Exploding the Phone : The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell (9780802193759)

by Lapsley, Phil

  The Los Angeles office requested additional pieces of silver for Eder: “Los Angeles believes [Eder] has performed a valuable service for the Bureau and accordingly should be compensated,” agents wrote, describing Eder’s work as “outstanding.”

  Eder met with his FBI handlers in San Francisco a few days later, on July 21, and turned over the blue box he’d purchased from Draper. He reported that “the phone freak underground has the capability of monitoring calls throughout the country” by using the verification technique.

  Eder further reported, “The phone freak underground currently is not selling information obtained from the intercept technique.” An FBI memo continued, “[Eder] does not know how widespread the phone freak underground is or who the contacts, if any, are with the telephone companies or the affiliates there. [. . .] As a source of income, the underground is manufacturing and selling ‘red boxes’ in large quantities. These boxes duplicate the tones generated by coins deposited in pay telephones. Through the use of ‘red boxes’ an individual is able to make long distance call[s] without depositing money. These boxes cost the underground $6 or $7 to manufacture and are currently retailing on the street at $100. All money obtained from the sale of red boxes is going towards purchase of technical equipment for further research.”

  Swell. Just swell. A shadowy underground organization made up of technical wizards—wizards who might have spies within the phone company—can monitor your calls from anywhere and who might, if they chose, sell the results of their wiretapping to the highest bidder. And who might that bidder be? The Yippies? The mob? The Russians? Who knows?

  San Francisco FBI agents contacted Assistant U.S. Attorney F. Steele Langford to discuss prosecuting Draper for wiretapping. The meeting didn’t go well for the G-men. Langford thought there was “insufficient information to consider any action against Draper and that the identity of the ‘blue box’ manufacturer [was] still unknown.” He kicked things upstairs, saying he would defer his opinion on the matter to his bosses in the Department of Justice in Washington.

  Part of Langford’s reluctance probably stemmed from the fact that the government’s star witness in the matter, Chic Eder, was an informant in several different cases. Nobody wanted to put Eder on the stand since it would blow his cover and compromise other investigations.

  Meanwhile, Bill Harward, head of the Radio Engineering Section of the FBI lab in Washington, D.C., had been working with Ken Hopper at Bell Laboratories to see if they, too, could duplicate Draper’s wiretapping technique. As with Walter Schmidt at General Telephone in California, they found it worked like a charm—at least for intercepting phones in the San Francisco Bay Area—and could be done from the East and West Coasts. It was unclear if this problem existed in places other than San Francisco. Harward reported in a memo that Hopper was “most anxious that this condition be corrected as soon as possible and has stated that Bell resources will be made fully available on the authority of the highest level of management.” Harward suggested that the FBI make a formal request to AT&T to assess the vulnerability of the telephone network in other parts of the country and to explain exactly what steps were being taken to fix the problem. In addition, he recommended that every FBI field office be alerted via teletype that phone calls to all offices could be wiretapped and that they should be “extremely cautious in use of the telephone.”

  As a result of Harward’s memo, on July 23, Clarence M. Kelley, the director of the FBI, penned a note to John D. deButts, chairman of the board of AT&T.

  Dear Mr. deButts:

  I am advised that information just developed and confirmed discloses a condition which permits any knowledgeable person using a blue box to intercept and monitor telephone conversations to and from the San Francisco FBI Office, and other subscribers in that area.

  This is a most alarming situation and I request the full cooperation of your organization and its resources to assess the possibility for similar conditions elsewhere and to take immediate corrective action wherever they exist.

  It is requested that, for the purpose of this effort, liaison with the FBI Laboratory, Washington, D. C., be established in order that I may be kept advised of pertinent results.

  The next day the FBI lab director Jay Cochran received a telephone call from Joe Doherty, AT&T’s director of corporate security. Doherty said that AT&T was aware of the problem, that it was now fixed in San Francisco, and that instructions had gone out to remove the capability from any AT&T facilities where it still existed. In a memo to his bosses at the FBI Cochran noted, in his best passive-voice Bureauspeak, “It is pointed out that we have received prior assurances from AT&T that procedures such as discovered [in this case] are not possible. It is also pointed out that the condition developed in this case was developed by FBI investigation and not from any information furnished by the telephone company. [. . .] In view of the past record of AT&T in this area, we feel a stronger, more positive position, must be taken in the absence of any constructive offering from [AT&T].” Cochran later described Doherty’s attitude during this call as “rather ‘ho-hum’ and appeared calculated to downplay the gravity of the situation.”

  The FBI informally approached the President’s Foreign Intelligence Advisory Board to let its members know of the problem. A PFIAB representative said that they “would undoubtedly be sympathetic with any strong initiatives that the FBI might take . . . to insure the security of communications.”

  Meanwhile another issue came up. Chic Eder needed to get his blue box back from the FBI so he could maintain credibility with Draper. (You can imagine the conversation: “Hey, Chic, where’s that box I made for you?” “Oh, uh, sorry, John, I’m sure it’s around here somewhere . . . oh, that’s right, I loaned it to some friends at the FBI! Um, no, I mean, uh. Crap.”) A small blizzard of memos bounced back and forth among those in the FBI lab, the Legal Division, HQ, and various field offices to figure out how to handle the situation. Do we really want to give the bad guys back a piece of equipment that they can use to tap our phones? But wait a minute, the bad guys made the equipment in the first place. If we don’t give it back they’ll just make another one. And besides, Eder is our informant, he’s not a bad guy. But Eder has friends who might borrow it who are bad guys. Plus, wasn’t it used in the commission of a crime? Isn’t it evidence at this point? How would we maintain evidence chain of custody if we give it back?

  This dilemma continued until late August 1975 when FBI agents again met with U.S. Attorney Langford in San Francisco. Per instructions from FBI HQ they explained that Eder was “a most valuable informant to the FBI who will not testify” in any legal proceedings but that they wanted to get the blue box back to him so they could continue their efforts to “penetrate the under­ground phone phreaks.” Langford stated that, as there were no witnesses—or at least none willing to testify—there could be no prosecution. Therefore FBI could dispose of the blue box or any other evidence as it saw fit, so long as the recipient didn’t use it.

  No prosecution. Really? Draper can wiretap the FBI and just get away with it?

  Up the chain of command went the word that the U.S. attorney wasn’t going to prosecute. Down came word from the Department of Justice: “Departmental Attorney Kline, after reviewing the matter, desired to know whether any of the telephone companies involved are actively pursuing investigation . . . in order to establish Fraud by Wire investigations.” In other words, remember how we got Al Capone for tax evasion when we couldn’t get him for murder? If we can’t get Draper for wiretapping us, maybe we can take him down for making free phone calls. Let’s see if the phone companies don’t have something on him in that regard.

  The answer was no. Pacific Telephone’s security office in Los Angeles said the company was “vitally interested” in determining whether Draper was phreaking, but until Draper moved to Los Angeles and started to phreak there would be no investigating him. General Telephone’s security
office in Los Angeles said much the same. New York Telephone’s security office said its investigators followed Draper’s activities by reading the TAP newsletter but “did not have him under investigation on specific fraud by wire charges.” And Pacific Telephone’s San Jose security office—the office in charge of security in the area where Draper actually lived—simply said that it was “not taking any further investigative action” toward him.

  AT&T claimed it had fixed the problem, the star witness wouldn’t testify, the U.S. attorney had declined prosecution, and not even the phone company was following up on things. A month passed. Somebody at the Justice Department poked someone at FBI HQ. You-know-what rolled downhill, toward San Francisco, Los Angeles, and New York, on November 17, 1975.

  For the information of receiving offices, the [Justice] Department continues to maintain an interest in this matter.

  San Francisco should timely submit letterhead memoranda, by cover airtel, reporting results of efforts to penetrate “under­ground phone freaks” pursuant to instructions set forth in referenced Bureau air telegram, 9/18/1975. These communications should [. . .] relate exclusively to investigation regarding penetration of “phone freaks.”

  Consideration should be given to potential prosecution for violations of Fraud by Wire Statutes should this become apparent.

  The change in strategy was now official. The focus of the investigation was now on penetrating the underground phone phreaks and getting Fraud by Wire prosecutions. The wiretapping business might have started it but that wasn’t how it was going to end.

  Eighteen

  Snitch

  PHONE PHREAKS LIVE to solve puzzles. They spend time observing, gathering data, thinking, and inventing theories about how things fit together. They think up experiments—things they can try—to solve whatever puzzle they’re working on. They get a little dopamine hit when they get it figured out. And that dopamine hit is the kick that causes them to rinse and repeat.

  What’s funny is that you can replace the phrase “phone phreak” with “FBI agent” or “telephone company security officer” in the preceding paragraph and it would be just as true. Figuring out a new phone hack, catching a bad guy: same same, at least as far as the brain’s neurotransmitter receptors are concerned.

  Phone phreak or cop, most of the observing, data gathering, and experimenting that either one does is a long, tedious process of running down leads—the 99 percent perspiration that made Thomas Edison a wealthy man.

  Other times, though, you get lucky and something drops into your lap that cracks things wide open. If you’re a phone phreak, this might be a purloined manual that tells you something of how the telephone network works, or perhaps an anonymous voice on a long-distance loop-around circuit who tells you how to do something you had been trying to figure out for months.

  For the FBI and Pacific Telephone and their case against John Draper, that lucky break would turn out to be a young phone phreak from Los Angeles.

  Wayne Perrin was a Pacific Telephone lifer. That wasn’t his plan, it just happened that way. Perrin was a big man, almost six-foot-two and 220 pounds, but he came across as affable and friendly rather than imposing; perhaps his sandy reddish hair, hazel eyes, and easygoing manner helped with this. Perrin had wanted to be a cop, and while waiting for a job with the local police force in 1965 he took a temporary gig with the phone company as a lineman, climbing telephone poles and such. He was good at it and was quickly promoted. He stayed with the phone company and also worked as a reserve police officer for the city of Alhambra, just east of Los Angeles. Then, in 1971 at the age of twenty-nine, opportunity knocked. There was an opening in the telephone company’s chief special agent’s office in Pasadena. Perrin became a telephone cop.

  Along with the other telephone cops in that office, Perrin was responsible for investigating security problems for the phone company in the greater Los Angeles area. Very few of these investigations had anything to do with phone phreaks or electronic toll fraud. More often it was pay phone or office burglaries, petty cash theft, vandalism, or dealing with a traffic accident involving a company vehicle, pretty much the same stuff that security people at all large companies handle.

  The latter half of 1975 has been unusually busy. In just six months Pacific Telephone’s Los Angeles area had been caught up in a vortex of telephone crime. But it wasn’t just that it was unusually busy, it was that the crimes were just plain weird. Someone had figured out a way to hack the 611 repair service phone number to make free phone calls all over the world. Meanwhile, telephone company truck yards were being burglarized, and the things being stolen were items such as telephone company hard hats, tools, and “test sets”—the odd-looking telephones with alligator clips that telephone company repair people always have on their tool belts.

  “We didn’t have a clue. No clue,” Perrin recalls. “We had all these little cases. You knew they were related in a fashion but you couldn’t tie them. . . . We had trucks being broken into, we had Dumpster diving, the Valley was just rife with petty thievery. Test sets were taken. Books were taken. Manuals were taken. Wire is taken. Nothing of great value, but they would go in and take this stuff. So you’re looking at this trying to figure it out.” And not getting anywhere.

  Then there were the really strange cases, the ones that made no sense at all. Like the $21,000 worth of telephone calls that had been fraudulently charged to one Dr. Bosley in what appeared to be a giant, multistate, nineteen-hour-long conference call over the course of a weekend. Or the late-night telephone calls to telephone company employees in Pacific Telephone’s Simi Valley and Panorama City offices, a creepy mixture of obscene, stalkative calls to operators peppered with threats of physical violence and bomb blasts. Strangest of all, some of the bomb threats were then followed by calls to law enforcement by someone pretending to be a telephone company security officer investigating the ­matter—or, in some cases, the reverse: calls would be made to the telephone company security office by someone pretending to be a law enforcement officer.

  All this left Perrin scratching his head. Who would do this, and why?

  Whoever was doing this was calling telephone operators to make these threats simply by dialing 0. You would think that when you call a telephone operator, the operator would have your telephone number. You’d think that the operators would be able to look up Mr. Harassing Caller and hand all of his info directly to security and then Perrin and Company could swoop down on this guy. Problem solved.

  Sounds great in theory but in practice it didn’t seem to work that way, at least not in 1975 in certain parts of Los Angeles, and at least not with this caller. The one clue they had—that their harassing caller would sometimes identify himself as “Robert P. Norden”—didn’t seem to be as helpful as you might think. They didn’t seem to be able to find any service records under that name.

  On November 19, 1975, at 3:55 a.m., “Norden” called the Panorama City office. This time the phone company held his line. When your line is held it means that you can’t hang up. Or, more accurately, you can hang up but it won’t disconnect your call. When you pick the phone back up, instead of getting a dial tone you’re still connected to the person you called or you get no dial tone at all.

  This is a very disconcerting thing, and if you’re a telephone prankster it’s like a creepy phone call in reverse. Imagine yourself making a late-night harassing phone call, thinking you’re powerful and anonymous and king of the world, and then finding that your phone has inexplicably turned on you. You can’t hang up. No matter what you do you’re stuck. Your intended victim has you by the tail and won’t let go.

  His line was held for hours and hours. Eventually he got up the nerve to go to another phone and call the telephone company to find out what was going on. He ended up speaking with Perrin’s security colleague Bill Cheney and demanded to know why his line was being held. Cheney gave his best telephon
ic shrug and told him that probably there was trouble on his phone line and perhaps he should call his local repair service. As soon as he hung up Cheney called the test board supervisor and explained the situation. As expected, “Norden” called repair service. He was told that his line was being checked for trouble.

  Meanwhile the phone company was feverishly trying to find out whose phone line it was holding. Normally this would be simple. Back in those days every phone line coming into a central office had a “line card,” a three by five–inch note card that had on it all the information about the telephone line—information like whose line it was, for example. But his line card was missing. It wasn’t in the 611 repair bureau file where it should have been. The next logical place would be the telephone company business office, but that didn’t open until later in the morning. And once it opened, employees there said they didn’t have it either.

  The phone company finally released his line that afternoon, almost twelve hours later. “No one could find any records,” Perrin says. As it turned out, a business office representative named Angie had the line card in her desk. “She was having other problems with that guy, so she had locked it up. So we couldn’t find anything about it until Angie actually got into the office. Had they had the line card we would have had him right away.”

  One thing you may have noticed by now about phone phreaks is that they’re obsessive. True to form, that night he again called the Panorama City office, this time to complain about his line being held the night before. But this time Perrin was ready and had arranged for a trap on the line that would allow him to trace the call. Finally, he had an address and telephone number for this mystery caller.