Perhaps the ultimate phone phreak prank belongs to Captain Crunch and a friend of his, though their material came courtesy of Johnny Carson’s joke writers. The year 1973 had been a rough one for the United States, what with the ongoing Watergate scandal and the energy crisis and gas rationing. Carson, the host of the popular Tonight show, watched by millions of people every evening, joked on TV in late December about the latest crisis facing the United States: “You know, we’ve got all sorts of shortages these days. But have you heard the latest? I’m not kidding. I saw it in the paper. There’s a shortage of toilet paper.” The next day Americans rushed to buy toilet tissue, emptying shelves in stores. Carson later apologized for the joke and clarified that there was no toilet paper shortage, except that now it seemed as if there actually were one, since people could see for themselves that store shelves were bare. The rumor took hold and it was months before the situation worked itself out.
With that as background, Crunch’s prank began with a call to a particular toll-free 800 number. Back in the 1970s, 800 numbers mapped to regular telephone numbers. In fact, each prefix within the 800 system translated to a particular area code. For example, 800-421 mapped to area code 213 in Los Angeles, 800-227 mapped to area code 415 in the San Francisco Bay Area, and 800-424 mapped to area code 202 in Washington, D.C.
Now, if you’re a phone phreak and want to scan for interesting numbers, what better place to dig through than Washington, D.C.? There are only ten thousand numbers to dial and it doesn’t cost you anything to call them—they’re toll-free, after all—and it should be a natural hunting ground for interesting things. Before long the phone phreaks had discovered a toll-free number that went to the White House: (800) 424-9337. Draper believed this was the “CIA crisis line,” that is, the CIA’s hotline to the White House, and he claims that he was able to eavesdrop on it using his blue box. One evening, Draper says, he and a friend were listening to this line and, through their wiretapping, learned that the code name for the president was “Olympus.”
“Now we had the code word that would summon Nixon to the phone,” Draper says. He and his friend wasted no time in dialing the 800 number, though he claims they were careful to first route their call through several tandems in order to make it difficult to trace back.
“9337,” said the person who answered the phone.
“Olympus, please!” Draper’s friend said.
“One moment, sir.”
About a minute later, Draper recalls, a man who sounded “remarkably like Nixon” asked, “What’s going on?”
“We have a crisis here in Los Angeles!” Draper’s friend replied.
“What’s the nature of the crisis?” the voice asked.
In the most serious voice he could summon, Draper’s friend responded, “We’re out of toilet paper, sir!”
“Who is this!” Draper recalls the Nixon-like voice demanding. Draper and his friend quickly hung up.
“I think this was one of the funniest pranks,” Draper says, “and I don’t think that Woz would even come close to this one. I think he was jealous for a long time.”
Sixteen
The Story of a War
NATIONAL PUBLIC RADIO host Jim Russell’s authoritative baritone delivered the ominous news. “This is the story of a war,” he intoned. “This war finds small bands of guerrillas attacking an enormous conventional army. While the large conventional army has been quick to publicize its victories, there is still great uncertainty about who is winning.”
NPR listeners could be forgiven for thinking this was yet another story about the Vietnam War. In January 1973 Vietnam was on the minds of Americans everywhere; after on-again, off-again peace talks with the North Vietnamese, President Nixon had just ordered a massive resumption of B-52 bombing raids over the Christmas holidays.
The story wasn’t about Vietnam, however, it was about phone phreaks. “The Telephone Company You’re Dialing Has Been Temporarily Disconnected” was an hour-long special featuring the likes of Al Bell, Al Gilbertson, and Joe Engressia. Over jangly background music made up of MF tones—a song called the “MF Boogie,” composed on an electronic organ during a conference call by the musical phone phreak Kim Lingo—the program gave its listeners a thorough, if slightly exaggerated, introduction to phone phreaking. It covered blue and black boxes, international dialing, conference calls, toll-free loop arounds, the YIPL newsletter, phone phreak conventions, Captain Crunch’s arrest and conviction, and even early computer hacking.
For balance, it included counterpoint from Joe Doherty, AT&T’s director of corporate security—the man NPR described as the “ranking general in Ma Bell’s war effort against the phone phreaks.” Doherty admitted that much of the phreaking problem was a self-inflicted wound. “The candor with which we have published technical information through the years, especially the early years, as to how the system works has come back to plague us to some extent,” he said. But he also emphasized that the game had changed: “At one time, to be perfectly frank, we were, in my view, somewhat overly lenient, in that we would just caution these people, slap them on the wrist and give them a deterrent interview. We did not prosecute to any great extent. We have changed that policy. We are prosecuting as a rule now, rather than an exception.” In addition, the network would eventually be modified to make phone phreaking obsolete. “It’s a tradeoff between the cost of prevention and what we’re losing,” he said. “We are restudying the most economical way to modify the network at the present time.”
The NPR program seemed to underscore the fact that phone phreaking had reached a tipping point. Thanks to the Esquire article, NPR, and other media coverage, coupled with the rise of the New Left and the hippie-Yippie “rip off culture,” phone phreaking—at least the sort of phreaking that was interested primarily in making free phone calls—was spreading to the mainstream. The host of the NPR program went so far as to suggest that there were “tens of millions” of potential phone phreaks due to widespread hatred of the phone company.
But it was too soon to count Ma Bell out. Its newly acquired penchant for prosecution, coupled with improved technology that was proliferating throughout the network, would give the phreaks a run for their money.
One of these bits of technology had been invented more than twenty-five years earlier. On a workbench in Murray Hill, New Jersey, in 1947 three Bell Labs researchers—Walter Brattain, John Bardeen, and William Shockley—had lashed together a setup that looked about as unlikely as Alexander Graham Bell’s original telephone back in 1876. It looked a bit like a high school science fair project, to be honest. It was a plastic wedge with a sharp edge that was pressed against a small chunk of germanium. Trapped between the wedge and the germanium were two small strips of gold foil.
Three tiny wires came away from the thing. One, attached directly to the base of the germanium, was a control input. If you applied a voltage to this wire, electric current could flow between the other two wires connected to the gold foil strips. This odd action happened because germanium was neither fish nor fowl. It was a semiconductor: not quite a conductor but not quite an insulator either. And though its semiconductor properties were not well understood at first, the practical implication was immediately clear. The little widget could be used both as an electronic switch and as an amplifier, just like a vacuum tube or a relay. But unlike vacuum tubes and relays, this thing could be turned on or off almost instantaneously. It was tiny, it had no moving parts, it consumed little power, and it didn’t wear out.
The researchers called it a transistor, and less than ten years later the trio would be awarded the Nobel Prize in physics for its invention.
It was not lost on the engineers at Bell Labs that the transistor might be the ideal thing to form the fabric of a new telephone switching system, the technology the company needed to replace the old step-by-step and crossbar switches. Indeed, the first proposals within Bell L
abs for a transistor-based telephone switching system came as early as 1952. Years earlier Strowger switches, with their rotors and pawls, had begun to replace operators who used plugs and jacks to make connections between pairs of telephone wires. They were in turn replaced by relays and crossbar switches. Now transistors would replace these electromechanical contrivances. No longer would telephone company central offices be filled with the clicks and clacks of physical switching as calls were placed; transistors would silently and electronically connect pairs of wires to one another. This new approach was dubbed “electronic switching.”
Bell Labs’ first foray into electronic switching began in 1954. For a variety of technical reasons, the transistor itself would not be used as the electronic device that would actually connect pairs of telephone wires together. Instead, transistors would make up the logic—the brains—that controlled the switches; in this role transistors were replacing the relays that had been used as the control logic in the crossbar system. But by 1955 the engineers working on the prototype electronic switching system at Bell Labs had run into problems. The control circuits had grown complex and unwieldy. Worse, every time the requirements changed—and given that they were building a pie-in-the-sky prototype system, requirements changed frequently—the engineers would have to go back and redesign surprisingly large chunks of the hardwired control logic.
During the summer of 1955 one of the Bell Labs engineers read an article that described a newfangled thing called a digital computer. He was “struck by the similarity of what the computer could do and the actions required of the [telephone switch] control circuits.” Within a few months Bell Labs had abandoned its approach of using transistors to create hardwired logic to control the new telephone switch. Instead, researchers would use transistors to build a programmable digital computer. The computer and its program would control the telephone switch. They christened this concept stored program control, or SPC. If it worked, SPC promised a much more flexible, capable telephone system. New features could be added quickly and telephone switches could be upgraded simply by reprogramming them, instead of by rewiring or replacing physical hardware. Moreover, they hoped, such switches would be cheaper in the long run: computer-controlled electronic switching systems could serve more telephone lines than their electromechanical brethren, which in turn meant fewer central offices would be needed.
It was a risky approach. Bell Labs had never built a computer before and its engineers had never written a line of computer code. Yet now they were proposing to stake the development of the company’s next-generation switching system on this new and unproven architecture.
Development took years, culminating finally in the 1960 trial of the world’s first electronic telephone switching system—a trial that was fully a year behind schedule. Known simply as “Morris” after Morris, Illinois, the city that hosted it, it served only a few hundred telephone lines.
Now, at some fundamental level, computers haven’t changed that much. At their most basic, computers still consist of central processing units (CPUs) and memories. The CPU executes instructions, that is, simple low-level commands that tell it what to do. These instructions direct the CPU to do things such as load a value from memory, store a value to memory, perform an arithmetic or logic operation, compare the result of an operation to some other result, or branch—execute some other set of instructions—depending on some previous result.
Today if you want a computer you can buy one for a few hundred dollars. Your computer will probably have a central processing unit—a processor—that executes somewhere between one billion and three billion instructions per second. This is made possible by about a billion transistors on a piece of silicon about the size of a postage stamp. Your computer will probably have several gigabytes of memory, that is, more than 10 billion bits, the zeros and ones that make up binary data. It will likely take less power than a pair of 100-watt lightbulbs and be smaller than a toaster.
In contrast, the computer that controlled the Morris switch consisted of twelve thousand individual transistors connected to one another by a spider’s web of wires. It executed its programs at a then blazing three hundred thousand instructions per second—in other words, about five thousand times slower than a typical PC today. For reliability, Morris had two complete CPUs running in sync with each other. If one detected an error in its computations, it would take itself out of operation and pass control to its twin, ideally never dropping a telephone call in the process. The entire program to operate the Morris telephone switch took about fifty thousand instructions, including things such as maintenance tasks; the portion used for typical phone calls was smaller. This number was large by the standards of the day but is tiny now. Microsoft’s popular word-processing program Word is about one hundred times larger, and that’s not counting the gigantic Windows operating system.
Morris’s program memory—the place where its programs were stored—looked like something out of a 1950s science fiction movie. Called the “flying spot store,” it consisted of four ten-inch by twelve-inch glass photographic plates with thousands of tiny black dots on them. A cathode ray tube—like an old-school television picture tube—moved a spot of light across the plate. As the beam of light flew across the dots, lenses and photodetectors decided whether they were seeing a “1” (a transparent spot) or a “0” (a black spot that blocked the light), enabling the bits of Morris’s program to be read out. Morris’s data memory—the “barrier grid store”—was similarly Frankensteinian, using electron beams generated by cathode ray tubes to deposit charges on an insulating plate. These charges could be changed on the fly to store 0s or 1s of binary data. The individual electronic components that Morris was built out of, such as transistors and diodes, were often designed in-house by Bell Labs and produced by Western Electric, AT&T’s manufacturing subsidiary. In total, Morris consisted of four rows of metal cabinets chock-full of components; each row was about seven feet tall by two feet deep. Oh, and thirty-five feet long.
Perhaps the most amazing thing about Morris was that it actually worked. Fundamentally, Morris demonstrated two things. First, the stored program control concept was viable, and a computer could in fact control a telephone switching system. Second, however, it demonstrated just how much more there was to be done before electronic switching was ready for prime time.
Bell Labs folded the hard-won knowledge from the Morris trial into an effort to develop a production-quality electronic switching system (ESS). It took five more years of hard work; a senior Bell Labs employee described the ESS development effort as a “traumatic experience.” But the new system, called—naturally—the No. 1 ESS, went live in 1965 in Succasunna, New Jersey. Though the No. 1 ESS differed in many ways from Morris, it retained the basic concepts of stored program control and dual processors for reliability. By the end of 1967 some eighteen No. 1 ESS switches had been deployed throughout the network, with many more to follow in the 1970s.
Development of a commercial-grade electronic switching system had taken ten calendar years, a staggering four thousand man-years of engineering effort, and cost $500 million—more than $3.5 billion in today’s dollars. It was a perfect example of the sort of thing that the Bell System could do, thanks to its being a regulated monopoly with a guaranteed profit and no competitors to speak of. In the words of the former AT&T historian Sheldon Hochheiser, “Absent competition, Bell Labs and AT&T took the time to get an innovation right (as an engineer would define right).” Or, as one observer of the ESS effort put it, they could “take the problem and trample it to death.”
Deploying computer technology throughout the network would take still more time and money, but the deployment was inevitable; henceforth, computers and telephone switches would be joined at the hip. Even old telephone switches weren’t safe from the computer revolution, not even the venerable 4A crossbar switch, the workhorse tandem of the long-distance network. Designed in the 1950s, 4As were purely electromechanical
affairs, with vacuum tubes and relays and mechanical card translator systems that looked up routing information by shining light through steel punch cards. AT&T set about upgrading these switches, replacing their relay-wired control logic with computers to allow the switch to make faster, smarter decisions. As early as 1969, just four years after the debut of the No. 1 ESS, Bell started upgrading 4As with new brains. Called the SPC No. 1A, these brains were essentially clones of the computers used in the No. 1 ESS. It would be the final evolution of Bell Labs’ cherished concept of common control—the idea that the smarts of the telephone switch should be separate from whatever mechanism did the actual switching. By 1976 more than 132 of the 4As had been upgraded to computer control.
From the telephone company’s perspective, the No. 1 ESS was eventually quite successful, though not without some initial teething problems. It was physically smaller than electromechanical telephone switches, offered vastly more features (such as call waiting and conference calling), and in the end cost less and could handle more calls. As far as phone phreaks were concerned, the No. 1 ESS was a mixed bag. On the plus side, these ESS installations often had more trunks to more places, and that meant more routes to explore. And No. 1 ESS had loop-around circuits that didn’t supe, meaning that they were free calls from anywhere in the country. Finally, No. 1 ESSes usually came with something called a touch-tone demonstrator. Believe it or not, there was a time when most telephone lines supported only rotary dialing; special circuitry had to be installed at the central office to enable touch-tone dialing on a given line, and this created a sales problem for the phone company. If you were a telephone installer and wanted to convince Mrs. Smith to upgrade her phone from rotary to touch tone (for which the telephone company charged an extra monthly fee), you had no way to show this new service to her, since her line probably didn’t support touch-tone dialing. A touch-tone demonstrator was a number that an installer could call with a rotary phone that would then connect to a second line, one that had touch tone enabled. This way the installer could demonstrate to Mrs. Smith how convenient touch tone was by using it to dial a call with a touch-tone phone, thereby closing the sale. Since there was no password on a touch-tone demonstrator, anyone could use it to make free calls as soon as the number leaked out.
Exploding the Phone : The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell (9780802193759) Page 26