$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$                                     $
$  ---------------------------------  $
$  : ELECTRONIC TOLL FRAUD DEVICES :  $
$  ---------------------------------  $
$                                     $
$$$$$$$$$-=>LEX LUTHOR<=-$$$$$$$$$$$$$$

     This phile is designed to identify various kinds of ETF
(Electronic Toll Fraud) devices and to describe their operation,
according to a booklet put out by Bell entitled: THE
INVESTIGATION AND PROSECUTION OF ELECTRONIC TOLL FRAUD DEVICES.
(For official use only).

     There are several different types of electronic equipment
which may be generally classified as ETF devices. The most
significant is the 'blue box'. The characteristics of each type
of device are discussed below.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

             * Cheese Box *
             --------------

     Its design may be crude or very sophistacated. Its size
varies; one was found the size of a half-dollar.

     A Cheese Box is used most often by bookmakers or betters to
place wagers without detection from a remote location. The
device inter-connects 2 phone lines, each having different #'s
but each terminating at the same location. In effect, there are
two phones at the same location which are linked together
through a Cheese Box. It is usually found in an unoccupied
apartment connected to a phone jack or connecting block. The
bookmaker, at some remote location, dials one of the numbers and
stays on the line. Various betters dial the other number but are
automatically connected with the bookmaker by means of the
Cheese Box inter-connection. If, in addition to a Cheese Box, a
Black Box is included in the arrangement, the combined equipment
would permit toll-free calling on either line to the other line.
If a police raid were conducted at the terminating point of the
conversation --the location of the Cheese Box-- there would be
no evidence of gambling activity. This device is sometime
difficult to identify. Law enforcement officials have been
advised that when unusual devices are found associated with
telephone connections, the phone company security representitive
should be contacted to assist in identification. (This probably
would be good for a BBS, especially with the Black Box set up,
and if you ever decide to take the board down, you wouldn't have
to change your phone #. It also makes it so you yourself cannot
be traced. I am not sure about calling out from one though).

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

            * BLUE BOX * 
            ------------

     The 'Blue Box' was so named because of the color of the
first one found. The design and hardware used in the Blue Box is
fairly sophisticated, and its size varies from a large piece of
apparatus to a miniaturized unit that is approximately the size
of a 'king size' package of cigarettes. The Blue Box contains 12
or 13 buttons or switches that emit multi-frequency tones
characteristic of the tones used in the normal operation of the
telephone toll (long distance) switching network. The Blue Box
enables its user to originate fraudulent ('free') toll calls by
circumventing toll billing equipment. The Blue Box may be
directly connected to a phone line, or it may be acoustically
coupled to a telephone handset by placing the Blue Box's speaker
next to the transmitter or the telephone handset. The operation
of a Blue Box will be discussed in more detail below.

     To understand the nature of a fraudulent Blue Box call, it
is necessary to understand the basic operation of the Direct
Distance Dialing (DDD) telephone network. When a DDD call is
properly originated, the calling number is identified as an
integral part of establishing the connection. This may be done
either automatically or, in some cases, by an operator asking
the calling party for his telephone number. This information is
entered on a tape in the Automatic Message Accounting (AMA)
office. This tape also contains the number assigned to the trunk
line over which the call is to be sent. The information relating
to the call contained on the tape includes: called number,
calling number, time of call. The time of disconnect at the end
of the call is also recorded.

     Although the tape contains info with respect to many
different calls, the various data entries with respect to a
single call are eventually correlated to provide billing info
for use by your Bell accounting department.

     The typical Blue Box user usually dials a number that will
route the call into the telephone network without charge. For
example, the user will very often call a well-known INWATS (toll
free) customer's number. The Blue Box user, after gaining this
access to the network and, in effect, 'seizing' control and
complete dominion over the line, operates a key on the Blue Box
which emits a 2600 Hz tone. This tone causes the switching
equipment to release the connection to the INWATS customer's
line. The 2600 Hz tone is a signal that the calling party has
hung up. The Blue Box simulates this condition. However, in fact
the local trunk on the calling party's end is still connected to
the toll network. The Blue Box user now operates the 'KP' (Key
Pulse) key on the Blue Box to notify the toll switching
equipment that switching signals are about to be emitted. The
user then pushes the 'number' buttons on the Blue Box
corresponding to the telephone # being called. After doing so,
he/she operates the 'ST' (Start) key to indicate to the
switching equipment that the signalling is complete. If the call
is completed, only the portion of the original call prior to the
emission of the 2600 Hz tone is recorded on the AMA tape. The
tones emitted by the Blue Box are not recorded on the AMA tape.
Therefore, because the original call to the INWATS # is
toll-free, no billing is rendered in connection with the call.

     Although the above is a description of a typical Blue Box
operation using a common method of entry into the network, the
operation of a Blue Box may vary in any one or all of the
following respects:

     (a) The Blue Box may include a rotary dial to apply the
2600 Hz tone and the switching signals. This type of Blue Box is
called a 'dial pulser' or 'rotary SF' Blue Box.

     (b) Entrance into the DDD toll network may be effected by a
pretext call to other toll-free # such as Universal Directory
Assistance (555-1212) or any # in the INWATS network, either
inter-state or intra-state, working or non-working.

     (c) Entrance into the DDD toll network may also be in the
form of 'short haul' calling. A 'short haul' call is a call to
any # which will result in a lesser amount of toll charges than
the charges for the call to be completed by the Blue Box. For
example, a call to Birmingham from Atlanta may cost $.80 for the
first 3 minutes while a call from Atlanta to Los Angeles is
$1.85 for 3 minutes. Thus, a short haul, 3 minute call to
Birmingham from Atlanta, switched by use of a Blue Box to Los
Angeles, would result in a net fraud of $2.65 for a 3 minute
call.

     (d) A Blue Box may be wired into the telephone line or
acoustically connected to the handset. The Blue Box may even be
built inside a regular Touch-Tone phone, using the phone's
pushbuttons for the Blue Box's signalling tones.

     (e) A magnetic tape recording may be used to record the
Blue Box tones representitive of specific phonr #'s. Such a tape
recording could be used in lieu of a Blue Box to fraudulently
place calls to the phone #'s recorded on the magnetic tape.

     All Blue Boxes, except 'dial pulse' or 'rotary SF' Blue
Boxes, must have the following 4 common operating capabilities:

     (a) It must have signalling capability in the form of a
2600 Hz tone. The tone is used by the toll network to indicate,
either by its presence or its absence, an 'on hook' (idle) or
'off hook' (busy) condition of the trunk.

     (b) The Blue Box must have a 'KP' tone that unlocks or
readies the multi-frequency receiver at the called end to
receive the tones corresponding to the called phone #.

     (c) The typical Blue Box must be able to emit MF tones
which are used to transmit phone #'s over the toll network. Each
digit of a phone # is represented by a combination of 2 tones.
For example, the digit 2 is transmitted by a combination of 700
Hz and 1100 Hz.

     (d) The Blue Box must have an 'ST' key which consists of a
combination of 2 tones that tell the equipment at the called end
that all digits have been sent and that the equipment should
start switching the call to the called number.

     The 'dial pulser' or 'rotary SF' Blue Box requires only a
dial with a signalling capability to produce a 2600 Hz tone.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

             * BLACK BOX * 
             -------------

     This ETF device is so-named because of the color of the
first one found. It varies in size and usually has one or two
switches or buttons. Attached to the telephone line of a called
party, the Black Box provides toll-free calling *to* that
party's line. A Black Box user informs other persons beforehand
that they will not be charged for any calls placed to him. The
user then operates the device causing a 'non-charge' condition
('no answer' or 'disconnect')  to be recored on the telephone
company's billing equipment. A Black Box is relatively simple to
construct and is much less sophisticated than a Blue Box.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

              * RED BOX * 
              -----------

     This device is coupled acoustically to the handset
transmitter of a single slot coin telephone. The device emits
signals identical to those tones emitted when coins are
deposited. Thus, local or toll calls may be placed without the
actual deposit of coins.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
