Group 42-Sells Out! - The Information Archive/Group 42 Sells Out (Group 42) (1996).iso/zines/emptimes/emptime2.txt

Text File | 1995-11-30 | 214KB | 4,634 lines

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %                    T H E   E M P I R E   T I M E S                       %
 %                    -------------------------------                       %
 %                       The True Hacker Magazine                           %
 %                                                                          %
 %  July 10, 1992   Issue II                                                %
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


  Editor in Chief: Albatross                     Co-Editor: {Spot is Open}
  Email:  [e-mail]       Staff:     {Spot is Open}
          [e-mail]


  Dist. Center: The Empire Corporation



=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

#   Phile Description                                 Size  Author or Group
-   ------------------------------------------------  ----  ---------------
1   Introduction                                      1k    Albatross
2   The Grim Reaper and his CBI Story                 10k   The Grim Reaper
3   Why the Secret Service Will Bust You              11k   C.P.S.R
    Instead of the F.B.I.
4   Use The Freedom of Information Act For You        38k   F.O.I.A.
5   Carding in the 90's                               4k    Mustang
6   Specs on Caller ID                                6k    TELECOM
7   Foiling The Cracker                               37k   S.E.I.
8   Phreak Knowledge      {What All Should Know}      8k    Rebel Lion
9   The Beginner's Guide To Hacking On Datapac        73k   The Lost Avenger
10  SummerCon '92  (The Conference)                   7k    Albatross
11  The News .... On the MOD Bust                     10k   {Various News}
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=





                          -=-  The Empire Times  -=-
                        Volume 1, Issue 2, File 1 of 11
                                Introduction



        As Time goes on and on, it seems that The Empire Times are reaching
    a bigger and better field of people, I have noticed myself that the
    level of knowledge has jump 10 fold since the first issue and that was                   small. Well after you finsh this baby I think The world will be in for
    the time of there life....

        The Times Needs writes like mad, so talk to me and I see what
    I can do to give ya a helping hand.  I need Freelance writers and
    dedicated staff members....





       "Don't let anybody stand in your way, Fight till the end,
        Never give in and never let them win, Allways fight Back"













=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

                          -=-  The Empire Times  -=-
                        Volume 1, Issue 2, File 2 of 11
                        The Grim Reaper & His CBI Story


                                                        by
                                                           The Grim Reaper


Well, I am sure you have all heard that I had a small legal problem today,
and I know how stuff gets blown out of proportion, so I thought I'd
explain the story myself.  Here goes...


I have carded a few items in the past 3 days, and I have NEVER done this
before.  The Grim Reaper got CBI accounts and placed orders, and I picked
them up.  Well, one of the places Grim ordered from was Paradise Computers,
they knew it was a bogus order, but told us the package was shipped.  Then
they called the FEDS.  Anyhow, the Feds must have been watching the pickup
spot, then following me around till I met up with Grim to deliver his share
of the stuff.  As soon as we went to make the exchange, the Secret Service,
FBI, state police, and local police were running at us with bulletproof
vests and automatic guns.  They handcuffed us, separated us, and took each
of us back to our homes for them to search.


So I haven't talked to Grim Reaper since I saw him lying next to me on
the ground being arrested.  But here's my story.  About 20 agents came
to my apartment and grabbed all computer equipment without a receipt. So
we still have 1 modem, and this computer system.  Anyhow, they grabbed\
every piece of paper they could find.  Unfortunately, I am a very
organized person, and had "the who's who in the pirate world" written
down for my use.  So if you ever gave me your real name, number, or
address, it is now in the hands of the Secret Service and FBI.  This
list was quite large, as it took 2 years to compile.


These boys did their homework.  They knew Enterprize was USA HQ and they
knew my handle, and they knew I supplied the group with software.  They
weren't going for just anyone here guys, they knew they needed to bust a
group leader.  Well, they did.  Got me on carding, pirating, and a ton of
other legal terms having to do with both of these.


I was charged with 6 different counts, each holding a 5-30 year prison
sentence.  It doesn't look good for me at all.  I'll post a file as
soon as I get arraigned and let you guys know what is going on.


But I will say this now, and I MEAN it.  I love the groups, the software,
and the competition.  But regardless of what happens to me, I am done
forever.  No more NotSoHumble Babe, no more USA.  I hate to do this to
everyone, but I really don't have a choice.  And regardless of who I am
that got busted, be strong and support what you believe in your hearts:
piracy.  Don't let them win.  You guys can all go on without me.  Just
promise me you won't give up and throw in the towel.  If anyone wants
to contact me, you can leave e-mail on Enterprize for me, or call voice
AT YOUR OWN RISK.  They told me they were tapping the phone lines.


Just got to say a few goodbyes...


Genesis: man, this stuff is in your blood, don't allow my mistakes to
         mess up something you've loved your whole life.  You Gotta Ski!


Silencer: well, you warned me and I didn't listen.  I needed to listen to
          the kid with a knowledgable mind.  Sorry, the second time I left
          a group and left you hanging...


Cool Hand: Joe, you are a really nice person to talk to, and you've got a
           wife and kids.  Remember that man, is this stuff worth it?


Line Noise: Neil, I guess you are one of the happier ones to hear of my
            bust.  No THG, no USA.  You will rule the world man, but be
            more careful than I was.


The PieMan: Well, you can quit threatening to turn my board in if you ever
            get caught.  My board was officially busted.


Fab.Furlough: Deep down inside, you are a backstabber.  But I still love
              you man...


And to all I didn't say anything to, doesn't mean I don't care.  I hope USA
will continue to live and prosper.  And I will do anything I can(legally)
to help USA prosper.  Goodbye...



                           The NotSoHumble Babe




  Of course, that was the version she wanted to play to the general
public. The NotSoHumble Babe and The Grim Reaper were not just doing this
for the first time, it had been a routine thing for quite a while.
(For at least 4 months, when TGR carded his 486/33).


  I guess it would be helpful to take a few steps back, and get a look
at the whole picture as I know it (From reliable sources, and from personal
experiance with these two people).


  The NotSoHumble Babe was always known for her good contacts in the
software field, that is the reason for USA's quick appearence. People
probably wondered how she did it? I am sure she had many ways, but the one
tactic she used which gained her the interest of the FBI was telling the
software Co's she was a distributor. All of them believed this expept for
one. When this one checked her Employer Identification Number, and found
it didn't check out with her, they knew something was up. They then had
her lines monitored, and because of this found out they had more then a
business fraud on their hands, they found out they had a veteran Credit
Card abuser, and the leader of a major pirate group. This then in turn
caused a lot more investigation to take place, and in turn the interest
of the Secret Service. Since they were being monitored, the SS knew all
their plans. When TGR had ordered his next shipment of carded goods, the
SS notified the company of what was going on, and set the trap. Now,
after several months of investigation on The Grim Reaper (Mike Arnolds)
and The NotSoHumble Babe, the case was about to come to a close, they
had everything they needed to convict these two people in court, and whoever
else they wanted.



  As Amy said in her text above, she and Mike were on the way to meet each
other to split the goods they had carded. When Amy went to FedEx to pick
up her shit, and go meet Mike, they were surrounded, and arrested.
This took place on 1-29-92 at approximately 2:27pm.


  Mike and Amy were taken back to their houses, where all of their equipment
was looked over. As she said, anything without a receipt was confiscated.
Then, came the big talks from the Feds - Interrogation.


  This day totally changed Mike's and Amy's life drastically. Things would
not be the same. And because of this, they were both pretty moved.
Because of this insecure feeling, and because they are both unable to take
this shit themselves, and not implicate other people, they decided to
cooperate 100% with the authorities. Anything they didn't have on paper,
anything the Feds found unclear, Mike and Amy are/were right there to make
a clear picture for them. Amy failed to say this, I see. I know first hand,
The Grim Reaper and The NotSoHumble Babe are going to drag as many as they
can with them. A loser thing to do, but that's what they are going to do.
Looks like it's time for us all to either call it quits for a while, or
be very fucking careful. TGR and TNSHB are both history. They fucked up.
And now they will pay for their mistakes. But we don't need to be party to
their bullshit. Delete their accounts from your board, blacklist them,
lock out newusers, change the system pw, and even go as far as deleting all
USA affiliates if you feel it is necessary.


  What about USA? What about Genesis and BBS-A-Holic? Well, Genesis was one
of her partners in crime. Thomas always made it a habit to get something out
of each of her shipments, so to do this, he had to contribute somehow, nothing
is free. He helped card about 25% of the shit they got, so I am sure he is a
nervous mother fucker right now. The Feds are monitoring his local FedEx
anyway, so if he goes there to pick up his last package, his ass is in jail
too. He also was a very avid user of the 950-0511 extender, as the Feds are
aware of, and they might pop him for this, who knows?  The board? USA?
I have heard, but not from Genesis, that USA is now officially dead.
BBS-A-Holic is down, and no idea when it will come back up.
But when it does again come online, I will not be a member on that system.
Thomas is considering turning himself in, if he does this, he said he too will
cooperate with the Feds, which means if you were his friend yesterday, and
helped him card shit, or anything, then you might share his cell tomorrow.


  What do you know about The Grim Reaper, The Void, and Vision-x? -
The Grim Reaper is getting popped for the second time, therefore, I think
his ass will be in jail a few years, once he is sentenced. The Void?
I am not sure, but I assume since he had carded all of his computer
equipment, that it was all confiscated, along with all of his backups.
Mike being in jail, or not, will never again run a board. As for Vision-x,
who knows. Warlord has not made a public statement yet, so noone knows yet.
He does live in 313 as did the other two, so if I were him I would be scared
shitless, especially since he was supposed to receive a carded 386/25 from
USA. Felony Net and Toxic Net are all history. Perhaps Warlord will bring
them back, though, but I don't foresee this any time soon.


  The Grim Reaper and The NotSoHumble Babe were charged with Credit Card
Fraud, ammounting 18,200$, and software piracy adding up to 72,000$.
Once you add Genesis' (Thomas') part in, the  credit card fraud will probably
amount to 21,000$, but, that's just my guess, based on all this shit he told
me about that he assisted in, and some he did on his own.


  When TNSHB says to call her board and leave her your questions, or number
to call you back at, it is just a simple way to drag you in. Dont fall for
it. Lives and freedom are too precious to ruin for a bitch like her.
Just for the hell of it, here are their telephone numbers, if you want to
verify all this shit, just call and ask them. (I advise you do this from a
payphone a LONG way from your house, and dont identify yourself)

The Grim Reaper (Mike) 313-981-1903/313-981-1296
The NotSoHumble Babe (Amy) 313-442-2523
Genesis (Thomas) 213-328-7507


  Hope this has all been helpful. If you want more history on these people,
send a public message on OoofNet in care of [>ANONYMOUS<], and I will give
the desired history out.


                                           [> ANONYMOUS <]










=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

                          -=-  The Empire Times  -=-
                        Volume 1, Issue 2, File 3 of 11

                      Why The Secret Service Will Bust You
                             Instead of The F.B.I.



Here is a letter from the Director of the Secret Service to US
Rep. Don Edwards, D-California, in response to questions raised
by Edwards' Subcommittee. This copy comes from Computer Professionals
for Social Responsibility in Washington, DC.

                                         DEPARTMENT OF TREASURY
                                         UNITED STATES SECRET SERVICE
                                         WASHINGTON, DC 20223


 The Honorable Don Edwards
 Chairman
 Subcommittee on Civil and Constitutional Rights
 Committee on the Judiciary
 House of Representatives
 Washington,  D.C.  20515

 Dear Mr. Chairman:

 Thank you for your letter of April 3, 1990, concerning your
 committee's interest in computer fraud.  We welcome the
 opportunity to discuss this issue with your committee and I
 hope the following responses adequately answer your
 questions.

 Question 1:

 Please describe the  Secret Service's process for investigating
 computer related crimes under Title 18, United States Code,
 Section 1030 and any other related statutes.

 Response:

 The process by which the  Secret Service investigates
 computer related crimes is similar to the methods we use to
 investigate other types of criminal investigations.  Most of the
 investigative techniques are the  same; surveillances, record
 checks, witness and suspect interviews, etc.  the primary
 difference is we had to develop resources to assist in the
 collection and review of computer evidence.

 To provide  our agents with this expertise, the secret service
 developed a computer fraud investigation course which, as of
 this date, has trained approximately 150 agents in the proper
 methods for conducting a computer fraud investigation.
 Additionally, we established a computer  Diagnostics center,
 staffed  with computer professional, to review evidence on
 computer  systems.

 Referrals of computer related criminal investigations occur in
 much the same manner as any other case.  A victim sustains a
 loss and reports the crime, or, a computer related crime is
 discovered during the course of another investigation.

 In the investigations  we do select, it is not our intention to
 attempt to supplant local or state law enforcement.  We
 provide enforcement in those cases that are interstate or
 international in nature and for one reason or another are
 beyond the capability of state and local law enforcement
 agencies.

 When computer related crimes are referred by the various
 affected industries to the local field offices, the Special
 Agent in  Charge (SAIC) determines which cases will be
 investigated based on a variety of criteria.  Each SAIC must
 consider the economic impact of each case, the prosecutive
 guidelines of the United States Attorney, and the investigative
 resources available in the office to investigate the case .

 In response to the other portion of your question, the other
 primary statute we use to investigate computer related crimes
 is Title 18, United States  Code,  Section 1029 ( Access Device
 Fraud).  This service  has primary jurisdiction in those cases
 which are initiated outside a bank and do not involve
 organized crime, terrorism, or foreign counterintelligence
 (traditional responsibilities of the FBI).

 The term "access device" encompasses credit cards, debit
 cards, automatic teller machines (ATM) cards, personal
 identification numbers (PIN's) used to activate ATM machines,
 credit or debit card account numbers, long distance telephone
 access codes, computer passwords and logon sequences, and
 among other things the computer chips in cellular car phones
 which assign billing.

 Additionally, this Service has primary jurisdiction in cases
 involving electronic fund transfers by consumer (individuals)
 under Title 15, U. S. code, section 169n (Electronic Fund
 Transfer Act).  This could involve any scheme designed to
 defraud EFT systems used by the public, such as pay by phone
 systems, home banking, direct deposit, automatic payments,
 and violations concerning automatic teller machines.  If the
 violations can be construed to be a violation of the  banking
 laws by bank employee, the FBI would have primary
 jurisdiction.

 There are many other statutes which have been used to
 prosecute computer criminals but it is within the purview of
 the U.S. Attorney to determine which statute will be used to
 prosecute an individual.

 Question 2:

 Has the Secret  Service ever monitored any computer bulletin
 boards or networks?  Please describe  the procedures for
 initiating such monitoring, and list those computer bulletin
 boards or networks monitored by the Secret  Service since
 January 1988.

 Response:

 Yes, we have occasionally monitored computer bulletin boards.
 The monitoring occurred after we received complaints
 concerning criminal activity on a particular computer bulletin
 board.  The computer bulletin boards were monitored as part of
 an official investigation and in accordance with the directives
 of the Electronic Communications  Privacy  Act of 1986 (Title
 18 USC 2510)

 The procedures used to monitor computer bulletin boards
 during an official investigation have involved either the use of
 an informant (under the direct supervision of the investigating
 agent)  or an agent operating in an undercover capacity.  In
 either case, the informant or agent had received authorization
 from the computer bulletin board's owner/operator to access
 the system.

 We do not keep records of the bulletin boards which we have
 monitored but can provide information concerning a particular
 board if we are given the name of the board.

 Question 3:

 Has the Secret Service or someone acting its direction ever
 opened an account on a computer bulletin board or network?
 Please describe the procedures for opening such an account and
 list those bulletin boards or networks on which such accounts
 have been opened since January 1988.

 Response:

 Yes, the U.S.  Secret Service has on many occasions, during the
 course of a criminal investigation, opened accounts on
 computer bulletin boards or networks.

 The procedure for opening an account involves asking the
 system administrator/operator for permission to access to the
 system.  Generally, the system administrator/operator will
 grant everyone immediate access to the computer bulletin
 board but only for lower level of the system.  The common
 "pirate" computer bulletin boards associated with most of
 computer crimes have many different level in their systems.
 The first level is generally available to the public and does not
 contain any information relation to criminal activity.  Only
 after a person has demonstrated unique computer skills, been
 referred by a known "hacker," or provided stolen long-distance
 telephone access codes or stolen credit card account
 information,  will the system administrator/operator permit a
 person to access the higher levels of the bulletin board system
 which contains the information on the criminal activity.

 As previously reported in our answer for Question 2, we do not
 keep records of the computer bulletin boards on which we have
 established accounts.

 Question 4:

 Has the Secret Service os0someone acting under its direction
 ever created a computer bulletin board or network that was
 offered to the public?  Please describe any such bulletin board
 or networks.

 Response:

 No, the U. S. Secret Service has not created a computer bulletin
 board nor a network which was offered to members of the
 public.   We have created an undercover bulletin board which
 was offered to a select number of individuals who had
 demonstrated an interest in conducting criminal activities.
 This was done with the guidance of the U.S. Attorney's  office
 and was consistent with the Electronic Communications
 Privacy Act.

 Question 5:

 Has the Secret Service ever collected, reviewed or
 "downloaded" transmissions or information from any computer
 network or bulletin board?  What procedures does the Secret
 Service have for obtaining information from computer bulletin
 boards or networks?  Please list the occasions where
 information has been obtained since January 1988, including
 the identity of the bulletin boards or networks,  the type of
 information obtained,   and how that information was obtained
 (was it downloaded, for example).

 Response:

 Yes, during the course of several investigations, the U. S.
 Secret Service has "down loaded" information from computer
 bulletin boards.  A review of information gained in this manner
 (in an undercover capacity after being granted access to the
 system by it's system administrator)  is performed in order to
 determine whether or not that bulletin board is being used to
 traffic in unauthorized access codes or to gather other
 information of a criminal intelligence nature.  At all times,
 our methods are in keeping with the procedures as outlined in
 the Electronic Communications Privacy Act (ECPA).

 If a commercial network was suspected of containing
information concerning a criminal activity, we would obtain
 the proper court order to obtain this information in keeping
 with the ECPA.

 The U. S. Secret Service does not maintain a record  of the
 bulletin boards we have accessed.

 Question 6:

 Does the Secret Service employ, or is it considering employing,
 any system or program that could automatically review the
 contents of a computer file, scan the file for key items,
 phrases or data elements, and flag them or recommend further
 investigative action?  If so, what is the status of any such
 system.  Please describe this system and research being
 conducted to develop it.

 Response:

 The Secret Service has pioneered the concept of a Computer
 Diagnostic Center (CDC)  to facilitate the review and
 evaluation of electronically stored information.  To streamline
 the tedious task of reviewing thousands of files per
 investigation, we have gathered both hardware and software
 tools to assist our search of files for specific information or
 characteristics.  Almost all of these products are
 commercially  developed products and are available to the
 public.  It is conceivable that an artificial intelligence process
 may someday be developed and have application to this law
 enforcement function but we are unaware if such a system is
 being developed.

 The process of evaluating the information and making
 recommendations for further investigative action is currently
 a manual one at our CDC.  We process thousands of computer
 disks annually as well as review evidence contained in other
 types of storage devices (tapes, hard drives, etc.).   We are
 constantly seeking  ways to enhance our investigative mission.
 The development of high tech resources like the CDC saved
 investigative manhours and assist in the detection  of criminal
 activity.

 Again, thank you for your interest.  Should you have any further
 questions, we will be happy to address them.

                                                 Sincerely,
                                                 /s/
                                                 John R.  Simpson, Director

 cc: Honorable Charles E.  Schumer











=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


                          -=-  The Empire Times  -=-
                        Volume 1, Issue 2, File 4 of 11
                   Use The Freedom of Information Act For You





>>> Freedom of Information Kit <<<


The following files are for individuals or organizations who wish to
make an FOIA application to a federal agency.


This kit is also available in printed form.  If you wish to obtain the
printed version, please send a check or money order made payable to
FOIA,Inc. for $3.00 to:

FOIA,Inc., P.O. Box 02 2397, Brooklyn, NY 11202-0050.

USING THE FREEDOM OF INFORMATION ACT

The Freedom of Information Act entitles you to request any record
maintained by a federal Executive branch agency.  The agency must
release the requested material unless it falls into one of nine exempt
categories, such as "national security," "privacy," "confidential
source" and the like, in which case the agency may but is not compelled
to refuse to disclose the records.

This kit contains all the materials needed to make FOIA requests for
records on an individual, an organization or on a particular subject
matter or event.

1988 EDITION

Fund for Open Information and Accountability, Inc.
P.O. BOX 02 2397, Brooklyn, NY 11202-0050
[phone]

INSTRUCTIONS

HOW TO MAKE A COMPLETE REQUEST

Step 1:  Select and make copies of the sample letter.  Fill in the
blanks in the body of the letter.  Read the directions printed to the
right margin of the letter in conjunction with the following
instructions:

For individual files:  Insert the person's full name in the first blank
space and any variations in spelling, nicknames, stage names, marriage
names, titles and the like in the second space.  Unlike other requests,
the signatures of an individual requesting her/his own file must be
notarized.

For organizational files:  In the first blank space insert the full and
formal name of the organization whose files you are requesting.  In the
second blank space insert any other names, acronyms or shortened forms
by which the organization is or has ever been known or referred to by
itself or others.  If some of the organization's work is conducted by
sub-groups such as clubs, committees, special programs or through
coalitions known by other names, these should be listed.  There is no
need to notarize signature for organizational requests.

For subject matter or event files:  In the first blank space state the
formal title of the subject matter or event including relevant dates and
locations.  In the second blank space provide the names of individuals
or group sponsors or participants and/or any other information that
would assist the agency in locating the material you are requesting.

Step 2:  The completed sample letter may be removed, photocopied and
mailed as is or retyped on your own stationary.  Be sure to keep a copy
of each letter.

Step 3:  Addressing the letters:  Consult list of agency addresses on
page 7 and 8 of this kit.

FBI:  A complete request requires a minimum of two letters.  Send one
letter to FBI Headquarters and separate letters to each FBI field office
nearest the location of the individual, the organization or the subject
matter/event.  Consider the location of residences, schools, work, and
other activities.

INS:  Send a request letter to each district office nearest the location
of the individual, the organization or the subject matter/event.

Address each letter to the FOIA/PA office of the appropriate agency.  Be
sure to mark clearly on the envelope:

Attention FOIA Request

FEES

In 1987 a new fee structure went into effect.  Each agency has new fee
regulations for search and review time and for duplication of released
documents.

Commercial requesters must pay for search and review time and for
duplication costs.

News Media representatives and Educational and Scientific Institutions
whose purpose is scholarly or scientific research pay for duplication
only.  Public Interest groups who can qualify as press, educational, or
scientific institutions will be charged duplication costs only.

All other non-commercial requesters are entitled to up to 100 pages of
free copying and up to 2 hours of free search time.  Requesters will
have to pay fees for work that extends beyond those limits unless they
qualify for a fee waiver or reduction (see below).

No fee may be charged if the cost of collection exceeds the fee.
Advanced payment may not be demanded unless a requester has previously
failed to pay on time or the fee exceeds $250.

FEE WAIVER

You will notice that the sample letter includes a request for a fee
waiver with instructions for the agency to refer to an attached sheet.
Fees for all non-commercial requesters, beyond the 2 hours/100
page/automatic waiver described above, may be waived or reduced if the
disclosure of the information is:

"in the public interest because it is likely to contribute significantly
to public understanding of the operations or activities of the
government and is not primarily in the commericial interest of the
requester."

You should always request a waiver or fees if you believe the
information you are seeking will benefit the public.  Read the fee
waiver worksheet for non-commercial users included in this kit on page 5
for help in composing a request for a fee waiver.  If your request for a
waiver is denied, you should appeal that denial, citing the ways in
which your request meets the standards set in the attached fact sheet.

HOW TO MAKE SURE YOU GET EVERYTHING YOU ARE ENTITLED TO. . .
AND WHAT TO DO IF YOU DON'T

After each agency has searched and processed your request, you will
receive a letter that announces the outcome, encloses the released
documents, if any, and explains where to direct an appeal if any
material has been withheld.  There are four possible outcomes:
1. Request granted in full:

This occurs very infrequently.  If the response you get indicates that
the agency has released all records pertinent to your request, with no
exclusions or withholdings, you will receive the requested documents
with an agency cover letter, or if bulky, the documents may be mailed
under separate cover.

Next step:  Check documents for completeness (see instructions below)
and make an administrative appeal if you find a discrepancy between your
own analysis and that of the agency (see instructions below).

2. Request granted in part and denied in part:

This response indicates that the agency is releasing some material but
has withheld some documents entirely or excized some passages from the
documents released.  The released documents may be enclosed or, if
bulky, mailed under separate cover.

Next step:  Check documents for completeness (see instructions below)
and make an administrative appeal of denials or incompleteness (see
instructions below).

3. Request denied in full:  This response and the denied part response
indicate that the agency is asserting that material in its files
pertaining to your request falls under one of the nine FOIA exemptions.
These are categories of information that the agency may, at its
discretion, refuse to release.

Next step:  Make an administrative appeal (see instructions below).
Since FOIA exemptions are not mandatory, even a complete denial of your
request can and should be appealed.

4. No records:  This response will state that a search of the agency's
files indicates that it has no records corresponding to those you
requested.  Next step:  Check your original request to be sure you have
not overlooked anything.  If you receive documents from other agencies,
review them for indications that there is material in the files of the
agency claiming it has none.  For example, look for correspondence, or
references to correspondence, to or from that agency.  If you determine
that there are reasonable grounds, file an administrative appeal (see
instructions below).

HOW TO CHECK DOCUMENTS FOR COMPLETENESS

Step 1:  Before reading the documents, turn them over and number the
back of each page sequentially.  The packet may contain documents from
the agency's headquarters as well as several field office files.
Separate the documents into their respective office packets.  Each of
these offices will have assigned the investigation a separate file
number.  Try to find the numbering system.  Usually the lower righthand
corner of the first page carries a hand-written file and document
number.

For instance, an FBI document might be marked "100-7142-22."  This would
indicate that it is the 22nd document in the 7142nd file in the 100
classification.  As you inspect the documents, make a list of these file
numbers and which office they represent.  In this way you will be able
to determine which office created and which office received the document
you have in your hand.  Often there is a block stamp affixed with the
name of the office from whose files this copy was retrieved.  The
"To/From" heading on a document may also give you corresponding file
numbers and will help you puzzle out the origin of the document.

When you have finally identified each document's file and serial number
and separated the documents into their proper office batches, make a
list of all the serial numbers in each batch to see if there are any
missing numbers.

If there are missing serial numbers and some documents have been
withheld, try to determine if the missing numbers might reasonably
correspond to the withheld documents.  If they don't, the release may be
incomplete and an administrative appeal should be made.

Step 2:  Read all the documents released to you.  Keep a list of all
documents referred to in the text, including letters, memos, teletypes,
reports, etc.  Each of these "referred to" documents should turn up in
the packet released to you.  If any are not in the packet, it is
possible that they are among the documents withheld and a direct inquiry
should be made.

In an administrative appeal, ask that each of these "referred to"
documents be produced or that the agency state plainly that they are
among those withheld.  List each "referred to" document separately.  The
totals of unproduced vs. witheld must be within reason; that is, if the
total number of unproduced documents you find referred to in the text of
the documents produced exceeds the total number of documents withheld,
the agency cannot claim that all the "referred to" documents are
accounted for by the withheld category.  You will soon get the hang of
making logical conclusions from discrepancies in totals and missing
document numbers.

Another thing to look for when reading the released documents is the
names of persons or agencies to whom the document has been disseminated.
The lower left-hand corner is a common location for the typed list of
agencies or offices to whom the document has been directed.  In
addition, there may be additional distribution recorded by hand, there
or elsewhere, on the cover page.  There are published glossaries for
some agencies that will help in deciphering these notations when they
are not clear.  Contact FOIA, Inc. if you need assistance in deciphering
the text.

Finally, any other file numbers that appear on the document should be
noted, particularly if the subject of the file is of interest and is one
you have not requested.  You may want to make an additional request for
some of these files.

HOW TO MAKE AN ADMINISTRATIVE APPEAL

Under the FOIA, a dissatisfied requester has the right of administrative
appeal.  The name and address of the proper appeal office will be given
to you by each agency in its final response letter.

This kit contains a sample appeal letter with suggestions for adapting
it to various circumstances.  However, you need not make such an
elaborate appeal; in fact, you need not offer any reasons at all but
rather simply write a letter to the appeals unit stating that "This
letter constitutes an appeal of the agency's decision."  Of course, if
you have identified some real discrepancies, you should set them forth
fully (for example see Step 2 under "How to Check Documents for
Completeness"), but even if you have not found any, you may simply ask
that the release be reviewed.  If you are still dissatisfied after the
administrative appeal process, the FOIA gives you the right to bring a
lawsuit in federal district court.


MONITORING THE PROGRESS OF YOUR REQUEST

You should receive a letter from each agency within 10 days stating that
your request has been received and is being processed.  You may be asked
to be patient since requests are being handled on a first come first
served basis.  The best strategy is to be "reasonably" patient, but
there is no reason to sit complacently and wait for an interminable
period of time.

A good strategy is to telephone the FOIA office in each agency after
about a month if you have received nothing of substance.  Ask for a
progress report.  Note the name of the person you speak to and what they
say.  Continue to call every 4 to 6 weeks.

Good record keeping helps avoid time-consuming and frustrating
confusion.  A looseleaf notebook with a section devoted to each request
simplifies this task.  At the beginning of the request process,
sometimes it is difficult to foresee what course of action you will want
to take in the future.  Keep copies of all correspondence to and from
each agency.  They can be inserted between the notes on phone calls so
that all relevant material will be at hand for future use, including
phone consultations, correspondence, newspaper articles, preparation for
media appearances, congressional testimony or litigation.



[NOTE:  All the text in braces [] is for your information.  Do NOT
include in request]

[NOTE:  Start by photocopying several copies of this letter or retype if
you prefer]

SAMPLE REQUEST LETTER FOR ALL AGENCIES

Date:
To: FOIA/PA Unit

[Check box for appropriate agency]

__ FBI Headquarters

__ FBI Field Office

__ Other Agency

This is a noncommerical request under the Freedom of Information and
Privacy Acts.  I have attached a sheet setting out my application for a
fee waiver of any fees in excess of those which are provided free
because of my category.
My category for fee and fee waiver purposes is:

(check one)
__   request for personal file;
        no search fee and 100 free pages.
__   journalist, academic or scientist;
        no search fee and 100 free pages.
__   other non-commerical requester (group or person);
        2 hours free search and 100 free pages.

I request a complete and thorough search of all filing systems and
locations for all records maintained by your agency pertaining to and/or
captioned:

____________________________________________________________

____________________________________________________________

____________________________________________________________

including, without limitation, files and documents captioned, or whose
captions include:

[describe records desired and/or insert full and formal name]

____________________________________________________________

____________________________________________________________

____________________________________________________________

This request specifically includes where appropriate "main" files and
"see references," including but not limited to numbered and lettered sub
files and control files.  I also request a search of the Electronic
Surveillance (ELSUR) Index, or any similar technique for locating
records of electronic surveillance and the COINTELPRO Index.  I request
that all records be produced with the administrative pages.  I wish to
be sent copies of "see reference" cards, abstracts, search slips,
including search slips used to process this request, file covers,
multiple copies of the same documents if they appear in a file, tapes of
any electronic surveillance, photographs, and logs of physical
surveillance (FISUR).  Please place missing documents on "special
locate."
I wish to make it clear that I want all records in your office
"identifiable with my request," even though reports on those records
have been sent to Headquarters and even though there may be duplication
between the two sets of files.  I do not want just "interim" documents.
I want all documents as they appear in the "main" files and "see
references" of all units of your agency.

If documents are denied in whole or in part, please specify which
exemption(s) is(are) claimed for each passage or whole document denied.
Give the number of pages in each document and the total number of pages
pertaining to this request and the dates of documents withheld.

I request that excized material be "blacked out" rather than "whited
out" or cut out and that the remaining non-exempt portions of documents
be released as provided under the Freedom of Information Act.

Please send a memo (with a copy or copies to me) to the appropriate
unit(s) in your office to assure that no records related to this request
are destroyed.  Please advise of any destruction of records and include
the date of and authority for such destruction.

As I expect to appeal any denials, please specify the office and address
to which an appeal should be directed.

I can be reached at the phone listed below.  Please call rather than
write if there are any questions or if you need additional information
>from me.  I expect a response to this request within ten (10) working
days, as provided for in the Freedom of Information Act.

[Have signature notorized ONLY if requesting your own files]


Sincerely,

(Signed)_______________________________________________

Name (print or type):_______________________________

Address:___________________________________________________

___________________________________________________________

Telephone:________________________
Social Security number (optional): _______________________

(for personal files)

     Date of Birth:____________________

     Place of birth:___________________

(for organization files)

     Date of founding:_____________________________________

     Place of founding:____________________________________

     Address of organization:______________________________

___________________________________________________________

___________________________________________________________

[MARK CLEARLY ON ENVELOPE: FOI/PA REQUEST]


FEE WAIVERS

Fee Waiver Worksheet for Non-Commercial Requesters

All non-commercial requesters are entitled to apply for a fee waiver for
charges in excess of those which are provided free because of
requester's category.  Following amendments to the FOIA in October 1986,
the Justice Department issued a memo outlining six criteria to be used
by agencies in determining whether or not to grant fee waivers.  Many
Congresspeople dispute the memo's legality, pointing out its invitation
to subjective judgements, and its proclivity to intimidate requesters.
Nevertheless, until the six criteria are eliminated, either by Congress
or court decisions, requesters will have to address them in order to
qualify for a fee waiver.

To apply for a fee waiver, attach a separate sheet of paper to your
request letter explaining in narrative form how your request satisfies
each of the following six criteria.

(1) Explain how the records you are requesting are likely to shed light
on the operations or activities of the government.

(2) Describe how the records you are requesting will contribute to the
understanding of government operations or activities.  If the
information being requested is not already in the public domain bring
this fact to the agency's attention.

(3)a.  Explain to the agency how the public will ultimately benefit from
the information you are requesting.  Legislative history and recent case
law indicate that the "public" is not limited to U.S. public nor must it
be the "public at-large."  For example, Representatives English and
Kindness jointly stated during recent Congressional debate, "Public
understanding is enhanced when information is disclosed to the subset of
the public most interested, concerned or affected by a particular action
or matter."  Furthermore, District Court Judge Harold Greene in a 1987
opinion involving a request by a Canadian newspaper said, "There is no
requirement in the [FOIA] statute that news media seeking fee waivers
[must] serve the American public exclusively, or even tangentially . . .
an FBI official does not have the authority to amend the law of the
United States by restricting it beyond its plain terms."*

In other words, the public you seek to educate does not have to reside
in the United States, nor is the size of that public relevant to your
entitlement to a fee waiver.

(3)b.  Explain to the agency your qualifications (educational, work
experience, etc.) for understanding the requested information and
outline your ability and intention to disseminate the information once
it has been obtained.

You might want to cite any of the following activities in order to
demonstrate your ability and intention to disseminate information to the
public:  writing newspaper or scholarly articles, writing books,
granting interviews, public speaking engagements, preparing
Congressional testimony, producing pamphlets, videos, film, radio
programs, etc.

(4) The Justice Department memo stipulates that the contribution to
public understanding must be "significant."  What constitutes a
"significant" contribution is clearly susceptible to subjective
interpretation.  However, we suggest that you make reference to current
news stories, efforts to correct the historical record or expose
government or corporate fraud or threats to public health and safety.
Broadly speaking, any information that would enable the public to hold
the government accountable for any of its operations or activities can
be persuasively argued to be a "significant" contribution to public
understanding.

(5) and (6) Explain to the agency (if it is the case) that any
commercial interest that will be furthered by the requested records is
not the primary interest when compared to the public interest that will
be served.  For example, if the information is requested pursuant to the
publication of a book, you should explain (if it is the case) that this
book is not destined to become a bestseller because of topic, publisher,
or anticipated audience, etc.

News media representatives, scholars or scientists, should make requests
for documents and fee waivers on the appropriate institutional
letterhead.  Similarly, requests for organizational files should be made
on the appropriate letterhead.

You have a right to file an administrative appeal if you receive an
adverse decision regarding either your fee category or fee waiver
request.  The letter containing the adverse decision will tell you to
whom you should direct the appeal.
------

* Joint statement by Reps.  English and Kindness, Congressional Record,
H-9464, October 8, 1986; Judge Greene's opinion in Southam News v. INS.
(Civ.  No. 85-2721, D.D.C., November 9, 1987).


SAMPLE ADMINISTRATIVE APPEAL LETTER

Date:

To: FOIA/PA Appeals Office RE: Request number [Add
this if the agency has given your request a number]

This is an appeal pursuant to subsection (a)(6) of the Freedom of
Information Act as amended (5 U.S.C. 552).

On [date] I received a letter from [name of official] of your agency
denying my request for [describe briefly the information your are
after].  This reply indicated that an appeal letter could be sent to
you.  I am enclosing a copy of my exchange of correspondence with your
agency so that you can see exactly what files I have requested and the
insubstantial grounds on which my request has been denied.

[Insert following paragraph if the agency has withheld all or nearly all
the material which has been requested]

You will note that your agency has withheld the entire (or nearly
entire) document that I requested.  Since the FOIA provides that "any
reasonably segregable portion of a record shall be provided to any
person requesting such record after deletion of the portions which are
exempt," I believe that your agency has not complied with the FOIA.  I
believe that there must be (additional) segregable portions which do not
fall within the FOIA exemptions and which must be released.

[Insert following paragraph if the agency has used the (b)(1) exemption
for national security purposes to withhold information]

Your agency has used the (b)(1) exemption to withhold information.  [I
question whether files relating to events that took place over twenty
years ago could realistically harm the national security.] [Because I am
familiar with my own activities during the period in question, and know
that none of these activities in any way posed a significant threat to
the national security, I question the designation of my files or
portions of my file as classified and exempt from disclosure because of
national security considerations.]

[Sample optional arguments to be used if the exemption which is claimed
does not seem to make sense; you should cite as many specific instances
as you care to of items withheld from the documents that you have
received.  We provide two examples which you might want to adapt to your
own case.]

"On the memo dated______the second paragraph withheld under the (b)(1)
exemption appears to be describing a conversation at an open meeting.
If this is the case, it is impossible that the substance of this
conversation could be properly classified."  Or, "The memo dated____
refers to a meeting which I attended, but a substantial portion is
deleted because of the (b)(6) and (b)(7)(c) exemptions for unwarranted
invasions of personal privacy.  Since I already know who attended this
meeting, no privacy interest is served by the withholding."

I trust that upon examination of my request, you will conclude that the
records I have requested are not properly covered by exemption(s)____
[insert the exemption(s) which the agency's denial letter claimed
applied to your request] of the amended FOIA, and that you will overrule
the decision to withhold the information.

[Insert following paragraph if an itemized inventory was not supplied by
the agency]

If you choose to continue to withhold some or all of the material which
was denied in my initial request to your agency, I ask that you give me
an index of such material, together with the justification for the
denial of each item which is still withheld.

As provided in the Freedom of Information Act, I will expect to receive
a reply to this adminstrative appeal letter within twenty (20) working
days.

If you deny this appeal and do not adequately explain why the material
withheld is properly exempt, I intend to initiate a lawsuit to compel
its disclosure.  [You can say that you intend to sue if that is your
present inclination even though you may ultimately decide not to file
suit.]

     Sincerely,
     name:

     address:

     signature:

[MARK CLEARLY ON ENVELOPE:

ATTENTION: FREEDOM OF INFORMATION APPEALS]


FUND FOR OPEN INFORMATION AND ACCOUNTABILITY, INC.

P.O. BOX O2 2397, BROOKLYN, NY 11202-0050

FOIA/PA ADDRESSES FOR SELECTED FEDERAL AGENCIES

Administrative Office of the U.S. Courts
Washington, D.C. 20544
[phone]

Bureau of Prisons
320 1st St., NW
Washington, D.C. 20534
[phone]

Central Intelligence Agency
Information and Privacy Coordinator
Washington, D.C. 20505

Civil Service Commission
Appropriate Bureau:
     ___ Bureau of Personnel Investigation,
     ___ Bureau of Personnel
     ___ Information Systems
Civil Service Commission
1900 E Street, N.W.
Washington, D.C. 20415
[phone]

Commission on Civil Rights
General Counsel, U.S. Commission on Civil Rights
1121 Vermont Ave., N.W., Rm. 600
Washington, D.C. 20405
[phone]

Consumer Producet Safety Commission
1111 18th St., N.W.
Washington, D.C. 20207
[phone]

Defense Intelligence Agency
The Pentagon
Washington, D.C. 20301-6111
[phone]

Department of Defense/Department of the Air Force
Freedom of Information Manager
Headquarters, USAF/DADF
Washington, D.C. 20330-5025
[phone]

Department of Defense/Department of the Army
General Counsel
Secretary of the Army
The Pentagon, Rm. 2E727
Washington, D.C. 20310
[phone]

Department of Defense/ Marine Corps
Commandant of the Marine Corps
Department of the Navy
Headquarters, Marine Corps
Washington, D.C. 20380-0001
[phone]

Department of Defense/ Dept. of the Navy
Chief of Naval Operations
OP 09 B30
Pentagon, Rm. 5E521
Washington, D.C. 20350-2000
[phone]

Department of Energy
1000 Independence Ave., S.W.
Washington, D.C. 20585
[phone]
Department of Justice/
General Administration

__ Civil Rights Division,
__ Antitrust Division,
__ Drug Enforcement Administration
__ Immigration and Naturalization Service

FOIA/ Privacy Act Unit
Department of Justice
Constitution Ave. & 10th St., N.W.
Washington, D.C. 20530
[phone]

Department of Labor
200 Constitution Ave., N.W.
Washington, D.C. 20210
[phone]

Department of State
Director, Freedom of Information Bureau
for Public Administration
Department of State, Rm 239
2201 C St., N.W.
Washington, D.C. 20520
[phone]

Department of the Treasury
Internal Revenue Service
1111 Constitution Ave., N.W.
Washington, D.C. 20224
[phone]
(Consult phone book for regional offices)

Environmental Protection Agency
Freedom of Information Office A101
Room 1132 West Tower
401 M St., S.W.
Washington, D.C. 20460
[phone]

Equal Employment Opportunities Comm.
Office of Legal Services
2401 E St., N.W., Rm. 214
Washington, D.C. 20507
Attn. Richard Roscio, Assc. Legal Counsel
[phone]

Federal Communications Commission
1919 M St., N.W.
Washington, D.C. 20554
[phone]

Food and Drug Administration
5600 Fishers Lane
Rockville, MD 20857
[phone]
Health and Human Services
200 Independence Ave., S.W.
Washington, D.C. 20201

Housing and Urban Development
451 Seventh St., S.W.
Washington, D.C. 20410
[phone]
National Aeronautics & Space Administration
400 Maryland Ave, S.W.
Washington, D.C. 20546
[phone]

National Archives and Records Service
Pennsylvania Ave. at 8th St., N.W.
Washington, D.C. 20408
[phone]

National Labor Relations Board
1717 Pennsylvania Ave., N.W.
Washington, D.C. 20570
[phone]

National Security Agency
Ft. George G. Meade, MD 20755-6000
[phone]

National Security Council
Old Executive Bldg.
17th & Pennsylvania Ave., N.W.
Washington, D.C. 20506
Attn. Brenda Reger
[phone]

Nuclear Regulatory Commission
Director, Office of Administration
Washington, D.C. 20555
[phone]

Secret Service
U.S. Secret Service
1800 G St., N.W.
Washington, D.C. 20223
Attn. FOIA/ Privacy Office
[phone]

Securities and Exchange Commission
450 5th St., N.W.
Washington, D.C. 20549
[phone]

U.S. Customs Service
1301 Constitution Ave., N.W.
Washington, D.C. 20229
[phone]

U.S. Agency for International Development
320 21st. St., N.W.
Washington, D.C. 20532
[phone]

U.S. Office of Personnel Management
1900 E St., N.W.
Washington, D.C. 20415
[phone]

U.S. Postal Service Records Office
475 L'Enfant Plaza, S.W.
Washington, D.C. 20260-5010
[phone]

Veterans Administration
810 Vermont Ave., N.W.
Washington, D.C. 20420
[phone]

[2/88]


Federal Bureau of Investigation
Offices where files are held


Albany, NY 12207                          Memphis, TN 38103
502 U.S. Post Office and Courthouse       67 N. Main St
518-465-7551                              901-525-7373

Albuquerque, NM 87102                     Miami, FL 33137
301 Grand Ave. NE                         3801 Biscayne Blvd
505-247-1555                              305-573-3333

Alexandria, VA 22314                      Milwaukee, WI 53202
300 N. Lee St                             517 E. Wisconsin Ave
703-683-2680                              414-276-4684

Anchorage, AK 99513                       Minneapolis, MN 55401
701 C St                                  392 Federal Bldg
907-276-4441                              612-339-7861

Atlanta, GA 30302                         Mobile, AL 36602
275 Peachtree St. NE                      113 St. Joseph St
404-521-3900                              205-438-3674

Baltimore, MD 21207                       Newark, NJ 07102
7142 Ambassador Rd                        Gateway 1, Market St
301-265-8080                              201-622-5613

Birmingham, AL 35203                      New Haven, CT 06510
Room 1400, 2121 Bldg                      150 Court St
205-252-7705                              203-777-6311

Boston, MA 02203                          New Orleans, LA 70112
John F. Kennedy Federal Office Bldg       1250 Poydras St., Suite 2200
617-742-5533                              504-522-4670

Buffalo, NY 14202                         New York, NY 10278
111 W. Huron St                           26 Federal Plaza
716-856-7800                              212-553-2700

Butte, MT 59702                           Norfolk, VA 23510
U.S. Courthouse and Federal Bldg          200 Granby Mall
406-792-2304                              804-623-3111

Charlotte, NC 28210                       Oklahoma City, OK 73118
6010 Kenley Lane                          50 Penn Pl
704-529-1030                              405-842-7471

Chicago, IL 60604                         Omaha, NE 68102
219 S. Dearborn St                        215 N. 17th St
312-431-1333                              402-348-1210

Cincinnati, OH 45205                      Philadelphia, PA
50 Main St                                600 Arch St
513-421-4310                              215-629-0800

Cleveland, OH 44199                       Phoenix, AZ 85012
1240 E. 9th St                            201 E. Indianola
216-522-1400                              602-279-5511

Columbia, SC 29201                        Pittsburgh, PA
1529 Hampton St                           1000 Liberty Ave
803-254-3011                              412-471-2000

Dallas, TX 75202                          Portland, OR 97201
1801 N. Lamar                             1500 SW 1st Ave
214-741-1851                              503-224-4181

Denver, CO 80202                          Quantico, VA 22135
Federal Office Bldg                       FBI Academy
303-629-7171                              703-640-6131

Detroit, MI 48226                         Richmond, VA 23220
477 Michigan Ave                          200 W. Grace St
313-965-2323                              804-644-2631

El Paso, TX 79901                         Sacramento, CA 95825
202 U.S. Courthouse Bldg                  2800 Cottage Way
915-533-7451                              916-481-9110

Honolulu, HI 96850                        St. Louis, MO 63103
300 Ala Moana Blvd                        1520 Market St
808-521-1411                              314-241-5357

Houston, TX 77002                         Salt Lake City, UT 84138
515 Rusk Ave                              125 S. State St
713-224-1511                              801-355-8584

Indianapolis, IN 46204                    San Antonio, TX 78206
575 N. Pennsylvania St                    615 E. Houston
317-639-3301                              512-225-6741

Jackson, MS 39264                         San Diego, CA 92188
100 W. Capitol St                         880 Front St
601-948-5000                              619-231-1122

Jackonsville, FL 32211                    San Francisco, CA 94102
7820 Arlington Expressway                 450 Golden Gate Ave
904-721-1211                              415-552-2155

Kansas City, MO 64106                     San Juan, PE 00918
300 U.S. Courthouse Bldg                  Hato Rey, PR
816-221-6100                              809-754-6000

Knoxville, TN 37919                       Savannah, GA 31405
1111 Northshore Dr                        5401 Paulsen St
615-588-8571                              912-354-9911

Las Vegas, NV 89101                       Seattle, WA 98174
Las Vegas Blvd. S                         915 2nd Ave
702-385-1281                              206-622-0460

Little Rock, AR 72201                     Springfield, IL 62702
215 U.S. Post Office Bldg                 535 W. Jefferson St
501-372-7211                              217-522-9675

Los Angeles, CA 90024                     Tampa, FL 33602
11000 Wilshire Blvd                       500 Zack St
213-477-6565                              813-228-7661

Louisville, KY 40202                      Washington, DC 20401
600 Federal Pl                            1900 Half St. SW





=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


                          -=-  The Empire Times  -=-
                        Volume 1, Issue 2, File 5 of 10
                           The Empire Times Presents
                              Carding in The 90's
                                  By Mustang





                                 False
                                 ------

        Carders are out to phuck people over, By charging vast
        amounts of money to there credit Cards.



                                 True
                                 ----

        Carders are really trying to fuck up the government, by making
        charges that people refuse to pay and the government has to pick
        up the tab.




        Now we all know the dangers of carding, but this file is dedicated to
        showing you the ways to get by these problems. If any problem is not
        written in this file or there is something that is wrong E-mail me on
        Empire or other fine boards.
        Traces-Even though it's a long shot that the store has a trace, never
        ever call from home. Use a payphone or public phone.
        Always know exactly what you want, So you cann make your order fast
        and easy. Try and use a deep voice when calling a store that way they
        belive it is a adult. Always use a drop point and never your own home.
        Know you already have the card number and name. Now pick up the pay
        phone and call a store.

Store Clerk- Hects, Can I help you?

Carder- Yes can you please conect me with the BLAH BLAH department.

Store Clerk- Please hold.

Department Clerk- BLAH BLAH department can I help you?

Carder- Yes I would like to order by credit card one BLAH BLAH.

Department Clerk- Ok... I will need your credit card number.

Carder- American Express, Number xxxxxxxxxxxxxxxx.

Departmen Clerk- Ok... Now what's your name.

Carder- My name is JOHN DOE.

Department Clerk- What's your experation date?

Carder- Me experation date is BLAH BLAH.

Department Clerk- Please hold while I cheack to see if the info is                      valid.

Department Clerk- Everything checks out.

Carder- (Sigh) Can I have that deliverd to my home?

Department Clerk- Yes, What's your address?

Carder- My addrress is BLAH BLAH.

Department Clerk- Thank You it's should arrive in a few weeks.

Carder- Thanks alot.

CLICK

          Its as easy as that. Next you have to pick up the stuff you orderd
        at your drop site. Now if you read the above you know that sending
        a dilevery to your own home is fucking stupid. So what you do is go
        out into your naborhood and find a nice little house for sale.
        Then when you order somthing give the address. Now when the UPS man
        comes here is a good story to tell him.

UPS Man- Dose BLAH BLAH live here.

Carder- She used to but moved out last week, she told me to pick up
        any mail that came to the house and foward it to here.

UPS Man- Ok can you please sign here.

Carder- Sure, Thank You.

        Now you have the delivery. (Note, Never put your real name down on
        the sign in sheet. Now find a good place to hide the goods for about
        a Two days just so now one get suspiciuos then take it home and have
        a ball.

        Geting Credit Card Numbers.

        There are many ways of doing this. I will just name a few.


        Trashing- Going through trash looking for numbers.

        Looking around ATM- machines for those little cards that have
        thecard number on them.

        Using Programs- That spit out card numbers.

        And then my favorte is a system written by Saturday Knight, This
        file can be found on any Elite BBs, it's called AMEX.zip.


        Well that's alll I have to say about carding for this issue.
        And remember Don't card just for fun becase that's how you get busted.




I would like to thank The following:
-----------------------------------


Dameon- For helping me get started.
Cultish Person- For showing how not to be a good user.
Alby - For all his help.














=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=



                           -=-  The Empire Times  -=-
                        Volume 1, Issue 2, File 6 of 11
                               Specs On Caller ID




This is a copy of the data sheet picked up at the Rockwell
booth at the COMDEX show.

INTRODUCTION
Calling Number Delivery (CND), better known as Caller ID, is a
telephone service intended for residential and small business
customers.  It allows the called Customer Premises Equipment
(CPE) to receive a calling party's directory number and the date
and time of the call during the first 4 second silent interval in
the ringing cycle.  The customer must contact a Bellcore Client
Company to initiate CND service.

According to Pacific Bell representatives, the following states
and district currently support CND service:  Delaware, District
of Columbia, Florida, Georgia, Idaho, Kentucky, Louisiana, Maine,
Maryland, Nebraska, Nevada, New Jersey, Oklahoma, Tennessee,
Vermont, Virginia, and West Virginia.

The following states are scheduled to support CND service by
April, 1992:  Alaska, Arizona, California, Colorado, Illinois,
Indiana, Iowa, Massachusetts, Mississippi, New Hampshire, New
York, North Carolina, North Dakota, Ohio, Oregon, Rhode Island,
and South Carolina.

PARAMETERS
The data signalling interface has the following characteristics:
        Link Type:                              2-wire, simplex
        Transmission Scheme:            Analog, phase-coherent FSK
        Logical 1 (mark)                        1200 +/- 12 Hz
        Logical 0 (space)                       2200 +/- 22 Hz
        Transmission Rate:                      1200 bps
        Transmission Level:                     13.5 +/- dBm into 900 ohm load

(I have copied this data as presented.  I believe the
transmission level is meant to be -13.5 dBm.)

PROTOCOL
The protocol uses 8-bit data words (bytes), each bounded by a
start bit and a stop bit.  The CND message uses the Single Data
Message format shown below.

Channel Carrier Message Message Data            Checksum
Seizure Signal   Type    Length Word(s)   Word
Signal                   Word     Word

CHANNEL SEIZURE SIGNAL
The channel seizure is 30 continuous bytes of 55h (01010101)
providing a detectable alternating function to the CPE (i.e. the
modem data pump).

CARRIER SIGNAL
The carrier signal consists of 130 +/- 25 mS of mark (1200 Hz) to
condition the receiver for data.

MESSAGE TYPE WORD
The message type word indicates the service and capability
associated with the data message.  The message type word for CND
is 04h (00000100).

MESSAGE LENGTH WORD
The message length word specifies the total number of data words
to follow.

DATA WORDS
The data words are encoded in ASCII and represent the following
information:

o  The first two words represent the month
o  The next two words represent the day of the month
o  The next two words represent the hour in local military time
o  The next two words represent the minute after the hour
o  The calling party's directory number is represented by the
   remaining  words in the data word field

If the calling party's directory number is not available to the
terminating central office, the data word field contains an ASCII
"O".  If the calling party invokes the privacy capability, the
data word field contains an ASCII "P".

CHECKSUM WORD
The Checksum Word contains the twos complement of the modulo 256
sum of the other words in the data message (i.e., message type,
message length, and data words).  The receiving equipment may
calculate the modulo 256 sum of the received words and add this
sum to the reveived checksum word.  A result of zero generally
indicates that the message was correctly received.  Message
retransmission is not supported.

EXAMPLE CND SINGLE DATA MESSAGE
An example of a received CND message, beginning with the message
type word, follows:

04 12 30 39 33 30 31 32 32 34 36 30 39 35 35 35 31 32 31 32 51

04h=    Calling number delivery information code (message type word)
12h= 18 decimal; Number of data words (date,time, and directory
        number words)
ASCII 30,39= 09; September
ASCII 33,30= 30; 30th day
ASCII 31,32= 12; 12:00 PM
ASCII 32,34= 24; 24 minutes (i.e., 12:24 PM)
ASCII 36,30,39,35,35,35,31,32,31,32= [phone]; calling
                          party's directory number
51h=    Checksum Word

DATA ACCESS ARRANGEMENT (DAA) REQUIREMENTS
To receive CND information, the modem monitors the phone line
between the first and second ring bursts without causing the DAA
to go off hook in the conventional sense, which would inhibit the
transmission of CND by the local central office.  A simple
modification to an existing DAA circuit easily accomplishes the
task.

(I will mail the Rockwell data sheet, which includes the
suggested schematic diagram.)

MODEM REQUIREMENTS
Although the data signalling interface parameters match those of
a Bell 202 modem, the receiving CPE need not be a Bell 202
modem.  A V.23 1200 bps modem receiver may be used to demodulate
the Bell 202 signal.  The ring indicate bit (RI) may be used on a
modem to indicate when to monitor the phone line for CND
information.  After the RI bit sets, indicating the first ring
burst, the host waits for the RI bit to reset.  The host then
configures the modem to monitor the phone line for CND
information.

(I'm skipping some Rockwell-specific information here.)

According to Bellcore specifications, CND signalling starts as
early as 300 mS after the first ring burst and ends at least 475
mS before the second ring burst

APPLICATIONS
Modem manufacturers will soon be implementing new modem features
based on CND information as this service becomes widely
available.

Once CND information is received the user may process the
information in a number of ways.

1.      The date, time, and calling party's directory number can be
        displayed.

2.      Using a look-up table, the calling party's directory number
        can be correlated with his or her name and the name
        displayed.

3.      CND information can also be used in additional ways such as
        for:

        a.  Bulletin board applications
        b.  Black-listing applications
        c.  Keeping logs of system user calls, or
        d.  Implementing a telemarketing data base

REFERENCES
For more information on Calling Number Delivery (CND), refer to
Bellcore publications TR-TSY-000030 and TR-TSY-000031.

To obtain Bellcore documents contact:

        Bellcore Customer Service
        60 New England Avenue, Room 1B252
        Piscataway, NJ   08834-4196
        [phone]










=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

                          -=-  The Empire Times  -=-
                        Volume 1, Issue 2, File 7 of 11
                            ``Foiling the Cracker''


A Survey of, and Improvements to, Password Security
This work was sponsored in part by the U.S. Department of Defense.
Daniel V. Klein
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, PA  15217
[e-mail]
[phone]

With the rapid burgeoning of national and international networks, the
question of system security has become one of growing importance.  High speed
inter-machine communication and even higher speed computational processors
have made the threats of system ``crackers,'' data theft, data corruption
very real.  This paper outlines some of the problems of
current password security by demonstrating the ease by which individual
accounts may be broken.  Various techniques used by crackers are outlined,
and finally one solution to this point of system vulnerability, a proactive
password checker, is proposed.

Introduction

The security of accounts and passwords has always been a concern for the
developers and users of Unix.
When Unix was younger, the password encryption algorithm was a simulation of
the M-209 cipher machine used by the U.S. Army during World War II.
Robert T. Morris
Ken Thompson
Password Security: A Case History
Communications of the ACM
22
11
594-597
November 1979
Morris1979

This was a fair encryption mechanism in that it was difficult to invert under
the proper circumstances, but suffered in that it was too fast an algorithm.
On a PDP-11/70, each encryption took approximately 1.25ms, so that it was
possible to check roughly 800 passwords/second.  Armed with a dictionary of
250,000 words, a cracker could compare their encryptions with those all stored
in the password file in a little more than five minutes.  Clearly, this was a
security hole worth filling.

In later (post-1976) versions of Unix, the DES algorithm

 Proposed Federal Information Processing Data Encryption Standard
 Federal Register (40FR12134)
 March 17, 1975

 DES1975 was used to encrypt passwords.  The user's password is used as the DES
key, and the algorithm is used to encrypt a constant.  The algorithm is
iterated 25 times, with the result being an 11 character string plus a
2-character ``salt.''  This method is  similarly difficult to decrypt (further
complicated through the introduction of one of 4096 possible salt values) and
had the added advantage of being slow.  On a \(*mVAX-II (a machine substant-
ially faster than a PDP-11/70), a single encryption takes on the order of
280ms, so that a determined cracker can only check approximately 3.6
encryptions a second.

Checking this same dictionary of 250,000 words would now take over 19
hours of CPU time.  Although this is still not very much time to break
a single account, there is no guarantee that this account will use one of
these words as a password.  Checking the passwords on a system with 50
accounts would take on average 40 CPU days (since the random selection
of salt values practically guarantees that each user's password will be
encrypted with a different salt), with no guarantee of success.  If this new,
slow algorithm was combined with the user education needed to prevent the
selection of obvious passwords, the problem seemed solved.
Regrettably, two recent developments and the recurrence of an old one have
brought the problem of password security back to the fore.
CPU speeds have gotten increasingly faster since 1976, so much so that
processors that are 25-40 times faster than the PDP-11/70 (e.g., the
DECstation 3100 used in this research) are readily
available as desktop workstations.  With inter-networking, many sites have
hundreds of the individual workstations connected together, and enterprising
crackers are discovering that the ``divide and conquer'' algorithm can
be extended to multiple processors, especially at night when those processors
are not otherwise being used.  Literally thousands of times the computational
power of 10 years ago can be used to break passwords.
New implementations of the DES encryption algorithm have been developed, so
that the time it takes to encrypt a password and compare the encryption
against the value stored in the password file has dropped below the 1ms mark.
 Matt Bishop
 An Application of a Fast Data Encryption Standard Implementation
 Computing Systems
 1
 3
 221-254
 Summer 1988
 Bishop1988

 David C. Feldmeier
 Philip R. Karn
 UNIX Password Security \- Ten Years Later
 CRYPTO Proceedings
 Summer 1989
 Feldmeier1989

On a single workstation, the dictionary of 250,000 words can once
again be cracked in under five minutes.  By dividing the work across multiple
workstations, the time required to encrypt these words against all 4096 salt
values could be no more than an hour or so.  With a recently described
hardware implementation of the DES algorithm, the time for each encryption
can be reduced to approximately 6 ms.

 Philip Leong
 Chris Tham
 UNIX Password Encryption Considered Insecure
 USENIX Winter Conference Proceedings
 January 1991
 Leong1991

This means that this same dictionary can be be cracked in only 1.5 seconds.
Users are rarely, if ever, educated as to what are wise choices for
passwords.  If a password is in a dictionary, it is extremely vulnerable to
being cracked, and users are simply not coached as to ``safe'' choices for
passwords.  Of those users who are so educated, many think that simply
because their password is not in /usr/dict/words, it is safe from
detection.  Many users also say that because they do not have any private
files on-line, they are not concerned with the security of their account,
little realizing that by providing an entry point to the system they allow
damage to be wrought on their entire system by a malicious cracker.
Because the entirety of the password file is readable by all users, the
encrypted passwords are vulnerable to cracking, both on-site and off-site.
Many sites have responded to this threat with a reactive solution \- they
scan their own password files and advise those users whose passwords they are
able to crack.  The problem with this solution is that while the local site
is testing its security, the password file is still vulnerable from the
outside.  The other problems, of course, are that the testing is very time
consuming and only reports on those passwords it is able to crack.  It does
nothing to address user passwords which fall outside of the specific test
cases (e.g., it is possible for a user to use as a password the letters
``qwerty'' \- if this combination is not in the in-house test dictionary, it
will not be detected, but there is nothing to stop an outside cracker from
having a more sophisticated dictionary!).
Clearly, one solution to this is to either make /etc/passwd unreadable,
or to make the encrypted password portion of the file unreadable.  Splitting
the file into two pieces \- a readable /etc/passwd with all but the
encrypted password present, and a ``shadow password'' file that is only
readable by root is the solution proposed by Sun Microsystems (and
others) that appears to be gaining popularity.  It seems, however, that this
solution will not reach the majority of non-Sun systems for quite a while,
nor even, in fact, many Sun systems, due to many sites'
reluctance to install new releases of software.

The problem of lack of password security is not just endemic to Unix.  A
recent Vax/VMS worm had great success by simply trying the username as the
password.  Even though the VMS user authorization file is inaccessible to
ordinary users, the cracker simply tried a number of ``obvious'' password
choices \- and easily gained access.
What I propose, therefore, is a publicly available \fIproactive\fR password
checker, which will enable users to change their passwords, and to
check a priori whether the new password is ``safe.''  The criteria for
safety should be tunable on a per-site basis, depending on the degree of
security desired.  For example, it should be possible to specify a minimum
length password, a restriction that only lower case letters are not allowed,
that a password that looks like a license plate be illegal, and so on.
Because this proactive checker will deal with the pre-encrypted passwords, it
will be able to perform more sophisticated pattern matching on the password,
and will be able to test the safety without having to go through the effort of
cracking the encrypted version.  Because the checking will be done
automatically, the process of education can be transferred to the machine,
which will instruct the user \fIwhy\fR a particular choice of password is bad.

Password Vulnerability
It has long been known that all a cracker need do to acquire access to a
Unix machine is to follow two simple steps, namely:
Acquire a copy of that site's /etc/passwd file, either through an
unprotected uucp link, well known holes in sendmail, or via
ftp or tftp.

Apply the standard (or a sped-up) version of the password encryption
algorithm to a collection of words, typically /usr/dict/words plus some
permutations on account and user names, and compare the encrypted results to
those found in the purloined /etc/passwd file.

If a match is found (and often at least one will be found), the
cracker has access to the targeted machine.  Certainly, this mode of attack
has been known for some time,

 Eugene H. Spafford
 The Internet Worm Program: An Analysis
 Purdue Technical Report CSD-TR-823
 Purdue University
 November 29, 1988
 Spafford1988

and the defenses against this attack have also
long been known.  What is lacking from the literature is an accounting of
just how vulnerable sites are to this mode of attack.  In short, many people know that there is a problem, but few people believe it applies to them.
``There is a fine line between helping
administrators protect their systems and providing a cookbook for bad guys.''

 F. Grampp
 R. Morris
 Unix Operating System Security
 AT&T Bell Labs Technical Journal
 63
 8
 1649-1672
 October 1984
 Grampp1984

The problem here, therefore, is how to divulge useful information on the
vulnerability of systems, without providing too much information, since
almost certainly this information could be used by a cracker to break into
some as-yet unviolated system.
Most of the work that I did was of a
general nature \- I did not focus on a particular user or a
particular system, and I did not use any personal information that might be
at the disposal of a dedicated ``bad guy.''  Thus any results which I have
been able to garner indicate only general trends in password usage, and
cannot be used to great advantage when breaking into a particular system.  This
generality notwithstanding, I am sure that any self-respecting cracker would
already have these techniques at their disposal, and so I am not bringing to
light any great secret.  Rather, I hope to provide a basis for protection for
systems that can guard against future attempts at system invasion.

The Survey and Initial Results

In October and again in December of 1989, I asked a number of friends and
acquaintances around the United States and Great Britain to participate
in a survey.  Essentially what I asked them to do was to mail me a copy of
their /etc/passwd file, and I would try to crack their passwords (and
as a side benefit, I would send them a report of the vulnerability of their
system, although at no time would I reveal individual passwords nor even of
their sites participation in this study).  Not surprisingly, due to the
sensitive nature of this type of disclosure, I only received a small fraction
of the replies I hoped to get, but was nonetheless able to acquire a database
of nearly 15,000 account entries.  This, I hoped, would provide a
representative cross section of the passwords used by users in the community.
Each of the account entries was tested by a number of intrusion strategies,
which will be covered in greater detail in the following section.  The
possible passwords that were tried were based on the user's name or account
number, taken from numerous dictionaries (including some containing
foreign words, phrases, patterns of keys on the keyboard, and enumerations),
and from permutations and combinations of words in those dictionaries.
All in all, after nearly 12 CPU months of rather exhaustive testing,
approximately 25% of the passwords had been guessed.  So that you do not
develop a false sense of security too early, I add that 21% (nearly 3,000
passwords) were guessed in the first week, and that in the first 15
minutes of testing, 368 passwords (or 2.7%) had been cracked using what
experience has shown
would be the most fruitful line of attack (i.e., using the user or
account names as passwords).  These statistics are
frightening, and well they should be.  On an average system with 50
accounts in the /etc/passwd file, one could expect the first account to
be cracked in under 2 minutes, with 5\-15 accounts being cracked by the end of
the first day.  Even though the \fBroot\fR account may not be cracked, all it
takes is one account being compromised for a cracker to establish a toehold
in a system.  Once that is done, any of a number of other well-known security
loopholes (many of which have been published on the network) can be used to
access or destroy any information on the machine.

It should be noted that the results of this testing do not give us any
indication as to what the \fIuncracked\fR passwords are.  Rather, it only
tells us what was essentially already known \- that users are likely to use
words that are familiar to them as their passwords.

 Bruce L. Riddle
 Murray S. Miron
 Judith A. Semo
 Passwords in Use in a University Timesharing Environment
 Computers & Security
 8
 7
 569-579
 November 1989
 Riddle1989

What new information it did provide, however, was the \fIdegree\fR of
vulnerability of the systems in question, as well as providing a basis for
developing a proactive password changer \- a system which pre-checks a
password before it is entered into the system, to determine whether that
password will be vulnerable to this type of attack.  Passwords which can be
derived from a dictionary are clearly a bad idea,

 Ana Marie De Alvare
 E. Eugene Schultz, Jr.
 A Framework for Password Selection
 USENIX UNIX Security Workshop Proceedings
 August 1988
 Alvare1988

and users should be
prevented from using them.  Of course, as part of this censoring process,
users should also be told why their proposed password is not good, and
what a good class of password would be.

As to those passwords which remain unbroken, I can only conclude that these
are much more secure and ``safe'' than those to be found in my dictionaries.
One such class of passwords is word pairs, where a password consists of two
short words, separated by a punctuation character.  Even if only words of
3 to 5 lower case characters are considered, /usr/dict/words provides
3000 words for pairing.  When a single intermediary punctuation character is
introduced, the sample size of 90,000,000 possible passwords is rather
daunting.  On a DECstation 3100, testing each of these passwords against that
of a single user would require over 25 CPU hours \- and even then, no
guarantee exists that this is the type of password the user chose.
Introducing one or two upper case characters into the password raises the
search set size to such magnitude as to make cracking untenable.

Another ``safe'' password is one constructed from the initial letters of an
easily remembered, but not too common phrase.  For example, the phrase ``Unix
is a trademark of Bell Laboratories'' could give rise to the password
``UiatoBL.''  This essentially creates a password which is a random string of
upper and lower case letters.  Exhaustively searching this list at 1000 tests
per second with only 6 character passwords would take nearly 230 CPU
days.  Increasing the phrase size to 7 character passwords makes the
testing time over 32 CPU years \- a Herculean task that even the most
dedicated cracker with huge computational resources would shy away from.

Thus, although I don't know what passwords were chosen by those users I was
unable to crack, I can say with some surety that it is doubtful that anyone
else could crack them in a reasonable amount of time, either.

Method of Attack

A number of techniques were used on the accounts in order to determine if the
passwords used for them were able to be compromised.  To speed up testing,
all passwords with the same salt value were grouped together.  This way, one
encryption per password per salt value could be performed, with multiple
string comparisons to test for matches.  Rather than considering 15,000
accounts, the problem was reduced to 4,000 salt values.  The password tests
were as follows:


Try using the user's name, initials, account name, and other relevant
personal information as a possible password.  All in all, up to 130 different
passwords were tried based on this information.  For an account name
klone with a user named ``Daniel V. Klein,'' some of the passwords that
would be tried were: klone, klone0, klone1, klone123, dvk, dvkdvk, dklein,
DKlein, leinad, nielk, dvklein, danielk, DvkkvD, DANIEL-KLEIN, (klone),
KleinD, etc.

Try using words from various dictionaries.  These included lists of men's and
women's names (some 16,000 in all); places (including permutations so that
``spain,'' ``spanish,'' and ``spaniard'' would all be considered); names of
famous people; cartoons and cartoon characters; titles, characters, and
locations from films and science fiction stories; mythical creatures
(garnered from Bulfinch's mythology and dictionaries of mythical beasts);
sports (including team names, nicknames, and specialized terms); numbers
(both as numerals \- ``2001,'' and written out \- ``twelve''); strings of
letters and numbers ( ``a,'' ``aa,'' ``aaa,'' ``aaaa,'' etc.); Chinese
syllables (from the Pinyin Romanization of Chinese, a international standard
system of writing Chinese on an English keyboard); the King James Bible;
biological terms; common and vulgar phrases (such as ``fuckyou,'' ``ibmsux,''
and ``deadhead''); keyboard patterns (such as ``qwerty,'' ``asdf,'' and
``zxcvbn''); abbreviations (such as ``roygbiv'' \- the colors in the rainbow,
and ``ooottafagvah'' \- a mnemonic for remembering the 12 cranial nerves);
machine names (acquired from /etc/hosts); characters, plays, and
locations from Shakespeare; common Yiddish words;  the names of asteroids;
and a collection of words
>from various technical papers I had previously published.
All told, more than 60,000 separate words were considered per user (with any
inter- and intra-dictionary duplicates being discarded).

Try various permutations on the words from step 2.  This included making the
first letter upper case or a control character, making the entire word
upper case, reversing the word (with and without the aforementioned
capitalization), changing the letter `o' to the digit `0' (so that the word
``scholar'' would also be checked as ``sch0lar''), changing the letter `l' to
the digit `1' (so that ``scholar'' would also be checked as ``scho1ar,''
and also as ``sch01ar''), and performing similar manipulations to change the
letter `z' into the digit `2', and the letter `s' into the digit `5'.
Another test was to make the word into a plural (irrespective of whether the
word was actually a noun), with enough intelligence built in so that
``dress'' became ``dresses,'' ``house'' became ``houses,'' and ``daisy''
became ``daisies.''  We did not consider pluralization rules exhaustively,
though, so that ``datum'' forgivably became ``datums'' (not ``data''), while
``sphynx'' became ``sphynxs'' (and not ``sphynges'').  Similarly, the suffixes
``-ed,'' ``-er,'' and ``-ing'' were added to transform words like ``phase''
into ``phased,'' ``phaser,'' and ``phasing.''  These 14 to 17 additional
tests per word added another 1,000,000 words to the list of possible
passwords that were tested for each user.

Try various capitalization permutations on the words from step 2 that were not
considered in step 3.  This included all single letter capitalization
permutations (so that ``michael'' would also be checked as ``mIchael,''
``miChael,'' ``micHael,'' ``michAel,'' etc.), double letter capitalization
permutations (``MIchael,'' ``MiChael,'' ``MicHael,'' ... , ``mIChael,''
``mIcHael,'' etc.), triple letter permutations, and so on.  The single letter
permutations added roughly another 400,000 words to be checked per user,
while the double letter permutations added another 1,500,000 words.  Three
letter permutations would have added at least another 3,000,000 words \fIper
user\fR had there been enough time to complete the tests.  Tests of 4, 5, and
6 letter permutations were deemed to be impracticable without much more
computational horsepower to carry them out.

Try foreign language words on foreign users.  The specific test that was
performed was to try Chinese language passwords on users with Chinese names.
The Pinyin Romanization of Chinese syllables was used, combining syllables
together into one, two, and three syllable words.  Because no tests were
done to determine whether the words actually made sense, an exhaustive search
was initiated.  Since there are 398 Chinese syllables in the Pinyin system,
there are 158,404 two syllable words, and slightly more than 16,000,000 three
syllable words.

The astute reader will notice that 398\s-2\u3\d\s+2 is in fact 63,044,972.
Since Unix passwords are truncated after 8 characters, however, the number
of unique polysyllabic Chinese passwords is only around 16,000,000.
Even this reduced set was too large to complete under the imposed time
constraints.

A similar mode of attack could as easily be used with English, using rules
for building pronounceable nonsense words.

Try word pairs.  The magnitude of an exhaustive test of this nature is
staggering.  To simplify this test, only words of 3 or 4 characters in length
>from /usr/dict/words were used.  Even so, the number of word pairs is
\fBO\fR(10\s-3\u7\d\s+3) (multiplied by 4096 possible salt values), and as of
this writing, the test is only 10% complete.


For this study, I had access to four DECstation 3100's, each of which was
capable of checking approximately 750 passwords per second.  Even with this
total peak processing horsepower of 3,000 tests per second (some machines were
only intermittently available), testing the \fBO\fR(10\s-3\u10\d\s+3)
password/salt pairs for the first four tests
required on the order of 12 CPU months of computations.  The remaining
two tests are still ongoing after an additional 18 CPU months of computation.
Although for research purposes this is well within acceptable ranges, it is a
bit out of line for any but the most dedicated and resource-rich cracker.

Summary of Results

The problem with using passwords that are derived directly from obvious words
is that when a user thinks ``Hah, no one will guess this permutation,'' they
are almost invariably wrong.  Who would ever suspect that I would find their
passwords when they chose ``fylgjas'' (guardian creatures from Norse
mythology), or the
Chinese word for ``hen-pecked husband''?  No matter what words or permutations
thereon are chosen for a password, if they exist in some dictionary, they are
susceptible to directed cracking.  The following table give an overview of
the types of passwords which were found through this research.

A note on the table is in order.  The number of
matches given from a particular dictionary is the total number of matches,
irrespective of the permutations that a user may have applied to it.  Thus, if
the word ``wombat'' were a particularly popular password from the biology
dictionary, the following table will not indicate whether it was entered as
``wombat,'' ``Wombat,'' ``TABMOW,'' ``w0mbat,'' or any of the other 71 possible
differences that this research checked.  In this way,
detailed information can be divulged without providing much knowledge to
potential ``bad guys.''

Additionally, in order to reduce the total search time that was needed for
this research, the checking program eliminated both inter- and
intra-dictionary duplicate words.  The dictionaries are listed in the order
tested, and the total size of the dictionary is given in addition to
the number of words that were eliminated due to duplication.  For
example, the word ``georgia'' is both a female name and a place, and is only
considered once.  A password which is identified as being found in the common
names dictionary might very well appear in other dictionaries.  Additionally,
although ``duplicate,'' ``duplicated,'' ``duplicating'' and ``duplicative'' are
all distinct words, only the first eight characters of a password are used in
Unix, so all but the first word are discarded as redundant.

box, tab(:), center;
cp+2fB s   s   s   s   s   s
cfB cfB cfB cfB cfB cfB cfB
cfB cfB cfB cfB cfB cfB cfB
l   n   n   n   n   n   n  .
Passwords cracked from a sample set of 13,797 accounts

Type of:Size of:Duplicates:Search:# of:Pct.:Cost/Benefit
Password:Dictionary:Eliminated:Size:Matches:of Total:Ratio\s-2\u*\d\s+2
User/account name:130\s-3\u\(dg\d\s+3:\-:130:368:2.7%:2.830
Character sequences:866:0:866:22:0.2%:0.025
Numbers:450:23:427:9:0.1%:0.021
Chinese:398:6:392:56:0.4%\s-3\u\(dd\d\s+3:0.143
Place names:665:37:628:82:0.6%:0.131
Common names:2268:29:2239:548:4.0%:0.245
Female names:4955:675:4280:161:1.2%:0.038
Male names:3901:1035:2866:140:1.0%:0.049
Uncommon names:5559:604:4955:130:0.9%:0.026
Myths & legends:1357:111:1246:66:0.5%:0.053
Shakespearean:650:177:473:11:0.1%:0.023
Sports terms:247:9:238:32:0.2%:0.134
Science fiction:772:81:691:59:0.4%:0.085
Movies and actors:118:19:99:12:0.1%:0.121
Cartoons:133:41:92:9:0.1%:0.098
Famous people:509:219:290:55:0.4%:0.190
Phrases and patterns:998:65:933:253:1.8%:0.271
Surnames:160:127:33:9:0.1%:0.273
Biology:59:1:58:1:0.0%:0.017
\fI/usr/dict/words\fR:24474:4791:19683:1027:7.4%:0.052
Machine names:12983:3965:9018:132:1.0%:0.015
Mnemonics:14:0:14:2:0.0%:0.143
King James bible:13062:5537:7525:83:0.6%:0.011
Miscellaneous words:8146:4934:3212:54:0.4%:0.017
Yiddish words:69:13:56:0:0.0%:0.000
Asteroids:3459:1052:2407:19:0.1%:0.007

Total:86280:23553:62727:3340:24.2%:0.053


In all cases, the cost/benefit ratio is the number of matches divided by the
search size.  The more words that needed to be tested for a match, the lower
the cost/benefit ratio.


The dictionary used for user/account name checks naturally changed
for each user.  Up to 130 different permutations were tried for each.


While monosyllablic Chinese passwords were tried for all users (with 12
matches), polysyllabic Chinese passwords were tried only for users with
Chinese names.  The percentage of matches for this subset of users is 8% \-
a greater hit ratio than any other method.  Because the dictionary size is
over 16\(mu10\s-2\u6\d\s+2, though, the cost/benefit ratio is infinitesimal.


The results are quite disheartening.  The total size of the dictionary was
only 62,727 words (not counting various permutations).  This is much smaller
than the 250,000 word dictionary postulated at the beginning of this paper,
yet armed even with this small dictionary, nearly 25% of the passwords were
cracked!

tab(:), center, box;
cp+2fB  s   s
cfB     cfB cfB
l       n   n.
Length of Cracked Passwords

Length:Count:Percentage

1 character:4:0.1%
2 characters:5:0.2%
3 characters:66:2.0%
4 characters:188:5.7%
5 characters:317:9.5%
6 characters:1160:34.7%
7 characters:813:24.4%
8 characters:780:23.4%


The results of the word-pair tests are not included in either of the two
tables.  However, at the time of this writing, the test was approximately 10%
completed, having found an additional 0.4% of the passwords in the sample
set.  It is probably reasonable to guess that a total of 4% of the passwords
would be cracked by using word pairs.

Action, Reaction, and Proaction

What then, are we to do with the results presented in this paper?  Clearly,
something needs to be done to safeguard the security of our systems from
attack.  It was with intention of enhancing
security that this study was undertaken.  By knowing what kind of passwords
users use, we are able to prevent them from using those that are easily
guessable (and thus thwart the cracker).

One approach to eliminating easy-to-guess passwords is to periodically run a
password checker \- a program which scans \fI/etc/passwd\fR and tries to
break the passwords in it.

 T. Raleigh
 R. Underwood
 CRACK: A Distributed Password Advisor
 USENIX UNIX Security Workshop Proceedings
 August 1988
 Raleigh1988

This approach has two major drawbacks.  The first
is that the checking is very time consuming.  Even a system with only 100
accounts can take over a month to diligently check.  A halfhearted check is
almost as bad as no check at all, since users will find it easy to circumvent
the easy checks and still have vulnerable passwords.  The second drawback is
that it is very resource consuming.  The machine which is being used for
password checking is not likely to be very useful for much else, since a
fast password checker is also extremely CPU intensive.

Another popular approach to eradicating easy-to-guess passwords is to force
users to change their passwords with some frequency.  In theory, while this
does not actually eliminate any easy-to-guess passwords, it prevents the
cracker from dissecting /etc/passwd ``at leisure,'' since once an
account is broken, it is likely that that account will have had it's password
changed.  This is of course, only theory.  The biggest disadvantage is that
there is usually nothing to prevent a user from changing their password from
``Daniel'' to ``Victor'' to ``Klein'' and back again (to use myself as an
example) each time the system demands a new password.  Experience has shown
that even when this type of password cycling is precluded, users are easily
able to circumvent simple tests by using easily remembered (and easily
guessed) passwords such as ``dvkJanuary,'' ``dvkFebruary,'' etc.

 Dr. Brian K Reid
 1989
 DEC Western Research Laboratory
 Personal communication.
 Reid1989

A good
password is one that is easily remembered, yet difficult to guess.  When
confronted with a choice between remembering a password or creating one that
is hard to guess, users will almost always opt for the easy way out, and
throw security to the wind.

Which brings us to the third popular option, namely that of assigned
passwords.  These are often words from a dictionary, pronounceable nonsense
words, or random strings of characters.  The problems here are numerous and
manifest.  Words from a dictionary are easily guessed, as we have seen.
Pronounceable nonsense words (such as ``trobacar'' or ``myclepate'') are
often difficult to remember, and random strings of characters (such as
``h3rT+aQz'') are even harder to commit to memory.  Because these passwords
have no personal mnemonic association to the users, they will often write
them down to aid in their recollection.  This immediately discards any
security that might exist, because now the password is visibly associated
with the system in question.  It is akin to leaving the key under the door
mat, or writing the combination to a safe behind the picture that hides it.

A fourth method is the use of ``smart cards.''  These credit card sized
devices contain some form of encryption firmware which
will ``respond'' to an electronic ``challenge'' issued by the system onto
which the user is attempting to gain acccess.  Without the smart card, the
user (or cracker) is unable to respond to the challenge, and is denied access
to the system.  The problems with smart cards have nothing to do with
security, for in fact they are very good warders for your system.  The
drawbacks are that they can be expensive and must be carried at all times
that access to the system is desired.  They are also a bit of overkill for
research or educational systems, or systems with a high degree of user
turnover.

Clearly, then, since all of these systems have drawbacks in some
environments, an additional
way must be found to aid in password security.

A Proactive Password Checker

The best solution to the problem of having easily guessed passwords on a
system is to prevent them from getting on the system in the first place.  If
a program such as a password checker reacts by detecting guessable
passwords already in place, then although the security hole is found, the hole
existed for as long as it took the program to detect it (and for the user to
again change the password).  If, however, the program which changes user's
passwords (i.e., /bin/passwd) checks for the safety and guessability
before that password is associated with the user's account, then the
security hole is never put in place.

In an ideal world, the proactive password changer would require eight
character passwords which are not in any dictionary, with at least one
control character or punctuation character, and mixed upper and lower case
letters.  Such a degree of security (and of accompanying inconvenience to the
users) might be too much for some sites, though.  Therefore, the proactive
checker should be tuneable on a per-site basis.  This tuning could be
accomplished either through recompilation of the passwd program, or
more preferably, through a site configuration file.

As distributed, the behavior of the proactive checker should be that of
attaining maximum password security \- with the system administrator being
able to turn off certain checks.  It would be desireable to be able to test
for and reject all password permutations that were detected in this research
(and others), including:


tab(:);
c lw(2.3i) c lw(2.3i).
\(bu:T{
Passwords based on the user's account name
T}:\(bu:T{
Passwords based on the user's initials or given name
T}
\(bu:T{
Passwords which exactly match a word in a dictionary (not
just /usr/dict/words)
T}:\(bu:T{
Passwords which match a word in the dictionary with some or all
letters capitalized
T}
\(bu:T{
Passwords which match a reversed word in the dictionary
T}:\(bu:T{
Passwords which match a reversed word in the dictionary with some or all
letters capitalized
T}
\(bu:T{
Passwords which match a word in a dictionary with an arbitrary letter turned
into a control character
T}:\(bu:T{
Passwords which match a dictionary word with the numbers `0', `1', `2', and
`5' substituted for the letters `o', 'l', 'z', and 's'
T}
\(bu:T{
Passwords which are simple conjugations of a dictionary word (i.e., plurals,
adding ``ing'' or ``ed'' to the end of the word, etc.)
T}:\(bu:T{
Passwords which are patterns from the
keyboard (i.e., ``aaaaaa'' or ``qwerty'')
T}
\(bu:T{
Passwords which are shorter than a specific length (i.e., nothing shorter than
six characters)
T}:\(bu:T{
Passwords which consist solely of numeric characters (i.e., Social Security
numbers, telephone numbers, house addresses or office numbers)
T}
\(bu:T{
Passwords which do not contain mixed upper and lower case, or mixed letters
and numbers, or mixed letters and punctuation
T}:\(bu:T{
Passwords which look like a state-issued license plate number
T}


The configuration file which specifies the level of checking need not be
readable by users.  In fact, making this file unreadable by users (and by
potential crackers) enhances system security by hiding a valuable guide
to what passwords are acceptable (and conversely, which kind of
passwords simply cannot be found).

Of course, to make this proactive checker more effective, it woule be
necessary to provide the dictionaries that were used in this research
(perhaps augmented on a per-site basis).  Even more importantly, in addition
to rejecting passwords which could be easily guessed, the proactive password
changer would also have to tell the user why a particular password was
unacceptable, and give the user suggestions as to what an acceptable password
looks like.

Conclusion (and Sermon)

It has often been said that ``good fences make good neighbors.''  On a
Unix system, many users also say that ``I don't care who reads my files, so I
don't need a good password.''  Regrettably, leaving an account vulnerable to
attack is not the same thing as leaving files unprotected.  In the latter
case, all that is at risk is the data contained in the unprotected files,
while in the former, the whole system is at risk.  Leaving the front door to
your house open, or even putting a flimsy lock on it, is an invitation to the
unfortunately ubiquitous people with poor morals.  The same holds true for an
account that is vulnerable to attack by password cracking techniques.

While it may not be actually true that good fences make good neighbors, a
good fence at least helps keep out the bad neighbors.  Good passwords are
equivalent to those good fences, and a proactive checker is one way to
ensure that those fences are in place before a breakin problem occurs.
-- ============ -- =========== -- =========== -- =========== -- =========== --
"The only thing that separates us from the animals is superstition
and mindless rituals".          Daniel Klein    CMU-SEI   +1 412/268-7791
                                                [e-mail]









-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-



                          -=-  The Empire Times  -=-
                        Volume 1, Issue 2, File 8 of 11
                               Phreak Knowledge
                          Written, Edited, and Remixed
                                     By
                                 Rebel Lion


        You are about to witness the power of phreak knowledge.
        Maybe you're a lamer. Maybe you don't know what a lamer is.
        Maybe you just want to know a little bit about phreaking.
        I'm gonna teach you how.




I. Definitions

Dialup: A telephone number used to access a long distance service such
        as MCI. Once accessed, a call may be made through a Calling Card.
        An extender for an LD company.

Calling Card: An account with a LD service such as Sprint or MCI. The card
              itself is plastic and has the subscriber's account number
              printed on the front, resembling a credit card. Never actually
              steal one, for it will be cancelled. Just copy down the number
              and use it for LD or whatever.

INWATS: Inward Wide-Area Tellicommunications Service. WATS is an 800 number.
        Inwards means a WATS that recieves calls, (a normal 1-800 number).

PBX: Private Branch Exchange. An extender owned by a private company that
     allows employees to make calls from outside the company, to be charged
     to the company. Naturally, a phreak uses this oppurtunity to hack out
     the code himself and use the PBX for his own needs.

Loop: A loop involves two phone numbers. One is the tone side, which is called
      by one person. The other is the silent side which is called by the
      second person. The two people can then talk to each other. Used by Ma
      Bell for some stupid testing thing. Used by Joe Phreaker to talk to
      people without giving out his home phone number [voice validation,
      maybe even conference shit].

Ma Bell: A generic term for the phone company, the place you're ripping off.

Bridge: A bridge is one big line where many people can call up and be added
        to an on-going group talk. Used by phreaks for a big conference.

AT&T Alliance Teleconference: A new conference system by AT&T that allows up
                             to 50 people in a conference and can easily
                             be accesed by any payphone with an AT&T calling
                             card. It's made for business pigs, so it's a very
                             un-suspicious user-phreindly system. It's run on
                             a voice system, so its much easier than with an
                             operator.

ANI: Automatic Number Identification. It is used by companies to identify
     the number of the caller. Used by phreaks when beige boxing or using
     a diverter to tell the number they're calling through.

Diverter: Basically calling up a company or small business and accesing
          their outward line. If you're gonna waste your time with this,
          make sure you use an ANI number to tell you actually have
          a diverter, and aren't just hearing your own dial tone
          [its happened].

Local: A non-LD call.

Blue Boxing: The original phreaking. Using a 2600hz tone to seize a trunk
             (using a tone that operators use to connect phone calls).
             You can also move yourself all around the phone company
             when you blue box, because Ma Bell thinks you're an operator.
             This still works under ESS, but if you try it an FCC man will
             be at your door within an hour. See ESS.


Beige Boxing: Using a lineman's handset, or similar homemade device, to
              access other people's lines through a bridge head.

Red Boxing: Using a device ["box"] to produce quarter tones at a phortress
            phone. Free calls.

Black Boxing: Using a device ["box"] to recieve a collect call without
              paying. Does not work under ESS.

ESS: Electronic Switching System. New brand of switching system used by Ma
     Bell. It is a computer program written to monitor, detect, and prosocute
     phreakers to the fullest. ESS detects foreign tones on the line, and
     alerts another computer in the system exactly where the call was                originated. As you can see, this is a dangerous weapon against                  phreakers.

Other switching systems: The original switching system was step by step
                         which used pulse and actually moved a relay for
                         every digit you dialed. Next was crossbar, which
                         had DTMF [touch-tones], but didn't have advanced                                features that ESS has, such as last call re-dial,
                         trace call, other * fucntions, and 911 for emergancy.

VMB: Voice Mail Box. An advanced answering machine where the user pays a VMB
     company to store messages for them, which are then retrieved by the user
     with a code. Phreaks can hack out a VMB's access code, and then change
     the box to their own.

Conference Call: A telephone call where more than two parties [people] talk at                   one time.

Area Code/NPA: First set of 3 digits in a telephone number. NPA-Nxx-xxxx.

Prefix: Second set of 3 digits in a telephone number. NPA-Prefix-xxxx.

Exchange: Last 4 digits of a telephone number. NPA-Nxx-exchange.

CN/A: Customer Name and Address. This is an office that an emplyee of Ma Bell
      calls up to recieve the name and address of someone from their phone
      number. Used by phreaks to see who their ripping off.

Phortress Phone: A standard pay phone.

Phreaking: The illegal use of the phone system by an individual or group.

Phreak: An abuser of the phone system for his own benefit.

Scanning: Either by hand or by using a program, dialing random or sequential              numbers in an exchange, prefix, or NPA, looking for carriers, PBX's,            or other Ma Bell test functions.

Extender: A number used by a LD company that can be dialed free from phortress            phones [950-xxxx]. Provides instant long distance access for calling            card holders.



II. Abbreviations

NPA: Number Planning Area [area code] (703)
Nxx: Prefix (765)
xxxx: Exchange (6567)
VMB: Voice Mail Box
ESS: Electronic Switching System
CN/A: Customer name and Address
PBX: Private Branch Exchange
99xx: A prefix scan (from 7659900 to 7659999)
LD: Long Distance
PIN: Personal Identification Number
WATS: Wide Area Telecommunications Service
XDC:  X digit code, where x the number of digits in the code
ACN: Any standard 10-digit telephone number
CO: Central Office
SxS: Step by Step, the first switching system

III. Conclusion

Phreak Knowledge is very usefull to everyone in the present. Hopefully,
phreaking will not die, and any new technology Ma Bell comes up with,
Phreaks will fight back at. Unfortunatley, ESS has disproven this theory. This
new, electronic switching system, has shown the end to much of our heritage.
Blue Boxing, Black Boxing, and in some places even Red Boxing, have all
been destroyed. We must ban together and fight against these evils, or we all
will perish.


-==============================Thanks=================================-
 Nat X, for teaching me the art of PBX'ing and to go through two of em when
        using Alliance.
 Chuck U Farley, for teaching me to always be cautious.
-==============================Call===================================-
                    Death Row [phone]
-=====================================================================-
                  "All Is Fair In Love And Phreak."
-=====================================================================-

                      ___________________________
                     |                           |
                     |  Phreaking Will Never Die |
                     |___________________________|
                     |                           |
                     |   Rebel Lion  06/20/92    |
                     |___________________________|











-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

                          -=-  The Empire Times  -=-
                        Volume 1, Issue 2, File 9 of 11

             The Beginner's Guide To Hacking On Datapac 1992 Update
                          Written By The Lost Avenger


    Welcome to once again to the first return issue of the UPi newsletter.
This file was originally released for Spectrum Issue #1, and then re-released
in the very first UPi Newsletter (Volume 1, Issue 1) and from there I have now
decided that the public's positive reaction to this file was still so
tremendous that it made me decide to re-release the file again and also
re-write and update it to the 1992 specifications for Datapac.  Hope you enjoy
reading this file as I did writing it.

    After reading through my large collection of g-files.  I have found that
there hasn't been a good text file for beginner about hacking the Datapac
network.  This guide will give a general incite on how to identity different
types of operating systems when you are hacking about Datapac, and on generally
basic information about Datapac.  I hope this will give you more knowledge
about the Datapac network to help get you started.  Hope you learn a lot about
Datapac and enjoy reading it at the same time.  I have released this file in
UPi Issue Number 1 but I have updated it and re-releasing it.

    These are the ten rules of hacking that I go by when I hack around on
systems.  These rules are important in order maintain from being caught or
discovered illegally hacking on a system.

I.    Do not intentionally damage *any* system.
II.   Do not alter any system files other than ones needed to ensure your
      escape from detection and your future access (Trojan Horses, Altering
      Logs, and the like are all necessary to your survival for as long as
      possible.)
III.  Do not leave your (or anyone else's) real name, real handle, or real
      phone number on any system that you access illegally.  They *can* and
      will track you down from your handle!
IV.   Be careful who you share information with.  Feds are getting trickier.
      Generally, if you don't know their voice phone number, name, and
      occupation or haven't spoken with them voice on non-info trading
      conversations, be wary.
V.    Do not leave your real phone number to anyone you don't know.  This
      includes logging on boards, no matter how k-rad they seem.  If you
      don't know the sysop, leave a note telling some trustworthy people
      that will validate you.
VI.   Do not hack government computers.  Yes, there are government systems
      that are safe to hack, but they are few and far between.  And the
      government has infinitely more time and resources to track you down than
      a company who has to make a profit and justify expenses.
VII.  Don't use codes unless there is *NO* way around it (you don't have a
      local Telenet or Tymnet outdial and can't connect to anything 800...)
      You use codes long enough, you will get caught.  Period.
VIII. Don't be afraid to be paranoid.  Remember, you *are* breaking the law.
      It doesn't hurt to store everything encrypted on your hard disk, or
      keep your notes buried in the backyard or in the trunk of your car.
      You may feel a little funny, but you'll feel a lot funnier when you
      when you meet Bruno, your transvestite cellmate who axed his family to
      death.
IX.   Watch what you post on boards.  Most of the really great hackers in the
      country post *nothing* about the system they're currently working
      except in the broadest sense (I'm working on a UNIX, or a COSMOS, or
      something generic.  Not "I'm hacking into General Electric's Voice Mail
      System" or something inane and revealing like that.)
X.    Don't be afraid to ask questions.  That's what more experienced hackers
      are for.  Don't expect *everything* you ask to be answered, though.
      There are some things (LMOS, for instance) that a beginning hacker
      shouldn't mess with.  You'll either get caught, or screw it up for
      others, or both.

    I think in my own opinion the best way to find systems is by scanning them
out.  Getting them off a board or off a friend is not very safe as they may
already have been hacked to death.  Now you are probably wondering how you scan
for systems, well this is what you do.  First you select a four digit number
representing the area you want to scan, for example 4910 or something like
that.  What you do from there is when you connect to the Datapac network (See
Part V for more details on how to connect to Datapac) you type ".." and press
enter.  You should get some kind message such as "DATAPAC: XXXX XXXX" (with
XXXX XXXX the Datapac node number you are on).  Once you get that message you
will enter a four digit number (the prefix) that you have selected, but don't
press enter yet.  After that type in another four digit number (the suffix)
your have selected and press enter.  Datapac will give respond to that by
giving you a Network Message which is discussed later (see Part VII for the
Datapac Network Messages).  These messages will tell you if the system you are
trying to reach is out of service, up, busy, and so on.  If you have
successfully connected to a system and want to disconnect from if and go back
into Datapac type in the following string "<Control>-P Clear <Enter>".  To
continue scanning for more systems just keep on adding one to the last digit of
the number in the suffix that you entered before and press enter.  To keep on
scanning just continue this until whatever suits your needs, for example you
may start scanning at 4910 0000 and could stop scanning at 4910 1000.

    Ok now in this section I will discuss on how to connect to the Datapac
network.  Ok what you do to connect to Datapac is first make sure you computer
is on.  Then you load your terminal program, next call your local Datapac
node.  Once connected type to Datapac type in "..<Enter>".  Datapac will
respond to this with the following message:

    DATAPAC: XXXX XXXX

The XXXX XXXX is the Datapac node number you are on.  If you have a Network
User Identifier (NUI) then you can enter it in the following way, if you don't
have one then skip this part:

    NUI <Your NUI> <Enter>

you will then see the next message:

    PASSWORD:
    XXXXXX

If Datapac did not send that message then that means that NUI that you entered
is not a valid one.  If you did get this message then enter the password
assigned and press enter.  Datapac will respond with either one of the
following messages:

    DATAPAC: network user identifier <Your NUI> active.

which means that the password entered is correct or

    DATAPAC: network user identifier error

which means that the password entered is not correct.  Take note that if you
have the valid NUI and it is on and you want to turn it off then type in the
following command:

    NUI Off<Enter>

>from there Datapac will send:

    DATAPAC: network user identifier not active

which means that you are no longer using the NUI, which also means that won't
be able to connect to NUA's  that don't accept collect calls.  Once you enter
in all that information.. you can know enter in a NUA.  To enter in a NUA just
type in 1+DNIC+NUA (example 1208057040540 for QSD).  If you connect to the NUA
properly then you will get this message:

    DATAPAC: Call connected to: XXXX XXXX

The XXXX XXXX is the NUA that you have requested to connected to, otherwise it
will display a different message which is discussed later on in this document.

    When a Datapac call is established through the network, a call connected
message is received at the originating DTE.  All or some of the following
messages may be identified depending on the type of call, options used for the
call, and the type of destination.

Example:

[HUNTED] [BACKED UP] [BACKED UP & HUNTED]
[i LCN] [P/N PACKETSIZE: (128 OR 256)] [NUI (6 to 8 CHAR)CHARGING]
[CUG:(CUG#)] [REVERSE CHARGE]

MESSAGE                         EXPLANATION

Call connected to: XXXXXXXX     A virtual circuit has been established between
                                an originating DTE and a remote (receiving)
                                DTE.

Hunted                          The remote logical channel is part of a hunt
                                group.

Backed Up                       The call attempt to the remote DTE has failed.
                                The network has re-directed the call to another
                                predetermined DTE that has been optioned as
                                backup.

i                               The call has been placed to an international
                                address.

P                               Priority service.  Packet size: 128.

N                               Normal service.  Packet size: 128 or 256.

DNA                             Data Network Address of the originating DTE.

LCN                             Logical Channel Number of the recipient DTE.

NUI                             The call will be billed to the 6 to 8 character
                                Network User Identifier.

CUG                             The recipient DTE is part of a closed user
                                group.

Reverse Charge                  The recipient DTE has accepted the charge
                                associated with the established call.

    There are thirty-three messages which may appear when you are accessing the
Datapac network.  All of these network-generated messages which are sent to a
terminal, are written as "Datapac: text".  The "text" will be one of the
following messages:

ADDRESS
    This is a Datapac herald message for an SVC terminal.  The "address"
displayed is your Datapac network address.  This message indicates that you are
connected to the Datapac network.  Proceed with the call request command.

{P,R} TERMINAL ADDRESS -- (DESTINATION ADDRESS LOGICAL CHANNEL)
    This is a Datapac herald message for a PVC terminal.  It indicates that you
are connected to the network (address and destination address)

CLOSED USER GROUP ERROR INVALID ADDRESS, MORE THAN 12 DATA CHARACTERS, or COMMA
REQUIRED BEFORE DATA CHARACTERS
    These messages indicate an error in the call request command--correct and
re-enter the command.

CALLED BY [P][R] or [N][I] ADDRESS (XXX)
    This message indicates that a host or terminal has called you.  Proceed
with sign-on.  (Note: P or N denotes grade of service.  R specifies the
charging option, if applicable.  I specifies that it is an international call.
(XXX) specifies the logical channel number if it is a national call, and
specifies the gateway id if it is an international call.

CALL CONNECTED
    This message indicates that the SVC connection between your terminal and
the destination has been established successfully.

RE-ENTER
    This message indicates that a transmission error has occurred in the
current input line.  Re-enter the line.  If the problem persists, report the
trouble to Telecom Canada.

INPUT DATA LOST
    This message indicates that a transmission error has occurred.  Since part
of your input line has already been transmitted to the destination, enter a
"line delete" character for your application and a carriage return (CR).  When
the destination replies, re-enter the line.

PARITY ERROR
    This message indicates that a parity error has occurred in the current
input line from a terminal which is operating in echo mode.  The character
which is in error is not echoed.  Re-enter the character and continue normal
input.  If the problem persists, report the trouble to Telecom Canada.

INPUT ERROR
    This message indicates that there is a network problem, due to overruns.
If the problem occurs often, contact Telecom Canada.

PVC DISCONNECTED - TEMPORARY NETWORK PROBLEM
    This message indicates that a network problem is preventing the requested
call from continuing.  Wait for the Datapac herald message, then continue.  If
the condition persists, contact Telecom Canada.

PVC DISCONNECTED - DESTINATION NOT RESPONDING
    This message indicates that either the access line to the destination, or
the destination itself is down.  Try again later.  If the condition persists,
contact the destination.

PVC DISCONNECTED - REMOTE REQUEST
    This message indicates that the destination has asked that the connection
be discontinued.

INVALID COMMAND
    This message indicates that there is a syntax error in the command.
Correct it and re-enter the command.

COMMAND NOT ALLOWED
    This message indicates that the command which was entered, although
syntactically correct, cannot be implemented either due to the NIM state, or
because it violates and/or conflicts with the service options selected --e.g.,
a call request command, when an SVC is already established.

CALL CLEARED -- DESTINATION BUSY
    This message indicates that the destination computer cannot accept another
call.  Try again later.

CALL CLEARED -- INCOMPATIBLE CALL OPTIONS
    This message indicates that the call request command includes facilities
which are not available at the destination or are incompatible with it.  Verify
and try the call again.  If the problem persists, contact the destination.

CALL CLEARED -- TEMPORARY NETWORK PROBLEM
    This message indicates that a network problem has occurred--try again
later. If the problem persists, report it to Telecom Canada.

CALL CLEARED -- DESTINATION NOT RESPONDING
    This message indicates that the destination is either not acknowledging
your request to connect or it is inoperable.  Try again later.  If the problem
persists, contact the destination.

CALL CLEARED -- ACCESS BARRED
    This message indicates that the network has blocked your call because of a
Closer User Group violation.  Verify the call establishment procedures with the
destination.

CALL CLEARED -- ADDRESS NOT IN SERVICE
    This message indicates that the network address in the call request command
identifies a non-existent destination-- i.e., the address is not yet (or is no
longer) assigned.  Verify the address and re-enter the call request command.
If the condition persists, contact the destination.

CALL CLEARED -- COLLECT CALL REFUSED
    This message indicates that the destination is not willing to accept the
charges for the connection (e.g., it does not accept calls from Datapac public
dial ports).  Verify the call establishment procedures and try the call
again.  If the condition persists, contact the destination.  (See Part VII and
Part VIII for more information.

CALL CLEARED -- LOCAL PROCEDURE ERROR
    This message indicates that a network protocol error has occurred.  Try the
call again.  If the condition persists, report the trouble to Telecom Canada.

CALL CLEARED -- REMOTE PROCEDURE ERROR
    This message indicates that a destination protocol error has occurred.  Try
the call again.  If the condition persists, contact the destination.

CALL CLEARED -- LOCAL DIRECTIVE
    This message indicates that a virtual circuit has been cleared in response
to a clear command from a terminal user.

CALL CLEARED -- REMOTE DIRECTIVE
    This message indicates that a virtual circuit has been cleared in response
to a clear request packet from the destination.

CALL CLEARED -- REMOTE REQUEST
    This message indicates that a virtual circuit has been cleared in response
to an invitation from the destination to clear the call.

RESET -- TEMPORARY NETWORK PROBLEM
    This message indicates that a network problem has occurred on the PVC
connection.  Wait for the Datapac herald message, then continue.  If the
condition persists, report the trouble to Telecom Canada.

RESET -- DESTINATION NOT RESPONDING
    This message indicates that the destination end of the PVC connection is
not responding-- i.e., either the access line to the destination, or the
destination itself, is down.  Try again later.  If the condition persists,
contact the destination.

RESET -- LOCAL PROCEDURE ERROR
    This message indicates that the PVC has been reset because of a network
protocol error.  Wait for the Datapac herald message, then continue.  If the
condition persists, report the trouble to Telecom Canada.

RESET -- REMOTE PROCEDURE ERROR
    This message indicates that the PVC has been reset because of the
destination protocol error.  Wait for the Datapac herald message, then
continue.  If the condition persists, contact the destination.
    If the host computer is connected via the ITHI option, this message
indicates that data has been disregarded due to the host not reacting to flow
control conditions sent by the PAD.

RESET -- LOCAL DESTINATION
    This message is the network's response to a reset command from the terminal
user.  Continue.

RESET -- BY DESTINATION
    This message indicates that the destination has reset the virtual circuit.
Data may have been lost.  Continue.  If the condition persists; report it to
the destination.

RESET -- TEMPORARY NETWORK PROBLEM
    These messages indicate that the network has reset the switched virtual
circuit.  Data may have been lost.  Continue.  If the problem persists, report
it to Telecom Canada.

RESET -- LOCAL PROCEDURE ERROR
    These messages indicate that the network has reset the switched virtual
circuit.  Data may have been lost.  Continue.  If the problem persists, report
it to Telecom Canada.

    Well let me just get back and discuss something that I was talking about
before but didn't go into any great detail about.  The Network User Identifier
(NUI) is a credit card-like system associated with the Datapac Network -
similar to a calling card used to bill long distance calls.  A NUI is a 6-8
character alphanumeric code which is entered during call set-up to indicate an
account to which Datapac calls may be billed.  Associated with each NUI is a
password which is used as a security check when establishing a connection to
the Datapac network.  The password is confidential, known only to the user.

    The purpose of a NUI is to allow a Datapac user to make use of the Datapac
network for data communications without the requirement of a dedicated Datapac
connection or the need for the destination to accept reverse charge calls.
Once the NUI/password pair has been correctly validated, the call is set up to
the requested destination and call usage billed to the NUI/Datapac account
number.

    At call set-up time, the user specifies the NUI and password to the
network.  The password is used by the network to authenticate the use of the
NUI.  After the NUI/password pair has been correctly validated (process whereby
NUI/password is checked by NUI application), the user will be able to bill all
subsequent session usage to the specified NUI.

    There are many useful applications for NUI.  NUI, when provided to
authorized users, can eliminate the need for host to accept reverse charge
calls.  NUI is required by users of public dial who are placing calls to a host
application with the reverse charge blocking option.  NUI permits subscribers
of dedicated and private dial Datapac services to "Third Party" usage charges
to a NUI account.  For example, some users may decide that they do not want
usage charged to the dedicated access line which they are using (i.e., if using
someone else's line/terminal).  By entering the NUI, all usage for subsequent
calls during the same session would be billed to the account associated with
the specified NUI.  NUI permits sender paid calls to domestic Datapac network
addresses and to foreign networks.  Users can make international calls to
overseas networks and charge the call usage to their NUI when using public dial
ports.  Offshore networks accessed via Teleglobe do not accept collect calls.
Users also have the capability of placing sender paid calls to Domestic Datapac
addresses, Telenet, Tymnet, Autonet, ACUNET and DASNET in the United Sates.
NUI is required to complete calls using Datapac indial/outdial ports (i.e.,
devices at destination not connected to Datapac).  NUI can be used to achieve
benefits of departmental accounting.  The Datapac bill is itemized to indicate
the charges related to each NUI.  This will assist in determining which
department has generated usage and the associated charges.

    There are two main components to Datapac billing which is access and usage
Both are billed on a monthly basis.  These are the monthly recurring charges
for dedicated access to the Datapac network.

    Included in this component are; Service charges - The one time service
charge associated with a request for new service or a change to an existing
one.  Monthly charges - The recurring charge for basic dedicated access to the
Datapac network.  Other monthly - The additional recurring charges for any
optional charges features or enhancements (additional VCs, PVCs, CUGs, etc.) to
a dedicated access.

    These are the charges for the variable amounts of customer data sent to and
>from the network.  Included in this component are; Hold charges - Per minute.
This applies only to Public Dial Port and International calls.  Call set-ups
(Call Requests) - Per attempt.  Does not apply to Permanent Virtual Circuit
(PVCs) arrangements.  Resets - Per occurrence when generated by the customer.
PAD usage - Per segment*.  Applies to all services except Datapac 3000.
Network usage - Per segment*.  Rateant  the grade (1,2,3) of the
cities involved (DPSAs) and the distance between them.  Surcharges - An
incremental 5% to 25% surcharge applies to network usage when a premium
throughput class is ordered.  - A 25% surcharge applies to network usage with
customer requested Priority calls.  NUI - although this is a recurring monthly
charge, it is grouped with usage for billing.

    Billing of data packets in Datapac is done in segments and commonly
referred to as KILOSEGMENTS (1000 segments).  In most cases, one segment is
equal to one packet containing from one to 256 characters.  There are some
exceptions; Priority packets - Are a maximum 128 characters and are billed as
one segment, surcharge applies.  512 character packets - Are billed as two
segments.  Packets to/from U.S. networks - Are a maximum 128 characters and
are billed as one segment.  Packets to/from Overseas networks - The
international standard packet size is a maximum 64 characters and is billed as
one segment by Datapac.  Some overseas networks have 128 character packets but
these are billed as two segments.

Network User Identifier (NUI) Charges

                                    Monthly          Service
                                     Rate             Charge

General NUI                          $2.40            $75.00
Corporate NUI                       $50.00           $125.00
Sub-NUI                              $2.40         No charge


General Access Rates

                                      Monthly        Service
                                       Rate           Charge

Closed User Group (CUG)                $1.35          $75.00
  - no charge for CUG options
Reverse Charge Call Feature            $1.35          $22.00
Direct Call Feature                    $4.20          $75.00
Hunt Group                            $55.00          $22.00
Call Redirection                     $157.00          $22.00
- additional charge for diversity
  where available


Usage Rates

Datapac usage includes the following billable components:

Hold Time (1,2)        $0.04/min.    Public Dial and
                                     International ONLY
Call Set-up            $0.01 each    Public Dial/SVCs ONLY
Reset                  $0.01 each    Customer initiated ONLY
PAD usage (1,2)
    Datapac 3101       $0.50/kilosegment
    Datapac 3201       $0.85/kilosegment
    Datapac 3303       $0.70/kilosegment

Network Usage (1)      see following table based on distance
                       and grade

(1) A 25% discount applies to these components for calls initiated and
    completed between 7 PM and 7 AM and on weekends and certain holidays.
    Applies to ** PUBLIC DIAL ONLY**.

(2) PAD and Hold Time charges are applied at both the calling and called end,
    where applicable.

                         M I L E A G E

DPSA (city)      1-100     101-400     401-1000       1000+
-----------      -----     -------     --------       ------
1 to 1           $0.40      $0.65       $1.06          $1.80
1 to 2           $1.01      $1.70       $2.33          $3.50
1 to 3           $1.70      $3.50       $4.13          $4.77
2 to 2           $1.75      $3.34       $4.24          $5.57
2 to 3           $2.44      $4.24       $5.30          $6.41
3 to 3           $3.13      $5.30       $6.36          $7.00

* NOTE : Larger cities are grade 1 Datapac Serving Areas smaller
         cities are grade 3 DPSA's

    The Datapac Summary Usage Statement is monthly statement is free of charge.
It is a summary of all calls that have been billed to the addresses or NUIs
that are part of an account for that billing period

    Because this is a summary, it is not possible to accurately reconcile the
details of any totals on this statement. This is due to the standard accounting
practices of rounding rules, minimum charging and taxing procedures that have
been applied.  If your organization needs this capability, it must be done from
a Detailed Usage Statement.  There are other options that can be considered to
meet these needs such as; reverse charging, NUI, separate accounts or division
codes (where available).  Please discuss this with the Sales Representative of
your local telephone company.

    In addition to the customers account number, dates of the billing period
involved, tax totals and grand total, the following information is supplied;
Billed Address (or NUI and city); Other Address (or City Code if Public Dial
call), # of calls, # of resets, billable units (kilosegments), indication of
surcharges (if applicable), duration of calls, hold charges (if applicable),
and usage charges; A sub total of all above information for each billed address
and Service type of each address

    This information is sorted in descending numerical/ alphabetical order.
This same information is given for the U.S.  and Overseas Summary Usage
Statements and is grouped by Packet Switching Network name.

    A new format for the Datapac Summary Usage Statement will begin
introduction in mid to late 1991.  Improved methods of grouping, sorting and
reporting usage have been introduced as well as some additional details.  Some
major highlights; Title page to display previous 12 months billing history,
page break by service type, sub-totals by service type, final page with
sub-totals of domestic, overseas and International usage with taxes and a grand
total.  The information you need from a summary statement will be easier to
find and handle.

    The Datapac Detailed Usage Statement which is chargeable option.  It is
a monthly statement that details each and every call that has been billed to
the addresses or NUIs that are part of an account for that billing period.

    In addition to the customers account number, the dates of the billing
period involved, tax totals and the grand total, the following information is
supplied for each call; Billed Address or NUI and city, service type, logical
channel (virtual circuit #), throughput class; Other Address and city (only
City if Public Dial call), service type, logical channel (virtual circuit #),
throughput class; Date, local start time and local stop time; Number of resets
(if any); Clear Cause Code; Billable Units (segments) received transmitted;
Call Set-up Class; Hold charges (if applicable); Usage charges and Taxing
province

    This same information is given for the U.S. and overseas calls and grouped
by Packet Switching Network name.

    The calls on this statement are grouped by billed address and other address
then sorted in descending numerical order.  The calls between the Billed and
Other Address are sorted in descending chronological order.

    Each call record on this statement can represent either a portion of or a
complete call.  Under normal circumstances, an accounting record for a call is
generated when a call is cleared, or every 12 hours.  If required, accounting
records can be generated on a call still in session (for variety of network
maintenance reasons).  Therefore, a complete accounting record for a particular
call may appear on more than one line.  Such instances are identified by the
Class and Clear Codes.  If call total is required, it must be calculated
manually.

    Well up to now I have discussed how to connect to Datapac, what a NUI is
and how much it cost for a NUI, summary usage statement, detailed usage
statements and usage statement codes.  Let me changes topics for a minute and
describe the different type of Datapac services available.

    Datapac 3000 is synchronous, application independent service that allows
data terminals (DTE's) and data communicating equipment (DCE) to exchange data
in a packet-mode over a public or private packet switching network.

    The DTE/DCE interface connection, disconnection and transmission rules are
defined in a packet switching protocol called X.25 recommendation which is
developed and governed by the international telephone and telegraph consultativ
committee (CCITT).

    X.25 protocol is a bit oriented framing structure based on the high level
data link control (HDLC).  The CCITT recommendations for X.25 are divided into
three levels, namely:

    The Physical Interface (Level 1) - Specifies the use of four-wire,
point-to-point synchronous circuit between the DTE and the network (DCE).  This
circuit includes two modems or datasets (one connected to the DTE and the other
connected to the network).  Characteristics are: 4-wire point-to-point or dial
via a V.22 bis modem; Full duplex via RS232 convention.

    The Frame Level Logical Interface (Level 2) - Defines the frame level link
procedures used to synchronize transmission, initiate the "handshaking"
necessary to establish the 'R-U-There'/Yes-I-Am sequence, flow control
mechanism and perform error checking of data exchange across the DTE/DCE
interface (link).  the DTE is usually located at the customer premises and is
called host while the DCE is located in the network.  the procedures used to
control the link are defined as commands and responses.  Characteristics are:
HDLC; Link access procedure balanced (LAPB) X.25(80) or X.25(84).

    The Packet Level Logical Interface (Level 3) - Defines the packet formats
and control procedures required to establish a logical path (call request),
exchange information (data packets) and for removing the logical path (clear
request) between the DTE and DCR.  Characteristics are: Logical Channels
(LCN`s); Packet Size; Window Size; And Throughput Class.

    The customer's terminal (Host) is connected to a local modem which in turn,
is connected to a second modem (Remote) in the central office via by 4 wires
which in turn, is connected to a line processing module in the Datapac network.
This configuration is called the DTE/DCE link and can be assigned speeds of
1200 bps through 19200 bps.

    This DTE/DCE link is assigned a unique Datapac network address (DNA) and
other link parameters such as line speed, modem type, flow control and security
by Telecom Canada.

    When the electrical signals are in the correct state as specified in level
1, the Datapac line processing module continuously transmits a CCITT command
called SBMM (Set Asynchronous Balanced Node) to the customer's terminal (Host)
every three seconds.  If the host is ready, it responds to the SABM with a
CCITT response UA (Unnumbered Acknowledgement).  When this occurs, the link is
initialized (level 2 ready), the host and Datapac module exchange restarts or
restart/restart confirmation commands.  When this occurs, the DTE/DCE link
generates a transition to the next X.25 level, level 3.

    The DTE then signals the address it wishes to communicate with in a CCITT
defined call request format (8 digits ), 10 digits if using 9th and 10th digit
subaddressing on a Logical Channel (LCN) Datapac then routes the call request
to the appropriate destination (national or international) and awaits a CCITT
defined call accept packet.  If this occurs, the accept packet is transmitted
back to the originating host and both hosts may now exchange CCITT defined data
packets.  This is called a Switched Virtual Call (SVC); permanent virtual calls
(PVC's) are also offered.  At the end of the session, either host can terminate
the SVC by transmitting a CCITT defined clear request packet.  Up to 255 SVC's
may be supported simultaneously.

    Dial access service is also offered at 2400 bps with a maximum of eight
LCN's over the public telephone network

    Datapac 3000 provides customers with a cost effective service derived from
packet switching technology and X.25 protocol.  Some benefits are: Simultaneous
communication with many (up to 255) different locations, national and
international, error free transmission, system expansion flexibility, cost
containment through reduced host port connections, 24 hours 7 days-a-week
service, lower communication costs, call parameter selection to suit particular
applications.

    Datapac 3101 is a network access service which enables teletypewriter
compatible devices, such as time-sharing terminals, to access the Datapac
network.

    Low speed, asynchronous devices are supported through an Interactive
Terminal Interface (ITI) in a Packet Assembler/Disassembler (PAD), which allows
the devices to access the network over dial-up (DDD) or dedicated access lines.

    ITI, the end-to-end protocol for Datapac 3101 conforms to the CCITT
recommendations X.3, X.28 and X.29 and supports access to the Datapac network
for asynchronous, start-stop character mode terminals.

    X.3 specifies the operation of the pad.  It contains the specifications for
the twelve international parameters and their operation.  Additional domestic
parameters are also in place to meet Canadian market requirements.

    X.28 specifies the command language between the terminal and the PAD.  It
also specifies the conditions which define the command mode and the data
transfer mode.

    X.29 specifies the procedures to be followed by an X.25 DTE to access and
modify the parameters in the pad as well as the data transfer procedure.

    The user needs no special hardware or software to interface a terminal to
the Datapac network.  A knowledge of the ITI procedures is the only requirement
at the terminal end.

    The Datapac 3101 service provides for terminal to host (user's computer)
and terminal to terminal communication.  The host access should conform with
the X.25 protocol, using the Datapac 3000 access service, and also support the
higher level protocol conventions of ITI.  host access may also be provided via
the Datapac 3101 service for some applications.  The Datapac 3101 service also
provides block mode and tape support.

    The Datapac 3201 Network access service which enables various terminals
that are buffered, pollable and operate asynchronously to communicate with host
computers through the Datapac network.

    The Datapac 3201 service is typically used by the general merchandise and
specialty sectors of the retail industry in Canada.  It provides a cost
effective communication solution whenever there is a requirement for sending
small amounts of information to a host computer and obtaining a short response.
The primary applications are on-line compilation of sales data to help in
inventory control, and on-line credit verification to detect fraudulent credit
cards.  Other emerging applications involve trust companies, credit unions,
banks and service stations.

    Datapac 3201 provides support at the customers' terminal end (for example a
retail store) by means of a Packet Assembler/Disassembler (PAD) which is
located in a Telecom Canada member company central office.  The PAD polls the
various devices for information in an on-line real time environment.

    Devices may communicate to the pad via two options: Shared multipoint
multidrop access at 1200 bps, or Dedicated access at 1200, 2400 bps.

    Communication between the PAD and the terminal conforms to the ANSI
(American National Standards Institute) X3.28-1976 ISO (International Standards
Organization) poll/select asynchronous protocol.  Telecom Canada undertakes to
test terminals which support this protocol, prior to connecting them to the
Datapac 3201 network.

    Communication between the customers host computer location and the Datapac
network is accomplished by the use of a X.25 (Datapac 3000) interface which
supports the Datapac 3201 host to PAD "Point-Of-Sale (POS) end to end protocol"
specification.

- Data Collection:  Average 1.7 to 2.3 seconds in the peak periods.

- Inquiry-Response (Credit Check):  Average 2.7 to 4.2 seconds in
  the peak periods.

    A typical retail Datapac 3201 application uses short input and output
messages.  (For example an average of 50 characters).  One kilopacket (1,000
packets or 256,000 bytes) is equal to approximately 1,000 sales transactions or
500 credit authorizations.  Average transaction volume would be less than 5000
packets per day.

    Other optional Datapac network features include Closed User Group (CUG):
Allows devices within one group to communicate only with accredited devices of
the same group, resulting in a high degree of data security.  Additional
options are available to limit call attempts between closed user groups or
within a closed user group, reverse charge call: Allows a user to charge a call
to the destination address, reverse charge call: Reverse charged calls destined
to a Datapac 3201 blocking: address will be blocked by the network.

    Datapac 3303 (BSC) provides polled BSC communications protocol support for
IBM 3270 information display systems or their emulators.

    Datapac 3303 (BSC) supports all the typical on-line inquiry response and
data entry applications normally accessed with these 3270 terminal clusters.

    Datapac 3303 (BSC) is a PAD based service.  The 3270 controllers connect to
the network via PAD's (Packet Assemblers/Disassemblers).  PAD's perform the
host functions of communicating with the 3270 controllers in the binary
synchronous communications polling protocol, and in doing so, eliminate
cross-network polling.

    Datapac 3303 (BSC) connections are dedicated facilities (one per
controller) at speeds of 2400, 4800, or 9600 bps.  A virtual circuit is
maintained for each terminal across the network and out to the host at the
other end via a Datapac 3000 line.  Most Datapac 3303 (BSC) connections
dialogue with hosts that are running Telecom Canada's Datapac access software
(DAS) in their IBM 3720, 3705, 3725 or Amdahl look-alikes front ends.  DAS
supports X.25 connecting.  To the network via Datapac 3000.  It also supports
the end-to-end protocol transporting the 3270 data across the network.

    Aside from lower communications costs, the main reasons for using Datapac
3303 (BSC) are: Ease of network reconfiguration, and dynamic multiple terminal
functionally.

    New on-line systems are economically feasible and equipment changes can be
easily accommodated without disrupting service or affecting the network.
Terminals are now much more versatile than ever before.  The capability exists
to dynamically access multiple hosts and/or applications from the same
destination (either manually, or via a user friendly mnemonic addressing
scheme).  This means terminals behind the same controller can access different
destinations at the same time, saving equipment and communications facilities
costs.  In conjunction with DAS (Datapac Access Software) in the host's front
end, that 3270 terminal can also act as an ASCII asynchronous device and access
such systems as Envoy/100 and iNet.  In addition, each terminal now has the
ability to appear as either a BSC device to a non-SNA host or an SDLC device to
an SNA host in a matter of a few keystrokes.

    There are currently 2 services under Datapac 3303 (SDLC).  They are Datapac
3303/SDLC and Datapac 3303/SDLC Plus.

    Both services allow IBM (and their emulators) devices to access the Datapac
network for the purpose of transmitting data using the SDLC link level
protocol.

    Some common features of the Datapac 3303 (SDLC) are terminal pad based:
The service provides the X.25 framing and de-framing for SDLC data stream as
well as the packetization and de-packetization, QLLC end-to-end protocol: the
service conforms to IBM's QLLC specifications thus making it compatible with
most host X.25 PAD software/hardware implementations, physical unit type 2
accessibility: services such as the IBM 3270, 3177, 52xx, 36xx, 37xx, 47xx,
ATM's, etc.  2.4, 4.8, 9.6 kbps access speeds, Point to point and multipoint
on-net and off-net access, terminal or host initiated calling, normal or
priority packet size option and Closed User Group (CUG) options.

    Datapac 3303/SDLC offers 1 VC per PU (controller), switched and permanent
virtual circuit support, and the following applications: virtual private line
emulation, centralized host processing simple call set up, international (via
Telenet/US) access, and token ring gateway support using the IBM 3174

    Datapac 3303/SDLC Plus offers 1 VC per LU (end user terminal), local
command mode allows call set up and clearing from users terminal, automatic
direct call, mnemonic DMA dialing methods of call set up, switched virtual
circuit support, and the following applications: disaster recovery, alternate
host access using switching capability from user terminal and Datapac options
(packet size, charging, CUG's) at user terminal level.

    Datapac 3304 offers batch terminal support.  It supports RJE (or Remote Job
Entry) batch work stations or communications terminals operating under binary
synchronous communications (BSC) protocols.

    Datapac 3304 allows users operating under IBM's Multileaving Interface
(MLI) protocol to access the Datapac network.  It also supports compatible
computers and terminals using this protocol.  Datapac 3304 supports the bulk
data transfer applications from these remote job entry (RJE) work stations
whin as 'transparent' s'pad-to-pad operation'.  Devices are connected to the Da
dedicated lines aor 9600 bps.  As users groimplement new technology, the termin
upgraded to X.25.

    A typical user profile would include a host with a spooling or queueing
subsystem such as HASP II, JES 2, JES 3, ASP and RSCS, batch terminals such as
the IBM 3777 M2 and Data 100 and to have low to medium volumes to transmit.

    Datapac 3305 also supports a variety of BSC RJE batch work stations such
as IBM 2770, IBM 2780, IBM 3740, IBM 3770 and IBM 3780.

    It provides network access support for those customers using equipment
operating under IBM's point-to-point contention mode protocol and those
compatible computers and terminals using the same protocol.

    Datapac 3305 supports the bulk data transfer (batch transmissions)
applications that occur between terminals, hosts, and a variety of other
devices such as communicating word processors.

    Datapac 3305 provides savings for those customers running low to medium
volume applications.

    Datapac 3305 is a PAD based service.  The RJE (Remote Job-Entry) work
stations access the network via PAD's while the host computer may also use the
Datapac 3305 PAD or connect via an X.25 link on Datapac 3000.

    Datapac 3305 supports three modes of access: Dedicated lines at 2400 or
4800 bps, private dial at 2400 bps and public dial at 2400 bps

    It should be noted that the destination must be dedicated in order to
receive a call.

    Datapac access software (DAS) provides a Datapac (X.25) compatibility for
IBM host computer environments.  Datapac access software (DAS) resides in
customer-provided IBM hardware; the communications controller or front end
processor such as the IBM 3725 or IBM 3705, and co-exists with its compatible
IBM software such as NCP (Network Control Program), EP (Emulation Program) or
PEP (Partitioned Emulation Program).  Datapac access software (DAS)
compatibility also extends to IBM look-alike hardware manufacturers such as
Amdahl.

    DAS-installed host computer environments have access to their Datapac-bound
devices, such as those connected via Datapac 3101, Datapac 3303 (DSI/DSP),
Datapac 3303 (QLLC)*, and Datapac 3305, as well as those devices which are
connected via conventional communications facilities, such as private line or
dial-up.

    DAS can also provide SNA conversion for non-SNA devices, such as conversion
>from 3270 BSC-3 (Datapac 3303 DSI/DSP) to physical unit type 2 (SNA 3270 SDLC
representation), and ASCII/asynchronous (Datapac 3101) to physical unit type 1
(SNA ASCII SDLC representation).  These SNA conversion features allow the
customer to convert his host environment to SNA without modifying or replacing
his existing terminal/device population.  DAS also provides an extended
conversion feature for 3270 devices that modifies the incoming data (3270) to
an ASCII/asynchronous datastream and re-routes the traffic into the Datapac
network.  Thus providing external ASCII database access to the 3270 device
population.

    Other DAS features include multiple host support, transparent path, host to
network callout, extended console routines, code conversion, etc.

    Datapac International provides outgoing and incoming access to 6 U.S. based
Networks and to over 100 packet-switched networks around the world.  To
successfully complete such calls, Datapac has implemented the International
CCITT X.75 procedures and X.121 International numbering plan.  Thus, the
Datapac user originating an international call must use the following format:

                                          (1) (DNIC) (FOREIGN ADDRESS)
                                           :     :          :
     One defines the Datapac International.:     :          :
     Prefix.                                     :          :
                                                 :          :
     Packet networks are identified by a ........:          :
     four digit number called a DNIC                        :
     (data network identification code)                     :
                                                            :
     The foreign national address is .......................:
     expressed as an eight to ten digit
     address.

    Calls to international networks, other than those to the U.S., must be pre-
paid; that is, placed from dedicated or private dial access, m

    The packet size for an international call must be 128 characters.

    On both the Summary and Detailed Usage Statements, Service Type (ST) codes
are used to identify the type of Datapac service involved with a particular
address.

Service  Service
Type     Description
Code

00       U.S. and overseas
01       3000     Dedicated
02       3101     De   Private Dial (300-1200 bps)
04*        "      Pub05 06         "      Out -Dial
07       3201     Shared
08       3303     BSC (DSP)
09       3304     MLI
112        "        "  Private12        "        "  P14       3101     Dedicat1
16*       "       Public Dial (2.4Kbps)
18       3000     Public Dial
19       3303     SDLC (Terminal)
20       3201     Dedicated
21       3303     SDLC (Multihost)
25       3303     SNA/SDLC - Private and Dedicated
26       3001     Enhanced Datapac 3000 Dial trial for off-net in-dial
27       3002     Enhanced Datapac 3000 Dial trial for off-net out-dial

    On the Detailed Usage Statement, a code is used to indicate the class of
the call set-up associated with the associated accounting record of a call.
The following codes are used; C Regular call set-up - A call set-up charge
applies; CP Priority Call set-up - A call set-up charge applies; N No call
set-up - A call set-up charge DOES NOT apply and NP Priority no call set-up - A
call set-up charge DOES NOT apply.

    On the Detailed Usage Statement, a code is used to describe the reason a
particular call cleared.

    At the present time a 3 number code is being used.  This will be replaced
by a 2 character alpha-numeric code in mid-1991.

    A call set-up charge applies to those clear codes denoted by an *

Clear Code     Description

000     00     Trunk network congested
001     01     DSR is invalid
002     02     DSR cannot be reached
003     03     TM not responding
004     04     Address not in tree
005     05     Service down
006     06     Address served not in tree
007     07     Addressed service not ready
010     0A     CPM busy
013     0D     CPM busy
015     0F     Out of norm state - reset
160     A0     Trunk network congested
161     A1     DSR invalid
162     A2     DSR unreachable
163     A3     Time out
164     A4     Address not in tree
165     A5     Service down
166     A6     Network address not found
167 *   A7     Addressed service not ready
173     AD     CPM busy
174     AE     Reset address error
175     AF     Reset state error
176 *   B0     Local user clear (see note)
177 *   B1     Remote user clear
178     B2     Close request from above
179 *   B3     Local procedure error
180 *   B4     Remote procedure error
181     B5     Message not wanted
182     B6     Packet not wanted
183     B7     CPM shot
184     B8     Call collision
185     B9     Network congestion
186     BA     Common block fail
187     BB     Local block fail
189     BD     Invalid call
190     BE     Incoming call prohibited
193 *   C1     Local clear before remote accepted
194     C2     X.75 call to clear
195     C3     X.75 reset to clear
196     C4     NUI barred
198     C6     RPOA required
199     C7     RPOA invalid
208     D0     Packet network address error
209     D1     Service not up
210     D2     Service to go down
212     D3     No links up
212     D4     Links restarting
213 *   D5     Link out of service
214     D6     No more calls
215     D7     Invalid logical channel number
216 *   D8     No free logical channels at called address
217     D9     Nonexistent CUP
218     DA     Failure to set up CUP
219     DB     Application processor busy
220     DC     No application processor
221     DD     Maximum number of facilities exceeded
222 *   DE     Collect call refused
223     DF     CUG violation
224     E0     Illegal facility
225     E1     LRC fail
226     E2     Service coming up
227     E3     Service not up

    Clear code 176 (B0) can also indicate a record was generated by the network
for accounting purposes.  This is most often associated with PVCs or long calls
with a greater than 12 hour duration.  The class for this type of record would
be N or NP.

    In addition to the fixed monthly rates for Datapac access lines and
options, the following charges apply: Internetwork Usage Rates and Holding Time
Charges

                                            $/HOUR FOR       $/HOUR FOR
                       $/KS      $/KS    US ORIGINATED    CDN. ORIGINATED
NETWORK       DNIC    DP3000    DP3101        CALLS            CALLS

ACCUNET       3134    $ 2.65    $ 3.90        $ 2.00       DED.      = $2.00
                                                           PUB. DIAL = $3.80
AUTONET       3126    $ 3.75    $ 5.10        $ 5.10       DED.      = $0.60
                                                           PUB. DIAL = $2.40
BT TYMNET     3106    $ 2.75    $ 5.00        $ 5.60       DED.      = $0.60
                                                           PUB. DIAL = $2.40
FEDEX         3138    $ 2.75    $ 5.10        $ 6.30       DED.      = $0.60
              3150                                         PUB. DIAL = $2.40
NET EXPRESS   3139    $ 2.50     N/A          $ 0.60       DED.      = $0.60
WESTERN       3101    $ 2.50    $ 5.00        $ 1.85       DED.      = $0.60
UNION         3124                                         PUB.DIAL  = $2.40
SPRINTNET     3120    $ 2.75    $ 5.10        $ 6.30       DED.      = $0.60
                                                           PUB. DIAL = $2.40

(NOTE: DATAPAC 3303 (SDLC) IS ALSO SUPPORTED THROUGH SPRINTNET DP 3303 $/KS =
       $5.90 $/HR = NIL )

Notes:
(1) Packet Assembler/Disassembler (PAD) charges are included each band.
(2) Each individual call is rounded up to the next higher minute
(3) Usage charges are calculated on a per Kilo-segment basis.  A KS is 1000
    segments; each segment is up to 128 characters.

    In addition to the fixed monthly rates for U.S. access lines, the
following charges apply: Internetwork Usage Rates and Holding Time Charges

NETWORK       DNIC     $/KS      $/KS       $/HOUR FOR       $/HOUR FOR
                      DP3000    DP3101    US ORIGINATED    CDN. ORIGINATED
                                             CALLS             CALLS

ACCUNET       3134    $ 2.25    $ 3.25       $ 1.80        DED.        $1.80
                                                           PUB. DIAL = $3.25
AUTONET       3126    $ 0.12    $ 0.15       $ 4.50        DED.      = $0.60
                      (kchar)   (kchar)                    PUB. DIAL = $2.40
BT TYMNET     3106    $ 0.07    $ 0.12       $ 4.98        DED.      = $0.48
                      (kchar)   (kchar)                    PUB. DIAL = $1.92
FEDEX         3138    $ 1.50 (   0-1000 ks)  $ 6.00        Not applicable
                      $ 1.40 (1001-2999 ks)
                      $ 1.30 (3000- +   ks)
NET EXPRESS   3139    $2.00       N/A        $ 0.30        DED.      = $0.48
WESTERN UNION 3101    (Not available...)
SPRINTNET     3120    $ 2.35    $ 5.10    DED. = $0.60     DED.      = $0.60
                                          DIAL = $5.10     PUB. DIAL = $2.40

(NOTE: SDLC SERVICE IS ALSO SUPPORTED THROUGH SPRINTNET) DP 3303 $/KS = $4.80
       $/HR = NIL)

Notes:  All above rates are in U.S. Currency
(1) These charges represent both Datapac and selected U.S.  Network holding
    time charges.
(2) BT Tymnet cannot currently make sent-paid calls, but will be able to do so
    shortly.

    The Datapac outdial service is available in eighteen major centers (DPSA's)
are being served by outdial.  They are: Vancouver, Calgary, Edmonton, Regina,
Saskatoon, Winnipeg, Toronto, Clarkson, London, Windsor, Kitchener, Hamilton,
Ottawa, Montreal, Quebec, Halifax, Saint John (NB) and St John's (Nfld) and is
only available at 300 and 1200 BPS.

    The outdial port uses profile 6, except that the user of the is allowed to
escape to command mode by using outdial port "Control P".  The destination
terminal must be set at even parity in order to receive the outdial call.  Once
connected, Datapac 3000 users can set and read the remote ITI parameters by
sending level 1 packets (X.29).

    Establish a call to Datapac via a dedicated or dial-in access.  Note: If
using a dial-in access, a network user identifier (NUI) must be activated
before establishing the call.  Enter the address of the outdial port.  Datapac
will respond with the following:

    DATAPAC:  call connected
    ENTER DESTINATION TELEPHONE NUMBER/ENTRER LE
    NUMERO DE TELEPHONE DU DESTINAIRE

Enter the 7-digit telephone number (Local) of the destination terminal.
Datapac will respond with the following:

    DIALING/COMPOSITION DU NUMERO (XXX-XXXX)

Printing the destination telephone number as it is dialed.  Datapac will
then indicate:

    RINGING/SONNERIE

as the modem detects ringback tone.  When the destination modem answers the
call, Datapac will send the following message to the originating end:

    CALL CONNECTED/COMMUNICATION ETABLIE

then proceed with your call.  To clear a call upon completion, enter the clear
command:

    (Control P) Clear <Enter>

Datapac will respond with the following:

    DATAPAC: call cleared - remote Note: If you have used a NUI to place the ca
the network with the command:

    NUI Off <Enter>

Datapac will respond with the following:

    DATAPAC: network user identifier not active

    Well I have talked about Datapac outdials know I will include a list of
outdial ports for the 18 cities that I mentioned above.  Well here's the list.

Calgary (ALTA)        300       63300900
                     1200       63300901
Clarkson (ONT)        300       91900900
                     1200       91900901
Edmonton (ALTA)       300       58700900
                     1200       58700901
Halifax (NS)          300       76101900
                     1200       76101901
Hamilton (ONT)        300       38500900
                     1200       38500901
Kitchener (ONT)       300       33400900
                     1200       33400901
London (ONT)          300       35600900
                     1200       35600901
Montreal (QUE)        300       82700902
                     1200       82700903
Ottawa (ONT)          300       85700901
                     1200       85700902
Quebec City (QUE)     300       48400900
                     1200       48400901
Regina (SASK)         300       72100900
                     1200       72100901
St-John's (NB)        300       74600900
                     1200       74600901
Saskatoon (SASK)      300       71200900
                     1200       71200901
St. John (NFLD)       300       78100900
                     1200       78100901
Toronto (ONT)         300       91600901
                     1200       91600902
Vancouver (BC)        300       67100900
                     1200       67100901
Windsor (ONT)         300       29500900
                     1200       29500901
Winnipeg (MAN)        300       69200902
                     1200       69200901

    You want to hack a system on Datapac.  So you decided to call and it
connects onto the NUA you want, but you find you are having troubles getting
the system to recognize your input.  So here are some answers to some common
problems people find when connecting to systems.

    The screen remains blank A physical link has failed - check the cables
between computer, modem and phone line.  The remote modem needs waking up -
send a <CR> or failing that, a ENQ <Ctrl> E, character The remote modem is
operating at a different speed.  Some modems can be brought up to speed by
hitting successive <CR>'s; they usually begin at 120 Bps and then go to 300,
and so on up the ladder.  The remote is not working at V21 standards, either
because it is different CCITT standard.  Since different standards tend to have
different wake-up tones which are easily recognized with practice, you may be
able to spot what is happening.  If you are calling a North American service
you should assume Bell tones.  Both your modem and that of the remote service
are in answer or in originate and so cannot speak to each other.  Always assume
you are in the originate mode.

    The screen fills with random characters.  Data format different from your
defaults - check 7 or 8 bit characters, even/odd parity, stop and start bits.
Mismatch of characters owing to misdefined protocol - check start/stop, try
alternatively EOB/ACK and XON/XOFF.  Remote computer operating at a different
speed from you - try in order, 120, 300, 600, 1200, 2400, 4800, 9600, 14400,
19200, 38400.  Poor physical connection - if using an acoustic coupler check
location of handset, if not, listen on line to see if it is noisy or crossed.
The remote service is not using ASCII/International Alphabet No 5.

    Every character appears twice.  You are actually in half-duplex mode and
the remote computer as well as your own are both sending characters to your
screen - switch to full-duplex/echo o    All information appears on only one li
has the facility, enable it to induce carriage returns when each display line
is filled.  many online services and public dial-up ports let you configure the
remote port to send carriage returns and vary line length.  Your software may
have a facility to show control characters, in which case you will see <Ctrl>-K
is the remote service is sending carriage returns.

    Most of the display makes sense, but every so often it becomes garbled.
You have intermittent line noise - check if you can command line the remote
computer to send the same stream again and see if you get the garbling.  The
remote service is sending graphics instructions which your computer and
software can't resolve.

    The display contains recognized characters in definite groupings, but
otherwise makes no sense.  The data is intended for an intelligent terminal
which will combine the transmitted data with a local program so that it makes
sense.  The data is intended for batch processing.  The data is encrypted.

    Data seems to come from the remote computer in jerky bursts rather than as
a smooth stream.  If you are using PSS or a similar packet-switched service and
it is near peak business hours either in your time zone or in that of the host
you are accessing, the effect is due to heavy packet traffic.  There is nothing
you can do - do not send extra commands to speed up twill arrive at the host ev
    Most of the time everything works smoothly, but I can't get past certain
prompts.  The remote servr computenormally generate - check your terminal softw
sending them.

    The following is a list of acronyms and terms which are often referred to
in this document and others dealing with this subject.

ACP - Adapter/Concentrator of Packets.
ASCII - American Standard Code for Information Interchange alternate name for
    International Telegraph Alphabet No 5 - 7 bit code to symbolize common
    characters and comms instructions, usually transmitted as 8 bit code to
    include a parity bit.
Asynchronous - Description of communications which rely on start and stop bits
    synchronize originator and receiver of data = hence asynchronous protocols,
    channels, modems, terminals, etc.
Call Accept - In packet switching, the packet that confirms the party is
    willing to proceed with the call.
Call Redirection - In packet switching, allows call to automatically
    redirected from original address to another, nominated address.
Call Request - In packet switching, packet sent to initiate a datacall.
Closed User Group - A type of high security NUI in use on several PSNs
    throughout the world.  CUG users can access optional parameters and NUAs
    blocked out by security.
CUG - Closed User Group.
Data Circuit Terminating Equipment - Officalese for modems.
Data Country Code - The first three digits in the four digits of any given
    DNIC.
Data Network Identifier Code - The four digits which come before the area
    code/address/port address of any given NUA.  The DNIC shows which PSN any
    given host is based upon.  The DNIC can also be broken down into two parts,
    the DCC and the NC.  For more information, see part VIII.
Data Terminal Equipment - Officalese for computers.
DCC - Data Country Code.
DCE - Data circuit terminating equipment.
Destination Paid Call - A collect call to a NUA which accepts collect charges.
DNIC - Data Network Identifier Code.
DTE - Data Terminal Equipment.
DTE Address - The five digits following the area code of the host on any given
    NUA.  For example, the NUA 234122345678 has a DTE address of 45678.
Gateway - A host on a given PSN which is connected both the the originating PSN
    and one or more different or same PSN's.  Gateways also allow one user on
    one PSN the ability to move to another PSN and operate on the second as if
    the first was not interfering.
Host - Any system accessible by NUA on the PSN.
Hunt/Confirm Sequence - String of characters sent to the SprintNet POTS
    dialin/port which allows SprintNet to determine the speed and data type to
    translate to on its PAD.
ITI Parameters - Online PAD parameters (X.3 or ITI) which allow the user to
    modify existing physical measurements of packet length and otherwise.
LAN - Local Area Network.
Local Area Network - A data network which operates within the confines of an
    office building or other physical structure where several computers are
    linked together into a network in order to share data, hardware, resources,
    etc.  These may or may not own a host address on any data network, and if
    so, may be accessed via NUA; otherwise direct dialin is the only
    alternative.
NC - Network Code.
NCP - Nodes of Communication of Packets.
Network Code - The fourth digit of any given PSN's DNIC.
Network Protocol - The hardware protocol which allows the host systems to
    communicate efficiently with the PSN it is connected to.  Generally,
    synchronous protocols (X.??) are used within the network and asynchronous
    protocols (V.??) are used to access the network, but asynchronous protocols
    within the network and/or synchronous dialin points are not unheard of.
    The standard protocol for packet transfer today is the X.25 synchronous
    data protocol.  For detailed information, please see part V and Appendix F.
Network User Address - The address of any given host system on any PSN.  This
    address is thought of as a "phone number" which is dialed to access the
    desired host.
Network User Identifier - The ID and password which allow the user which has
    logged onto the PSN's PAD to originate calls to host systems which do not
    accept collect calls.  it is often thought of as a "k0de" or a calling card
    which will be billed for at the end of every month.
NUA - Network User Address.
NUI - Network User Identifier.
Outdial - Any system which allows local, national, or international dialing
    from the host system.  PC-Pursuit can be defined as a local outdial system.
    Most outdials operate using the Hayes AT command set and others may be menu
    oriented.
Packet Assembler/Disassembler - The device/host which translates the actual
    input/output between the host and the user.  The PAD often translates
    between baud rates, parities, data bits, stop bits, hardware protocols, and
    other hardware dependant data which reduces the hassle of continual
    modification of terminal and hardware parameters local to the originating
    terminal.
Packet Switched Exchange - Enables packet switching in a network.
Packet Switched Network - A network based upon the principle of packet
    switching, which is the input/output of packets to and from the PAD which
    translates input and output between the user and the host.  For detailed
    information, please see part IV.
Packet Switched System - Another name for the PSN.
Packet Switch Stream - The PSN used by British Telecom.
PAD Delay - The extra time that is used to translate incoming and outgoing
    packets of data which is composed of a continuous stream of clear-to-send
    and ready-to-send signals.  PAD delay can vary depending on the type of
    network protocol and network/port speed is being used.
PAD - Packet Assembler/Disassembler (technical), Public Access Device (customer
    service description).
PDN - Public Data Network or Private Data Network.
Port Address - The two optional digits at the end of any given NUA which allow
    the PAD/PSN to access a given port.  For example, 131202129922255 would
    reach the NUA 31202129922255, 55 being the port address.
Private Data Network - Any network (LAN/WAN/PSN) which is owned and operated by
    a private company.  Private networks are usually smaller than public
    networks and may host a myriad of features such as gateways to other
    public/private networks, servers, or outdials.
PSE - Packet Switch Exchange.
PSN - Packet Switched Network.
PSS - Packet Switch Stream or Packet Switched System.
PTSN - Public Switched Telephone Network.
Public Data Network - Another name for the PSN.
Public Switched Telephone Network - The voice grade telephone network dialed
    from a phone.  Contrast with leased lines, digital networks, conditioned
    lines.
Server - A type of network which is connected to a host system which can be
    reached either via NUA or direct dial which provides the "brain" for a LAN
    or WAN.
V.?? - Asynchronous network protocol.
V1 - Power levels for data transmission over telephone lines.
V3 - International Alphabet No 5 (ASCII).
V4 - General structure of signals of IA5 code for data transmission over public
    telephone network.
V5 - Standardization of modulation rates and data signalling rates for
    synchronous transmission in general switched network.
V6 - Standardization of modulation rates and data signalling rates for
    synchronous transmission on leased circuits.
V13 - Answerback simulator.
V15 - Use of acoustic coupling for data transmission.
V19 - Modems for parallel data transmission using telephone signalling
    frequencies.
V20 - Parallel data transmission modems standardized for universal use in the
    general switched telephone network.
V21 - 300 bps modem standarized.
V22 - 1200 bps full duplex 2-wire modem for PTSN.
V22 bis - 2400 bps full duplex 2-wire modem for PTSN.
V23 - 600/1200 bps modem for PTSN.
V24 - List of definitions for interchange circuits between data terminal
    equipment and data circuit terminating equipment.
V25 - Automatic calling and/or answering equipment on PTSN.
V26 - 2400 bps mode on 4-wire circuit.
V26 bis - 2400/1200 bps modem for PTSN.
V27 - 4800 bps modem for leased circuits.
V27 bis - 4800 bps modem (equalized) for leased circuits.
V27 ter - 4800 bps modem for PTSN.
V29 - 9600 bps modem for leased circuits.
V35 - Data transmission at 48 kbps using 60-108 kHz band circuits.
V42 - Combined error correction and data compression standard to give 9600 bps
    on dial-up lines.
WAN - Wide Area Network.
Wide Area Network - A data network which operates on a continuous link basis as
    opposed to the packet switched basis.  These do not operate on the X.25
    protocol and may only be accessed via direct-dial or a host on a PSN which
    is linked with the WAN.
X.?? - Generally symbolizes some type of synchronous network protocol.
X1 - International user classes of services in public data networks.
X2 - International user facilities in public data networks.
X3 - Packet assembly/disassembly facility (PAD).
X4 - General structure of signals of IA5 code for transmission over public data
    networks.
X20 - Interface between data terminal equipment and a data circuit terminating
    equipment for start stop transmission services on public data networks.
X20 bis - V21 compatible interface.
X21 - Interface for synchronous operation.
X25 - Interface between data terminal equipment and data circuit terminating
    equipment for terminals operating in the packet switch mode on public data
    networks.
X28 - DTE/DCE interface for start/stop mode terminal equipment accessing a
    PAD on a public data network.
X29 - Procedures for exchange of control information and user data between a
    packet modem DTE and a PAD X95 - Network parameters in public data
    networks.
X96 - Call process signals in public data networks X121 - International
    addressing scheme for PDN's.
X400 - Standards for electronic mail, covering addressing and presentation.

    Some interesting books I think you should read that are related to
Phreaking & Hacking:

Cyberpunk - Outlaws And Hackers On The Computer Frontier, By Katie Hafner And
John Markoff, Simon And Schuster Incorporated, Simon And Schuster Building,
Rockefeller Center, 1230 Avenue Of The Americas, New York City, NY 10020, 1991,
368 Pages

Data Theft, By Hugo Cornwall, Mandarin Paperbacks, Michelin House, 81 Fulham
Road, London, England SW3 6RB, 1989, 402 pages

Hacker's - Heros Of The Computer Revolution, By Steven Levy, Bantam Doubleday
Dell Publishing Group Incorporated, 666 Fifth Avenue, New York City, New York
10103, 1985, 448 Pages

New Hacker's Handbook, By Hugo Cornwall, Century Hutchinson Limited,
Brookmount House, 62-65 Chandos Place, Covent Garden, London, England WC2N 4NW,
1989, 194 pages

The Cuckoo's Egg, By Cliff Stoll, Pocket Books A Division Of Simon And Schuster
Incorporated, Simon And Schuster Building, Rockefeller Center, 1230 Avenue Of
The Americas, New York City, NY 10020, 1990, 356 Pages

The Hacker's Handbook, By Hugo Cornwall, E Author Brown Company, 3404 Pawnee
Drive, Alexandia, MN 56308, 1986, 186 Pages













-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-



                          -=-  The Empire Times  -=-
                        Volume 1, Issue 2, File 10 of 11
                         SummerCon '92  (The Conference)
                                 By Albatross





                            ********************
                            *  Empire   Times  *
                            *     Present:     *
                            *                  *
                            *   SummerCon '92  *
                            *   St. Louis,MO   *
                            * June 26th - 28th *
                            ********************






SummerCon:     (Day 2, Saturday June 27th)
----------



        The Morning started off with everybody waking up with hang overs and
  and wet condoms from the previous night with the little girls. Anyhow
  Saturday was the day of the conference which was suppose to begin at 1pm
  but was postpone due to late fucks. ANyhow after the shit got going
  there were some speakers on some intestiing shit with you should check out:


                           SummerCon Conference:
                           --------------------



Dispatar:        Opened up The Meeting with a little chat about Phrack
                and what everything was about etc.. Nothing all That!!

Gatsby:          His Speech was on that crazy 1000 member bust of some carding
                ring way out in California some where that was just blown outta
                proportion. Anyhow Gatsby was saying that the 1,000 member card
                ring was just The Crypt Keeper blabbing his whole fucking story
                to the Feds and more or less did nothing more but rat on
                everybody cause he was scared from the feds {WHAT NOT TO DO!!}
                 Gatsby more or less wrapped it up with by talking about what
                all has happen since that bust and who all was this and that
                etc....

Emmanuel:        Mr 2600 man got up to speak about the beginnings of 2600
                and what all it really stands for and what type do. 2600
                has about 15,000 Subscribers and about 3,000 newstand
                locations, and all there info is encrypted and in very
                secure locations, so in other words nobody knows you from
                your membership info, unless the decide to read the mailing
                labels as there passing thru the Post Office which is a crime
                in the first place..
                 Anyhow Emmanuel is looking for Writers to give 2600 a big
                hand cause there desperate for some writers and he also states
                that he will publish anybody's SSN (ie. George Bush)


Control-C:       Mr Ex-LOD member got up to talk on how he got a job with
                Michigan Bell Security by breaking into there systems, but he
                then lost his job because some Bell employee never liked him
                cause he was a Criminal and shit, and also cause the contract
                said he could break into and test Michigan Bell's security but
                he went over board and the Government said he had no contract
                not to fuck with them. (Fucking Feds)
                 Anyhow The feds bust Control-C and they get other Ex-LOD
                members to testify against Control-C at a grand jury
                investigation so that they would end up with lighter sentences
                and all the wimpy shit that goes alone with that Backstabing
                move..

Signal Surfer:   Super Hacker Signal Surfer talks about his new software
                that he is look for people to Beta test for him on either
                IBM's of Mac's. The Software will allow you to get a legal
                internet account and address so that you can recieve mail
                and read news groups and all that shit (Just not telnet
                or FTP shit).
                 The Software is great cause I'm beta testing it and I love
                it so far, it's great for a email site (Look 4 my address).
                NOTE: If you wish to beta test this software called WorldLink
                you can reach Signal Surfer (Robert Stratton) at:
                InterCon                    Voice:      703-709-9890 ext. 253
                950 Herndon Parkway         FAX:        [phone]
                Herndon, VA 22070           Email:      [e-mail]

Predat0r:        This is the man behind TAP magazine. Dude to the fact
                that predator didn't want Chris Coggins camera on during his
                speech I'll hold back some details on his talk.
                 Pred, was talking about how they did some shit and obtained
                a 3,000 dollar computer so he could run a board But due to
                some problems it had to be sold, and in the process of being
                sold the G-Men snagged them and he served some time behind
                bars. Anyhow on a lighter note, Tap Magazine is planning on
                being back in The Fall of '92 and Tap is also looking for
                writers: You can reach Predator on The Blitzkrieg BBS
                located in Knoxville, Kentucky
                 The Blitzkrieg BBS
                 502-499-8933
                 502-491-5198
                 NUP: Columbian Coke

ICOM:            This is a cool dude behind a somewhat small but growing
                printed mag called 'CyberTek' (Great shit), The mag is
                loaded with stuff on making your own Pirate Radio/TV station
                and fucking with caller ID and many other Tek/Anarchy type
                of projects. To get a hold of this great mag you can reach ICOM
                at:
                                The New CyberTek BBS
                                --------------------
                             Uncensored:  [phone]
                             The Implosion: [phone]


Blood Axe:       This is the legendary Chris Coggins, the man looking for a
                job that doesn't wanna cut his hair. Anyhow Chris talked
                about everything and just went on and on, but some of the key
                key things he had to say was about his artical in Computer
                World Magazine on computer hackers and shit like that. Also
                Blood Axe went into shit on PSN networks, but over all it was
                pretty informative....

Mr. Drunkfux:    Talked about all the shit that happened at HoHo Con back in
                '91 and how the hotel got totally trashed like shit. The
                Hotel security tried to blame The Hoho Con organizers for
                fires in the hallways and holes in the walls, and Drunkfux was
                getting on there shit like 'Well if there was a fire what
                happen to the smoke alarms' and how they had witnesses that
                say that they say hotel employees punch holes in the walls
                just so they could blame it on HoHo Con.. fuck that shit...




        More or less that was end of teh SummerCon Conference, and I compiled
      a listing of what States were being represented by at the conference and
      they were:



Massachusetts           Argentina (The Country)
Texas                   Missouri
Illinois                Maryland
Louisiana               Virginia
Florida                 New York
Kentucky                Indiana
California              Mississippi
South Carolina          Colorado
Michigan



That was the end of the high point of the Conference, and so we shall wait
till next year when more people shall come and bring more computers with them
and do more hacking, and all that shit... (And make gifs from pictures)


                Anyhow, Till Next we meet, See ya!!!!!!



                          SummerCon   4 ever

                    Phrack: 1     Secret Service: 0









-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-



                          -=-  The Empire Times  -=-
                        Volume 1, Issue 2, File 11 of 11
                          M.O.D  (Masters of Disaster)
                                  Get Busted








 5 Computer Hackers Charged with Tampering, Fraud, Conspiracy      July 8, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 By Samuel Maull (Associated Press)

NEW YORK -- Five computer "hackers" have been indicted on federal charges of
breaking into computer systems run by telephone companies, credit reporting
services and educational institutions, officials said.

The hackers, in their teens and 20s, did it to show off for their peers, to
harass people they didn't like, to obtain services without paying, and to get
information they could sell, said U.S. Attorney Otto Obermaier.

During these invasions, they obtained 176 credit reports from the TRW credit
information company, destroyed an education series of a television station, and
left electronic graffiti on an NBC television news show.

Obermaier said much of the evidence against the defendants was obtained through
wiretaps which were the first ever used to intercept data exchanges between
computers communicating with each other.

The defendants were part of a group of hackers, people adept at using computers
to get into other computers or data systems, who called themselves MOD, which
stands for "masters of disaster" or "masters of deception."

Obermaier said MOD's members include Julio "Outlaw" Fernandez, 18, John
"Corrupt" Lee, 21, Mark "Phiber Optik" Abene, 20, Elias "Acid Phreak"
Ladopolous, 22, and Paul "Scorpion" Stira, 22.  All are from New York.

They are charged with computer tampering, computer fraud, wire fraud, illegal
wiretapping and conspiracy.  They will be arraigned Manhattan federal court on
July 16.  Each count is punishable by up to five years in prison.

The indictment charges that on November 28, 1989, MOD destroyed the information
in WNET Channel 13's Learning Link computer in New York City.

Learning Link provided education and instructional material to hundreds of
schools and teachers in New York, New Jersey and Connecticut.

A message left on the Learning Link  computer  said, "Happy Thanksgiving, you
turkeys, from all of us at MOD."  The message was signed "Acid Phreak," "Phiber
Optik," and "Scorpion," said Stephen Fishbein, assistant U.S. attorney in
charge of the prosecution.

During an NBC news broadcast on November 14, 1990, two hackers identified as
"Acid Phreak" and "Phiber Optik" claimed responsibility for sending the "Happy
Thanksgiving" message that appeared on the screen, Fishbein said.

The hackers  also allegedly broke into telephone switching computers operated
by Southwestern Bell, New York Telephone, Pacific Bell, US West and Martin
Marietta Electronics Information and Missile Group.

In some case the defendants added and altered calling features.  For example
they call-forwarded local numbers to long distance numbers so they could get
long distance calls for the price of a local call, Obermaier said.

Southwestern Bell reported it lost some $370,000 in 1991 because of computer
tampering by three of the defendants.

Obermaier said no defense intelligence was compromised by the Martin Marietta
invasion.

Two other defendants, Morton Rosenfeld, 21, and Alfredo de la Fe [Renegade
Hacker], 18, pleaded guilty to conspiracy to use and traffic in unauthorized
access devices in connection with MOD's activities.







_______________________________________________________________________________

 Hackers Indicted For Breaking Into Phone, Credit Systems          July 8, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 By Gail Appleson (Reuter Business Report)

NEW YORK -- A group of computer hackers has been indicted for breaking into
computer systems operated by major telephone companies and credit reporting
agencies in what prosecutors said were "crimes of the future."

The charges mark the first time court-authorized wiretaps were used to obtain
conversations and data transmissions of computer hackers, the government said.

"I see these cases as crimes of the future," Ray Schaddick of the Secret
Service, told a news conference.

The indictment alleges the defendants broke into computer switching systems
operated by Southwestern Bell, New York Telephone, Pacific Bell, U S West and
Martin Marietta Electronics Information and Missile Group.

Southwestern Bell allegedly lost $370,000 because of the crimes.

The defendants also allegedly tampered with systems owned by the nation's
largest credit reporting companies, including TRW, Trans Union and Information
America.  They allegedly obtained 176 TRW credit reports on various
individuals.

The indictment does not state a total amount of money lost by victims of the
tampering, and Manhattan U.S. Attorney Otto Obermaier said the hackers, who
were all under the age of 22, were often just after power.

Indeed, the men called themselves "MOD," an acronym used variously for "Masters
of Disaster" and "Masters of Deception."  They used individual aliases such as
"Corrupt," "Outlaw," "Phiber Optik" and "Acid Phreak."

Obermaier quoted the indictment as alleging the group broke into the computers
"to enhance their image and prestige among other computer hackers and to harass
and intimidate rival hackers and other people they did not like."

One of the defendants allegedly said that he wanted information that would let
him change TRW credit reports so he and others could "destroy people's lives
or make them look like saints."

The defendants also allegedly infiltrated computers systems to obtain
telephone, credit, information and other services without paying from them and
to obtain passwords, account numbers and other information they could sell to
others.

On one occasion they allegedly intercepted data communications on a network
operated by Bank of America and they wiped out almost all of the information
contained on a system operated by the Public Broadcasting System affiliate in
New York, WNET, that provided educational materials to schools in New York, New
Jersey and Connecticut.

They left a message on the computer that said "Happy Thanksgiving you turkeys,
from all of us at MOD."

The defendants in the case are Julio Fernandez, 18; John Lee, 21; Mark Abene,
20; Elias Ladopoulos, 22, and Paul Stira, 22. All are from New York.

The indictment contains 11 counts of computer tampering, computer and wire
fraud, illegal wire tapping and conspiracy.  If convicted, the defendants
face a possible maximum prison term of more than 50 years and fines of more
than $2.5 million.

Prosecutors said two other defendants previously pleaded guilty to buying
information from the five hackers.








_______________________________________________________________________________

 Computer "Masters of Disaster" Indicted                           July 8, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Taken from United Press International

NEW YORK -- Five alleged computer hackers known as "Masters of Disaster" were
indicted on federal charges for breaking into computers of major institutions
for fun and for gain, authorities said.

The defendants, known as "MOD" or "Masters of Disaster/Masters of Deception,"
broke into computers "to harass and intimidate rival hackers and other people
they did not like; to obtain telephone, credit, information and other services
without paying for them; and to obtain passwords, account numbers and other
things of value which they could sell to others," the indictment said.

The case marked the first court-authorized use of wiretaps in an investigation
to obtain data transmissions of  computer hackers who use computer-connected
telephone lines for unauthorized access to other computers, said a spokesman
for U.S. Attorney Otto Obermaier.

The indictment was announced with two arrests in separate, but related computer
fraud cases.

Among the computers the defendants allegedly broke into were telephone
switching computers operated by Southwestern Bell, New York Telephone, Pacific
Bell, U.S. West and Martin Marietta Electronics Information and Missile Group.

The hackers also allegedly wiped out of almost all information within the
Learning Link computer operated by WNET and left the words, "Happy
Thanksgiving you turkeys, from all of us at MOD."

Southwestern Bell allegedly lost about $370,000 in 1991, due to alleged
tampering by three of the defendants, two of whom also allegedly intercepted
data on a network operated by the Bank of America.

With access to credit and information services such as TRW, one of the alleged
hackers claimed he could "destroy people's lives or make them look like
saints," the indictment said.

The defendants were identified as Julio "Outlaw" Fernandez, 18, of the Bronx;
John "Corrupt" Lee, also known as John Farrington, 21, of Brooklyn; Mark
"Phiber Optik" Abene, 20, of Queens; Elias "Acid Phreak" Ladopoulos, 22, of
Queens, and Paul "Scorpion" Stira, 22, also of Queens.

They are scheduled for arraignment at 10 am, July 16 in U.S. District Court in
Manhattan on charges of fraud, wire fraud, illegal wiretapping and conspiracy.

In November 1991, Fernandez and Lee sold information to Morton Rosenfeld on
accessing credit services and later provided a TRW account number and password
that was used to obtain about 176 TRW credit reports on individuals.

Rosenfeld, 21, of Brooklyn, pleaded guilty to conspiracy on June 24. Alfredo De
La Fe [Renegade Hacker], 18, of Manhattan, pleaded guilty on June 19, to using
and selling telephone numbers and codes.

Rosenfeld must appear September 9 for sentencing, De La Fe on August 31.

Obermaier's office conducted the probe with James Heavey, special-agent-in-
charge of New York's U.S. Secret Service, William Doran, special-agent-in-
charge of New York's FBI office, and Scott Charney, chief of the computer
crime unit of the Department of Justice.
_______________________________________________________________________________