Exploding The Phone db318 www.explodingthephone.com Bibliographic Cover Sheet

Title Inside Ma Bell

Publication 73 Magazine

Date 1975-06-00

Author(s) Whipple Jr., Spenser

V/I/P p. 67

Abstract Overview article on the operation of the telephone network from a ham radio perspective. Includes schematic circuit diagrams for red and blue boxes.

Keywords 73 Magazine; blue box; red box

Source Alan Rubinstein

The following pages may contain copyrighted material. We believe that our use of this material for non-commercial educational and research purposes constitutes "fair use" under Section 107 of U.S. Copyright Law. If you wish to use this material for purposes that go beyond "fair use," you must obtain permission from the copyright owner, if any. While it will make us slightly sad to do so, we will nonetheless comply with requests from copyright owners who want their material removed from our web site. Spenser Whipple, Jr. c/o 73 Magazine Basic Telephone Systems Peterborough NH 03458 Conclusion

Inside Ma Bell

he automatic couplers we have in many combinations. T described so far would be ideal for a On the right-hand side we see that a repeater autopatch or possibly an answering +21 volt supply is connected to the CT machine or automatic dialer (although we'll output through one transformer winding, mention others specifically designed for while ground is connected to the CR lead answering machines and dialers later), but to through a resistor and another transformer connect just a few extension phones we need winding. This provides the talking power to a bit more. We need a battery to provide the ex tension phone, and the voltage drop power for the carbon mike, a series relay to produced across the resistor when the exten­ detect when the extension goes off hook and sion is off hook is sensed by the control when it dials, and also a 20 Hz ringing circuits and used to operate the line relay. generator to ring bells. When you pick up the extension phone, the line relay closes and puts the coupler on the While it is no great problem to build just line. As you dial, pulses are repeated by the this, if all you want is a telephone­ line relay. company-approved way to connect 10 ex­ tensions in your 25-room mansion, you can The ringing circuit is also interesting. As order the STC Voice Connecting Arrange­ usual, a ring detector across the line detects ment for $5.80 a month plus $25 installa­ the 20 Hz ringing and pulses a relay. But tion. usually the relay pulses at 40 Hz, once on each half cycle of the 20 Hz. In this case the As shown in Fig. 12, the STC has only circuit is set up so the ring relay pulses at one varistor but two transformers. As usual, only 20Hz. The ringing generator is simply a the main PC board ( KS-20721) is used in de-to-de inverter which changes 21 volts de almost a dozen different couplers and has a into about 120 volts de. The ring relay number of jumpers which can be hooked up contacts then change this into 20 Hz ac by

JUNE 1975 73 MAGAZI NE 67 reversing the polarity to have at a 20 Hz rate a message unit counter on your LINE {remember, an x means a normally open premises to keep track of your own message RING RELAY contact, while the short line means a nor­ units. Probably intended for hotels and mally closed contact). The resulting ringing motels, which charge guests by the call. TO PHOfi!E signal is then applied to the CT and RV1 The RDL, RDM, RDMZR, RDMZY and LINE leads. ROY couplers LINE are various versions designed TIP RELAY As mentioned in the figure caption, any for telephone answering machines or for number of extensions can be hooked up, but automatic recording {dictating) machines. the ringing generator can only feed a maxi­ Depending on the model, you get one-way • 2111 ~ LINE mum of three bells. This means that all the or two-way transmission, volume limiting, or REL non-ringing extensions need only two-wire automatic cutoff when the message stops. connections via the CT and CR leads; unfor­ The RCT and RCW are couplers for tunately the three ringing phones require a recording a two-way conversation. The RCT three-wire connection. This is done in order automatically generates a beep every 15 •2 to keep the coupler simple, as it is a bit seconds, and the RCW doesn't. I think only messy to test for de continuity {off hook) law enforcement agencies can get the RCW. Fig. 12. Simplified diagram of ST on the tip and ring leads at the same time The RCT runs $2.46 a month and $12.30 number of extension telephones car {there is 100V ac there) as it is normally installation, while the RCW is only $1.23 a generator so it could be used for done at the CO. month and $12.30 installation. The RCZ is but not to ring them. The STS For some reason this coupler has the ring similar. $25 installation) is the same as {CR) and tip {CT) leads mixed up. In Fig. The RTT and RC1 are similar, but only but with an added volume 12, we see that the ringing generator applies beep. Used with a customer owned call received audio. its voltage between the CT {tip) lead and duration timer, they beep to tell you you've Of greater interest, especially RV1. Since the ringer goes between the red been talking too long. The RTT sends the (though expensive compared to a and yellow wires in the extension {see Fig. beep to both parties, while the RC1 only version) control of things like r 2), that means that the red wire has to go to beeps the local party. the SU4 or SU6 coupler. Both ar the tip and the green to the ring side of the The SU7 and SU7QW {at $3.85 a month the CAU with the SU4 being 0 1 line. A rotary dial phone won't mind this, and $25 installation) allow outward dialing the SU6 being two way. In nc but a Touchtone phone won 't work like this. only for automatic dialers. service, both of these allow an al You have to move the black ringer wire from Finally, there is a group of couplers out and send a voice or tone mess the L2 terminal to the L1, and then connect designed for burglar and fire alarm systems. addition, they allow remote tes red to ring (R to R) and green to tip, as Real fancy alarm systems may have a private alarm. normal. line running straight to a police station or They work like this: To test Let's just quickly cover some other private detective agency; a somewhat you need either a 1475Hz tone g couplers you might be interested in : cheaper alternative is to get an automatic a Touchtone phone {which can The GC2 is just a plain ring detector, dialer which dials a number and then feeds high-group tone of 1477 Hz if similar to the one in Fig. 7, which closes a in a tape-recorded message. That's where taneously push two buttons in relay contact when there is ringing voltage these couplers come in {although burglar hand column {3-6-9) . You call 1 on your line. alarm installers often connect a dialer SU6 coupler from the outside. l The CTD is a toll-denial relay which directly without a coupler.) detects the 20 Hz ringing, answ< senses long distance calls. The CAU coupler ($4.36 a month and and automatically sends a pulse The C1 V and HZM couplers monitor a $14.4 7 installation) allows an alarm dialer to tone back to you. Now it wail line and provide a signal when the line is seize the line (and at the same time discon­ 14 7 5 Hz tone; if no such tone busy. Intended to allow customers to run nects any other telephones on the line to simply waits 20 seconds and han timers or pen recorders to measure line prevent a burglar from interfering with the gets 1475 Hz, it gives the alarrr usage . call), dial a call , and then play a pre-recorded have-you) a relay contact clr The CEZ and CEZAW couplers allow you message. It provides only one way outgoing changes the pu Ised 2125 Hz to a to make conference calls if you have two or audio transmission. An SU6AQ coupler {at tone to confirm receipt. By . more lines. Actually, just shorting the two $4.25 a month and $25 installation) is also relay closures the alarm can now lines together {tip-to-tip, ring-to-ring) would for alarm systems but allows two-way voice 2125 Hz, send out audio {and i work just as well . and tone transmission; it has a ring detector receive audio), or wait for fu rthr The CEK coupler, along with an extra and is actually built just like the STC signals. Altogether a very interest line and some changes in the CO, allows you coupler {Fig. 12) but without a ringing It is fairly hard to get infor

68 73 MAGAZINE JUNE1975 essage unit counter on your LIN[ RELAY :ep track of your own message AI .. G CT dy intended for hotels and charge guests by the call. TO •21 V PHON E ROM, RDMZR, RDMZY and LINE t LINE If> '--- REO are various versions designed RELAY TIP ~I1 CR ±J7 I GREEN answering machines or for ording (dictating) machines. r- VELLOW the model, you get one-way I CONTROL I EXTENSION •21 v TELEPHONE LINE 1 CIRCUITS nsmission, volume limiting, or RELAV J ff when the message stops. l RING RINGING l and RCW are couplers for DETECTOR D GENERATOR .25_ RUI )-way conversation. The RCT R ING • 2JIV generates a beep every 15 ) RELAY 1e RCW doesn't. I think only nt agencies can get the RCW. Fig. 12. Simplified diagram of STC Coupler, when equipped with options W, Z , S, P and X. Any $2.46 a month and $12.30 number of extension telephones can be connected, but the ringing generator can only drive three bells. 1ile the RCW is only $1.23 a generator so it could be used for extensions these and other couplers from your local 2.30 installation. The RCZ is but not to ring them. The STS ($5.65 and telephone company. For each coupler there $25 instal lation) is the same as the SU6AQ is a Technical Reference supposedly avail­ 1d RC1 are similar, but only but with an added volume limiter for able from "the local Telephone Company ith a customer owned call received audio. Business Office or the Marketing Representa­ they beep to tell you you've Of greater interest, especially for simple tive." Unfortunately, the gals in the Business >o long. The RTT sends the (though expensive compared to a homebrew Office don't know what you're talking parties, while the RC1 only version) control of things like repeaters, is about, and the marketing reps have unlisted :>arty. the SU4 or SU6 coupler. Both are similar to numbers. If you don't ask for too many at a j SU7QW (at $3.85 a month the CAU with the SU4 being one way and time, I've found that the best way to get ation) allow outward dialing the SU6 being two way. In normal alarm Technical References is with a neat letter ttic dialers. service, both of these allow an alarm to dial (preferably on letterhead) to the Engineering re is a group of couplers out and send a voice or tone message. But, in Director, Transmission Services, American rglar and fire alarm systems. addition, they allow remote testing of the Telephone and Telegraph Co ., 195 Broad­ n systems may have a private alarm. way, New York, New York 10007. Publica­ ·aight to a police station or They work like this : To test the alarm, tion Pub-40000 is an index of the Technical ive agency; a somewhat you need either a 1475Hz tone generator or References available and is a good starting tive is to get an automatic a Touchtone phone (which can generate a point. These publications are intended for 1ls a number and then feeds high-group tone of 1477 Hz if you simul­ customers and so they will tell you what the ded message. That's where taneously push two buttons in the right­ coupler will do and how to use it the way come in (although burglar hand column (3-6-9) . You call the SU4 or they want it used, but not what's in it. The · often connect a dialer SU6 coupler from the outside. The coupler latter information (on couplers and most a coupler.) detects the 20 Hz ringing, answers the call, other telephone company equipment and 1upler {$4.36 a month and and automatically sends a pulsed 2125Hz procedures) is contained in BSPs (Bell on) allows an alarm dialer to tone back to you. Now it waits for your System Practices). These are "cookbooks" nd at the same time d iscon- 1475 Hz tone; if no such tone comes, it for installers and repairmen which tell them telephones on the line to simply waits 20 seconds and hangs up . If it anything they need to know; I wouldn't be .r from interfering with the gets 1475 Hz, it gives the alarm (or what­ surprised if there is a BSP somewhere telling Ind then play a pre-recorded have-you) a relay contact closure, and them how to climb a ladder or drive a truck. ides only one way outgoing changes the pulsed 2125 Hz to a continuous If you've been reading carefully so far, )n. An SU6AQ coupler (at tone to confirm receipt. By appropriate you've probably been wondering who these and $25 installation) is also relay closures the alarm can now silence the phone phreaks are whom I mentioned a few 1s but allows two-way voice 2125 Hz, send out audio (and in the SU6, thousand words ago. We've actually alluded ission; it has a ring detector receive audio), or wait for further 1475 Hz to two other related items, the magic sig­ built just like the STC signals. AI together a very interesting gadget. nalling frequency of 2600Hz, and billing for 2) but without a ringi ng It is fairly hard to get information on very short calls. Maybe now is a good time

73 MAGAZI NE JUNE 1975 69 to explain. But first a word of caution: The which puts a very fast short circuit across following technical information is a matter the line}. you get the bell to stop! That's all of public knowledge and has been previously there is to the Black Box. published in many places {see, for example, Somewhere along the line, somebody Esquire for October 1971 and Ramparts for came up with an even neater version: if a june 1972 and October 1972.} Although 1 Ok resistor is placed in series with the you are free to read it and marvel at the phone, enough de current passes through to ,,. •9VJ,01 perseverance of a group of blind kids don't provide talk current for the carbon mike, try to use it yourself. The phone companies but not enough to trip the CO relays. A are very uptight about the following subjects lpF capacitor or so across the resistor is and don't hesitate to prosecute anyone they needed to let audio through, as well as an catch using the techniques we're about to SPST switch to remove the resistor when not describe. needed. On a 500 style telephone the extra Sometime in the late sixties, a few blind capacitor is not even needed if the 1 Ok kids interested in the phone company resistor is placed between the F and RR happened to meet at a camp for the blind. terminal on the network (see Fig. 3) and the • 9V By pooling their knowledge and talents switch is placed in series with the pulsing {excellent hearing and musical pitch, as well contacts of the dial. as lots of free time to experiment) they were Before continuing, let us again stress the able to develop a number of techniques for admonition that you not use any of these Fig. 13. Early version of the Red B diodes 1N914 placing and receiving free long distance calls. ideas - they are presented here only for or similar, resistors polystyrene. Elated with their knowledge, they got great your own information. As mentioned earlier, kicks out of routing their calls through widespread usage of any of these techniques like the one in the payphone, "' foreign countries and even all around the could cause havoc and the telephone speaker to couple it to the mike. world. Some of them even got to be quite companies are determined to catch any users are coded as follows: famous - ever hear of Captain Crunch and as fast as possible. They are hard at work to Nickel - One 60 millisecond puis' his magic whistle, which just happened to develop equipment which would identify Dime - Two 60 ms pulses separ whistle at 2600 Hz? · and trace such calls, and a number of people ms; The simplest of their techniques involves have already been prosecuted. For example, Quarter - Five 35 ms pulses sepa1 the so-called black box, which allows you to rumor has it that black boxes can be ms. receive free long-distance calls (calls for detected on calls longer than a minute or Some of the phone phreaks mL which the other party is not charged}. It two in duration. knowledgeable about electronics works like this: Another device is popularly called the Box circuits are reasonably mod When someone calls your number, the Red Box. If you remember the old-style coin using ICs. dial system connects his phone to your phones with three coin slots on top {nickel, Fig. 13 shows an early version phone and then starts ringing your bell. If dime, and quarter}, you may remember the Box. To sec how it works, supp• you had a way of coupling to your line sounds they made when you dropped a coin button is pushed. This starts between the rings in such a way that you in - two bells inside made a ding on a multivibrator (02 and 03}, whic didn't complete the de circuit, you could nickel, a ding-ding on a dime, and a bong on turning it on 60 ms, and off actually talk to him without his being a quarter. Unfortunately, some unscrupulous shorts the output of Q1, th• charged for the call, because as far as the CO individuals either looted a pay-phone and oscillator, generating pulses of tc is concerned, there is no de connection and stole the bells, or tape-recorded the sound, Q7 are a timer that lets exactly t therefore there is no answer at your end. and then used this to fool operators into pulses reach the IC, which feed Of course, the 90 volt ringing signal thinking that calls were being paid for. To True to form, the phone phreal makes it tricky, because it can blow your counter this, a new coin phone was designed use a 600 Ohm earpiece (borro eardrum out. Wouldn't it be nice if you which used an electronic oscillator, rather phone handset) rather than could stop it? Then you could talk contin­ than a bell , to signal the type of coin speaker. uously. But we mentioned earlier that the inserted. When the oscillator is on, the A later version, in Fig. 14, is call doesn 't register unless it lasts a second or earphone is muted so you can't hear it, and more sophisticated. IC1 is the t so. By picking up and then slamming down an electronic gizmo indicates to the operator IC2 is the astable. the regu Jar telephone set as fast as possible how much money was inserted. The most famous {and most {or having a ring-detector relay as in Fig. 7 The Red Box is simply a 2.2 kHz oscill­ well as most dangerous) is the with its n.o. contacts right across the line, ator, switched on and off electronically just Because it goes to the heart of I<

72 73 MAGAZINE JUNE 1975

··- ____, ______;i______... ery fast short circuit across !t the bell to stop! That's all lack Box. along the line, somebody

an even neater version: if a IO,.F placed in series with the •9V k current passes through to 01 r-+------.,}:gRPifCE rent for the carbon mike, r 1201( relays. A 0022 •9V 1 to trip the CO •9V is x so across the resistor 620 1( Jdio through, as well as an emove the resistor when not )0 style telephone the extra t even needed if the l Ok d between the F and RR network (see Fig. 3) and the ! M EG

in series with the pulsing I MEG ial. let us again stress the •uing, are NPN silicon (2N2222 or HEPSS), Fig. 13. Early version of the Red Box, circa 1972. Transistors you not use any of these are high quality mylar, epoxy, or 1N914 or similar, resistors ~ Watt, 5%. Small capacitors prese nted here only for diodes ·e polystyrene. a tion. As mentioned earlier systems, let's talk about long : of any of these technique~ like the one in the payphone, with a small switching for a while. avoc a nd the telephone speaker to couple it to the mike. The pulses distance calls way at the beginning of this :termined to catch any users are coded as follows: All the Fig. 1, we showed your local CO e. They are hard at work to Nickel -One 60 millisecond pulse; article, in connected to other local sub­ ent which would identify Dime - Two 60 ms pulses separated by 60 as being COs, and also to long distance il ls, and a number of people ms; scri bers, other centers; the latter are called n prosecuted. For example, Quarte r - Five 35 ms pulses separated by 35 switching :hat black boxes can be ms . "tandems." COs in any city, just as s longer than a minute or Some of the phone phreaks must be fairly There are many tandems throughout the knowledgeable about electronics as the Red there are many clearly be impractical for ;e is popularly called the Box circuits are reasonably modern - even country. It would connected directly to every ·emember the old-style coin using ICs. every CO to be likewise it's not practical for e coin slots on top (nickel, Fig. 13 shows an early version of the Red other CO, and be connected difectly to :r) , you may remember the Box. To see how it works, suppose the 10¢ every tandem to This means that in a e when you dropped a coin button is pushed. This starts an astable every other tandem. as over common routes inside made a ding on a multivibrator (02 and 03), which feeds Q5, few instances (such to Chicago) a long distance g on a dime, and a bong on turning it on 60 ms, and off 60 ms. Q5 - say, New York directly from a tandem Jnately, some unscrupulous shorts the output of 01, the 2.2 kHz call may be routed to another tandem near r looted a pay-phone and oscillator, generating pulses of tone. 06 and near New York a call may have to r tape-recorded the sound 07 are a timer that lets exactly two of these Chicago. But many times several tandems - his to fool operators int; pulses reach the IC, which feeds a speaker. be routed through for instance, might go Is were being paid for. To True to form, the phone phreaks prefer to Chicago to San Diego, Because of this, the :w coin phone was designed use a 600 Ohm earpiece (borrowed from a through Los Angeles. arranged that if they cannot lectronic oscillator, rather phone handset) rather than buying a tandems are so call directly (either because all direct signal the type of coin speaker. route a busy, or else there are no direct the oscillator is on, the A later version, in Fig. 14, is quite a bit lines are route a call some more d so you can't hear it, and more sophisticated. IC1 is the timer, while lines) they simply indirect way. Also, if a tandem office 10 indicates to the opera tor IC2 is the astable. intended for it, it just was inserted. The most famous (and most powerful as receives a call not the right direction. is simply a 2.2 kHz oscill­ well as most dangerous) is the Blue Box. relays it on in there is a direct connection and off electronically just Because it goes to the heart of long distance Whenever

73 73 MAGAZINE JUNE1975 between tandem offices, that may consist of the equipment used to set up a connection many lines, carrying many simultaneous (called a sender) is shared among many lines. conversations. Actually, we shouldn't use Whenever a sender has a call to handle, it the word "lines," because in reality these searches for an idle line; when it finds one it conversations may be multiplexed onto latches onto it and then forwards the call. As coaxial cables or microwave links. This soon as it is finished , the sender leaves the means that dialing can't take the form of de call and goes to service another call. To mark pulses, as in your home phone, but always an idle line, the tandem office feeds a 2600 consists of pairs of tones called multi­ Hz tone into it. frequency or M F tones, similar to Touch­ Now let's examine a typical call - tone dialing. The only difference is that the suppose you place a call from New York to frequencies are different from those used 1n Los Angeles. You pick up your phone in Touchtone dialing, as follows: New York and dial area code 213 for Los Digit Frequencies (Hz) Angeles, followed by the seven-digit number. That 1 700 + 900 number is stored in a register in your 2 700 + 1100 CO, and now two things happen. First, an 3 900 + 1100 accounting machine called CAMA - Cen­ 4 700+ 1300 tralized Automatic Message Accounting - Rfr 5 900 + 1300 keeps track of 6 1100 + 1300 your call. This is done by 7 700 + 1500 punching your number, the time, and the 8 900 + 1500 number you dialed into a paper tape (which 9 1100 + 1500 will later be fed to a computer). Your CO 0 1300+ 1500 now sets up a connection with the nearest In addition, 3 additional signals are : tandem office and sends the area code and KP (Key Pulses) 1100 + 1700 number you dialed to the ST (start) tandem. In the 1 500 + 1 700 tandem a sender decides Disconnect 2600 on the route, and t~ starts looking for an idle Iin e. Suppose there Another aspect to keep in mind is that it is an idle direct connection from this tandem takes quite a bit of equipment to establish a to the one in L.A. Since this line can be used connection, but little equipment Even with is needed for calls in either direction, both tandems thousands of ampl to maintain it. To avoid useless duplication, our one man repair are marking it as idle by feeding 2600 Hz departmer more than four hours each repairs and modifications ... his time is spent making sure tt­ that are shipped won't comet to repair. • 9V Because of our extra attenti ity control our amplifiers a by more government agenci vate organizations than any ot of its type. Our product line is the only by many major two-way rad turers for use with their prodL

TPL pt

Fig. 14. Later version of the Red Box, circa 1973.

74 73 MAGAZINE JUNE1975 -- ·------=---- TO OS<

Fig. 1 s. Early version '

into paper tape. Once a da· to the computer, which th• and eventually uses it to prE The CAMA tape runs 0 1 calls on which there is no are free (such as informati• area code 800). It's up to decide at the end of the rr and how much. This, by th to detect black, blue and record is kept of all calls Chester County (Pa.) Detective Ronald Johnson (right) displays an illegal "Blue Box" can be programmed to I used to bypass toll charges and seize long distance telephone circuits. Johnson and Chief picious calls. of County Detectives Eugene Sharpe (left) were part of a law enforcement raided several team which Now, where does the Chester County residences of suspected "phone phreaks." Four persons were arrested in connection the story? The Blue Box with charges ranging from toll fraud to impersonation of telephone company employees and, in one case, wiretapping. Authorities thirteen buttons ·and t carloads" said "several of illegal equipment were confiscated, some of which is shown here. generate the MF tones - ST and 2600 Hz disconne into it, one from each end. When the other party answers, the ringing acoustically coupled from Now the sender finds this idle line. First, stops and a signal is sent all the way back to the mike of the phone. to prevent L.A. from trying to send a ca ll in your CO to indicate that the call has reached phreak can use the toll ci~ the opposite direction at the same time, the its destination. This too is punched into the anywhere in the world WI New York sender removes its 2600Hz tone. CAMA paper tape. enough knowledge of tt This tells L.A. that a call is about to come If you hang up first, your CO of course route himself via a spec on this line, and soL A. assigns an incoming knows this immediately. On the other hand, even choose whether he ' sender to it. The New York sender sends the if the party hangs up first, a signal has to be satellite. Some phone I 213 are a code and the 7-digit number to sent back to your CO. The L.A. CO notifies sitting in a phone booth a L.A., using the MF (multi-frequency) tones the L.A. tandem, the LA. tandem puts 2600 the very next booth all t described earlier. The code is preceded by Hz back on the line to signify a disconnect, whole globe; then they the KP tones, and followed by the ST tones. the New York tandem gets the tone and and enjoy the fact that tl The LA tandem office decodes the tones breaks the connection, and notifies your CO. by having to travel all t and, in this case, connects you to the CO If you listen carefully, you may hear a short world. serving the party you dialed. The CO now burst of 2600 Hz just before the connection The procedure for us decodes the last four digits of the number, is broken at your e nd. simple. You start by pia• connects you to the proper line, and starts At this point your CO again punches your call in the normal ringing it. wa number, the time a nd the number you dialed number (information o

76 73 MAGAZINE JUNE 1975 TO ANOTHER OSCILLATOR

FROM OTHER { OSCILLATORS

,------15K

47K I EARPIECE IFROM OTHER { I OSCILLATORS R I I R I f '); zc l j L_o~~~~~~~!£.R~ __ oscillators are needed. Box, circa 1972. Seven identical Fig. 15. Early version of the Blue number) or else to a .close-by destination tape. Once a day this tape is sent into paper is cheap to call. This is the call which which then reads the tape which to the computer, on the CAMA tape. Since a long prepare the bill . will appear and eventually uses it to to a non-ex is tent call, even call to information or The CAMA tape runs on every phone number is suspicious, dedicated on which there is no answer, or which calls usually make sure to use a valid 800 as information calls or calls to phreaks are free (such or, if not too stingy (or stubborn), It's up to the computer to number area code 800). to a nearby place. what to bill even a paid call decide at the end of the month your nearby way Once dialing is completed, how much. This, by the way, is one and routes the call to the tandem office blue and red boxes since a tandem to detect black, possibly ·through inter­ all calls and the computer at the destination, record is kept of the way. As soon as for any sus­ mediate tandems along "Blue Box" can be programmed to look end, you you hear ringing from the other >nand Chief picious calls. for one into feed 2600 Hz into your phone team which Now, where does the Blue Box fit 'our persons box with second. the story? The Blue Box is just a of Your local CO is unaccustomed to getting ·sonation buttons ·and the oscillators to thirteen and so simply ignores it, but passes :aid "several tones - 0 through 9, KP, 2600 Hz generate the MF tandem. These tones are it on to the nearby ST and· 2600 Hz disconnect. 2600 Hz as a Box into This tandem can recognize s, lhe ringing acoustically coupled from the Blue but is disconnect idle from other tandems, back to mike of the phone. With it the phone way the to react to the signal coming from the toll circuits to place calls not built I has reached phreak can use it and passes it on. But charge. With a CO. So it ignores :hed in to the anywhere in the world without hung up, the next tandem, thinking you knowledge of the system he can enough the call. This leaves you hanging, still via a specific path and can cancels :o of course route himself to a toll line between tandems . he will go via cable or connected ! other hand even choose whether 2600Hz, you remove it. delight in After one second of .nal has to b~ satellite. Some phone phreaks that the line is to The distant tandem now sees notifies in a phone booth and routing a call an . CO sitting longer idle, and so it connects all the way around the no m puts 2600 the very next booth sender. As soon as you hear the talk to themselves incoming t disconnect, whole globe; then they this, you have ten seconds to voice is delayed click signifying 1e tone and and enjoy the fact that their , preceded by KP and the dial the desired number 'ies your CO. by having to travel all the way around (603) followed by ST. For example, to call hear a short world. you would press the Blue Box is 924 - 3873 ! connection The procedure for using KP6039243873ST. . You start by placing a long distance is sent I simple When the number answers, a signal either 'to a free unches your call in the normal way tape punched to indi- series back and the CAMA ·r you dialed I number (information or a valid 800 I 77 I 1975 l MAGAZINE ) JUNE cate the connection time. At the end of the where the best values for R are between call, the CAMA tape is again punched with about 30k and 1 OOk. In all of these circuits, Mobil your number, the time and the number you see Fig. 15 for component data. Since disk originally dialed. This is the call and time for capacitors are very unstable with tempera­ which you will be billed (unless it is free) ture, frequency-determining capacitors and the number actually 220 MHz reached with the should be good quality mylar or preferably Blue Box is not recorded. poly sty rene. • 10 W in - 60 W ou Since all calls are punched into the Fig. 16 shows a later version of the Blue • 9 dB linear gain CAMA tape, even the most daring phone Box, showing real state-of-the-art design • Under 1 dB Rx (0 phreakers would use a pay phone rather thall with all ICs. The LM100 (or LM300) regula­ Model # 113M 10 -6 their home phone. Moreover, since the mere tor is needed to assure stable frequency possession of a Blue Box might be con­ characteristics - my own preference is a sidered suspicious, some record the tones on 723, which uses a similar circuit, and is 144 MHz a cassette and then erase it as soon as easier to get. • 10 Win - 70 W ou possible. The actual Blue Box circuitry is The use of the lntersi l 8038CC shows a • 10 dB linear gain interesting not only for the insight into the good knowledge of the field by whoever • Under 1 dB Rx (0 technical competence of the phone phreaks, designed this circuit in late '73 or early '74. Model #2M 10-70L but also because with just a retuning, it can The uninitiated wouldn't know about this be used for Touch tone generation. new ultra-stable IC which, unlike the 566 or Fig. 1 5 shows an early version of Both a Blue other popular oscillator ICs, generates a very Amps: • Box, where each tone is generated by a low-distortion sine wave. Only two oscilla­ • separate o ne-transistor oscillator. There tors are needed, as the switches and diodes • would be a total of . 7 oscillators and 13 select different pots for different tones. • push-buttons, with each push-button (except Although most Blue Boxes seem to use plain • the 2600 Hz disconnect/idle button) feeding push -buttons, Chomerics makes nice • two oscillators, through a diode. switches which are sui table. • The Twin-Tee oscillators generate a rela­ just to give you an idea of the power of Seeym tively clean sine wave, but some juggling of the Blue Box, here are some numbers and values is needed. The oscillation frequency is destinations that have been published in f = 1 various places: 27T RC Vegas Radio 1108 S. 3rd Las Vegas NV 89101

-{If r { r 700f"l ~ 7 -'l~.6 , 4 ~ 900 r1 II OO_f"l 45' t> oo .n [:[ .:"'.:' .! 6 f-01 I' r~2K 741 1700 .f:l » --;+,- , 2 • •

9 00 rl !. • 1 0 ~ lOOK 1100 .r-1 ~ ,l . . EARPIECE 13 0 0 .rl Q8038 CC 15oo T1 I "II 3.9 I 2 600 .r-1 1'~ 0 1 82K INV I 7 • IOV REGU LATED r r 2 l. 1K J L M IOO r6t47p F "' ...=.. 1 ~ · 18 V J: 1. 8K l

Fig. 16. Later version of the Blue Box, circa 1974. The polS are 25k; .01 uF capacitors are mylar or TUf polystyrene.

78 73 MAGAZINE JUNE 1975 various colored boxes described in this London weather: KP 044 1 246 8091 ST article; the information presented here has Sidney, Australia weather: KP 061 3 6064 ST been written only for your own information Sidney time: KP 061 2 2074 ST and entertainment, not as a guide for con­ struction or use. The digits 044 or 061 in the above (AUTHOR'S NOTE: Some time after this numbers are the country codes agreed on by article was written, AT&T, in response to a Dirt ChE the CCITT; further information on country complaint lodged with the FCC by Phone­ codes, Blue Box tone frequencies, etc., is Mate Corp., a iarge manufacturer of tele­ published in Chapter 2 of Reference Data phone answering machines, made a con­ for Radio Engineers (Howard W. Sams) as cession in its insistence on the use of a for well as in an underground (and sometimes coupler with an answering machine. It nasty and violent} newsletter called TAP ( $2 ap pI i es only to telephone answering for a one-year subscription from TAP, Room machines though. For a fee, the Bell System 504, 152 West 42 Street, New York NY will license the answering machine manufac­ turer to build and 10036}. install a coupler directly aving ~ 6 n:eter Tunaver Further information may be obtained into the answering machine, using a design H tried 1t w1th var1ous sr from a book entitled Basic Telephone developed by Bell System engineers. The radios, I thought there had to Switching Systems by David Talley (Hayden coupler consists of several transistors, resis­ better. I began to look for a u Book Company}, Communications System tors and capacitors, limiting diodes, a relay, auto radio that was small and Engineering Handbook edited by D. and a three-winding transformer, and is lucky - I found two that w estimated Hamsher (McGraw-Hill Book Company} and to cost less than $20 to build . It is foreign car:o (one was a Mot basically various telephone company periodicals. The a receive-only coupler which pre­ other was a Peptone, which vents the answering machine Bell System Technical journal should be from dialing Volkswagen uses) and they C• outgoing available in most engineering college calls. Although further details two. One had a broken pia: haven't libraries, and carries a lot of abstract and been released at the time of writing, (which epoxy cured) and the it doesn't mathematical articles as well as some fairly look as though the answering dirty. machine manufacturers practical descriptions. For example, the will be making these I saw a picture of a set-u~ couplers November 1960 issue has an article on separately for updating older mounted a car radio and c machines, "Signaling Systems for Control of Telephone and there seem to be quite a few cabinet, making a VHF solid s Switching." A much more readable publica­ strings attached.) he was using it as it was. tion is the GTE Lenkurt Demodulator {GTE {SECOND AUTHOR'S NOTE: Gradually, Motorola to change. Be sure Len kurt, 1105 Country Road, San Carlos more details are coming out about the your radio before any chan CA 94070) which is a monthly magazine strings attached to the coupler offer to repairs if needed. As is , they availabie free to people working in the answering machine manufacturers. AT & T hard on batteries (even sma communications field or in schools. will consider only inquiries from actual you have a transistor transmit The GTE equivalent of the Bell Systems manufacturers, who must submit a $1000 lator working from the sam Practices is called the General System Prac­ non-refundable "inspection fee," for which power stage alone, accordi tices, and may just possibly be available AT &T will send a team to inspect the records, draws 350 rnA. Stil locally or from GTE Automatic Electric manufacturer's factory to determine dry batteries? Inc., Northlake, Illinois. You may also be whether he is "qualified" to manufacture I took the cheap way out. able to get your hands on a mail-order the coupler. Only if he passes, will AT &T stripped AM/FM radio and I I course offered some years ago by Don discuss the price with him, apparently on a and cut the push-pull audi• Britton Enterprises in Hawaii. A new book, take-it-or-leave-it basis. The coupler design repa.ired the broken (sawed How to Cut Costs and Improve Service of appears to be more complicated than was soldered leads to it and m01 Your Telephone, Telex, TWX and Other announced originally, and includes an opto­ radio where the original outp Telecommunications by Frank Griesinger electronic coupler - neon bulb/photocell had been located. Mine h (McGraw-Hill} and a monthly magazine combination - to detect ringing, similar to ground , so I had to insula called " Communications News" are other the circuit on page 31 of the April 1974 chassis by fiber washers. possible sources. issue of 73 Magazine. Only time will tell how The emitter's resistor was In closing, I would again I ike to caution many answering machine manufacturers will but the transistors heated up readers that the telephone companies do decide to gamble the $1 000 on such a basis.) so I broke the lead and add their best to "discourage" the use of the ... WH IP PLE resistor and all was well. My

80 73 MAGAZINE JUNE1975