But How Does It Work? (August, 1984)
------------------------------------

How much do you really understand about the way your telephone works? Probably
not as much as you should. Considering the amount of time most people spend on
the contraptions, this is really quite a disgrace. Ask questions and make an
effort to learn and you ll be the exception to the rule, which is basically:
"Safety is Stupidity."  Read on.

Wiring

Assuming a standard one-line fone, there are usually four wires that lead out
of the fone set. These are standardly colored red, green, yellow, and black.
The red and green wires are the two that are actually hooked up to your central
office (CO). The yellow wire is sometimes used to ring different fones on a
party line (i.e., one number, several families - found primarily in rural areas
where they pay less for the service and they don't use the fone as much),
otherwise the yellow is usually just ignored. On some two-line fones, the red
and green wires are used for the first fone number and the yellow and black are
used for the second line. In this case there must be an internal or external
device that switches between the two lines and provides a hold function (such
as Radio Shack's outrageously priced two-line and hold module).

In telephony, the green and red wires are often referred to as tip (T) and ring
(R), respectively. The tip is the more positive of the two wires. This naming
goes back to the old operator cord boards where one of the wires was the tip of
the plug and the other was the ring (of the barrel).

A rotary fone (a.k.a. dial or pulse) will work fine regardless of whether the
red (or green) wire is connected to the tip (+) or ring (-). A touch-tone fone
is a different story, though. It will not work except if the tip (+) is the
green wire. (Some of the more expensive DTMF fones do have a bridge rectifier,
which compensates for polarity reversal, however.) This is why under certain
(nondigital) switching equipment you can reverse the red and green wires on a
touch-tone fone and receive free DTMF service. Even though it won't break dial
tone, reversing the wires on a rotary line on a digital switch will cause the
tones to be generated.

Voltages, Etc.

When your telefone is on-hook (i.e., hung up) there are approximately 48 volts
of DC potential across the tip and ring. When the handset of a fone is lifted,
a few switches close, which cause a loop to be connected (known as the "local
loop") between your fone and the CO. Once this happens, DC current is able to
flow through the fone with less resistance. This causes a relay to energize,
which causes other CO equipment to realize that you want service. Eventually,
you should end up with a dial tone. This also causes the 48 VDC to drop down
into the vicinity of 12 volts. The resistance of the loop also drops below the
2500 ohm level, though FCC licensed telefone equipment must have an off-hook
impedance of 600 ohms.

As of now, you are probably saying to yourself that this is all nice and
technical but what the hell good is the information. Well, also consider that
this drop in impedance is how the CO detects that a fone was taken off hook
(picked up). In this way, they know when to start billing the calling number.
Now what do you suppose would happen if a device such as a resistor or a Zener
diode was placed on the called party's line so that the voltage would drop just
enough to allow talking but not enough to start billing? First off, the calling
party would not be billed for the call but conversation could be pursued.
Secondly, the CO equipment would think that the fone just kept on ringing. The
Telco calls this a "no-no"  (toll fraud to be more specific) while phone phreaks
affectionately call this mute a black box.

How These Boxes Are Built

It's really surprisingly easy to build a device such as a black box. If it
weren't for the amazingly high morals inherent in today's society, you'd  most
certainly see more of them in use. Only two parts are needed: an SPST toggle
switch and a 10,000-ohm (10 K), 1/2-watt resistor. Any electronics store should
stock these parts.

A person would then cut two pieces of wire (about 6 inches long) and attach one
end of each wire to one of the terminals on the switch. Then the K-500
(standard desk fone) would be turned upside down and the cover taken off. A
wire would be located and disconnected from its terminal. The switch would then
be brought out the rear of the fone and the cover replaced. Labeling the switch
usually comes next. A position where one receives a dial tone when picking up
is marked "NORMAL."  The other side is, naturally, "FREE."

Making Them Work

When phriends call (usually at a prearranged time), the person with the black
box quickly lifts and drops the receiver as fast as possible. This stops the
ringing (if not it must be done again) without starting the billing. This must
be done within less than one second. The phone can then be picked up with the
switch in the "FREE" position. Most phone phreaks are wise enough to keep their
calls under 15 minutes in length, greatly minimizing the odds of getting
caught.

Some interesting points: (1) If someone picks up an extension in the called
party s house and that fone is not set for "FREE," then billing will start. (2)
An old way of signaling a phriend that you want to call him is to make a
collect call to a nonexistent person in the house. Since the phriend will
(hopefully) not accept the charges, he will know that you are about to call
and, thus, prepare the black box (or vice versa). (3) The phone company can
detect black boxes if they suspect one on the line. This is done due to the
presence of AC voice signal at the wrong DC level! (4) The black box will not
work under ESS or other similar digital switches since ESS does not connect the
voice circuits until the fone is picked up (and billing starts). Instead, ESS
uses an "artificial" computer generated ring.

Ringing

To inform a subscriber of an incoming call, the Telco sends 90 volts (PK) of
pulsing DC down the line (at around 15 to 60 Hz; usually 20 Hz). In most phones
this causes a metal armature to be attracted alternately between two
electromagnets, thus, striking two bells. Of course, the standard bell
(patented in 1878 by Tom A. Watson) can be replaced by a more modern electronic
bell or signaling device.

Also, you can have lights and other similar devices in lieu of (or in
conjunction with) the bell. A simple neon light (with its corresponding
resistor) can simply be connected between the red and green wires (usually L1
and L2 on the network box) so that it lights up on incoming calls.

Be advised that 90 VDC can give quite a shock. Exercise extreme caution if you
wish to further pursue these topics.

Also included in the ringing circuit is a capacitor to prevent the DC current
from interfering with the bell (a capacitor will pass AC and pulsing DC while
it will prevent straight DC from flowing - by storing it).

Another reason that Telcos hate black boxes is because ringing uses a lot of
common-control equipment in the CO, which uses a lot of electricity. Thus, the
ringing generators are being tied up while a free call is being made. Usually
calls that are allowed to "ring"  for a long period of time will be construed as
suspicious. Some offices may be set up to drop a trouble card for long periods
of ringing and then a "no-no" detection device may be placed on the line.

Incidentally, the term "ring trip" refers to the CO process involved to stop
the AC ringing signal when the calling fone goes off hook.

It is suggested that you actually dissect fones to help you better understand
them (regardless of whether or not you want to build any devices). It will also
help you to better understand the concepts here if you actually prove them to
yourself. For example, actually take the voltage readings on your fone line (any
simple multitester (a must) will do). Phreaking and/or learning is an
interactive process, not a passive one!

(Any questions on the above? Write us and we ll try to answer them.)