Exploding the Phone : The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell (9780802193759)

by Lapsley, Phil

  “Over a period of time we realized there were any number of ways in which telephones and telephone systems were interesting,” Ross remembers. “It was interesting to see how this strange and mysterious thing worked. And the more we got to know it, the stranger and mysteriouser it was.” He adds, “Over the course of that academic year it became, as undergraduate things do, an obsession.”

  They soon graduated from tie-line dialing to harder drugs. Pyne told them about the 331 test number exchange and how he used it to reach inward operators. Before long they were making trips to Boston’s Logan Airport to conduct their research; 331 was a local call from Logan, plus the airport was great because it had tons of pay phones and you wouldn’t arouse any suspicion by constantly being on them. But 331 was somewhat limited: you could reach the inward operator and a few other places but not much else. And, besides, Pyne had already been through it with a fine-tooth comb. They wanted a bigger playground to explore.

  Pyne had gotten his hands on a copy of the 1956 edition of a Bell System book called Notes on Distance Dialing. As Tony Lauck describes it, Notes “was an overview of the architecture of the long-distance telephone network that was written from the point of view of an engineer at an independent telephone company. So it described all the ways area codes were assigned, the way the various types of signaling worked, what the tones were, what the frequencies were, and all of this kind of stuff.” It wasn’t exactly secret but it wasn’t widely available—unlike the Bell System Technical Journal or the Bell Labs Record, it wasn’t in most engineering libraries.

  The Harvard kids spent a bunch of time studying Notes on Distance Dialing, but they couldn’t quite make the pieces fit together. For example, Notes talked about multifrequency signaling and even gave the frequencies of the two tones that made up each digit; it explained about the key pulse (KP) and start (ST) signals too. The good news was that WHRB had an audio oscillator, which they quickly pressed into service as a tone generator. The bad news was that WHRB had only one audio oscillator, so they couldn’t generate the two simultaneous tones needed for multi­frequency signaling. They did have a tape recorder, however. Lauck recalls, “We had recorded one of the oscillators and we had dubbed it back on top of it on a strip of tape, all the various multifrequency tones. . . . We had tape rolls of zeros, and tape rolls of ones, and tape rolls of nines, and tape rolls of key pulse, and tape rolls of start. . . . And we could splice these together with splicing tape and play them through a tape recorder and it would sound very much like the tones you would hear when you were making a long-distance phone call in that era.”

  They tried mightily to use their spliced tapes to make calls using MF—to no avail. They would make a local call and press play on the tape recorder and send their tones down the line. Nothing. They’d make a long-distance call and try the same thing. Still nothing. “We knew we had the tones right,” Lauck says. “But every time we played these tones nothing would happen.”

  They kept at it. Lauck recalls, “On one particular day we swept the oscillator up to 2,600 while we were dialing into an information service someplace, or some sort of a useless free call. And we heard this . . . disconnect, a click, and then a bomp or a babump or some sort of a noise.” They didn’t know what it was, exactly, but they knew something important had just happened. “I looked at Charlie and he looked at me,” Lauck remembers. “When we heard this thing go kerbunk we just sort of had this intuitive feeling that, yeah, now was the time.”

  A tape was cued up on the tape recorder, loaded with “KP 212 121 ST”—the eight quick MF tones required to call the inward operator in New York City. “When we heard this bonk sound we flipped the selector switch on the preamp and pushed play on the tape recorder. It went, dee de de de de de de dup and then the operator came on and said, ‘New York.’

  “After struggling with this tape for maybe two or three days and playing it in various ways and getting nowhere, all of a sudden when we heard this funny little sound, we had put the system in a new state. We knew that was it,” Lauck remembers.

  They had proven it could work. Now they needed to build an electronic box to generate the tones on command rather than dorking around with bits of audiotape. “We had some junk parts, Charlie had a bunch of switches,” Lauck says. They built an audio oscillator, reusing the vacuum tubes from Lauck’s stereo amplifier, basing their design on a circuit from the radio amateur’s handbook. It was a bulky thing on a metal chassis, Lauck remembers, “But within twenty-four hours, ’cause we didn’t get much sleep, we had this thing working and we could then key in whatever numbers we wanted.”

  Lauck believes it took them longer than it should have. “See, part of the thing that made it so difficult was that we didn’t think it was really possible. We didn’t think they would have been so stupid as to design the system where we could get into the signaling of the system. So even though we knew the signaling tones were in-band tones, we didn’t think that was going to amount to anything. We didn’t understand that the 2,600 Hz signal could be passed straight through. . . . We didn’t think it was possible.”

  “The next idea was to make a more miniaturized one,” says Pyne. “And that’s where Heckel came in.” Paul Heckel was two subway stations away at MIT, still majoring in electrical engineering. Heckel told them, “Not only can I make you one much more miniaturized and transistorized, but we’ll pot it”—that is, the components would be coated in epoxy so that nobody would be able to tell what was in it. “Heckel was the main guy who built that,” Pyne says, though Lauck and Pyne assisted in its assembly. Pyne remembers returning to Harvard on the first subway train from MIT’s Kendall Square station around five a.m. after pulling an all-nighter in Heckel’s dorm room working on the transistorized blue box. He vividly recalls spilling an assortment of resistors all over the floor of the train, scrambling around trying to find all the pieces and put them back in their container. Electronic component mishaps notwithstanding, they soon had a tidy little portable blue box, suitable for telephonic field trips.

  Ultimately, they realized they could combine their blue box with the 331 test number: dial 331 plus any four digits, send a burst of 2,600 Hz down the link, and then use the blue box to MF whatever digits they wanted. The beauty of this setup was that 331 was a local call, and because the phone company didn’t bill for local calls it didn’t bother to keep records of them either. This, they figured, meant they were less likely to get caught than, say, calling 555-1212 in distant area codes.

  “Now the only problem would be, sort of, ‘Well, you’ve solved the problem!’” Pyne recalls with a laugh. “Now what do you do? You don’t really want to call anybody.” But, he says, “you still want to be researching more interesting things.

  “Somehow that got us thinking, ‘Well, what about receiving calls?’” They had figured out how to make free outgoing calls; indeed, they had solved that problem six ways from Sunday. But maybe they could figure out a way to receive calls that would make it free for the caller?

  By now they knew that the secret to telephone billing was whether the called telephone answered, that is, went off hook. That’s what 2,600 Hz indicated, after all: whether a phone was hung up or not. Pyne recalls their thinking, “What if you received a call but you never went off hook? Wouldn’t that mean that the calling party wouldn’t be billed for the call?”

  Pyne says, “So we wound up building a very simple box, which was basically a capacitor on the line so you could pass the voice through but not the DC through.” He knew that a change in direct current was how the phone system detected that a phone had answered, so if you blocked DC, you blocked the telephone company from knowing whether you had answered the phone. This approach worked, to a point. It did let them talk while the phone was still ringing it, but it also let the ringing signal through, and the ringing signal was much louder than the voice. As Pyne says, “You had to talk between the rings.” And that, they all agreed, wa
s lame.

  They pressed on. “A lot of these things are just sort of by accident,” Pyne says. At some point they were fooling with the circuit they had built and somebody took the phone off hook for a ­moment—the phone was picked up for a fraction of a second and then hung up again. The ringing instantly went away. But they could tell from the sound of the telephone line that billing hadn’t started. They had discovered another unlikely glitch in the phone system: although the billing equipment and the ringing signal were both controlled by the phone going off hook—in other words, ringing stopped and billing started when you answered the phone—the timing on the two was different. The ringing signal stopped the very instant you answered the phone. But billing didn’t start unless the phone stayed off hook for several seconds.

  This gap in timing meant that they had just solved their latest research problem. “We said, Oh!” Pyne recalls. If they took the phone off hook for just a second, “it’s long enough to make the ring go away but not long enough to activate the billing. So then we built this little box, you just go click [with a switch] and you get rid of the ring. And now somebody could call you and talk a little while and when they hang up they get their dime back or they don’t get billed.” Pyne and his friends didn’t know it at the time, but this simple device had been discovered by others a few years earlier. The telephone company called it a “black box”; it would later come to be called a “mute.”

  They were rapidly running out of stuff to research. Bored and looking for something to do, they decided to borrow some musical instruments and see if they couldn’t stage a live concert that would please the telephone system. If a blue box generated just two different musical notes, couldn’t you do the same thing with a pair of flutes?

  The trio soon found themselves gathered around a telephone, instruments in hand, trying to play 2,600 Hz followed by the MF tones for KP + 121 + ST. “We were able to generate the tones using some wooden baroque recorders”—flutelike musical instruments, Lauck says. “It actually did work,” Pyne remembers. “The 2,600 was easy, you could just whistle that. The flutes weren’t ­really a practical way to do it, but we proved that it could be done.” Lauck adds, “We were laughing so much it was not very effective.”

  “We started getting maybe a little bored with it, and we started getting a little loose,” Pyne remembers. “We started being a little bit more open about telling people what we had discovered.” Everybody at the WHRB radio station knew about their playing with the phone system, for example.

  It was around this time that, through some other students they didn’t know very well, “we met a guy by the name of Ernie Reid,” Pyne remembers. “Reid worked for the phone company, he was kind of like a repairman-type guy.” Reid was very interested in what the Harvard kids were up to. “He said, ‘This is very interesting, this is cool, what are you doing? I could get you keypads, I could get you equipment . . .’ He kind of ingratiated himself with us and asked a lot of questions.” At his request, they loaned him the Fine Arts 13 notebook.

  Pyne didn’t give any of this too much thought, as it was starting to dawn on him that he had other things to worry about. Ever since the group had been working on their telephone research, Pyne’s grades had gone into the toilet. Sure enough, a bit later that month, Pyne got a phone call telling him to see his dean. With final exams right around the corner, there was no way a sudden request to speak to his dean could be anything good.

  Pyne told Lauck about the meeting. “That’s funny,” Lauck responded. “I’m supposed to see my dean at nine a.m. tomorrow too.”

  Hmm. Lauck was an excellent student, so this wouldn’t be about his grades.

  Pyne and Lauck called Ed Ross. Sure enough, Ross had a nine a.m. appointment with the headmaster of his dormitory. The clincher? Paul Heckel also had a nine a.m. appointment, and he was at an entirely different school.

  It didn’t take a genius—much less several geniuses—to figure out they were busted.

  “We had always realized that this stuff was not totally above board, people might look askance at our doing this,” says Ross. Still, he says, “we never took it horribly seriously.” The summons from the school officials suggested it might be time to reevaluate that sentiment. They scheduled an emergency meeting that evening at the Boston apartment of a mutual friend to get their stories straight. As Pyne recalls it, the gist for the group was: “What story are we going to tell these deans? Can we conjure up a story that will sound plausible and innocent?” After much discussion they concluded that, as Pyne puts it, “There’s no story that you could make up that you could consistently tell that would be any more innocent than just the truth.” So that’s what they decided to do: they would simply tell the truth. They went their separate ways, the stress of the evening and tomorrow’s impending meetings aggravated by Ross’s car running out of gas on Boston’s Storrow Drive on the way home.

  At nine o’clock the next morning—May 10, 1963—each student went to his respective appointment. Each meeting was in a different location. Tony Lauck remembers that the staff in his dean’s office “seemed pretty alarmed” when he arrived. Their alarm was caused by the two men there to interview him: “There was one tall one and one short one, they were both wearing trench coats, one was nice and the other was nasty, and they were both from the FBI.”

  The same scene played out in the other locations. No deans or headmasters, just Ross, Pyne, Lauck, and Heckel, each interrogated by two FBI agents. “I was totally flabbergasted by people flashing FBI badges,” Pyne says. He was quickly introduced to the time-honored interrogation technique called good cop/bad cop. One of the two FBI agents interviewing him “was nasty,” Pyne recalls. “He was pushy, he was questioning me. And the other guy was just the nicest guy in the world. The first guy would go out . . . and the second guy would say, ‘Isn’t it nice to be here at Harvard? And what are you studying?’ He was just very pleasant. And then the other guy would come back in the room.”

  Periodically one of the agents would step outside and, apparently, coordinate with the other FBI agents by radio or telephone. The agents had done their homework, brandishing thick dossiers on the students. Indeed, the FBI had apparently gone to the trouble of tailing them, Ross remembers. The FBI agents knew about their meeting the night before, including their running out of gas on Storrow Drive. They tried to explain their research project as an innocent hobby; as one of the students put it, “Some people collect stamps.” But they were thrown by the focus of the FBI agents’ questions. “They were particularly concerned about the activities via MIT Lincoln Labs, MITRE, and the defense department phone system,” Ross says. Ross felt this was the least technically sophisticated thing the group had done, so he wasn’t sure why the FBI agents were so interested in it. After all, it was nothing special, just dialing around. Still, he remembers, “they concentrated on that.”

  It slowly dawned on all the students that the FBI was convinced that it had stumbled upon an espionage ring. The FBI agents, it seemed, didn’t really care about AT&T and long-distance phone calls and blue boxes and whatnot. Rather, they thought Pyne and company were spies.

  The agents drilled them on one point in particular, over and over again: Who else was involved? The answer they got back was always the same: “Just us!” The nasty one of Pyne’s two FBI agents wasn’t buying it. “What about Stewart and Jerome?” he finally demanded. “We know they’re involved!”

  “I almost broke up laughing,” Pyne remembers. It was at that point, Pyne says, that “we knew that they had either read the Fine Arts 13 notebook, which mentioned Stewart and Jerome, or more likely had tapped our lines.”

  The FBI had been investigating Pyne and company for about three weeks, it turned out, ever since the telephone company brought the matter to their attention. Ernie Reid, the telephone company repairman who had befriended them and who had borrowed their Fine Arts 13 notebook, was the source of the trouble
, passing the notebook on to the security department of New En­gland Telephone and Telegraph. “His motives were to make a big deal out of this,” Pyne says. “He told them things that weren’t even true, that we were trying to get the keys to Franklin Street [the headquarters of the telephone company in Boston], that we were interested in defense things, and NORAD . . .”

  If Reid’s goal was to make a big deal, he succeeded. Within days Peter Mason, the head of New England Telephone and Telegraph security, and his deputy, John Desmond, had contacted the FBI. According to an FBI memo, Mason and Desmond had been reviewing the Fine Arts 13 notebook “and felt that this should be called to the attention of the FBI since it contains information concerning tie lines from various defense establishments in the Boston, Mass. Area, in addition to tie lines to defense establishments in other areas of the country such as Lincoln Laboratory, Raytheon Company, Arthur D. Little Company, Hanscom Air Force Base, Millstone Radar Installation, IBM, . . . MITRE Corporation . . . and General Electric Company.”

  The phone company’s main concern was the specter of widespread electronic toll fraud. As the FBI memo put it, “Mr. Desmond furnished a copy of the subject’s notebook . . . They requested that the information contained in this notebook not be disseminated at this time since it was felt by the telephone company that any dissemination outside the Bureau could lead to wholesale use of telephone company facilities at no cost.”

  In contrast, the FBI was more concerned about national security. The possibility that the Harvard kids were a spy ring was not entirely ludicrous; 1963 was a scary year, with charges and counter­charges of espionage flying back and forth between the Kremlin and the White House. At the time, the FBI was deep into an investigation of a Soviet spy ring in New York and Washington, D.C., and just two years earlier the British courts had convicted five people in a damaging Soviet espionage operation. Indeed, Kim Philby, the so-called third man of England’s notorious Cambridge Five spy ring, defected to the Soviet Union that very January; like Pyne and company at Harvard, the Cambridge spies had all attended one of their country’s top universities. Could the FBI have stumbled onto the Harvard Three?