 HOW BELL CATACHES BLUE BOXERS 
    WRITTEN BY:           
LEX LUTHOR AND THE LEGION OF DOOM
 UPDATED: 25-JUN-84

   THIS PHILE DESCRIBES THE INVESTIGATIVE PROCEDURES USED BY THE
SECURITY DEPARTMENT OF MA BELL.

   MOST OF THE PHILE WILL TALK ABOUT BLUE BOX INVESTIGATIONS
BECAUSE OF THE FREQUENCY OF THE BLUE BOX CASES REFERRED TO LAW
ENFORCEMENT OFFICIALS FOR PROSECUTION.

   THE SECURITY DEPARTMENT MAY FIRST DISCOVER EVIDENCE OF BOXING
ACTIVITY FROM LOOKING AT CALLING PATTERNS TO PARTICULAR NUMBERS.
SUCH ANALYSES MAY REVEAL ABNORMAL CALLING PATTERNS WHICH
POSSIBLY ARE THE RESULT OF BOX ACTIVITY (SUCH AS 122 HOUR CALLS
TO DIR. ASSIST) ALSO, CASES OF SUSPECTED BOXING ARE REFERRED TO
THE SECURITY DEPARTMENT FROM THE VARIOUS OPERATING DEPARTMENTS
OF BELL, FROM OTHER TELEPHONE COMPANIES , OR FROM LAW
ENFORCEMENT OFFICIALS. IN SOME INSTANCES, DETECTION AND
INDENTIFICATION OF A CALLING STATION ORIGIN- ATING SUSPECTED
BLUE BOX TONES CAN BE PROVIDED BY USE OF A SPECIAL NON-
MONITORING TEST EQUIPMENT.

   IF INITIAL INDICATIONS ARE THAT THERE IS A GOOD POSSIBILITY
THAT A BLUE BOX IS BEING USED ON A PARTICULAR PHONE LINE, THE
SECURITY DEPARTMENT DETERMINES CERTAIN INFORMATION ABOUT THE
LINE. THE NAME OF THE SUBSCRIBER TO THAT LINE IS IDENTIFIED, AND
AN INVENTORY IS MADE OF THE LINE AND STATION EQUIPMENT BEING
PROVIDED TO HIM. A DISCREET BACKGROUND INVESTI- GATION (RECORD)
IS CONDUCTED TO ESTABLISH THE SUBSCRIBER'S IDENTITY.  AFTER THIS
PRELIMINARY DATA IS GATHERED ,BLUE BOX DETECTION UNITS ARE
INSTALLED ON THE SUSPECTED LINE TO ESTABLISH "PROBABLE CAUSE"
FOR FURTHER INVESTI- GATION. IF THE "PROBABLE CAUSE" EQUIPMENT
INDICATES REPEATED BLUE BOX ACTIVITY ON THE LINE, OTHER
EQUIPMENT IS THEN INSTALLED TO DOCUMENT SUCH ACTIVITY.

   THE "PROBABLE CAUSE" EQUIPMENT ASCERTAINS THE PRESENCE OF
MULTI- FREQUENCY TONES ON THE SUBSCRIBERS END OF THE LINE WHICH
WOULD NOT BE PRESENT IN NORMAL USAGE. THE "PROBABLE CAUSE"
DEVICE NOW BEING USED BY SOME BELL CENTRAL OFFICES REGISTER EACH
AND EVERY APPLICATION OF 2600HZ TONES IN SINGLE-FREQUENCY (SF)
SIGNALLING AND OR 2600HZ TONE FOLLOWED BY KP TONES USED IN
MULTI-FREQUENCY (MF) SIGNALLING . AS PREVIOUSLY STATED, SUCH
TONES SHOULD NOT NORMALLY BE PRESENT ON THE LINE.

   IF "PROBABLE CAUSE" IS ESTABLISHED, OTHER DETECTION,
INDENTIFICATION AND DOCUMENTATION EQUIPMENT IS INSTALLED. THE
PRIMARY EQUIPMENT NOW BEING USED IS THE DIALED NUMBER RECORDER
(DNR), COUPLED WITH AN AUXILLARY TAPE RECORDER. THE DNR IS
ACTIVATED WHEN THE SUSPECT SUBSCRIBER'S PHONE GOES "OFF-HOOK"
ANDB PRINTS ON PAPER TAPE THE FOLLOWING INFORMATION CONCERNING
THE CALL: THE DATE AND TIME OF THE CALL AND THE DIGITS DIALED
OVER THE SUSPECTS LINE. MOREOVER, THE DNR RECORDS ON THE PAPER
TAPE AN INDICATOR OF THE PRESENCE OF 2600HZ TONES ON THE LINE
AND THE PRESENCE OF MULTI-FREQUENCY SIGNALLING TONES ON THE
SUBSCRIBER'S LINE. THE AUXILIARY TAPE RECORDER IS ACTIVATED
*ONLY* AFTER THE PRESENCE OF 2600HZ TONE ON THE LINE IS DETECTED
BY THE DNR (INDICATING THE USE OF A BLUE BOX) . ONCE THE TAPE
RECORDER IS ACTIVATED, IT RECORDS THE TONES BEING EMITTED BY THE
BLUE BOX, OTHER SIGNALLING TONES, AND THE RINGING CYCLE ON THE
CALLED END . IT ALSO RECORDS A MINIMUM AMOUNT OF ENSUING
CONVERSATION FOR THE PURPOSE OF:

 (1) ESTABLISHING THAT THE FRAUDULENT CALL WAS CONSUMMATED

 (2) ESTABLISHING THE IDENTITY OF THE FRAUDULENT CALLER. THE
TIMING DURATION OF THE TAPE RECORDER IS PRE-SET. A TIME OF
ONE-MINUTE (INCLUDING PULSING, RINGING AND CONVERSATION) IS THE
STANDARD SETTING; HOWEVER, IF THE BLUE BOX USER IS SUSPECTED OF
MAKING OVERSEAS CALLS, THE TIMING MAY BE SET FOR 2 MINUTES
BECAUSE OF THE GREATER TIME REQUIRED BY THE BLUE BOX USER TO
COMPLETE THE CALL. UPON TERMINATION OF THE CALL, THE DNR
AUTOMATICALLY PRINTS THE TIME OF TERMINATION AND THE DATE. IT
SHOULD BE POINTED OUT THAT THE PRESENCE OF 2600HZ TONES *PLUS*
MULTI-FREQUNCY SIGNALLING TONES ON A SUBSCRIBER'S LINE
POSITIVELY ESTABLISHES THAT A BLUE BOX IS BEING USED TO PLACE A
FRAUDULENT CALL BECAUSE SUCH TONES ARE NOT NORMALLY ORIGINATED
FROM A SUBSCRIBERS LINE.

   ONCE THE RAW DATA DESCRIBED ABOVE IS GATHERED, THE SECURITY
DEPARTMENT COLLECTS AND FORMULATES THE DATA INTO LEGALLY
ADMISSABLE EVIDENCE OF CRIMINAL ACTIVITY. SUCH EVIDENCE WILL
ESTABLISH:

   (1) THAT A FRAUDULENT CALL WAS PLACED BY MEANS OF AN ETF
DEVICE,

   (2) THAT CONVERSATION ENSUED,

   (3) THAT THE FRAUDULENT CALL WAS PLACED BY AN IDENTIFIED
INDIVIDUAL, AND

   (4) THAT SUCH CALL WAS NOT BILLED TO THE SUBSCRIBER NUMBER
FROM WHICH THE BLUE BOX CALL ORIGINATED. THE EVIDENCE WHICH IS
THEN AVAILABLE CONSISTS OF DOCUMENTS AND ALSO OF EXPERT WITNESS
TESTIMONY BY TELEPHONE COMPANY PERSONNEL CONCERNING THE CONTENTS
OF THOSE DOCUMENTS, THE OPER- ATION OF THE BLUE BOX, AND THE
OPERATION OF THE DETECTION EQUIPMENT.  (NOTE- SIMILAR TECHNIQUES
ARE USED IN THE INVESTIGATION OF OTHER FORMS OF ETF.)

PRESENTATION OF EVIDENCE TO PROSECUTORS
------------ -- -------- -- -----------

   THE EVIDENCE ACCUMULATED BY THE SECURITY DEPARTMENT IS
CAREFULLY REVIEW ED BY THE LEGAL DEPARTMENT FOR THE PURPOSE OF
DETERMINING WHETHER SUFF- ICIENT EVIDENCE EXISTS TO WARRENT THE
PRESENTATION OF THE EVIDENCE TO LAW ENFORCEMENT OFFICIALS. IF
THE EVIDENCE DOES WARRENT SUCH ACTION, IT IS PRES- ENTED UNDER
APPROPRIATE CIRCUMSTANCES TO THE PROPER LAW ENFORCEMENT
OFFICIALS. IN ALL CASES WHERE PROSECUTION IS RECOMMENDED, A
PROFESSIONALLY INVESTIGATED AND DOCUMENTED SUMMARY OF THE CASE
WILL BE PREPARTED AND PRESENTED BY THE SECURITY DEPARTMENT TO
THE PROSECUTOR'S OFFICE. EACH CASE RECOMMENDED FOR PROSECUTION
WILL BE PREPARED AS COMPLETELY AS POSSIBLE, USUALLY
NECESSITATING LITTLE OR NO PRE-TRIAL INVESTIGATION FOR THE
PROSECUTOR. THE SUMMARY OF THE CASE WILL INCLUDE THE FOLLOWING:

     (A) A BACKGROUND OF THE CASE WITH DETAILS OF THE
DEFENDANT'S ACTIVITIES AND A SUMMARY OF ALL PERTINENT
INVESTIGATIVE STEPS AND INTERVIEWS CONDUCTED IN THE COURSE OF
THE INVESTIGATION.

     (B) IDENTIFICATION OF WITNESSES.

LEX LUTHOR  --  LOD  --  KOS  --

