In retrospect, perhaps it was the phone company that should have been paranoid. Some phreaks were becoming bolder in their quest to understand the network. One such phreak in New York recalls making friends with a fellow named George,¶¶ an operator at the AT&T overseas switching center at 32 Avenue of the Americas in Manhattan in 1975 or so. George provided him with a copy of the quick reference guide used by the international operators, giving the phreaks valuable international routing codes. Before long the phone phreak had talked George into loaning him his telephone company ID card, allowing him to slip inside and wander the switching center, looking for desirable manuals and reference books. “Later, after I pointed out the location of the books to him,” the phone phreak recalls, “he put them in a garbage bag, which he placed in the freight elevator along with the other garbage. And yes, I went searching for it. It was my first time going through the telephone company’s garbage, but not my last.”
¶¶A pseudonym.
Still, the phone phreaks’ increased paranoia wasn’t without reason. In addition to celebrities, some of the original phone phreaks were being busted too. Blind San Jose–area phone phreak Jim Fettgather’s arrest came in 1973. “The [Telephone Company] chief special agents kept warning us over and over again,” Fettgather remembers. “They really were actually friendly. They were not mean in any way. They talked with my folks, they talked with me,” Fettgather says, all to warn him to stop phreaking. “They knew what was happening. I don’t quite know how they found out, but they knew we were doing all this MFing and muting and so forth. We were given ample warning, there’s no question.” Finally, he says, the phone company must have had enough. The local police showed up with a search warrant and Fettgather spent a night in jail. “The whole thing was pretty ugly,” he says.
It was Denny Teresi’s turn next. Teresi, the blind kid with what the Esquire article described as the “voice of a crack oil-rig foreman,” the phreak with the otherworldly skill at getting telephone company switchmen to wire things up for him, had gone one call too far. “What finally nailed me was something that I had wired up in San Francisco,” he says. “It was a touch-tone demonstrator, where you dial in to one number and it would grab dial tone from another line . . . You could make outgoing calls, and all the calls were billed to an unassigned test number. That was up for a while. When they took it down I had the balls to call back in and get it wired up. I probably would have gotten nailed sooner or later anyway, but that was just the final straw. When I called back to have it wired in, they went ahead and wired it up for me, but they set it up and then they watched that line for three weeks and they billed me for all of the calls. I probably should have let well enough alone and just let it go away.”
Like Fettgather, Teresi agrees that the Pacific Telephone security agents had given them more than their share of breaks. “For the longest time the chief special agent, in this case George Alex, they had working on the case in San Jose, he was calling my parents or Jim’s parents or whatever, and he’d let them know what’s going on and he’d try to get us to cut it out. That went on for five years,” he says. “I guess they figured that would be enough of a slap on the hand to get us to slow it down or stop.” Teresi was fined $150 and had to pay for $320 worth of phone calls.
For the year 1973, an AT&T internal memo noted, there were 119 arrests for electronic toll fraud—more than double of the previous year. By 1974 the number had jumped to 158. By 1975 it was 176. Joseph Doherty, AT&T’s director of corporate security, was as good as his word: “We are prosecuting as a rule now, rather than an exception.”
Seventeen
A Little Bit Stupid
ON JUNE 21, 1975, John Draper did something a little bit stupid.
That day he entered a telephone booth in New York City and dialed an 800 number in Oakland, California. While the call was going through he held a blue box up to the phone and pressed a button, sending a burst of 2,600 Hz down the line.
“Bleeep!” said the blue box. “Kerchink!” responded the telephone network.
Draper pressed more buttons. Key pulse. 127 552 2155. Start. A few seconds later the telephone network rewarded him with what sounded like a bad imitation of Donald Duck talking to one of his nephews. If you squinted your ears and used your imagination you might think it sounded almost—almost—like two people talking.
Draper pressed another button and sent another quick blip of 2,600 Hz down the line. Donald Duck was replaced by the clear voices of two people talking about a work-related matter. Draper was now in the middle of their conversation, listening quietly. He eavesdropped for a few minutes and then hung up.
Draper had just used his blue box to hack into an internal telephone company service called verification. The need for this service sprang from one of the most annoying sounds in the world: the repetitive baaa . . . baaa . . . baaa of the busy signal. Although it’s less common to run into them today, what with call waiting being a standard feature on every mobile phone, it wasn’t that long ago that busy signals routinely drove people up the wall, especially if you were trying urgently to reach somebody with important news—somebody who, let’s say, had a teenage son or daughter who was constantly on the phone. When your frustration boiled over in such cases you could call the operator, give her the number you were trying to reach, and ask her to verify if someone was indeed talking on the line. After all, perhaps the person you were calling had simply forgotten to hang up the phone properly. If a conversation was actually in progress, you could ask for an emergency interrupt, in which case the operator would barge into the conversation and announce to your party that you were trying to reach them. Naturally, the Bell System charged for both of these services, typically 25¢ or so in the 1970s.
Busy line verification service had been around since the early 1900s. It was kind of a spooky thing, since it allowed operators to monitor and break in on private telephone calls. For security reasons, in most places only special operators had access to busy verification trunks, and these were limited to a particular city or area or telephone exchange. That way, an operator in Kansas City couldn’t eavesdrop on someone in San Francisco, for example.
It didn’t take phone phreaks long to start playing with verification, and by 1970 or so they had learned that you could call an inward operator, pretend to be someone from the test board, and—if you had the right voice or maybe just got lucky—talk her into “putting you up” (that is, plugging you in) to a verify trunk. From there, with a blue box, you could select the particular telephone line in that area or exchange that you wanted to eavesdrop upon.
As with everything else in the telephone network, verification started out as a manual affair but eventually became automated. By 1972 phone phreaks like Bill Acker, Ray Oklahoma, and Joe Engressia had discovered that verification circuits in some places could be reached with just a blue box, no operator required, from anywhere in the country. Telephone calls in parts of Miami, Dallas, San Francisco, and Long Island, New York, to name the four that the phreaks had discovered, could all be eavesdropped upon this way. As scary as this sort of security hole seems, the phone phreaks viewed verification access primarily as a harmless prank, the sort of thing you might do to your pal as a joke.
Or maybe for bragging rights. So believe it or not using verification to eavesdrop on a telephone conversation wasn’t the little-bit-stupid thing that John Draper did that day. No, the little-bit-stupid thing was the telephone number he had chosen to eavesdrop upon. Because 415-552-2155 was the telephone number of the San Francisco field office of the Federal Bureau of Investigation.
It would be a couple of more days before Draper did something really stupid.
Draper lived in California but was visiting New York, hanging out with his buddy Chic Eder. Eder was a burly, forty-five-year-old ex-con whose slightly bulging eyes perched above a bushy mustache and underneath a balding head, surrounded on both sides by long
, straggly hair. Outgoing, friendly, intelligent, and intense, Eder was a dope dealer’s dope dealer, given to introducing himself to strangers with a handshake and the phrase, “Chic’s the name, smoke’s my game.” An acquaintance of the stand-up comic Lenny Bruce—“It was my best friend in LA who sold Lenny the smack he OD’ed on,” Eder is said to have claimed—Eder had become a staple of the New York City drug scene: friends with everybody he met, unafraid to wander into the toughest neighborhoods, sure that he could take care of himself in any situation. This confidence came from hard-won experience. Eder was like a one-man crime wave, one whose rap sheet spanned almost ten pages. It went as far back as 1950 and detailed offenses such as fraud, reckless driving, vagrancy, possession of a concealed weapon, possession of narcotics, burglary . . . the list went on. Eder had spent years behind bars in some very tough places. His most recent legal woes stemmed from his involvement in the firebombing of a police station in Santa Barbara, California, an act that appeared to be connected to the Weather Underground organization, a political offshoot of the New Left dedicated to the violent overthrow of the United States. In 1971 Eder was convicted of possession of marijuana and a firebomb and sentenced to spend up to fifteen years enjoying the hospitality of the California state prison system.
It was hospitality he apparently didn’t care for. Eder busted out of prison in late 1972, only to be apprehended six months later. Yet somehow, despite a lengthy original sentence and subsequent prison escape, he was granted parole and released just a year and a half later. He moved to New York City where he began working with his friend Albert Goldman, a professor and writer, helping research an article on the dope-dealing trade. Eder’s contribution to the effort included buying and selling drugs in New York’s roughest neighborhoods.
Draper had already told Eder about phone hacking—free calls and the various colored boxes that phone phreaks used. This was, after all, four years after the Esquire article and it’s not like this stuff was that much of a secret anymore. Besides, keeping quiet was never one of John Draper’s strengths. It wasn’t too long before Draper was telling Eder about his eavesdropping on the FBI.
And that was the really stupid thing. Because Chic Eder was an informant for the feds. Eder’s career as an informant began with a letter to the FBI, written just three months after being back in the clink from his earlier prison break. “Dear Agent in Charge,” the letter read. “You want Weather Underground fugitives. I want a parole, and some money to start a new life. Interested?! As you’re aware, I can deliver. There will be, however, certain stipulations that are non-negotiable. The prime requisite—above even the parole and money—is that you agree to take no action that might bring suspicion to bear on me as an informant.” Toward the end of the letter Eder reflected, “This is no snap decision on my part. It’s taken a great deal of cold, hard thinking to bring me to a point 180 degrees from my previous position on informing.”
It is said that no good news comes between midnight and six a.m.
True to this maxim, the FBI’s first inkling that its calls were being wiretapped came at 2:01 a.m. on June 24, 1975, in the form of an urgent teletype message from its New York office. The five-page message, wordy by FBI standards, was marked confidential and was encrypted for added security. It described Draper’s use of a blue box to wiretap the San Francisco office, gave a quick sketch of Draper’s background, and described “‘phone freaks,’ an underground clandestine group involved in making ‘blue boxes.’” It requested FBI headquarters to authorize funds so that Eder could travel to California with Draper and purchase a blue box from him “in order to determine the degree of technology developed by ‘phone freaks.’” Finally, it asked the San Francisco office to survey its employees to see if any of them remembered making a telephone call like the one Eder claimed Draper intercepted.
The FBI reacted the same way many large organizations react to surprising and unwelcome news: with disbelief. Informants make crazy claims all the time. This was probably just another one. The sort of thing you’re duty bound to check out but nothing to get too excited about.
San Francisco responded that there was little point in asking its employees if any of them remembered making such a call unless the informant could be “pinned down” as to specifics. Perhaps headquarters could check with the FBI Laboratory to see if anyone there knew anything about these outlandish claims.
San Francisco asked friends at Pacific Telephone if they knew anything about this. Was it even possible that some guy in New York could remotely wiretap the San Francisco FBI office? Pacific Telephone told them that this was all nonsense. According to the phone company the only automatic telephone monitoring equipment in northern California was in Stinson Beach, Inverness, and Point Reyes, beautiful rural towns north of San Francisco but far away from the FBI’s offices. Though it might conceivably be possible that calls in those small towns could be vulnerable, Pacific Telephone said, firmly, “San Francisco is not serviced by this equipment and calls cannot be monitored” by the procedure Eder claimed Draper had used.
An anonymous source familiar with the investigation summarized it this way: “An informant contacts us and tells us, ‘This guy Draper is bugging your calls.’ Our Laboratory Division knows nothing about it and people in AT&T and Pacific Telephone basically say it’s not possible, just can’t be done.” Shrug.
Disbelief notwithstanding, FBI headquarters authorized its New York office to pay for Eder’s round-trip airfare to California (“coach,” the FBI memo noted) to buy a blue box from Draper. The FBI also felt it needed to inform other governmental organizations of the problem. A July 2, 1975, memo classified secret and titled “Alleged Interception of Telephone Call of Federal Bureau of Investigation Field Office” was dispatched to several agencies, including the U.S. Department of Justice and the Secret Service.
This is to inform that an investigation is currently being conducted concerning an allegation that an interception of communication took place on a telephonic communication in a field office of the Federal Bureau of Investigation (FBI). Information has been received that the device used, described to be a sophisticated “blue box,” can not only intercept FBI telephone calls but [one sentence redacted] and calls made on the White House “hotline.”
Investigation is continuing to obtain this device for examination by our FBI laboratory so that determination may be made as to the capability of the device.
You will be apprised of developments in this matter.
News of such developments would have to wait for the FBI’s informant to turn up something more. Fortunately for the FBI, Chic Eder was a varsity player; he was good as a drug dealer, he was good as a hustler, and he was good as an informant. On July 13, he did as his masters bade him: he bought a blue box from Draper. Actually, blue boxes being works of art back in those days, he commissioned the creation of one; it would be ready for pickup in a few weeks. In the meantime, he got Draper again to demonstrate how to eavesdrop on the FBI’s San Francisco field office. This time Eder made sure to get details of the conversation they eavesdropped on.
This time, in fact, he got it all on tape.
Now it’s one thing to have an informant tell you something fantastic. Oh, you know, some hippie guy from California with an electronic box can somehow magically tap the FBI’s phone calls from New York, two thousand miles away. But it is a different thing to have an informant provide detailed information that can be checked against reality. It is all the more unusual when the informant can back it all up with a tape recording.
“All hell broke loose,” recalls an anonymous source familiar with the investigation. “AT&T and Pacific Telephone said it wasn’t possible. But here’s a tape recording of it happening.”
“Headquarters wanted this case solved, fast,” the source remembers. “In thirty years, it’s the most freedom I’ve ever seen special agents given in a case. All they had to do was sneeze and say, ‘
I need a Lincoln Continental’ and there would be one parked out in front of the building. Headquarters wanted it solved, whatever it would take, and there were no questions asked. Whatever it will take to nail this guy and see to it that it doesn’t happen again.”
Why the urgency? “The implications from a national security viewpoint, when you consider the consulates that were there in San Francisco, law enforcement, DEA . . . the opportunities were limitless [for wiretapping]. And it could be done from any telephone, anywhere in the country. It became rather evident that if this technology fell into the wrong hands, well, the implications were tremendous.”
The freedom of action may have been a pleasant change for the FBI agents but it came at a price. The agents working the case were now under the gun on a case that headquarters wanted results on, today. “You figure this out! Solve this! Figure out what he did, how he did it, who else was involved, who else did he intercept!” is how the source recalls the orders from HQ.
A few days later, on July 18, Los Angeles FBI agents worked with Walter Schmidt—the same General Telephone security officer who had been instrumental in Draper’s arrest in 1972—to see if they could duplicate Draper’s technique for wiretapping calls with a blue box. They succeeded. According to a teletype from the Los Angeles FBI office, the group “was able to intercept numerous telephone calls in progress of the San Francisco office [. . .] through utilization of a conventional blue box.” As if it wasn’t bad enough that the FBI’s phone calls could be intercepted at all, the word “conventional” here was particularly chilling. It meant that the box Eder obtained from Draper wasn’t “sophisticated” or anything special. In other words, anyone who owned a blue box was able to eavesdrop on San Francisco FBI telephone calls, as well as calls in other parts of the San Francisco Bay Area. All that was needed was the magic code “127” and the telephone number that was to be intercepted.
Exploding the Phone : The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell (9780802193759) Page 28