Acker’s plan was straightforward. “I’ll just dial every area code and 555-1212 and learn where the area codes were. I’d just talk to the operator and say, ‘Where are you? Where are you located?’” The operators were surprisingly game for this. Several hundred calls later Acker had constructed an area code map of the United States in his head, a map that remains there to this day, revised, updated, and annotated with all the telephonic esoterica he’s learned since.
His fascination grew. “Just being exposed to the network, how the different directory assistance operators sounded,” he says, was like discovering a new world. The operators’ accents differed from place to place, but even the sounds of the calls themselves—that is, the sounds that the telephone switching equipment made as the calls were being placed and routed through the network—well, those sounds varied almost as much as the operators’ accents! Why was that? How did it all work?
In December 1968 someone pointed out to Acker an odd newspaper article about a blind kid at a university down in Tampa who could make free phone calls just by whistling a certain tone. Acker found the article interesting but figured it didn’t apply to him. “I knew enough about the phone system by then to know that Tampa was independent,” he says, meaning that its telephone service was provided by a telephone company other than AT&T and the Bell System. In contrast, Acker’s community was served by Bell. “So I basically said, ‘Gee, it’s really nice if you could do those things if you’re in an independent telephone company such as Tampa, but I guess that can’t have much bearing on me. After all, I live in the Bell System, so it must work completely differently.’”
Acker continued his experiments with the phone system. He was fascinated by tones, by the sounds that the telephone system made. He tried lots of different things—just playing around, really. For example, Acker knew that every touch-tone digit is made up of two different tones that are added together. That is, when you press the 1 button your phone generates two different tones and adds them together. Equipment at your telephone company’s central office hears these two tones and figures out from them that you dialed a 1. Acker says, “I discovered that if you added a third tone to a touch-tone, you could block the digits from being received. So if you pressed the digit one but you added some arbitrary tone on top of that, the central office wouldn’t recognize the digit at all.”
In other words, Acker had found that, with enough work, you can screw up your own dialing. My goodness, what a discovery! A normal person wouldn’t think twice about this; come to think of it, a normal person wouldn’t even think once about this. But phone phreaks aren’t normal people. For Acker, the discovery that you could play a tone into the phone and goof up its operation gave him an idea.
He knew that when he made a long-distance call from his house he could hear the switching equipment sending tones down the line to complete his call. He knew these tones didn’t sound like touch tones; they were something else. They weren’t very loud. Probably they were far away, he thought. But, if he could hear them, maybe whatever equipment was listening to them could hear him. And if that equipment could hear him, maybe he could disrupt the tones, just like he could with his touch-tone phone at home. “If I make a very loud noise,” Acker recalls thinking, maybe “I can block those tones from happening, and then I can substitute my own tones, by tape recording them and playing them back.”
Acker looked around to find something that could make a loud noise. He figured he needed something really loud to disrupt the tones, given how faint they were.
“What I came up with was a little toy flute called the Tonette,” he recalls. “The Tonette had a detachable mouthpiece and that made a very, very loud shriek if you blew it. I thought that shriek was the most perfect shriek I could make.”
Acker dialed several long-distance calls. Each time he would wait until the switching equipment began its electronic concert, sending its quick little musical MF tones down the line. Each time he would jump into the concert, uninvited, playing his Tonette flute as loud as he could while the tones were being played. It was a jam session: he was trying to jam the switching equipment.
It didn’t work. Try as he might, he didn’t seem to be able to block the phone company’s tones. The calls went through every time. His loud whistle was a loud bust.
Then something funny happened. Once, Acker recalls, “I kept that tone on too long after the call started to go through. And when I let go of the tone, the call didn’t seem to want to go through. It went chunk wink! It made two clicks. And I didn’t understand that. It stopped the call from going through, but I didn’t feel like I had accomplished anything.” While he might have succeeded in stopping the call from completing, he didn’t know why. It certainly didn’t seem to have anything to do with his blocking the musical tones the phone company was sending. In fact, it seemed to work best to stop the call if he played the tone after the call had started to go through.
After repeating the experiment a few times, some audio matching circuitry deep in Bill Acker’s brain woke up and got out of bed. The resonant, hollow sound of the long-distance circuit between the chunk and the wink that followed his whistling reminded him of something: the sound of an operator plugging her cord into an outgoing long-distance trunk. It all fell into place. “I realized very quickly that the 2,600 Hz stuff did apply to me, and that’s what the Tonette squeal happened to be.” Maybe it wasn’t exactly 2,600 Hz, maybe it was a little bit lower or a little bit higher in pitch, but it didn’t matter; whatever it was, “it was close enough to twenty-six to drop a connection reliably.” The stuff in the newspaper article about the blind kid in Tampa did apply to him! “It seems strange in retrospect that I didn’t get it as quickly as I could have,” he says.
With this, Acker was able to disconnect a call in progress. But that’s only half the game; you then have to be able to tell the switching equipment where you want your new call sent. His original plan to do this had been to tape-record the faint MF tones that the phone company’s signaling equipment was sending out and then play them back. This plan was great in theory but suffered from one slight flaw in practice: he didn’t have a tape recorder. But he figured he could do the same thing that the Engressia kid in Florida did: whistle bursts of 2,600 Hz to dial a call. Acker had no problem figuring out that his beloved Tonette whistle could be used to beep the appropriate number of beeps to dial a telephone number. The problem was finding a place in the telephone network that would accept this antiquated SF signaling technique. Lucky Joe Engressia just happened to live in a place where that worked. Not so Bill Acker.
“I knew it was my job to find a place that would take SF,” he recalls.
Acker had a friend, John, who sometimes joined him on his telephonic explorations. Together, they started scouting out locations on the telephone network that would work for them. They dialed lots of places and tried to make calls using pulses of 2,600 Hz but didn’t meet with any success. Then, one Sunday night toward the end of 1968, Acker happened to call Halifax, Nova Scotia (area code 902, if you’re wondering). He noticed immediately that “it sounded like a very different kind of a system.” Unfortunately, Acker had to go into school the next day, so he didn’t get a chance to experiment with it that night. The next time he saw his friend he said, “John, try Halifax, it sounds a little different, maybe we’ll be able to do it.”
The next afternoon at school Acker was paged to the principal’s office, saying that he had a phone call. Acker went down to the administration office, where he was handed the telephone. “So I pick up the phone call and I hear this long-distance noise on the line and a very excited John on the other end of the line saying, ‘It works, it works! 902! You can do it!’ So then we knew we were in.” From then on, Acker says, “We routed all of our fun and games through Halifax, Nova Scotia.” Acker would just dial 902-555-1212, whistle off, whistle the pulses for the number he wanted, and he was off to the races.
Using the Tonette whistle got old quickly. Acker needed a way to reliably make a controlled number of carefully timed pulses of 2,600 Hz. What better way than with a telephone dial? After all, that’s exactly what your telephone dial does: it makes a controlled number of pulses on your telephone line. But, of course, he needed more than just a rotary phone, because a rotary phone just makes clicks or pulses and Acker needed beeps of 2,600 Hz. Fortunately, Acker was a ham radio operator and back in those days ham operators used Morse code to communicate. Acker rewired an old rotary phone and connected it to a Morse code practice oscillator that he had lying around. He tuned the oscillator to 2,600 Hz. Voilà! Now if he dialed a 7 he got seven perfect beeps at just the right pitch. No Tonette flute required. He didn’t know it, of course, but Acker had just independently re-created the very first box that Ralph Barclay had built back at Washington State some eight years earlier.
The Morse code practice oscillator connected to the telephone dial was a great stopgap measure, but Acker wanted to get back to his original plan of recording the outgoing MF tones that he could hear the phone company equipment sending and then playing them back into the phone. Finally, early in 1969, Acker got his hands on a small Panasonic cassette tape recorder. Once he captured the phone company’s tones on tape he could splice up the tape to select the particular digits he wanted and play them back—the network would be his oyster. Not only would this be easier than playing his Tonette flute or using the slightly clunky Morse code practice lash-up, it also meant he would no longer have to dial all his calls through Halifax as multifrequency tones were accepted pretty much anywhere in the network.
He ran into a problem, however. Although he could indeed hear and record the tones sent out by the switching equipment, he discovered that the tones were distorted. “It’s all highs and no lows,” Acker says. If you think of the phone network as a big stereo, it was as if somebody had cranked the tone control way over to one side, with the effect of toning down the bass notes and jacking up the treble notes. If you recorded these tones and tried to play them back, you’d be playing what Acker describes as a “very tinny” concert for the phone company; the remote switching equipment you were serenading “isn’t really going to be interested,” he says.
“So,” Acker says, “I knew I had to do something to the audio. What could I do? The tape recorder was a cheap cassette machine with automatic level control,” he recalls. There was nothing he could do to adjust it. “What you got, you got. I didn’t have access to an equalizer, I’m not even sure if I knew such a thing existed back then. So I went to my junk drawer and pulled out a component.” Unable to see the components, of course, he worked by feel. “I don’t know what this is. It’s a can, it has a lead at each end, it could have been a resistor, it could have been a capacitor. I didn’t really know,” he recalls.
“I put it across the output of the tape recorder. And that did a great thing!” Bill exclaims, excitement in his voice more than forty years later. “It did a wonderful job of rolling off the highs, it was much ‘bassier,’ and I was just in.”
It wasn’t too long before he came up with something even better than recording tones from the telephone company: an electronic organ. The Lavelle school had a Hammond organ that could be used to create the frequencies he needed to generate MF tones and transfer them to tape. “I used to go in there and record all the numbers I needed for the weekend,” he says. Acker and his friends made a master tape from the Hammond. “You know, KP, 1, 2, 3, 4, 5, 6, 7, 8, 9, ST, and a lot of 2,600 Hz.” With smaller tape recorders with pause buttons, “we could pretty much make tapes of whatever we wanted.” What did his teachers think of his unorthodox use of the school’s organ? “They had no clue!” Reflecting on it a bit more he allows, “I think the music teacher did know what we were doing but he kind of looked the other way.” Either way, he says, it was “a bucket of fun!”
In May 1969, just ten days shy of his sixteenth birthday, Acker received a surprise telephone call.
“We had done something that I knew stood a chance of getting us in trouble,” he recalls. In the old days, when you made a long-distance call and the person you were calling answered the phone, a supervision signal was sent back to the billing equipment instructing it to start charging for the call. If the phone just rang and rang without ever being answered, no supervision signal was ever sent back; that’s why you didn’t get charged for phone calls that weren’t answered. The phone company also used this technique to make certain internal test numbers toll-free; the circuitry for those numbers was configured not to send back supervision. In phone phreak parlance, such calls were said not to “supe.”
The telephone company did this on a large scale with the directory assistance number, 555-1212. Calls to 555-1212 were free because they didn’t supe—from the telephone company billing equipment’s standpoint, calls to those numbers never seemed to be answered.
But there’s a subtle problem here if you’re a phone phreak with a blue box or, like Acker, a phone phreak with tape recordings of blue box tones. If you call 555-1212 in a distant area code and then whistle it off and use your blue box or tape recordings to reroute the call to a normal telephone number, you’ve just given the phone company a clue that you’re up to no good. Why? Well, remember, a call to 555-1212 never supes. Except that when you reroute the call to a normal telephone number and your friend answers the phone, the call does supe—the instant your friend answers the phone. Acker was starting his exploration of the network by dialing 555-1212, a number that should never look like it answered. “Yet when we were through with the call, it did, because we connected to things that answered.”
At that point, the phone company billing records show something anomalous: here’s a call to a number, 555-1212, that should never look like it answered and yet it does. The phone company doesn’t like anomalies in its network, not so much because they think somebody might be messing with them, but just because anomalies probably mean that something is broken somewhere and needs repair.
“I knew that was an irregularity,” Acker says. “My fear was, you know, if this registers on your tape”—Acker knew the phone company in those days used paper tape for billing records—“they’ll be able to tell that [the call] answered, and they know it’s not supposed to.” Acker’s fears were right on the money. The phone company was indeed using computer-generated reports of supervision irregularities to spot blue boxes. Along with Greenstar, these reports were a primary tool the Bell System used to detect such fraud and, due to Greenstar’s secrecy, were among the most effective for prosecution.
Acker’s surprise caller was a security agent from his telephone company, New York Telephone. The agent had already talked to Acker’s friend John, likely because of 555-1212 supervision anomalies. But the reason the agent wanted to talk to Acker was more concrete. John had ratted out Acker to the security agent.
“He spilled his guts,” Acker says. “That was just an inconceivable no-no to me. That pretty much trashed our friendship. Forever and ever.” Forty years later you can still hear the intensity in Acker’s voice. “When you get in trouble, you don’t squeal on anybody.” Even today Acker still sometimes worries that the phone company may have caught some phone phreaks simply by surreptitiously monitoring Acker’s telephone line. The thought that he might have inadvertently gotten people in trouble merely by talking to them on his home phone is bad enough, he says. “But to actually give up the name of another phreak was just . . . just horrible.” Somehow Acker had picked up the concept of omertà, honoring a code of silence. “I don’t know where I got that ethic. I believe it was the right ethic, but I don’t know where I got it from,” he says.
The New York Telephone security agent told Acker that his illegal dialing had to stop. “He was as firm as he had to be,” Acker recalls. “He didn’t go out of his way to scare us, but he laid it out for us. I don’t even recall him saying, ‘If you don’t stop we’r
e gonna send the FBI after you,’ but he made it clear that it had to stop.”
“I like learning about the network,” Acker told the security agent.
“I can appreciate that,” was the agent’s reply. “It was nice of him to say that,” says Acker, “but the bottom line was, you gotta stop.”
So Acker stopped.
Or so it appeared, at least to all outward appearances; his fingers stopped dialing around the network and he quit playing with the MF tapes on his Panasonic tape recorder. But his brain just wouldn’t stop thinking about this stuff. “I realized that 555 had gotten us in trouble,” Acker says. What he needed, it seemed, was a safer way to access the network, one that wouldn’t get him in trouble again. The telephone company delivered. Just a few years earlier the company had introduced an innovative new service, something called an 800 number. These numbers were free to the caller because the person or company being called paid the bill. That doesn’t seem like such a big deal today, now that long-distance is so cheap, but back then, given how expensive calls were, it was a big deal.
Since calls to 800 numbers were free, like 555-1212, they were a good place to start a blue-boxed call. But 800 numbers didn’t have the pesky problem that 555-1212 did. “When an 800 number answers, it answered. It went off hook, all the way back to you,” Acker says. In other words, 800 numbers returned supervision. Acker’s theory was that if he used 800 numbers for blue boxing, “they looked like normal calls to an 800 number.” That meant no telephone network anomalies for the phone company to investigate. And that meant no more phone company security calls to Bill Acker. Or so he hoped. Of course, it might look suspicious if you had too many calls to 800 numbers—normal people just didn’t call that many 800 numbers back in 1969, or talk very long on them—but, says Acker, “it was obviously safer than 555.”
Exploding the Phone : The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell (9780802193759) Page 16