                                Verification
                              By Fred Steinbeck
      
From TAP issue # 88  10-83
        
	There has been a great deal of controversy in the realm of
phreakdom over a mysterious subject known under a number of different
names, including "Verification", "Autoverification", "Verify",
"Autoverify", "Verify Busy", and even "VFY BY". All of these names
basically mean the same thing: the ability to listen to another
person's telephone line from any telephone in the direct- dialable
world.
        
	Needless to say, Bell System is very tight lipped about
knowledge regard- ing verification. Indeed, the infamous book 'Notes
on long distance dialing' ('68 edition) says, "Care must be taken to
insure that the customer never gains verification capabilities." With
a printed policy like that, you can imagine what their real-world
policy is like! Even their own rate and route operators will not give
verification on routing codes (at least in my experi- ence), one even
responding, "What?! You must be crazy! We don't give those out!"
Before you get too far into this article, I will state simply: I
don't know how to verify. However, I have been fooling with various
things related to it, and collecting information on it for some time
now. Therefore, while I can't do it (yet), I may be able to point
some other bright TAPer on the right track, and perhaps he or she
will show us all how. If you have knowledge not covered in this
article, but don't want to write an article on your own, please send
your ideas, comments, or information to Project Verify, C/O TAP
Verify has also been called "Autoverify", and I have no idea why.
This is not, to my knowledge, a Bell System term (at least I've never
seen it in any manu- als)  As far as I know, there is verify, which
means being able to listen to speech (kind of; see below) on a line,
and there is the "Emergency Interrupt which allows you to take part
in the conversation taking place on the line in question. It has been
suggested that "Autoverify" is the same as an emergency interrupt ,
but I tend to disagree with this idea. It should be noted that the
verification circuitry does not actually let an operator listen to a
conversa- tion without making a beep on the line every so often.
Instead, she will hear encrypted speech. However, I believe with the
proper methods, verify can be converted to an emergency interrupt.
        
	Verification is normally done either by your normal "0" (TSPS)
operator, if the call is in your home NPA (HNPA), or by an inward
operator (IO). If the call is outside your HNPA, your normal operator
will call the IO for the NPA,and say, "Verify Busy" or "Emergency
Interrupt" please, 555 1212."  The IO will perform whatever magic he
or she must, and then report back. If the call is in your HNPA,
though, the "0" operator can do the verification herself by using the
"VFY BY" key on her keyshelf. However, in some areas, the operator
uses a routing code to accomplish verification, and this the is loop
hole we shall attack.
        
	It follows that if a IO or "0" operator can do it, so can we,
with a blue box Now, courtesy of Robert Allen (who brought it to my
attention) and Susan Thunder (who apparently discovered it), here is
what used to work for getting operators to hook you into
conversations with other people (i.e.,let you listen to them till you
hung up): You'd call the operator and say "Operator, TSPS Maintenance
Engineer Calling. Ring forward to 001 + NPA + 7d, ring back to my
number, hit ring forward, no AMA, and then position release.
        
	This creates some problems, and you must be familiar with the
TSPS con- sole (by dialing "0"), you are on the "back", or incoming
part of a loop. When she places a call for you, the call goes out on
the "forward", or outgoing part of the loop. If an operator wants to
make a call, she punches KP FWD (keypulse forward), the number, and
ST. Ring FWD puts a 90 volt ringing signal across the forward part of
the line (and may dial the number as well).  The problem arises from
the fact that I don't know if Ring FWD will actually dial a call, and
if there is some other subtle difference between it and KP FWD.
        
	Let us assume ringing forward makes a call from the TSPS console
to whatever number is given. Ring back causes your phone to ring (it
is assumed you hung up after giving her your instructions; if you
didn't you'd hear an annoying 90 volts across the earpiece...) "No
AMA" means "no automatic message accounting", so nobody gets billed
for the call, although it will show up on a tape somewhere. "Position
Release" removes the operator from the circuit, and allows her to
receive other calls. This leaves an unaccounted-for ring for- ward.
        
	The verification circuit, as you know, likes to encrypt
conversation, which is something we don't want. Well, the second Ring
FWD sends another 90 volts crashing against the verify circuitry,
which Juda Gerad thinks removes the voice encryption from the line,
puts the operator (and you) in circuit, and puts a beep tone on the
line every five seconds. This seems to make sense, and I am inclined
to agree with him.
        
	The bit about "..001 + NPA + 7D" causes the thought "MF routing
code" to spring immediately to mind. Now, the above trick was
supposed to work in the 213 NPA. I have tried both
"KP+001+213+7D+ST", and some other area codes. I generally get
nothing, a reorder signal, or a tandem recording.
        
	Here's some food for thought: On an official Telco sheet I have,
labeled " 213 NPA MF Routing Codes", 001 is listed as "VFY BY", or
verify busy for the 213 NPA. 002 is listed for the 805 NPA. Ma Bell
likes to have standardized routing codes, such logical, then, that
001 would be a sort of "standard" verify code, and other prefixes
would be tacked on at 002,003, etc. However, I have heard from a
retired operator that verification codes are different from area to
area, and are not always nice numbers like 001, 002. Ah, well, a guy
can hope, can't he?
        
	Some suggestions for future attacks on this dilemma: Everyone
call your operators and subtly ask questions. I have found they tend
to give information out easier if you ask for something that you
would ordinarily have to be a company employee to know about, such as
rate steps, operator routings, etc.
        
	Casually let slip that you used to be (or still are) an
operator, or that you work for company security. Also, you might want
to blue box some codes like 001 followed by your NPA and the last 7D
of a busy number. If you get a sort of "whispery noise", try blasting
the line with a ringing signal (you might piggyback another line onto
yours and call the piggyback to generate the 90 volts) and see if
that does anything.
