$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$                                     $
$    Electronic Toll Fraud Devices    $
$                                     $
$        Typed And Uploaded By:       $
$                                     $
$$$$$$$$$$$$-=>Lex Luthor<=-$$$$$$$$$$$


   This phile is designed to identify various kinds of ETF (Electronic Toll 
Fraud) devices and to describe their operation, according to a booklet put out 
by Bell entitled: "The Investigation And Prosecution Of Electronic Toll Fraud 
Devices". (For Official Use Only).

   There are several different types of electronics equipment which may be 
generally classified as ETF devices. The most significant is the "Blue Box". 
The characteristics are discussed below.

-=-=-=-=-=-=-=-=
= The Blue Box -
-=-=-=-=-=-=-=-=

   The "Blue Box" was so named because of the color of the first one found.  
The design and hardware used in the Blue Box is fairly sophisticated, and it's 
size varies from a large piece of apparatus to a miniaturized unit that is 
approximately the size of a "King Size" pack of cigarettes.

   The Blue Box contains 12 or 13 buttons or switches that emite multi-
frequency tones characteristic of the tones used in the normal operation of 
the telephone toll (Long Distance) switching network. The Blue Box enables 
it's user to originate fraudulent ("Free") toll calls by circumventing toll 
billing equipment. The Blue Box may be directly connected to a phone line, or 
it may be acoustically coupled to a telephone handset by placing the Blue 
Box's speaker next to the transmitter or the telephone handset. The operation 
of a Blue Box will be discussed in more detail below.

   To understand the nature of a fraudulent Blue Box call, it is nescessary  
to understand the basic operation of the Direct Distance Dailing (DDD) 
telephone network. When a DDD call is properly originated, the calling number 
is identified as an integral part of establishing the connection. This may be 
done either automatically, or in some cases, by an operator asking the calling 
party for his telephone number. This information in entered on a tape in the 
Automatic Message Accounting (AMA) office. This tape also contains the number 
assigned to the trunk line over which the call is to be sent. The information 
relating to the call contained on the tape includes: Called Number 
Indentification, Time of origination of call, and information that the called 
number answered the call. The time of disconnect at the end of the call is 
also reforded.

   Although the tape contains info with respect to many different calls, the 
various data entries with respect to a single call are eventually correlated 
to provide billing info for use by your Bell's Accounting Department. 

   The typical Blue Box user usually dials a number that will route the call 
into the telephone network without charge. For example, the user will very 
often call a well-known inwats (Toll-Free) customer's number. The Blue Box 
user, after gaining this access to the network and, in effect, "Seizing" 
control and complete dominion over the line, operates a key on the Blue Box 
which emits a 2600 Hertz (Cycles Per Second) tone. This tone causes the 
switching equipment to release the connection to the inwats customer's line. 
The 2600 Hz tone is a signal that the calling party has hung up. The Blue Box 
simulates this condition. However, in fact the local trunk on the calling 
party's end is still connected to the toll network. The Blue Box user now 
operates the "KP" (Key Pulse) key on the Blue Box to notify the toll switching 
equipment that switching signals are about to be emitted. The user then pushes 
the "Number" buttons on the Blue Box corresponding to the telephone # being 
called. After doing so, He/She operates the "ST" (Start) key to indicate to 
the switching equipment that signalling is complete. If the call is complete, 
only the portion of the original call prior to the mission of 2600 Hz tone is 
recorded on the AMA Tape. The tones emitted by the Blue Box are not recorded 
on the AMA Tape. Therefore, because the original call to the Inwats # is toll-
free, no billing is rendered in connection with the call.

   Although the above is a description of a typical Blue Box operation using a 
command method of entry into the network, the operation of a Blue Box may vary 
in any one or all of the following respects:

A: The Blue Box may include a rotary dial to apply the 2600 Hz tone and the 
   switching signals. This type of Blue Box is called a "Dial Pulser" or 
   "Rotary SF" Blue Box. 
B: Entrance into the DDD Toll Network may be effected by a pretext call to any 
   other toll-free # such as Universal Directory Assistance (555-1212) or any 
   # in the Inwats Network, either inter-state or intra-state, working or non-
   working.
C: Entrance into the DDD Toll Network may also be in the form of "Short Haul" 
   calling. A "Short Haul" call is a call to any # which will result in a 
   lesser amount  of toll charges than charges for the call to be completed by 
   the Blue Box. For example, a call to Birmingham from Atlanta may cost $.80 
   for the first 3 minutes while a call from Atlanta to Los Angeles is $1.85 
   for 3 minutes. Thus, a short haul, 3-minute call to Birmingham from 
   Atlanta, switched by use of a Blue Box to Los Angeles, would result in a 
   net fraud of $1.05 for a 3 minute call.
D: A Blue Box may be wired into the telephone line acoustically coupled by 
   placing the speaker of the Blue box near the transmitter of the phone 
   handset. The Blue Box may even be built inside a regular touch-tone phone, 
   using the phone's pushbuttons for the Blue Box's signalling tones.
E: A magnetic tape recording may be used to record the Blue Box tones 
   representative of specific phone #'s. Such a tape recording could be used 
   in lieu if a Blue Box to fraudulently place calls to the phone #'s recorded 
   on the magnetic tape. 

  All Blue Boxes, except "Dial Pulse" or "Rotary SF" Blue Boxes, must have 
the following 4 common operating capabilities:

A: It must have signalling capability in the form of a 2600 Hz tone. This tone 
   is used by the toll network to indicate, either by it's presence or it's 
   absence, an "On Hook" (Idle) or "Off Hook" (Busy) condition of the trunk.
B: The Blue box must have a "KP" tone that unlocks or readies the multi-
   frequency reciever at the called end to recieve the tones corresponding to 
   the called phone #. 
C: The typical Blue Box must be able to emit MF tones which are used to 
   transmit phone #'s over the toll network. Each digit of a phone # is 
   represented by a combination of 2 tones. For example, the digit 2 is 
   transmitted by a combination of 700 Hz and 1100 Hz.
D: The Blue Box must have an "ST" key which consists of a combination of 2 
   tones that tell the equipment at the called end that all digits have been 
   sent and that the equipment should start switching the call to the called 
   nunber.

   The "Dial Pulser" or "Rotary SF" Blue Box requires only a dial with a 
signalling capability to produce a 2600 Hz tone. 


-=-=-=-=-=-=-=-=-
= The Black Box =
-=-=-=-=-=-=-=-=-

   This ETF device is so-named because of the color of the first one found. 
It varies in size and usually has one or two switches or buttons.

   Attached to the telephone line of a called party, the Black Box provides  
toll-free calling *TO* that party's line. A Black Box user informs other 
persons beforehand that they will not be charged for any call placed to him. 
The user then operates the device causing a "Non-Charged" condition ("No 
Answer" or "Disconnect") to be recorded on the telephone company's billing 
equipment. A Black Box is relatively simple to construct and much less 
sophisticated than a Blue Box.


-=-=-=-=-=-=-=-=-=
= The Cheese Box -
-=-=-=-=-=-=-=-=-=

   This device is so-named for the container in which the first one was 
found. It's designed may be crude or very sophisticated. It's size varies; one 
was found the size of a half-dollar.

   A Cheese Box is used most often by bookmakers or better to place wagers 
without detection from a remote location. The device inter-connects 2 phone 
lines, each having different #'s. But each terminating at the same location. 
In effect, there are 2 phones at the same location which are linked together 
through a Cheese Box. It is usually found in an unoccupied apartment connected 
to a phone jack or connecting block. The bookmaker, at some remote location, 
dials one of the numbers and stays on the line. Various bettors dial the other 
number but are automatically connected with the bookmaker by means of the 
Cheese Box interconnection. If, in addition to a Cheese Box, a Black Box is 
included in the arrangement, the combined equipment would permit toll-free 
calling on either line to the other line. If a police raid were conducted at 
the terminating point of conversations - the location of the Cheese Box - 
there would be no evidence of gambling activity. This device is sometimes 
difficult to identify. Law Enforcement officials have been advised that when 
unusual devices are found associated with telephone connections the phone 
company security representatives should be contacted to assist in 
indentification. (This probably would be good for a BBS, especially with the 
Black Box set up. And if you ever decided to take the board down, you wouldn't 
have to change your phone #. It also makes it so you yourself cannot be 
traced. I am not sure about calling out from one though.


-=-=-=-=-=-=-=-
= The Red Box =
-=-=-=-=-=-=-=-

   This device is coupled acoustically to the handset transmitter of a single-
slot coin telephone. The device emits signals indentical to those tones 
emitted when coins are deposited. Thus, local or toll calls may be placed 
without the actual deposit of coins.
