DBS Hacker Update as of 11/28/95

The Canadian group has released their fix for the DSS system. Their chief engineer is said to be Dectec's former head engineer. The fix will be marketed from Canada and Mexico, and underground in the U.S.

The fix is a paddleboard which fits into the cardslot. It uses two microprocessors including a Dallas 5002 and an Atmel with Fastram. There is also a 256k ram chip with a lithium battery backup. In order to receive Pay-Per-View programming the EEPROM in the receiver must be reprogrammed with a new ID.

According to informed sources, the first-run paddleboards suffer from a 30% failure rate. In addition, they are extremely sensitive to static electricity. If zapped, they cannot be reprogrammed.

The developers are grabbing every penny they can on this fix. The wholesale cost to dealers purchasing in quantities is $400 each so retail will likely be $600-$700. This is the cost of one year's programming and it is longer than the fix will last. Opening the DSS receiver will also void any warranty.

There is another, more elegant smartcard fix which is not yet on the market. Someone placed an anonymized ad in rec.video.satellite.dbs recently that they have hundreds of pirate smartcards for sale. It is possible that someone obtained a supply of blank cards and programmed them but it is unlikely they would be sold openly through the internet.Thousands could very easily be sold quietly through the satellite underground, without fanfare.

Subscribers to our newsletter ($29.95 for 12 issues) will receive more information by mail next week. (12/4/95). It will include important information on the Cyber 1 fix for the VCII PLUS. One of the individuals now distributing the paddleboard fix is one of the individuals who was charged and convicted in the U.S. Customs sting of 1993. That sting involved a fix for the Videocipher II PLUS satellite system. We have included the article we did on that sting. It may be of interest to some of you, and it will provide you with an inside account of how the satellite piracy business works.Our article was prepared from court documents and interviews with the participants. All those charged were convicted.

The sting started in the spring of 1993 and culminated at the SBCA trade show for satellite dealers on September 7, 1993. Here is what happened.

With impeccable timing, the U.S.Customs Service executed a sting on several of the largest suppliers of satellite television modifications in the country. Most dealers got their first news of it through a message by Ron Mac Donald, on his Canadian BBS. The message quickly spread across North America, with many individuals changing the name on the header to their own. Here is the text:

Msg#:19752 *News*
09-08-93 22:30:23 (Read 40 Times)
From: RON MACDONALD
To: ALL
Subj: FBI & GI STING

Well it seems that the FBI and the U.S. Customs department in conjunction with GI have pulled off a MAJOR sting operation in New Orleans yesterday. By now everybody has heard of the so-called VCII Plus clone fix that has been shown around in the states.

The story starts 6 months ago and I will try to set out the players in order of appearance.Everybody has asked for a VCII plus fix - when will it be released? A new member on this BBS using the name Gerald ?XXXX kept bugging me about a rumour he was hearing and trying to chase down. I kept saying it is too hard and too expensive to develop. But lo and behold, 2 weeks ago, he called me and said he found the guys with the VCII PLUS clone fix and he was now representing them and was marketing it for the developers. The developers wanted to keep their names out of the picture completely.

We were told that Gerald's associate "Richard Collins" would be in touch with us to do a demostration of the product. Arrangements were made for "Richard" to meet us in Canada just across from the border of Buffalo. But at the last minute Richard called and said he wouldn't cross the border with the VCII units and we have to go to the states for the demo. We complied and went to see the device. Sure enough, he had a MASTER unit and three clones of that ID number.

All three were tested seemed to be identical. The three cloned units had a soft epoxy on them and we were told that the parts under the epoxy could be bought at Radio Shack for the simple mods.

One of the cloned units was picked at random, put on line and called in for a subscription to be added to the unit. The hit came down within minutes and on came the new subscribed channel. This verified the existence of a cloned unit.

Richard informed us that the price of the technolgy was $50,000.00. They wanted 20 people to put up $50,000.00 each to pay off the developers a total of $1,000,000.00. This fix was to be guaranteed for a year.

A meeting was going to be held in New Orleans on Sept 7 1993 for a demo of the so-called keypuller/reader/writer device. At this meeting we would be taught the full operation of the process and then pay for it and leave with the product. We stalled off on answering their questions about when we would arrive in New Orleans.

Something was fishy! Richard was using the same sales pitch on too many people in the inustry! Feedback was coming in from all over the country! Even from people that I knew, who could not afford the $50,000.00 price tag - why were they attending this so-called hush-hush meeting. Were they playing around with the price tag?

Better off to sit back and let it shake itself out.

Did you ever see that Eyewitness Video episode on how a police department setup a phoney front that bought any hot stuff from crooks. After 3 or 4 months in operation they had a party for all of these "customers" of theirs and then the FBI raided them and hauled them off to jail.

Well I couldn't get that episode out of my mind! I keep thinking - what a major catch for the FBI and GI.A perfect STING operation - 20 or more of the top chippers in the industry, all in one spot at one time! And that is exactly what GI and the FBI and U.S. Customs did!

Now the others players who were involed in setting up the sting:Richard Collins - possible alias: Ted La Fever - U.S Customs agent Gerald XXXXX - New Orleans - hosted the demo ! Dana XXXXXXX - Corning N.Y. - was he busted or was he also selling the fix. aka: Jason Bates

Busted:
Tony- Magna Systems
Jeff C.- Tennennese
Jeff P. - Tennennese
Scottie- S&S Satellite
Kenneth- New York
Theo- Nassau
Robert- Kentucky

According to official sources here is what really happened. This information was obtained exclusively by Scrambling News. Two individuals were arrested in New Orleans on September 7, 1993. They were Jeffery Carr of TN, referred to in Criminal Complaint number 93-223 MAG in the U.S. District Court in the Eastern District of Louisiana, and Douglas Stewart, a Canadian, with a residence in Santa Clara, CA, and referred to in Criminal Complaint 93-221 MAG. Both cases resulted from the work done by an undercover officer employed as a Special Agent of the U.S. Customs Service.

In the case of Douglas Stewart: On August 3, 1992 a counterfeit Videocipher II descrambler module, a device used primarily for the unlawful interception of encrypted satellite cable programming was ordered from Troy Stewart. The module arrived but had to be returned due to defects. On August 28 a replacement module arrived. The module is commonly known as a Sunboard (a counterfeit Videocipher II module). The module successfully descrambled encrypted programming on satellite G5, without paying for the services. General Instrument Corporation analyzed the module and found that it successfully descrambled services without paying for them.

On or about October 7, 1992 Troy Stewart telephonically introduced the undercover officer to his father Douglas Stewart. Then on October 29 the agent contacted Douglas Stewart and told him that he was interested in purchasing Sun board descramblers. During that undercover contact the officer told Stewart that they must be careful about the authorities and he asked Stewart how he gets descramblers into the United States. Stewart told the officer that although it was risky he just drove them past U.S. Customs Inspectors.

On December 1, 1992 the officer telephoned Douglas Stewart at his home in California. During that conversation Stewart agreed to sell to the officer, two modified Videocipher II descrambler modules for $400 each. Stewart instructed the officer to send the money to a California residence.

The officer phoned Douglas Stewart on December 15 concerning the purchase made on December 1. He told Stewart that $800 had been sent via the U.S. Mail. Stewart said that he did not accept U.S. Mail because it was mail fraud. He instructed the officer to have the package containing the funds returned by the U.S. Post Office and requested that the money be sent to an address in Canada.

On or about January 8 the two modified Videocipher II descrambler modules ordered from Douglas Stewart were received. The package had been sent directly from Canada to the officer's undercover address and contained an insufficient or false description of the contents of the package for proper declaration to U.S. Customs.

Between January 8, and February 17, 1993 the officer negotiated from New Orleans with Douglas Stewart for the purchase of 40 additional modified Videocipher modules for a total price of $14,000. Stewart agreed to meet the officer in Blaine WA for the transaction.

On or about February 17, the officer called Douglas Stewart in Canada. Stewart said he was still working on the modules but would meet the officer on February 18, in Blaine. At the February 18 meeting the officer and Stewart discussed how necessary it was to be leery of the F.B.I. Stewart said he had just come from the airport and that he was on the lookout for someone who fit his profile of an F.B.I. agent. He also said that when agents recently raided his son's home in California that they had seized 1500 GP-28 adapters, just like the ones that had been installed on the boards which had been ordered on December 1. Stewart said that the descramblers were at a private mailbox and that he shipped Sun Boards from there on a regular basis.

The officer, accompanied by a female U.S. Customs officer followed Stewart and his business partner Alan Reimer to the private mail box company, located in Blaine WA where Stewart and Reimer loaded the 40 modified descrambler modules into the agents' rental car. They commented that the trunk of the agents' car was larger than that of the rental car they had used to transport the modules.When the officer presented Douglas Stewart with the $14,000 cheque, he expressed concern that the bank would generate an IRS form because the transaction was over $10,000.

In a subsequent phone call the officer adked Alan Reimer about the method of importation of the modules purchased on February 18. He asked how the Customs Inspector did not notice the boxes in the rear of the mini van that he and Stewart were driving that day. Reimer said that they had used another vehicle with a trunk and had been able to drive past U.S. Customs. In later conversations between the officer and Douglas Stewart, Stewart repeatedly expressed concern over being caught by U.S. authorities for being involved in the purchase/sale of modified Videociphers or equipment designed to aid in the modification of Videociphers and that the purchase or sale of this type of merchandise could result in a jail sentence.

On September 7, 1993 the officer again met with Douglas Stewart in New Orleans and during that conversation Stewart admitted that he committed the act of smuggling satellite descrambling devices on or about February 18 and numerous other acts as well. At that time he was arrested by assisting U.S. Customs agents and the undercover officer revealed his true identity. Douglas Stewart was charged under Title 47 United States Code, 605 (e) (4) for unlawfully distributing devices designed primarily for use in the unauthorized interception of satellite cable programming.

In the case of Jeffrey Carr: The undercover officer had made contact with Dana LaFever of Corning, NY. LaFever had told him that he could sell or install VMS devices which enable satellite customers to download cable security codes via a computer modem and telephone line so that they can receive encrypted satrellite cable programming without authorization. LaFever quoted a price of $115 each.

On or about June 2, the officer again contacted LaFever. LaFever said that either he or Bill Hunter, a Canadian who is in the satellite piracy business would sell a host program for $750 which would allow the officer to automatically provide his customers with the codes for the encrypted channels.

In a phone conversation on or about June 9, LaFever said that his tec support program, which will enable customers to receive the code updates would go on line that night. LaFever told the officer that there was a legitimate use for the VMS device but then added that it was necessary to have a gimmick. It was necessary to be able to claim that the device has some legitimate purpose. At that time the officer ordered a host program, one remote program for $900 and ten VC 018 modules with ten VMS devices installed by LaFever for $1950.

On June 17, the officer placed another order for another
host program, remote program and a security device.
LaFever stated at that time that he tries to conduct his
business without paper work.

On July 15, during the S.B.C.A. show the officer met
Dana LaFever at the Fiddler Inn in Nashville. for the
purpose of purchasing more VMS devices. He was
introduced to Jeffrey Carr who works for Video Marketing
Services which manufactures the devices. After Carr left,
LaFever told the officer that Carr does all the programming
and that he had just paid Carr's partner over $30,000 in cash.
LaFever had a sealed box in the room which he said contained
100 VMS devices. The officer purchased 15 of them with
modems for $95 each.

The officer next met with Dana LaFever on August 30, at his
residence in Corning NY in order to purchase more illegal
satellite cable programming descrambling devices and to
demonstrate the latest illegal device, modified Videocipher
II PLUS modules. The officer told LAFever that the devices
were clearly illegal and LaFever acknowledged that he knew
they were. LaFever tested the modules and and had at least
three telephone conversations with Jeffrey Carr. LaFever
initiated the first phone call and Carr returned at least one call
to LaFever. After one of the conversations the officer was
requested to connect two of the descramblers to the same
satellite cable receiving system in order to determine if the
descramblers would receive authorization simultaneously if
only one of the unit addresses was was provided to a legitimate
programmer. LaFever said that if both descramblers allowed
the viewing of scrambled services simultaneously based on a
single unit address then it truly was a clone fix. The officer told
LaFever that an illegal seed key pulling device was in existence
in New Orleans. the officer also said that if LaFever wished to
purchase the device he would have to travel to New Orleans for
a complete demonstration and that the device was for sale for
$50,000.

On or about August 31, Jeffrey Carr phoned the officer and
said that he had been talking with Dana LaFever and that he
was interested in seeing the demonstration of the modified
VCII PLUS modules and possibly purchasing a device being
offered for sale. Carr asked if the agent and his associates
would be interested in mass production of the devices being
offered. The officer responded that he would have to
confer with his associates and said that his associates
expected payment at the demonstration/sale in New Orleans
on September 7. He added that 20 of the devices would be
sold for $50,000 each. and that only 20 were being offered to
avoid being busted. Carr acknowledged that the price was
$50,000 and that the test would be to see if the two clones
could be authorized simultaneously.

On September 7, 1993 at approximately 10 AM, the officer went
to Jeffrey Carr's room at the Oliver Hotel in New
Orleans. and was met by Jeffrey Mayes. Mayes introduced
himself as Carr's partner and he said that Carr was too ill
to see the VCII PLUS module demonstration. The agent
transported Mayes to a location in Kenner, LA and
demonstrated the VCII PLUS cloned boards. He discussed
with Mayes the illegality of the boards and Mayes
acknowledged that he was aware of it. Mayes also admitted
that he was aware that many users of the VMS device used
it primarily for the illegal descrambling of encrypted
satellite transmissions. Shortly after that, Mayes was advised
of the officer's true identity. and that he was in violation of federal
law.

At approximately 2 PM the officer returned to Jeffrey Carr's
room at the Oliver Hotel and offered to demonstrate the VCII
PLUS fix to him. On the way to Kenner, Carr described how he
pulled the seedkeys from several legal descrambling devices.
Carr said that they had recently obtained the seed keys for
Request Pay Per View services.

At the Kenner location the officer demonstrated the VCII
PLUS cloned boards and engaged him in conversation
about the VMS devices. Carr was asked specifically
about the method by which the VMS was being distributed,
whereby distributors sign a disclaimer to absolve Video
Marketing Services of criminal liability. Carr described the
legal use of the VMS and did not acknowledge that he was
aware that his distributors were utilizing the VMS for illegal
purposes. The officer then advised Carr that he
is a U.S. Customs Special Agent investigating the
distribution of devices primarily used for illegal
descrambling purposes.Shortly thereafter, another agent
spoke to Mayes and asked him if Jeffrey Carr was also
aware, as Mayes had just told the undercover agent that
many of the VMS distributors were using the VMS device
for illegal purposes. Mayes said yes.

Later that day the officer interviewed Mayes who said that
he and Carr had been in the business of manufacturing
VMS devices for approximately one year. Mayes was the
hardware designer and Carr was the software designer.
Mayes said that upon startup they had conferred with their
lawyers who had advised them to have their distributors
sign a disclaimer to protect themselves against illegal
utilization. Mayes said that he and Carr had met with all
their distributors to make sure that each one had a
computer capable of running the text data feature of the
VMS device. Mayes said each one was instructed to use
the device for legal purposes only. and to sign a disclaimer
to that effect.

Mayes also said that he and Carr recently came to realize
that Bill Hunter and LeFever were using the VMS devices
for the purpose of illegally descrambling satellite
transmissions. Mayes said that he and Carr continued to
supply them because they were such a large part of the
distribution system. Mayes also said that Carr came to him
recently after having been told by LaFever that the PLUS fix
existed. They wanted Carr to determine if it was real. Mayes
said that Carr got excited about the VCII fix and the possibility
of making a quick million dollars. He said that Hunter and
LeFever would be the actual buyers and that he and Carr
would only receive a kick-back from the sale.

Jeffrey Carr was charged under U.S. Code Title 47, Section 605
(e) (4) and under Title 18, section 371.

The Business

The following is entirely based on guesstimates and is only
intended to provide some order of magnitude.There
are several different modem systems in use, with 10-15,000
users each being typical. The VMS system is the largest,
with an estimated 100,000 users. At a wholesale price of $75
the VMS manufacturing business would have generated
approximately $7.5 million in a little less than a year of
business. [Ed. when S&S was raided in February, authorities
released information that they had done $700,00 in business
the month before they were raided]. Consumers paid an average
$200 for an installed unit for a total of $20 million at retail. In
addition they directly or indirectly have been paying for a BBS
service to download the cable security codes, at roughly $10
per month for a total of $1 million/month. Establishment
sources always calculate the cost of piracy as if each pirate
would pay for services if they weren't being received free but
that is not true. Assuming that each individual would on
average spend $100/yr. on legal programming, then
programmers have lost $10 million in revenue over the
past year.

What was allegedly being offered was a package consisting
of a 3M,3M clone and a 4M with auto- shut-off. That would
provide for three consumer upgrade levels. The qualitative
tests which were allowed to be conducted on the modules
precluded an independent test to determine whether the
three modules had in fact, all been loaded with the same
keys in the first place. According to informed sources, that
is what happened, and GI did not actually demonstrate a
compromise of its PLUS system.

The Charges

We discussed 47 U.S.C. Section 605 with attorney Barry
Teague in the September 1992 issue of Snews. Section
(e)(4) reads as follows:Any person who manufactures,
assembles, modifies, imports,
exports, sells, or distributes any electronic, mechanical
or other device or equipment, knowing or having reason
o know that the device or equipment is primarily of
assistance in the unauthorized decryption of satellite
cable programming or is intended for any other activity
prohibited by subsection (a) shall be fined not more than
$500,000 or imprisioned for more than 5 years for each
violation, or both. For purposes of all penalties and remedies
established for violations of this paragraph, the prohibited
activity established herein as it applies to each such device
shall be deemed a separate violation. (d) for purposes of this
section (1) the term satellite cable programming means video
pro - gramming which is transmitted via satellite and which
is primarily intended for the direct receipt by cable operators
for their retransmission to cable subscribers.The officer in
the affadavit describes the TVRO system used to give the
clone demonstration as a satellite cable receiving system.

Title 18 Section 371 relates to a conspiracy to commit an
offense or to defraud the United States. It reads: If two or
more persons conspire either to commit any offense against
the United States or to defraud the United States, or any
agency thereof in any manner or for any purpose and one or
more of such persons do any act to effect the object of the
conspiracy, each shall be fined not more than $10,000 or
imprisoned not more than five years, or both.

If however, the, the offense, the commission of which is the
object of the conspiracy,is a misdemeanor only, the
punishment of such conspiracy shall not exceed the
maximum punishment provided for such misdemeanor.
In the historical and revision notes for this law it says that
the statute is broad enough in its terms to include any
conspiracy for the purpose of impairing, obstructing or de-
feating any lawful functions of any department of government.

Others Involved

We have not been able to contact all those involved. Others
we spoke to were under instructions by their attorneys not to
comment. Tony at Magna Systems said that he was raided on
the morning of September 7 by approximately twelve U.S.
Customs agents, executing a search warrant. He said they
were looking for any VCII related objects, but found none.
They answered the phone for the 5 or 6 hours they were
there but it was a slow day and there were only about ten
calls. They left with some computer magazines and his
mother's bank records. He was not charged and is still
open for business.

According to sources, the offices of Video Marketing
Services were raided by U.S. Customs agents who were
towing U Haul trailers behind their vehicles. Nothing illegal
was found, though records and samples were taken. The
agent in charge reportedly told them they could continue
with their business. Video Marketing Services is still open
for business.

The Fallout

This action has visibly shaken satellite dealers across the
country, as well as those who assumed they would soon be
selling VCII PLUS products and that their flagging businesses
would return to normal. The ECM's, the upgrades, the on-going
monthly BBS charges, not to mention the danger in repeatedly
calling a phone number which only downloads cable security
codes has more and more dishowners going legal. Earlier this
year authorizations were running at about 35,000/month.
Today they are up to 75,000/month. To make matters worse
the HBO/Cinemax western commercial feeds were shut off
on September 20, the Eastern feeds are scheduled for shutdown
October 20, and Showtime/Movie Channel have announced that
they will discontinue their commercial feeds by the end of October.
First Choice in Canada has also announced that it will discontinue
its use of the VCII commercial data stream by the end of October.
We have not heard of any other services announcing their
abandonment of the VCII commercial data stream so there will
still be many services abvailable, but the loss of virtually all the
most popular services and the lack of a pirate alternative leaves
consumers no option but to go legal. Those now turning legal will
probably not readily return to piracy, considering what it has cost
them over the past eighteen months.

If a PLUS fix is released, it may well be done quietly, without publicity
or fanfare. It is inconceivable that anyone would advertise it in a
magazine any time in the near future. The normal distribution channels
which were targeted in the sting are going to be extra leery even if a
valid product appears.According to official sources this is an on-
going investigation.

The Videocipher II information is only of historical interest, but the
"biz" is the same. In the newsletter we will discuss the desirable
features of a DSS fix. Scrambling News. Voice/FAX 716.874.2088