Draper claims that he warned the phreaks that talking to Rosenbaum was a bad idea and would get them all in trouble and might lead to the end of their hobby. He said he asked Rosenbaum not to write the article. “When I talked to Ron, I let him know in no uncertain terms that to publish this would cause major problems, not just for me, but for the phone company and all parties concerned, and did everything in my power to convince him not to publish this information.” Rosenbaum’s recollection differs: “At the time Crunch was very happy to be included in the story.”
Rosenbaum concluded his West Coast interviews and flew to Memphis to spend some time with Joe Engressia. “He was a really fascinating character,” Rosenbaum recalls, “a really likable guy.” Rosenbaum returned home to New York to finish his assignment.
The picture on the cover of Esquire magazine’s October 1971 issue was striking: a naked 1940s pinup girl on a swing, blond hair flowing behind her, breasts strategically hidden by her upraised arms. But for some readers, the really striking picture came on page 116: a full-page, full-frontal black-and-white photo—but not of a pinup girl. No, the photo was of a small plastic box with a silver metal face, four screws, and thirteen small buttons. The caption read, simply, “Actual size.”
The photo was the lead in to Rosenbaum’s article, “Secrets of the Little Blue Box.” It followed the adventures of a fanciful mix of characters, members of an otherworldly underground network of phone phreaks. The soul of the network was Joe Engressia, a blind twenty-two-year-old from Memphis who could whistle free phone calls and whom Rosenbaum dubbed the “granddaddy of phone phreaking.” Engressia, Rosenbaum wrote, sat like a sightless spider at the center of a web of other phone phreaks. A dozen teenagers—some blind, some sighted—formed the bulk of the network, each with his own odd nickname: Fraser Lucey from New York, Randy and Mr. Westin from San Jose, the Midnight Skulker from Seattle, the list went on. Rosenbaum chronicled their clandestine activities, their meeting like spies on anonymous loop-around circuits and their efforts to trick telephone company employees into manipulating switching equipment for them. The article spoke of an electronic mecca: a legendary conference call setup called “2111” that only phone phreaks could reach, one where dozens of teenagers would talk for hours, exchanging information on the telephone system and swapping tales of their adventures.
Their hobby may have been illegal but Rosenbaum portrayed most of the phreaks as possessing the innocence of monks, electronic seminary students studying the Bell System’s long-distance network as if it were scripture. An older, worldlier character named Al Gilbertson injected hints of avarice and danger with his plans to Make Money Fast by selling blue boxes to the mob. And throughout the article a maniacal fellow referred to only as Captain Crunch kept popping up. Crunch appeared to be some kind of crazy superphreak who claimed to live out of his VW van as he traveled the country, using his wits and his blue box to tap phone lines and make calls that circled the globe from one pay phone to another—all while staying one step ahead of the telephone company and the FBI.
All in all, Rosenbaum’s story read like a telephonic cross between an acid trip and Gulliver’s Travels. It seemed like it had to be fiction.
Except that it wasn’t—aside, perhaps, from some journalistic license. With the exception of Engressia, Rosenbaum gave the characters pseudonyms and brushed more than enough makeup over them to obscure their identities; some, in fact, were composite characters. Rosenbaum’s distinctive writing style later caused several of the characters he portrayed to raise their eyebrows just a smidge when they read the article. “I thought he spiced it up too much,” recalls Gilbertson. Bill Acker, who says he was the lion’s share of the composite character “Fraser Lucey” in the article, agrees. “I didn’t like the technical inaccuracies,” he says.
Technical inaccuracies are one thing, Acker allows, and flavor another: “He captured the spirit of it wonderfully!” Indeed. The article’s tone and style lent an air of mystery and hipness to an otherwise geeky hobby. Rosenbaum even coined a new word in the article: phreak, with a “ph.” Although they had referred to themselves as phone freaks prior to the Esquire article, it had always been freaks with an “f.” Now, forever more, it would be phreaks.
Readers with a slight bit of technical knowledge found the article intriguing, something worth investigating. The article gave enough leads to get people started, but not enough to hand it to them without some work on their own. In many ways, like the telephone network itself, it was a puzzle, a fifteen-thousand-word one that begged to be solved. To the right sort of reader, the rewards for solving this puzzle were intoxicating. It wasn’t just the ability to make free phone calls but the promise of joining a secret society, one whose members could control the telephone network and con telephone switchmen into doing their bidding.
One part of the article described a phone phreak trick called tandem stacking. Remember that tandems were like intermediate stops on the telephone network: if you needed to call from Long Island to Chicago your call would likely be routed through at least one tandem switching machine to get there, and possibly a couple of them. The phone company spent lots of money and R&D effort in making the tandems smart enough to route calls automatically, like the hulking No. 4A switching machine that took up a city block, with its metal punch cards encoded with routing information. That was the intelligence that enabled the switching equipment to automatically route calls across the country. This is great news if you’re a typical telephone user; you just want your calls to go through and you don’t particularly care how they get there. But not if you’re a phone phreak.
Phone phreaks like control, to be in charge of the network, to decide exactly how their calls get from point A to point B. For some this was a love of discovery. “What happens if I route the call this way? What does it sound like?” For others it was a flexing of electronic muscles, a feeling of power that came from exercising will over Ma Bell’s billion-dollar network. And for still others it was just fun, a way to goof off, an interesting mental challenge followed by a lovely auditory experience.
Tandem stacking was possible thanks to a bug—some would call it a feature—in a particular type of telephone switch called a crossbar tandem. Crossbar tandems could be tricked with a blue box into sending your call via a particular route in the network. It might work as follows:
Say you’re Bill Acker out in Farmingdale, New York. You dial an 800 number that goes to someplace out of state—California, let’s say. The first leg of your call gets routed through a switching machine called White Plains Tandem 2, which happens to be a 4A tandem. Before anyone in California answers your call you send a burst of 2,600 Hz down the line and hear the kerchink come back from White Plains. This is the “wink” signal that tells you you’ve reset the call and are now talking directly to the White Plains 4A, which is waiting for you to send it MF digits.
Using your blue box you send KP 099 213 ST, a string of digits that doesn’t look much like a telephone number. Within a given area code there are of course many different cities, and many of these cities had their own tandems. Partially as a holdover from the old days of operators plugging cords into jacks, each of these tandems was given a three-digit terminating toll center (TTC) code. In New York’s 516 area code, 099 refers to a crossbar tandem in Poughkeepsie. So White Plains sees the 099 you sent, grabs a trunk to Poughkeepsie, and sends it the remaining digits: KP 213 ST. Poughkeepsie recognizes 213 as the area code for Los Angeles, so it takes this as a command to get southern California on the line. It connects you to a 4A tandem there called Los Angeles 2. But Poughkeepsie has run out of digits—that is, it has no further digits to send to Los Angeles—so while it establishes the connection to LA it doesn’t do anything more.
Now it’s your turn again. You and your blue box, via White Plains and Poughkeepsie, are now whispering into the ear of Los Angeles 2. You key KP 707 001 042 ST; 707 is the area code for the north
ern part of the San Francisco Bay Area and 001 is the terminating toll center code for Eureka, a small town in northern California. Los Angeles Tandem 2 recognizes 707 001 and grabs a trunk to Eureka and sends KP 042 ST. As it happens, 042 is the TTC code for Santa Rosa, California, so Eureka in turn grabs a trunk to Santa Rosa. But, like Poughkeepsie, Eureka has run out of digits, so the action stops for a moment. You’re now talking to the Santa Rosa crossbar tandem via White Plains, Poughkeepsie, Los Angeles, and Eureka. Using your blue box you send KP 312 338 1975 ST, the number of your friend in Chicago. Santa Rosa finds a trunk to Chicago and sends it the seven-digit local number to dial. Your friend’s phone begins to ring.
You’ve just placed a call that could have taken two hops through the network and traveled 750 miles and turned it into one with six hops over more than 5,000 miles. The call will now be way noisier than it needed to be and the audio distortion introduced by the extra crossbar tandems will make it sound like hell. Why on earth would you do this? Because you could. Because you’re a phone phreak. Most of all, Acker recalls, because it was just plain fun.
When your friend in Chicago picks up the phone he will instantly know this is a special call—if he’s a phone phreak, that is. He will first hear the hiss of the long-distance trunk noise, much louder than usual because of the peculiar call routing you’ve gone to such trouble to create. Over the course of the next couple of seconds he will hear a series of phantomlike kerchinky noises, one after another—about six in all—fading in volume as they go. It will be as if they are receding into the vapor of the network, almost as if they are running away from him. As it turns out, they are; these are the sounds of the supervision signal being sent from his phone in Chicago to the billing equipment in Long Island, a signal that is repeated by each intermediate tandem, each farther away from your friend and closer to you. When you hang up, the domino process will repeat, but this time the dominos will be falling toward your friend in Chicago, the kerchinks getting louder and louder as the supervision signal races toward him, repeated by each tandem as it goes.
Tandem stacking was simply a cool, harmless prank . . . until Captain Crunch made some hair-raising claims in the Esquire article, saying that just “three phone phreaks [could] saturate the phone system of the nation. Saturate it. Busy it out.” This could be done, he said, by stacking tandems to tie up long-distance trunk lines between cities.
It was an alarming claim. It also happened to be nonsense, at least according to Bill Acker, Crunch’s friend and the phone phreak probably most versed in long-distance call routing. “I don’t know what John was smoking when he said that,” Acker says. “I just don’t know why he said things like that.” According to Acker there were simply too many trunk lines between cities, the switching systems all supported the concept of alternate routing—that is, looking for an alternative route if the first choice was busy—and, finally, it was difficult to stack up more than about six or seven tandems at a time.
One of the other alarming things in the Esquire article was the suggestion that phone phreaks somehow had a preternatural ability to con telephone company employees into flipping switches in central offices for them. As it turns out, they did. When it came to the ability to BS telephone company employees, Denny Teresi—“Randy” in the Esquire article—was the undisputed master of the phone phreak phlimphlam, what would later become known as social engineering: calling someone up, pretending to be someone else, and getting them to do things for you, things they shouldn’t oughta do. Teresi’s targets were unwitting switchmen in telephone company central offices. Pretending to be another telephone company switchman or technician, his usual goal was getting his marks to wire up loop arounds or conference circuits or getting such circuits restored to operation when they had been removed from service. His patter might go something like this.
“Hey buddy, this is Fred in the network service center. How you doing? Hey, the loop around in your office seems to be busy. I wonder if you could take a look at it for me?” Depending on how green the switchman was, he might need some coaching. “Okay, let’s find out what the trunk group is. On your computer type VFY-EXG-270100. Look for a TR02 message. Yeah. See it? Okay, in the TR02 message, you’ll find on the third line down, on the left-hand side, you’ll find the trunk group. Do you have that? Great. What is it? Fifty-five? Okay, now, we wanna find the TRZ in the trunk group. The way we’ll do that is type TRK-TRZ-QT0055 . . .”
If you’re wondering how the phone phreaks learned this kind of stuff, often all they had to do was ask. “Sometimes you’d call up and get a switchman who knew what he was doing,” Acker says. “You’d ask him to do something for you and he’d jump right on it. Then you’d ask him to explain to you how he did it. You’d say something like, ‘Wow, that’s great, thanks! You know, I’m finding we’re running into that problem a lot. Can you talk me through what you did to fix it?’”
Teresi explains his modus operandi this way: “I understood the equipment well enough. You just start trying it and see what happens. If you knew enough about it and you had the right tone, you could often get them to do it. Of course, you had to have the knack of BS a little bit, you needed to be able to convince them that, even though this was not a normal channels kind of thing, that it was still okay.” One of his techniques involved reassuring his target. “For example, you tell them to choose the line links [i.e., where the wires should be terminated for a bogus conference call setup], and then you’d tell them you were immediately going to call Traffic [Engineering] and clear it with them, so they wouldn’t reassign them.” That way the target knew he wasn’t going to get in trouble for whatever strange thing he was being asked to do. “We were doing things that were definitely nonstandard but it was just a matter of sounding authoritative enough to convince them that it was okay to do,” Teresi says.
Teresi’s task was made easier by the size of the telephone company and its sprawling geography, with its roughly one million employees spread out across virtually every town and city in the United States. The size and scope of the Bell System forced it to rely on its own product, the telephone, to perform its daily business; one historian estimated that some 95 percent of all telephone company internal business was conducted over the phone. And besides, say you’re a telephone company switchman. Just how likely is it, really, that some kid is going to get your unlisted work telephone number and then call you up and ask you to do some obscure technical thing for him? And how could a kid possibly know enough about your job and the equipment you use to be able to convince you that he works for your company and that his is a legitimate request?
That was—and is—the sort of thinking that allows social engineering to work. “It’s really kind of wild that we were able to get them to do it, but it was just a matter of sounding convincing enough,” Teresi remembers. “If you got someone with not enough experience, they’d fall for it.”
“Denny was the best,” says Acker. The term “social engineering” hadn’t been coined yet, so in Teresi’s honor the phone phreaks invented a new verb: to DT someone was to bullshit them so thoroughly that they never suspected they’d been had.
Rosenbaum’s writing skill coupled with Esquire’s circulation did more in one month to spread phone phreaking into the mainstream than anything before or after. The Law of Unintended Consequences could brush its hands together briskly. Its work here was done and the train was now fully off the rails.
John Draper remembers the publication of the Esquire article as if it were yesterday. A student at San Jose City College, Draper went to his first class that morning and then walked across the street to buy a copy of the magazine. “I went back to my car and I read it cover to cover,” Draper says. “I missed three classes. I had to read it. I could not go to those classes.” When he finished, he remembers, “I said, ‘Oh my God. Well, I guess that’s pretty much the end of phone phreaking.’”
Draper drove home. He called Denny Teresi and rea
d the article to him over the phone. Draper was certain that with this much publicity, with this many secrets being exposed, the telephone company would have to take action. Holes in the network would be plugged up. Things that used to be safe now wouldn’t be. The phone company and the FBI could come swooping down on them at any moment. “I knew right then and there that phone phreaking as I knew it was ended,” he recalled.
Worse, Draper was featured as one of the stars of the article. The good news was that he was under the alias Captain Crunch. But many phreaks knew his real name. And if there were raids, he figured he was likely to be the prime target. It was just a matter of time, he thought. Draper took his blue boxes and put them in a shed out back, where they wouldn’t be discovered if the FBI searched his apartment. He made a decision, he recalls. From that moment on, “they don’t live with me anymore.”
Draper’s instincts were right; as the saying goes, “Even paranoids have enemies.” While the Esquire article was still being written the phone company was already beginning to step up its enforcement activities. In May of that year, after a three-month investigation, New York Telephone and the police arrested nine college students for blue box fraud in New York—eight upstate in Potsdam at Clarkson College of Technology and the State University of New York and one at the New York Institute of Technology; the NYIT student was referred to in the New York Times as a “boy genius.” The very next day another ten students at Case Western Reserve University in Cleveland, Ohio, were arrested on similar charges. That August, eight more people were arrested by the FBI for blue box fraud in Billings, Montana. In September, four more people—including one telephone company employee, who claimed innocence—were arrested in Pennsylvania.
Draper’s worries weren’t helped when Maureen Orth’s “For Whom Ma Bell Tolls Not” was published on October 31, 1971, in the Sunday supplement to the Los Angeles Times. The article, which was later reprinted in other newspapers, read like a shorter version of the Esquire story. It opened with a description of Captain Crunch in a pay phone booth at a gas station using his blue box to get the American embassy in Moscow on the line. It discussed the blind phreaks, Joe Engressia, tandem stacking and quoted an independent telephone company source as saying that the cost of blue box fraud might be as high as $50 million a year.
Exploding the Phone : The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell (9780802193759) Page 20