card for some
really big sounds on your game ...that's more like it. Make an old 386 clone run like a champ with some memory upgrades,
tinkering with the Bios, and defragging and partitioning the hard drive ...you are there. But it's not just what you do with you
hands and tools .
A Hacker is someone, male or female , with a specific mindset. Some of these people (poor victims of the current public school
system, no doubt) aren't even into computers, but they have the right mindset, and they would do just fine if introduced to the
right pieces of equipment. That mindset flows out from our knowledge of number crunchers, sound makers , game players , and
word manipulators . We see the other, the possible but not available, that which is not offered as an option or add-on but we
want NOW. And we try to do it ourselves. Like the similar-minded hot rodders of the '50s and '60s , who could make a '53
Chevy do things not exactly within its initial design parameters, and look quite a bit different from the show room floor , take a
pickup truck, or VW Beetle , or fin-laden Caddy, and do with it that which was not exactly intended, designed, or even sought.
But consider the outcome, and the designs, performance, options, availabilities, and variations now available, because of hot
rodders in the last two generations. The Japanese sure caught on, and after a bit, so did Detroit and Wolfsburg. As with them ,
so with us.
Forgive me if I need to deviate to make my point. While this is not intended to be a history of small computing, this background
is necessary, so please bear with me.
Consider if you will, way back in the summer of 1981, when what is now considered the modern era of computing began (well,
some of you good readers may have been a little too young at the time; I was a Science Officer, spending 4 months testing
prototype equipment in the desert in lovely EI Paso, Texas, reading the business section of the paper when I read that it
happened). Business computing got serious---or at least threatened as much . In a three week period, two business-only
microcomputers were released , to huge fanfare. The Apple III, a business box running faster versions of VisiCaIe, Peach Tree
Accounting, and WordStar, seemed to dominate the papers : this was the box that would put Tandy in its place! One could
hardly blink before the next big announcement: Charlie Chaplin's character, "The Little Tramp" from the movie "Modern Times"
was the new logo and silent spokesperson for The 1.8.M. Personal Computer (you just had to see the ads, hear it on the
radio, to believe the voice inflections). Where did these two competing, totally incompatible boxes come from? Totally
different from each company's past, that's for sure.
Apple, tired of the "rich man's toy" banner that so many had slapped on it, tried to go BUSINESS with this box, in a big way.
For business applications, especially word processing, people were encouraged by the embryonic computer press, to go with
Radio Shack, specifically the Tandy TRS III. The Apple 11+, not quite as fast but in may ways a better system, seemed to
suffer from its very abilities. It was a great game machine, had good built-in color (no color or graphics card needed), and
generated decent sound, for serious playing of Star Castle, Pac-Man, and various other shoot-em-ups. Due to the fact that
every kid (and adult) wanted the Apple 11+ as a game player (that could also do neat layouts for word processing documents),
it was labeled the game computer or the kid's computer. Not saddled with so many games or options, but still an excellent
box, Tandy went after the "serious, business side" of computing. And for a while, both companies were winners .
A little point I should make here about "little computers." On a great (and now extinct) radio show called CBS Newsmark,
Steve Jobs talked about not trusting big computers due to the "Big Brother" label that went along with them. He said that he
was told , back before his Apple days, that you could trust a computer , but only one you could pick up. If you can't pick up the
THUD Volume 1 Issue 1 • Spring 1998 5
computer in question, and throw it out the window, just don't trust it. Not too bad an idea for now, if you asked me...
Apple put its very best people into the Apple III, this very serious, business-only system. And its excellence for doing only
business, and the lack of vision, killed an otherwise good product. Bad call : Jobs insisted the Apple III be complet ely
incompatible with Apple II "recreation" software, and it would only display in monochrome, that is, beautiful green, or as an
option, stunning black and white. "We won't be labeled as a kid's platform any more!" was the Cupertino battle cry for this
business box. So, this inflexibility to run from the label of kid's computer killed the system . At that point, there were thousands
of programs (only about half of which were games), that could run on the Apple II or 11+. There were maybe a dozen (when it
debuted) that would run on the far more expensive Apple III, all monochrome, no sound, all business, no games. Poor idea,
one that would be the first of may near-fatal errors for such a great startup with so many talented , creative people, and wildly,
rabidly loyal users and fans. (Note: I was one of them.)
International Business Machines, the bluest of any bluechip American company, took a totally different course . IBM, the home
of the white shirt and dark blue tie as an employee requirement, was actually dealing with the enemy. Not trading with the
Soviets or Chinese, but something just as outrageous. Having amateurs (those we'd now call Hackers) design the hardware
and software of a small computer . The mind just boggled. Don Estridge, an IBM V.P., and head of the new division called
"Entry Systems" in Boca Raton, Florida, had the vision to step away from the other blue suits, get a couple of kids (Gates and
Allen) who'd shown some great innovation , if a lack of discipline, and try to make a desk top , that is, an entry system, not in
the mold of IBM, but more in the mold of a hobbyist's computer, a garage job . Dare it be said-s-a Hacked microcomputer and
its operating system? Yes. Estridge, blue suit, white shirt, and engineering degree, had the vision . He could see things as
they were not. And he brought in the talent to make it happen.
And this was not even IBM's first foray into desktop computing . Back in 1974, their engineers (all homegrown and party-line ,
it should be noted) built a giant typewriter looking thing that was a "desk top minicomputer" as they called it. Get this, it only
ran the APL programming language. Bet you'd love to fly in an aircraft or drive a car designed by that, huh?
IBM, in spite of this serious failure (I think they sold about a thousand of the things), and had no non-IBM software developed
for it due to the fact they refused to license anything, the engineers at IBM kept plugging . Some of them, Estridge at the top,
knew they needed new ideas, new blood. After all, these guys were used to building computers that could be as big as a
house, but only as small as a large refrigerator. Small computers had been around , in some shape or other, since the Altair
8800 debuted in 1975. New blood was brought in.
Bill Gates and Paul Allen , who'd written the BASIC for the Altair, and had written some game programs, were brought in.
While they certainly did not fit into the corporate culture of IBM, they could see things in a different way, new computers could
be great even if they weren 't huge, and their input (but not really their design) has partially resulted in the computing world we
have today---definitely in software, but somewhat in hardware as well. The vision of IBM, to do something greater and
different from the "big iron" they'd successfully flooded the corporate and military world with, was broad enough to accept this
new view: some of their customers wanted smaller ("Hey, I know, let's do smaller!"). Their stilted, military-industrial world view
was able to produce a distinctly non-IBM vision, and with the input of amateurs, hackers, non-engineers, and college dropouts,
thus came the IBM PC. The computer world , from that moment on, would never be the same . (Note an old saying from the
Bible Belt that may be illustrative: "Amateurs build Noah's Ark, professionals built the Titannic .")
Do not think this is blanket and blind praise for Big Blue. Not from me! I've owned computers of some kind or other since
1980, and used computers since 1978. But I was of the old school---terminals, Z-80s, or Commodore, or Apple. My first
expensive box was a Macintosh; I didn't cave in and buy a DOS or Windows anything until 1992, when I bought a Dell 486
from a Sam's Club. I'd felt for so long that so much creativity was diverted into "compatiblilty," and not into generating some
Blacklisted! 411
The Official Hackers Magazine
Tired of the same old thing?
NOW you have a choice!
Published by Syntel Vista, Inc.
"We 're in our 4th year, now! Join the thousands of other happy hackers
around the world! Take a look at our rag!"
./ Hacking/Phreaking ./ BBS/lnternet Updates/News
./ Telephone Technology ./ The Underground
./ Cable Television Technology ./ Sovereign Citizenship
./ Satellite Communications ./ Pirate Radio
./ Radio Communications ./ Sources
./ AudioNideo/Computers ./ Survival Guide
./ Encryption & Virii ./ Hardware Hacking....and
We publish reader questions and article submissions.
Got something to share with the hacker community?
We're your resource AND your means to communicate with
fellow hackers!
Blacklisted! 411, P.O. Box 2506, Cypress, CA 90630
\ ,. (714 )899-8853
;'1),'\j ) SUbscriptions are $20/yr U.S., $24/yr Canada. $35/yr Foreign (U.S. Currency)
""'-J\, Samples are $5 each (most current issue unless otherwise requested)
NITt9F1"11IJl'In lin IIIA1tFL' NOTE: We're a quarterly zine - we only publish 4 issues per quarter.
6 Volume 1 Issue 1 • Spring 1998 THUD
of the neat things done by Apple or Commodore or Osborne , but these three companies all shot themselves in the foot, and
while more creative, they wasted their early leads, failed to successfully compete, and therefore failed to thrive . Did these
companies, in a blind race to embrace the "business market," ignore their hackers?
A brief mention of John Scully is in order. As you know , Scully was recruited by Jobs to run Apple, back in 1985 or so. It was
thought that, as someone who'd run a significant #2 company (Pepsi) in an environment of a gigantic, global #1 (Coca-Cola) ,
he'd be ideal to successfully run Apple versus the Goliath IBM. Good thought.. .wrong execution . Scully, great businessman
that he had been with Pepsico, had no idea how to compete in the computer world (remember, he was recruited as a Suit). It
is easy, from 1998, to see three different occasions when Scully could have killed off Windows as an OS, just by licensing the
Mac's OS for cloning purposes. He didn't. Well, he did, but far too late to matter one bit. Look at what happened, and the
environment we're stuck in. [Don't forget, Don Estridge, white-sh irted, home grown VP of the evil empire, had the vision, not
to try it with his own team, but to bring in the kids, see what might work , risk failure and his job, for a bunch of hackers ...] The
Mac's better interface could only be (legally) used in a more expensive Apple box. DOS, then Windows, not very friendly or
even very good at first, just got better.
Apple, and to a lesser extent Tandy and Commodore, tried going business, and failed, yet IBM, that Great Satan of
computerdom, developed the box that was the model for 90% of the world's desktops. Due to hiring amateurs with a vision.
Allowing games to be played on their business systems . They brought in the tinkerers. Those who could see the same things
as everyone else, but see a different end, a different result, a different end use. A whole different world. So who were these
different thinkers? I believe we'd call them Hackers.
Some input from February 1998 might now be in order. In an interesting short news piece in an Investor's Business Daily
article, the ISO, the International Standards Organization, selected Apple's QuickTime and QuickTime VR as the cross-
platform viewing standard for video documents. Some of Apple's hackers, it seems, are still in place. Wozniak is gone, Kay
is at Disney as an "Imagineer" or some such, and Steve Jobs, now King of Pixar, is the Man Who Would Be President of
Disney . So Apple's hackers are still there. Just not in any position to establish policy, make decisions, direct the company .
Let's take a look at the two great inventors mentioned at the top of this article. Edison, home schooled due to his
"inattentiveness" (actually, his near-deafness was the cause), learned to look for solutions, and looked for ways he could make
money . Physical labor led to telegraphy (certainly less physical), which led to innovation, which lead to invention. Edison
tinkered with everything he could get his hands on. Even in his now famous laboratory, where tinkerers and thinkers came up
with all sorts of consumer products (now a little company called General Electric), when Edison had surpassed 1,000 issued
patents, he still took apart, reassembled , and fussed with everything that came his way.
Bell, also with some difficulty in hearing, was fascinated by electrical currents , storage, phonics for the deaf, and box kites.
Bell developed an entire phonetic alphabet for the deaf. He also loved to publish what he was doing, and what others were
doing in the various scientific disciplines and exploratory fields. By the way, his publication is still available for all to read:
National Geographic Magazine. Think of what we'd be missing without the works of these two tinkerers. These two men
learned to look at the same things in a manner different from the rest of people at that time .
So, Hackers are not just people who love computers, or who wear a lot of black (although , that's usually true) . Not just coders
and writers , not just good with a keyboard or soldering gun or mini tool kit. And not just tinkerers. The Hacker sees things in
a different way, for a different use. The "highest and best use" is a term used for specific assets (such as buildings or a
well-located piece of vacant land) in the business world . The alternative use is more like it for the Hacker. What can this
"black box" REALLY be used for? How can we use this whatzits in a better way? Why do we use such expensive stuff to do
such-and-such? Remember, back in 1975, Steve Wozniak took a 5-1/4 inch disk drive, and reduced its total chip count from
50 to 9---and it worked. Same drive, same performance, but far cheaper to build, repair, upgrade. Same thing, viewed a
different way. Hacked.
People who are not Hackers , who may not be "computer literate" (although I cringe at the overuse of that term), who view
things merely as they are presented, think that we're a threat. We must be regulated, or we'll break something! (Or worse,
break into something.) I've had people stare at me, dumbfounded, when I mention that my Cyrix 133 with all the gizmos on it
is one that I slapped together one weekend. The fact that is was fun and saved me $600 completely misses the point with
these folks. For every virus intentionally put into a company's network, for every domest ic attempt on the Pentagon 's network
or NORAD 's systems or Citicorp, there are a thousand acts of "Hey, I can fix that for ya" or "We can do this cheaper---Iet's try
it this way" or "Wait for the Rep? I'll install it before lunch!" We see the alternatives, and if we risk a bit of failure with someone
watching, one not as technically adept as are we, we still take the chance and try. This is a bad thing?
View things differently. Try alternatives with the unwashed (or the Suits) watching you. Wear black when it's just not
fashionable. Be willing to break things when you attempt to fix or upgrade . It's OK. Hack. Go on. Be a Hacker.
Bill Hayes, a hacker who's been called much worse, writes for THUD and Blacklisted! 411, as well as other magazines. If
you are interested in keeping your life from being hacked, try his book, ''Take Back Your Privacy: Keeping Your Life Off The
Information Superhighway." It's $20 total ($17 plus S&H), does not wear black, and will help keep the government and
corporations from hacking you and yours. Bill Hayes, 12289 Pembroke Road, Suite 151, Pembroke Pines, Florida 33025.
THUD Volume 1 Issue 1 - Spring 1998 7
t-@-tSf+tSo-:et: ~¢{)-@-+ 7 11!o-:e vt+tS¢{) ~i+itS¢{)o-:e
Building :Jour Own Pirate Radio Station
by: mycal@mycal.net
reprinted from Iron Feather Journal
edited by: navig8er
graphics by: covert
o-:e¢{)tSi+i~ ¢{)tS++V +i++tSl o-:el l17 IIII-@-¢{)~ o-:etS+ftS-@-t
the dislaimer 800mw, and a 5 watt . Instructions for modifying the Ramsey
Here is a rough compilation of information about the Ramsey PA-1 for FM broadcast band operation. A section on how to
FM-10, and other BA1404 Stereo FM broadcasters. Some of design and build your own antenna. Plans for a power meter ,
the modifications may make you BA1404 based broadcaster regulated power supply, and a dummy load. A block diagram
illegal to use on the open airwaves in the US and Canada. showing a typical station. Spec sheet for the BA1404. FM-10
Also, it has been brought up the the stock Ramsey FM-10 kit modifications. Sources for parts and info. A more up to date
may exceed FCC power limits when used with a proper design of my digitally synthesized transmitter. Loaded with
antenna. The information contained in this article is in no way schematics, board layouts and diagrams. And now,
complete, nor do I take any responsibility for it's accuracy. schematics and construction details of the FRB 5 watt
With that in mind, along with the above paragraph, I must say transmitter . The price for this packet is $5 in the US and $8
"this file is for information purposes only." overseas . Address to send the money to is:
mycal
about this file P.O. Box 750381
When I first started hacking on my FM-10, a few of us on Petaluma, CA
alt.radio.pirate were exchanging information on the mods to 94975-0381
improve the range, stability and audio quality of the FM-10. You can also use this address to send me any info that would
After a couple of posts about filters and amps, my mailbox be hard to send bye-mail. I will trade info packets for hard
was swamped with requests for copies of previously posted copy information, e-mail me for details . Note: this packet is in
information and other questions about the FM-10 . So rather a constant state of change, more info could be added at any
than drive myself crazy with sending a piece of info here and time.
there, I decided to dig through my mailbox and notes and
compile this file. I hope it helps. Also, if anyone has more other places to look in cyberspace
information about the FM-10 or FM transmitters , antennas, alt.radio.pirate is another good forum to find or post
mixing equipment, programming information, stories about information on FM radio transmitters. Although you may not
pirates, or anything else that falls into this realm, please send have pirate aspirations, many of the things talked about can
it to myca/@netacsys.com. I will try to update this file as new benefit everyone. Other places to scan are scLelectronics and
information becomes available. (editors note: please feel free the amateur radio groups. The American Radio Relay League
to submit your information to THUD magazine, find addresses (ARRL) has a useful service - the ARRL Information Mail
on back cover.) Server. This is an automated mail server that lets you access
many of our information files, conta ining information about
FM·10 mailing list various facets of amateur radio. Some of the information has
First things first. There is now a mailing list that deals with technical value that is related to all radio services. To use it,
the topic of the Ramsey FM-10 and other BA 1404 based FM mail messages to info@arrl.org with the message "help". This
Stereo Transmitters. Feel free to join up and contribute. To will give you all the information you need to use this service .
send a message to the mailing list, send your question, reply,
comment , or contribution to fm-10@dg -rtp.dg.com . To add or radio resistors bulliten
delete yourself from the list, send a short message with the A little 'zine that sometimes discusses pirate/micropower
funtion (add/delete/change address) along with the relevant radio along with public radio stuph. Send Frank a buck to help
e-mail addresstofm-10-request@dg-rtp.dg.com . If you have out with the copying and stamps.
any questions I can be reached at myca/@netacsys.com. Frank Haulgren RRB
P.O. Box 3038
FM·10 archives Bellingham WA
Yes, it is finally here; message archives of the FM-10 mailing 98227-3038
list and a place to puUfind schematics, reviews , stories, etc.
and related to the FM-10 and other BA 1404 based FM FM·10 myths
transmitters. Currently a 350mw amp plan, 800mw amp There have been several myths about the FM-10 kit. The
plans , "Radio is my Bomb" text, slim jim plans/info, and the most prevelant are:
BA1404 spec sheet are located there. People can FTP in
dg-rtp .dg.com with the user name "anonymous" and your 1) The FM-10 puts out 100mw of power . This is not true , or at
e-mail address as the password. In the FM-10 directory you'll least not true for the Ramsey FM-10's that I have tested. They
currently find two sub-directories: put out between 8 and 12mw when driven with a 12 volt
supply . (note: there has been several revisions of the FM-10
INCOMING - This is writable by everyone and this is where and it is possible that the original version put out more power ,
people should upload new stuff. but I find even that highly unlikely since it would require
another amplifier stage.) Also, the FM-10 is the only low-cost
MSG-ARCHIVES - This directory will have files names kit that I have seen with an amplifier stage . Most others have
according to the date they were last 'sealed' . The file power outputs in the fraction of a milliwatt area.
"Currant" is a running log of all e-mail messages from the last
'seal' date of the archives. I want to thank Ed Savage and the 2) The FM-10's output can be cranked up by reducing the
guys at Data General, NC for making the list and the archive value of R9. This, like the above is also not true. R9 and R10
possible . are optimized for maximum output and greatest harmonic
snail mail info packet suppression at 12 volts . There are much better ways of
"Pirates Guide to FM Stereo" getting more outpur power than to mess with this output
The information packet has evolved yet again, it is now 24 stage . Lowering the value of R9 will most likely degrade the
pages . It includes plans for 4 amps; a 200mw, 350mw, FM-10's performance and cause lots of interference.
8 Volume 1 Issue 1 • Spring 1998 THUD
FM-10 improvements anti-drift mod
note: I sent this file and a list of other modifications to John There has been quite a bit of discussion on the FM-10's
Ramsey. Low and behold 4 months later the FM-10a is frequency stability . There have been complaints that digital
released. The new FM-10a incorporates all of these following receivers cannot lock onto the FM-10's signal for any great
mods. length of time. I have used the follwing mod with good results
(I used an N750 negative temperature compensated disc), but
stereo pilot mod I have been told that mylar or polystyrene caps are even
One of the first problems experienced with the FM-10 is better.
difficulty in getting the stereo pilot to operate correctly. One
solution is to replace C7 and C8 with a 28KHz crystal. This The FM-10 was designed to be inexpensive and cost saving
works and is recommended. If you cannot find a 38KHz measures with components are inevitable. Disc ceramic
crystal, you can make your life a whole lot easier withg a capacitors are less expensive than silver-mica caps , and also
couple of part changes. As indicated on the Ramsey much less stable. Simply replace C16 with a silver-m ica,
schematic, about 100pF is necessary to tune the oscillator. tantalum oxide, or temperature compensated disc cap (say
The components supplied to achieve this are a small fixed anywhere from N150 to N750) of the same value.
value capacitor (C7) and a slightly larger value trimmer
capacitor (C8). Since propper setting of the trimmer occurs Ramsey FM-10 70mw output amplifier
within a very small 'window' (about 5% of the trimmers range), This mod provides almost 9dB gain to bring the output power
it can be difficult or impossible to adjust the pilot to 19KHz and of the Ramsey FM-10 Stereo Transmitter from 8mW to
have it stay put. This can be cured by increasing the value of 70mW. Not the best design, but all the parts can be found at
C7 to 100pF and replacing C8 with a 6-50pF trimmer (Radio Radio Shack! Much better designs are available at the archive
Shack #272-1340); a 5-30pF trimmer will do the trick also. site.
The RS trimmer will not fit the holes in the PC board. You
need to cut the leads off a spare resistor and solder them to +12v
the legs of the trimmer (or just use bits of stiff wire) to mount it
on the component side of the board. On a second note, I
replaced C7 with a 68pF cap and found it much easier to tune R1 2200hm 1/2W
a rock solid 19KHz at the test point.
C2
crystal mod
\. 1', 1 .....
- .... ~ output
Remove C7 and C8 and replace them with the 38KHz crystal
and 10pF capacitor. Not that the 10pF and the crystal are
running in series and the old cap setup is running in parallel. C1
note: there have been good and bad reports on using the
Epson crystal from Digi-Key. From what I have heard the
i nput ~ t------II--..........
crystal is quite delicate, and in at least one case the
experimenter destroyed the crystal. In on of the positive the
C1 cap was replaced two 22pF caps run in parallel. This
yielded a rock solid stereo.
GND
C8
10pF 38KHz You can also use 2440 ohm 1/4 watt resistors run in parallel
in place of R1. I built this thing right on the underside of the
HD FM-10 kit. C1 is the cap that currently goes to the RCA
antenna jack, the 9K and the 220 ohm resistor have to be
bought. Not that if you cannot find 220 ohms you can make
one by using two 440 ohm resistors in parallel; and that a 10K
will work in place of the 9K but yields poorer performance
(-5%) .
The MPS2222A is from Radio Shack, part number 276-
2009. Use this part! If you substitute it for a 2N2222A you will
get only half the gain. Be very careful to get the leads in the
correct orientation!
treble boost mod C2 is of the same value as C1. I took the one that goes to the
Trebel boost is also known as pre-emphasis. The FM-10 on board antenna pad.
appears to have been designed by someone outside the
United States since it operates at the European audio Important! The value for R1 that seems to be optimal is 220
standard of 50 microseconds. Receivers in the US are set up ohms , but it is very close to the saturration point of the
for 75 microsecond de-emphasis . R3 and R6 determine the transistor. If the amp seems noisy (interference with the TV
time constant for the pre-emphasis curve . Replacing them etc.) back this value off to 240 ohms . If you lower this value
75K ohm resistors (standard value 68K ohm is close enough) below 205 ohms the power meter may read higher power but
will result in improved audio response. this will not be true. The transistor will be spewing all kinds of
junk and the power meter will mistake this for higher ouput (in
A much better pre-emphasis/input circuit is shown in the July reality the signal we want will drop considerably).
1992 issue of Radio Electronics . Not only do they use 75K
ohm resistors in their pre-emphasis, but they filter stray RF Well, that's it. Effective range with a good antenna should be
signals by inserting a .001uF cap between pin 1 (of the a little over double.
BA1404) and ground, and pin 18 and ground.
Ramsey PA-1 2-meter to 3-meter conversion mod
It has been noted that the above mod actually cause The Ramsey 2-meter amp (PA-1) can be converted for use
distortion on cheaper stereo receivers, since they were mass on the FM broadcast band. The inductors L1 and L2 need to
produced for the world market. They were designed for the be changed to the following:
European audio standard, which Japan and other Asian
nations use too. Try it out and let me know what works for
you. L1 - Should be replaced with a 1-turn 1/4" diamter coil. It is
identical to the stock L2 coil shown in the PA-1 manual.
THUD Volume 1 Issue 1 - Spring 1998 9
L2 - Should be replaced with a 2-turn 1/4" diameter coil, one need very little coax cable. Line loss using RU58u can be
more turn than the L1 coild above. killer at 100MHz . You could also try a 5/8 wave length
antenna. This would give you 2+dB gain, or almost 2x power
Tune up should be the same as in the PA-1 manual. Note gain on transmit.
that a FM-10 kit cannot be used to drive a PA-1 kit alone . The
FM-10 kit doesn't put out enough power to turn on the PA-1 kit filter design for fm radio transmitters
running class C. So you have two options . One, you can do It is very important to have a clean signal. The way 99% of
the "biased on" (newer kits may call this class B) modification all people who get busted for illegal transmitting is that the
shown in the PA-1 manual. Doing this you can drive the PA-1 people that live around them complain about interference.
with a stock FM-10, yiedling about 200-300mW of output Most of this interference is caused by harmonics. Filters cut
power. Or two, you can drive teh PA-1 with the output of the down these nasties. So don't draw attention to yourself. Keep
70mW amp shown above and get close to a watt of output everyone happy, including yourself . Be clean , use a filter!
power.
When you amplify a signal, you get unwanted byproducts .
It should be noted here that running the PA-1 "biased on" (or These are called harmonics . They show up at multiples of
class B) produces a much cleaner output signal than running your starting frequency. For example, if you amplify a 50MHz
the PA-1 class C. Also note that you can run the PA-1 "biased signal you may get echo's on 100MHz, 150MHz , 200MHz,
on" while driving it with the 70mW amp, but you will show 250MHz and so on ... If you interfere with your neighbors TV,
slightly less gain than in class C. the local fire department, or anyone else, you are just asking
for trouble . If you are only on the FM band, you will hardly be
antenna - most important noticed .
Do you have a good antenna? I think that is the most
important thing that you can do for extended range. I built a filter designs
1/4 wave gound plane using a UHF connector and 5 lengths These designs are basically from the charts in the ARRL
of copper plated brazing rod (found at the local welding shop) . handbook .
Works great and only cost about 3 bucks to make.
Remember, a good antenna will improve your range much This is a 7 element Chebyshev filter. I run at 88.1 MHz so my
further than a good amp driving a bad antenna. So this should first harmonic is at 176.2 MHz. This filter seem ideal. Inputs
be you first project to increase your range . Use the formulas and outputs are at 500hms. Fe = 85.8Mhz, 3db = 95.9Mhz,
out of your FM-10 manual. 20db = 116MHz, and 40db = 148Mhz.
234/freq . -length of rod
.132uH .150uH .132uH
example: 234/88MHz = 2.66 feet * 12 in/foot = 31.0"
234/1 08MHz = 2.17 feet * 12 in/foot = 26" in
Insert the 4 ground plane rods in the 4 holes of the UHF
connector. Stick them through about a quarter inch and solder
into place . Solder th radiator in the top of the UHF connector
(you may have to grind it a bit to make it fit) then bend the
ground plane rods downward to a 45 degree angle to the
radiator . There you have it. Just connect it with a 50 ohm CB
antenna cable to your amplified Ramsey, stick the antenna in GND
a tree or in another high place and you should have about a
mile of solid coverage (when using the above amp) . Also, if
you have an SWR meter you can cut the rods a little longer This next filter is a 5 element Chebyshev design . While it
and start clipping the ends off until you get the best SWR does work it is not as effective as the one above as evidenced
reading. by frequency values at certain decibel readings. Fe
That is one 81.8Mhz, 3db = 105MHz, 20db = 147Mhz, and 40db =
radiator pointing 222Mhz.
straight up and
four ground
plane radials . .128uH .128uH
Sorry for the
extreme
desciption but in
there has been
some confusion .
Be careful when
you bend the
brazing rod, don't break the connector. Grab the rod right
below the connector with a pair of vice-grips (or the likes) and
bend the brazing rod at that point. Try not to have anything
metal near the radiator as this will affect the radiation pattern.
The radiation pattern should look a lot like a doughnut
surrounding the radiator , though deformed a bit. I have been
told that you can shorten the radiator and make the ground GND
radials longer to lower your radiation angle, but I haven;t tried
this, nor do I know what this would do to the antenna
impedance . The difficult part in the above is winding the coils. 3 turns of
#12 wire 1/2 inch diamter should be about .12uH. 4 turns is
on the road .17uH (but ugh, #12 wire is big stuff). You could just use
Old magnetic mount CB antennas can make great mobile molded inductors, I have found these work well. Try to use
antennas. just take all of the base load out of them and cut the fiked value caps, or fixed value with small 5pf trimmers. The
radiator to 1/4 wave length . If you need a longer radiator than latter works well when you have a spectrum analyzer to tune
the one that comes with the anenna use the above mentioned these babies.
brazing rod. I've tried this antenna and it workds great! It is
better than my di-pole at home and you can drive to a high I just pulled a program off of a BBS that tells you how to wind
optimal location for your broadcasts. Also, with this setup you inductors . Give it the value and wire size you have and it will
10 Volume 1 Issue 1 - Spring 1998 THUD
tell you how many turns and what size. Way cool! More on build your own , as wimpy or as studly as you want by running
this later. resistors in parallel to create 50 ohms . IE two 100 ohm 1/4
watt resistor s will create a 1/2 watt 50 ohm load. Do not use
Here is a very simple Chebyshev filter. It won't knock the 50 ohm wire wound resistors , they are not 50 ohms at radio
harmonics down as much as frequencies .
the other two designs but the
.15uH
good thing about this one is rf probe
that it uses standard off the For those of you (like me) who are in constant starving
sehlf parts . The inductor is student mode, and DON'T have a good scope, you can use a
one of those molded jobbies good DMM for RF power calculations. All you need to do is
that looks like a resistor so build an RF probe. Here's the schematic (yes, taken from the
you can make this very 1989 ARRL handbook.
small. You may stack these
things to make a better filter.
.01uF 4.7meg
Each stage will knock the 1st
harmonic down about 15db. probe tip • ~ center of 50 ohm coax
GND Both C1 and C2 are of the to braid
same value. Use the 01
following values for the range you operate at: 87-90Mhz use cliplead
62pF, 90-103MHz use 54pF, and for103-108Mhz use 50pF. for ground
Also of interest is that the FM-10 puts out about 8-9mW and
the 2nd harmonic is -25db off the fundamental frequency you Anyway, the diode (arrow points to ground) should ideally be
are broadcasting on . The FM-4 kit by Ramsey puts out a Schottky diode (low rf capacitance) although a LN914 will
130mW and the 2nd harmonic is only -12db off the work . To use just hook up to your digital meter, set on DC
fundamental, which means the 2nd harmonic of the FM-4 is voltage. You will get very close to RMS RF voltage. This
about as powerful as the FM-10 itself . db is log10 so 3db is 2 probe was specified for a 10 megohm meter. To calculate
times, 6db is 4 times, and 9 db is 8 times, etc... power into a KNOWN purely resistive load (a.k.a. a dummy
load) use this formula :
recommended test equipment (E"2)/R
An SWR/power meter is a giant help, a CB to 2 meter one E is the RMS RF voltage and R is the resistance of the load
will suffice. Power readings will not be accurate, but can be
useful for peaking. The most important part is the SWR meter , This is also useful for checking inputs and ouputs of low
this is very importatn when making an antenna . power RF units, since the inexpensive power meters don't
seem to do real well below 1 watt .
A note on power meters . I recommonded the above type
power meters because they are inexpensive and most people paranoid?
interested in hacking the FM-10 have very limited funds. I've been talking to a few people that are worried about their
These are by no means accurate but they will give you some 'voice' being on the air, since they are afraid of being
idea what is going on. If you can spend the money you can recognized . So, I dusted off old stacks of Radio-Electronics
get an accurate power meter that is designed for this band , and found two articles that may be of interest. In the January
but the cost is 10-15 times more. 1993 issue they have a "Build Your Own Digital Voice
Changer" using a simple real time digital signal provessor . I
An RF probe could also be used as a replacement for a think that this design is very similar to the voice changing
powermeter . Construction plans follow. telephones . It basically raises or lowers your voive pitch. A
place called LNS Technologies at 1-800-886-7150 sells the
A 50 ohm NON inductive load is also very helpful. For low kits for $59.
power applications a 500hm 1/4 or 1/2 watt carbon resistor
works well. This can be used to tune up your kit and amp In their Septembet 1992 issue they have a "Buil dThis DSP
without interferring with anyone. Also note that you can run as Voice Effects Board " using a little more complex,
much power you want, legally, as long as it doesn 't radiate . programmable, real time digital signal processor. The
software they include conta ins a harmonizer, echo, reverb ,
A VOM is also very helpful. I would put out the extra bucks and pitch . The kit is sold by American Distributors, Inc. for
and buy one with a frequency counter (if you shop around, $105 at 1-800-877-0510. You can also wr ite your own
about $6-$70). Buy one that covers audio to 20MHz (or software but the programmer is several hundered dollars .
more). If you are serious about electronics you need one of
these! DC Electron ics has a Robot Voice kit for $15. I don't know
how well this works or what it sounds like, but it claims to be
dummy loads adjustable for many different effects .
Dummy loads are great for testing , without radiating a signal.
In fact , you can run as much power as you want into one of Ramsey's address
these things legally! Basically you want to create a non- If you're looking to purchase an FM-10 kit and can't find one
inductive 500hm load. This can be done with regulare carbon locally, try Ramsey Electronics, Inc. 793 Canning Parkway ,
resistors, or by buying pre-built amateur or CB radio loads. Victor, New York 14564 . Phone (716) 924-4560 FAX (716)
For low poer (less than 1/2 watt) an ethernet terminator works 924-4555.
well (check temp when using, if it gets very hot lower input
power, if it is still cool you may be able to go up 3/4 watt). sources
Most CB loads use a 2-watt 500hm carbon resistor you can BA1404 's andot her FM Broadcaster kits can be found at D.C.
THUD Volume 1 Issue 1 - Spring 1998 11
Electronics. Phone 1-800-467 -7736 & 1-800-423 -0070 . Fax Progressive Concepts sells plans for a 88MHz to 108MHz
1-602-994-1707. They sell BA1404s for $2 each, seems to be amp. The power curves show that 12mW in will yield 2.5
the best deal going . Also they sell 38KHz crystals fro $5.99, watts, but can be driven harder fro up to 12 watts . (I have not
which is also a fair deal. The crystals are tiny ones like the seen these plans) Plans only in U.S., $16 (a bit spendy,
digi-key ones, but a different brand and work without ouch!) Progressive Consepts 1313 N. Grand Ave #291
problems Walnut, CA 91789.
38Khz crystals can be obtained at Digi-Key at 1-800-DIGI- If you're looking to purchase an FM-10 kit (or a PA-1 kit) and
KEY. 38.000KHz by Epson America, Digi-Key part no. is can't find one locally try Ramsey Electronics, Inc. 793
SE3314 (see notes on crystal mod using this crystal, also Canning Parkway, Victor, new York 14564. Phone 1-716-924-
4560 Fax 1-716-924 -4555. Should be $29.
note that this is a cylinder type crystal and kinda delicate. You
are probably better off getting the 38KHz crystals from D.C. The makers of the infamous BA-1404 : Rohm Corporation,
Electronics.) Rohm Electronics Division , 3034 Owen Dr., Jackson
Business Park, Antioch, TN 37013 . Phone 1-615-641-2020
Mouser Electronics 1-800-346-6873, fax 1-817-483-9384. (ask for someone who deals with the BA1404) Fax 1-615-
Giant catalog! 239 pages of parts! Just about everything . No 641-2022 . Also available is P.O . Box 1399 Antioch, TN
minimum order for North America. $100 minimum for 37011-1399.
overseas.
other raw info
RF Parts 1320-16 Grand Ave. San Marcos, CA 92061 They The 2SC2570 is supposedly replaceable with an ECG10.
have just about any RF transistor! Also I have used an MRF901 for a replacement, though tough
to mount, try bottom of the pc board and connecting the whip
antenna pad to ground plane. MPS901s seem to replace the
Dalbani - 2733 Carrier Ave. Los Angeles, CA 90040 1-800- 2SC2570 directly , same case too, check the pinouts though. I
325-2264 in the US or 1-213-727-0054 for the rest of the have also been told that MPS918s work well also.
world. Fax is 1-213-727-6032 . They have RF transistors and
other semiconductors and more! 187 page catalog . $20 The MRF239 can be used as direct replacement for the
minimum order. Ramsey 2 meter PA-1 kit. Cost is around $14 bucks.
Panaxis Productions makes some very high quality FM Newark also has the 38KHz crystals fro $2.90 (I don't know
transmitters. The last word in transmitt ing with tons of kits. Newark's address, this was sent to me in the mail, will try to
Panaxis Productions P.O. Box 130 Paradise , CA 95967-0130 find it though.) Once more, if you have any info, I stress
(right next to myoid place of study, Chico State!) Phone "ANY", about this subject please drop me a byte or two. Have
1-916-534-0416. Catalogs are $2 but well worth the price. A fun, your pal Mycal - mycal@netronix.com.
must have item.
1)I~ll ) .. INI~
IF YOU WANT TO GET ANY OF THE FOLLOWING INTO OUR
NEXT (SUMMER) ISSUE OF
"THE HACKERS UNDERGROUND DIGEST"
PLEA f SEND THE MATERIAL TO US BEFORE THE DEADLINE.
WE'RE LOOKING FOR:
IIA'/G/KA/AA'TWIIA'K
PHIITIII/MPH./'II''IIVA''APIIA'/IFKAt'K/KGA'FUIFP/IFM.
AA'T/t'/F./'11Kt'A8/FTIf IF/FPHIIK#; PIIWFIl Mil/it
F/Ft'mIlK/t'J; PA'II.1Ft'J:( t'IIMPVIFA'J; FTt:
YOU EED TO HA'il MA TE ~ LSENT TO US BY
u e 1 h, 1998
(Volume 1, Issue 2 Summer 1998)
©@~1i' ®~ & ©W~®@Q:{]D1i' oooo@1i'& WD~ @~Q:{]@@~ &~@ fl,~&OO~ @@~~1i'Q:{]D~@
12 Volume 1 Issue 1 - Spring 1998 THUD
The United States Senate, or Upper House of Congress , is comprised of two senators from each
state. Senators were origiganlly chosen by the legislative powers of each state but since 1913 when the
17th Amendment went into effect, they have been chosen by popular vote of the citizens of each state . The
requirements to become a senator are simple and straightforwa rd. The candidate must be at least 30 years
old, a citizen of the United States for at least 9 years, and a resident of the state for which they are to be a
senator.
The vice-president of the United States acts as the presiding officer of congress and only votes whent he
senate is deadlocked in a tie. Senators gather in committees to handle the legislative powers granted them
by the Constitution. Among the 16 or so committees are those on Appropriations, Foreign Relations, Armed
Services, Banking and Currency, Finance, Judiciary, and even Public Works.
The power of the senate, along with the House of Representatives, has the power, as outlined in Article 1,
Section 8 of the Constitution, to collect taxes, regulate commerce between the states and with foreign
nations, to coin money, raise and support armies, declare war, and make all laws necessary for the
execution of it's own powers. However, the Senate has some specific duties as well, such as the
confirmation of presidential appointments and the power to try impeachments. Impeachments, by the way,
must be initiated by the House of Representatives.
Following is a list of all the current senators of the United States, listed by state , their snail-mail address
and voice telephone numbers. Also included are their email addresses as well as web sites concerning
each senator . You can also call the Congressional switchboard at 1-202-225-3121 and ask to be switched
to your Senator.
Now you have the means of contacting your senator and either supporting or caomplaining about their
work. The true power of America is meant to lie in the hands of it's citizens. Exercise that right and become
involved in the politics of your nation. Don't be a shmuck and let someone else decide for you what is best
for you. Decide for yourself!!!
Alaska Hutchinson, Tim (R) Colorado
Murkowski, Frank H. United States Senate Campbell , Ben N. (R)
United States Senate 708 Hart Senate Office Building United States Senate
706 Hart Senate Office Building Washington, D.C. 20510 380 Russell Senate Office Building
Washington, D.C. 20510 1-202-224-2353 1-202-228-3973 Washington, D.C. 20510
1-202-224-6665 1-202~224-5301 http://www .senate .gov/-hutchi 1-202-224-5852 1-202-224-1933
email@murkowski.senate.gov http://www .falcontech .com/nig
http://www.senate .gov/-murkow
http://www .state.ak .us/local/ Arizona Allard, Wayne (R)
Kyl, Jon (R) United States Senate
Stevens, Ted (R) United States Senate 716 Hart Senate Office Building
United States Senate 702 Hart Senate Office Building Washington, D.C. 20510
522 Hart Senate Office Building Washington, D.C. 20510 1-202-224-5941 1-202-224-6471
Washington, D.C. 20510 1-202-224-4521 1-202-224-2207 http://www .senate.gov/senator
1-202-224-3004 1-202-224-2354 info@kyl.senate.gov
Senator_Stevens@stevens.senate.gov http://www.house.gov/-kyl/ Connecticut
http://www .senate.gov/-steven Dodd, Christopher J. (D)
McCain, John (R) United States Senate
Alabama United States Senate 444 Russell Senate Office Building
Sessions, Jeff (R) 241 Russell Senate Office Building Washington, D.C. 20510
United States Senate Washington , D.C. 20510 1-202-224-2823 1-202-224-1083
34 Dirksen Senate Office Building 1-202-224-2235 1-202-228-2862 sen_dodd@dodd .senate.gov
Washington, D.C. 20510 Senator_McCain@mccain.senate.gov http://www .senate.gov/-dodd/
1-202-224-4124 1-202-224-3149 McCain, John (R) cont...
sessions@wrtdnet.net http://aspin.asu.edu/-pctp/mc Lieberman, Joseph I. (D)
http://www.senate.gov/senator United States Senate
316 Hart Senate Office Building
Shelby, Richard C. (R) California Washington, D.C. 20510
United States Senate Boxer, Barbara (D) 1-202-224-4041 1-202-224-9750
110 Hart Senate Office Building United States Senate senatorJieberman@
Washington, D.C. 20510 112 Hart Senate Office Building lieberman .senate.gov
1-202-224-5744 1-202-224-3416 Washington, D.C. 20510 http://www.senate.gov/-Iieber
senator@shelby.senate.gov 1-202-224-3553 1-415-956-6701
http://www.senate.gov/senator senator@boxer.senate.gov
http://www.senate.gov/-boxer/ Delaware
Arkansas Biden Jr., Joseph R. (D)
Bumpers, Dale (D) Feinstein, Dianne (D) United States Senate
United States Senate United States Senate 221 Russell Senate Office Building
229 Dirksen Senate Office Building 331 Hart Senate Office Building Washington, D.C. 20510
Washington, D.C. 20510 Washington, D.C. 20510 1-202-224-5042 1-202-224-0139
1-202-224-4843 1-202-224-6435 1-202-224-3841 1-202-228-3954 senator@biden.senate.gov
senator@bumpers.senate.gov senator@feinstein.senate.gov http://www.senate.gov/-biden/
http://www .senate.gov/-bumper http://www.senate.gov/-feinst
THUD Volume 1 Issue 1 - Spring 1998 13
Roth Jr. William V. (R) Kempthorne, Dirk (R) Landrieu, Mary (D)
United States Senate United States Senate United States Senate
104 Hart Senate Office Building 367 Dirksen Senate Office Building 825 Hart Senate Office Building
Washington, D.C. 20510 Washington , D.C. 20510 Washington, D.C. 20510
1-202-224-2441 1-202-228-0354 1-202-224-6142 1-202-224-5893 1-202-224-5824 1-202-224-2952
Roth Jr. William V. (R) cont... dirk_kempthorne@ mary96@worldnet.att.net
http://www.senate.gov/-roth/ kempthorne. senate.gov http://www .senate.gov/senator
http://www.senate.gov/-kempth
Florida Illinois Massachusetts
Graham, Robert (D) Moseley-Braun, Carol (D) Kennedy, Edward M. (D)
United States Senate United States Senate United States Senate
524 Hart Senate Office Building 320 Hart Senate Office Building 315 Russell Senate Office Building
Washington, D.C. 20510 Washington, D.C. 20510 Washington, D.C. 20510
1-202-224-3041 1-202-224-2237 1-202-224-2854 1-202-224-2626 1-202-224-4543 1-202-224-2417
bob_graham@graham.senate.gov 1-202-228-1318 senator@kennedy.senate.gov
http://www.senate.gov/-graham senator@moseley-braun.senate.gov http://www .senate.gov/-kenned
Moseley-Braun, Carol (D) cont...
Mack, Connie (R) http://www.senate.gov/-mosele Kerry, John F. (D)
United States Senate United States Senate
517 Hart Senate Office Building Durbin, Richard (D) 421 Russell Senate Office Building
Washington, D.C. 20510 United States Senate Washington, D.C. 20510
1-202-224-5274 1-202-224-8022 267 Russell Senate Office Building 1-202-224-2742 1-202-224-8525
chairman_ mack@jec .senate.gov Washington, D.C. 20510 john_kerry@kerry.senate.gov
connie@mack.senate.gov 1-202-224-2152 1-202-224-0868 http://www.senate.gov/-kerry/
http://www .senate.gov/-mackl http://www.senate.gov/senator Maryland
Georgia Indiana Mikulski, Barbara A. (D)
Cleland, Max (D) Coats, Daniel R. (R) United States Senate
United States Senate United States Senate 709 Hart Senate Office Building
4633 Dirksen Senate Office Building 404 Russell Senate Office Building Washington, D.C. 20510
Washington , D.C. 20510 Washington, D.C. 20510 1-202-224-4654 1-202-224-8858
1-202-224-3521 1-202-224-0072 1-202-224-5623 1-202-228-4137 senator@mikulski .senate.gov
http://www.senate.gov/-coats/ http://www.senate.gov/-mikuls
Coverdell, Paul (R)
United States Senate Lugar, Richard G. (R) Sarbanes, Paul S. (D)
200 Russell Senate Office Building United States Senate United States Senate
Washington, D.C. 20510 306 Hart Senate Office Building 309 Hart Senate Office Building
1-202-224 -3643 1-202-228-3783 Washington , D.C. 20510 Washington, D.C. 20510
senator_coverdell@ 1-202-224-4814 1-202-228-3060 1-202-224-4524 1-202-224-1651
coverdell.senate.gov lugar@iquest.net senator@sarbanes.senate .gov
http://www .senate.gov/-coverd http://www.iquest.netllugar/w http://www.senate .gov/-sarban
Hawaii Maine
Akaka, Daniel K. (D) Kansas Snowe, Olympia (R)
United States Senate Brownback, Sam (R) United States Senate
720 Hart Senate Office Building United States Senate 495 Russell Senate Office Building
Washington, D.C. 20510 141 Hart Senate Office Building Washington, D.C. 20510
1-202-224-6361 1-202-224-2126 Washington, D.C. 20510 1-202-224-5344 1-202-224-1946
http://www.senate.gov/senator 1-202-224-6521 1-202-224-8952 Olympia@snowe.senate.gov
http://www .senate.gov/senator http://www.senate.gov/-snowe/
Inouye, Daniel K. (D)
United States Senate Roberts , Pat (R) Collins, Susan (R)
722 Hart Senate Office Building United States Senate United States Senate
Washington, D.C. 20510 116 Dirksen Senate Office Building 40-4 Dirksen Senate Office Building
1-202-224-3934 1-202-224-6747 Washington, D.C. 20510 Washington, D.C. 20510
senator@inouye.senate.gov 1-202-224-4774 1-202-224-3514 1-202-224-2523 1-202-224-2693
http://www.senate.gov/-inouye http://www.senate.gov/senator collins96@midcoast.com
Iowa Kentucky Michigan
Harkin, Thomas (D) Ford, Wendell H. (D) Levin, Carl (D)
United States Senate United States Senate United States Senate
531 Hart Senate Office Building 173A Russell Senate Office Building 459 Russell Senate Office Building
Washington, D.C. 20510 Washington, D.C. 20510 Washington, D.C. 20510
1-202-224-3254 1-202-224-9369 1-202-224-4343 1-202-224-0046 1-202-224-6221 1-202-224-1388
tom_harkin@harkin.senate.gov wendel'-ford@ford.senate.gov senator@levin.senate.gov
http://www .senate.gov/-harkin http://www .senate.gov/-ford/ http://www.senate.gov/-Ievin/
Grassley , Charles E. (R) McConnell, Mitch (R) Abraham, Spencer (R)
United States Senate United States Senate United States Senate
135 Hart Senate Office Building 361A Russell Senate Office Building 245 Dirksen Senate Office Building
Washington , D.C. 20510 Washington, D.C. 20510 Washington, D.C. 20510
1-202-224-3744 1-202-224-6020 1-202-224-2541 1-202-224-2499 1-202-224-4822 1-202-224-8834
chuck_grassley@grassley.senate.gov senator@mcconnell.senate.gov michigan@abraham.senate.gov
http://www.senate.gov/senator http://www.senrlte.gov/-mcconn http://www.senate.gov/-abraha
Idaho Louisiana Minnesota
Craig, Larry E. (R) Breaux, John B. (D) Wellstone, Paul (D)
United States Senate United States Senate United States Senate
313 Hart Senate Office Building 516 Hart Senate Office Building 717 Hart Senate Office Building
Washington, D.C. 20510 Washington, D.C. 20510 Washington, D.C. 20510
1-202-224-2752 1-202-228-1067 1-202-224-4623 1-202-224-4268 1-202-224-5641 1-202-224-8438
larry_craig@craig.senate.gov senator@breaux.senate.gov senator@wellstone.senate.gov
http://www.senate.gov/-craig/ http://www.senate.gov/-breaux http://www .senate.gov/-wellst
14 Volume 1 Issue 1 - Spring 1998 THUD
Grams. Rod (R) Dorgan , Byron L. (D) Nevada
United States Senate United States Senate Bryan, Richard H. (D)
261 Dirksen Senate Office Building 713 Hart Senate Office Building United States Senate
Washington, D.C. 20510 Washington, D.C. 20510 364 Russell Senate Office Building
1-202-224-3244 1-202-228-0956 1-202-224-2551 1-202-224-1193 Washington, D.C. 20510
mai'-grams@grams.gov senator@dorgan.senate.gov 1-202-224-6244 1-202-224-1867
http://www.senate.gov/-grams/ http://www .senate .gov/-dorgan senator@bryan.senate.gov
Missouri http://www.senate.gov/-bryan/
Bond, Christopher S. (R) Nebraska
United States Senate Hagel, Chuck (R) Reid, Harry (D)
293 Russell Senate Office Building United States Senate United States Senate
Washington, D.C. 20510 40-3 Dirksen Senate Office Building 324 Hart Senate Office Building
1-202-224-5721 1-202-224-8149 Washington, D.C. 20510 Washington, D.C. 20510
kit_bond@bond.senate.gov 1-202-224-4224 1-202-224-5213 1-202-224-3542 1-202-224-7327
http://www .senate.gov/-bond/ email@hageI96.com senator_reid@reid .senate .gov
http://www .senate .gov/senator http://www .senate.gov/-reid/
Ashcroft , John (R) New York
United States Senate Kerrey, Bob (D) Moynihan, Daniel P. (0)
170 Russell Senate Office Building United States Senate United States Senate
Washington, D.C. 20510 303 Hart Senate Office Building 464 Russell Senate Office Building
1-202-224-6154 1-202-228-0998 Washington, D.C. 20510 Washington, D.C. 20510
john_ ashcroft@ashcroft.senate .gov 1-202-224-6551 1-202-224-7645 1-202-224-4451 1-202-228-0406
http://www .senate.gov/-ashcro bob@kerrey .senate.gov senator@dpm .senate.gov
http://www .senate .gov/-kerrey http://www.senate.gov/-moynih
Mississippi
Cochran, Thad (R) New Hampshire D'Amato, Alfonse M. (R)
United States Senate Gregg, Judd (R) United States Senate
326 Russell Senate Office Building United States Senate 520 Hart Senate Office Building
Washington, D.C. 20510 393 Russell Senate Office Building Washington, D.C. 20510
1-202-224-5054 1-202-224-9450 Washington, D.C. 20510 1-202-224-6542 1-202-224-5871
senator@cochran.senate.gov 1-202-224-3324 1-202-224-4952 senator_al@damato .senate.gov
http://www.senate.gov/-cochra mailbox@gregg.senate.gov http://www.senate.gov/-damato
http://www.senate.gov/-gregg/
Lott, Trent (R) Ohio
United States Senate Smith, Robert (R) Glenn, John (D)
487 Russell Senate Office Building United States Senate United States Senate503 Hart Senate
Washington, D.C. 20510 332 Dirksen Senate Office Building Office Building
1-202-224-6253 1-202-224-2262 Washington, D.C. 20510 Washington, D.C. 20510
http://www .senate.gov/senator 1-202-224 -2841 1-202-224-1353 1-202-224-3353 1-202-224-7983
Montana opinion@smith.senate.gov senator_glenn@glenn .senate .gov
Baucus, Max (D) http://www.senate.gov/-smith/ http://little.nhlink.neUjohn
United States Senate
511 Hart Senate Office Building New Jersey DeWine, Michael (R)
Washington, D.C. 20510 Torricelli, Robert (D) United States Senate
1-202-224-2651 1-202-224-1974 United States Senate 140 Russell Senate Office Building
max@baucus.senate.gov 728 Hart Senate Office Building Washington, D.C. 20510
http://www .senate.gov/-baucus Washington, D.C. 20510 1-202-224-2315 1-202-224-6519
1-202-224-3224 1-202-224-8567 senator_dewine@dewine.senate.gov
Burns, Conrad R. (R) tprroce@torricelli .com http://www.senate.gov/-dewine
United States Senate http://www.senate.gov/senator Oklahoma
187 Dirksen Senate Office Building Inhofe, James (R)
Washington, D.C. 20510 Lautenberg, Frank R. (D) United States Senate
1-202-224-2644 1-202-224-8594 United States Senate 453 Russell Senate Office Building
conrad_burns@burns.senate.gov 506 Hart Senate Office Building Washington, D.C. 20510
http://www.senate.gov/-burns/ Washington, D.C. 20510 1-202-224-4721 1-202-228-0380
North Carolina 1-202-224-4744 1-202-224-9707 http://www.senate.gov/-inhofe
Faircloth, D. M. (R) Lautenberg, Frank R. (D) cont ...
United States Senate frank_Iautenberg@ Nickles , Donald (R)
317 Hart Senate Office Building lautenberg .senate.gov United States Senate
Washington, D.C. 20510 http://www.senate.gov/-Iauten 133 Hart Senate Office Building
1-202-224-3154 1-202-224-7406 Washington, D.C. 20510
senator@faircloth.senate.gov New Mexico 1-202-224-5754 1-202-224-6008
http://www.senate .gov/-faircl Bingaman, Jeff (D) senator@nickles.senate .gov
United States Senate http://www .senate .gov/-nickle
Helms, Jesse (R) 703 Hart Senate Office Building
United States Senate Washington, D.C. 20510 Oregon
403 Dirksen Senate Office Building 1-202-224-5521 1-202-224-2852 Smith , Gordon (R)
Washington, D.C. 20510 Senator_Bingaman@ United States Senate
1-202-224-6342 1-202-224-7588 bingaman.senate.gov 40-2 Dirksen Senate Office Building
jesse_helms@helms.senate.gov http://www.senate.gov/-bingam Washington, D.C. 20510
http://www.senate.gov/-helms/ 1-202-224-3753 1-202-224-0276
North Dakota Domenici , Pete V. (R)
Conrad, Kent (D) United States Senate Wyden , Ron (D)
United States Senate 328 Hart Senate Office Building United States Senate
724 Hart Senate Office Building Washington, D.C. 20510 259 Russell Senate Office Build ing
Washington, D.C. 20510 1-202-224-6621 1-202-224-7371 Washington, D.C. 20510
1-202-224-2043 1-202-224-7776 senator_domenici@ 1-202-224-5244 1-202-228-2717
senator@conrad.senate.gov domenici .senate.gov senator@wyden.senate.gov
http://www.senate.gov/-conrad http://www.senate.gov/-domeni http://www.senate.gov/-wyden/
THUD Volume 1 Issue 1 • Spring 1998 15
Pennsylvania Frist, Bill (R) Washington
Santorum, Rick (R) United States Senate Murray, Patty (D)
United States Senate 565 Dirksen Senate Office Building United States Senate
120 Russell Senate Office Building Washington, D.C. 20510 111 Russell Senate Office Building
Washington, D.C. 20510 1-202-224-3344 1-202-228-1264 Washington, D.C. 20510
1-202-224-6324 1-202-228-0604 senator_frist@frist.senate.gov 1-202-224-2621 1-202-224-0238
senator@santorum.senate .gov http://www.senate.gov/-frisU senator_murray@murray.senate.gov
http://www.senate.gov/-santor http://www.surgery.mc.vanderb http://www .senate.gov/-murray
Specter, Arlen (R) Texas
United States Senate Hutchison, Kay Bailey (R) Gorton, Slade (R)
530 Hart Senate Office Building United States Senate United States Senate
Washington, D.C. 20510 283 Russell Senate Office Building 730 Hart Senate Office Building
1-202-224-4254 1-202-224-1893 Washington, D.C. 20510 Washington, D.C. 20510
senator_specter@specter.senate.gov 1-202-224-5922 1-202-224-0776 1-202-224-3441 1-202-224-9393
http://www.senate.gov/-specte senator@hutchison.senate.gov Senator_Gorton@gorton .senate .gov
http://www.senate.gov/-hutchi http://www .senate.gov/-gorton
Rhode Island
Reed, Jack (D) Gramm , Phil (R) Wisconsin
United States Senate United States Senate Feingold, Russell (D)
339 Russell Senate Office Building 370 Russell Senate Office Building United States Senate
Washington, D.C. 20510 Washington, D.C. 20510 502 Hart Senate Office Building
1-202-224-4642 1-202-224-4680 1-202-224-2934 1-202-228-2856 Washington, D.C. 20510
reed@collegehill.com http://www.senate.gov/senator 1-202-224-5323 1-202-224-2725
http://www .senate.gov/senator russeILfeingold@feingold.senate.gov
Utah http://www.senate.gov/-feingo
Chafee, John H. (R) Bennett, Robert (R)
United States Senate United States Senate Kohl, Herbert H. (D)
505 Dirksen Senate Office Building 431 Dirksen Senate Office Building United States Senate
Washington, D.C. 20510 Washington, D.C. 20510 330 Hart Senate Office Building
1-202-224-2921 1-202-228-2853 1-202-224-5444 1-202-224-4908 Washington, D.C. 20510
senator_chafee@chafee.senate.gov senator@bennett.senate.gov 1-202-224-5653 1-202-224-9787
http://www.senate.gov/senator http://www.senate.gov/-bennet senator_kohl@kohl.senate.gov
http://www.senate.gov/-kohl/
South Carolina Hatch, Orrin G. (R)
Hollings , Ernest F. (D) United States Senate West Virginia
United States Senate 131 Russell Senate Office Building Byrd, Robert C. (D)
125 Russell Senate Office Building Washington, D.C. 20510 United States Senate
Washington, D.C. 20510 1-202-224-5251 1-202-224-6331 311 Hart Senate Office Building
1-202-224-6121 1-202-224-4293 senator_hatch@hatch.senate.gov Washington, D.C. 20510
senator@hollings.senate.gov http://www.house.gov/-hatch/ 1-202-224-3954 1-202-228-0002
http://www.senate.gov/-hollin senator_byrd@byrd.senate.gov
http://www .senate.gov/senator
Thurmond, Strom (R) Virginia
United States Senate Robb, Charles S. (D) Rockefeller , John D. (D)
217 Russell Senate Office Building United States Senate United States Senate
Washington, D.C. 20510 154 Russell Senate Office Building 109 Hart Senate Office Building
1-202-224-5972 1-202-224-1300 Washington, D.C. 20510 Washington, D.C. 20510
senator@thurmond .senate .gov 1-202-224-4024 1-202-224-8689 1-202-224-6472 1-202-228-7665
http://www.senate.gov/-thurmo Senator_Robb@robb.senate.gov senator@rockefeller.senate.gov
vascr@CapAccess .org http://www.senate.gov/-rockef
http://www .senate .gov/-robb/
South Dakota Wyoming
Daschle, Thomas A. (D) Warner, John W. (R) Enzi, Michael (R)
United States Senate United States Senate United States Senate
509 Hart Senate Office Building 225 Russell Senate Office Building 116 Dirksen Senate Office Building
Wash ington, D.C. 20510 Washington , D.C. 20510 Washington, D.C. 20510
1-202-224-2321 1-202-224-2047 1-202-224-2023 1-202-224-6079 1-202-224-3424 1-202-228-0350
tom_daschle@daschle.senate.gov senator@warner.senate .gov senator@enzi .senate.gov .
http://www.senate.gov/-daschl http://www.senate .gov/-warner http://www.senate.gov/-enzi/
Johnson, Tim (D) Thomas, Craig (R)
United States Senate Vermont United States Senate
528 Hart Senate Office Building Leahy, Patrick J. (D) 302 Hart Senate Office Building
Washington, D.C. 20510 United States Senate Washington, D.C. 20510
1-202-224-5842 1-202-228-0368 433 Russell Senate Office Building 1-202-224-6441 1-202-224-1724
tim@win .dakota.net Washington, D.C. 20510 craig@thomas.senate.gov
http://www .senate.gov/johnson 1-202-224-4242 1-202-224-3595
senator_leahy@leahy.senate.gov
Tennessee http://www .senate .gov/-Ieahy/
Thompson , Fred (R)
United States Senate Jeffords, James M. (R)
523 Dirksen Senate Office Building United States Senate
Washington, D.C. 20510 513 Hart Senate Office Building
1-202-224-4944 1-202-228-3679 Washington, D.C. 20510
senator_thompson@thompson.senate.g 1-202-224-5141 na
ov vermont@jeffords.senate.gov
http://www.senate.gov/-thomps http://www .senate.gov/-jeffor
16 Volume 1 Issue 1 - Spring 1998 THUD
RC DR AMES
Sales - Parts - Service - Custom
If you're looking for one of those hard to
find arcade games, this is the place to
call. We have one of the largest
selections of hard to find classic arcade
games and pinballs. If you're looking for
a part or you just want an arcade game for
your business site or for home use, give
us a call. Be sure to mention you saw the
ad here in Blacklisted! 411.
THUD Volume 1 Issue 1 - Spring 1998 17
.t4ALU6.EAL.EKT .P~.B.IiC .E'.B.E,s U.EKeI.E6
by: Dr. Whip
ALRIGHTY THEN, I'm sure there's quite a few of us out Connecticut 154.625 154.740
there who have spent a few dollars on at least a simple Lake Compounce Festival 155.370 157.740
scanner. I also know there's some people who should be Park 158.100 158.460
locked up for their obsession with scanning. Instead of a 464.425 464.475 171.025 173.225
469.425 469.475 173.275 173.325
microwave oven they buy microwave receivers . Well,
Quassy Amusement Park 173.375 184.400
whatever level of scanner enthusiast you are I'm sure 154.57 199.400 204.600
every once in a while we've gone to the local amusement Florida 204.850 206.000
park with friends or family. Some of us even live n~ar Busch Gardens Tampa 206.300 206.625
them. Surely we've all noticed lotsa people walking 461.7125 462.0875 206.975 207.350
around with walkie-talkies or other radio equipment while 467.1125 207.600 207.750
visiting and having a jolly 01' good time (NOT!) or even Cypress Gardens 208.175 208.625
seen the odd utility cart with a radio on it. Now, for you're 464.425 208.950 209.100
listening pleasure for those who just can't get away fr~m Lion Country Safari 209.425 209 .600
a receiver while entertaining the kiddies we have a fairly 464.375 469.375 210.125 211.850
comprehensive list of scanner frequencies. It's broken Miracle Strip Amusement 212.475 442.000
Park 443.400 448.400
down by state so it shouldn't be too hard for you to find
462.1 450 .0625 450.1875
what you're looking for. Sea World of Florida 450 .3125 450.4375
151.775 151.805 451.500 452 .700
Arkansas 467.875 467.9 154.515 154.54 453.475 453.875
Magic Springs Family Theme 467.925 490.1625 154.6 461.0125 453.925 452.650
Park 490.2625 493.1625 461 .0375 461 .1 453.825 453.875
154.515 154.54 493.2625 461.1625 461.2625 453.925 461 .300
California Raging Waters 461.2875 461 .5875 461.3375 461 .600
Belmont Park 462 .6 463.9875 461.675 461.7375 461 .700 461 .9125
464.8875 469.8875 464.1375 464.9875 461.775 461.85 462.475 462.550
Disneyland Santa Cruz Beach Boardwalk 462.0 463 .325 462.575 462.625
154.625 461 .85 461.0625 461.0875 463.3875 463.5625 462 .650 462.675
464.5375 464.6375 462 .0625 462 .1625 463.675 463 .825 462.775 462 .850
464.4125 464 .575 463.925 466.0625 463.9125 463.95 463.750 463 .975
464.7625 464.5125 466.0875 467.0625 464.0375 464.0875 464.0625 464.125
464.7125 464.1625 467 .1625 468.925 464.1 464.2125 464.200 464 .200
464.1125 464 .9875 Sea World of California 464.2875 464.3375 464.400 464 .500
464.8875 938.3875 42.96 154.515 464.3875 464.4375 464 .525 464.600
938.40 938.4125 154.54 460.8875 464.4875 464.525 464.625 464.800
938.425 938.4375 461.0875 461.1625 464.6625 464.725 464.9375 467.250
938.45 938.4625 461 .3875 461.4875 464.775 464 .825 467.575 468.8125
938.475 938.4875 461.5375 461.5875 464.875 464 .975 469.3375 483.000
938.50 461.6625 461 .6875 465.0 466.0125 484.175 484.325
Hecker Pass: A Family 461 .7625 461.7875 466.0375 466 .1 484.350 484.375
Adventure 462.06-25 462.0875 466.1625 466.2625 806.000 851.3125
460.8875 461 .8875 462.85 462.8875 466.2875 466 .5875 851.5625 851.8875
462 .8875 463.8875 463.6625 463.6875 466.675 466.7375 852.1875 852.2375
464 .8875 465.8875 463.7125 464 .05 466.775 466.85 852.3625 852.4125
Knotts Berry Farm 464.1875 464.2125 467.0 467 .1375 852.5625 852.7375
151.625 151.655 464.4375 464.4625 467.8375 468.325 852.8125 853.4625
151.685 151.745 464.9125 465.8875 468.675 468.825 53.4875 853.7125
154.54 154.57 466.0875 466.1625 468.95 469.1 854.3375 855.1875
154.6 158.46 466.3875 466.4875 469.2125 469 .2375 855.6875 855.7875
461.1875 461 .7875 466.5375 466.5875 469.2625 469.2875 855.8125 855.8875
462.0375 462 .0625 466.6625 466.6875 469 .3125 469 .3875 855.9875 856.7875
462.1125 462 .1375 466 .7625 466.7875 469.6625 469 .725 856.8125 856.9125
463.5875 464.6625 467 .0625 467.0875 469.825 896.6875 857.1625 857.1875
464.8625 466 .1875 467 .8875 468.6625 897.1875 898.1875 857.7875 857.8125
466.3625 466.3875 468.6875 468 .7125 899.1875 899.7125 858.0375 858.7875
466 .6875 466 .7875 469.05 469.1875 935.6875 936.1875 858.8125 859.7875
467.0375 467.0625 469 .2125 469.4375 937.1875 938.1875 859.8125 860.7875
467.1125 467 .1375 469.4625 469.9125 938.7125 957.05 915.000
468.5875 469.2625 Six Flags Magic Mountain 957.65 959.35 Georgia
469.6375 469.6625 151.685 151.715 Shipwreck Island Six Flags Over Georgia
469.7125 469 .8625 151.745 151.775 462.15 462.05 462.1
Marine World-Africa USA 151.805 151.895 Wet'N Wild 464.575 464 .675
151.925 151.955 151.995 151.515 154.6 464 .975 467 .1
461 .7375 464.6875 154.54 154.57 Universal Studios Florida 467.875 469.575
469.6875 468.8125 463.225 928.1625 469.675 469 .975
Paramount's Great America Universal Studios Hollywood 952.1625 Hawaii
157.74 457.525 151.745 151.83 Walt Disney World Waimea Falls Park
457.55 457 .575 Colorado 123.050 127.750 151.745 151.865
457 .6 465.9 Elitch Gardens 147.300 147.900 151.925
465.975 466.05 466.3625 469.5125 148.100 151.200 Idaho
466.125 466 .2 469.5375 469.5625 151.655 151.625 Silverwood Theme Park
466.275 466.35 Lakeside Park 151.745 151.775 122.85 154.6
466.425 467.75 457.575 151.865 151.925 157.56 160.845
467 .775 467 .8 Santa's Workshop 151.895 154.430 464.425 469 .375
467.825 467.85 461.5 461 .675 154.4787 154.47875 469.425
18 Volume 1 Issue 1 - Spring 1998 THUD
Illinois 461.7625 463.425 463.675 464.0375 462.1125 462.8625
Knight's Action Park 464.175 464.275 464.4375 466.1625 462 .8875 462.9
151.925 151.955 468.425 469 .175 466.325 466.4875 463.2125 463.2375
Six Flags Great America 469.275 469.55 467 .1375 467.7625 463.3875 463.7
457.525 457 .55 Nebraska 467.8125 467 .8625 463.7375 464.85
457.575 457.6 Peony Park 468.2625 468.5125 466.1 466.125
460.6125 463.3625 464.425 468.6625 468.675 466.4375 466.7875
463.6 464.375 Nevada 469 .0375 469.4375 467 .1125 468.7
464.475 464.675 Wet'NWild Sea World of Ohio 468 .7375 469.85
464.775 464.875 461.3 461 .975 154.54 154.6 Sea World of Texas
465 .9 465.975 464.0 464.375 462.025 463.2125 461.15 461 .35
466.05 466.125 466.3 463.2625 463.3125 461.65 461.6875
466.2 466.275 New Jersey 463.4625 463.5125 462.0625 462.0875
466.35 466.425 Action Park 464.025 464.825 462 .1625 463.45
467.75 467.775 154.57 154.6 464.875 467.025 464.0875 464.1875
467.8 467.825 Mariner's Landing 468.2125 468.2625 464 .2125 464.325
467.85 467.875 151.895 151.985 468 .3125 468.4625 464.4625 464.5125
467.9 467.925 Six Flags Great Adventure 468 .5125 469.875 464.675 465.0
468.6 469.375 154.54 154.6 Wyandot lake 466.15 466.35
469.475 469.675 461 .775 464.325 151.655 466.65 466.6875
469.775 469.875 464.425 464.625 Oklahoma 467.0625 467.0875
Indiana 464.675 464.825 Bells Amusement Park 467 .1625 468.45
Indiana Beach 464.975 466.775 461.25 466.25 469.0875 469.1875
151.865 155.22 469.325 469.425 Frontier City 469.2125 469.325
Old Indiana Fun Park 469.675 469.825 464 .775 464.975 469.4625 469.5125
151.745 469.975 Pennsylvania 469.675
Iowa Storybook Land Bland's Park Six Flags Over Texas
Arnolds Park 464.925 464.2125 464.5125 457.55 461.3125
461.975 New Mexico 464 .7125 462 .1125 462 .9125
Kansas Cliffs Amusement Park Dorney Park 463.8125 464 .2125
Joyland 463.225 467.8 151.835 151.865 464 .3875 464.425
154.6 468.225 151.895 151.925 464.5125 464.7375
Kentucky New York Dutch Wonderland 466.575 466.6625
Kentucky Kingdon Darien Lake 151.715 151.745 468.5125 469.3875
463.425 468.425 151.655 151.715 Hersheypark 469.425
Maine 151.745 . 151.775 461 .325 464.375 Western Playland
Palace Playland 151.805 154.515 464.425 464 .575 154.515
151.655 Fantasy Island Idlewild Park Wet'N Wild
York's Wild Kingdom Zoo and 464.525 151.685 154.515 461 .0875 461.2125
Amusement Park North Carolina Kennywood 461 .7375 154.6
151.655 151.755 Emerald Point 151.865 Wonderland Park
151.805 151.835 151.745 154.54 Sandcastle 154.57
Massachusetts Paramount's Carowinds 151.745 466 .3625 Utah
Riverside Park 461.375 461 .6 Sesame Place 49th Street Galleria
154.625 464.525 461.875 461.975 151.685 151.715 464 .575
464.5625 464.825 462.025 462.8 151.805 151.895 Lagoon
464.925 464 .65 151.955 154.515 154.515 154.54
Whalom Park Santa's Land Waldameer 158.46 461.0125
154.515 154.57 151.685 154.54 Raging Waters
Michigan Tweetsie Railroad Rhode Island 461.3 462.0125
Michigan's Adventure 464.475 468.4 Rocky Point Park 466 .3 464.975
Amusement Park 468 .8875 468.9 464.825 464.925 Virginia
154.54 Ohio South Dakota Busch Gardens Williamsburg
Minnesota Beach Waterpark Flintstones Bedrock City 334.4 463.225
Valleyfair! 463.9 468.9 151.805 464.175 468.225
463.4625 463.5125 Cedar Point Tennessee 469.175 806.0
463.8625 463.9125 151.685 154.515 Dollywood Paramount's Kings Dominion
463.9375 463.9625 461.3 463.6125 463 .525 463.575 461.4125 461 .975
463.9875 464.0375 463 .8625 464.2125 463 .8 463 .825 464.175 464.35
464 .9875 469 .0375 464.3125 464.375 463.925 464.025 464.475 464.925
Missouri 464.4125 464.5125 464.05 464.1 466.975 469.175
Ocean's of Fun 464.575 464 .6125 464 .675 464.7 469 .35 469.475
463.775 468 .75 466.3 468.8625 464.725 468.525 469.925
468.775 469.2125 469.3125 468 .575 468.8 Water Country USA
Silver Dollar City 469.4125 469.5125 468.925 469.025 464.525
151.685 151.835 469 .6125 469.05 Washington
151.865 152.3 Coney Island Libertyland Fun Forest
157.56 157.62 151.925 154.515 464 .775 464.825 461 .6625
463 .8125 465.0 154.54 154.57 464.925 Wisconsin
468 .8125 154.6 Texas Circle M Corral Family Fun
Six Flags Over Mid-America Geauga Lake AstroWorld Park
461.2125 462.1375 154.515 154.57 462 .1625 462 .1825 461.95 466.95
463.2125 464 .2625 Paramount's Kings Island 467.1625 467.1825 Circus World Museum
464.325 464.3875 154.54 154.57 462 .7 467.7 461.325 464.325
464.4125 464 .5125 154.6 461.1625 462.7875 461.4375 469.325
464 .6875 469.325 461.325 462.1375 463.4375 462.8125 Noah's Ark Waterpark
WhiteWater 462.7625 462 .8125 Fiesta Texas 154.57
461.0375 462 .8625 463.2625 461.1 461. 125 Thumb Fun Park
Worlds of Fun 463.5125 463.6625 461 .6125 461 .7625 151.715
THUD Volume 1 Issue 1 - Spring 1998 19
I H.9.ck E~-::ch.9.n'21e I
Are you looking for those difficult to find parts? Or maybe just a simple novelty item for your entertainment? Or do you have a
product or information you'd like to sell? The Hack Exchange is your buy/sellitrade resource . If you would like to place an ad
in Hack Exchange .... Right now, all classified advertisments are FREE of charge. We must limit each person/company to two
ads not more than 20 lines combined . Stay tuned for advertising rates in the future. To place an ad, send copy to the following
address:
THUD Magazine Advertising
P.O. Box 2521
Cypress, CA 90630
EPROMS COPIED We have an EPROM duplication service. AUCTIONS! You hear about them all the time, but you've
Give us your original and we can make as many copies as never been to one? You gotta GO to one. You can buy just
you'd like. We Specialize in older 2516, 2532, 2716, 2732, about anything for pennies on the dollar! Cars, trucks , boats,
2764, 27128, 27562 and 27512 EPROMs. We also do houses, electronic equipment, furniture , etc. Forget that "cars
Bi-Polar PROMs, as well. $6 per copy includes the copy for $100" crap. That's a load! But, you can get some pretty
service, the material (any of the part numbers mentioned awesome deals for small amounts of cash .. Our favorite
above) and return shipping. Bi-Polar PROMs may be slightly auctions (and many of the BL411 staff) include the arcade
more or less in cost. 15% discount on 10+ copies . 20% auctions and the car auctions. Remember those arcade
discount on 25+ copies . Send prepaid orders (with master games you played as a kid in the 80's? Man, you can get
copy) or inquiries to: TCE Information Systems , P.O. Box some bitchen deals on those! This is only the tip of the
5142, Los Alamitos, CA 90721 iceberg. There's SO MANY things you can get for a small
THUD MONTHLY MEETINGS We don't have any meetings fraction of their worth. Send $6 and we'll send you a booklet
for the magazine yet. If you're interested in setting one up in loaded with names, numbers and places to go...You NEED to
YOUR area, please contact us. For now , we suggest you do this! You'll find out how you can attend the non-advertised
hang out at the Blacklisted! 411 meetings until we can come auctions, which will mean better deals for you. Don't miss out
up with our own. THUD Magazine, P.O. Box 2521 , Cypress, on all the great deals! Send $5 right NOW: TCE Information
CA 90630 "Come one, come all, just don't be a FED" Systems, P.O. Box 5142, Los Alamitos, CA 90721.
BLACKLISTED! 411 Magazine From the same people who LOOKING FOR A BLACKLISTED! 411 MEETING IN YOUR
produce THUD is another magazine dedicated to hackers . If AREA? The Official Hackers Magazine is looking for a few
you like this magazine you will like Blacklisted! 411 . $5 good men to host meetings in your area! Would you like to
sample copy. Blacklisted! 411 Magazine, P.O. Box 2506, host one? It's easy. Tell us where you want it held and give
Cypress, CA 90630 us a contact name and number or email address. If you want
COIN-oP VIDEO ARCADE GAMES . Repairs, parts, boards , your free subscription, you'll need to provide an address, of
accessories, and empty cabinets available for all your video course. Think about starting a meeting yourself. Blacklisted!
game and pinball needs. Largest selection available in the 411 Magazine, P.O. Box 2506, Cypress, CA 90630
United States. Eldorado Games 911 S. East St. Anaheim, CA 6.500MHz or 6.5536MHz CRYSTALS Your choice. $4 each.
92805 or call (714) 535-3300 FAX (714) 535-3396 No shipping charges. Send to TCE Information Systems,
WEB SITES We have a list of hundreds of interesting and P.O. Box 5142, Los Alamitos, CA 90721
unusal web sites. Some of the sites are related to this ADVERTISE IN BLACKLISTED! 411 Reach thousands of
magazine and some are not. Hacking , phreaking , breaking readers in the US, Canada, Japan , the UK, Australia, and
the law, sovereign citizenship, lasers , electonics, surplus , elsewhere. Join our long list of satisfied clients who have
credit, etc.. You have to check this out! Save hundreds of made Blacklisted.411 their vehicle for reaching customers.
hours of time by getting our list. We will provide the list on Call 714-899-8853 and request our rate card information.
3-1/2" disk and you can load it directly into your web browser Blacklisted! 411 Magazine, P.O. Box 2506, Cypress. CA
and click on the links OR we can provide the list on paper - 90630
whichever you prefer. Send $5 to TCE Information Systems , ADULT VIDEOS. We have all the newest releases for $25.99
P.O. Box 5142, Los Alamitos, CA 90721 plus s/h or LESS. Get the latest titles, hottest names; Raquel
"TAKE BACK YOUR PRIVACY" Author and Speaker Bill Darian, Mrylin Star, Nikki Dial, Janine, etc. Amateur, all girls,
Hayes shows you how to stay cyber, yet stay private. Real etc. New titles every week. For latest prices, send SASE to:
world tips and examples to keep prying eyes and electrons E&M Adult Videos, P.O. Box 1471, Los Alamitos, CA 90720.
out of your life. Send $18.00 (I won't keep any records on you, "I'VE BEEN BLACKLISTED!" T-shirts now available.
your cash, address, or checking account) plus $2.50 SH to: Endorsed by the Blacklisted! 411 crew. Get yours now.
Bill Hayes, 12289 Pembroke Road, Suite 151, Hollywood, FL White lettering on black shirt. Available in large and extra
33025 or leave a message at (954) 537-3792. The privacy large sizes. $14.95 each shipped. Send to TCE Information
you preserve will be your own . .. Systems, P.O. Box 5142, Los Alamitos, CA 90721 .
"I LOVE TOXIC WASTE" T-SHIRTS Now available .Red on THUD MAGAZINE WANTS YOU! We're still really new, so
white. Available in Large and Extra Large . $16.95 each. TCE we're looking for a few things . If you're a hacker, artist, writer
Information Systems, P.O. Box 5142 , Los Alamitos, CA 90721 or all around freak, send us what ya got! We can offer free
ADVERTISE IN BLACKLISTED! 411 Reach thousands of subscriptions in exchange for articles or artwork we end up
hackers in the US, Canada, Japan, the UK, Australia , and printing. So, get off your butt and send us some good stuff to
elsewhere. Join our long list of satisfied clients who have print in the magazine . THUD Magazine, P.O. Box 2521,
made Blacklisted.411 their vehicle for reaching customers. Cypress, CA 90630 .
Blacklisted! 411 Advertis ing, P.O. Box 2506, Cypress, CA RUGA? If you know what this is, I have one thing to say:
90630 . Call 714-899-8853 and request our rate card Pobleet '87. WAX ANDERSON SHOKE MAYONASAL IT'S
information. ONLY RUBBER DUDE RAUL OBI WAN CENTOBI AJBV87
Volume 1 Issue 1 - Spring 1998 THUD
POLice CODes
Ten Codes: Horse; U)Pickup Animal 405-Citizens Holding Prisoner
1-Receving Poorly 97-Arrived at Scene 406-0fficer Needs Emergency Help
2-Receiving OK 98-Finished Last Assignment 407-Prisoner Transport
4-0K 408-Ambulance
5-Relay Eleven Codes: 409-Tow-Truck
7-Out of Service 24-Abandoned Vehicle 410-ResquestedAssistance Responding
8-1n Service 26-Abandoned Bicycle 415-Noise Complaint
9-Repeat 27-DOL Information 416-Citizen Standby
10-0ut of Service on Radio 28-Registration Information 417-Person Ringing Doorbells
12-Visitor/Officer Present 44-Coroner's Case 418-Fight or Dispute (No Weapons)
13-Weather/Road Conditions 54-Suspicious Vehicle 419-Fight or Disput (Weapons)
14-Escort 79-Accident Ambulance Enroute 420-Juvenile Disturbance
15-Station with Prisoner 80-Accident Injury 459-Burglary
16-Pickup 82-Accident Property Damage 470-Fraud
18-Equipment Check 83-Accident No Detail 476a-Fictitious Document
19-Return/Arrive at City Hall; (a)Pound; 84-Traffic Control 484-Petty Theft
(b)Corp Yard; (c)Park 85-Tow Car Needed 488-Petty Theft
Hdqtrs;(d)Airport 96a-Out for Investigation 496-Stolen Property Receiving
20-Location 98-Meet Officer 518-Vehicle Accident (No Injury)
21-Telephone Call 519-Vehicle Accident (Injury)
22-Cancel Codes: 520-Aided Case
23-Standby 1-Acknowledge Call 527-Bonfire
24-File Check PermiURecord 2-Urgent No Siren 528-Fire
25-00 You Have Contact 3-Emergency Siren 529-Explosion
27-DOL Information 4-No Added Support Needed 530-Bomb Threat
28-Registration 5-Stakeout 531-Suspected Explosive Device Found
29-Check for Wants 6-Want 585-Traffic Stop
30-Normal Radio Traffice 7-Out of Service 594-Malicious Mischief (Vandalism)
32-Drowning 10-Bomb Threat 595-Malicious Mischief (Grafitti)
33-Alarm Sounding 20-Assist Officer 596-Abandoned Vehicle
34-0pen Door 30-Emergency Traffic 600-Road block
35-Scramble Transmission 33-Clear Channel for Emergency 601-Tresspassers
36-Correct Time 602-Person Breaking In
37-Restricted Vehicle Code: 603-Prowler
39-Message Delivered 10851-Stolen Vehicle 647b-Prostitution
40-Available for Phone Call 10852-Tampering With Car 647f-Drunk
45-Ambulance Needed 10853-Malicious Mischief Vehicle 650-Threats
49-Proceed To 20001-Hit and Run (Felony) 799-Senile Person
50-Obtain Report 20002-Hit and Run (Misdemeanor) 800-Mentally Disturbed Person
53-Man Down 20007-Hit and Run (Parked Vehicle) 801-Person Attempting Suicide
54-Possible Dead Body 22500-lllegal Parking 802-Coroner's Case
56-Suicide 23101-Drunk Driver (Felony) 806-Juvenile Beyond Parental Control
57-Firearms Discharged 23102-Drunk Driver (Misdemeanor) 807-Missing Juvenile
60-Check Parking Meter 23103-Reckless Driver 809-Missing Person
62-Meet the Citizen 23109-Speed Contest 811-lntoxicated Person
65-Missing Person 23110-Throwing at Vehicle 819-Reolling of Intoxicated Person
66-Suspicious Persons 851-Stolen Vehicle
67-Person Called for Help Penal Code: 852-Auto BoosUStrip
68-Tree/Limb Down 148-Reisting Arrest 853-Recovered Stolen Vehicle
69-Wire Down 152-Drunk Driving 901-Call Station (or other location)
70-Prowler 187-Homicide 902-Return to Station
73-How do You Receive 207-Kidnapping 904-Meet with Officer
74-Check Road Conditions 211-Robbery 904-Fire
75-Check Hole in Road 212-Strongarm Robbery 905-Meet with City Employee
77-Check Barricade 213-Purse Snatch 909-Citizen Requests Interview
78-Check Water Condition 216-Shots Fired 910-Check on Well Being
79-Plugged Sewer 217-Shooting 911-Broken Window
80-Explosion 219-Stabbing 912-Person Dumping Rubbish
81-Broken Water Main 221-Person With Gun 913-Complaint Unknown
82-Leaking Hydrant 222-Person With Knife 914-Person Down
83-Signal Light Out or Malfunction 240-Assault and Battery 916-Suspicious Person in Vehicle
84-Street Light Out 245-Aggravated AssaultlADW 917-Suspicious Person
85-Make Inspection 261-Sexual AssaultlRape 918-Person Screaming for Help
86-Any Traffic 288-Lewd and Lascivious Conduct 980-Radioactive Support
91-Stray Animal; (a)Vicious Animal; 311-lndescent Exposure 5150-lnsane Person
(b)Noisy Animal; (c)lnjured Animal; 314-1ndescent Exposure
(d)Dead Animal;(e)Animal Bite;(f)Sick 400-Demonstration/Pickets
Animal;(g)Pickup Animal; (h)Stray 404-Riot
All power corrupts, but ~e nee~ electr~city. I,
THUD Volume 1 Issue 1 • Spring 1998 21
CIIL EDIT II a software review by: Solar Prophet
~~~~~~~~~~~~~~~~~~~~~~~~~x A" rig~ a" you phreakeffi, and anyone e~e ~ars
interested in generating tones. Cool Edit 96 is a
great little software package or the IBM PC that runs
under Windows 95 or NT. It's basically a very
sophisticated WAY file editor, with some extra perks.
There is a shareware version available which does
disable the use of a" functions simultaneously. If you
haven't registered it, a" functions are available but
when you launch the program you will be shown a
list of function sets and you are prompted to choose
two of them to work with. I found Cool Edit 96 on
www.slaughterhouse.com and they gave it a
maximum "five skull" rating. I think it really deserves
it.
Loading files is easy and accepts many formats. The
common file name extensions being .VOX, .VOC,
.WAV, and .PCM. Cool Edit can also save to these
formats as well.
Cool Edit has many capabilities. It allows you to load
In this picture you can see the main interface screen of Cool Edit 96. WAY files and perform various functions on them. A"
Here I have a 3 minute 16bit 44 .1KHz stereo WAY file of a song me WAY file bitrates are supported. It also handles
and a friend composed. As you can see from the icon bar there are mono and stereo. You can easily perform cut/pastel
tons of functions right at your fingertips (or is it mousetip?) that will trim functions just like you'd do to a picture using
allow you to do just about anything you want to the sample. If you want Photoshop. You can even stretch the wavefroms,
any more sophistication you might as we" get yourself a futl fledged adjust their amplitude, change the sampling rates,
digital studio package, but I find this software sufficient for my needs, add delay, flanging, echo, reverb and even reverse
even with the needs of a startup band. I have used Cool Edit as a first capability. You can even add distortion. Great for
"step
- in preparing to convert my music to mp3 format. --1 turning Bach into Metallica.
~~~~~~~~~~~~~~~~~~~~~~~~~One~~emoreadvanc~functions~~ea~Ry~
do a spectrum analysis on a waveform. This is great
for seeing what fundamental and harmonics there
are in a waveform. This can easily allow a user to
identify the important characteristics of a sound
sample and use that data to re-create the sound
diqitally using the built in tone generator.
The tone generator is the real beauty of this
program. It allows you to create tones in various
wave shapes. There's the customary sine, cosine,
sawtooth, triangle, and square wave patterns as we"
as a few more exotic variations on these forms. One
can take a fundamental and up to four harmonics.
The tones can be swept across the spectrum in a
controlled linear fashion or can be made to modulate
to a lower rate. It's real easy to create red box tones
using this program.
1~~~~~~~~~~~~~~~~~~~~~~~~~ A~ng
Here is a zoom into a portion of the WAY file. It's possible to zoom in to
utility, awRh~e ~ne genern~r ~ ano~er
DTMF tone generator. You won't have
painstakingly generate each number and space
them by hand. Using the DTMF generator you
handy
to
the point that individual samples show up as dots with an interpolated simply enter the number string to be created and set
waveform drawn inbetween. Clicking and draging on a sample allows a few parameters such as tone length, spacing, and
you to move it giving you the flexibility to edit bad samples to eliminate pause times. Press a button and voila, perfect DTMF
clipping from overdriving the input or to clean up pops and clicks. tones without even trying. If you want to genereate
~~~~~~~~~~~~~~~~~~~~~~~~--IDTMF~nM
b~ n~~~e ~a~a~ ~~~ndM
used by telephones, there are even boxes to allow
you to change the frequncies of each row or column on the keypad. Quite versatile.
The program is easy enough that in only 15 minutes I was able to create a small WAY file that had a dial tone, a few coins
being dropped, a phone number being dialed and then a 2600Hz tone. Playback via a Sound Blaster or similar card and
hooked up to the right recording equipment would lead to endless possibilies.
All in all Cool Edit 96 is a very easy program to use. The interface is standard Windows style and very intuitive; very easy to
learn . A definate must get for anyone who needs to manipulate WAY files and generate tones .
22 Volume 1 Issue 1 - Spring 1998 THUD
Here's a shot of the Tone Generator window. You
set the base frequency or fundamental first. If you
want harmonics (up to five) you set their amplitude
and value with the frequency component settings. In
this example I have two components selected, one
This is the spectral analysis of the waveform. The image is actually in 3.3 times and the other 4.4 times the fundamental of
a visually pleasing color gradient. Time is reperesented on the X axis 100 hertz. That means the generated tone will be a
from left to right. Frequency is represented on the Y axis with 0 hertz composite of 330 and 440 hertz. Other parameters
on the bottom and 22050 hertz at the top of each section. The top is the allow you to change the modulating rate and
left channel. The gradient represents the level of that freqency at that amplitude of the tone. You may also control phasing
moment in time. It's kinda like the spectrum analyzer on your stereo or which leads to a pleasing stereo effect. Under
equalizer, except that it adds the dimension of time to create a graph of "general " you may select the type of waveform to
the selected space. It's also much more accurate . You can change how use. Also note that there are two tabs, one for initial
detailed the analysis is and several other factors by changing the setting and one for final settings. This allows to to
setting under Options. To change between waveform and spectral view specify the start and end parameters of the tones
simply select the function under View in the main window menu bar. you are generating . The computer will linearly
~
~~~~~~~~~~~~~~~~~~~~~~~~~ l time
sweePspan
fromspecified
fue ~m~in~thefueduration
fin~ sett~gs ovffi fueis
box. There
also a section to program preset patterns, there are
fou r that come with the program.
This is the DTMF signal generating window. As can be seen I have selected a
famous number to call. There are setting to allow you to control the length of
each DTMF tone, the spacing inbetween, and the pause time . All standard
DTMF numbers can be generated (1234567890*#abcd,). I have selected
custom simply to allow you to see the boxes for changing the base frequencies
used to generate the tones . This will allow you to generate tones for non-
standard DTMF devices, such as security boxes, etc. You may also specify
presets of numbers in case you do lots of tone generating.
(Listed in MHz)
Frequency Channel Frequency Channel Frequency Channel Frequency Channel
35.20 P3-1 43.30 P4-5 931.0875 P9-4 931.5625 P9-23
35.22 P1 43.34 P4-6 931.1125 P9-5 931.5875 P9-24
35.24 P3-3 43.38 P4-7 931.1375 P9-6 931.6125 P9-25
35.30 P3-5 43.42 P4-8 931.1625 P9-7 931.6375 P9-26
35.34 P3-6 43.46 P4-9 931.1875 P9-8 931.6625 P9-27
35.38 P3-7 43.50 P4-10 931.2125 P9-9 931.6875 P9-28
35.42 P3-8 43.54 P4-11 931.2375 P9-10 931.7125 P9-29
35.46 P3-9 43.56 P4-12 931.2625 P9-11 931.7375 P9-30
35.50 P3-10 43.58 P4 931.2875 P9-12 931.7625 P9-31
35.54 P3-11 43.60 P4-14 931.3125 P9-13 931.7875 P9-32
35.56 P3-12 43.62 P4-15 931.3375 P9-14 931.8125 P9-33
35.58 P2 43.66 P4-16 931.3625 P9-15 931.8375 P9-34
35.60 P3-14 152.2 P5 931.3875 P9-16 931.8625 P9-35
35.62 P3-15 152.8 P1-2 931.4125 P9-17 931.8875 P9-36
35.66 P3-16 158.10 P1-3 931.4375 P9-18 931.9125 P9-37
43.20 P4-1 158.70 P6 931.4625 P9-19 931.9375 P9-38
43.22 P3 931.0125 P9-1 931.4875 P9-20 931.9625 P9-39
43.24 P4-3 931.0375 P9-2 931.5125 P9-21 931..9875 P9-40
43.26 P4-4 931.0625 P9-3 931.5375 P9-22
THUD Volume 1 Issue 1 - Spring 1998 23
STOPflING 'OWER METERS
Review by: Shiva
The Book:
Stopping Power Meters is a small booklet written by John J. Williams and El
Guapo. Don't let it's small size fool you however. I found the booklet to contain a
great deal of information on your typical power meter. I'm sure I'm not the only one
who wondered how they work ed and how they could be 'adjusted'. As it turn s out,
there's actually a multitude of designs, each working on a variation of the same
principle, all known as watthour meters, or more commonly, kilo-watthour mete rs.
The booklet starts out by first explaining exactly what the meter does and how it
works . "There is nothing magical, sacred or miraculous about watthour meters."
Even different manufactures of meters are discu ssed with explanations of their
differences .
After the theoretical background the
booklet goes on to describe what it
takes to calibrate a power meter,
going on to mention that even with
slight miscalibration the meter can
cause over or undercharging of the
customer. It is also noted the possible
outcomes of a customer complaining
about an inaccurate meter. There is
some discussion about how the
power company can track down
discrepancies in usage over time ,
Stopping Power Meters - The newest and how they usually find these to be
addition to a huge line up of in the ir favor (what else did you
educational hackers material expect?) and how much it could cost
available from Consumertronics, a YOU to have the 'problem' fixed. But
vete ran in the hacker community. not to worry folks, some example ' - - - - -- - - - -- - -- - - - - '
'-- ---' excuses are provided for your education.
Following up adjustments is the inaccuracy department. It's amazing just how
inaccurate these things can be! It also appears that they become more
unreliable as time goes by. Think about it, how old is the house you live in? I bet
it still has it's original power meter from way back then and has NEVER been
calibrated to insure accuracy. Of course, these errors are almost always in the
favor of the power company. It's almost as if it were by design that the meter fails
over time .
The booklet doesn't just spout off that the meters are in error, it backs up these
claims by explaining the causes of these inaccuracies. Meters , like any other
scientific instrument, need constant care in order to provide accurate
information. Explained are are several sources or conditions that over time will
cause the meter to slowly fail. It's quite detailed in some respects.
Now for the good part. The last half of the booklet discusses how to slow down, John Williams narrates the video, seen
or even stop a power meter from registering. Now, it should be noted that here holding the meter used for
tampering with a power meter is illegal. The demonstration.
booklet talks about this for several pages '---- - - -- - - - - - - - - - - '
explaining how the utility suspects and determines if the meter has been messed with. But
like anything else in this world , such tampering can be made very difficult to detect.
As for the actual methods of tampering, there's a lot more described between the covers
than I suspected. These methods are described in detail, even providing actual schematics
of the devices used. What more could you ----,----------.....,..--.,
want? Well, there's a little sections describing
some of the terminology used for the parts
you'll need. And speaking of parts, there's
even a section listing several electronics
suppliers that are good places to start looking
for the necessary components. Some books
are also listed for those wishing to learn more
about domestic electrical wiring.
The Video:
Also available is Stopping Power Meters : The
Video . This 20 minute video, narrated by John
J. Will iams himself, highlights the most Front of the meter showing braking
important basics that are discussed in the magnets. One of the adjustment screws
booklet. Covered are the internal mechan isms is being pointed out.
24 Volume 1 Issue 1 • Spring 1998 THUD
of meters , how the meter
actually measures the power
used, and how they are
accessed.
The video then goes on to
demonstrate a power meter in
action. The meter is hooked up
to a series of high powered light
bulbs to provide a load. Shown
is the speed at which the meter
runs. Hooked up to the test bed
is another product available
from Consumertronics, the
Stopping Power Meters
'--- ----' Educational Module. This is a
device built along one of the principles described in detail in the booklet. The meter is shown both with the SPMEM on and off
so one can readily see the effect of the module on the registration of the meter. It's quite a dramatic effect.
Also demonstrated is a method of slowing down the meter through the use of ordinary kitchen mag nets. It is also
demonstrated that the same magnets can also speed up the meter and how it is
important to use them correctly.
The video, combined with the booklet, provide an excellent educational tour on
the functionings of utility power meters found in most homes and small business.
You will also learn of their shortcomings and methods of fouling their abiiity to
register correctly .
About Consumertronics:
Consumertronics is the company who puts out Stopping Power Meters . They
offer "hundreds of books, manuals, software , hardware, and services that
primarily relate to computers, electronics, phones , energy, security, medical, and I-----------------~~
financial." The author, John Williams, was even interviewed on the CBS show 60 Closeup of the Stopping Power Meters
Minutes. For more information, look for the full page Consumertronics Educational Module (S.P.M .E.M.)
advertisement in this magazine. demonstrated in the video.
Note: This article appears in our sister publication, Blacklisted! 411 - Volume 5, Issue 1. For more information,
contact Blacklisted! 411 at P.O. Box 2506, Cypress, CA 90630.
THUD Volume 1 Issue 1 • Spring 1998 25
rr" r" r"" '("""r" -f!"" "r""1"1"1"1"1"1"-("
" " " " " " " r"': '. "1"1"
£'" ", 1'"",1'" r",. r""r"'; r"" r"('"r"
1"'-1'"
1'" Pyrotechnic 1'"
('" ChulTlicals ("
[" [" (" r' r' (" t" (" (" (" (" (" (" (" (" (" (" r r' (" [" r' (" (" r' (" (" r'
Within this booklet you will find descriptions of almost 150 of saft explosives.
chemicals that are used in fireworks, explosives, rocket fuels
or are explosive in themselves. This list is not complete and is Ammonium Perchlorate
not intended to be complete. All of the uses are not given and This chemical can be made to explode by either heat or
only the related purposes of each are stated. shock. Besides exploding in itself, it is used to manufacture
other explosives.
Whenever possible we explain which grades are thought to
be best, the chemical formula, melting temperature, Ammonium Permanganate
decomposition temperature, form (liquid, powder, crystal, A moderate explosive which can be detonated by either heat
etc.), if it will explode, if it is poisonous and its usage. Some of or shock.
these chemicals cannot be purchased and are offered as a
guide for information purposes only. Ammonium Picrate
These bright orange crystals are used in armor piercing shells
Chemicals have a certain purpose to perform in fireworks and and fireworks. If heated to 300 degrees it will explode or it can
can be classified into four groups. be set off by shock. If you do any work with this chemical, it is
advisable to keep it wet.
GROUP I
These chemicals are the chemicals which produce the Aniline Dyes
oxygen and are called oxidizers. These are used in smoke powder formulas. They are organic
coal tar derivatives. Available in many different colors.
GROUP II
Those which combine with the oxidizers are called reducers. Aniline Green
Also known as Malachite Green. One of the many aniline
GROUP III dyes. The green crystals are used in smoke formulas.
These are the chemicals which regulate the rate of burning
and help to produce the desired effect. Anthracene
A coal tar derivative used as a source of dyestuff and for
GROUP IV colored smokes. Available as colorless crystals which melt at
This group of chemicals are those which impart color to the 217 degrees.
flame.
Antimony
We believe that the information contained here-in is true and Another name for this metal element is Antimony Regulus.
correct, however it is offered only as a guide and not to be Purchase the black powder in a 99% purity. Not the yellow
used as a guarantee. We cannot assume responsibility nor variety. It is used in pyrotechnics .
liability for the use or misuse of the information contained
here-in. Antimony Fulminate
One of a group of unstable, explosive compounds related to
PLEASE NOTE: ALL REFERENCES TO TEMPERATURE Mercury Fulminate.
ARE IN DEGREES FAHRENHEIT .
Antimony Potassium Tartrate
Aluminum Also known under the name of tartar Emetic. These
An element used for brilliancy in the fine powder form. It can poisonous, transparent, odorless crystals (or white powder)
be purchased as a fine silvery or gray powder. All grades from are used to make Antimony Fulminate. The moisture that is
technical to superpure (99.9%) can be used. The danger is present can be driven off by heating to 100 degrees. Do not
from inhaling the dust and explosive room condition if too exceed this temperature or the chemical will decompose.
much dust goes into the air.
Antimony Sulfide
Aluminum Chloride This has a usefulness in sharpening the report of firecrackers,
This chemical must not come in contact with the skin, as salutes, etc. or to add color to a fire. The technical, black
severe burns can result. The yellowish-white crystals or powder is suitable. Avoid contact with the skin, dermatitis or
powder have a strong attraction for water. Purchase only in worse will be the result.
the anhydrous grade.
Aqua Regia
Amber A strong acid containing 1 part concentrated Nitric Acid and 3
This is a fossil resin of vegetable origin and is yellowish-brown parts concentrated Hydrochloric Acid. Store in a well closed
in color. It is used in fireworks to a small extent. glass bottle in a dark place. This acid will attack all metals,
including gold and platinum. It is used in making some
Ammonium Bichromate & Dichromate explosives.
A mild poison used in the manufacture of tabletop volcanoes
(sometimes called Vesuvius Fire). It is available as orange Arsenic Sulfide, Red
crystals in a technical grade. Also used in smoke formulas . The common name is Realgar and it is also known as Red
Arsenic. Purchase the technical grade, which is available as a
Ammonium Chloride poisonous orange-red powder. It is used in fireworks to impart
The common name is Sal Ammoniac. Comes as colorless color to the flame.
crystals or a white powder. The technical grade is used to
manufacture safety explosives and smokes. Arsenic Sulfide, Yellow
This chemical is just as poisonous as its red brother and is
Ammonium Oxalate also used in fireworks, somewhat. The common name is
This compound takes the form of colorless , poisonous, Kings Gold.
crystals. The technical grade is suitable for the manufacture
26 Volume 1 Issue 1 - Spring 1998 THUD
Arsenious Oxide Chrysoidine
A white, highly poisonous powder used in fireworks . It is also An organic dye available as a red-brown powder. It is used in
known as Arsenious Trioxide, Arsenic Oxide and Arsenous smoke formulas.
Acid. Its uses are very similar to Paris Green.
Clay
Asphaltum This can be purchased in the powdered form. It is used dry for
A black bituminous substance , best described as powdered chokes , nozzles and sealing firework cases . You can mix it
tar. with water to form a paste if so desired .
Auramine Hydrochloride Confectioners Sugar
Also known as Auramine. It is used in smoke formulas. Commonly called Powdered Sugar, it can be purchased as
Available as yellow flakes or powder, which readily dissolve in your local food store. The fineness is graded by the symbol
alcohol. XXXX. It is used in explosives.
Auramine Copper
A certified Biological stain used in smoke cartridges. As any pure metal used in fireworks, this must also be in a
powdered state. It is reddish in color, in fact, it is the only
Barium Carbonate element to be found in nature having that color .
This is a poisonous salt of Barium, which decomposes at a
fairly high temperature, 1300 degrees . It is available as a fine Copper Acetoarsenite
white powder in the technical grade. It is used in fireworks as The popular name for this is Paris Green. It is also called
a color imparter. Kings Green or Vienna Green . It is readily available as an
insecticide or as a technical grade, poisonous, emerald green
Barium Chlorate powder. It is used in fireworks to add color .
Available as white powder. It is poisonous , as are all Barium
salts . It is used in fireworks , both as an oxidizer and color Copper Arsenite
imparter. It is as powerful as Potassium Chlorate and should A fine, light green, poisonous powder. It is used in the
be handled with the same care. Melting point is 414 degrees. technical grade for fireworks .
Barium Nitrate Copper Carbonate
The uses and precautions are the same as above with a Also known as Cupric Carbonate or Artificial Malachite. It is a
comparison equal to Potassium Nitrate instead of the green powder used in fireworks.
Chlorate. It melts at 500 degrees.
Copper Chlorate
Bismuth Fulminate Or, technically Cupric Chlorate. A poison used in fireworks as
One of a group of unstable, explosive compounds derived an oxidizer and to add color.
from Fulmin ic Acid .
Copper Chloride
Brass An oxidizer and color imparter used in fireworks . Purchase
This is an alloy of Copper and Zinc. Some also contain a the brownish-yellow technical grade. This is a poisonous
small percentage of Tin. The commercial grade is suitable in compound.
a powdered form . It is used in some firework formulas.
Copper Nitrate
Calcium Carbide Or Cupric Nitrate, Cupric and Cuprous are many times
These grayish, irregular lumps are normally packed in interchangeable with the word Copper. These blue crystals
waterproof and airtight metal containers . It is used in toy absorb water, as you can see from the formula . It is used in
cannons . Mixed with water it forms Acetylene Gas . fireworks .
(EXPLOSIVE)
Copper Oxide
Calcium Carbonate When ordering be sure to specify the black powder . It is also
This occurs as the mineral Calcite . It is used for Phosphorus available in Red. The technical grade will serve the purpose
Torpedoes, but does not have any dangerous properties in for fireworks .
itself. Also as an acid absorber in fireworks.
Copper Oxychloride
Calcium Fluoride A green powder used to impart oxygen and color especially to
This finds its use in a smokeless firework mixture and is not blue star formulas. It is a poison and the dust should not be
used elsewhere. It is a white powder, also known as inhaled.
Fluorspar.
Copper Sulfate
Calcium Phosphide Known as Blue Vitroil, this poisonous compound is available
This compound , which comes as gray lumps, must be kept as blue crystals or blue powder. It can be purchased in some
dry. Upon contact with water it will form the flammable gas, drugstores. Used in fireworks for blue stars.
Phosphine. It is used in signal fires .
Copper Sulfide
Camphor As are the other Copper salts, this is also used in fireworks to
A ketone found in the wood of the Camphor tree, native to add color. The technical grade is suitable and is black in color.
Formosa and a few of our States. For the best results, buy the You can make your own, by passing Hydrogen Sulfide into a
granulated , technical grade. Used in explosives and Copper salt.
fireworks.
Decaborane
Castor Oil This chemical is classed as a flammable solid and is used for
The common drug store variety is used in some powders to rocket fuels . It will remain stable indefinitely at room
reduce the sensitiveness and to waterproof the mixture. temperature.
Charcoal Dextrin
A form of the element, Carbon, it is used in fireworks and This can be purchased as a white or yellow powder. It is a
explosives as a reducing agent. It can be purchased as a dust good cheap glue for binding cases and stars in fireworks .
on up to a coarse powder . The softwood variety is best and it
should be black, not brown.
THUD Volume 1 Issue 1 - Spring 1998 27
Diazoacetic Ester Glycerol
A very severe explosive in the form of a yellow oil. It will Commonly known as Glycer in. It is obtained from oils and fats
explode on contact with Sulfuric Acid or when heated . Very as a by-product when making soaps. It is a sweet warm
volatile and explosive. tasting syrupy liquid which is used in several explosives.
Contact with Chromium Trionide or Potassium Permanganate
Diazoaminobenzene may cause an explosion.
These golden yellow crystals will explode when heated to 150
degrees. Gold Explosive
A dark brown powder which explodes when heated or rubbed.
P-Diazobenzeneslfonic Acid Upon exploding, it yields Gold, Nitrogen and Ammonia. The
Another severe explosive. It can be exploded by rubbing the exact composition is unknown because it is too explosive to
white paste or powder, or by heating. be dried.
Diazodimitrophenol Guanidine Nitrate
An organic explosive in the same group as the above Guanidine is found in turnip juice, rice hulls and earthworms .
compound . Also very sensitive to shock or heat. It is used in the preparation of this chemical. Or, it can be
made from Ammonium Nitrate and Dicyanodiamide. To be of
Diazomethane any value, it should be 95% pure. Guanidine Nitrate is not
Also known as Azimethylene. This yellow gas is also in the explosive itself, but is used in the manufacture of explosives.
same group as above and can be exploded by heat or shock . It is a white powder which melts at 210 degrees .
Dinitrotoluene Gum Arabic
Known as DNT for short. These yellow crystals are used in A dried, gummy , exudate from tropical trees . It is available as
the manufacture of other explosives. flakes, fragments and powder. It is used as a binder in
firework formulas .
Ethyl Alcohol
This alcohol is the only one that is useful for fireworks . It Hexachloroethane
should be about 95% pure. It is poisonous because of the Also known as Carbon Hexachloride , this chemica l is used in
impurities. It is clear, like wate r and also a very flammable smoke formulas . It can be obtained in either powder or
liquid. crysta ls.
Fluorine Perchlorate Indigo
A very sensitive colorless gas which will explode on the A dark blue crystalline powder which is a commercial dye.
slightest contact with a rough surface. It can also be You can purchase either the technical or pure grade for
detonated by heating to 168 degrees. Avoid all contact with smokes .
this gas , even a trace of it will attack the lungs.
Iodine
Gallic Acid Heavy grayish metallic looking crystals or flakes . Poisonous.
A white or pale fawn colored powder used in fireworks to Purchase the U.S.P. grade . It is being used in making
make whistles. When mixed with some Chlorates, explosives .
Permanganates or Silver salts, it may explode.
We've got both 6.500Mhz and 6.5536Mhz crystals.
We know you may want one or the other
Opens up all Nintendo game units and cartridges!
depending on yo ur part ic ul ar project.
3.8mm typically fits the cartridges.
4.5mm typically fits the game units . $4 each including shipping.
We sell just about any screwdriver bit you're looking fo r. We have the hard to find bi ts like security Torx (also known
as tamper Torx), Scrulox (security Scrulox), Spanner, Internal and External Line Head (like the Nintendo bits above),
Tri-wing, Security Hex, Spline and Pozi Drive. Most bits are $12-$15 each .
Our best selling 30 piece screwdriver bit set is now available lor ~40 including shipping to anpthere in the U.S. The setincludes
9 security Torx bits hom 1T7 through TT40, 1 security Hex bits hom 5164" through 1/4", 4 security Scrulox bits from S-o
through S-3,8 standard pieces, covered ~astic case wI a nice handle lor all of the bits. This is an extremely handy toolsetl
6.50Mhz Crystals EPROM Programming Unusal web site listing Tool bits(includingsecurity)
6.5536Mhz Crystals Auction Booklet T-shirts other interesting stuff....
rtJ FIIID OUT MORE ABOUT AllY S1IECIFIC nlODUCT WE IM~ PLEASE CHECK OUT 01/1 ADS III THE
ClASSIFIED SECTION OFTHIS MAGAZINE.
TCE Information Systems
P.O. Box 5142
Los Alamitos, CA 90720
28 Volume 1 Issue 1 - Spring 1998 THUD
Iron Mercuric Oxcyanide
The granular powder (at least 99% pure) is needed for several In the pure state it is a violent poison which will explode when
firework pieces. It is not a dangerous element, but will rust touched by flame or friction.
very easily , making it useless.
Mercuric Thiocyanate
Iron Oxide A poisonous, white odorless powder used in the making of
These black crystals are used in thermite mixtures. When Pharoah's Serpents. Use the technical grade .
ordering, it may be listed as Ferrous Oxide. Black .
Mercurous Chloride
Kieselguhr Also known as Calomel or Mercury Monochloride. This white,
This is a whitish powder used in dynamites. It is a siliceous non-poisonous powder will brighten an otherwise dull colored
earth, consisting mainly of diatoms. A good grade will absorb mixture. Sometimes it is replaced by PVC or
about four times its own weight. Hexachlorobenzene and even Antimony Sulfide, for the same
purpose . Note that it is non-poisonous only when it is 100%
Lactose PUR E. Never confuse this chemical with Mercuric Chloride,
Also called milk sugar . This white powder has a sweet taste. which is poisonous in any form .
The crude grade will do for smoke formulas.
Mercury Fulminate
Lampblack A crystalline compound used in primers, percussion caps ,
This is another form of the element, carbon. It is a finely blasting caps and other detonators. Explodes very easily from
powdered black dust, resulting from the burning of crude oils . heat or shock .
It is used for special effects in fireworks .
Methylene Blue
Lead Azide This dark green powder is used for smokes in the technical
This is a poisonous white powder which explodes by heating grade. Also called Methylth ionine Chloride.
to 350 degrees or by concussion. The main usage is in
primers . It can be made from Sodium Azide and Lead Nitrate. Mineral Jelly
Also known as Vaseline, Petrolatum or Petroleum-Jelly. This
Lead Bromate acts as a stabili- zer in fireworks and explosives .
Poisonous, colorless crystals . Pure Lead Bromate is not
explosive unless it is made from precipitated Lead Acetate Naphthalene
with an alkali bromate . Made in this manner, it can be This is a tar product that you may know better as Moth Flakes.
exploded by rubbing or striking . Only the 100% PURE form should be used in making smoke
powders . The melt ing point is 100 degrees .
Lead Chloride
It is available as a wh ite crystalline, poisonous powder which Nitric Acid
melts at 501 degrees. It is used in fireworks . Also known as Aqua Fortis. It is a clear, colorless, corrosive
liquid, which fumes in moist air. It can react violently with
Lead Dioxide organic matter such as: Charcoal, Alcohol or Turpentine and
Also known as Brown Lead Oxide, this dark brown powder is consequently must be handled very carefully. It is available in
used as an oxidizor in matches and fireworks . Poisonous . three forms : White Fuming , Red Fuming and Concentrated
(70 to 71%). The latter, with a specific gravity of 1.42, is the
Lead Nitrate proper grade to buy. Whatever grade, avoid contact with the
Available as white or colorless crystals is the technical grade . fumes or the liquid . Contact with the skin will cause it to burn
The uses include matches and explos ives. Poisonous . and turn yellow . It is used to manufacture many explosives .
Lead Oxide Nitroglycerin
Also known as Red Lead or Lead Totraoxide . A 95% purity is A liquid with a sweet burning taste but do not taste it or it will
desired for matches . Also poisonous . produce a violent headache or acute poisoning. It can be
made to explode by rapid heating of percussion. It is used as
Linseed Oil an explosive and also to make other explosives .
Available in many forms: Brown , boiled, raw and refined. All
are made from the seed of the flax plant. The cheapest form Nitroguanidine
is suitable for fireworks. Purchase from a paint store . A yellow solid make by dissolving Fuanidine in concentrated
Sulfuric Acid and then diluting with water. Dangerous
Lithium Chloride Explosive.
The technical grade is sometimes used to add color to
fireworks compositions. Available as a white powder. Nitromethane
An oily, poisonous liquid, which is used as rocket fuel.
Manganese Dioxide
Used in pyrotechnic mixtures, matches and match box friction Oil of Spike
surfaces. Available as a technical grade, black powder. This This is a volatile oil obtained from the leaves of certain trees.
oxidizer decomposes at 535 degrees . Keep this colorless (or pale yellow) liquid well closed and
away from light. It is used in some fireworks. •
Magnesium
This metal is used in a powdered state for brilliancy in flares Paraffin
and will even burn vigorously underwater. This is a white or transparent wax. It is normally sold in a solid
block. You can use a file to make the required powder.
Mercuric Chloride
A white, poisonous powder. Also known as Corrosive Paranitroaniline Red
Sublimate. It can be made by subliming Mercuric Sulfate with A dye used in smoke formulas. It dissolves in alcohol and will
ordinary table salt and then purified by recrystallization. The melt at 139 degrees. It is also known as p-Aminophenyl.
U.S.P. grade is used for some firework compositions.
Mercuric Oxide Pentaerythrityl Tetranitrate
Available in two forms- red and yellow. Both forms give the A high explosive known at PRTN. Besides being an explosive
same oxidizing effects in fireworks. The technical grade is itself it is used in a detonating fuse called Irimacord.
suitable. All forms are Poisonous.
THUD Volume 1 Issue 1 - Spring 1998 29
Perchloryl Fluoride Potassium Ferrocyanide
A gas under normal air pressure. When brought in contact Lemon yellow crystals or powder which will decompose at
with alcohol, explosions have resulted. high temperatures . It is used in the manufacture of
explosives.
Phosphorus
This element comes in three forms, with three different ways Potassium Nitrate
of reacting . They resemble each other in name only . Red Commonly called Saltpeter; this chemical is an oxidizer which
Phosphorus is the only suitable form for fireworks and decomposes at 400 degrees . It is well known as a component
matches . It is a non- poisonous violet-red powder. It will ignite of gunpowder and is also used in other firework pieces.
at 260 degrees. When making a formula containing Available as a white powder.
Phosphorus, be sure to work with it in a wet state. This is a
most dangerous chemical to work with and should be handled Potassium Perchlorate
by the most experienced . Oxidizers have been known to Much more stable than its Chlorate brother, this chemical is a
detonate violently without warning when mixed with Red white or slightly pink powder . It can often substitute for
Phosphorus. Potassium Chlorate to make the formula safer. It will not yield
its oxygen as easily, but to make up for this, it gives off more
Phosphorus Pentasulfide oxygen . It is also poisonous .
Also known as Phosphoric Sulfide. These light yellow crystals
are used in matches . Potassium Picrate
A salt of Picric Acid, this chemical comes in yellow, reddish or
Phosphorus Trisulfide greenish crystals. It will explode when struck or heated. It is
This chemical can catch fire from the moisture that is present used in fireworks.
in air, therefore the container should be kept tightly capped .
The technical grade, purchased as grayish-yellow masses, is Potassium Thiocyanate
used in making matches. Colorless or white crystals which are used to make the
Pharaoh's Serpent. The commercial grade or pure grade is
Picric Acid suitable.
This is used to bring out and improve the tone of colors in
various fireworks. It is also used to make other chemicals that n-Propyl Nitrite
are used in fireworks and explosives. Picric Acid can explode Prepared from Silver Nitrate and n-Propyl Bromide and is
from heat or shock. It is interesting to note what it is called in used as a jet propellant.
other countries. Britain : Lyddite; France: Melinite ; Japan:
Shimo- Red Gum
se. Rosin similar to Shellac and can often replace it in many
fireworks formulas. Red Gum is obtained from the barks of
Plaster of Paris trees.
This is a white powder, composed mostly of Calcium Sulfate.
It is used, by mixing with water , for end plugs in fireworks and Rhodamine B
also in some of the formulas. A basic red fluo rescent or ganic pigment also known as
Rhodamine Red. Available in green or red crystals or powder.
Potassium It is used in smoke formulas.
A soft silvery metal element. It will react vigorously with water
and several acids . It is not used directly except for some Shellac
experiments. An organic rosin made from the secretion of insects which live
in India. The exact effect it produces in fireworks is not
Potassium Chlorate obtainable from other gums. The common mixture os Shellac
This, perhaps, is the most widely used chemical in fireworks . and Alcohol sold in hardware stores should be avoided .
Before it was known, mixtures were never spectacular in Purchase the powdered variety, which is orange in color.
performance. It opened the door to what fireworks are today.
It is a poisonous, white powder that is used as an oxidizer . Silver Fulminate
Never ram a mixture containing Potassium Chlorate . Do not A crystalline salt simila r to Mercury Fulm inate but more
store mixtures which contain this chemical for any great sensitive. In fact, too sensitive for commercial blasting. It is
length of time, as they may explode spontaneously. used for toy torpedoes and poppers .
Silver Oxide
Potassium Dichromate Dark brown, odorless powder . It is potentially explosive and
Also known as Potassium Bichromate . The commercial grade becomes increasingly more so with time. Keep away from
is used in fireworks and matches . The bright orange crystals Ammonia and combustible solvents . The technical grade ,
are poisonous . Also used in smokes. which is about 92% Silver, is suitable.
30 Volume 1 Issue 1 - Spring 1998 THUD
Sodium Aluminum Floride Strontium Chloride
Also known as the mineral, Cryolite . It is used in fireworks in A colorless or white granulated chemical used in
the white powdered form. pyrotechnics. It will absorb water and is not used often.
Sodium Bicarbonate Strontium Nitrate
When a formula calls for this chemical, you can use Baking By far the most common chemica l used to produce red in
Soda (NOT Baking Powder). It is a white, non poisonous flares , stars and fires. Available in the technical powder
powder . grade. An oxidizer with 45% oxygen and absorbs H20.
Sodium Carbonate Strontium Sulfate
This white powder is used in fireworks, but not to any great This does not absorb water as quick as nitrate and is used
extent. The anhydrous grade is best. when storage is necessary. In its natural state it is known as
Celestine, which compares to grades used in fireworks.
Sodium Chlorate
An oxidizer similar to Potassium Chlorate, although not as Sulfur
powerful and also with the disadvantage of absorbing water. For an example type II burns as 250 degrees giving off
Decomposes at 325 deqrees. chok ing fumes. Purchase good pyro grades low in acid. Used
in many types of fireworks and explosives.
Sodium Chloride
This is used in fireworks . You can use the common form, Sulfuric Acid
table salt (or rock salt if made into a powder) . Also called oil of Vitriol, it is a clear liquid with the consistency
of thin syrup. Bottles should be kept tightly closed as it is a
Sodium Nitrate very corrosive and dangerous chemical. It has a great affinity
Also known as Chile Saltpeter; very similar to Saltpeter for water and will absorb it from any source. The effect can be
(Potassium Nitrate). a charred surface or fire . The grade used in explosives is
It is used where large amounts of powder are needed in 93-98% .
fireworks and explosives. It will absorb water as do other
sodium salts. Sulfur Trioxide
This powder will combine with water with explosive violence
Sodium Oxalate to form Sulfuric Acid. If brought in contact with wood flour and
This is not a strong poison but is poisonous, and you should a drop of water is added, a fire willstart . It is used to make
not come in contact with it or breathe the dust for any some explosives.
prolonged period. The technical grade is best for making
yellow fires. Trinitrotoluene
Commonly known as TNT . The poisonous crystals are
colorless in the pure state . It is more powerful and expensive
Sodium Perchlorate than Dynamite. If not confined it will burn like dynamite. Used
This chemical is used in fireworks and explosives . It is very as a high explosive and to make others .
similar to Potassium Perchlorate with the exception that it will
absorb water. Wood Flour
This is merely another name for Sawdust or Wood Meal. It is
Sodium Peroxide used in fireworks and explosives.
A yellowish-white powder. It can explode or ignite in contact
with organic substances . Zinc
Of all the forms, only the dust is suitab le in the technical or
Sodium Picrate high purity grade. It is a gray powder used in star mixtures
Very similar to Potassium Picrate and should be handled with and for fuel in model rockets .
the same precautions . It is also known under the name of
Sodium Trinitrophenolate . Zinc Borate
A white amorphous powder used in making smoke formulas .
Sodium Silicate A relatively safe compound to handle.
This chemical, commonly called water glass, is used as a
fireproof glue. It is available in syrupy solution and can be Zinc Carbonate
thinned with water if necessary. When dry it resembles glass, Another white Zinc compound used in some smoke formulas.
hence the name. It can when desired be thickened with Also a safe compound to handle.
calcium carbonate, zinc oxide, powdered silica , or fibre glass
(chopped) if extra strength is desired. Zinc Oxide
Sometimes called Flowe rs of Zinc . This is a white or yellowish
Stearin powder used in some fireworks formulas . It has also found
Colorless, odorless, tasteless , soapy crystal or powder. use as a thickening agent in water glass when a stronger pyro
Sometimes referred to as Stearic Acid , purchase the technical paste is desired.
grade, powder. It can often take the place of Sulfur and
Charcoal in fireworks .
11I11111111111111r1
Strontium Carbonate
Known in the natural state as Strontianite, this chemical is
used for adding a red color to fires . It comes as a white
powder in a pure, technical or natural state .
, 0 FE '''ER lOUR L
'ACKERS PHREA/(ING S/(AMl GLOBAL CONTACTS PIRATE RAJ) 0
HIGHS ET EROTICA ELECTRON/I( CHOONZ SEI(URITY
UTUR LIFESTYLES
P.o. Box 1905, Boulder, CO 80306-1905 USA
THUD Volume 1 Issue 1 - Spring 1998 31
CABLE TEST llIP FA
PROVIDED BY TELECODE
PRE-INSTALLATION
You are about to install a test device in a cable descrambler. There are several things you should be aware of before you open the package
containing the chip or board. Once installed, you own the chip or board . Any damage done to the box or test chiplboard is your
responsibility. DO NOT install this chip or board in a box not owned by you unless you have permission from the owner of the box. I I'
using the box with a test chip installed, it is the responsibility of the user to notify and get written permission fron the cable company
supplying programming to the cable box or descrambler.
HOW THEY WORK
There is no magic involved with these chips or boards. They work by telling the microprocessor that all channels the box is normally
capable of receiving are OK to "tum on". This DOES NOT necessarily mean that the chip or board, once installed, will "get all channels.
It mayor may not. These are "test" devices, NOT theft devices. There does NOT exist a chip or board to GET all channels for free .
Programming MUST enter the box to be seen . Test chips or boards only "enable signals" that are there for testing box.
It mayor may not be able to test all channels, depending upon the installation by your cable company of any extra "traps and filters".
Please re-read the preceding until you understand this basic point. Once installed, ALL channels that the box is "capable of receiving" are
"turned on" enable testing of individual channels of the descrambler. If you intend to view programming on continued basis, you must pay
for the programming you watch.
BEGIN TESTING
After installation, begin testing. All channels that you previously received prior to the installation of the test chip or board should be
viewable. If you then tune to a premium channel, such as HBO, which was NOT previously watchable, and it DOES NOT COME IN
CLEARLY or AT ALL, the test board or chip is MOST LIKE LY still working properly. The reason that the descrambler is NOT
displaying the channel is most likely due to the cable company having installed a "trap" on the cahle line servicing this descrambler. The
"trap" has removed the HBO channel from the cable.
NO signal = NO picture.
The signal for HBO not being there means it cannot be displayed by the descramhler. The descrambler before the test chip was installed
could not tune the channel. Now it can, but the channel is "missing" due to the "trap ". This is common in some areas and not in others. It
costs money to have an employee of the cable company come out and remove or re-install the trap each time you wish to view a PPY event
or add Premium channels. So, the cable companies have mostly gone to addressable descramblers. Each addressable descrambler box has
a unique electronic serial number (ESN) that can be "spoken to" by the cable company (CACO), or "head -end" as it is called.
Authorization is done electronically by telling a specific ESN, what channels are authorized.
IT WORKED FOR A WHILE .. .
Installation of test chip or boards may enable all channels, including PPY and other Premium channels, but only for a short time . In these
cases, Electronic Countermeasures (ECM) have most likely been sent from the headend to ALL boxes . Only those boxes WITH test chip
or boards installed permanently will be affected. Click here for Starcom Diagnostic Codes. ECM signals are typically sent just before and
during a PPY event, and at regular or non-regular intervals during other times . The ECM instructions "confuse" the box and it may shut-off
some or all of its programming. ECM sometimes "kills" authorized boxes, also . Unplugging the box for 10 minutes and then plugging
again may reset the box back to normal until the next ECM hit. If you have an authorized box and the programming disappears without
reason, call the cable company and asked that the box be "re-initialized" or sent a "hit".
ECM
ECM can be "controlled" by installing a filter to trap out the ECM signal, which is usually transmitted as a I 06MHZ carrierwave "on top"
of the regular programming. These traps are known collectively as "Bullet Busters". Bullet Busters are specific to the frequency of the
transmitted ECM signal, so they usually arc adjustable . Follow the installation instructions for the particular Bullet Buster you are using.
WARNING
Installation of a test chip or test board does NOT MEAN you can watch channels that you have NOT PAID for. Use of the test chip or
board is legally limited to testing descramblers and viewing channels that have been paid for but are otherwise not viewable. One
example could be where a second box has been installed, with a test chip, in a house that has paid for cable programming and the cable
company is unable to authorize the second box. Another example is where the descrambler, because of some electrical fault, is incapable
of displaying channels that have been paid for.
Boxes with test chips will display all programming input to it, but you are legally only authorized to view programming you have paid for.
If you have any doubt as to whether or not you would be breaking the law in you community, we suggest that you consult an attorney for
legal adv!ce before installing or testing any channels.
DISCLAIMER
The sale(s) of all test chips or boards are made with the understanding that the user of these device(s) will comply with all laws, both State
and Federal. If in doubt, consult an attorney prior to use.
TROUBLESHOOTING TIPS
1. The most common cause of test device not functioning properly is from poor soldering or a bad connection during installation. Inspect
connections before applying power to the unit. Solder connections should be shiny and smooth. If connections are dull and/or rough, it
could be a "cold solder joint".
2. The second most common cause of test device not functioning, is that the device is not installed in accordance with the instructions
supplied. Some test chips do not align pin 1 of test device with pin I of unit under test (Zenith ZF-I). Follow instructions "...to the letter".
Be careful not to bend pins under chip when installing.
3. If installing the test device "piggyback" onto another chip, make sure that the pins of the test device are in contact with that of the "host"
chip. Clean pins of host IC and solder on a socket first. Then plug the test chip into the socket.
CONTINUED ON PAGE 49
32 Volume 1 Issue 1 - Spring 1998 THUD
@@)~0~~~U1lJU1®[K]~@0
2430 JUAN TABO, HE #259, ABQ, NM 87112 1IIII-06l ~ ....
P.O. Box 23097, ABQ, NM 87192
IP!'I\I _
Voice: 505-237-2073 (9-6,M-F)
Fax: 505-292-4078 (all hours, orders only)
www.tsc-global.com
Add $5 total S/H (US, Canada)
10% Offorders $100+ CATALOG is$3 w/ order / $1 w/ 0
Postal MO is fastest VISA, MCOK COD,add $7
Sold for educational purRoses only
See CATALOG for all Policies
How cellphones operate and
are modified . Vulnerabilities . . .
to hack attack and coun- I Pager Ma~ual VOIC~ 1\lall Hack. I The Hacker ~I1es
termeasures. Comprehen- Net Tr acking & Tracing Hack. Answer. Machines
sive info 0 reprogrammin~ NAMs Net Cons & Scams ComputerPhreak. ~ons&Scams
In. ' Stealth Technolog I Iron Gonads Crypto Techs
ESNs, ~tc. (cloning), control ata formats, Polygraph Defeats High Volt. Devices I Secret IDs
computIng encoded MINs, ESNs,.SIDHs, op- Mind Cantrall Under Attack! I Rocket's Red Glare
er~tIng sys~ems, PROMs and their program- Casino Hacking I S,e
, cret & Survival Radio I Ultimate
mIng,. forcing f\CK, test mode an.d resets, Success Man.,~~J.lJhL:~n Order of the Magnitude
:~adm~~~~~:lC~ll~:~~:s~r:~:~r~~~n;~~~~A· · · · · ··· · · ;:;;: ?iiiill liiiIi B=-:qM~ucl:llhpm.orl'eraq!"~FIJ.q'"
e ui ment sources. Much more! 9. ' ,
ClJ
The absolute latest tricks and
methods being used on the Net
to pirate software and crack
passwords. Internet security, ~~ot":4.~ ...
How to Avoid Getting ~
Caught, To:p- 20 Hacking Sites, Anony-
mous FTP, Defeating Copy Protection, Using
Net News rou s. Much, much more! $29.
THUD Volume 1 Issue 1 - Spring 1998 33
Pirate Radio Trials And Tribulations
In November, three Tampa Bay, Florida residents got rude wake up calls from raiding parties involving SWAT teams, Federal Marshals,
local police, customs agents, and a CIA agent. They were all led by agents from the FCC. The raids, conducted against, Arthur Kobres,
Kelly Benjamin, and Doug Brewer were a successful attempt to shut down three area unlicensed micro-power FM broadcasters. They've
succeeded for the time being.
Arthur Kobres, who operates 'Lutz Community Radio' and transmits on 96.7 FM was charged in a l4-count federal indictment for
operating a radio without a license. He was eventually released on a $25,000 bond . Kelly Benjamin operates '87X' on 87 .9 FM in
Seminole Heights. Known on the air as Kelly Kombat, he was also arrested on state charges of possessing marijuana and other drug
paraphernalia. He was later released on a $1,000 bond .
Doug Brewer, operating 102.1 FM's 'The Party Pirate' says some of the equipment seized from his home belonged to other groups, such as
the Temple Terrace Golf & Country Club and was nothing more than ham radio repeater equipment unrelated to any 'pirate radio'
broadcasting equipment. A 150 foot broadcasting tower was also dismantled. Brewer has been in trouble with the FCC before. He refused
to pay a $1000 FCC fine and even taunted the FCC on and off the air. A web page even shows FCC agents outside his home measuring his
broadcast strength.
Ralph Barlow, head of the FCC in Tampa had no comment but a Wall Street Journal article on Brewer quotes Barlow as saying "Sooner or
later I'll nail him." Drew Rashbaurn , VP and owner of several legal Tampa area radio stations had filed a complaint with the FCC about
102.1's 'The Party Pirate' about a year before claiming it's proximity to his station 102.5 was confusing listeners. Although Rashbaum
doubts this will stop pirate broadcasters he says "to some degree, it makes the airwaves safer to listen to."
This rash of raids come son the heals of a California Federal Judge Claudia Wilken's ruling that refused to grant the FCC a permanent
injunction to shut down Free Radio Berkeley. The ruling also questioned the FCC's involvement in violating the constitutional rights of
citizens.
Richard Edmondson, speaking for SF Liberation Radio had strong words to say in regards to the matter. "The raid against Doug brewe and
other microbroadcasters in Florida, coming as it has just a week after the Federal Court Ruling in California, is a display of lawless
thuggery which demonstrates to me more clearly than ever that the US Government does not care about its own courts, its own laws, or its
own Constitution."
In response to the raids there have been several organized demonstrations against Federal Buildings and the FCC. In San Marcos protestors
showed up to the only Federal building in town, the Post Office. The peaceful protest was decorated with signs saying "Free the Tampa 3",
"Micro Radio is not a crime", and "FCC: Obey Judge Wilken". Most citizens who say the protest were friendly and curious. Some were
even shocked to learn about the victims civil rights being violated by our government once again.
In another protest a lone man showed up to the FCC office in the LA area to hand out flyers protesting the raids. Several security guards
tried to force the man to leave but he was well armed saying that he had a right to be on the property because it was a public agency
conducting public business. The guards had tried to convince him it was private property.
One of the many complaints towards the FCC from microbroadcasters is that they couldn't get licenses when they applied to the FCC. It
appears the FCC simply won't grant a license to anyone unless it's a big money mongering corporation. But not to fear, there are already
several legal actions in progress which could change all this in the future.
Minor Threat's letter to the media
DATE: July 9, 1997
FROM: Chris Lamprecht (mthreat@paranoia.com)
TO: All interested journalists
SUBJ: Lamprecht challenges Internet ban on First Amendment grounds
Dear Journalist:
On May 5, 1995, I was sentenced to 70 months in federal prison. The judge ordered that upon my release I shall not use the "Internet or
any other computer network." I became the first person to be banned from the Internet. Additionally, the judge prohibited me from getting
ajob as a computer programmer (my hobby since age 9, and my career throughout high school and college). If! violate these conditions I
could be sent back to prison .
Although hacking was a "hobby" of mine for several years, I have never had a criminal charge for hacking, and my current crime has
nothing to do with computer programming or the Internet. I admit that I have committed undisputed crimes involving theft and sale of
telephone equipment (stolen from Southwestern Bell Telephone). And for this I will spend five years in prison as punishment. But banning
me from the Internet and from programming computers when I am released from prison is unjust and will not help foster my rehabilitation
into society.
So on April 22, 1997, I filed a Federal habeas corpus petition challenging my Internet ban on First Amendment (and other) grounds. I
claimed that banning me from the Internet is a Free Speech violation in light of recent cases dealing with the Communications Decency
Act (CDA), ACLU v. Reno, currently in the Supreme Court. The government has been ordered to respond to my petition by July 11, 1997.
If! do not win in the district court, I will appeal to the U.S. Court of Appeals and, if necessary, to the United States Supreme Court.
I am writing this letter for this reason: Attorney George Lasko recently contacted me, and will be helping me fight my computer
restrictions pro bono . However, we want to publicize what the government is doing with this absurd "Internet ban" restriction as a Free
Speech violation.
34 Volume 1 Issue 1 • Spring 1998 THUD
While I may be the first person banned from the 'Net, I won't be the last. Recently, I learned through the Freedom of Information Act that
the U.S. Department of Justice and the Parole Commission plan to add restrictions to ban parolees from the Internet and to prohibit
parolees from using or possessing encryption software (like PGP, or even PKZIP , since it has an option to encrypt) .
My story has been covered in magazines such as Texas Monthly (January 1996), Internet Underground (December 1996), SWING (March
1997), and on three television shows: TV.COM (CBS), Extra (ABC), and the KVUE-24 local Austin news. But the media attention so far
hasn't been focused on the legal implications of an Internet ban on one's right to Free Speech on any medium, including the Internet.
If you are interested in helping , or want more information, please visit www.paranoia.conv--mthreat/ on the Web. To contact me in prison ,
mail me at this address:
Christopher Lamprecht
#61153-080, Houston Unit, PO Box 1010, Bastrop, TX 78602-1010
Thank you for taking the time to read this.
Real Time Face Recognition Software
Facelt DB is a new program from Visionics that allows real time scanning of video images of peoples faces that can be compared to a large
data base giving a match within minutes. The software can search live video images or static images, even scanning multitudes of faces in
a single frame for matches.
Facelt uses Local Feature Analysis (LF A) that breaks up a face into local features making it possible to map an individuals face into a
computer database . The program compares the target picture with those stored in its database and presents to the operator a a list of the top
matches . The operator can then quickly scan for themselves the possible matches in order to confirm the actual identity.
The software can work even when the head is turned up to 35 degrees , can compensate for lighting, skin color, glasses, facial hair, facial
expressions, and even compensate for natural aging. The software runs on a standard PC in either 95 or NT environments and can use
standard file formats such as JPEG or TIFF . Once an image is scanned the program can store enough information for over a million images
on a typical multi -gigabyte hard drive.
Uses for the software are wide ranging. Several examples given are the uses of identifying of terrorists in airports , snagging of shoplifters
in stores, and searching for missing or exploited children by scanning the multitudes of pictures on the Internet.
This author fears the use of such programs, not that I have fear of being caught for any crime. It could readily be used to keep track of a
persons where-abouts. Already in my city , and in hundreds of cities nationwide, cameras are being installed in public locations for uses
unknown. There are many intersections in my area that have cameras on each of the four signal poles. That's four cameras in one
intersection!' Face recognition software linked to such cameras could be used for tracking a person without their knowledge. Even if laws
become enacted to prevent such tracking without a warrant , since when has that stopped anybody? There's even places where people
already know about and accept cameras for 'security' reasons which could easily be used. Maybe it's time to start learning how to put on
makeup and use disguises?
New Jersey Resident Charged With Multiple Cable Violations
Andrew Anthony Christopher of Newark , New Jersey has been Indicted on 18 charg es relating to the use and distribution of devices for
cable TV theft . Some of the charges relate to using mail fraud, conspiracy, and alleged false statements to the Social Security
Administration for the false collection of benefits. Oth er charges relate to unlawfully receiving cable service, possession of devices for
such theft, and distribution and sale of such devices. Court documents also state that Christopher unlawfully possessed and distributed
modified tone dialers for the use of simulating the tones pay phones use to recognize money being deposited (AX.A. Red Box).
U.S. Attorney Faith Hochberg said that Christopher sold turned on cable boxes and descramblers "knowing they were to be used to
descramble encrypted cable television programming without the authorization of the cable television provider and without the payment of
the required fee."
The Indictment includes one count of conspiracy, seven counts of mail fraud, five counts of assisting in the unlawful reception of cable
service, one count of possessing illegal telecommunications equipment, and four counts of making false statements to a government
agency. Each count comes with a maximum of $250,000 fine and five years in prison except for the count on the telecom equipment,
which is ten years.
These indictments were made by a Grand Jury, a group of 16 to 23 citizens who use a vote of at least 12 jurors to find probable cause that
a crime has been committed. Defendants nor their jurors are allowed to be present during grand jury hearings.
New Remotely Scannable Cards
SCS Corporation along with Hitachi Maxel Ltd. have announced their development of of SCS's Interactive Identification System labels
into an ultra thin contactless card . The cards , only .25mm thick are read by radio frequency scanners to obtain the information stored on
them. The cards can also be printed on using ordinary printers and copiers. No more sliding hard plastic cards through terminal slots .
The cards can store 1024 bits of information which is about 5 times as much as existing cards. Projected uses for such cards or strips are
for airline tickets, payphones, libraries , pharmaceuticals, mass transit, and anyplace else where existing ID cards are in use.
The cards do not use batteries and are readlwriteable, meaning they should last forever. New scanning systems for use with the cards will
be capable of scanning multiple cards simultaneously. This could be useful in such places as subway terminals where users can just walk
through a specified area without even removing their debit card from their wallets, or having to walk single file in a line.
The strips can also be placed on packages for tracking of inventories, dating of perishable items, or for retail anti-theft applications.
I would also imagine they could be used or hidden in such items as money . Since they can be accessed remotely a person can be scanned
for the presence of such cards or strips and immediately all information on them can be accessed. This could even be done without the
carriers knowledge. Just another way Big Brother could keep an eye on us all.
THUD Volume 1 Issue 1 • Spring 1998 35
This section will be for "letters to the editor" in future issues. Since we don't yet have any letters from our readers,
we're going to list some standard questions that we've seen in the past and answer them. This will be a kind of
hackers FAQ to start the ball rolling with the letters section. Please address all letters to:
THUD Letters
P.O. Box 2521
Cypress, CA 90630
Q: What is a Red Box and how can I make one? (we have seen Q: I'm familiar with some of the more common boxes, such as
this question millions of times.) Red, Blue, and Gold. I know there's more out there. What are
they?
A Red Box, also known as a quarter box. is a little gizmo that
simulates the tones made by a pay phone when coins are inserted. A: Well. the most common are Beige. Blue, Chrome. Gold. Green,
Since there are three coins used by phones there are three different Infinity. Red, Silver, and White.
signals that can be made. The basic tone is 1700Hz and 2200Hz
combined. It's the pulse length. number of pulses and the spacing A Beige box is really nothing more than a poor man's version of a
between them that counts. For a nickel it is one 60 millisecond pulse linemans test set. To make a simple one all you do is take a regular
(06 seconds). A dime is two 60ms pulses separated by 60ms of phone . preferably a baseless type. By baseless I mean the kind
silence . A quarter is a little different; it is five 33ms pulses with where the whole phone is contained in the handset. Kinda like a
33ms silent spaces in-between each. cordless, but the phone line hooks directly to the handset. All you do
is take a phone cord. cut one end off and put alligator clips (or
There are several ways to make a red box. roach clips. if you prefer) on the inside pair of wires. Then all you
do is clip your phone to someone else's line and you can make calls.
Radio Shack tone dialer mod: Best access point is the telephone access box. or .l-box on the back
ofthe house or apartment .
Radio Shack has a handy little tone dialer. There's been several
part numb ers available. Part no. 43-141 which was stopped being A blue is a type of tone generator. Mainly , it generates the 2600Hz
made in 1994 is the older model with 33 pres ets. The current model tone that's used to take contro l of a trunk line. The other tones are
is 43-146 There are two different versions with this same catalog used to access the "operator touch tones" or operator functions that
number . One is supposed to be 'hacker-proof in that the crystal is control what operation of the trunk. In essence. you become an
disguised (some say it looks like a capacitor) and is the newest operator. These don't work anymore cuz the phone company got
model and is the one you are likely to get if you go out and buy one wise to it a long time ago.
today . IT CAN STILL BE MODIFIED!!! The tone dialer is basically
a DTMF encoder that can store and playback the tones needed to A chrome box is pr etty much nothing more than a portab le strobe
dial a number . The modificati on changes the crystal inside on of light. When set to the correct flash rate it is used to trigger traffic
these to a differ ent fr equency so that the * key is close enoug h to the
lights to turn green, just like the strobes on fir e engines and poli ce
tones required. Then all one needs to do is program a pr eset to playcars. Of late. a new system has been starting to come into use.
back 5 *'s and voila! a quart er. All y ou do is change the Infrared triggers are starting to be used. The advantage is that
3. 579545MHz crystal inside the tone dialer to either 6. 5536MHz or strobe lights won't work anymore . but they 'll ju st say it's to keep
just plain 6.5MH z. The 6.5 is preferred as it is closer to the epileptics from having seizures. There's a way around that one too.
frequencies needed. but the 6.5536 crystal is easier to obtain and All you do is stand on a street corner near a fire station with one of
will still work. See the Hack Exchange section (classified ads) in those universal remote controls. Wait for them to come your way
this issue for sellers ofthe necessary crystals. and point the remote in their direction and program the remot e.
Then whatever remote button you programmed will have the code
Hallmark greeting card/digital memo recorders: pattern for the IR traffic trigger . Now all you do is point your
remote at the traffic light and press you r button to get a green light.
You ever get one ofthose greeting cards that allows y ou to record a You may have to make a modification to your transmitter by adding
personal message for the person you're giving it to ? That is extra infrared LED's to have enough power to work. especially in
basically a simple form of a digital sound recorder. There's also daylight .
those pocket digital memo recorders . Basically all y ou do is if you
have something that can generate the necessary tones. you use one A gold box. also known as a call diverter, is a little device that is
of these devices to record them. Then. when needed . y ou just whip attached to two phone lines. When you place a call on One phon e
out your memo recorder or greeting card and playba ck the tones line, the Gold Box picks it up and automatically connects you to the
into the mouthpiece of the pay phone. You may find it more other phone line giving yo u a dial tone. Then you dial your number
convenient to remove the guts from the card. It'd look kinda funny and it's as if you are actually making the callfrom the second phon e
seeing someon e holding a greet ing card up to a pay phone . line. These are also sometimes called Dark. or Diverter Boxes.
Tape recorder /walkman : A green box is similar to the Red. Silver. or White Boxes to generate
tones except the tones it generates are those to make Coin Collect.
This is just a variation on the above digital recording trick. Do the Coin Return. and Ringback tones. Coin Return is just that. it gives
same thing as above except that you are using a tape recorder you your money back. Coin Collect tells the phone to take the
instead. money that you entered and put it in it's box; can't get it back from
there. Ringback tells the phon e system to make the payphone ring
Ways ofgenerating tones : once you hang up. These used to work in the 80's but don't anymore .
Once again. there's actually a smart person at the phone company .
If you don't have a modified tone dialer or some other little
electronic device already set up to make the tones for you. you can An Infinity Box is a neato little device that can allow you to spy on
use your computer. Just use a WAV file editor that allows you to your home. or anywhere else. What you do with the device is you
create tones and make them as needed, then record them into your put it on your line or the line ofthe phone you 're using. Then. when
favorite device and there you have it. Check out the review on Cool you call the number it picks up the line and turns on the
Edit 96 in this issue for an EXCELLENT program for generating microphone . Now all you do is sit back and listen. The microphone
tones ofall kinds. will pick up everything in the area and put it on the phone line for
your listening pleasure.
36 Volume 1 Issue 1 - Spring 1998 THUD
A Red Box, sometimes referred to as a Quarter Box is used to Scanning IS illegal in SOME areas. You'll have to check your local
generate the tones that a payphone makes when you drop coins in laws to find out. Scanning is usually not complained about by the
them. For more information see the above question on Red Boxes. victims since they only receive one hang-up call. I'm sure we've all
gotten them. Phone companies do not look kindly upon scanning.
A Silver Box and a White Box are very similar. Both are devices Some central offices are set up to automatically detect scanning and
that generate the DTMF tones used in dialing. The White Box can will shut down the offending line for a period of time. About the
only generate tones for 0-9*# whereas a Silver Box can also only way you might get in trouble is if there is a law specific to
generate the tones for ABCD. scanning or if you scan regularly and the telco catches it.
A Black Box basically fools the phone company into thinking that Q: What is LATA?
the phone it's hooked up to hasn't picked up the phone . What
happens is that even after the person picks up the phone it continues A: LATA stands for Local Access Transport Area . These are
to ring. You talk between the rings and the call is never billed. All it geographic areas used to determine whether the call is to be routed
is is a resistor and capacitor in series placed across the phone line . using the loacal network or if it is to be routed by a long distance
It does not work on the newer ESS type phone systems. Was a great carrier. If the source and destination are in seperate LA TA's then
one back in the early 80's. the call is long distance .
A Clear Box is a telephone pickup coil and a small amp used to LATA mapping is not restricted to geo -political boundaries. LATA's
make free calls on Fortress Phones . Great for use on the newer can take up a whole state or just a small region . Some LATA's even
phones that mute the pickup microphone. cross borders between states .
A Color or Tan Box is a line activated telephone recorder . You can Maps of LATA boundaries can sometimes be found in phone books.
actually buy these at Radio Shack They're known as It depends on whose phone book it is. The Center for
phone line recorders. Communications Managment Information also sells LATA maps
and can be reached at 800-929 -4824. It has also been mention that
A Tron Box reverses the phase ofpower to your house , causing your McGraw-Hill business publishing may have LATA maps.
electric meter to run slower. For more information see the article in
this issue on Stopping Power Meters . BTW, it has NOTHING to do Q: Many times when I see schmatics for touch tone encoders or
with phone systems. decoders I see the frequencies for the keys ABeD. What are they
used for?
Q: Someone was telling me once about something called
Tempest and he said that with this stuff someone parked in a A: The ABCD extensions originally came for the militry. They had
van outside your house would be able to see what's on your need for a way to prioritize their calls . If say there was an
computer monitor or tell what you are typing. Is this true? emergency call because the Rushes were about to nuke our ass and
all the phone lines happened to be busy , they could just press a
A: All computers and electronic devices emit electromagnetic button and the phone system would drop line automatically so the
radiation of one form or anoth er. Ever have a neighbor that had a call would go through . But this was only on the military's own phne
HAM transmitter and liked to key down right when the winning play network known as Autovon .
for the game was in progress and all you saw was a bunch of wavy
lines? Well, this is called electromagnetic interf erence, or EMI for Originally the four keys ABCD were called Fa. F. I. and P. They
short. It's also sometimes referred to as radio frequency stood for Flash Override. Flash, Immediate , and Priority. These
interference, or RFI. If you look at the sticker on the back of TV's buttons ranked the priority of the call and would override calls of
and such you'll see an FCC compliance statement concerning the leser priority. FO was the highest and P the lowest .
devic es ability to not emit RFI but ye t accept RFI from other
sourc es. Although these buttons are not in general commercial service. they
are used in custom devices. Amateur radio repeaters make use of
It is these emissions that are picked up by very specialized and these tones for contro/. Security systems sometimes make use of
sensitive receivers that enable someon e to 'see' what you are doing these buttons as well, although for security reasons they don't use
on your computer. Differ ent devices emit on differ ent frequ encies . the same set of DTMF frequencies . You may also find that most
By having their equipm ent set up to scan only the frequencies for DTMF generators are capable of making th e ABCD tones.
the device they want to surveil . they can home in on their suspect . including modems .
Usually, they synchronize one of their monitors to the refresh sync
pulses on your monitor so that they can see the image on your Q: I have a computer that I need to change the BIOS settings
screen as you see it. It can also be applied to other devices. on it and it's password locked. Is there a way or a program that
will crack the BIOS password!
Yes, it's ve,y true, and you can thank our dear government for
bringing it to us. Tempest stands for Transient Electromagnetic A: Well, what kind of BIOS is it? What you need to do varies from
Pulse Surveillance Technology. Tempest is actually a u.s. machine to machine and from BIOS to BIOS. Common BIOS's
Government program that evaluat es electronic equipment and sets include AMI, Award. IBM and Phoenix. There are several other
the standards for how much EMI devices can emit without kinds of BIOS's but these are the most common for non-proprietary
compromising any information stored or processed on them . It uses systems.
shielding technology to prevent the EMI from getting out of the
device . In the United States , Tempest shielding is illegal for the Also , there are two types of passwords that may be set . One is a
average Joe Blow citizen to use. I wonder why? boot password, required when the user turns on the computer to
allow it to boot up. The other is simply used to control access to the
Q: What is war dialing and is it illegal? BIOS, which seems to be your problem .
A: War Dialing (a.k.a. scanning. demon dialing) is the process by The BIOS must store this password somewh ere and that somewhere
which a person dials phone numbers f or the purpose of finding is usually accessible in RAM. If you can boot the machine and you
intersting tones or carriers . It is usually done automatically by know the memory address of where the BIOS password is stored.
computer and modem in a search for other computer system dial in you can just read it directly. Ofcourse , it may be scrambled in some
access points. Programs are usually written to scan all numbers in way so you'll have to know that also. The best way is to have a
a given prefix . They can be set up to do so sequentially or randomly. program that knows both ofthese things .
Most BIOS cracking programs are written for the AMI BIOS. Some
Many people have written their own war dialers . But. for those of will give you the password in plain English (the best) while others
you who are not comput er programmers, you can find already made just give you the ASCII codes. There are also some that just give
packags on the internet . Probably the best one available for the PC you the keyboard scan codes. This not only varies from cracker to
is ToneLoc . You can get the file on the internet atftp.paranoia.com/ cracker but also f rom version of BIOS to BIOS as well. One place
pub/toneloc/. that you may be able to find the software you need is to ftp to
oak.oakland.edu and look in /simtel/msdos/sysutil/.
THUD Volume 1 Issue 1 - Spring 1998 37
Another common Irick 10 use if you are able to boot the machine but 607 993 609 958
just can't gel into the BIOS is to simply boot the machine and then 610 958 610 958-4100
remove the power supply to the CMOS memory chip that stores the 612 511 614 200
BIOS presets . A small battery all the motherboard is used to 614 571 615 200200200200200
maintain the information when the computer is turned off There's 615 2002222222 615 830
just aile catch. though. ALL of the BIOS information will he lost; 616 200-222-2222 617 200-222-1234
date/time. floppy drive settings . hard drive settings, and possibly 6/7 200-222-2222 617 200-444-4444
even more critical information. Depending Oil the machine this 617 220-2622 617 958
could be considered a last resort tactic . 618 200-xxx-xxxx 618 930
619 211-2001 6/9 21l-2/21
Q: What is an ANAC? 703 81/ 704 311
707 211-2222 708 /-200-555-/212
A: ANAC stands for Automatis Number Anouncment Circuit. Whe11 708 1-200-8825 708 200-6153
you call all ANAC a recording comes Oil that tells you the number 708 724-9951 708 356-9646
that you are calling from . It's an excellent way to find out the 713 380 713 970-xxxx
number of a wire pair. They're very' useful when GaM Boxing. 713811 714 114
Following is a large list of ANAC's. They are not guaranteed to 714 211-212/ 714 211-2222
work. DO NOT abuse ANAC's as the phone company will catch Oil 716 511 716 990
and change the number. 717 958 718 958
802 2-222-222-2222 802 200-222 -2222
United Slates: 802 1-700-222-2222 802 111-2222
201 958 202 811 805 114 805 211-2345
203 970 205 300-222-2222 805 211-2346 805 830
205 300-555-5555 205 300 -648- I I // 806 970-xxxx 8/0 200200200200200
205 300-765-4321 205 300-798-11 11 812 4/0-555-/212 813 311
205 300 -833-3333 205 557-231/ 8 I 5 200-xxx-xxxx 8/5 290
205 811 205 841-/111 817 211 8/7 970-611-111/
205 908-222-2222 206 411 818 /223 8/8 211-2345
207 958 209 830-2/2/ 8/8 211-2346 903 970-611-11 11
209 211-9779 2/0 830 904 200-222 -222 906 / -200-222-2222
212 958 213 1/4 907 8/ I 908 958
213 1223 213 211-2345 910 200 910 311
213 211-2346 213 760-2?? ? 9/0 988 914 990-1111
213 61056 214 570 915 970-xxxx 916 211-2222
214 790 214 970-222-2222 9/6 461 919 200
214 970-611-1111 2/5 410-xxxx 919 711
215 511 215 958
2 I 6 200-XXXX 216 331 Canada :
216 959-9892 217 200-xxx-xxxx 204 644-4444 306 115
219 550 219 559 403 311 403 908-22 2-2222
301 958-9968 310 114 403 999 416 997-xxxx
310 1223 310 211-2345 506 / -555-1313 514 320-xxxx
310 211-2346 312 200 519 320-xxxx 604 1116
312 290 312 1-200-8825 604 121l 604 211
312 1-200-555 -1212 313 200-200-2002 613 320-223 2 705 320-4567
313 200-222-2222 313 200-xxx -xxxx
3 I 3 200200200200200 314 410-xxxx# Australia :
315 953 315 958 +61 03-552-41 I I +61219123
315 998 317 310-222 -2222 +61211544
317 559-222-2222 317 743-1218
334 5572411 334 5572311 United Kingdom :
401 200-200-4444 401 222-2222 175
402 31l 404 31l
404 940-xxx-xxxx 404 990 Israel:
405 890-7777777 405 897 110
407 200-222-2222 408 300-xxx-xxxx
408 760 408 940 Q: Are caller ID and ANI the same thing?
409 951 409 970-xxxx
410 200-6969 410 200-555-1212 A: Yes. and no. ANI, or Automatic Number Identification is the term
410 811 412 711-6633 describing the phone company's internal system for identifying the
412 7JI-441l 412 999-xxxx the caller. This is used for routing and billing purposes and is of
413 958 413 200-555-5555 itselfnot accessible to the public.
414 330-2234 415 200-555-1212
415 21l-21l 1 415 2222 Caller ID. a/so called eNID or Call Display , is a service offered by
415 640 415 760-2878 the phone company to their customers that. for a fee. will display
415 7600-2222 419 311 the number of the calling party on a special box attached to the
502 2002222222 502 997-555-1212 phone which is bought seperately, again for a fee.
503 6J.J 503 999
504 99882233 504 201-269-1l 11 ANI has existed for a /oooooooooooooong lime. All this crap we
504 998 504 99851-0000000000 keep hearingfrom the phone companies that they can 't do it is bunk.
508 958 508 200-222-1234 How do you think 911 operators get their info when someone needs
508 200-222-2222 508 26011 help? A hangul' call to 911 will result in a patrol car being sent to
509 560 510 760-11 JI the location to confirm if there is an emergency or not. The 911
512 830 512 970-xxxx operator has the callers location shown on their computer display
515 5463 515 811 the moment the answer "911. what's the emergency?"
516 958 516 968
517 200-222-2222 517 200200200200200 Basically. ANI has always existed. for how else does the phone
518 511 518 997 company know who to bill? Caller ID is their way ofletting you use
518 998 603 200-222-2222 ANI but making you pay for it.
606 997-555-1212 606 711
38 Volume 1 Issue 1 - Spring 1998 THUD
Q: What does COCOT stand for? The mobile transmits 45MHz below the base channel. i.e. channel I
base channel is 870.030MHz so the mobile transmits at
A: COCOT is Coin Operated Customer Owned Telephone, or could 825.030MHz and receives on 870.030MHz. Caution. the new
be Customer Owned Coin Operated Telephone ...either way it digital systems are being allocated to some ofthese channels.
means the same thing. It's like a payphone in the sense that you
have to drop coins into the phoen to make a call. The difference lies Ch. Freq. (base) System
in who actually OWnS the phone itself. Use
991-1023 869.040 - 870.000 A-RCC voice
A regular payphone which you might see lines on the streets is 001-312 870.030 - 879.360 A-RCC voice
owned by the phone company itself. A COCOT on the other hand is 313-333 879.390 - 879.990 A-RCC data
owned by an individual. Of course the individual has to pay the 334-354 880.020 - 880.620 B - Telco data
phone company to access the network but the cost is low enough to 355-666 880.650 - 889.980 B - Telco voice
allow the owener to make a profit from the use ofthe phone. 667-716 890.010 - 891.480 A-RCC voice
717-799 891.510 - 893.970 B - Telco voice
Sometimes individuals have COCOT's installed in their homes
thinking that they can save money on their calls. Most often. Cordless Telephones
however, the services they get are less than what is expected. Many
times a COCOT is unsable to make long distance calls at all. Others Channels 16-25 we're once channels 1-15. These were the original
have been knwn to have problems accessing new area codes when 10 channels allocated. Channels ABCDE are also used for walkie-
they go into effect. talkies. baby monitors and other low power uses.
COCOTs are also known to Red Boxers as "useless" since a red Ch Base Handset Ch Base Handset
box proves to be ineffective on a COCOr. The reason for this is 1 43.72 48.76 14 44.46 49.46
very simple. Red Boxes work on this principle: recreate the toners) 2 43.74 48.84 15 44.48 49.50
that fool the phone company into thinking you inserted money into 3 43.82 48.86 16 46.61 49.67
the payphone. 4 43.84 48.92 17B 46.63 49.845
5 43.92 49.02 18C 46.67 49.86
You see, the payphones on the street that are owned by the phone 6 43.96 49.08 19 46.71 49.77
companies themselves are quite dumb. really. The payphone makes 7 44.12 49.10 20D 46.73 49.875
no decisions when it comes to handling calls. When a coin is 8 44.16 49.16 21A 46.77 49.83
inserted into one of these payphones, the phone creates the coin 9 44.18 49.20 22£ 46.83 49.89
insertion tones (the same ones that the Red Boxes reproduce) and 10 44.20 49.24 23 46.87 49.93
sends it offto the phone company switches. At that time. the phone 11 44.32 49.28 24 46.93 49.99
company equipment at the closest CO decides if the tones are real 12 44.36 49.36 25 46.97 49.97
and which amount of money was inserted. If everything goes all 13 44.40 49.40
right, the CO allows the call to go through. It 's a rather interesting
cycle ofevents. Mobile Telephones
These are FM transmissions. Many of the channels are now used
Now, the COCOTs don 't work like this. COCOTs are special for paging.
payphones that work on normal phone lines such as the phone line
in your home. It works like this: You own your own line and put a VHF - 30 kHz spacing UHF - 25 kHz spacing
payphone on it. The payphone itself has to make the decisions on Base:
when a coin is inserted and if the coin is counterfeit or not. The 152.030 - 152.210 RCC 454.025 - 454.350 RCC
COCOT does not send a special tone to the phone company CO 152.510 - 152.8/0 telco 454.375 - 454.650 telco
since the phone company does not operate the payphone. The Red Mobile:
Box tones are ineffective because of this. The COCOT does not /57 .770 - 158.070 telco 459.025 - 459.350 RCC
generate tones anyway. so why would a Red Box work? A COCOT /58.490 - 158.670 RCC 459.375 - 459.650 telco
is much like a vending machine. It's selfcontained and owned by a
vendor. COCOTs have their own flaws. though. Air to Ground Telephones
Q: What are DTMF tones and how do I make one? These are FM transmissions used on private aircraft. Anywhere
from one to four channels are used in a given area. The ground
A: DTMF stands for Dual Tone Multi-Frequency. When you dial a station repeats the airborne halfof the conversation. They transmit
phone number with your telephone, the tones you hear are DTMF a steady tone when not in use.
tones. Each tone actually consists of two tones. To create any kind Ch Ground Airborne
of DTMF tone, you simply create two tones at the same time. For
instance. the following is a list ofthe DTMF tones used Ona phone: Signal 454.675 (459.675)
6 454.700 459.700
1209Hz 1336Hz 1477Hz 1633Hz
7 454.725 459.725
697Hz 1 2 3 A 5 454.750 459.750
770Hz 4 5 6 B 8 454.775 459.775
4 454.800 459.800
852Hz 7 8 9 C 9 454.825 459.825
941Hz 0 # 0 3 454.850 459.850
/0 454.875 459.875
2 454.900 459.900
If you'd like to create these tones with a piece ofsoftware on your 11 454.925 459.925
IBM compatible. check out the review on Cool Edit '96 in this issue 1 454.950 459.950
of THUD. /2 454.975 459,975
Q: What are some good frequencies to scan to find interesting 800 MHz Air to Ground Telephones
stuph?
These are AM or sometimes SSB transmissions in digital format and
A: Ok. .ithat 's a lall order, but I think we've got enough info to get are used on commercial airliners. Channel spacing is 6KHz. Each
you started. geographic area is assigned a block of 29 unique channels. Ground
stations do not echo the airborne half. Guard Band between each
Cellular Telephones channel is xxx.x765 - xxx.x797. Control Channels for each channel
is xxx.x813 - xxx.x973.
These are transmitted in FM and each channel is 30KHz apart.
Channels 991-/023 are sometimes referred to as channels 800-832.
THUD Volume 1 Issue 1 • Spring 1998 39
Airhorne Ground They were allocated in June 1996. Freqs are in MHz.
Block Ch / - Ch 29 Ch 1 - Ch 29
/0 894.0055 - 894./735 849.0055 - 849./735 Ch Freq Ch Freq
9 894.2055 - 894.3735 849.2055 - 849.3735 1 462.5625 8 467.5625
8 894.4055 - 894.5735 849.4055 - 849.5735 2 462.5875 9 467.5875
7 894.6055 - 894.7735 849.6055 - 849.7735 3 462.6125 10 467.6125
6 894.8055 - 894.9735 849.8055 - 849.9735 4 462.6375 11 467.6375
5 895.0055 - 895./735 850.0055 - 850./735 5 462.6625 12 467.6625
4 895.2055 - 895.3735 850.2055 - 850.3735 6 462.6875 13 467.6875
3 895.4055 - 895.5735 850.4055 - 850.5735 7 462.7125 14 467.7125
2 895.6055 - 895.7735 850.6055 - 850.7735
/ 895.8055 - 895.9735 850.8055 - 850.9735 GMRS - General Mohile Radio Service
Television Maximum power on these channels is 5 watts. 462.6750 may also
he used as an emergency channel. The repeater is on the same
Yeah. TV, the boob-toob, eye-hall burn er.... anyway, each TV frequency as the hase. These are licensed stations.
channel is 6MHz wide (WOW!) . The video is upper sideband,
supressed carrier 1.25MHz into the hand. Audio is 200KHz wide Base Mobile
FM with it's carrier .25MHz helow the end of the hand. Some 462.5500 462.5625
stations might he off by +/- 10KHz. not much compared to the total 462.5750 462.5875
bandwidth. Note the gaps between ells 4/5,617. and 13/14. In some 462.6000 462.6125
areas the frequencies in channels /4-20 are used for Public Service 462.6250 462.6375
mohile use. For some oddball reason channel 37 is not used. 462.6500 462.6625
462.6750 462.6875
Ch Range Video Audio 462.7000 462.7125
2 54 - 60 55.250 59.750 462.7250 462.7375
3 60 - 66 61.250 65.750
4 66 - 72 67.250 7/.750 Railroads
5 76 - 82 77.250 8/ .750
6 82 - 88 83.250 87.750 The Association of American Railroads assigned the channel
7 /74 - /80 /75.250 /79.750 designations for these frequencies. all in MHz. 2 through 6 are only
8 /80 - 186 181.250 /85.750 used in Canada. Channel spacing above channel 6 is 15KHz.
9 186 - /92 187.250 /91 .750
10 192 - 198 /93.250 197.750 Ch Freq
11 198 - 204 199.250 203.750 2 159.810
12 204 - 210 205.250 209.750 3 159.930
13 210 - 2/6 211.250 2/5.750 4 160.050
14 470 - 4 76 271.250 475.750 5 /60 .185
15 476 - 482 277.250 481. 750 6 160.200
xxx-xxx + 6 xxx + 1.25 xxx+5 .75 7 /60 .2/5
68 794 - 800 795.250 799.750 8 160.230
69 800 - 806 801.250 805.750
96 161.550
Cable TV 97 161.565
Cable TV is pretty much the same as broadcast television except the The following frequencies are also shared with trucking.
ranges for some ofthe channels are different .
Base Mobile
Ch. MHz 452.325 457.325
2 -13 54 - 216 same as broadcast VHF 452.375 457.375
14 - 22 120 - 174 Mid band Ch. A-I 452.425 457.425
23 - 36 216 - 300 Super band J- W 452.475 457.475
37 - 53 300 - 402 Hyper band AA -QQ 452.775 457.775
54 - 64 402 - 468 Hyper band 452.825 457.825
65 - 94 468 - 648 Ultra band 452.875 457.875
95 - 99 90-120 Low band A5-A1 452.900 457.900
100-125 648 - 804 Ultra band
These ones are used for slave and remote controlled locomotives .
Citizens Band
452.925 452.950
Also known as CE. Mostly AM with some SSE in use.
Freq's are in MHz. These are for end of train monitors (ETM's). 161.115 is specific to
Norfolk-Southern.
Ch Freq , Ch Freq Ch Freq Ch Freq
1 26.965 11 27.085 21 27.215 31 27.315 457.9375 161.115
2 26.975 12 27.105 22 27.225 32 27.325
3 26.985 13 27.115 23 27.255 33 27.335 Marine VHF
4 27.005 14 27.125 24 27.235 34 27.345 In US waters ships may transmit on the shore frequencies of
5 27.015 15 27.135 25 27.245 35 27.355
channels 20, 24-28, and 84-87 . Shore frequencies are 4.6Mhz
6 27.025 16 27.155 26 27.265 36 27.365
above the ship frequency. Notice how the channel numbers are
7 27.035 17 27.165 27 27.275 37 27.375 interlaced.
8 27.055 18 27.175 28 27.285 38 27.385' Ch Ship Ch Ship
9 27.065 19 27.185 29 27.295 39 27.395
60 156.025
10 27.075 20 27.205 30 27.305 40 27.405 156.050 61 156.075
156.100 62 156.125
FRS - Family Radio Service 156.150 63 156.175
156.200 64 156.225
These frequencies are FM. Maximum power is 1/2 watt. These' xx xxx.xxx xxx.XXX
channels are allowed to vary by up to 2.5KHz. You'll find that the 25 157.250 85 157.275
first seven channels are shared by the GMRS (see next section). 26 157.300 86 157.325
40 Volume 1 Issue 1 - Spring 1998 THUD
27 157.350 87 157.375 123.100 control tow er at special events
28 157.400 88 157.425 122.825 Enroute airline ops - local area
122.875 Enroute airline ops - local area
Some channels have specific assignments. 122.750 air-to-air - private arcft
123.025 air-to-air - helicopter
6 156.300 Intership Safety 131.550 ACARS - digital (airlines)
9 156.450 General use - recreational vessels
/3 156.650 Bridge-to-Bridge Ambulances
/5 156.750 Weather. notices, etc
/6 156.800 General Calling / Distress Channels Med-9 and Med-l0 are sometimes used by the ambulance
22 157.100 Coast Guard Liaison companies for dispatch purposes.
AMTS - Automated Maritime Telecommunications System chan Hospital Ambulance
Med-9 462.950 467 .950
Channel spacing is 25KHz. Ships are not allowed to transmit in Med -l0 462.975 467.975
groups C & D. Med-l 463 .000 468 .000
Med-2 463 .025 468 .025
Grp Ch Shore Ship Med-3 463 .050 468.050
D 101-120 216.0125-216.4875 Med-4 463.075 468.075
C 121-140 216 .5125-216.9875 Med-5 463 .100 468 .100
B 141-160 217.0125-217.4875 219.0125 - 219.4875 Med-6 463.125 468.125
A 161-180 217.5/25-217.9875 219.5125 - 219.9875 Med-7 463.150 468.150
Med-8 463.175 468.175
Here's some other frequencies used for one hoard communications.
A special channel.
Ch mobile repeater
1 467.750 457.525 155.340 HEAR Intersystem (Hosp. Emerg. AmbuJ. Radio)
2 467.775 457.550
3 467 .800 457.575 Poli ce
4 467.825 457.600
39.46 intersystem operations only
Aeronautical Frequencies 45.86 int ersystem operations only
155.370 (wid ely used, but not a Federal allocation)
There's a shitload of different frequencies and frequency ranges 155.4 75 statewide emergency nets
used in aviation. The ones listed here are voice communications. 173.075 stolen vehicle recovery (LoJack)
There's many others used for navigation. It is possible to obtain 154.665 154.680 154.695 Stat e Poli ce
ariel navigational charts and have all the freqs used in a particular 154.905 154.920 154.935 coordinated operations
area laid out for you . 155.445 154.460 154.490 "
25KHz wide AM unles s noted otherwise. Fir e
45.88 inters ystem. primarily base-mobile
Range Use 154.265 mutual aid
108.000 - /17 .950 Nav Aid s - VOR & localizer. 50 kH z step /54 .280 mutual aid
118. 000 - 12/.4 00 ATC - towers & ARTCC 154.295 mutual aid
121. 600 - 121.925 A TC - airport ground control
122.000 - 122.650 Flight Service Stations. 50 kHz step Emergency Medical
122.700 - 123.500 UNICOM For ambulance MED channels see above.
123.600 - 128.800 ATC - towers & ARTCC
128.825 - 132.000 Enroute - airline company freqs 155.340 HEAR - Hospital Emerg. Ambul. Radio
132.025 - 135.975 ATC - towers & ARTCC 460.525 inter/intrasystem w/ Police & Fire
136.000 - 136.4 75 Enroute - international 460.550 inter/intrasystem w/ Police & Fir e
136.500 - 136.975 Enroute - domestic & international
Public Safety - all
UNICOM - Aeronautical advisory station at airport Mobile fr equencies for 220MHz range are I MHz above; for
122.700 122.725 460MHz range are 5 MHz above; and for 860MHz range are 45
122.800 123.000 MHz below.
122.950 at airport w/ full-time tower
122.975 above 10.000 feet 220 .8025 - 220 .8475 Mutual Aid (5 kHz intervals)
123.050 123.075 at heliports 866 .0125 866.5125 Mutual Aid
867.0125 867.5125 Mutual Aid
Multicom - common freq. at uncontrolled facilities 868.0125 Mutual Aid
122.850
122.900 primary CTAF Weather - NOAA broadcasts
122.925 Fed/State natural resources
The alert signal on these frequencies is a 1050Hz tone for about 5
FSS - FAA Flight Service Stations seconds.
122.000 122.050 EFAS "Flight Watch"
122.100 receive only (w/VOR) Ch Freq .
122.200 standard FSS 1 162.550 161.650 Environment CAN
123.600 123.650 AAS Airport Advisory Svc 2 162.400 161.775 marine weather
3 162.475
Aviation Support - training. gliders. ballons, etc 4 162.425
121.950 5 162.450
123.300 123.500 6 162.500
122.775 122.850 aviation services 7 162.525
Miscellaneous Television and movies.
121.500 standard emergency freq .. ELTs Broadcast Remote Pickup
123.100 Search And Rescue - actual 25.87 - 26.45 20/40 kHz intervals
122.900 Search And Rescue - training 152.87 - 153.35 60 kHz intervals
THUD Volume 1 Issue 1 - Spring 1998 41
161.64 - 161.76 30 kHz intervals Full Disclosure
450.05 - 450.85 50/100 kHz intervals P.o. Box 903-C, Libertyville. I//inois 60048
455.05 - 455.85 50/100 kHz intervals HAC-TIC Dutch Hacking Magazine
P.o. Box 22953
Film and Video Production 1l00DL
152.87 152.90 152.93 Amsterdam
152.96 152.99 153.02 Phone: +31 206001480
173.225 173.275 173.325 173.375 E-Mail: ropg@ooc.uva.nl
Wireless mikes 2600 Magazine
You may find some on unused FM/TV broadcast channels P.o. Box 752
169.445 169.505 170.245 Middle Island, NY 11953-0752
170.305 171.045 171.105 (516)751-2600
171.845 171.905
Cybertek Magazine
Dot Frequencies P.o. Box 64
Brewster NY 10509
These are the channels used on the profJesional "walkie-talkies"
/ike you'll find at construction sites and the /ike. They are assigned Mondo 2000
by the manufacturer or distributor. P.o. Box 10171
Berkley. CA 94709-5171
Color Freq. Comment Phone 415-845-9018
Red 151.625 itinerant Fax 415-649 -9630
Purple 151.955
Blue 154.570 Monitoring Times
Green 154.600 P.o. Box 98
White 462.575 GMRS 7540 Highway 64 West
Black 462.625 GMRS Brasstown, NC 28902-0098
Orange 462.675 GMRS (704)837-9200
Brown 464.500 itinerant www.grove.net
Yellow 464.550 itinerant Email: mteditor@grove.net
"J" 467.7625
"K" 467.8125 Satellite Times
Silver Star 467.850 P.o. Box 98
Gold Star 467.875 7540 Highway 64 West
Red Star 467.900 Brasstown. NC 28902-0098
Blue Star 467.925 (704)837-9200
Also check these frequencies . http://www.grove.net/hmpgst. html
27.49 35.04 43.04 151.505 Email: steditor@grove.net
158.400 469.500 469.550
Scrambling News
CTCSS (PL) Frequencies 1060 Niagara Falls Blvd.. #110
Tonawanda. NY. 14150
Motorola differs from EIA with: XZ (L1), X4 (L2). XB (L3). yz (716)283-6910
(L4). YB (L4A), ZA (L5). ICOMM does not use 97.4 and uses one E-Mail: scramblingnews @msn.com
less than the amateur numbers above that (i.e. ICOM #25 = 162.2). URL: http://www .scramb/ingnews. com/
Freq Designator Freq Designator Privacy Journal
EIA Ham EIA Ham P.o. Box 15300
67.0 L1 01 136.5 42 21 Washington D. C. 20003
71.9 L2 02 141.3 4A 22 Phone 202-547 -2865
74.4 WA 03 146.2 4B 23
77.0 L3 04 151.4 52 24 Q: I know that a beige box is just a Iinemans test set. I'd like to
79.7 SP 05 156.7 5A 25 know where I can buy one of these and perhaps some other
82.5 L4 06 162.2 5B 26 telecom tools?
85.4 YA 07 167.9 62 27
88.5 L4A 08 173.8 6A 28 A: Try the following places:
91.5 22 09 179.9 6B 29
94.8 L5 10 186.2 72 30 Jensen Tools
97.4 2B II 192.8 7A 31 7815 S. 46th Street
100.0 12 12 203.5 Ml 32 Phoenix. A285044-5399
103.5 lA 13 206.5 82 (800)426-1194
107.2 lB 14 210.7 M2 33 http://wwwjensentools.com
110.9 22 15 218.1 M3 34
114.8 2A 16 225.7 M4 35 Contact East
118.8 2B 17 229.1 92 335 Willow Street
123.0 32 18 241.8 M6 37 North Andover. MA 01845-5995
127.3 3A 19 250.3 M7 38 (508)682-2000
131.8 3B 20 254.1 02 www.contacteast .com
Q: What are some other hacking related magazines I can get Time Motion Tools
ahold of! 12778 Brookprinter Place
Poway, CA 92064
A: There are still quite a few titles available if you do some looking (619)679-0303
around. Check these out for starters :
PLEASE SEND QUESTIONS & LETTERS TO:
TAP Magazine
P.o. Box 20264
Louisville. KY 40250 THUD MAGAZINE
P.O. BOX 2521, CYPRESS, CA 90630
42 Volume 1 Issue 1 - Spring 1998 THUD
the 555 timer Ie for dummies
by: Orion
The 555 timer IC is probably one of the most versatile chips the amateur electronics builder can have at their disposal for
generating controlled and even quite precise waveforms. It comes in a small 8-pin IC package, although a dual version is
available in a 16-pin package. There are many uses for this device and many ways to configure it for various types of output ,
however this we will only deal with the basics of how to set up the chip to produce the desired frequency. The output will
generally be a square wave which is usually suitable for most applications. In this article we will describe the two basic modes
of operation for the 555; monostable or one-shot, and astable. Monostable operation is when the chip is setup to deliver a
single pulse of desired pulse-length when an input trigger is received . Astable is when the chip is setup to run freely or
continuously oscillate at a pre-determined frequency. Depending on the selected external components it is possible to make
the 555 run at frequencies as high as 100KHz or so low the the siganal on time can be measued in minutes, sometimes hours.
, . . . . . - - - - - - - - - - - - - - - - - , In fig. 1 we have the pinouts for the 555. Note that the supply pins 1 and 8 are
555 pinouts not what one may be used to if you deal with normal 7400 series TTL. The
typical maximum Vcc operating voltage is from 12-15 volts, although I have
Vcc
seen devices rated as high as 18 volts . Of course the chip will work just fine on
normal 5 volt power so you can use it with other CMOS and TTL devices . Pin
2 is used to trigger the chip to produce the output pulse. It's connections vary
discharge between mono and astable operation . Pin 3 is the output, not much need for
an explaination there . Pin 4 is the active low reset input. For normal operation
this should be tied directly to Vcc. Pin 5, the control voltage input is used to
output threshold control the point at which the capacitor voltage triggers the 555 to go low or
high. For our applications this is not used and is tied to ground via a .01uF
control capacito r. Pins 6 and 7 are used in conjunction with the external RC network
reset voltage to create the timing of the pulses generated .
fig. 1 Fig. 2 shows the basic schematic for simple monostable or one-shot operation .
10--10--------------.. The input trigger is held high and sent low to trigger the 555. The output is low
and goes high when triggered for the specified time . How long the 555 goes
, . . . . - - - - - - - - - - - - - - - -... high is controlled by the resistor/capacitor network of Rand C. As you know a
monostable operation cpacitor stores a charge . When used in conjuction with a resistor to control
current flow, the capacitor with charge or discharge at a certain rate. This is
+Vcc ~----....- - - - - used to control the timing of the 555. In the setup of fig. 2 the on time found at
the ouput on pin 3 can be calcula ted with the following simple formula:
trigger R t(seconds) = 1.1 RC
input e.g. 51.7milliseconds=1.1 (100K)(.47uF)
To spell it out take the resistor value in ohms and multiply it by the capacitor
.01uF value in farads and then multiply that answer by 1.1 to yield an answer in
seconds of how long the output will stay high when the trigge r is grounded .
output
fig. 2
monostable operation
misfire modification
+Vcc~------------
R
.01uF
Now , you might think, what's the point of monostable operation? Well, you
know those outdoor lamps that only go on when someone trips the infrared
fig. 3 sensor and then stays on for a short while? Or how about your garage door
opener light that stays on for a short while after the door is opened or shut? Or
what about those automat ic doors that open for you when you approach them or step on the floor mat? These are all
examples of timers in monostable operation. Once they are triggered, they stay 'on' for a predetermined length of time then go
'off until another trigger pulse turns them 'on' again. Now, I admit that these examples almost surely don't use 555 timers , the
principle is the same.
Now, let's move on to astable or free running operation. In this setup the 555 basically self-triggers. Whereas in the
monostable setup the RC netwrok only controls how long the output remains high by how quickly the capacitor is charged, this
setup also controls how long the oupt remains low by controlling how long the same RC network discha rges. Actually, there is
an added resistor, as can be seen in fig. 4. The formula for calculating the operating frequency is as follows :
F =1.443/(R +2R )C
1 2
e.g. 3101.22 Hz = 1.443/(330ohms+2(330ohms)).47uF
THUD Volume 1 Issue 1 - Spring 1998 43
astable operation
+Vcc
R1
output
R2
.0 1u F
fig. 4
astable operation
+5v...-...- -....- ....I - - - Now, if you really want a precise frequency you can use a crystal to control the
555. An example of just such a circuit is shown in fig. 6. You still need to pick
R1 your values for the RC network , but it's been reduced to a very simple formula :
F = 1.443/RC
R2 You will have to choose your values so that the resulting frequency value is as
close as possible to the frequency of the crystal. You can vary by up to 25%
and possibly more but the closer the better, of course . The small trimmer
capacitor can be used to fine tune the frequency of your oscillator so you can
match it to a known standard.
fig. 5
crystal controlled astable operation
1K
Now for the gravy. What can you do with two 555 timers, a 12 digit keypad ,
and a simple opamp to mix the 555's outputs together, and the correct Rand
C values? A DTMF touch tone encoder, better known as a silver box. I present
here a schematic with all the values figured out for you. Use the two 5K pots
on each of the 555's to adjust each of the high side and low side tones . Have
fun!!!
4 5
two tone
7 8 9 c o~p~J
* 0 # D
+1 2v
44 Volume 1 Issue 1 - Spring 1998 THUD
WI~ELESS CABlE "ELE"ISI~N
F~hUEN""~ ASkED ~IES"I.S
Compiled by Brian J. Catlin
Copyright
This file is Copyright (C) 1993, 1997 by Brian J. Catlin. All rights reserved . Redistribution of this file in both electronic and
printed form, is permitted provided that this file is distributed in its entirety, including this copyright notice. If you redistribute this
file, please let me know so that I can keep track of where this file goes.
Sources
Most of this information is taken from FCC Public Notices along with information sent to me by both the FCC and the Wireless
Cable Association (WCA). Other information has come from numerous newspapers, magazines, and from discussions with
MMDS subscribers. I would like to thank Alan Larson, Craig Strachman, David Newman, David Simmons, and JBlitzEsq for
their numerous contributions and corrections.
Questions and Answers
1.0) ABBREVIATIONS USED :
ITFS
Instructional Television Fixed Service . Channels that must have a minimum of 5 hours per week of educational programming.
May be leased for wireless cable usage.
LMDS
Local Multipoint Distribution Service. Two sets of 50 channels in the 28 GHz band . Not yet available for wireless cable usage.
MDS
Multipoint Distribution Service . Two channels that are similar to MMDS. May be used in a wireless cable system.
MMDS
Multichannel Multipoint Distribution Service . Two sets of four channels each . Also , type of service known as "Wireless Cable".
2.0) WHAT IS WIRELESS CABLE?
Wireless cable is a name given to a service that is called Multichannel Multipoint Distribution Service (or MMDS). It is a type
of cable television system that offers its subscribers a mix of satellite channels by transmitting the programming over MMDS
frequencies along with MDS, OFS , and ITFS frequencies, if they are available. Wireless cable uses Super High Frequency
("SHFn) channels to transmit satellite cable programming over-the-air instead of through overhead or underground wires.
2.1) WHAT IS CELLULARVISION?
CellularVision/Suite12 is a company that has been granted special permission by the FCC to transmit video services on a
higher frequency than what wireless cable uses. They have been testing in the 28 GHz (or LMDS) band. It is believed that the
FCC may allocate two sets of 50 channels in this band for wireless cable type service .
CellularVision is hoping to provide television plus much more. Since the signal is interleaved , it is possible for a large number
of services to occupy a narrow bandwidth. CellularVision is planning on offering interactive networking, grocery ordering, bank
transactions, and video teleconferencing . I am not sure what all CellularVision is planning on offering during this initial testing
period.
Howeve r, using the 28 GHz band means sacrificing signal range. These signals aren't able to achieve even the 25-30 mile
range that MMDS and other 2 GHz services are able to get, given the same transmitting power. To get around this , they are
using 35 "cell sites" to transmit the programming . They hope to offer service to over 6.3 million subscribers in the region
around New York City by 1995.
3.0) WHAT ARE THE BENEFITS OF WIRELESS CABLE TO THE CUSTOMER?
Availability : Wireless Cable can be made available in areas of scattered population and other areas where it is too expensive
to build a traditional cable station.
Affordability: Due to the lower costs of building a Wireless Cable Station, savings can be passed on to the subscribers .
3.1) HOW DOES IT WORK?
Scrambled satellite cable programming is received at a central location where it is processed and fed into special transmitters.
The SHF transmitters distribute the programming throughout the coverage area. The signals are received by special antennas
installed on subscribers' roofs, combined with the existing VHF and UHF channels from the subscriber's existing antenna,
and distributed within the home or building through coaxial cable into a channel program selector located near the television
set.
Notice that you must provide a UHF and/or VHF antenna if you want the broadcast channels . This is because the Wireless
THUD Volume 1 Issue 1 - Spring 1998 45
Cable Box only provides a UHFNHF tuner. Of course . not all boxes include even this feature (but most do).
3.2) WHAT IS THE HISTORY OF MMDS?
It is a fairly new service that developed from MDS (multi-point distribution service) which could only send one or two channels.
Originally. the FCC thought MDS would be used primarily to send business data. However, since MDS's creation in the early
70's, the service has become increasingly popular in sending entertainment programming. Because the FCC does not
regulate the content of the transmission, alternative uses would not be prohibited.
Today, there are systems in use all around the U.S. and in many other countries including the former Soviet Union, and
Canada. Other systems are being built all over the place. including Australia . At the rate that the FCC has been receiving
applications, it looks as if many more systems are going to be built in the U.S..
3.3) HOW DOES MMDS WORK COMMERCIALLY?
A MMDS licensee, which is similar to a broadcast station owner, leases transmission time to programmers on a first-come.
first- served basis. The programmers . in turn. are responsible for designing and selling their programs to the subscriber .
A MMDS applicant can choose to operate as a common carrier. In the telecommunications industry, a common carrier also
may provide services such as audio only transmissions, telephone, or data.
A MMDS applicant can alternatively choose to operate as a non- common carrier. This scenario in effect would constitute a
non- common carrier wireless cable system .
Also, note that a MMDS license only entitles you to FOUR channels. In order to use all 33 channels, you must apply for several
different licenses. This can be very costly!
4.0) WHAT FREQUENCIES ARE USED?
Frequency Range(MHz) Number of Channels used Type of Service Channel Groups
2.150-2,162 MDS 1,2,2(A)
2,500-2.596 16 ITFS ABC&D
2,596-2 ,644 8 MMDS E&F
2,644-2,686 ITFS G
2,644-2,686 MMDS H
2,686-2,689 .875 31* MMDS Response Channels
* - Each channel's bandwidth is 125 KHz, and does not carry video.
There are also tests being made in New York for transmitting in the 28 GHz band (LMDS). The frequencies used are 27.5 GHz
- 29.5 GHz . I am not sure of how these frequencies are divided between the different services.
The FCC is currently thinking about opening up more frequencies so that up to 7 wireless cable companies can compete in the
larger markets.
4.1) HOW MANY CHANNELS CAN BE TRANSMITIED?
When fully implemented, wireless cable operations may have as many as 33 channels of broadcast and cable programming .
This, of course, depends on which channels are already used in your area. Furthermore, 20 of the 33 channels are borrowed
from ITFS services and are earmarked for educational use. This means there is a requirement to program 20 hours per week
per channel of educational material. All educational programming is now allowed to be placed on one ITFS channel instead of
having it spread over the four channels in the ITFS group.
For new ITFS licenses, only 12 hours per week per channel is required, but they cannot be grouped together. If any of these
channels are being used, then any extra time can be leased by the MMDS station, if the owner of the license agrees.
Approximately 150 to 300 channels may become available if digital compression is used. There are a few sites that are testing
this new technology, and I have heard that the video and audio signals are quite good. They are using Zenith's new 16-level
digital transmission system which is also capable of delivering HDTV (High Definition Television).
Also, since the signals will be sent digitally, it is expected that the range of the signal will increase by approximately 3 times.
4.2) WHAT CHANNELS CAN BE SENT?
Wireless cable systems can carry any of the typical cable channels. In the past, some channels refused to let wireless cable
systems carry their signals. However, the cable re-regulation 'bill made channels that are available to cable companies also
available to wireless cable . It can also send the 'SuperGuide' data along with similar data services.
46 Volume 1 Issue 1 - Spring 1998 THUD
5.0) WHAT IS THE RANGE OF WIRELESS CABLE?
Wireless cable systems optimally can get a range of up to 25-30 miles. This depends largely on the terrain, transmitting power,
both the transmitting and receiving equipment, and many other factors . In order to receive the signal, the transmitting and
receiving antennas must be line-of-site.
Because of its low startup costs, and the ability to reach places that cannot be served by traditional cable, MMDS may be
feasible in certain rural areas.
A range of 75 to 90 miles could be accomplished if a new digital compression system is used. (See question 4.1 )
5.1) DOES WEATHER AFFECT RECEPTION?
The answer to this question depends on the type of system used. For systems that transmit their programming without
modification (ie. No compression or scrambling), severe fog and/or rain can cause the signal to be reflected, causeing the
picture to deteriorate. From what I have heard,you can usually expect between eight to ten days per year of interrupted
service. This figure, I believe, is the average for the current systems operating in the U,S..
If the programming is scrambled, the downconverter/descrambler may loose authorization sooner.
On the other hand, if the programming is sent digitally, or is digitally compressed, the signal can deteriorate to a much lower
level before the picture is affected. However, once the signal gets this weak, the picture will deteriorate at a much faster rate
as the weather gets worse. From what I have read, the average number of days that this type of service would be interrupted,
would be one day per year. (This sounds rather optimistic to me... does anyone have any info about this?)
Also, the farther the receiver is from the transmitter , the sooner the picture will be affected.
6.0) WHAT EQUIPMENT IS IN THE SUBSCRIBER'S HOME?
Each household subscribing to the service has a small antenna on its roof (about the size of an open newspaper) and a
downconverter inside. The downconverter usually includes an addressable decoder and a VHF/UHF tuner built in. This gives
it the ability to tune in broadcast channels without having to use up valuable MMDS channels. It also allows pay-per-view
services and simplifies channel blocking and premium channel activation/deactivation.
Also, the subscriber will need a UHF and/or VHF antenna if they want to receive broadcast channels.
Recently, a new converter has been introduced that will send all channels out of the converter at once. This means that you
can use your TV's and your VCR's built in tuner instead of having to have seperate boxes for each. This new technology is
(hopefully) going to be integrated into Wireless Cable converters as well as the traditional cable boxes.
6.1) IS WIRELESS CABLE EQUIPMENT RELIABLE?
Several excellent manufacturers produce antennas and downconverters for signal reception along with decoder boxes.
Because the signal is broadcast over the air, it is not subject to the failures of traditional cable. However , the receiving end is
somewhat more complex than most wired cable systems would use. Also, the signal is in a frequency range that may be
attenuated by water (such as rain) and can be blocked by trees. There is also some risk of interference from microwave ovens
operating in the area on 2,450 MHz.
There are several companies that provide equipment and consulting services. If you are interested in this, you may want to
pick up the latest copy of The Broadcasting Yearbook or Multichannel News. These can be found at most large libraries.
7.0) WHAT ABOUT COPYRIGHT ISSUES?
In the past, wireless cable systems have assumed that they may use a compulsory license to pay for copyright issues (similar
to what cable companies do today). A compulsory license enables systems to re-transmit broadcast signals for a pre-
established fee to compensate producers of TV programs. The copyright office then announced that wireless cable is NOT a
cable system, therefore, these systems may not use compulsory licenses .
However, the Satellite Home Viewer Act of 1994 was passed and enacted on October 18, 1994. This act establishes that
wireless cable systems fully qualify for the compulsory copyright license in the same manner as cable systems. I would like to
thank JBlitzEsq for this information.
8.0) WHAT ABOUT SECURITY?
In systems that use scrambling, signal security is provided by encoding each channel and equipping the converter with a
decoding device that responds to a pilot signal carrying a data stream with authorization instructions. Thus, the system is
totally addressable . No (legal) converter box will have any utility unless it is authorized for service by the central computer. All
channels, both Basic and Premium, are hard scrambled . Because the wireless cable system is addressable, it can also
accommodate pay- per-view service.
One way to defeat this is to use an illegal converter box. These are not as easy to find as the ones for regular cable systems .
However, a "Universal Descrambler" will probably be able to descramble the channels. (I have not tried this).
If digital compression is used. then no scrambling is needed as a compressed signal is impossible to watch.
According to Barry Nadler of the FCC office in Vero Beach, "There is not any restrictions on receiving wireless cable
transmissions. There are currently restrictions on the cellular frequencies only. If you decode scrambled signals, you are
THUD Volume 1 Issue 1 - Spring 1998 47
breaking the law. Cable companies can take you to court (Title 47 Section 605,USC) for 'Use of information not specifically
directed to you'." This means that you may view any unscrambled/unmodified signals with your own receiver. You may not,
however, unscramble a signal without authorization . I would like to thank David Simmons for providing this quote to me.
9.0) HOW ARE WIRELESS CABLE SYSTEMS REGULATED?
The FCC has specifically preempted local regulation of wireless cable frequencies, asserting that it is interstate commerce.
There is no basis for local regulation of the wireless signal. Unlike cable, no public rights of way are used, and all transmission
and reception equipment is on private property.
Furthermore, the antennas are so similar to regular television antennas that there can be no basis for zoning restrictions . If a
particular area does have zoning restrictions against antennas , they can be fought against in court (the newsgroup
rec.video .satellite occasionally has these discussions). However , if you signed an agreement that restricted antennas, you
may be out of luck.
This does not mean, however, that there is little regulation. The federal government regulates the industry heavily. This is done
through processes of getting licenses, transfering licenses, applying for ITFS channels, report filings, etc.
10.0) I SAW ONE OF THOSE 'INFOMERCIALS' ABOUT WIRELESS CABLE. ARE THESE COMPANIES LEGIT?
While some companies may be legit, there are some things that they don't disclose . Because of this, two companies have had
temporary restraining orders placed against them . A judge has placed some of the following restrictions on them .
They may no longer state that applicants are "virtually guaranteed" of winning a license in the FCC lottery or that most wireless
cable licenses are "highly valuable ."
"There may be substantial delays in the awarding of any MMDS license due to the length of time the FCC takes to process
MMDS applications and award MMDS licenses ."
That financing for wireless cable systems is hard to get. "given the relatively new nature of this field of technology and that
such financing may require additional funds of the customer's own money as a condition" to obtaining a system.
Provide a new "Risk Disclosure" statement that applicants must sign before sale is completed. This statement informs
applicants , among other items, that any representations of value of systems are opinions and not actual values , that the
winner of a MMDS lottery wins only 4 channels and that there may be competition with satellite, VCR, and other media .
Also, take note that in the U.S., it is ILLEGAL to enter into (or even plan on entering into) a settlement group when applying for
a license .
10.1 HOW CAN I TELL IF A COMPANY IS RUNNING A SCAM ON ME?
Many scams work the following way:
Television, radio, and newspaper ads say that a wireless cable company is looking for investors to apply for licenses for a
given area, which the company will service.
Investors are asked to pay a large sum of money for application and engineering fees. The application fee is only about $155
for four channels.
The company then does an engineering study, which may not meet the technical requirements, and submits many
applications at one time to the FCC for that market.
If the investor wins a license, the company may not have the funding to actually bring a system on-line.
Most legitimate companies get their investments from institutions instead of from individuals. Also, beware of any "limited
liability partnerships" as they are frequently scams .
11.0) IS THERE AN INDUSTRY ASSOCIATION?
Wireless cable operators, license holders, and equipment/service suppliers have formed the Wireless Cable Association.
Among its activities the WCA has established a set of industry standards, both business and technical. The WCA has also
made the industry's concerns known on Capitol Hill and at Federal agencies such as the FCC, NTIA, OTA and DOJ. The
WCA has also opened channels of communication with organizations such as the National League of Cities, NATOA, MPAA
and the Association of State Attorneys General.
11.1) WHO DO I CONTACT FOR MORE INFORMATION?
FCC
Mass Media Bureau
Washington , DC 20554
Wireless Cable Association International, Inc.
1155 Connecticut Avenue, N.W. Suite 700
Washington, DC 20036
(202) 452-7823
FAX: (202) 452-0041-
11.2) ARE THERE ANY FTPOR GOPHER SITES AVAILABLE FOR MORE INFORMATION?
The FCC is currently setting up a site (ftp.fcc.gov) for anonymous FTP of daily reports, transcripts , and many other things on
48 Volume 1 Issue 1 • Spring 1998 THUD
cable, radio, television, telephone, and everything else that the FCC deals with .
For more information on anonymous FTP, see your local network administrator or your BBS's sysop.
This service is also available via gopher. All you need to do is gopher to ftp.fcc.gov port 70.
12.0) WHERE CAN I GET THE LATEST COpy OF THIS FAQ?
This FAQ can be found via the World-Wide-Web (WWW) at: http://www.bearhunter.com/-bearhntr/wireless-cable.html
Other FAQs can be found at: http://www.cis.ohio-state.edu/hypertexUfaq/useneUFAQ-List.html
Disc laimer
I have no affiliation with any type of cable or broadcast system . I am definitely not an expert in these areas. I have tried, to the
best of my ability, to interpret and relay the most accurate and up to date information . However, I do not guarant ee the
accuracy of this information as some of my sources may be biased or incorrect.
For additions, clarifications, corre ctions, or if you just have some questions or comments, please feel free to e-mail me.
B. J. Catlin
. " (:JABEE TEST CHip FAQ ,. ' '
." . ' ' contin~ed:lrom page 32 .,
4. Double check all work . A mistake in wiring may cause the test device to be damaged, and perhaps the box . Check your work carefully
be fo re the box is powered up.
5. Once installed correctly, ifunit fails to work, make sure that it is connected to a signal that is compatible with that of the unit under test.
I.E., a Zenith box will not work with a Jerrold type signal.
7. Sometimes the cable box /descrambler itself, is defective. If the box worked before you installed the test chip, and you suspect your
installation as faulty, remove and reinstall test chip .
8. To protect pins of test chips which are removed and replaced often, install test chip first into high quality socket.
9. Test chips, typically, will allow reception of all channels that the box is capable of receiving. This means that PPV or Premium channels
mayor may not be enabled for testing. Sometimes a second outboard descrambler, using a different scrambling method is required . Some
test chips will reprogram the apparent locations of some or all channels. The box will still decode all channels, however, they may not all
be in sequence. This is not a problem, it's just the way the test chip works .
10. If the box still does not operate, you must now determine whether (I) the box is at fault (2) the test chip or module is at fault (3) you
have done a bad job of installing or (4) a combination of (l) through (3). If the box operates on all but a few premium channels, the cable
company may be using a di fferent descrambler to decode those channels. If this is the case, the installation is OK and the test chip is
operating correctly. If not, then remove the test chip and return the box to its original condition. You may have to bridge cuts made on the
PCB or re-install jumpers, etc. The easy way to do this is to follow the installation instructions for installing the chip, only do it in reverse.
Start at the end of the instructions and remove instead of installing, uncut instead of cut etc.
11. Once box is returned to original condition, connect cable company cable TV, and power-up box. The box should operate as normal.
I.E., you should be able to receive some sort of programming. If nothing happens, double check the work you just performed. If the box
has been returned to normal condition, it should work same as it did before you began work. If it does not, the box may be defective, Or
YO U may not have programming going into the box . If the box received channels before the installation of the test chip, but does not work
now, you either have not returned the box to original operating condition or have damaged the box during the initial installation. If you
have incorrectly installed the test chip or module the first time, you may have damaged either the box or the test chip I module or both .
12. Ifbox works normally now, i.e., receives some channels, the box is OK. Now follow the instructions to the letter, and reinstall the test
ch ip or module. Be sure to follow the instructions exactly. The majority of installation problems can be traced to improper installation.
Very rarely, the chip or module will be bad .
13. If after re-installing the chip I module in a working box, it STILL does not work, contact us for return authorization to replace the
mod ule or chip. We have the facilities to check the chip or module. If the chip or module is defective from manufacture, we will repair,
repr og ram or replace it at NO CHARGE to you.
This information was taken directly from Te/ecode webpage with permission to do so. Te/ecode sells
all sorts of useful hacking material. Please take the time to check them out:
TELECODE
PO BOX 6426, YUMA AZ 85366-6426 (520) 726-2833
http://www .hackerscatalog.com/index.htm
THUD Volume 1 Issue 1 • Spring 1998 49
THUD Magazine Presents "OhMyGoD" Acronyms A-B
?A Action field contains an error CSU Advanced T -1 channel service unit
?D Data field contains an error CT AC testing definition
?E Error exist in message but cannot be resolved to the proper field CT AC Testing definition
?I Identification field contains an error CT Activate
?T Time-out has occured on channel CT Active
?W Warning message CT Auto or automatic circuit transactions
15S Fifteen seconds CTS Automated coin toll service
1CF Singal party coin first pay phone CTV Acticated
1FAC Interface packs CTVD Activated
1FB One party flat business rate CU Alarm control un it
10F One party official (telco) business line CU Automatic calling unit
2SPDT Partial dial timeout in the 2nd stage of traditional 2stage international o Attendant INTERfTRA blocal 1-26
2SPST Permanent sig.timeout in 2nd stage of traditional 2stage international DAP Audix data acquisition package
2SVCA Vacant code in 2nd stage of traditional 2stage international outbound DAS Advanced directory assistance system
2W Two wire (pair) (circuit) DC American digital cellular
2WAY Two-way trunk groups DC Analog to digital converter
300 Log command menu (SARTS command) DCCP Advanced data communication controll procedure
376 Log clear (SARTS command) DCCP Advanced data communications control procedure
384 Write log (SARTS command) DCI Automatic display call indicator
385 Read log (SARTS command) DDEXP Address expander
399 Log print (SARTS command) DOL Additional
3KHZ Three kilohertz DDR Address translations
3RNGR Three ringer OJ Ajust
3WO Third wire open OM Add -drop mult iplex
4W Four wire (pair) (circuit) DMA Advanced DMA controller SAB82258
600 Test menu (SARTS command) ON Abbreviated dialing number
600B 600-ohm briged connection DP Automatic diagnostic process.
611 Detail tests (SARTS command) DPCM Adaptive PCM
621 Macro command menu (SARTS command) OS Administration of designed services
631 Automatic test command (SARTS command) OS Administration of designed services review
735T 735-ohm compromise termination OS Advanced digital system
A A side (lead) (pair) OS Audio distribution system
A Area OS Aux ilary data system
A Telephone # or trunk group & member number from trouble DSL Asymmetrical digital subscriber line
AlB Two wire phone connection (T&R) DTS Automated digital terminal system
AA Automatic answer DTS Automatic data test system
AA Packet analog access line INTERfTRA blocal 1-26 DTS Automatic digital terminal system
AABS Automatic alternate billing service DU Automatic dialing unit
AAE Auxiliary access equipment ERM Alignment error rate monitor
AAR Automatic alternate rout ing F Commercial audio fulltime INTERfTRA blocal 1-26
AAX Automated attendant exchange FACTS Automatic facilities test system
AB Packet switch trunk INTERfTRA blocal 1-26 FADS Automatic force adjustment data system
ABATS Automatic bit access test system FE Analog front end
ABATS Automatic bit access test system (DDS serv ice) FI Authority and format identifier (ISO 7498)
ABC Automatic bill calling (TSPS) FSC Advanced featu res service center
ABF Abandon fa ilure FSK Automatic frequency shift keying
ABF Abandon failure (MOil) G/EEE Above ground electronic equipment enclosures
ABHC Average busy hour calls GC Automatic gain control
ABL Aux iliary Buffer oder word Left half GM Normal aging months
ABM Asynchronous balanced mode ( -> SABME) GND Analog ground
ABME ABM extended GT Accelerated aging type
ABR Auxiliary Buffer order word Right half I Activate indication (C/I channel code)
ABS Alternate billing service I Artificial intelligence
ABS Alternative billing service I Assigner's initials
ABSBH Average busy season busy hour I Automatic identified outward dial ing INTERfTRA blocal 1-26
ABT Abort IC Automatic intercept center I
ABV Above ICC Automatic intercept commun ications controller
AC Administrative computer IN Advanced intelligent network
AC Alternating current 100 Automatic id of outward dialing
AC Assembly code 100 Automatic identifaction of outward dialing
ACA Asynchronous communication adapter IS Alarm indication signal
ACB Annoyance call bureau IS Alarm indication signals
ACB Automatic call-back IS Automatic intercept system
ACC Audio communications controller IT Analit initialization of tables
ACCS Automated calling card service IU AI upstream
ACD Automatic call distribution L Alternate services INTERfTRA blocal 1-26
ACD Automatic call distributor LATS Automatic loop access system system (DDS service)
ACDA Automatic call disposition analyzer LBO Automatic line buildout
ACDN Access directory number LE Address latch enable
ACDN Access Directory Number LE Automatic line evaluation
ACE Assignment change establish LFE Analog line front end
ACE Automatic calling equipment LGOL Algorhythmic computer language
ACES Aris cabs entry system LI Automatic location indentification
ACF Advanced communications functions LIT Automatic line insulation testing
ACFA Advanced CMOS frame aligner peb2030 LL All eve nts
ACG Automatic call gap LL All module controller maintenance interrupts
ACH Attempt per circuit per hour LL Turns on all IDs
ACI Answer controller interface (10M2 monitor command) LPT Alarm scan points
ACIA Asynchronous communications interface adapter LRM Alarms
ACK Acknowledge LRU Automatic line record update
ACK No acknowledgement wink LS Automated list service
ACK No acknowledgement wink (MOil) M Administrative module
ACKDB Acknowledgement database M Amplitude modulation
ACM Address complete msg . (SS7: in ISUP) M Asynchronous multiplexer
ACOF Attendant control of facilities M Packet
ACP Action po int MA Automatic Message Accounting
ACSE Association control service element MA Automatic message accounting
ACSNET Acedemic computing services network MACS AMA collection system
ACSR Automatic customer station rearrangement MAIRR Automatic message accounting irregularity
50 Volume 1 Issue 1 - Spring 1998 THUD
AMALOST Lost automat ic message accounting RSB Automatic repair service bureau
AMARC AMA recent change RSSI Automatic rought selection screening index
AMARC AMA recording center RT Audible ringing tone
AMASE AMA standard entry RU Activation request upstream
AMAT Automatic message accounting transm itter RU Audio response unit
AMATPS Automatic message accounting teleprocessing system SAP As soon as possible
AMATPS Automatic message accounting transmitter teleprocessing sys SC Alarm and status circu it
AMC Add-on module connector (-> sipb) SC Alarm and status circuit.
AMERITECH American information technologies SC Alarm surveillance and control
AMI Alternate mark inversion code SCC2 Advanced serial communication controller
AML Automatic maintenance limit. SCII American standard code for information interchange
AMP Advance measurement processor SCII American standard code for information interexchange
AMP Amplifier SO Automated SMAS diagnostics
AMPS Advanced mobile phone service SOPE Synchronous data link controller (SOLC) A reset
AMR Automatic meter reading SE Applicat ion service element
AMWI Act ive message waiting indicator SEC Assignment section
AN Announcement service INTERfTRA blocal 1-26 SGN Assign
AN Associated number SGNMTS Assignments
ANA Automatic number announcement SIC Application specific integrated circuit
ANC All number calling SM Analog subscriber module
ANCT Analysis control table SOC Administrative service oversight center
ANI Automatic number identification SP Advanced service platform
ANIF Automatic number identification failure SP Arcofi signal processor
ANM Answer msg. (SS7 : in ISUP) SPACGCOMP ASP SCP response message with an ACG component
ANS Answer received at the switch
ANS Answer msg . SPBAORESP ASP SCP response message received with invalid data
ANS Answer On Bus SPEN Automatic system for performance evaluation of the network
ANSER AT&T Network Servicing System (i.e. via EAOAS link) SPNORTEMSG ASP reject message ret err and a play announc received at
ANSI American national standards institute the switch from the SCP
AO Allocation order SPSNCOMP ASP SCP response message with a send notifi
AO International/overseas audio (full time) INTERfTRA blocal1-26 component received at the switch
AOC Advice of charge (i.256 B) ASP termination notification message sent from the switch to
AOSS Auxilliary operator service system the SCP
AP-PG Access point page Access service request
AP Access point Assignment
AP Application (OSI layer 7) Posit ion acknowledge seizu re signal time-out (MOil)
AP Application processor Asynchronous
AP Attached processor Auto test-1
AP Auciliary processor Auto test-2
AP Automatic position Access tandem
AP Commercial audio (part time) INTERfTRA blocal1-26 International/overseas audio (part time) INTERfTRA blocal 1-
APC Alarm processor circuit 26
APC Amarc protocol converter T&T American telephone and telegraph
APO Access point data T01 Results of trunk test - 1AESS automat ic trunk test
APO Avalanche photo diode TA Automatic trunk analysis
APOB Access point data base TAB Area trunk assignment bureau
APOL Application processor data link TAl Automatic troubler analysis interface
APH Application protocol handle r TB All Trunks Busy
API Application interface TB All trunks busy
APM Application processor modules TC Automated testing control
APPC Advanced program to program communication (IBM) TC Automatic transmission con trol
APPL 1-APPL5 Reserved for application handlers TO Accept date
APS Automa tic position system TO Async. TOM
APS Automatic protect ion switch TH Abbrev iated trouble history
APS Automatic protection switching system TI Automatic test inhibit
AQ Autoquote problem . TI Awake TI
AR Activation request (CII channel code) TICS Automated toll integrity checking system
AR Alarm report TIS Automatic transmitter identification system
AR01 Office alarm - 1AESS alarm message TM Analog trunk module
AR02 Alarm retired or transferred - 1AESS alarm message TM Asynchronous transfer mode
AR03 Fuse blown - 1AESS alarm message TM Automatic teller machine
AR04 Unknown alarm scan point activated - 1AESS alarm message TMS Automated trunk measurement system
AR05 Commercial power failure - 1AESS alarm message TN Assigner's telephone number
AR06 Switch room alarm via alarm grid - 1AESS alarm message TO Time-out waiting for address complete signal
AR07 Power plant alarm - 1AESS alarm message TP All tests pass
AR08 Alarm circuit battery loss - 1AESS alarm message TR Alternate trunk routing
AR09 AMA bus fuse blown - 1AESS alarm message TRS Automated trouble reporting system
AR10 Alarm configuration has been changed (retired inhibited) TIC Automatic transmission test and control circuit
AR11 Power converter trouble - 1AESS alarm message TICOM AT&T communications
AR13 Carrier group alarm - 1AESS alarm message TIG Attendant group
AR15 Hourly report on building&power alarms -1AESS alarm message TIIS AT&T information system
ARA Automatic reservat ion adjustment U Access unit
ARC Administrat ive responsibility code U Autoscript INTERfTRA blocal 1-26
ARC Alternate route cancellat ion U Auxiliary
ARC Alternate route cancellation control UO Assignment list audit
ARC Audio response controller UO Audits
ARCOFI-SP ARCOFI + speakerphone function UOIT Audit detected problem.
ARCOFI Audio ringing codec filter UOIX Audio information exchange
ARCOS ARCOFI coefficient support program UP Access unit port
ARCOTI SIPB telephone module UTO Automaitc
ARO AR downstream UTOOIN Automatic digital network
ARG Alarm reference guide UTOSEVCOM Automatic secure voice communications
ARG Assemble and run a given master file UTOVON Automatic voice network
ARIS Audichron recorded information system UXF Auxiliary frame
ARL Activation request local loop (C/I channel code) VO Alternate voice-data
ARM Activation request maintenance (C/I channel code) VO Alternate voice data
ARM Asynchronous response mode WI Awake indication
ARM Automatic R(emote test system) maintance o All zeros data
ARMAR Automat ic request for manual assistance resolution B B side (pair) (lead)
ARN Activation request B Bridged connection
ARQ Automat ic repeat request B Equipment number
ARR Automatic ring recovery. B6ZS Bipolar with 6 zero subsitution
ARS Alternate route selection B8ZS Bipolar eight zero suppression encoding (OS-1)
ARS Automatic route selection B8ZS Bipolar with 8 zeros substitution (T1 pri)
ARSB Automated repair service bureau B911 Basic 911
THUD Volume 1 Issue 1 • Spring 1998 51
BA Basic access BNSNBLK BVA BNS message returned because of network blockage
BA Protective alarm (CD) INTERffRA blocal 1-26 BNSNCO BVA BNS message returned because of network congestion
BAF Blocking acknowledgment failure N BVA BNS message returned because of no routing data
BAI Bridge lifter assignment inquiry BNSNRTE BVA BNS message returned because of timeout
BAL Balance BNSTOUT BVA BNS message returned because of unequippeddestination
BAMAF Bellcore AMA format BNSUNE BVA BNS message received with an unexpected reply
BANCS Bell administrative network communications system Q Business name x (x =number of line)
BANKS Bell adminastration network systems BNSURPYBell operating companies
BAPCO Bellsouth advert ising & publishing company BNx Bell operating company
BAS Basic activity subset BOC Building operations control center
BAT Battery (-48v) BOC Byte oriented protocol
BAx Business address x (x =number of line) BOCC Basic output report
BB Blue box BOP Battery
BBDO/1 Binary Os or 1s detected in band d channels BaR Bit oriented signaling
BCC Bellcore client companies BORSCH Business office supervisor
BCC Block check character T Billing and order support system
BCC Blocked call cleared BaS Business office service system (NYNEX)
BCCP Bearer ccp BaS Beginning of tape
BCD Binary coded decimal BOSS Bottom
BCD Blocked call delayed BOSS Bits per inch
BCFE Busy call forwarding extened BOT Bell point of contact
BCID Business customer identifier BOT Bits per second
BCLID Bulk calling line identification BPI Binary psk
BCMS Basic call management system BPOC Basic packet-switching service
BCS Batch change supplement (NTI) (DMS-100) BPS Backup pump
BOCA Unk BPSK Bit robbing (CAS-BR)
BDCS Broadband digital cross-connect system BPSS Business residence account tracking system
BDS Basic data service BPUMP Business and residential customer service feature
BOT Billing data transmitter BR Business and residential customer services
BEF Band elimination filter BRAT Business residence custom service
BEL Bell BRCF Broadcase
BELLCOREBell communications research BRCS Bridge
BER Bit error rate BRCS Bridged
BERT Bit error rate test BRDCST Brevity control
BETRS Basic exchange telecommunications radio service BRDG Baud rate generator
BG Battery and ground signaling BRDGD Basic rate interface
BG/EEE Below ground electronic equipment enclosures BREVC Basic rate interface transmission extension (5ESS)
BHC Busy hour call BRG Break
BHC Busy hour calls BRI Basic remote module
BIB Backward indicator bit (SS7) BRITE Bell communications research practice
BICU Bus interface contro l unit BRK Bridge signature table
BIFIFO Bidirectional fifo BRM Backspace
BIR Bit receiver BRM Banded signaling
BIR Bus interface register BRST Bias battery (-19 .1v)
BISON Broadband ISDN BS Siren control INTERffRA blocal 1-26
BISP Business information system program BS Basic serving arrangements
BISYNC Binary synchronous communications BS Busy season busy hour
BIT Bit BS Business service center
BIT Bit transmitter BSA Business/residence service center
BITNET Because-it's-time network BSBH Bisynchronous communications module
BITR Bit transceiver BSC SDLC B reset
BIX Building internal cross -connects BSC/RSC Basic service elements
BK Back BSCM Bell shock force
BKUP Backup BSDPE British standards institution
BKUP Requests a backup BSE Backward sequence number (SS7)
Bl Bell & lights INTERffRA blocal 1-26 BSF Bell systems operating company
Bl Bridge lifter BSI Bell system practice
BL Bridge lifters - COSMOS command BSN Basic standard reference frequency
BLIDS Busy line/don 't answer BSOC Bell system reference frequency standard
BlA Blocking acknowledgement (SS7 : in ISUP) BSP Basic services terminal
BLF Busy line field BSRF Bell system technical journal
BlFCA Blocking a fully coded addressed international outbound call routed BSRFS British telecom
to a non-common channel signaling trunk BST Basic telecommunications access message
BlK Block BSTJ Both
BlKD Blocked BT Bell telephone laboratories
BlO Blocking (SS7: in ISUP) BTAM Billing telephone number
BlS Bridge lifter status BTH Bootstrapper board
BLS Business listing service BTL British thermal unit
BLV Busy line verification BTN System buffers (NTI)
BMC Billing media coverage BTSR Billing validation application
BMD Batch mode display BTU Billing verification and authorization for payment process
BMI Batch mode input - TIMEREL and DEMAND BUFF Billing validation center
BMOSS Building maintance operations service system BVA Basic voice service
BMR Batch mode release BVAPP Broadcast warning message
BMU Basic measurement unit (dip) BVC Broadcast warning twx
BND Band number BVS Bandwidth test set
BNS Billed number screening BWM Display the bypass file
BNSDBOV BVA BNS message received indicating data base overload BWT Change the contents of the bypass file
BNSDBUN BVA BNS message returned because data base unable to BWTS Commercial-automatic call distributor (aSPS)
process BYF C-notch
BNSGMSG BVA BNS message received garbled BYP Counting rate
52 Volume 1 Issue 1 • Spring 1998 THUD
by Oxygene
Here's a list of web sites deal ing with pirate radio , ham , amateur, manufacturers , suppliers , resources and anythin g else that
has to do with pirate radio. Enjoy.
ftp://dg-rt p.dg.com/fm 10 http ://users .aol .com/amn92/amn.htm
FM-10 FTP Site Free Radio site from Connecticut with plans etc . Micropower
f t p : 1/ f t P . u n i - pad e r b 0 r n . del F A a 1 a It . r a d i 0 . P ira tel broadcasting movement. Mark's micropower broadcasting movement
Low_Po wer_B roadc astin g_FAa page . Micropowe r Broadc asting Movement.
Low Power Broadcasting FAa http://users.aol.com/amn92/radio .htm
ftp://netacs ys .com/pub/micro_radio Amplifiers for Pirate Radio . AND Freedom of the airwaves!
Micro Radio FTP Site http ://users .aol.com/hldalis2/HOMEPAGE/home.html
http ://206 .130 .20 .3 :80/-gle n/ H L Dalis - Parts and Equipment Supplier.
Gle n's Pirate Radio Site . http ://users .aol.com/Net1fm /index .htm
http://burn.ucsd .edu/-blr/ MORE Pirate Radio kits.
Black Liberation Radio! http://vanbc.wimsey.coml rkozinuk/manual.html
http://clandjop .com/- jc ruzan/frn .html Pirate radio Web pages!
The Free Radio Network Info, pictures & audio clips . http ://w3 .one .neV-folklfrw.htm
http://comm-data .com FREE RADIO WEEKLY on-line magazine .
Communications Data Services, Inc - Broadcast & Communications http ://world .std.com/-maddawg/optimark.html
Softwa re & Data Supplier. Optimark - Fiber Optic Components & Transmission Systems .
http ://cust.iam erica .neVdwhowell/wavemach.html http://www-pp .hogia .neVjonny/pcl
Wavemach Communications - transmitters, amps , etc . PIRATE MAGAZINE costs $$$ . Steph an Printz 's Swedish Pirate Site.
http://cust.iamerica.neVdwhowelllomnij.htm http ://www-pp.kdt.neVjonny/index.html
Antennas for pirates by John Lentz . A U.K. Pirate Web Site . SRS (The Swed ish Report Service) European
http://deepthought.armory .com/- airbrick/frsc.html Pirate DX-ers Extensive logs (The Best European Pirate Rad io Site! !).
Aa ron's Free Radio Santa Cruz Page! http://www .0171 .com
http ://elektron.et.tudelft.nl/- stern/pulsar/scheme.htm Stuart Kidd's REAL AUDIO "Pirate Stat ion" on the WEB live broadcasts
Diagrams etc for BA1404 transmitters , Linears and other stuff . Dutch WED & THU evenings from London .
FM transmitter schematics on -line . http ://wwwAzzzfm .org .au/
http ://gwis2.circ.gwu.edu/- gringo/ AUSTRALIAN PIRATE RADIO SITE .
Clandestine Rad io International. http ://www .abekas .com/
http://home.pi.neV- freak55/home.html Abekas - Furniture and equipment.
FRSH Radio , Netherlands A Dutch pira te station . http://www .abg.coml
http://home.pi.neV- trans/HOME.HTM Audio Broadcast Group - Broadcast Equipment Supplier.
Harry 's pirate radio web site . Transatlantic radio Europ irates . http ://www.access.digex.neV-cps/
http://home.pi.neVusers/- freak55/home.html Chris Smolinski's SW/P irate/numbers Radio info page!
Joop Ter Zee : Free Radio New from the Netherlands . http ://www .access.digex.neV- cps/pirate.html
http ://homes .cls .neV-msievers/pirate/pirate.htm Free Radio Stations Pirate INFO .
Martin's Pirate Site in Kiel Germany . http ://www .aceinfo .com/bbh/info
http ://http ://tide1 .eventide.com/ BBH Software - Specializes in Media Addresses and Databases .
Eventide - Audio Processors . http ://www .adc .com
http://indigo.ie/- cruze AD C - ADC Telecommun ications - More than Patch Bays.
Anoraks Anonymous : interesting FM band pirate rad io news . http ://www .adtnet.com/
http ://involved .com/ewolfe/index2.htm AID Technologies, Inc. - Technical Services & RF Systems.
Burton Jame s of 102.1 FM Pirate & Patriot gove rnment consp iracy http://www .airwaves.com/fccdb.html
page 2. Pirate radio Web pages!
http://IOpht.com/- hotrod/frb.txt http ://www .alpcom .iVhamradio/freewaves
Radio Free Berkeley Italian pirate radio freewave .
http ://mcradio.com http ://www .ams-neve .com
McCurdy - Hard Disk Audio , Metering and Audio Mon itoring. Seimans Aud io - Aud io Equipmen t.
http ://members.aol.com/abfffr/index.htm http ://www .andrew .com
Pirate address list , infos , DJs etc . Achim 's Free Radio Disaster. Andrew Corporation - Coax , Antennas & Accessories .
http ://members.aol.com/wattsupmpr http ://www .angelfire .com/ma/wmbg/wmbg .html
Los Angeles Free Radio Conference 6/97 . WATTS UP! - a pirate WMBG
magazine. http://www .azstarnet .com/-dwahl
http://members .aol.com /y ae suto m The Virtual Pirate Band TRY IT!
Tom's Pirate Page . hltp:llwww .azstarnet.com/-dwahl/index.html
http ://members.cruzio.com/-frsc/frscpage Var ious Pirate stations: Laryngitis, Confusion etc .
Free Radio Santa Cruz!! http://www .beatworld .com
http://members .cruzio .com/-roguel Pirate station in Minneapolis .
Micro Radio, a history & a case study of Free Radio Berkeley. http://www .broadcast-warehouse .com
http ://members.tripod.com/- wlmd Broadcast Warehouse Fm transm itters and products .
A pirate radio station in Pittsburgh, PA. WMLD Rad io Pittsburgh , PA http ://www .broadcast.harris .com
with 50 watts on 99 .1 FM . Harris/All ied Broadcast Division - Equipment Manufactu rer .
http://metro .metro .mu.eduIWTPS/ http://www .broadcast.net
WTPS PIRATE RAD IO. Broadcast.Net (BNet ) - Shopp ing Mall of Broadcast Equipment.
http://new s.zippo.com/news-bin/www news?alt.radio.pirate http ://www .broadcast.neVbsc/onestep .html
alt.radio.pirate via www news . One-Step - Coaxial Cable Leak Repa ir.
http ://nighthawk.reichel .neVpatrioVdawn/ http://www .broadcast.neVjamprol
Burton James of 102.1 FM Pirate & Patriot governmen t conspiracy Jampro Antennas - FM and TV Antennas .
page s! http://www .broadcast.neVlogiteki
http ://ourwo rld.compuserve .com/homepages/SLewis2/ Logitek Systems , Inc. - Digi tal Audio Meters , Amplifiers & consoles
Stephen Lewis's Pirate Radio Page . http ://www .broadcast.neVorban
http://ourworld .compuserve.com/homepages/sosoft Orban - Audio Processing .
SOSO FT - ISDN Remote Talkba ck & Control Software . http ://www .broadcast.neVphaseteki
http://ourworld.compuserve.com/homepages/tels tar90 1 Phasetek - AM Phasors and Anten na Systems Components.
Telstar Radio FRCG . http ://www.bssaudio.co.uk
http ://pages .prodigy.com/RFAmerica BSS Audio - Pro Audio Signal Process ing & Distr ibution Equ ipment.
NLNR 102.1 FM American micro -broadcaster. http://www .ccaelectronics.com
http ://pine .shu.ac .ukl - sejones/piratesl CCA Electron ics Broadcast Transm itter manufacturer .
Latest UK & London pirate radio listings . List of all the lates t pirate radio http://www.chubs.demon .co.uk
in Lond on . Radio World . Radio World - A British radio related page
http://pirateradio.miningco.coml http ://www.clandjop.com/-jcruzan/greek-p .html
Pirate Radio at The Mining Company J. Cruz an mirror for greek pirate radio .
http://radiolink.neVkissfm http ://www.comrex .com/
Kiss 101.9 FM in Valdosta Georgia . Comrex - Equipment Manu facture r.
http ://u se rs .aol.co m/am n9 2/ http://www .comnet.nl/-freestyle
AM - FM Broadcasting Technology information , circuits with RealAudio . Freestyle FM (pirate radio from Delft, Holland) .
THUD Volume 1 Issue 1 - Spring 1998 53
http://www.cris .com/-squesValt-tv-pirate/index.html http://www.guernsey.neV-bebridel/
Pirate Radio Newsgroup archives. Pirate Radio of the Offshore Kind .
http://www.crtsystems .com http ://www .halcyon .comlrbds
Circuit Research Labs - Audio Processing, RBDS . Smart Radio Store - RBDS Receiving Equipment. Smart Radio Store -
http ://www.csos.orst .edu/-kenneke/rfccat.html RBDS Receiving Equipment.
RF Consulting Catalog http ://www .halls .com
http ://www .cybertron.com/-comcents/mhr/mhrgr/515.jpg Hall Electronics - Digital, Pro Audio & RF Equipment.
Transmitter Plans on -line. http://www.hauraki.xtra .co .nz
http ://www.decade.ca The Amazing History of Pirate Radio in New Zealand!
The Decade Company A new Canadian company that sells , very http://www.hookup.com/bdst.html
expensive FM transmitters(starting at $900) . Cool Site though!! Carpenter & Associates - Broadcast Equipment Leasing .
http ://www.digiface.nll-smc/ http://www.hp.com
Stichting Media Communicatie . Hewlett - Packard - Manufacturer.
http ://www .directnet.com/-vasgroup http ://www .i-way .co.ukl-stunova/kickfm.htm
VAS . Group - Scan Converters - Animation Controllers . KICK-FM Radio Station .
http://www.dma.be/p/amphion/sztuka/marabu.html htlp://www.imagevideo.com
Radio Marabu . Image Video - Manufacturer of Routing Switchers & Master Control
http://www.dolby .com Switchers .
Dolby Labs· Dolby Equipment Web Site. http://www.imagineV-rwaves/index .htm
http ://www .dungeon .com/-starVrds.html RADIO WAVES INTERNATIONAL new updated URL.
Radio Data Systems (RDS) - RBDS Equipment Suppl ier . http ://www .infi .neV-jlridge
http ://www .durhamradio.ca/ramsey .html Audio Concepts and Engineering - Technical Broadcast Consulting.
Durham Radio Sales & Service Low power FM Transmitters! Canada's http ://www .internet-ireland .ie/xfm/
largest Ramsey Dealer! Xfm , Pirate radio in Dublin Ireland .
http://www.ecn .bgu .edu/users/bsngd/fmradio.html http ://www.intertype.co.ukldesign/talk
Low Power FM Broadcasting PIRATE RADIO DESIGN? not sure!
http://www.ECNet.NeVusers/bsngd/fmradio.html http://www.io .org/-dixon
This is a low power broadcasting page with some pictures . part lists and Dixon Systems - Manufacturer & Services Supplier.
other helpful items . http ://www .itc-net.com
http ://www .ecsintl .com/ecs International Tapetronics - International Tapetronics Corporation (ITC) .
Energy Control Systems - Power Quality Equipment. http ://www .jagunet.com/-kodis/station.html
http ://www .edx.com Broadcast Station Locator.
E 0 X Engineering - Broadcast Engineering Software Demos & http://www.jvc -us .com
Databases. J V C - Commercial Video Products .
http ://www .electrotex .com http ://www .kcuf .org/radio/
Electrotex - SBE Internet Provider/Electronic Parts Supplier. KCUF Extreme Death Metal (oh well ..).
http ://www .euphonix .com http ://www .kfjc.org
Euphonix - Audio Mixing Consoles . Psych Rock info page!!
http ://www .exactweb.com/RSMI http ://www .kode .neVmeret
RADIO SAN MARINO INTERNATIONAL. MereVDynair - Optical Transmission Products.
http ://www .exit109.com/-jimh/radio.shtml http ://www .ldbrewer.com
Jim's Radio Room - Tubes & hi-power BC transmitting LARGE graphics L.D. Brewer's Pirate pages .
http ://www.ezlink.coml-meclpirateradio/ http ://www.ldbrewer.com/pirate.html
The #PirateRadio home page, the Pirate Radio IRC channel. Pirate xmtr kits . Tampa Pirate Radio , 102.1 FM . This Guy Rules!
http://www.faqs .org/faqslradio/broadcasting/low-power-faq/ http://www.legend.co.uk/-veronica/
Another Low Power Broadcasting FAQ Page . VERONICA FM transmitter kits 5 watts of pirate delight !
http ://www .fcc .gov/mmb/asd/lowpwr.html http ://www.leitch.com
FCC Information about low power radio . Leitch - Equipment Manufacturer.
http ://www .fni .com/-rice/bi/bi.html http://www.lls.se/-jal/
Broadcast Systems - Broadcast Equipment Distributor. The Swedish Report Service . This page contains QSL info. pirate links,
http ://www .freeradio.org sounds and other fabulous items that must be seen to be believed .
FREE RADIO pirate radio site . The Free Radio Berkeley Home Page . hllp ://www .lls.se/jal/pc
http ://www .freespeech.org/html/free_rad io_berkeley.html Pirate Connection Maga zine .
The Free Radio Berkeley page at Free Speech TV . htlp ://www.mediadesign.net
http://www.freezywater.u-net.com Kind Micro Radio. with Internet Audio feed .
DUNCAN's: Audio from Londons stations of the past. Radio Caroline http://www.mediadesign.neVkindmenu.htm
etc. photos too! Micro Kind Radio 105 .9 FM San Marcos, TX They've got a constant
http ://www .frn.net netcast going on !!!
Free Radio Network. SW Pirate radio aud io , info & chat! An incredible http ://www .mgnonl ine.com
wealth of information . Check it out! MGN Online - Media Graphics & Photo Database .
http ://www.frn.neVace/ http ://www .mnet.fr/onda.caliente/
ACE Clandestine Radio site . Onda Caliente A shortwave pirate station from France that transmills
http ://www .frn.neVgrapevine/chat2/chat.html on Sunday mornings. Onda Caliente Home page of a French SW Pirate
Pirate Chat Room - Real time chats, give it a try . http ://www .mnsinc .com/bry//ham/fm15watt.htm
http ://www .frn .neVrfi A practical 15 watt FM amplifier you can build (for VHF-FM broadcast or
Andrew Yoder's RADIO FREE INTERNET. the 144 MHz ham band).
http://www.fused .comlwww/xbones.html http://www.mnsinc.comlbry/mega/xtals.htm
The Modern Day 1990s London Pirate FM scene. Suppliers of crystals for your (Medium Wave) AM band transmitter.
http ://www .geocities .com/-garfield25/pirate.html http ://www .mnsinc .comlbry/mine/fcc_care.txt
INFO from Radio World magazine! Does the FCC still care? Some comments! (works now!!)
http://www.geocities.com/Athens/5383/lowpower.html http ://www .mnsinc.comlbry/mine/pirate .fun
Low Power Broadcasting FAQ Page . A 14 year-old has fun with Free Radio!
http://www.geocities.com/Broadway/1122/ http://www.mnsinc.comlbry/piralynx .htm
-=Channel 61 =- The best of pirate radio and TV. Bry's Pirate Radio links - A huge selection of links Pirate Radio linkss,
http ://www .geocities.com/CapeCanaveraI/2594/geo-pir.html quite a few links to quite a. few sites.
Martin's pirate radio address list. etc . hltp ://www .mnsinc .comJbrylradio/1 pirate .txt
http://www.geocities.com/capecanaveral/6702 A history of UK Pirate Radio .
John Harper's FM Free Radio site . John Harper's Pirate FM radio site . http://www.mnsinc .comJbrylradio/2pirate.txt
http://www.geocities.com/CapeCanaveraI/9885/ The history of a U.K. Pirate Radio D.J.
KIWI Radio New Zealand's most prolific pirate station http://www.nmsinc.comlbry/radio/arc5.txt
http ://www.geocities.comlCapitoIHill/Lobby/2395/ INFO about ARC5 SW transmitters from WW2 which can be converted
The Pirate Monitor - great page . for Pirate AM (NOT for beginners!)
http://www.geocities.comlheartland/hills/3764 http://www.mnsinc.comJbrylradio/pirat2.txt
FCC Enforcement comments. NLNR 101 .9 MHz FM in Seattle, WA. Is it Legal? Willi get caught? The FCC and Pirates !
http://www.geocities .comlHollywood/HiIIs/8244 http ://www .mnsinc.comJbrylradio/pirate.txt
KISS 102FM in Georgia MY FREE RADIO FAQ my copy available here!
http://www.geocities.comlResearchTriangle/Lab/1635/equip.html http://www.mnsinc.comJbry/xtalpage.htm
AM transmitter schematics for 550-1700 kHz band! Buy and sell crystals for your (Medium Wave) AM band transmitter.
http ://www .geocities.com/SunsetStriplPalms/3840/icon_com.gif http://www.mole.com
FRHC - Free Radio Hell's Canyon Mole/Richardson - lighting, Grip & Camera Supplies.
http://www.GeoCities.conllSunsetStriplPalmsI9377 http://www.monitor.neV-mycal/mpr/default.html
KPRT Pirate Radio . Mycal 's Micro Radio Page excellent: starting your own FM Pirate Radio
http://www.geocities .comlWestHollywood/6507/pirate.html station.
John Benjamin's Pirate Radio news . http://www.nashville.coml-monte.carroll/mbc.html
http://www.glowbug.comledge/edge.html Monte Carroll: Nashville, TN pirate radio fan.
The Edge - 91 .9 FM in Kansas
54 Volume 1 lssue 1 - Spring 1998 THUD
http://www.netcom.com/-adscapes/new.html http ://www.speedline.ca/-glen/
Pirate radio Web pages! Glen's Pirate Radio Site. Glen's Pirate Radio Site.
http://www.netwrx.neVbsi http ://www.summitmedia .com/hitech/
Broadcast Software International - Digital Studio and Other Broadcast Hi-Tech Enterprises, Inc - Dealers of used/new broadcast video eqpt.
Related Software . http://www .surf.com/-graharn/
http://www.northcountryradio .com Legal Briefs filed in the Stephen Dunifer "Pirate" case .
Pirate supplies from North Country . http://www.svetlana.com
http://www.npsnet.com/leblanc/ Svetlana - Tubes.
LeBlanc - Supplier. http ://www.swt .edu/SunsetStrip/Lounge/8311
http://www .omen.com The Dissent Show .
Radio Free Moscow http://www .tek.com
http://www.panasonic.com Tektron ix - Product Information.
Panasonic - Products Division. http://www .teleport .com/-mmarcus/AMINFO/AM_lnfo.html
http://www .paranoia .com/-filipg A less expensive route to AM transmitting!
Latest update to the FREE RADIO FAQ, IF he is still doing it! http://www.teleport .com/-mmarcus/crrsw.html
http://www.paranoia .com/-filipg/HTMULlNKlF_FM10.html Columbia River Radio Shortwave - 13560 kHz (22 Meter Band) .
Ramsey FM10FAQ http://www.theoffice.neVbarbier
http://www.paranoia .com/-filipg/HTMULlNKlF_FM10_more.html Reinier de Barbier's FREE-RADIO-FADING site (Dutch FM pirate w/
A great guide to transmitter kits. FAQ: Low Power FM Broadcast photos) .
transmitters. Low Power Transm itter Kit Sources FAQ http://www.threethirtysix.org/pirate/
http://www .phlat.com/bk .shtml Media Pirate's Network Media Pirates Network . The Media Pirates
PORTAL63 - Coming Soon : FM and SW transmitter Schematics . Network!
http://www .pi.neV-freak55/home.html http://www.thud.org/mutiny.htm
Pirates & more! PIRATE RADIO is alive! Radio Mutiny in Philadelphia .
http://www.powergold .com http://www .tiac.neVusers/jcrose/zeplist.html
Powergold - Music Scheduling Software. Zephyr - Audio Codec Manufacturer.
http://www .pp.hogia .neVjonny/fr/kiwi .html http://www .tip.nl/users/henk.leppers/
History of KIWI Radio Henk Leppers Pirate Mediapage.
http ://www.pp.hogia .neVjonny/index.html http://www.toshiba .com
SRS The Swedish Report Service Toshiba - Equipment Manufacturer.
http://www .proaudio .com/ http://www.tucker.com/
Crouse-Kimzey Company - Equipment Supplier. Tucker Electronics - New and Used Test Equipment.
http://www.radio-online.com/radioearth http://www .tv36.com/buffalo .html
AIRWARE - Showprep Software From Corey Deitz. Radio Newyawk International defunct pirate station . Real Audio clips
http://www.radi0101 .de/radi0101/index-e.html soon . Radio Newyork International Famous offshore station . Not much
RADIO 101 - a cool Euro-pirate rock station on 27 MHz Shortwave . here, but promises Real audio clips in the future .
http://www .radi04all .org http://www .users.dircon.co.uk/- tomgrady/
Radio 4AII This one's packed with the latest info and a wonderous Tom Grady, G61GA's Ham Radio, Scanning & pirate site .
collection of links . http://www.v-soft .com
http://www.radi0510 .org V-Soft Communications - Doug Vernier AM/FMITV Engineering
RADIO 510 International, from Europe . Software.
http://www.radioresources .com http://www .vcnet .com/qvi/om i.html
Steve Scarborough's Radio Resources , Baltimore, MD Go to Omnicron Video - AudioNideo Duplication Accesso ries .
"preowned showroom" http://www.vtpinc.com
http://www .rain.org/-dschmidV Videotape Products , Inc. - Broadcast & Ind. Video Equipment Dealer.
D. Schmidt (FM pirate gear) Seller of transmitters etc . http://www.webcom .coml-ljvideo
http://www.ramseyelectronics .com LJ Video Engineering - Equipment Rental & ; Services .
Ramsey Home Page Ramsey Electronics AA-25 transmitter for AM http://www.wenzel .com
Broadcast ing. Wenzel Co. Crystal Oscillators & RF modules .
http://www.rdrop.com/users/billmc/khog/khog .html http ://www.worldonline .nl/-doublez
KHOGBiography A Dutch Pirate station with great links .
http://www .reelradio .com/ http://www1.tip .nl/users/t668302/index.html
Real Audio On-ai r samples of old TOP40 DeeJays! Radio Free Holland Popular European SW pirate station) cool
http://www.rell.com homepage.
Richardson Electronics - Tubes and Semiconductors . http://zephyr .com
http://www .rfspec .com/ TELOS Systems - ISDN & Telephone interfacing equipment.
R F Specialties - Broadcast Equipment Supplier. mailto :sales@belar.com
http://www.rfspec .com/crl/mbI100 .htm Belar Electronics Laboratory - Send Mail to Belar - Monitoring
Sales page with info about AM BC transmitters . Equipment.
http://www.rootsworld.com/rw/feature/rrb.html news :alt.radio .pirate
FREE RADIO PRESS: An AWESOME site wlTONS of info! alt.radio .pirate Newsgroup . alt.radio .pirate. You've got questions,
http://www.rule.com they've got opinions .
Rule Broadcast Systems, Inc. - Equipment Rental.
6.500 MHz "Red Box" Crystals
BLOWOUT ECS gUARTZ CRYSTALS
HC ·49/US
.142~
Q:+=~JJT
.78! 1 .197
~
.0 17
PRICES!
S,.c .f ..: .Ii_", ~
fteq .. M.,
0,., .li" II
In~r.rw:'L AI
'I""P "••ge
::.. 1
! U ' / tI."
• I) n 1IIIIn (til . 1') ''(
• l ue llilm 1,, :111 o -r l~: • Ii) -t,; Olive t ..·.I · 1:nW.
The crystal used to make the infamous "Red Box" is available now at a
reasonable price . These are very small & perfect for limited space applications .
We've been selling the $4.00 + $1.00 s/h
6.500MHz crystals for
Channel 21 "D.i~J,ey"Filters
several years now! This is the very notch filter used to receive The Disney Channel on Paragon
Systems in Southern Californ ia. They try to charge $150 for this sucker!
Order YOURS TODAY! $20.00 + $2.00 s/h
PVS you need Zenith Remotes, we got 'em!
If
/fyou need those hard to find 6.500MHz Xta/s, we got 'em!
P.O. Box 1032 /fyou need channel 21 (Disney) notch filters, we got 'em!
Los Alamitos, CA 90720 If you need it, CALL US TODA Y!
THUD Volume 1 Issue 1 • Spring 1998 55
On this page are pictures
of a few tools and other
things we think you may
find useful. Above, to the
right and left of this text
you see a total of 5
pictures . The security
sleeve tool is used by the
cable company to tighten
down 75 ohm F-
connectors (and the trap
filters) fitted with special
"sleeves" that you cannot
remove using normal
wrenches or pliers.
To the left and right of this
text you will find the
Gilbert tool pictured. The
Gilbert tool is a special
security tool used to
terminate unused ports
along the cable line so
people cannot simply
"plug in" and get free
cable. Note how the tool
works .
To the left, we have a
Harris TS-22 linemans test
set pictured. It's also
known as a beige box ,
more or less. Pictured on
the right, we have two
Progressive Electronics
tone generators - the 77M
(smaller unit) and the
100A (the larger unit)
Pictured on the left is what
cable TV field techs are
equipped with. It's called a
"Star Key" tool. This is the
sucker that opens up the
boxes mounted on the
walls (if a padlock is not in
use). On the right is a
crimper with cable TV type
F connectors.
56 Volume 1 Issue 1 - Spring 1998 THUD
Cool·Book List .
Computer Security Basics Complete Lan Security and Control
Author: Deborah Russell and G.T. Gengemi Sr. Author: Peter Davis
Publisher : O'Reilly & Associates, Inc. Publisher: Windcrest / McGraw Hill
Copyright Date: 1991 Copyright Date: 1994
ISBN: 0-937175-71-4 ISBN : 0-8306-4548-9 and 0-8306-4549-7
This is an excellent book. It gives a broad overview of Network Security
computer security without sacrificing detail. A must read for Author: Steven Shaffer and Alan Simon
the beginning security expert. Publisher: AP Professional
Copyright Date: 1994
Computer Security Management ISBN: 0-12-638010-4
Author: Karen Forcht
Publisher : Boyd and Fraser Applied Cryptography: Protocols, Algorithms, and
Copyright Date: 1994 Source Code in C
ISBN: 0-87835 -881-1 Author: Bruce Schneier
Publisher: John Wiley & Sons
Information Systems Security Copyright Date: 1994
Author: Philip Fites and Martin Kratz ISBN: 0-471-59756-2
Publisher : Van Nostrad Reinhold
Copyright Date: 1993 Bruce Schneier's book replaces all other texts on
ISBN: 0-442-00180-0 cryptography. If you are interested in cryptography, this is a
must read. This may be the first and last book on
Practical Unix Security cryptography you may ever need to buy.
Author: Simson Garfinkel and Gene Spafford
Publisher : O'Reilly & Associates, Inc. Cryptography and Data Security
Copyright Date: 1991 Author: Dorothy Denning
ISBN: 0-937175-72-2 Publisher : Addison-Wesley Publishing Co.
Copyright Date: 1982
Finally someone with a very firm grasp of Unix system ISBN: 0-201-10150-5
security gets down to writing a book on the subject. Buy this
book. Read this book. The Little Black Book of Computer Viruses
Author : Mark Ludwig
Firewalls and Internet Security Publisher: American Eagle Publications
Author: William Cheswick and Steven Bellovin /' Copyright Date: 1990
Publisher: Addison Wesley ISBN : 0-929408-02-0
Copyright Date: 1994'
ISBN : 0-201-63357-4 The original, and still the best, book on computer viruses. No
media hype here, just good clean technical information.
Un ix System Security
Author: Rik Farrow Computer Viruses, Artificial Life and Evolution
Publisher: Addison Wesley Author : Mark Ludwig
Copyright Date: 1991 Publisher: American Eagle Publications
ISBN: 0-201-57030-0 Copyright Date: 1993
ISBN: 0-929408-07-1
Unix Security: A Practical Tutorial
Author: N. Derek Arnold Computer Viruses, Worms, Data Diddlers, Killer
Publisher: McGraw Hill Programs, and Other
Copyright Date: 1993 Threats to Your System
ISBN: 0-07-002560-6 Author: John McAfee and Colin Haynes
Publisher: St. Martin's Press
Unix System Security: A Guide for Users and Systems Copyright Date: 1989
Adiministrators ISBN: 0-312-03064 -9 and 0-312-02889-X
Author: David A. Curry
Publisher: Addison-Wesley The Hacker Crackdown: Law and Disorder on the
Copyright Date: 1992 Electronic Frontier
ISBN: 0-201-56327-4 Author: Bruce Sterling
Publisher : Bantam Books
Unix System Security Copyright Date: 1982
Author: Patrick H. Wood and Stephen G. Kochan ISBN : 0-553-56370-X
Publisher: Hayden Books
Copyright Date: 1985 Bruce Sterling has recently released the book FREE to the
ISBN: 0-672-48494-3 net. The book is much easier to read in print form, and the
paperback is only $5.99. Either way you read it,
Network Security Secrets you will be glad you did. Mr. Sterling is an excellent science
Author: David J. Stang and Sylvia Moon fiction author and has brought his talent with words to bear
Publisher: IDG Books on the hacking culture. A very enjoyable reading
Copyright Date: 1993 experience.
ISBN: 1-56884-021-7
Cyberpunk
Not a total waste of paper, but definitely not worth the $49.95 Author: Katie Hafner and John Markoff
purchase price. The book is a rehash of previously published Publisher: Simon and Schuster
information. The only secret we learn from Copyright Date: 1991
reading the book is that Sylvia Moon is a younger woman ISBN: 0-671-77879-X
madly in love with the older David Stang.
THUD Volume 1 Issue 1 . Spring 1998 57
The Cuckoo's Egg The Day The Phones Stopped
Author: Cliff Stoll Author: Leonard Lee
Publisher: Simon and Schuster Publisher: Primus I Donald I Fine. Inc.
Copyright Date: 1989 Copyright Date: 1992
ISBN: 0-671-72688-9 ISBN: 1-55611-286-6
Hackers: Heroes of the Computer Revolution Total garbage. Paranoid delusions of a lunatic . Less factual
Author: Steven Levy data that an average issue of the Enquirer .
Publisher: Doubleday
Copyright Date: 1984 Information Warfare
ISBN: 0-440-13495-6 Author : Winn Swartau
Publisher: Thunder Mountain Press
Secrets of a Super Hacker Copyright Date: 1994
Author: The Knightmare ISBN: 1-56025-080-1
Publisher: Loompanics
Copyright Date: 1994
ISBN: 1-55950-106-5
HACK
The Knightmare is no super hacker. There is little or no real
information in this book. The Knightmare gives useful advice
like telling you not to dress up before going
"T HE
trashing. The Knightmare's best hack is fooling Loompanics
into publishing this garbage. WORLD·,'
So, you have some piece of equipment you
Regular
000Phillips Hex Security
Hex
want to open up, but you have no idea
what the hell that little fastener is? There
are all sorts of oddball screws (screw
balls?) out there and here's a sample of
some of them.
o
Use the Regular and Phillips diagrams to
get an idea of how the diagrams work for
00
the rest of the screw/bit types you're
unfamiliar with. The white part of each
diagram is where the bit fits into the
screw. The Black portion of the diagram is
Torx Secu rity Scrulox/ Security the base of the screw that the bit is
Torx Robertson Scrulox surrounded by when the bit is inserted.
It'll make sense after awhile.
Often, you will find Spanner screws used
to hold wall plates in place at schools...
primarily in bathrooms.
Internal Security External Spline You will find Security Torx screws used in
Line Head Line Head Line Head all the ST-1600 thru ST-2500 cable boxes.
External line head screws are really
unusual. Or are they? Check out Super
Nintendo, Nintendo 64, Gameboy, Pocket
Gameboy, SNES Carts, N64 Carts,
Gameboy Carts, Sega Genesis, etc, etc
Mostly, if not entirely, Japanese made
Spanner Spanner Torq-set Posidrive home video game systems.
Do you want some of these? Do you need some of these? It'd be a good idea to stock up
just to have them handy in case you do happen to need them some day . Find them at the
following locations:
Jensen Tools, Inc. Parts Express
(800)426-1194 (800)338-0531
http://www.jensentools.com http://www.parts-express.com/
Tri-wing
58 Volume 1 Issue 1 - Spring 1998 THUD
Electronics & Computers Surplus City
EIO is a versatile electronics surplus source
associating information with the distribution
of electronics, computer and
optical materials. We have implemented
interactive via e-mail, technical forums on
Liquid Crystal Displays, Charge
Couple Devices, Stepper Motors, Lasers,
Laser Light Shows, Microcon trollers,
Holography, Fiber Optics, Electro-Optics
and ECSC Products with many more forums
to come. We boldly supply links to
competitors, revealing alternate and
additional sources of surplus electronics,
along with providing a rich listing of
information on events (trade shows, swap
meets, conferences, etc.) and resources
such as web sites, magazines, newsgroups,
and information of interest to the
technologically inclined.
./ Tra nsistors LED's Softwa re ./ Network equipm ent
Resistors Wire Hard drives ./ Monitors
,/ Capacitors Connectors Surplus equ ipment ./ Printers
,/ Inductors Compu ters RAM ./ Hardware
,/ IC's galore! Lasers EPROMs ./ Modems
./ Switches Racks NOS (New Old Stoc k) ./ Sockets
,/ Lights Cases Telephones ./ Tons of "obsol ete" stuff!
lectronics and Computers Su rp lus City (ECSC)
1490 W. Artesia Blvd, Gardena, CA 90248
(800) 543-0540, (310) 217-802 1 FA X :(310) 217-0950
St ore Hours: Mon. t hrough Sat ., 10 AM - 6 PM
http://www.eio.com/
SUBSCRIBE
r------------------------ - -
TO DAYI (T hat means NOW!)
mup NagdZln8 SuP.fcn)l/ilJl1 Cdrl
We suggest that you photocopy this coupon, fill it out and send it to us in the ma il with your payment option.
V111
) Please send me a 1 year subscription of THUD Magaz ine (4 quarterly issues) for $20
) Please send me a 2 year subscription of THUD Magazine (8 quarterly issues) for $40
) Please send me a 3 year subscription of THUD Magazine (12 quarterly iss ues) for $54 (10% discount)
) My Check is enclosed ( ) Money Order enclosed ( ) Bill my Cred it Card:
) MasterCard ( ) Visa ( ) American Express ( ) Discover
Name : _ Company: _
Address: City: St : Zip: _
Card#: _ Exp Date: _ Phone: _
Signature: _ DL#: (Required for cred it card purchases)
THUD Magazine
E-Mail Address: _ P. O. Box 2521
Cyppress, CA 90630
Please enclose this card in an envelope for privacy. Copyrig ht 1998 THUD Magazine . . Canadia n orders add $4 u.s. per year. Other fo reign orders add $15 u.s.
per yea r. Please aI/ow 6-8 weeks for delivery offirs t issue.
~----
THUD ------------ - ----
Volume 1 Issue 1 - Spring --
1998 - - - - - - - - - - -
59