[00:04.220 --> 00:06.180]  And this session is pagers.
[00:07.400 --> 00:19.980]  Most people have them, but few people really know what they're all about and exactly how they work, and I'm even going to talk about setting up your own paging system and some little tricks you can do with setting up your own paging system.
[00:20.780 --> 00:25.260]  I'm going to start by just giving a basic overview on how pagers work.
[00:31.100 --> 00:32.660]  Excuse the atrocious handwriting.
[00:42.130 --> 00:46.870]  Okay, that's a really basic, basic diagram of how a paging system works.
[00:47.690 --> 00:49.390]  It starts with a telephone.
[00:49.750 --> 00:52.390]  A person picks up his phone and dials the paging system.
[00:52.930 --> 01:02.050]  It then goes into a computer system which will receive the touch tones and convert it to a format that can be sent over the air efficiently.
[01:03.110 --> 01:06.330]  Usually paging systems, they have several different formats.
[01:06.530 --> 01:09.090]  The most common is just basic ASCII data.
[01:09.550 --> 01:11.790]  That's sent free of frequency shift keying.
[01:12.030 --> 01:17.650]  It then goes to a radio transmitter which then sends it out over the air.
[01:18.850 --> 01:23.190]  And then when your pager receives it, your pager goes off.
[01:23.750 --> 01:26.490]  It's pretty basic when you really look at it.
[01:27.050 --> 01:28.550]  Now looking inside a pager...
[01:38.170 --> 01:40.570]  Okay, as you can see there's really not a lot to them.
[01:41.150 --> 01:49.790]  A pager is basically an antenna, a really small antenna hooked into a radio receiver, the output of which goes to a demodulator decoder.
[01:49.790 --> 01:52.850]  And that'll just sit there as long as you have it on.
[01:52.990 --> 01:57.750]  It'll wait for your specific serial number for your pager which is called a CAP code.
[01:58.110 --> 02:03.810]  When it receives your CAP code, that little decoder modulator turns itself on and receives your data.
[02:04.130 --> 02:10.010]  Your phone number if you have a numeric pager or if you have one of the alphanumeric ones, you can get a complete message.
[02:10.010 --> 02:14.690]  And when it receives it, it then alerts you through an alerting system.
[02:14.890 --> 02:22.490]  Pagers usually have a buzzer, a vibrator or a beeper, audio beeper that goes off.
[02:22.730 --> 02:25.310]  And that's basically how it works.
[02:25.310 --> 02:27.030]  As you can see it's fairly simple.
[02:27.550 --> 02:29.270]  There are different types of pagers.
[02:39.000 --> 02:42.380]  Okay, starting the first pagers that came out were tone only.
[02:43.360 --> 02:45.720]  The pager got the code and it beeped.
[02:45.720 --> 02:47.480]  You didn't know who beeped you.
[02:47.660 --> 02:49.980]  All you know is that someone was trying to get in touch with you.
[02:50.520 --> 02:53.620]  These were typically hooked into answering machines.
[02:54.400 --> 02:59.700]  And when someone called your answering machine, a little black box would then call your pager and page you.
[02:59.880 --> 03:06.240]  Or doctors used them because the only person that would be paging the doctor would be his office so he'd know how to call his office.
[03:06.920 --> 03:11.800]  Then someone got the bright idea to actually market an answering machine with a pager.
[03:11.800 --> 03:18.660]  Actually marketing a voicemail system with a pager and that came out to be a tone VRS pager.
[03:18.780 --> 03:20.800]  VRS stands for voice response system.
[03:21.120 --> 03:24.900]  When you call it up, it's just like an answering machine or a voicemail account.
[03:25.120 --> 03:29.020]  You get the person's message and they prompt you to leave yours.
[03:29.280 --> 03:39.780]  You leave it and then the person gets paged and that tells the person to call his VRS system and retrieve his messages just like a voicemail.
[03:40.640 --> 03:49.840]  There's then a voice paging system which isn't seen much in commercial use but a lot of public safety agencies still use it.
[03:50.580 --> 03:56.900]  And with that system you call it up, it picks up the phone and you are on the air.
[03:57.120 --> 04:06.240]  It sends out the CAP code for the pager, opens up a channel to the airwaves and whatever you say goes out over the guy's pager.
[04:06.240 --> 04:09.220]  It also goes out to anyone else who happens to be listening in on a scanner.
[04:10.980 --> 04:17.700]  Then you have the display pagers which are the numeric and the alphanumeric pagers which I'm sure everyone here is familiar with.
[04:17.800 --> 04:24.480]  Those are the ones where you either call and enter in your phone number at which point the person is paged with the phone number that you're calling.
[04:24.480 --> 04:28.620]  You can also enter in a little up to 14 digit numeric code.
[04:28.620 --> 04:30.720]  So you can even send short little messages with it.
[04:31.580 --> 04:41.440]  And then there are the alphanumeric pagers which you call up and the operator asks you for the pager code and you give it to her and you tell her the message and then they go and page the person.
[04:47.510 --> 04:54.830]  Okay, now that you know how easy, basically how simple pagers are, there are a number of ways you can set up your own paging system.
[04:55.790 --> 05:01.010]  Radio Shack will sell you one for $100 which is a basic tone pager.
[05:01.970 --> 05:05.370]  Get a little paging terminal, it actually works on the CB band.
[05:05.930 --> 05:12.290]  And you can get, with a decent antenna, about a 20 mile range out of it under the best of conditions.
[05:12.290 --> 05:13.770]  Typically it's about a mile.
[05:15.830 --> 05:23.070]  Quarter wave whip, which would be about, let's see, about three meters high.
[05:26.430 --> 05:28.570]  So you're talking about a nine foot high antenna.
[05:29.650 --> 05:33.470]  And you can get a 20 foot range on those CB tone pagers.
[05:34.210 --> 05:44.470]  You can also set up your own voice paging service if you have any type of radio transceiver that's capable of setting up, sending out any type of signaling.
[05:44.810 --> 05:47.790]  I have a system like that here, which I'm going to demonstrate.
[05:49.450 --> 05:58.910]  And it will... you're basically opening up a frequency, sending in a code, and then the unit will open up its receiver and you can send a message.
[05:59.330 --> 06:01.530]  And if Adam is out there...
[06:03.470 --> 06:04.030]  Okay.
[06:04.530 --> 06:07.650]  Now I've set this up on an amateur band frequency.
[06:08.310 --> 06:12.450]  It's probably one of the best places to do this because you can run a decent amount of power.
[06:12.630 --> 06:17.390]  It does require a license, but the no code technician license is very easy to get.
[06:18.570 --> 06:25.610]  And basically most modern transceivers will have a function called digital code squelch.
[06:25.710 --> 06:27.370]  And that is basically a pager.
[06:27.770 --> 06:31.250]  Your receiver sits there and it waits for a code.
[06:31.250 --> 06:32.950]  In this case, they're using touch tones.
[06:33.950 --> 06:36.690]  And Adam just keyed up with my touch tone code.
[06:38.810 --> 06:39.290]  And...
[06:39.290 --> 06:39.910]  Hello, man.
[06:40.150 --> 06:41.290]  I just got paged.
[06:46.170 --> 06:47.670]  So do I have any questions?
[06:51.160 --> 06:51.800]  Go ahead.
[06:51.800 --> 06:52.180]  Certainly.
[06:52.540 --> 06:55.780]  I apologize to your audience here, but this is slightly off topic.
[06:57.060 --> 07:01.820]  If you could, Mr. Icom, explain to me exactly the circumstances of your involvement.
[07:02.080 --> 07:09.580]  And Mr. Ken Citarella,, the Westchester County Assistant District Attorney, could you explain any of this to us?
[07:10.280 --> 07:22.020]  Well, Mr. Pinz, why don't you explain your involvement in a covert military project called Project Marigold, which, as I've been told, is an anti-hacker COINTELPRO activity.
[07:22.200 --> 07:23.930]  And while you're at it, why don't you...
[07:24.680 --> 07:25.700]  Can I come up here with you?
[07:27.240 --> 07:28.240]  You can speak.
[07:28.620 --> 07:30.960]  You can get on and you can speak.
[07:31.140 --> 07:34.580]  Or why don't you talk about where you're getting your funding for PNet?
[07:37.580 --> 07:38.280]  What do you mean?
[07:39.480 --> 07:40.700]  From my internet side?
[07:40.700 --> 07:41.480]  Yeah.
[07:42.460 --> 07:50.740]  Apparently, from what's been seen, people are wondering how you're getting all these points of presence and not getting any money in on it.
[07:54.120 --> 07:55.880]  Unless you believe that I have one.
[07:55.980 --> 07:57.940]  We have one, let's say, two points of presence.
[07:58.480 --> 08:01.780]  Cheshire, Connecticut, Hartford, Connecticut, and, of course, Paul Horowitz.
[08:03.780 --> 08:06.960]  But actually, what I see is you're dodging the entire question.
[08:07.060 --> 08:15.020]  Well, Mr. Pinz, if you want to talk about the PumpCon event, what about you putting my handle on the system that you hacked into?
[08:15.440 --> 08:17.040]  I do not deny that.
[08:17.500 --> 08:18.860]  You were in the same room with me.
[08:19.120 --> 08:21.160]  I have actually pled guilty to this.
[08:21.700 --> 08:22.840]  And I'm currently out of probation.
[08:24.640 --> 08:27.240]  I would actually like to know how...
[08:27.240 --> 08:33.620]  So, why did you go and put someone's handle on a system that you just hacked into?
[08:33.840 --> 08:36.260]  It seems that would be a violation of hacker ethics.
[08:39.320 --> 08:39.840]  Damn!
[08:42.760 --> 08:43.640]  Let's go!
[08:49.440 --> 08:51.200]  So we can go back to your footage, just slightly.
[08:52.880 --> 08:56.120]  Could you please repeat the question as I was speaking to someone else at the time?
[08:57.180 --> 08:57.700]  Which question?
[08:58.060 --> 08:59.200]  Whatever you just said.
[09:00.460 --> 09:04.240]  Well, what about you putting your handle on the system that you hacked into?
[09:04.660 --> 09:07.340]  That would seem to be a violation of hacker ethics, don't you think?
[09:09.540 --> 09:11.500]  Mr. Icom was in the room with me.
[09:12.940 --> 09:14.840]  It was pretty much just like a joke.
[09:15.340 --> 09:18.200]  He was also present at a conference prior to.
[09:19.300 --> 09:21.580]  And some other systems had been violated.
[09:21.800 --> 09:24.640]  And it was kind of some of the same types of things.
[09:24.760 --> 09:25.860]  It was mostly just a big joke.
[09:26.980 --> 09:30.120]  There were three accounts added to this RS6000.
[09:31.180 --> 09:35.780]  One was my handle, which, of course, in haste, I typed wrong.
[09:35.920 --> 09:39.480]  And instead of coming out Icom, it came out I-X-O-M with the letter U.
[09:40.420 --> 09:46.360]  There was one by the name of the conference that happened to be being held, which was PumpCon and, of course, Mr. Icom.
[09:47.540 --> 09:53.460]  The company that was involved with this was Bob's Stores, which is just a retail chain in Connecticut.
[09:53.940 --> 10:00.620]  And, of course, they had an A-I-X system with a nice announcement that said, Welcome to Bob's A-I-X and the version number and stuff.
[10:00.800 --> 10:02.300]  And an unpassworded root account.
[10:05.700 --> 10:19.040]  This company, of course, along with the district attorney, I was facing ten felony counts, including three forgeries, because Mr. Thomas Icom was the first person to be arrested at this conference because he had an illegal weapon.
[10:20.600 --> 10:24.520]  Being military, in that he was in the reserve, I don't know if he still is.
[10:24.840 --> 10:25.900]  It's not really relevant.
[10:25.900 --> 10:30.360]  But the military police had to come in and, you know, he had to...
[10:30.980 --> 10:36.080]  He was pressured into talking about what I had been doing when they entered the room.
[10:38.480 --> 10:44.340]  Well, Ron, as I recall it, you did put my handle on the system, which is a violation of hacker ethics.
[10:44.480 --> 10:47.800]  Now, I don't know what you were trying to do because I certainly didn't ask you to put it on the system.
[10:47.900 --> 10:51.260]  As far as me getting arrested for an illegal weapon, that never occurred.
[10:53.920 --> 10:58.620]  So, is the reason that you were not arrested because of your rollover?
[10:59.680 --> 11:00.900]  None of that ever occurred.
[11:01.940 --> 11:12.080]  So then, Mr. Ken Citarella, Kenneth Citarella, the assistant district attorney for Westchester County, is in fact lying to me in saying that you were going to be the key witness.
[11:13.020 --> 11:16.960]  Anything that occurred between you and Kenneth Citarella is your business and I was not privy to it.
[11:18.960 --> 11:20.260]  You're dodging the question.
[11:20.460 --> 11:29.080]  I asked you if Ken Citarella was lying to me when he told me that you were going to be the key witness in my trial.
[11:29.440 --> 11:30.980]  For all I know, he could have been.
[11:36.440 --> 11:40.540]  Okay, I don't know how to respond to that one actually because that's just really weird.
[11:40.920 --> 11:44.840]  But actually, folks, you could try leaving, Ron.
[11:45.980 --> 11:48.880]  Well, for those people, excuse me, excuse me.
[11:48.980 --> 11:55.300]  For those people that did see what happened earlier between two other people, who shall remain nameless?
[11:56.200 --> 11:57.440]  I'm not pushing him.
[11:57.600 --> 11:58.480]  I haven't hit him.
[11:58.580 --> 11:59.880]  I'm not a violent person.
[11:59.880 --> 12:01.000]  I know he isn't himself.
[12:02.240 --> 12:05.580]  I, myself, I'm on three years probation, no big deal.
[12:07.600 --> 12:09.420]  I had to pay a thousand dollars.
[12:09.500 --> 12:16.400]  It's a good thing that you're on three years probation because you are disrupting the conference and we would like you to leave.
[12:16.840 --> 12:17.080]  Okay.
[12:18.360 --> 12:18.540]  What?
[12:19.360 --> 12:20.240]  Excuse me.
[12:22.180 --> 12:24.200]  Would they like me to step down?
[12:25.040 --> 12:30.680]  I just want to say that I for one actually am interested in hearing a little more about this whole celebrated PumpCon.
[12:31.520 --> 12:32.860]  There's this PumpCon action here.
[12:34.480 --> 12:36.800]  As we all know, yes, Ixom here.
[12:37.460 --> 12:41.760]  When we were doing registration, I found his sheet and we finally said, hey, look, it's Ixom.
[12:41.920 --> 12:46.120]  I mean, I can't even, I don't want to insult you or anything, but he's a funny guy.
[12:47.320 --> 12:48.100]  And Tom here.
[12:48.280 --> 12:49.640]  I mean, there's no parallel for Tom.
[12:50.700 --> 12:53.820]  And all I can say is I'd love to see maybe some sort of panel thing.
[12:54.760 --> 12:57.060]  I don't know if you guys want to talk it out in front of everyone.
[12:57.140 --> 12:58.120]  I don't know if that's cool with you two.
[12:58.520 --> 12:59.940]  I don't know how you feel about that, Tom.
[12:59.940 --> 13:01.040]  I know Ixom is...
[13:01.040 --> 13:01.700]  Yeah, I think that's...
[13:01.700 --> 13:02.740]  Do you want to do like a panel thing?
[13:02.960 --> 13:04.040]  No, I don't have it with other people.
[13:04.140 --> 13:04.720]  Okay, right.
[13:04.860 --> 13:05.700]  Like I said...
[13:05.700 --> 13:05.700]  Right.
[13:05.860 --> 13:06.180]  Okay.
[13:06.560 --> 13:09.720]  And so I was going to say that maybe we could schedule something for a little later.
[13:10.000 --> 13:10.620]  How's that sound?
[13:10.640 --> 13:12.180]  How many people are going to be here later on in the evening?
[13:12.920 --> 13:13.580]  You want to come?
[13:14.840 --> 13:15.800]  See them duke it out?
[13:16.980 --> 13:17.420]  All right.
[13:17.980 --> 13:19.180]  Hold on, I just want to make this note.
[13:20.020 --> 13:25.780]  The open mic time got eaten because that's why we're only one hour behind schedule now because we were...
[13:26.580 --> 13:28.660]  Previously, we were much farther behind.
[13:28.660 --> 13:31.960]  Okay, then I'm sorry if I delayed it slightly.
[13:32.200 --> 13:32.460]  No.
[13:32.460 --> 13:32.780]  Don't worry, man.
[13:32.860 --> 13:39.700]  Because I am on probation, just so in case anybody here is a fed, I do have my permission slipped to be here for my probation officer.
[13:43.520 --> 13:49.180]  As we know, no one here at HOPE would ever be caught breaking the law.
[13:50.580 --> 13:54.560]  No one here would ever be caught doing anything to a telephone or a computer.
[13:55.060 --> 13:59.800]  And that is why this is a place for law-abiding citizens like Mr. Ixom.
[14:00.520 --> 14:00.720]  All right.
[14:00.840 --> 14:01.300]  Thank you very much.
[14:17.880 --> 14:20.600]  Well, if anyone's have any questions on paging systems?
[14:26.380 --> 14:27.740]  Anything... Which one?
[14:29.820 --> 14:32.680]  Yeah, Adam, if you could... Where is he?
[14:34.700 --> 14:36.020]  No, it's alright.
[14:36.780 --> 14:42.480]  If Adam can key up again on the frequency, we can do another demonstration of it.
[14:47.790 --> 14:48.550]  Go ahead.
[14:51.070 --> 14:57.990]  As you see, he sent me a touch-tone code out, and that waked my receiver off, and now I can hear everything he has to say.
[15:02.570 --> 15:06.030]  You could do it with a regular scanner if you had a touch-tone decoder hooked into it.
[15:09.650 --> 15:12.210]  I'm using an amateur band transceiver right now.
[15:12.410 --> 15:14.410]  Those have built-in digital paging.
[15:14.990 --> 15:19.090]  You can use any type of receiver or any type of signaling format you want.
[15:21.330 --> 15:22.090]  Excuse me?
[15:25.010 --> 15:27.350]  We're signaling with two handband transceivers.
[15:29.470 --> 15:30.170]  Go ahead.
[15:34.710 --> 15:35.810]  It all depends.
[15:36.310 --> 15:41.870]  Now, the system we're using right now has a range of about five miles.
[15:42.730 --> 15:47.250]  If you use more... We're only using five watts into a really low-gain antenna.
[15:47.250 --> 15:49.530]  If you use more power, bigger antenna.
[15:49.970 --> 15:52.270]  If you could find a ham repeater that has...
[15:52.930 --> 15:54.150]  That passes touch-tones.
[15:54.310 --> 15:57.410]  Few of them do anymore because they mute them out for the patch functions.
[15:57.930 --> 16:00.270]  You can go 70, 80 miles without any problems.
[16:00.690 --> 16:00.990]  Go ahead.
[16:04.880 --> 16:08.720]  But you can put up these big blocks with no detail.
[16:09.020 --> 16:12.740]  Something that you can find in, like, you know, a children's program on pagers.
[16:13.620 --> 16:19.780]  Well, we're... I'm trying to keep it simple because I don't know the, you know, how technical the audience is.
[16:19.780 --> 16:20.860]  We aren't modulating.
[16:21.060 --> 16:24.120]  Are we talking amplitude, phase, frequency?
[16:24.840 --> 16:26.260]  What bandwidth is going here?
[16:26.320 --> 16:28.940]  Well, typically, most of that stuff is done with frequency modulation.
[16:29.140 --> 16:33.480]  Because that's the standard for, you know, VHF and UHF where the pagers are at.
[16:36.440 --> 16:43.780]  The data format is sent in FM FSK in which the zeros and ones of the binary signal are...
[16:44.900 --> 16:48.120]  Each, each, the zero is represented by one FM frequency.
[16:48.380 --> 16:53.100]  And then it shifted up a number of kilohertz for the, for the one.
[16:53.400 --> 16:59.680]  On audio frequency shift key, which is another method used on the older pagers, it's done by audio tones.
[17:00.140 --> 17:01.500]  One tone represents a one.
[17:01.660 --> 17:03.300]  One tone represents a zero.
[17:08.200 --> 17:08.720]  Okay.
[17:08.980 --> 17:12.340]  But, you mentioned before it reads the standard ASCII from these notes.
[17:12.840 --> 17:16.500]  Yeah, most of the standard formats that are used for, um...
[17:17.780 --> 17:21.520]  Your POCSAG, which is the most common format, is ASCII data.
[17:25.280 --> 17:26.760]  What's the data sent in?
[17:27.020 --> 17:30.120]  And the standard data, which is POCSAG, is sent in ASCII.
[17:35.130 --> 17:36.230]  You right over there, go ahead.
[17:39.150 --> 17:40.770]  There are three different rates.
[17:41.370 --> 17:46.650]  One is 512 baud, the other is 1200, and now they have a system out which is running at 2400 baud.
[17:47.190 --> 17:53.850]  It's slow compared to some of, you know, most people using modems over the landlines are running at 28.8, 14.4.
[17:54.070 --> 17:59.910]  But it's RF, and it's only 12 characters for a numeric display pager, so...
[18:00.610 --> 18:02.150]  You don't really need a lot of speed.
[18:02.370 --> 18:06.850]  Uh, they do have a basic parity check, but that's it.
[18:08.010 --> 18:08.750]  Uh, go ahead.
[18:15.590 --> 18:20.410]  What kind of security systems are built into the EEPROM on a Motorola advisor?
[18:22.130 --> 18:24.230]  Um, there are none.
[18:24.390 --> 18:25.250]  There's no need for it.
[18:25.810 --> 18:32.390]  Um, the double EEPROM is set up through a programmer, uh, which is hooked into your PC.
[18:33.830 --> 18:35.750]  And there is no, there's no security.
[18:35.910 --> 18:37.370]  You're just programming up a CAP code.
[18:38.230 --> 18:40.490]  You can very easily clone a pager.
[18:41.250 --> 18:51.450]  Uh, if you have, you know, if you have a pager that's, um, you know, programmable through that method, you could easily clone a pager and have two, three, four, even ten pagers on the same frequency in CAP code.
[18:54.710 --> 18:55.230]  Right.
[18:56.830 --> 18:57.950]  Uh, excuse me?
[19:00.610 --> 19:04.350]  Hmm, that's interesting.
[19:04.590 --> 19:06.890]  I haven't had much experience in the Motorola advisors.
[19:07.130 --> 19:10.430]  I was mostly working with Bravo's, and they're fairly easy.
[19:11.350 --> 19:16.590]  Right, because they only have one, one, one CAP code, as opposed to four CAP codes on an advisor.
[19:24.930 --> 19:26.170]  Okay, any other questions?
[19:27.330 --> 19:29.070]  Uh, you back there, go ahead.
[19:34.810 --> 19:37.510]  Um, the data that's being sent out is asynchronous.
[19:40.110 --> 19:40.890]  Excuse me?
[19:44.490 --> 19:47.010]  Yes, regular start and stop in 8-bit format.
[19:47.670 --> 19:48.570]  Anyone else?
[19:50.450 --> 19:52.190]  I just wanted to correct you on one thing.
[19:52.410 --> 19:55.650]  You referred to something being a touch-tone coder.
[19:55.810 --> 19:58.750]  Actually, the correct term for it would be a DTMF.
[20:01.190 --> 20:04.050]  Well, DTMF is the generic name for it.
[20:04.130 --> 20:10.690]  Touch-tone is an AT&T trademark, but DTMF, dual-tone multi-frequency tones and touch-tones are the same thing.
[20:13.610 --> 20:14.450]  Anyone else?
[20:15.750 --> 20:17.070]  Okay, well, thank you for your time.
[20:28.320 --> 20:28.880]  Yeah.
[20:29.000 --> 20:29.220]  Yeah?
[20:29.420 --> 20:31.720]  For the air system and motion connection.
[20:33.460 --> 20:34.380]  What were you doing?