[00:02.220 --> 00:03.820]  Let's get you guys set up.
[00:04.980 --> 00:06.660]  And this is really awesome.
[00:07.060 --> 00:10.640]  Not often one gets to MC for one's heroes but here I am.
[00:11.560 --> 00:18.040]  Ladies and gentlemen, with no further ado, because really ado sucks, here is the panel on Old School Phreaking.
[00:18.180 --> 00:21.300]  May I present Cheshire Catalyst, John Draper, and Tom Santa Monica.
[00:21.580 --> 00:22.240]  Let's hear it for him.
[00:28.030 --> 00:28.690]  Thank you.
[00:31.750 --> 00:32.630]  Thank you very much.
[00:33.530 --> 00:34.010]  Me?
[00:35.290 --> 00:37.310]  Oh, I'm... Johnny come lately here.
[00:37.430 --> 00:38.630]  I came in the 70s.
[00:38.970 --> 00:40.550]  You guys were a lot earlier than me.
[00:40.810 --> 00:43.110]  I'm also the 70s.
[00:43.290 --> 00:44.170]  Is this microphone?
[00:44.470 --> 00:45.030]  Yeah, there it goes.
[00:45.450 --> 00:46.830]  Yeah, I'm also 1970.
[00:47.750 --> 00:49.030]  Vintage, 70, 71.
[00:49.290 --> 00:58.090]  I actually predate the Esquire article by I guess about nine months when I got visited but I guess been going since the 70s.
[00:58.090 --> 01:07.250]  And my very favorite thing was sort of step-by-steps which is specifically automatic electric full SAT offices Strowger automatic toll ticketing.
[01:08.390 --> 01:13.590]  But then it's sort of ongoing about how we kind of found out about each other and how things happen.
[01:13.710 --> 01:16.210]  And remember, this is before the great Internet explosion.
[01:16.390 --> 01:19.590]  This was when the Internet was still a largely experimental thing.
[01:19.590 --> 01:23.350]  I think just four connections between four universities and that was it.
[01:25.010 --> 01:26.650]  And so we didn't have Facebook.
[01:26.830 --> 01:27.630]  We didn't have Twitter.
[01:27.930 --> 01:28.870]  We didn't have any of that.
[01:28.950 --> 01:31.230]  But we had something else that was kind of bizarre.
[01:31.230 --> 01:32.950]  I actually created for something else.
[01:33.150 --> 01:35.750]  It was phone company loop-arounds.
[01:36.630 --> 01:40.550]  These were numbers that curved in pairs, usually consecutive.
[01:40.990 --> 01:45.110]  In Southern California, they were usually 1118 and 1119.
[01:46.230 --> 01:53.570]  And you would just dial the first number of the pair, sit on it and wait and just see who came on the other side.
[01:53.670 --> 01:54.990]  And some people used it for dating.
[01:55.190 --> 01:59.950]  I remember I was one in Westchester, the 672 line.
[02:00.090 --> 02:02.550]  And I was on there thinking, well, maybe there was some phreak to talk to.
[02:02.550 --> 02:06.150]  And somebody comes on and says, hey, you got a great sounding voice.
[02:06.290 --> 02:07.190]  Would you like to come see me?
[02:07.470 --> 02:08.050]  What do you mean?
[02:08.190 --> 02:09.110]  I said, don't you know?
[02:09.230 --> 02:10.210]  This is the gay line.
[02:10.350 --> 02:11.010]  Oh, okay.
[02:11.110 --> 02:14.370]  I'm really looking for technical information, you know, rather than sex.
[02:14.570 --> 02:16.290]  So I searched around.
[02:16.370 --> 02:19.350]  But anyway, you just kind of had people up there.
[02:19.550 --> 02:27.730]  And in fact, it got to be a problem that I found during this dumpster diving that the phone company was getting a little bit annoyed by this.
[02:27.730 --> 02:30.670]  I don't know if you could read that, but look at 1.04.
[02:31.630 --> 02:39.250]  Unauthorized use of this circuit as a hotline or a means to attempt to avoid toll charges interferes materially with its intended use.
[02:39.410 --> 02:44.050]  And yes, there were some of those loop-arounds that were non-supervising.
[02:44.090 --> 02:47.150]  In other words, they looked like a phone that had never answered.
[02:47.210 --> 02:52.590]  So you could use them to make free phone calls if you just called up at a prearranged time.
[02:52.990 --> 03:00.370]  So anyway, here it gives this thing about the pitch of how to disable it and the technical thing to do it and make all requests on callback places.
[03:00.550 --> 03:05.250]  But all you guys out there that were good at social engineering were able to get around that.
[03:05.270 --> 03:11.590]  So they finally went to this version where they invented the 60A control unit.
[03:11.690 --> 03:20.070]  The 60A control unit was a device that listened for the frequencies other than the 1,000 cycle milliwatt testing tone.
[03:20.570 --> 03:25.350]  Well, okay, that's kind of put the damper on it, but let's see how sensitive it was.
[03:25.350 --> 03:33.030]  Well, if you had your other frequencies or other content, oh, about 18 dB below the 1 milliwatt tone, it wouldn't activate.
[03:33.270 --> 03:34.670]  And you could actually talk on it.
[03:34.830 --> 03:40.870]  And people who were ham radio operators who were used to listening over interference could hear it.
[03:40.910 --> 03:46.750]  But if you wanted to get rid of that annoyance, you just build a notch filter, notch out the 1,000 cycles, and you were good to go.
[03:48.710 --> 04:05.110]  But anyway, this is how I actually met a Spanish-speaking kid, or at least he pretended to be Spanish-only speaking that said, canojos numeros magicos uno dos tres, which I probably killed the Spanish, but basically translated, do you know the magic numbers 1,
[04:05.230 --> 04:05.750]  2, and 3?
[04:05.950 --> 04:09.570]  And I said, cano conosco numeros magicos 1, 2, and 3.
[04:09.570 --> 04:13.630]  So again, my high school Spanish was much less rusty back then than it is now.
[04:13.770 --> 04:31.770]  But bottom line is, he says if you flash the hook switch and dial 1, 2, 3, and then the routing code for your office, you could actually seize control away from the director, which ordinarily figured out how the call was going around, and you were in direct control with your good old rotary dial telephone,
[04:32.750 --> 04:34.210]  the primary switch train.
[04:34.810 --> 04:41.870]  So anyway, here's a little thing I also found in the trash behind the general telephone office that gave you the basic call routing.
[04:42.070 --> 04:43.530]  Okay, how it normally worked.
[04:43.790 --> 04:53.550]  You know, your phone was here, went to connectors, distributing frames down here, operated a line and cuff where the line said, I picked up my phone, I want to get a dial tone.
[04:54.030 --> 05:02.310]  It would move the selector or the line finder over, connect you up, and then the cuff, you would cuff everything so nothing else would get it.
[05:02.310 --> 05:19.670]  It goes over here to the SAT primary selector, which actually was through a director hunter, because one director could be shared, because once you got the call set up with the first three digits, that could go away and handle somebody else's call, but you always stayed on this primary selector for the duration of the call.
[05:20.450 --> 05:26.550]  And if it was a local, if it was a call in the same central office, it went here, fourth selector, fifth selector, connector, et cetera, like that.
[05:26.850 --> 05:32.650]  If it was a call going somewhere else, once the director said, okay, what kind of train does it go through?
[05:32.830 --> 05:39.410]  And larger offices are actually more of these selector switches, so somebody just had to dial two codes.
[05:39.630 --> 05:42.510]  So the director was actually what gave you your phone number.
[05:42.970 --> 05:52.590]  However, if you flashed your hook switch at just the right time, you kicked this little puppy off, and you were left in direct control of this.
[05:53.330 --> 05:54.890]  The ticker was still around.
[05:55.050 --> 06:00.210]  But however, the ticker, instead of having the legitimate number stored in it, it would have one, two, three.
[06:00.950 --> 06:06.170]  And then in the case of Santa Monica, seven, five in, in case you were trying to get a long distance trunk.
[06:06.870 --> 06:12.290]  And then you were on the selector, the repeaters going other offices and all that good stuff to whatever tandem you had set up.
[06:12.830 --> 06:33.730]  In Los Angeles, back in Los Angeles, when 213 was a big area code and covered all of Los Angeles County and part of some other counties, you could dial anywhere in there with just your rotary dial toll-free by just flashing that off, getting the downtown LA grand tandem and just rotary dial pulsing out.
[06:34.850 --> 06:40.230]  Obviously, if you wanted to make a long distance call that went away, you had to have a Blue Box for that.
[06:42.130 --> 06:43.950]  So anyway, what have we got here?
[06:44.390 --> 06:45.010]  Well, let's see.
[06:45.110 --> 06:46.010]  That's about something...
[06:46.010 --> 06:48.830]  Actually, I'm gonna kind of shell out of this if I can.
[06:53.620 --> 06:55.940]  And go a little minimize that.
[06:56.420 --> 06:58.440]  And what am I gonna play here for you?
[06:58.600 --> 06:58.860]  Okay.
[06:59.060 --> 07:00.500]  How sort of step-by-step works.
[07:00.540 --> 07:03.640]  That was kind of important for things.
[07:05.620 --> 07:06.720]  If it would come up.
[07:07.000 --> 07:09.740]  But, you know, demos never work right when you do it live.
[07:09.960 --> 07:10.340]  You know that.
[07:12.840 --> 07:13.320]  Okay.
[07:13.560 --> 07:14.380]  Here it comes.
[07:24.290 --> 07:27.830]  The circuit is connected to contacts controlled by the telephone dial.
[07:28.790 --> 07:35.010]  As the dial is moved off normal for the digit three, no action takes place in the first selector.
[07:35.770 --> 07:40.930]  But as the dial returns to normal, the selector will respond to the dial pulses.
[07:42.730 --> 07:44.730]  It steps up to the third level.
[07:44.990 --> 07:50.850]  And by rotary action, cut in automatically to select an idle circuit to the next selector.
[07:53.090 --> 07:53.650]  Okay.
[07:53.890 --> 07:59.830]  This I'm kind of jumped ahead to explaining one of the pranks that was done during that time.
[08:00.490 --> 08:06.130]  of the Santa Barbara Nuclear Emergency.
[08:07.350 --> 08:11.210]  And that was how a selector normally works.
[08:11.470 --> 08:16.370]  You dial a middle digit of the number, it goes up and it's supposed to go over to the first vacant trunk.
[08:16.370 --> 08:19.170]  We decided to have some fun.
[08:19.390 --> 08:19.710]  Let's do...
[08:19.710 --> 08:24.670]  What if we hook a whole bunch of phone lines in parallel, you know, plus to plus and minus to minus.
[08:24.950 --> 08:28.130]  Nothing will happen because if the polarities are the same, no current will flow.
[08:28.570 --> 08:29.890]  Hook a phone on across it.
[08:30.110 --> 08:32.850]  Pick it up and get like 10 dial tones at once.
[08:34.150 --> 08:36.710]  And we first thought, let's have fun with directory assistance.
[08:36.710 --> 08:40.070]  And we called 4-1-1.
[08:40.410 --> 08:46.030]  And yes, as predicted, we got a whole bunch of directory assistance operators on the line at the same time.
[08:46.730 --> 08:49.490]  And, you know, directory assistance, directory assistance, directory assistance.
[08:51.130 --> 08:52.350]  Can I help you with this?
[08:52.390 --> 08:53.630]  You know, there's something going wrong here.
[08:53.950 --> 08:55.210]  You want to write a report on this?
[08:55.290 --> 08:56.090]  No, I guess I'll do it.
[08:56.190 --> 08:57.050]  And what station are you at?
[08:57.290 --> 08:57.610]  15.
[08:57.770 --> 08:58.430]  Oh, I'm 15.
[08:58.770 --> 08:59.750]  Oh, hi there, Mabel.
[08:59.870 --> 09:00.370]  Oh, hi there.
[09:00.790 --> 09:02.030]  Well, that was kind of amusing.
[09:02.030 --> 09:05.070]  So let's try and do this other places.
[09:05.110 --> 09:11.550]  And then we found that with this, with enough tries by just throwing things out of sequence here...
[09:13.290 --> 09:16.670]  I'll get back to my other thing here.
[09:17.550 --> 09:24.190]  With enough tries of throwing things out of sequence, you can...
[09:26.730 --> 09:29.390]  Here's the internal wiring diagram of a selector.
[09:29.510 --> 09:30.270]  Normally, you come here.
[09:30.390 --> 09:34.330]  Here's the lines and bolder, the actual talk path of what you talk on.
[09:34.330 --> 09:38.670]  And these little symbols here in the photograph were the lower banks.
[09:38.930 --> 09:40.790]  Up here was more of the important part.
[09:40.930 --> 09:45.370]  The control leads and the extra control leads that would either be...
[09:45.370 --> 09:49.530]  If you can follow the schematic here, would be there once it's selected properly.
[09:49.690 --> 09:57.790]  When it's not selected, when it's vacant, it's got battery through a relay coil that here goes to plus 48 volts, and you have 1100 ohm relay coil.
[09:58.750 --> 10:00.410]  And that would normally say that's idle.
[10:00.650 --> 10:01.510]  When you actually...
[10:01.510 --> 10:02.650]  A connector got to...
[10:02.650 --> 10:08.770]  Or a selector got to it and connected that particular circuit, that would ground through here.
[10:08.970 --> 10:10.670]  And the ground said it was busy.
[10:10.670 --> 10:17.970]  However, if two of these landed at exactly the same time, it would goof these relays all out of sequence, and they wouldn't be in the right order.
[10:18.070 --> 10:23.810]  And actually, I believe it was actually the circuit going back this direction that still left you just hanging on the line.
[10:24.390 --> 10:29.630]  Some of the relays down here were in the proper order, so it didn't give what's called a permanent signal to the central office.
[10:29.730 --> 10:31.170]  They had no idea anything was wrong.
[10:31.170 --> 10:34.190]  But this was still shown as being an idle circuit.
[10:34.510 --> 10:40.450]  And if you were fortunate enough that you were kind of one of the first levels to step over, you would get a lot of calls.
[10:40.550 --> 10:45.230]  I later calculated maybe you had a one out of ten chance of intercepting calls.
[10:45.390 --> 10:51.770]  But if a lot of people happened to be calling for that area for a particular reason, you got one out of ten calls.
[10:51.890 --> 10:54.270]  And people would drop in and they wonder what's happening.
[10:54.510 --> 10:59.690]  So the prankster involved decides, oh, let's make up something kind of ridiculous.
[10:59.690 --> 11:01.870]  Like, okay, let's say there's a nuclear emergency.
[11:02.530 --> 11:05.870]  Because this was Santa Barbara they did it to because they had this old equipment to it.
[11:07.010 --> 11:15.310]  And they figured, most people think it's preposterous because at that time the nearest atomic power plant was down in San Ofra, quite a bit of distance from Santa Barbara.
[11:15.830 --> 11:20.670]  So anyway, they said, oh, you know, we must keep these lines clear for emergency use.
[11:21.070 --> 11:22.570]  Please get off the line.
[11:22.710 --> 11:24.250]  And, you know, we did that for a while.
[11:24.370 --> 11:26.290]  And then, well, some funny things started happening.
[11:27.610 --> 11:32.290]  Law enforcement and official governments and agencies starting to calm that line to decide what happened.
[11:32.390 --> 11:33.610]  Well, this is not a good idea.
[11:33.790 --> 11:35.910]  The pranksters decided, well, let's not stick around.
[11:36.030 --> 11:36.710]  Drop the connection.
[11:36.930 --> 11:41.230]  And, of course, immediately once you dropped, the circuit released everything and the whole system was back to normal again.
[11:41.990 --> 11:47.270]  Well, the event made the LA Times the next day and the AP wire service about the nuclear bomb host.
[11:47.370 --> 11:48.590]  And, of course, the phone company was interviewing.
[11:48.930 --> 11:51.110]  We had no idea what went wrong with it.
[11:51.970 --> 11:53.730]  But it seemed to clear itself up.
[11:53.850 --> 11:55.230]  So I guess we're not going to worry about it.
[11:55.250 --> 11:59.370]  Well, we just gave you the reason why that happened.
[12:01.350 --> 12:02.990]  And how much time do I have?
[12:03.450 --> 12:03.930]  Oh, lots.
[12:04.190 --> 12:04.410]  Huh?
[12:05.750 --> 12:06.350]  I'm good?
[12:06.470 --> 12:06.870]  Lots of time.
[12:07.250 --> 12:08.290]  Got more time?
[12:08.470 --> 12:08.570]  Okay.
[12:08.630 --> 12:08.750]  Sure.
[12:09.830 --> 12:10.750]  We're looking for old stories.
[12:10.910 --> 12:11.450]  This is fine.
[12:18.240 --> 12:20.400]  I didn't come in until after the Esquire article.
[12:20.600 --> 12:22.040]  That's what got me involved.
[12:22.040 --> 12:28.720]  Well, of course, before that I was doing things like listening to loops and talking between the beeps of the busy signals, the kinds of things kids did.
[12:28.940 --> 12:31.120]  And it got me interested in the telephone network.
[12:31.120 --> 12:34.080]  So I looked into it a little further than most kids.
[12:34.220 --> 12:37.520]  But really it was after the Esquire article that I really got involved.
[12:38.340 --> 12:41.540]  And I came in around 1969.
[12:42.260 --> 12:44.780]  I was experimenting around with an FM transmitter.
[12:46.280 --> 12:49.080]  And I was into antenna design.
[12:50.380 --> 12:54.420]  And I hooked up the transmitter and played some audio.
[12:54.420 --> 12:59.240]  And I went out driving around to see how far the antenna would pick, you know, send the signal.
[12:59.480 --> 13:03.000]  And I got back home and I said, Anybody hear this?
[13:03.080 --> 13:05.260]  Please call 2648773.
[13:05.420 --> 13:06.960]  And sure enough, I got a call.
[13:07.420 --> 13:08.480]  It happened to be Denny.
[13:09.400 --> 13:16.240]  But the guy gave me a loop around number in the San Jose area that was 0044 and 0045.
[13:16.960 --> 13:22.780]  So he gave me the 44 side of the loop and I called the 44 side because I wanted to get another signal check from him.
[13:22.880 --> 13:24.520]  And I got that loud tone.
[13:24.720 --> 13:28.900]  And I called the phone company up and I said, Hey, I think there's something wrong with this number.
[13:29.280 --> 13:31.960]  And the phone company says, Well, this is a special internal number.
[13:32.020 --> 13:32.720]  How'd you get it?
[13:32.840 --> 13:33.200]  I don't know.
[13:33.540 --> 13:34.640]  This guy gave it to me.
[13:35.060 --> 13:36.420]  And we finally hung up.
[13:36.420 --> 13:39.920]  Finally, he called me back about two weeks later.
[13:40.180 --> 13:43.620]  Because he's got like photographic memory and he remembers the number.
[13:43.760 --> 13:46.380]  He didn't quite remember who the number went to.
[13:46.800 --> 13:49.180]  So I said, Yeah, I'm the guy that did the FM transmitter.
[13:49.340 --> 13:49.500]  Remember?
[13:49.700 --> 13:51.340]  And I said, What's that stupid number you gave me?
[13:51.580 --> 13:53.240]  And he said, Oh, that's a loop around number.
[13:53.340 --> 13:53.720]  What's that?
[13:53.780 --> 13:55.400]  And he tried to explain to me what it was.
[13:55.900 --> 13:57.140]  And I said, Wow, okay.
[13:57.300 --> 13:57.660]  That's cool.
[13:57.940 --> 13:58.880]  Can you make free calls?
[13:59.780 --> 14:03.240]  And he says, Yeah, I was working around trying to find another demonstrator number.
[14:03.240 --> 14:08.520]  Back in the day, there was just getting Touch-Tone service.
[14:08.820 --> 14:10.820]  It's all dial, dial pulse back then.
[14:11.440 --> 14:18.200]  And so we called a demonstrator number, gave a Touch-Tone, dial tone, and then you could Touch-Tone off of that.
[14:18.640 --> 14:19.880]  Local numbers, local calls.
[14:20.020 --> 14:24.200]  Sometimes they would forget and hook it up so you can actually make long distance calls on it.
[14:24.480 --> 14:27.580]  Of course, you wouldn't be able to do that too much because they're going to detect it pretty quickly.
[14:29.160 --> 14:35.100]  So I went out to visit him and I go knocking on the door and his father answered.
[14:35.220 --> 14:36.180]  I said, Is Denny there?
[14:36.340 --> 14:37.280]  Yeah, he's in his room.
[14:37.800 --> 14:40.020]  Go to his room and totally dark.
[14:40.400 --> 14:42.700]  And he says, Hey, can you turn on the lights?
[14:43.280 --> 14:44.400]  Everybody was blind.
[14:44.480 --> 14:45.260]  They don't need lights.
[14:46.280 --> 14:51.060]  So I got a little earful of demonstration of Jimmy.
[14:51.540 --> 14:53.320]  Jimmy, Jim, that's the other is his real name.
[14:54.040 --> 15:01.440]  And Jimmy basically hammered out some multi-frequency tones on his organ and says, Here's what you do.
[15:01.520 --> 15:05.560]  You call this 800 number and you send it 2600 or you can blow the Cap'n Crunch Crunch whistle.
[15:06.140 --> 15:08.260]  Then it wasn't called the Cap'n Crunch Crunch whistle.
[15:08.400 --> 15:09.920]  He says, It's just a whistle to them.
[15:10.120 --> 15:13.200]  It wasn't later on until we called it the Cap'n Crunch Crunch whistle.
[15:14.560 --> 15:18.820]  So he whistled the 800 number off.
[15:18.880 --> 15:19.700]  I went ka-ching.
[15:20.000 --> 15:23.160]  And you could then just dial key pulse, area code number start.
[15:23.580 --> 15:24.780]  And it went through.
[15:25.040 --> 15:25.820]  I said, Oh my God.
[15:26.080 --> 15:27.860]  This nuts can't be that easy.
[15:29.060 --> 15:32.280]  So I went home and built my first Blue Box.
[15:32.280 --> 15:35.100]  It was a six button box.
[15:35.960 --> 15:39.020]  I had to push two buttons at a time to make the tones.
[15:39.300 --> 15:42.580]  And I kind of drew a little diagram on the box there.
[15:42.580 --> 15:45.100]  I didn't have enough diodes to make a diode matrix.
[15:45.620 --> 15:47.100]  But the next couple days I did.
[15:47.640 --> 15:51.100]  But just to play around with it, I was actually proof of performance.
[15:51.320 --> 15:56.520]  I was running back and forth between the piano and the thing to make sure I got the right frequencies once I knew the keys of the piano.
[15:57.420 --> 15:58.380]  And sure enough, it worked.
[15:58.520 --> 15:59.180]  Oh my God.
[15:59.180 --> 15:59.940]  This is crazy.
[16:00.080 --> 16:01.160]  How can it work that easy?
[16:02.020 --> 16:03.060]  So things went on.
[16:03.180 --> 16:11.140]  I started getting more and more experimenting with it and started learning the OCC codes, other common carriers.
[16:11.140 --> 16:15.080]  And these codes are like 042 and 04 whatever.
[16:16.240 --> 16:19.320]  And I have a little bit of a demo that I can play later.
[16:19.860 --> 16:21.300]  Bob, you ready with your stuff now?
[16:21.440 --> 16:21.760]  Okay.
[16:21.980 --> 16:23.140]  We're going to go back here.
[16:23.540 --> 16:27.100]  Well, here I showed you the diagram of what we did.
[16:27.100 --> 16:28.660]  Because actually, you know, we figured...
[16:28.660 --> 16:30.560]  I kind of figured, you know, using...
[16:30.560 --> 16:32.760]  Knocking off an 800 number by whistling off...
[16:32.760 --> 16:33.660]  I don't know how safe...
[16:33.660 --> 16:35.700]  I figured that wasn't really too safe.
[16:35.880 --> 16:40.270]  Because back in that day, 800 numbers were primarily made to make hotel reservations.
[16:40.270 --> 16:44.870]  And they'd get a little suspicious about a half hour call to make a hotel reservation.
[16:45.310 --> 16:54.550]  So with the 53 director exploit of throwing the relays out of sequence and getting this, you could use a different way to get on the tandem.
[16:54.890 --> 17:00.810]  But anyway, I got an audio sample of what that sounded like to do that here.
[17:01.290 --> 17:02.250]  So let me go.
[17:02.530 --> 17:06.890]  First of all, just to place what a call normally sounded like on a general telephone office.
[17:07.090 --> 17:12.070]  Now, in this recording, I just had bridged across the line with a capacitor into my audio system.
[17:12.370 --> 17:14.730]  So you hear the dial pulses really loud.
[17:15.130 --> 17:17.930]  But the important thing here to listen to is this.
[17:21.990 --> 17:23.970]  Now, you notice there's two clicks right there.
[17:24.070 --> 17:25.190]  Clunk, clunk, boo.
[17:25.830 --> 17:30.390]  It's between those two clunks that you flash the hook switch just right.
[17:30.390 --> 17:38.030]  And you knew you got it right by instead of the second clunk and then the dial tone, it just went smooth into a dial tone.
[17:38.130 --> 17:39.450]  But here's how the rest of the call went.
[17:40.090 --> 17:40.970]  I'll do it again.
[17:45.150 --> 17:45.950]  Two, one.
[17:50.380 --> 17:52.500]  Okay, that bubbling sound is the ticketer.
[17:53.620 --> 17:54.800]  And that set up the call.
[17:55.200 --> 17:57.780]  Now, here's my doing niner, niner, niner, niner.
[18:02.380 --> 18:04.160]  Okay, that sends it out into the repeater.
[18:04.240 --> 18:06.080]  Now, here's the repeater repeating those pulses.
[18:12.930 --> 18:15.250]  And there's the phone at the other end finally ringing.
[18:19.770 --> 18:26.130]  Okay, then here's a variant of a call that used MF for part of the call and dial pulse for part of the call.
[18:26.350 --> 18:27.910]  So we'll open that file up here.
[18:28.970 --> 18:29.750]  MF trunk.
[18:36.350 --> 18:39.530]  Okay, this one I actually, when I, I actually decided to record.
[18:39.730 --> 18:41.710]  I didn't bring the whole recording because it would bore you to tears.
[18:41.890 --> 18:53.250]  I recorded the call progress from every, to every prefix that you could dial from the 394 central office in the 213 area code to hear what they all sounded like.
[18:53.250 --> 18:59.230]  And some of the ring progress tones are kind of interesting, but that's more for almost a telephone collectors meeting than a hacker meeting.
[18:59.830 --> 19:03.490]  The pole changing ringing machine that sounds like a burring sound and all that.
[19:03.590 --> 19:07.970]  But anyway, here's now an example of the call where the last digits are MF.
[19:08.710 --> 19:11.110]  Actually, I have it set up just to hear the MF right now.
[19:16.290 --> 19:17.910]  So I don't know, do you want to hear the whole call?
[19:18.030 --> 19:19.010]  Anybody want to hear the whole call?
[19:19.130 --> 19:20.790]  Yeah, okay, you want to hear the whole call.
[19:20.890 --> 19:22.510]  So let's go do a select all.
[19:30.280 --> 19:32.360]  All right, here's the whole call from beginning to finish.
[19:32.440 --> 19:37.480]  But you won't hear the individual pulses, you'll just hear the make and break of the contacts across the earpiece.
[19:37.620 --> 19:38.540]  But it's still the same idea.
[19:38.860 --> 19:45.780]  First three digits, I pause to let it hear the grinding and banging from the office as the, this one, it was not hacked or phreaked.
[19:45.940 --> 19:48.800]  This is just the normal call actually used to map it out.
[20:18.100 --> 20:19.040]  And that's it.
[20:19.160 --> 20:22.680]  And like I say, if you noticed, you know, it's four digits, but there you heard six tones.
[20:22.940 --> 20:28.820]  The first one was KP, then 9999, and then start in MF.
[20:28.980 --> 20:30.120]  So that's how that office worked.
[20:30.240 --> 20:33.240]  KP is 1100 plus 1700.
[20:34.140 --> 20:37.760]  And start is 1500 plus 1700 hertz.
[20:38.780 --> 20:44.080]  You had to do the key pulse first, and then you dial the number, and then you did start.
[20:44.200 --> 20:51.220]  Now the reason why you had to do that was because these tandems had to be able to accept many different kinds of numbers.
[20:51.540 --> 20:55.660]  So three-digit numbers, six-digit numbers, seven-digit numbers, and ten-digit numbers.
[20:58.360 --> 20:58.940]  Go ahead.
[20:59.740 --> 21:01.840]  Okay, let's see what else we have here.
[21:04.840 --> 21:06.740]  And let's see, what else do we have?
[21:07.900 --> 21:09.860]  That's about it, I think.
[21:10.280 --> 21:12.400]  Unless, what else here?
[21:12.520 --> 21:12.740]  Oh!
[21:13.220 --> 21:16.200]  Well, my first Blue Box, I gotta show you a picture of that.
[21:18.360 --> 21:21.880]  And it wasn't nearly, I don't know if it was all against John's first one.
[21:21.880 --> 21:24.640]  Actually, this is actually not my first one that I have.
[21:24.840 --> 21:26.400]  I didn't have a picture of my first one.
[21:26.480 --> 21:28.500]  Actually, this is part of the first one.
[21:29.400 --> 21:32.000]  My original one, I built with vacuum tubes.
[21:32.280 --> 21:36.740]  Specifically, a bunch of 6SN7 vacuum tubes I had in my junk box.
[21:37.020 --> 21:41.820]  My first attempt was with an LCO, with an RC oscillator, a Wien bridge type of thing.
[21:41.900 --> 21:44.740]  But it wasn't too stable, because things would drift and go off frequency.
[21:44.860 --> 21:50.160]  And you might wonder how I calibrated this thing, because I didn't have access to a frequency counter back then.
[21:50.160 --> 21:58.240]  However, there was a handy government-sponsored frequencies on 2.5, 5, 10, and 20 megahertz.
[21:58.360 --> 22:00.460]  And you mainly think of that as far as RF.
[22:00.840 --> 22:07.200]  But on the audio transmission, they also played 440 cycle tones and 600 cycle tones.
[22:07.500 --> 22:16.420]  600 cycles had integer divisions into the 700, 900, 1100, all the MF tones.
[22:16.420 --> 22:20.000]  So an oscilloscope and Lissajous patterns, and that's how I tuned up my Blue Box.
[22:21.320 --> 22:23.280]  So the first thing was like huge.
[22:23.480 --> 22:24.620]  It was like that, by that.
[22:24.740 --> 22:26.160]  And it carried around a cardboard box.
[22:26.220 --> 22:29.160]  You had to plug it into the wall, so you couldn't very well use it in the pay phone.
[22:29.400 --> 22:30.880]  So that lasted.
[22:31.000 --> 22:33.340]  But anyway, I figured to use the control box for that iteration.
[22:33.360 --> 22:37.680]  I finally compacted it, found some transistors, some 88 millihenry toroid.
[22:37.680 --> 22:39.940]  So I had an LC oscillator, which is more stable.
[22:40.140 --> 22:41.840]  And this is the exterior view.
[22:42.020 --> 22:43.120]  It's still kind of big and clunky.
[22:43.260 --> 22:45.580]  Here's a quarter here for reference at the bottom.
[22:46.360 --> 22:48.340]  And here's the inside view of it.
[22:49.260 --> 22:54.400]  And tuning it up involved just getting a bunch of capacitors in parallel with the...
[22:54.400 --> 22:57.220]  I didn't feel like peeling wires off the toroid.
[22:57.220 --> 23:01.240]  So I just put a bunch of capacitors in parallel until it was on frequency.
[23:01.400 --> 23:02.640]  And it's held pretty well.
[23:02.760 --> 23:03.120]  It's pretty good.
[23:03.120 --> 23:05.800]  You can actually take it to a phone booth and play with this thing.
[23:05.960 --> 23:07.280]  And so that was my first Blue Box.
[23:08.780 --> 23:12.840]  Yeah, mine was a digital Blue Box.
[23:13.060 --> 23:16.680]  I used some digital circuitry to switch in the diode matrix.
[23:16.800 --> 23:18.340]  What I had, I had a cherry switch.
[23:19.760 --> 23:21.220]  Unfortunately, I don't have a picture of it.
[23:21.300 --> 23:26.340]  But you basically got these little slide switches that go up and down from zero all the way up to nine.
[23:26.780 --> 23:34.720]  And then I would put one slide switch to two, the other one to one, the other one to three, and then the other one to five, five, five, one, two, one, two.
[23:34.960 --> 23:37.580]  And it will automatically inject the key pulse and ST.
[23:37.780 --> 23:41.760]  I'd have to actually be the one to start the tones.
[23:41.900 --> 23:45.080]  I hit the key pulse tone and then I just hit the other tones.
[23:45.300 --> 23:52.420]  They go really fast exactly in the precisely the duty cycle that the phone company equipment switch would really have.
[23:52.560 --> 23:58.540]  So this was really stealthy because you really couldn't tell the difference between it and the actual telephone company equipment.
[23:59.240 --> 24:06.020]  Because we were expecting them to be putting in newer equipment and we wanted to make sure we had everything correct.
[24:06.840 --> 24:08.240]  And so that's what I did.
[24:08.380 --> 24:09.840]  And I also had to add one more thing.
[24:10.020 --> 24:19.800]  I had to add a 3200 hertz oscillator with a variable amplitude control that I used for guard banding.
[24:19.800 --> 24:23.460]  Guard banding is... let me tell you a little bit about guard banding.
[24:23.800 --> 24:31.940]  Guard banding is when you have another frequency besides 2600 present on the phone line, you don't want it to drop off.
[24:32.100 --> 24:32.320]  Why?
[24:32.440 --> 24:36.520]  Because Aunt Jemima's voice might have a lot of 2600 component in it.
[24:36.660 --> 24:39.360]  And when she screams and yells, it'll drop her off the call.
[24:39.840 --> 24:41.020]  So we don't want that.
[24:41.020 --> 24:47.120]  So they had some kind of a way of guard banding it or preventing the 2600 from going off the line.
[24:47.460 --> 24:50.180]  So what we did... and why did we pick 3200?
[24:50.760 --> 24:55.500]  3200 is just slightly outside of the frequency range of the normal telephone.
[24:55.760 --> 24:57.940]  Which is 300 to 3000.
[24:59.240 --> 25:01.640]  That's kind of like the main frequency range.
[25:02.020 --> 25:05.240]  And just above 3000, I figured I'll put it at 3200.
[25:06.020 --> 25:08.660]  And we did vary the frequency a little bit to get it just right.
[25:08.660 --> 25:12.020]  So what we did was, we'd call a number.
[25:12.260 --> 25:13.240]  We'd tweak it off.
[25:13.660 --> 25:16.080]  And then we put the 3200 on there.
[25:16.500 --> 25:18.760]  And the 2600, we hit it and nothing happened.
[25:18.940 --> 25:20.860]  And we notched it down a little bit more.
[25:21.320 --> 25:21.920]  Nothing happened.
[25:22.040 --> 25:24.300]  And all of a sudden it would go keek, peep, ka-ching, chink.
[25:24.420 --> 25:25.520]  We get two little ka-chinks.
[25:25.760 --> 25:27.540]  So therefore we were able to guard band it.
[25:27.900 --> 25:29.360]  Now guard banding works anywhere.
[25:29.720 --> 25:30.960]  It doesn't work on number...
[25:30.960 --> 25:33.820]  I mean, number one crossbar tandem stacking.
[25:34.500 --> 25:36.320]  And Bob, why don't you get that thing set up?
[25:36.480 --> 25:36.640]  Okay.
[25:36.640 --> 25:43.820]  Number one crossbar tandems are tandems which are basically stackable without actually using guard band.
[25:44.620 --> 25:49.860]  And the way that worked is you would do the key pulse and 042 start.
[25:50.920 --> 25:53.840]  And that would then drop you into the 042 trunk.
[25:53.980 --> 25:57.000]  But since there's nothing else for it to dial, it just drops you in.
[25:57.600 --> 25:58.960]  The first cut or the second cut?
[25:59.020 --> 25:59.420]  The first cut.
[25:59.420 --> 25:59.760]  Okay.
[26:02.240 --> 26:05.440]  This tape was recorded by a doorbell.
[26:05.640 --> 26:09.480]  And I tried very hard to get doorbell up here to this conference.
[26:09.680 --> 26:11.220]  But I didn't know how to reach him.
[26:12.440 --> 26:12.920]  So...
[26:15.290 --> 26:17.170]  This is dialing a number.
[26:17.330 --> 26:17.510]  It's it.
[26:27.380 --> 26:29.800]  The number that's ringing at this point doesn't matter.
[26:30.080 --> 26:37.140]  What's important is that this call has gone over a trunk from New York to a distant 4A, which can be reset by 2600.
[26:42.550 --> 26:45.530]  That's the supervision handshake, off hook, on hook.
[27:17.820 --> 27:24.880]  And now it's waiting for new digits, which Ben will supply.
[27:28.420 --> 27:33.940]  Stopping the tape now, what he dialed was 216-054-064.
[27:34.300 --> 27:36.460]  These are old routing codes.
[27:36.720 --> 27:42.780]  The network of the 1970s had routing codes for tandems in all major cities.
[27:42.780 --> 27:48.680]  The first code, 216-054, is the routing code for Youngstown, Ohio.
[27:49.340 --> 27:55.980]  The 064 in the area code of 216 is the routing code for Canton, Ohio.
[27:56.480 --> 27:58.380]  Both of these are crossbar tandems.
[27:58.780 --> 28:07.920]  When Ben keys in this sequence, the 4A into which he is keying picks up a trunk to Youngstown, Ohio and sends 064.
[28:09.340 --> 28:14.160]  That tick is the 4A cutting through to Youngstown, Ohio after having sent 064.
[28:15.080 --> 28:17.840]  Now what does Youngstown do with the 064?
[28:18.200 --> 28:20.260]  Well, it picks up a trunk to Canton.
[28:20.520 --> 28:21.760]  That's the code for Canton.
[28:22.140 --> 28:30.680]  But having been sent only the routing code and no digits to follow it, it simply dumps us into the Canton trunk without sending anything.
[28:30.980 --> 28:32.960]  In other words, it stacks.
[28:34.600 --> 28:38.120]  That's the sound of Youngstown, Ohio dumping us into a trunk to Canton.
[28:40.160 --> 28:42.100]  And that's the handshake from Canton.
[28:42.680 --> 28:45.440]  Canton, Ohio is now ready to receive digits.
[28:49.660 --> 28:50.960]  That's 054-064.
[28:51.900 --> 28:56.240]  This causes Canton to pick up a trunk to Youngstown and send 064.
[28:57.780 --> 29:02.000]  Now we're in Youngstown again, which stacks into Canton.
[29:02.320 --> 29:06.040]  And then Canton gives us the handshake.
[29:06.300 --> 29:08.620]  And we'll do another 054-064.
[29:11.810 --> 29:13.330]  Now we're in Youngstown again.
[29:14.290 --> 29:15.690]  Youngstown stacks to Canton.
[29:18.570 --> 29:19.510]  That's the handshake.
[29:19.670 --> 29:20.470]  And here we go again.
[29:22.930 --> 29:24.410]  Well, that brings back old memories.
[29:24.790 --> 29:25.030]  Youngstown.
[29:25.170 --> 29:25.310]  Yeah.
[29:25.750 --> 29:25.990]  Canton.
[29:28.770 --> 29:29.190]  Handshake.
[29:31.890 --> 29:35.070]  Now the connection has gotten so long that the handshake is all you can hear.
[29:37.810 --> 29:43.590]  Now on that supervision flash, you could really hear multiple links both on the off hook and the on hook.
[29:46.010 --> 29:47.170]  He's going around again.
[29:51.130 --> 29:54.410]  That was such a short flash that you didn't get to hear all the on hooks.
[29:58.080 --> 30:04.920]  You've been listening to the beginning of the original 1975 tape stretched to allow me to describe what's going on.
[30:05.000 --> 30:05.240]  Okay.
[30:05.340 --> 30:05.660]  We can stop it there.
[30:05.660 --> 30:06.680]  Let me go...
[30:06.680 --> 30:07.360]  All right.
[30:07.440 --> 30:19.720]  What you just heard was just number one crossbar switches being stacked by just simply using and just pairing up the TTC codes back and forth, back and forth, back and forth.
[30:20.540 --> 30:22.980]  And that was how you were able to stack TANMs.
[30:23.620 --> 30:24.560]  Go to number two.
[30:24.720 --> 30:24.920]  Okay.
[30:24.920 --> 30:25.000]  All right.
[30:25.940 --> 30:35.800]  Now in this next sequence of tones, you'll hear, will be a very, very large TANM stack.
[30:36.080 --> 30:39.480]  This one here has got to be one of the biggest ones we have ever done.
[30:41.260 --> 30:47.100]  And so what you'll hear is that.
[30:54.630 --> 31:00.890]  The tone that you hear there, right there, that's called a tone-applier.
[31:02.230 --> 31:02.670]  And...
[31:07.430 --> 31:07.950]  Okay.
[31:08.370 --> 31:09.310]  And so it skipped a little bit.
[31:10.210 --> 31:11.350]  So the tone...
[31:11.350 --> 31:19.710]  Go to the part where they hang up and kind of just skip a little bit, about maybe 30 seconds into it or something.
[31:21.250 --> 31:23.110]  Listen to those 26's beating.
[31:23.390 --> 31:24.310]  There's so many of them.
[31:25.350 --> 31:26.130]  It's flash suit.
[31:31.890 --> 31:33.670]  Now this is what you hear on the other side.
[31:33.870 --> 31:36.230]  Because what he's done, he's got two phones right next to each other.
[31:38.910 --> 31:41.930]  So at first, it was, it was like...
[31:44.690 --> 31:45.790]  Soft going to loud.
[31:45.930 --> 31:48.530]  Now this is loud going to soft.
[31:49.350 --> 31:51.170]  Because the stack is going the other way.
[31:51.170 --> 31:52.670]  Because you're on the other line.
[31:53.250 --> 31:54.290]  So it's going to kind of away from you.
[31:55.430 --> 31:58.410]  And here he's kind of flashing around, kind of playing around with it.
[32:07.240 --> 32:08.540]  Sounds like one of those filters.
[32:08.780 --> 32:10.560]  It's not quite filtering out that 2600.
[32:18.790 --> 32:24.750]  I'll skip to the part where they hang up, which I guess is just about right there on your screen.
[32:24.930 --> 32:26.130]  Yeah, probably about there.
[32:26.390 --> 32:27.470]  Yeah, yeah, yeah.
[32:27.590 --> 32:28.110]  Hit it again.
[32:28.110 --> 32:30.590]  Shoot on the cord line and flash down.
[32:32.370 --> 32:34.370]  Shorter, longer, longer, longer, longer.
[32:40.670 --> 32:41.790]  It's the other way now.
[32:48.780 --> 32:52.460]  So the wink back is that very quick chirp you hear.
[32:53.680 --> 32:55.800]  The mechanical filters filter that out.
[32:55.800 --> 32:59.820]  So it just switches in a filter, which sort of like cuts it off.
[33:03.530 --> 33:07.070]  I think it's going to come up to the big, the big hang up here.
[33:07.190 --> 33:08.370]  That's what you want to really listen to.
[33:09.750 --> 33:13.410]  And it takes quite a while for all those trunks to kind of evaporate.
[33:24.210 --> 33:29.150]  You see it takes, you know, quite quickly considering our own mechanical relays.
[33:34.110 --> 33:35.810]  Back to the cord line.
[33:37.250 --> 33:37.650]  Yeah.
[33:38.370 --> 33:39.650]  Let it go soft a little bit.
[33:44.780 --> 33:47.560]  I guess we should describe what he means by flash forward.
[33:47.740 --> 33:49.740]  I guess the proper term is ring forward, isn't it?
[33:49.780 --> 33:51.240]  Normally that's what they called it, yes.
[33:51.540 --> 33:53.860]  Which is to send a short burst to 2600.
[33:53.980 --> 33:54.940]  That voice you hear is Bill.
[33:54.960 --> 33:59.140]  These are all toll tandem, so they tended to want to repeat the signal along the way.
[33:59.440 --> 34:01.140]  Which makes a wonderful sound.
[34:01.140 --> 34:04.540]  Now in the actual network, the ring forward was used for...
[34:04.540 --> 34:07.280]  To signal an operator if they had put up a connection.
[34:07.540 --> 34:12.140]  And that was also used to cut off the scramble.
[34:12.940 --> 34:14.980]  Which would send a little chirp of 2600.
[34:15.060 --> 34:17.780]  When you go in on an auto verify and tap a line.
[34:17.960 --> 34:19.860]  ...flash where the connection was.
[34:20.060 --> 34:25.260]  And when you get a connection this long and you ring forward, assuming that it passes it along, which this one does.
[34:25.500 --> 34:25.860]  Oh yeah.
[34:26.080 --> 34:31.520]  You get to hear that little burst of forward on hook being sent, you know, just very slowly.
[34:31.740 --> 34:33.400]  One, then the next, then the next, then the next.
[34:33.540 --> 34:34.040]  All the way down.
[34:34.340 --> 34:34.440]  Yep.
[34:34.580 --> 34:35.540]  Just cascading down.
[34:35.720 --> 34:36.360]  You can count the links.
[34:36.600 --> 34:41.700]  And he does that with the tape recorder on, you know, first on the calling line and the called line.
[34:51.780 --> 34:52.440]  Flash forward.
[34:57.220 --> 34:57.820]  Flash forward.
[34:57.820 --> 34:59.960]  So each trunk is kind of doing its little thing.
[35:00.280 --> 35:02.380]  By acknowledging that flash forward.
[35:03.220 --> 35:06.560]  Rippling and kind of transmuting along its little pathways.
[35:09.900 --> 35:11.520]  And wait till you hear the hang up.
[35:14.320 --> 35:14.860]  What's that?
[35:18.200 --> 35:18.560]  Yeah.
[35:20.180 --> 35:21.060]  We're almost there.
[35:21.300 --> 35:21.360]  Yeah.
[35:26.610 --> 35:29.830]  We didn't get a chance to edit this very much.
[35:35.480 --> 35:36.660]  No, this is the other way.
[35:36.820 --> 35:37.140]  Okay.
[35:37.680 --> 35:39.140]  Let's close forward to the calling in there.
[35:39.900 --> 35:41.520]  It jumped over to the other line now.
[35:41.620 --> 35:43.100]  That is what it looks like from the other side.
[35:48.100 --> 35:51.200]  Notice how it gets closer on this line.
[35:51.450 --> 35:56.350]  On the other line, it was going away as it was getting, as the tones were going fainter.
[35:57.430 --> 36:01.430]  So you're actually looking at it on the other side now, of the big tandem stack.
[36:05.010 --> 36:06.150]  We're almost done here.
[36:20.240 --> 36:20.700]  Wow.
[36:21.540 --> 36:23.830]  This is 148 at the beginning, then all correspond.
[36:24.520 --> 36:24.980]  Okay.
[36:25.140 --> 36:27.040]  Now we'll hang up the calling in.
[36:27.500 --> 36:28.700]  Get ready for this.
[36:29.410 --> 36:30.020]  Here we go.
[36:33.740 --> 36:35.340]  I'm going to make sure we're recording.
[36:36.860 --> 36:37.800]  Yes, we are.
[36:37.980 --> 36:39.160]  So we're going to disconnect.
[36:46.490 --> 36:47.790]  And there you have it.
[36:48.890 --> 36:49.470]  Okay.
[36:49.690 --> 36:50.530]  There you have it.
[36:51.110 --> 37:03.370]  Now this tape was classic tandem stacking, and you yourself can also get copies of this and listen to it on wideweb.com slash phone trips.
[37:04.790 --> 37:13.950]  The website itself is not very clean, but it's got links up there to all kinds of different phone connections and stuff like that.
[37:14.370 --> 37:16.670]  So this is sort of what we did.
[37:16.810 --> 37:19.110]  We tried to, of course, get the biggest stack we can find.
[37:19.270 --> 37:24.150]  And as Dorvell mentioned in the tape, you can always go too far.
[37:24.150 --> 37:26.170]  It's like playing the game of 21, you know.
[37:28.090 --> 37:33.750]  So you can just go so far, and then, of course, and then you try to get that last trunk to get there, and it'll work.
[37:33.870 --> 37:40.610]  And then one more, and you can try to go for that one more, and that's going to be the one that won't work, and you've got to just do the whole thing all over again.
[37:42.170 --> 37:50.770]  Well, while they were doing that, I was living in Rochester, New York, the home of the Rochester Telephone Company, one of the nation's largest independent telcos.
[37:51.770 --> 37:57.970]  And I was trying to find a way to get to a timesharing system out in Brockport, New York, at a college out there.
[37:59.230 --> 38:03.790]  But I was still reading all this literature about how to operate this stuff because I did not have my own Blue Box.
[38:03.790 --> 38:08.490]  A friend of mine did, and he let me borrow it one day, and I placed three telephone calls.
[38:08.770 --> 38:21.110]  The first was to 303-499-7111, which is, to this day, WWV, the National Bureau of Standards Time Signal, which is the one Bob was listening to on shortwave to set his Blue Box tones.
[38:22.210 --> 38:35.070]  The second call was to the White Plains Center onto London to the teletourist recording in London, because I'd heard you could do that sort of thing, and I had all the information available on how to do it if I had a Blue Box.
[38:35.070 --> 38:38.690]  I had it that day, and I got through and heard the teletourist recording.
[38:38.950 --> 38:46.550]  And then I placed my third call to 910-555-1212.
[38:47.030 --> 38:49.970]  In those days, 910 was not a telephone area code.
[38:50.150 --> 38:58.630]  It's what Telco called a special area code, an SAC for the TWX Teletype Network, TWX, Teletype Writer Exchange.
[38:58.630 --> 39:00.330]  I dialed it.
[39:00.550 --> 39:05.970]  It went ring, click, modem tone.
[39:06.530 --> 39:10.230]  And that's when I knew AT&T had lied.
[39:11.150 --> 39:15.750]  Because they said the TWX Teletype Network was in no way interconnected with the telephone network.
[39:15.870 --> 39:16.650]  Oh, of course not.
[39:17.150 --> 39:18.110]  They lied.
[39:18.250 --> 39:18.950]  It was.
[39:20.350 --> 39:27.570]  And so that meant that I could use the teletype machine in that office in downtown Rochester to reach the time sharing system out in Brockport.
[39:28.090 --> 39:29.450]  But it was a very expensive service.
[39:29.570 --> 39:34.130]  It was really easy for me to go to a different college, use their dial-up modems and what have you.
[39:34.270 --> 39:36.810]  But I learned about the TWX Teletype Network.
[39:37.370 --> 39:45.870]  And I found out that there were other exchanges in other cities that the TWX special area codes and exchanges would translate to.
[39:45.870 --> 39:47.790]  Because there I was in Rochester, man.
[39:48.290 --> 39:54.210]  Why would the cheapskates at the Rochester Telephone Company put up a whole new telephone exchange for a Pa Bell play toy?
[39:54.530 --> 39:57.010]  And that's when I figured they would translate the numbers.
[39:57.590 --> 40:03.090]  So I had a list of about 40 cities I could directly dial the TWX machines in, which, you know, was fairly useless.
[40:03.450 --> 40:05.110]  But one of those cities was New York.
[40:05.690 --> 40:17.390]  And after I moved to New York, you know, whenever I had a press release to send, I would just dial up the TWX machine at the AP or the UPI and send them my press release.
[40:17.510 --> 40:18.830]  And some of them got published.
[40:21.170 --> 40:28.550]  The international record carriers, RCA Global Communications, ITT WorldCom, all had TWX numbers you could dial.
[40:28.790 --> 40:40.230]  And they would do speed and code conversion from 110 baud ASCII on the TWX side to 75 baud Baud O on the Telex side to reach any Telex machine outside of North America.
[40:40.570 --> 40:47.130]  So I could send messages, you know, hi, this is Cheshire, a computer hacker in New York.
[40:47.130 --> 40:48.830]  Does anyone have time to sit and chat?
[40:49.130 --> 40:51.290]  Well, in the offices, that didn't really go very far.
[40:51.490 --> 40:55.370]  But then they put up Marisat, the Maritime Communications Satellite.
[40:55.810 --> 41:00.350]  And I got the list of ship Telex numbers and all the publicly available information.
[41:01.250 --> 41:03.770]  So I dialed up a random ship.
[41:03.950 --> 41:05.790]  Hi, this is Cheshire, a computer hacker in New York.
[41:05.910 --> 41:07.310]  Does anyone have time to sit and chat out there?
[41:08.030 --> 41:12.410]  I am now reaching a ship's radio officer, hundreds of miles at sea.
[41:12.410 --> 41:16.970]  Absolutely nothing to do but sit and chat, especially, on someone else's nickel.
[41:24.410 --> 41:25.970]  So we'd be chatting away.
[41:26.130 --> 41:28.110]  But this was brand new to those guys.
[41:28.530 --> 41:30.190]  And, you know, they were out at sea.
[41:30.270 --> 41:33.530]  They didn't have access to all the available information and literature.
[41:33.530 --> 41:41.230]  I'd get questions like, RCA sent me these Unicodes for me to get to my head office and I can't figure out how to use these damn things.
[41:41.390 --> 41:41.990]  Oh, well.
[41:42.470 --> 41:42.910]  Moan please.
[41:43.190 --> 41:44.070]  M-O-M-P-L-S.
[41:44.190 --> 41:45.690]  The official Telex abbreviation for...
[41:45.690 --> 41:45.870]  Wait a minute.
[41:46.130 --> 41:47.910]  And I'd look up the RCA brochure.
[41:48.130 --> 41:52.430]  Oh, take the carrier ID thumb wheel and turn it to 2 for RCA.
[41:52.710 --> 41:55.410]  And then your 1 plus will get you right back to your head office.
[41:55.810 --> 42:02.210]  Well, of course, the helpful salesman had set the thing to carrier ID 2 and figured that the fellow would never change it.
[42:02.750 --> 42:06.930]  So when the guy just changed it back to 1 for CompSat General, he had a problem trying to use the 1 plus.
[42:07.670 --> 42:09.770]  So I always imagined...
[42:09.770 --> 42:16.230]  See, back in the early days of Marisat, they weren't sure how reliable the satellite was, so they kept everything on mag tape.
[42:16.770 --> 42:22.510]  And I always imagine the day when the exception report was printed out with the answer bags they didn't know how to bill.
[42:23.050 --> 42:28.450]  You see, every Telex machine and every TWX machine had an answer back hard-coded into the machine.
[42:28.690 --> 42:32.970]  Well, I was calling from an ADM-3 video terminal, so I didn't have an answer back.
[42:33.290 --> 42:37.730]  But I had to type one in so that the computers thought that I was a real TWX machine.
[42:38.650 --> 42:50.610]  Well, I used the maximum number of characters, 14 characters in my answer back, which was TWX, space, the letter R, the number 4, space, P-H-R-E-A-K-S.
[42:50.770 --> 42:51.970]  TWX are for phreaks.
[42:55.440 --> 42:55.940]  Thank you.
[42:58.160 --> 43:04.880]  I always imagine when that exception report hit the desk of whoever was looking at it and went, oh, good grief.
[43:05.280 --> 43:10.340]  Somebody's breaking into our system, they're blowing our system security all to hell and gone, quick, pull the mag tapes.
[43:10.800 --> 43:17.800]  And they would send some minion out to the tape library, he'd pull the mag tape, throw it up on the tape drive, run it out to the printer, look at the printout.
[43:18.920 --> 43:22.400]  He's breaking our system security all to hell, and he's being friendly?
[43:23.860 --> 43:25.480]  They never could figure me out.
[43:26.720 --> 43:30.160]  Because like most phreaks and hackers, I was exploring the network.
[43:30.500 --> 43:33.880]  You know, just trying to figure out what I could do with it, which really wasn't much.
[43:34.320 --> 43:37.680]  You hit these business machines and people weren't that friendly out there.
[43:37.680 --> 43:38.760]  They were business people.
[43:39.740 --> 43:41.860]  And they weren't playing with these things.
[43:42.000 --> 43:42.920]  They used them for business.
[43:43.200 --> 43:44.820]  Me, I was a phreak.
[43:44.940 --> 43:45.600]  I was playing with it.
[43:46.040 --> 43:59.060]  And also in the TWX code, like 01, like 710, but if you do 017-555-1212, then you get the other side.
[43:59.060 --> 43:59.760]  Mm-hmm.
[44:00.940 --> 44:07.920]  And so what I did was, like when I wanted to make a call, like on a pay phone, there was no...
[44:07.920 --> 44:10.220]  You couldn't dial direct 800 numbers.
[44:10.320 --> 44:11.560]  You had to go to an operator.
[44:12.580 --> 44:13.700]  So I would...
[44:13.700 --> 44:20.720]  And just about the time you're ready to bang out the number, the operator comes on the line because that wink back shows that the call on the other end just hung up.
[44:21.440 --> 44:24.940]  So what I tell the operator, I say, Operator, I want to place a data call.
[44:25.760 --> 44:27.520]  Please ignore false supervision.
[44:28.720 --> 44:38.240]  And so that just gave me just a little bit more time to bang out the 017-121-stanything, start.
[44:38.540 --> 44:39.380]  And it would go...
[44:40.160 --> 44:42.400]  And she'd come on the line and say, Oh, she must be data call.
[44:42.660 --> 44:43.900]  So she goes off the line.
[44:44.240 --> 44:45.460]  Now I won't be molested.
[44:45.580 --> 44:48.720]  What she does, she puts a little tag up there saying, Do not touch this line.
[44:48.860 --> 44:49.460]  Only hand...
[44:49.460 --> 44:53.320]  She'll only do the one that the calling party answers.
[44:54.060 --> 44:54.940]  And so...
[44:54.940 --> 44:56.420]  Or when the calling party hangs up.
[44:56.640 --> 44:58.380]  And so that was how it all worked.
[44:59.800 --> 45:04.020]  So after a while, one thing I did want to try was the Audubon.
[45:04.080 --> 45:05.640]  Let me talk a little bit about Audubon.
[45:05.700 --> 45:06.480]  How much time do we have?
[45:06.960 --> 45:09.280]  We got a 10-minute warning about how many minutes ago?
[45:09.460 --> 45:09.760]  Yeah.
[45:10.220 --> 45:10.960]  About five minutes left.
[45:11.140 --> 45:11.340]  Okay.
[45:12.980 --> 45:16.280]  Audubon was Nicholson Creek, Alaska, and Murphy Dome, Alaska.
[45:16.860 --> 45:23.000]  And they had switches up there that served both Audubon and regular commercial traffic.
[45:23.300 --> 45:25.280]  And those were the only switches that did that.
[45:25.440 --> 45:28.120]  And the only thing that they did was they class marked the switches.
[45:28.540 --> 45:33.240]  So if you were coming from 940 and calling to 950, it's cool.
[45:33.380 --> 45:35.880]  You could actually make a call.
[45:36.020 --> 45:39.760]  So you go 940-950-1230, you get NORAD switch.
[45:40.380 --> 45:43.600]  And then you blow off the 2600, just a little burst.
[45:43.820 --> 45:45.540]  And these trunks were a little bit different.
[45:46.680 --> 45:49.740]  It would drop you all the way back to the NORAD center.
[45:50.000 --> 45:52.160]  And that left me right on the NORAD trunk.
[45:52.420 --> 45:55.680]  From there I could do flash, flash override, priority, and everything like that.
[45:56.480 --> 45:59.400]  And I had total control of the military phone network.
[45:59.540 --> 46:00.640]  I could do anything I wanted to with it.
[46:01.020 --> 46:03.120]  I was like root access to it.
[46:06.020 --> 46:09.360]  And now I want to talk a little bit about kind of what I'm doing now.
[46:09.640 --> 46:12.700]  And kind of end things here because I think we're almost out of time.
[46:13.580 --> 46:15.140]  Currently right now I'm working on a book.
[46:16.540 --> 46:19.740]  And I think we're going to call it Hack This Life.
[46:20.040 --> 46:21.480]  I've already done three chapters.
[46:21.820 --> 46:23.380]  First chapter was done on law.
[46:23.600 --> 46:28.260]  Second chapter was hacking the Russian KGB system, which I don't think anybody has heard yet.
[46:30.240 --> 46:32.540]  And some stuff I was doing in Germany.
[46:32.800 --> 46:34.380]  And it goes on and on.
[46:34.560 --> 46:36.880]  So I'll be looking forward to the book.
[46:37.100 --> 46:40.020]  I'm JD Crunchman on all social networks.
[46:40.200 --> 46:42.560]  So you can contact me that way.
[46:43.300 --> 46:49.440]  Skype, Gmail, AIM, MySpace, Facebook.
[46:50.180 --> 46:52.960]  It's all JD Crunchman, LinkedIn, whatever.
[46:53.240 --> 46:54.200]  It's JD Crunchman.
[46:54.480 --> 46:55.800]  So that's how you contact me.
[46:55.940 --> 46:57.200]  Bob, you want a few last words?
[46:57.200 --> 46:58.320]  That's about it.
[46:59.080 --> 47:07.140]  I guess you say what finally became of me and why I kind of retired from the phreaking career is because even though I have safe faith, you've got to be aware of snitches.
[47:07.220 --> 47:09.500]  Somebody was mad at my roommate who was also a phreaker.
[47:09.640 --> 47:10.980]  And he was so mad at him.
[47:11.060 --> 47:12.280]  He said, I don't care who else I take down.
[47:12.300 --> 47:14.060]  I want to get to see this guy thrown in jail.
[47:14.340 --> 47:16.040]  So we got snitched on.
[47:16.460 --> 47:17.640]  They started listening in.
[47:17.880 --> 47:26.740]  But they told me later, part of the deal was where I only had to plead guilty to a misdemeanor, do no jail time, $500 fine, $400 probation.
[47:26.740 --> 47:29.720]  But that was still a lot of money for a kid in 1970.
[47:31.640 --> 47:33.160]  They still couldn't figure out how I was doing.
[47:33.260 --> 47:38.920]  Even when they were monitoring, they couldn't figure out the down-up kerchunk business with dumping the 53 director off.
[47:39.120 --> 47:43.900]  So part of the degree was I told them exactly how I do it so they could patch the loophole.
[47:43.980 --> 47:51.080]  Well, I think they realized that, well, the only way really to patch this loophole is to replace it with ESS and be done with it.
[47:53.320 --> 47:56.280]  So that's why I sort of took more of a lower profile.
[47:56.460 --> 47:57.180]  And I was a good boy.
[47:57.300 --> 48:05.500]  I didn't even call loop-arounds for the three years I was on probation because I didn't want to be selled up in a big guy named Bubba who would make me his bitch.
[48:05.500 --> 48:06.220]  Yeah.
[48:08.060 --> 48:20.360]  And I also got snitched on also the second or third time, sometime between the time that I did the White House toilet paper crisis, which you've all heard that.
[48:20.360 --> 48:21.380]  I'm not going to go into that.
[48:22.600 --> 48:30.600]  But that was sort of when I got snitched on and a guy by the name of Adam Bauman was the snitch.
[48:30.600 --> 48:35.400]  He basically testified for the FBI and they came and arrested me.
[48:36.280 --> 48:37.700]  That was the second time.
[48:39.420 --> 48:54.300]  But I had not done anything since that time, except one of his friends was at a payphone and made a call on a payphone with a Blue Box and that payphone had been tapped because it had been previously arranged by Adam Bauman that I was going to use that phone at a certain time.
[48:55.040 --> 49:00.520]  And so it was pretty easy for them to set up a dialed number recording on it and that's how I got done in the second time.
[49:01.060 --> 49:12.220]  And then, of course, they also said that even if they hadn't been snitched on, if I had kept it up, they were still trying to figure out why the international traffic out of the San Bernardino 4A had gone up a thousand percent.
[49:12.580 --> 49:25.820]  Yeah, and the FBI, when they came in, they found the NCIC crime computer manual and they were also very interested in how I was able to tap the FBI.
[49:25.820 --> 49:33.880]  So, in cooperation with the authorities, which I didn't get any jail time for...
[49:34.360 --> 49:35.400]  Well, actually, I did.
[49:35.540 --> 49:40.920]  I got four months in Lompoc, which was kind of like a summer camp for kids, basically.
[49:42.440 --> 49:47.460]  So, while I was there, of course, I would have phone-free classes and teach everybody and I got really popular.
[49:54.440 --> 50:05.700]  And, of course, getting me close to the modern era, people are aware of my having my own area code, where I live in Florida now, near the Kennedy Space Center.
[50:05.900 --> 50:17.760]  So, when they were splitting 407, I decided to look up the list at NANPA, the North American Numbering Plan Administration, and found that the number 321 was available.
[50:18.120 --> 50:19.820]  And that struck a chord somehow.
[50:20.080 --> 50:27.580]  So, I went to the Public Service Commission hearing and explained to them that Cape Canaveral, the countdown capital of the world, really should get 321.
[50:28.200 --> 50:35.660]  So, the way I look at it is, I asked for it, they approved it, so it must be my area code that I share.
[50:39.440 --> 50:40.060]  Thank you.
[50:44.170 --> 50:52.190]  So, these days, to be a phreak in the 21st century, what I'm doing now is writing web pages meant to be read on mobile phone web browsers.
[50:52.490 --> 50:53.830]  Mostly, I just don't like Flash.
[50:54.270 --> 50:59.370]  But, I don't think you need to write an app that's specifically for a specific piece of hardware.
[51:00.270 --> 51:08.290]  Candy bar phones, flip phones, can read simple HTML, and if all you're trying to do is get the information content out, all you need is a simple web page.
[51:08.490 --> 51:18.590]  If you visit HOPE9, that's numeral 9, H-O-P-E-9.Mobi, M-O-B-I, you'll find the web page I created for this conference.
[51:18.930 --> 51:25.630]  And you can maneuver around that schedule by pushing the buttons on your touch-tone dial, on the phone pad on your mobile phone.
[51:26.170 --> 51:29.690]  And the numbers 1, 2, and 3 are the schedules for Friday, Saturday, and Sunday.
[51:29.870 --> 51:38.350]  And then the time of day at the top of each page, you maneuver with your little maneuvering thing to the hour you want, and it tells you what's on the schedule for that time.
[51:38.770 --> 51:44.730]  Very simple kinds of websites and pages, and that's how I've morphed into being a phone phreak in the 21st century.
[51:45.930 --> 51:47.510]  For more history...
[51:48.590 --> 51:49.270]  Thank you.
[51:49.710 --> 51:56.710]  For more history, may I suggest Phil Lapsley's book, Exploding the Phone, which should be out, I suspect by fall.
[51:57.030 --> 51:58.170]  Be looking for it.
[51:58.170 --> 52:00.610]  And I think we're about through, aren't we?
[52:00.710 --> 52:05.370]  One more thing I wanted to say is that I'm starting up a new LLC.
[52:05.590 --> 52:14.470]  It's a membership-only entity, and it's crunchcreations.org, and crunchcreations.com.
[52:14.570 --> 52:25.190]  The .com website is the blog, and the .org is the actual website for building and making portable devices for Android and iOS, iPhones, and stuff like that.
[52:30.700 --> 52:31.280]  Thank you, Mike.