Message-Id: <8705240511.AA01756@buita.bu.edu>
Date: Sun, 24 May 87  1:10:53 EDT
From: The Moderator (JSol) <TELECOM-REQUEST@BUIT1.BU.EDU>
Reply-To: TELECOM@BUIT1.BU.EDU
Subject: TELECOM Digest V7 #5
To: TELECOM@BUIT1.BU.EDU
Status: O


TELECOM Digest     Sun, 24 May 87  1:10:53 EDT    Volume 7 : Issue 5

Today's Topics:

 Submission for comp.dcom.telecom (Communication Progress for Criminals)
----------------------------------------------------------------------

Date: Fri, 22 May 87 23:19:07 EDT
From: kitty!larry@seismo.CSS.GOV
To: seismo!xx.lcs.mit.edu!telecom@seismo.CSS.GOV
Subject: Submission for comp.dcom.telecom (Communication Progress for Criminals)
Cc: kitty!larry@seismo.CSS.GOV


> In a recent article dmt@ptsfa.UUCP (Dave Turner) writes:
> 
> The following is from an editorial by Wayne Green in the June, 1987 issue
> of 73 Amateur Radio magazine:
> 
> The recent legislation making cellular phone calls illegal to listen in on
> has provided a bonanza for both organized and disorganized crime. It's
> difficult not to laugh over the situation the cellular industry has gotten
> itself into in its blind pursuit of the fast buck.
>
> What's happened is a mass move into cellular by criminals. They buy a
> cellular system, have an unscrupulous dealer alter the electronic serial
> number (ESN) on the built-in programmable IC, which makes calls both
> untraceable and free--a great combo. They tool around town, making calls
> to Pakistan, Columbia, and their Caribbean drug warehouses at will.

	I have a few comments to make on this and some related topics which
may be of interest to Net readers.  My comments are based upon personal
knowledge and experience as one who has provided some forensic science
consulting services to certain law enforcement agencies for a number of years. 

	It's sort of interesting to note that it was even easier to implement
spoofing fraud in dial IMTS mobile telephone installations, but such fraud
has been virtually unheard of.  The reasons for this are: much fewer IMTS
channels and much fewer IMTS customers than cellular make such fraud extremely
conspicuous; most IMTS installations are combined with MTS installations and
have a high probability of telephone company (or RCC) operator monitoring.
	My personal opinion is that cellular fraud has been encouraged due to
"safety in numbers". :-)

> Cellular has turned out to be great for coordinating every kind of criminal
> activity. It's just what criminals have been needing for years-- a
> dependable, free, untraceable, and safe communications system. With a
> combination of pagers and cellular phones, crooks are making a shambles
> of the cellular system--all protected by Congress.
> 
> If you wanted to deal in drugs, how better to get orders from your
> customers than by giving them your cellular phone number? There's no way
> to tap a telephone that can be anywhere in a big city, operating through
> different cells as it moves around. And with an altered ESN it's all free!

	Progress in telecommunications has unquestionably been of benefit to
criminal activity.
	Probably the single greatest benefit has been the introduction of call
forwarding.  This service has been of such great benefit to the conduct of
unlawful gambling, narcotics and prostitution operations that for many years
I have jokingly referred to it as: "1A Criminal Facilitation Service"; AT&T
and BOC people may appreciate the satire in this remark.
	As an example, an unlawful gambling operation could change location
every day or so, with the telephone number for bettors being the same.  This
situation also neatly defeats any court-authorized eavesdropping warrant since
there would never be conversations on the telephone pair that was the subject
of such a wiretap; a forwarded call never takes place on the physical line
whose number was dialed.  In earlier No. 1 and No 1A ESS installations there
was no rapid method to determine to what number a given line had its calls
forwarded; such determination could only be made by an experienced switchman
using the ESS maintenance tty.  This rather frustrated law enforcement
agencies in their investigation of unlawful gambling and narcotics activity.
Furthermore, I know of some instances where telephone company personnel flatly
denied to law enforcement investigators that they could determine the
forwarded telephone number; this was, of course, a false statement, but was
made in a  misguided effort to keep the telephone company "uninvolved".
	As an interesting aside, prior to the advent of ESS and call
forwarding, some larger unlawful gambling operations used an electronic device
called a "cheese box" that effected a rudimentary kind of call forwarding in a
manner similar to a loop-around test line.  Two telephone lines would be
ordered for say, an unoccupied office or apartment, and each line would
connect to the "cheese box".  The actual location of the gambling operation
would call the first line, and remain on the line and wait for calls; the
"customers" would call the second line, with the result that it would
auto-answer and be connected to the first line.
	Telephone company loop-around test lines were used for the conduct of
unlawful narcotics dealing during the 1970's, but this practice has generally
disappeared as telephone companies: (1) installed 60A control units or
equivalent devices that dropped loop-around connections upon the detection
of speech energy (legitimate use of loop-around test lines is for single
frequency transmission measurements only); and (2) went ESS and therefore had
"call trace" capability that would automatically determine the origin of
calls to loop-around and other test lines.
	After call forwarding, the next most useful communications adjunct to
criminal activity is the voice radio pager.  It is an unfortunate fact of life
that no self-respecting prostitute or "street dealer" of narcotics would be
caught without their voice pager.  Voice pagers represent an ideal, inexpensive
method of arranging clandestine meetings.  A typical voice pager scenario:
customer calls narcotics dealer's pager from a coin telephone, giving coin
telephone number; narcotics dealer finds coin telephone to call coin telephone
where customer is waiting to arrange for a meeting.  What could be simpler
and more untraceable?
	In my travels, I have known of only two instances where criminals used
any speech privacy devices (speech scramblers) to defeat eavesdropping (lawful
of otherwise); however, I suspect that a new generation of low-cost digital
speech privacy devices will result in more of these devices being used by
criminals.  The units that I have seen used were all based upon analog
"speech inversion" techniques; these devices are easy to defeat, whereas the
digital devices are virtually impossible to compromise by other than NSA.
	One of the most novel (at the time) applications of communications
technology by criminals that I have personally seen was the use of
telecopiers by a large unlawful gambling operation about 11 years ago.
While the law enforcement agencies involved had obtained eavesdropping
warrants to install wiretaps on some of the telephone lines involved, they
were totally baffled by the strange sounds heard during some intercepted
calls.  I was called in to solve the mystery, and some listening told me
that this was an FSK facsimile machine running in 6-minute mode.  So we
borrowed a telecopier to decode the tapes; this was not as easy as first
anticipated.  I finally had to modify the telecopier to start in receive
mode without receiving a ringing signal (which was not possible from an
after-the-fact tape recording).  We got some pretty damning evidence, much
to the consternation of the criminals (who suspected a wiretap, but felt
that the facsimile machine was "secure").  While telecopiers are rather
common today, such was not the case 11 years ago.  I suspect that as
telecopiers decrease in price, they too will be more commonly used by
criminals.  While Group I and Group II facsimile machines are fairly easy
to monitor, the more common Group III (sub-minute) machines are much more
complex since they are digital and require faking a handshake protocol by
any receiving machine used as a monitor.

> If it weren't against the law to listen to cellular channels, I'd suggest we
> hams help the law by listening for suspicious cellular calls and recording
> them. Say, how'd you like to get the goods on some serious crooks and find
> (a) the evidence is inadmissible because it was illegally attained and (b)
> yourself on trial for making the recordings. So join me in a big laugh, okay?

	I know of law enforcement agencies that have in the past used scanners
to listen to paging service channels and IMTS mobile telephone channels, and
have obtained useful intelligence information.  None of the information so
derived was used in court per se, but it may have contributed to the "probable
cause" for looking in a certain _public_ place at a certain time.  When any
investigator was pressed in court for the "basis of probable cause", the
information was attributed to an "anonymous informant" - a VERY common source
of law enforcement information.  Under the circumstances, I see nothing wrong
with this - but I am certain that a number of people will disagree with me.
	For example, an experienced investigator can readily detect a drug
deal going on via certain types of pager messages.  Now, if a police cruiser
just happened to be going by the aforesaid location, and decided it was time
for a routine traffic check... :-)  

	[Flames about prosecuting people for alleged "victimless" crimes such
as gambling, narcotics and prostitution should be directed to /dev/null]
 
<>  Larry Lippman @ Recognition Research Corp., Clarence, New York
<>  UUCP:  {allegra|ames|boulder|decvax|rocksanne|watmath}!sunybcs!kitty!larry
<>  VOICE: 716/688-1231        {hplabs|ihnp4|mtune|seismo|utzoo}!/
<>  FAX:   716/741-9635 {G1,G2,G3 modes}    "Have you hugged your cat today?" 


------------------------------

End of TELECOM Digest
*********************