The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/zines/n_z/pvtline.004

Text File | 2003-06-11 | 90.7 KB | 1,931 lines

Tom Farley ---  [e-mail]

1. General Info on private line: ISSN No. 1077-3487

A. private line  is a hardcopy magazine about the telephone
system. It's published six times a year by Tom Farley. It's
been reviewed well in Factsheet5 and Nuts and Volts.
Copyright (c) 1994 It runs 28 pages. It's done in black and white.

B. Subscriptions: $24 a year for subscriber's in the U.S. $31 to
Canada or Mexico. $44 overseas. Mailed first class or equivalent.
(1)  Make checks or money orders payable in US funds to private line.
(2)  Back issues are five dollars apiece.Specify Issue Number 4 if you
want this issue.
(3) A sample is four dollars.
(4) The mailing list is not available to anyone but me.

C. Mailing address: 5150 Fair Oaks Blvd. #101-348, Carmichael, CA
95608

D. e-mail address: [e-mail]

E. Phone numbers:  [phone]  FAX

F. Submissions: Go for it! Anything semi-technical is strongly
encouraged. I don't run any personality pieces. I pay with
subscriptions.

G. You may post this file to any site or BBS as long as the whole
file is kept intact.

H. This 'patent issue' is well illustrated. It may be hard to follow as
a text file but I intend to keep posting the text of each issue no matter
how they come out.

PRIVATE LINE NUMBER 4: JANUARY/FEBRUARY

I.   About The Front Cover
II.  Editorial Page
III. Updates and Corrections
IV.  Hacking Patents -- A How To Guide
     A. Introduction
     B. Sidebar -- Quick Start Guide
     C. Patent Numbering and Classification
     D. Sidebar -- A Tale of Two Classes
     E. The Patent Document
     F. Patent Bibliography Example
     G. Tools and Resources
     H. Background and Summary Example
     I. List of Patent and Trademark Deposit Libraries
     J. Class 379 -- Telephonic Communications
V. Who's Bugging You?: An Interview With Chris Hall
VI. Federal Toll Fraud Law: Section 1029

-----------------------------

I. About The Front Cover

1. "3,142,522 COIN TELEPHONE HOUSING: Norris R. Hall and Richard K.
Thompson, Jr., Indianapolis, Ind., assignors to Bell Telephone
Laboratories, Incorporated, N.Y., a corporation of New York
Filed Dec. 18, 1962, Ser. No. 245,567 10 Claims.  (Cl. 312--199)"

The front cover depicts the housing of the 1A1, the first single slot
payphone used in the Bell System. Note the large circular hole for the
rotary dial. The patent for the housing itself was granted in May, 1964.
The 1A1 was introduced in 1965 after seven years of development by Bell
Labs and Western Electric. I found this patent by making a list of
developer's names from articles in the Bell Laboratories Record.  I then
looked for those names in many year's worth of the Index of Patents. See
my article on patent searching for information on the different kinds of
indexes.
2.    Want to know more about early payphones? Check out Stokes, R.R., "A
Single-Slot Coin Telephone" Bell Laboratories Record  (January, 1966) 20
and W. Pfred "A New Coin Telephone" Bell Laboratories Record  (December,
1959) 464. Please note that the Record  is not  the same publication as
the Bell System Technical Journal. The B.S.T.J. is widely available. It
is dense, intimidating and hard to read. It is also indispensable. The
Record, on the other hand, is user friendly. It is well illustrated and
easy to read. It was published until 1984. Look for it. You'll find
valuable background information on how the Bell System set up phone
service for about 75% of America's  population.

-----------------------------------------------
II. An Introduction

3.    Welcome to the fourth issue of private line. This is the first
national edition! private line is an open, questioning forum about all
things telephonic. It's written with the beginner in mind, but I hope
that everyone can find something interesting here. Readers are
encouraged to submit articles and to forward corrections. I pay with
subscriptions. private line focuses on the technology of the information
age, rather than on the personalities. How did all this get started? The
magazine 2600 rekindled an interest in telephones that had laid dormant
with me for over fifteen years. I read about blue boxing as a teenager
but I didn't know anyone who did it. Many San Francisco Bay Area people
were involved in hacking but there was no way to get in touch them.
Everyone quoted in The San Francisco Chronicle used a fake name.  I
experimented a little with coin first phones but that was by myself. I
tried reading telephony books but they were very difficult to
understand. I didn't apply myself and I eventually gave up. That was a
mistake. I graduated from high school, went to work and got involved in
other hobbies and pursuits. And then last year I saw a copy of 2600 for
the first time.

4. What a revelation. I sent for back issues and got a look at what I
had been missing. People were still experimenting with the telephone
system and still having fun doing so. What's more, the technology of
communications was rushing ahead at an incredible speed, producing more
fascinating equipment that I could begin to understand. But I still
didn't know the basics.  I hit several libraries and was discouraged to
find that most of the books were as difficult as before. I resolved,
however, to apply myself this time. I started taking notes since I learn
better when I write things out. The first two issues of  private line
were a result of that loose collection of notes.

5. I could tell you more about the past but I want to write about the
future. I look forward to sharing  what I learn about telephones and
telecommunications.  I look forward to seeing anything you have to
contribute. Maybe we can learn together.  Thank you!
Tom Farley (Sherman) KD6NSP

----------------------------

III. Updates and Corrections

6.    I discussed California Penal Code Section 502.7 in the first issue.
502.7 covers toll fraud. I had a question about subsection (3). It says
that avoiding lawful charges "[b]y use of a code, prearranged scheme, or
other similar stratagem or device whereby the person, in effect, sends
or receives information" is illegal. I wasn't sure what this was about.
I asked if anyone could give me an example of what the legislature
meant.

7.    Tom ([e-mail]) clears this up nicely. He writes,
"Perhaps they mean trying to avoid collect call charges.  For example,
let's say I'm in Jersey City, and I want my mom, who lives in Bayonne,
to pick me up to take me home.  I don't want to put $.20 in the phone to
make a call, and I don't want her to get the collect call charge.  So,
we prearrange this idea:  I'll call her collect, and when the operator
asks who the call is from, I give a fake name that we have prearranged
to mean that she should pick me up to drive me home.  Then my mom simply
refuses the call, saying 'I don't know who that person is,' she hangs
up, then goes to Jersey City to get me.  Neither my mom or I have been
charged for the call, but the information was passed successfully. In
real life, though, I'm not THAT cheap... I CAN spare 20 cents... I guess
some people see small change in terms of cheap transistors and
resistors.  But anyway, that what the law seems to mean."

8. I think Tom provided a good example. It takes on even more importance
with new services such as 1-800-COLLECT. You can leave code names that
stand for different things.  Biff Barker, for example, to stand for
"Call me back." Interestingly, the technology is so good these days that
phrases like "Call me back" or "My number is . . ." may result in an
operator intercept if you try to record them. True, this process is a
hassle and it takes a long time to do. But it is possible. I suppose
they would charge you with that code section if you had, say, a thousand
'800' calls from your residence that were never completed. And your long
distance company does keep track of those calls . . .

9. In issue 3 I talked about a program that came from Thipdar's Custom
Software. I said it hunted for modem tones. Not so. It's actually a
normal scanning program. It notes modem tones but does not look for them
exclusively.

---------------------------------

IV. Hacking Patents: A How-To Guide (Patent Searching & Telephones)
by Tom Farley

A. Introduction
B. -- Sidebar -- Quick Start Guide
C. Patent Classification
D. -- Sidebar -- A Tale of Two Classes
E. The Patent Document Itself
F. The Search Process
G. Tools and Resources
H. Example of a Background and Summary of the Invention
H. Example of a Patent Bibliography
I. List of Patent and Deposit Libraries
J. Class 379 -- Telephonic Communications

A. Introduction

10.    Patent searching is a great way to find out about telephones. It's
low cost and fascinating. Got a question about AT&T's True Voice? Tired
of the hype? Read the patent instead.  Interested in pay phones? You'll
find more information in  patents than from any other free, public
source.  Need telecom clip art that's copyright free?  Patents provide.
Too good to be true? Well, you must not expect too much. You will not
find, for example, operating procedures like those in a manual. But you
will find some detailed information that a manual may be based on. Using
patents with other information will get you closer to the goal. You may
find that patent searching becomes a compelling, hypnotic hobby.

11.    A patent is a written document with illustrations. Hardcopy versions
of the entire patent are only available at the Patent and Trademark
Office in Washington, D.C. Patent and Trademark Depository Libraries or
PTDL's have microfilm copies of those originals. See page 18 for a list.
In addition, the U.S. Patent and Trademark Office gopher has the texts
of 1994 patents online. See the Quick Start Guide if you want to start
looking at patents right now. For the rest of us, let's start the search
process by looking at patent classification. . . (go to paragraph

A. Sidebar -- Quick Start Guide

The Conventional Approach

12. Go to a Patent and Trademark Deposit Libary listed on page 18.  Pull
out the microfilm roll for any of the following patents.  Thread roll on
viewer. Read  the patent.

a) 3,142,522 Payphone housing
b) 3,86,3036 Ground circuit
c) 4,310,726 Early 911 network
d) 4,924,496 COCOT info
e) 5,311,582 Current COCOT

The Internet

13. Do you have net access? Preferably an .edu account? Full text of all
1994 patents were on line as of 12/01/94.  The Patent and Trademark
office has a gopher.  It pulls files from a database at town.hall.org.
True keyword searches of more than 90,000 documents are possible. You
can enter phrases such as toll fraud, COCOT or  paystation and get a
list of relevant patents. You can then select which patent you wish to
view. Check out paragraph

B. Patent Numbering and Classification

14.    Each patent gets a permanent number once it's approved. These go in
chronological order. You can get an idea, then, of an invention's age
without looking up its patent. The payphone housing on the front cover,
for example, has patent number 3,142,522. That dates back to mid-1964.
The patent number for the 1994 COCOT we discuss later is 5,311,582.
Tables exist that match dates to numbers. Two thousand patents on
average get approved weekly. More than 5,000,000 patents have been
assigned already. Organizing these patents is a major task.

15.     All patents are first put into one of several hundred broad
classes. Some examples are Class 119 for Animal Husbandry, Class 102 for
Ammunition and Explosives and Class 380 for Cryptography. Most telephony
related stuff is put into Class 379: Telephonic Communications. All
classes, including 379, are broken down into subclasses.

16. Take a look at class 379 at the end of this file. See how everything
is arranged? Every conceivable piece of telephone equipment gets a
subclass number along with its class number.  Payphone patents start at
subclass 143. So, the COCOT we'll talk about later has the reference
number 379143. That patent deals with other subclasses as well. But 143
is the one that that patent impacts most.

17.    The chief problem with subclasses is that the headings are non-
intuitive. That's because the descriptions use 'patenteese' and not
telecom lingo. The Patent and Trademark Office defines these subclasses
but you have to go to a PTDL to look up the vague descriptions. Who
would describe, for example, a toll fraud prevention device with
language like this: "189. Fraud or improper use mitigating or indication
(e.g., 'blue box', 'black box'). Huh? This category is actually quite
broad. It includes equipment that deals with fraudulent tones of all
kinds. It may be a payphone that's designed to deal with red boxing, or
it may involve central office equipment that's designed to detect blasts
of 2600 Hz. Don't rule out a subclass because the wording of a heading
doesn't match your search exactly.

18.    Other classes contain other telephone related products. Not
everything is in 379. Telephone booths are in Class 52. Coin collectors
for pay stations go in Class 194. You can look up these related things
with The Index to the U.S. Patent Classification System. I list it under
resources at the end of this article. It is essential for anyone dealing
with patents. Let's now look at the patent document itself. . .
(go to paragraph 20)


C. Sidebar -- A  Tale of Two Classes

19.     Classifying telephone equipment used to be simpler. Telephony
inventions were in another class altogether: Class 179: Telephony.  It
had nice, friendly headings like 'Systems', 'Telephones', 'Switches',
and 'Testing Devices.' It contained 190 subclasses. The breakup of the
Bell System opened telecom to an avalanche of new products, inventors
and companies. This diversity  of inventions caused the old class to
collapse after only a year. In 1986, Class 379 was introduced to replace
old 179. The amount of subclasses doubled. Simple headings were replaced
by cryptic ones. Parenthetical statements were devised to explain the
headings. Most don't work.  You may get a better understanding of the
new class by photocopying the last revision of 179.  At the very least,
you will need a copy of it to do a telephony search before December,
1985.

D. The Patent Document

20.    Many, many parts make up a patent. I'll cover the main ones. The
first part is the title. Something complex like, "An Integrated COCOT
and Regulated Paystation Telephone System." Or, "Automatic Telephone
Answering System Using a Single-Tone Signal For Various Operations."
Only rarely will you see a simple title like "Modem With Call Waiting."
The first title is about a payphone that can be a  COCOT or a telco
payphone. Two in one. What's more, the phone can be dialed up and set
into either mode with just a few commands. It takes some reading to make
sense out of these titles. Your best bet may be to always look up a
patent that has the right class and subclass number, despite what the
title says.

21.    The second interesting part of the patent is its bibliography. It
gives you clue after clue about the invention as well as the entire
field that it belongs in. You'll quickly learn the companies, people,
documents and patents that are important. Use any large libary with
business directories to get names, addresses and phone numbers.

22.    The third important part of the patent is the abstract. It is a
legalistic summary of the invention. The abstract is the most widely
accessible part of the patent. That's because each new patent has its
abstract printed in the Official Gazette, a weekly publication of the
Patent and Trademark Office. Hundreds of libraries carry it as well as
some companies. You can look up the abstract in the Gazette, even if you
don't have access to a Patent and Trademark Deposit Libary. An entry in
the Gazette also gives you the patent's number, its title and an
illustration. Correctly interpreting abstracts saves you time. Certain
abstracts grab your attention. In those cases, you know immediately that
a patent is worth the time and effort  to get to a Patent and Trademark
Deposit Libary to look it up.  Many abstracts, though, leave you
wondering. Relating an abstract to its patent is a matter of practice
through more reading.

23.    The background of the invention is the most engaging part of the
patent for general readers. It gives you a technological summary of the
subject involved. For example, a patent about telephone handsets will
contain a  background that summarizes handset history and operation.
I've reprinted the background of the COCOT patent on page 10 to give you
a good idea of what they contain. This short summary is a great
introduction to pay phone operation

24.    The summary of the invention tells you how the invention works in
fairly non-technical terms. It also provides good details about how the
invention relates to other things in its field. The COCOT we discuss,
for example, has a specific procedure to deal with credit cards. The
summary gives details of calling card principles in order to relate the
invention's claims to everyday practice. I reprint the COCOT summary on
page 10 as well.

25.    The body of the text provides the nitty gritty details. It is the
longest part of the document. The text is always linked to
illustrations. It is next to impossible to figure out a patent without
seeing the whole thing. Here's one quotation that shows you the problem.
Each number represents a diagram or a part of diagram:

 "Assuming the voice message system is collect/return, control
relay 93 is provided in co-pending application Ser. No.
07/740,576 incorporated by reference above. The coin refund
inhibit relay 73, coupled in series between the collect/return
relay 93 and the coin relay 100, includes a pair of control
windings 75, 76. One end of  each of windings 75, 76 is coupled
in common to receive a coil energizing voltage. The other ends
of control windings 75, 76 are respectively coupled to receive
"relay off" and "relay on" signals from the  microprocessor 45,
to delineate the position of switch 74 in series with the coin
relay 100. As shown in FIG. 5, switch 74 is closed so as to
complete the circuit between the collect/return control relay
93 and coin relay 100 allowing for a firing of the coin relay
100. If the microprocessor 45, however, issues a relay off
signal, then the switch 74 opens (as noted by the phantom line)
to turn off the coin relay 100.  .   ."

You can tell that the body provides enough information to do some
serious reverse engineering. I hope this article persuades you to visit
a Patent and Trademark Deposit Libary so that you can look at what is
available. Or at least to look up a few abstracts at your local libary.
Let's now turn to the search process itself.
F. The Search Process
26.    Go to the nearest patent and trademark deposit libary if you are
impatient and you know what patent you want to look at.  These are the
only places that have the complete, illustrated patent on microfilm.
Not sure what to look for? Then you have to choose a subclass to
investigate. Let's say you've picked subclass 189, the one about
detecting toll fraud. What then? Well, again, the easiest answer is to
tell you to get to a Patent  and Trademark Deposit Libary. It has the
most tools and you'll waste the least time. But I can make a case for
not going to the PTDL first, even if you have one near you.
27.    PTDL's can be intense, intimidating and somewhat crowded. Why not
start with a lower key setting first? I'd recommend a beginner go to a
state college or university that carries the Official Gazette. You'll
usually find it in the Government Documents section. Such a libary will
have some supporting materials as well. You can get familiar with patent
publications and the microfilm reader there, rather than at a PTDL.
Let's go through an example of using a libary that has just the Gazette.
28.    Okay, you're now in the Patent section at your libary. Find the
Manual of Classification. It's in two loose leaf binders. This is your
key to the whole classification system. It's a compilation of all the
different patent classes. You'll find Class 379 in there along with
everything else. No pictures but very compelling. All of technology is
categorized in one work. A libary may keep only the current  Manual in
the Government Document section; older ones may be kept out in the open
stacks.
29.     Let's say you're sticking with  subclass  189 in telephonic
communications. You need to make a list of the recent patents in that
field.  How? Look for the Index of Patents Issued From The United States
Patent and Trademark Office. A long title for some small books. You'll
find them near the Manual. The Index of Patents is put out every year in
two parts.  Stronger libraries have more back issues.
30.    The first part of the Index of Patents lists patent holders by name.
Organizations such as Bell Laboratories, Protel and Motorola are listed
by name as well. Next to the patent holder's name is the class and
subclass number of their invention. But no description of the invention
is given. A more useful tool is the second part. It lists patents by
Class and subclass.  What it calls subjects. A list of all patents
issued in the last ten years may take only a few minutes  to look up if
you have a quiet subclass.  Classes like 149, "Post pay coin
collection", however, may not have had a single patent issued as far
back as you can search. Don't be discouraged. Developers may be
producing equipment in your field but they may not have decided to go
through the patent process. Remember, too, that Class 379 changed in
1985.

31.    Well, now you have a list of patent numbers in your subclass. The
next step is to look up their abstracts in the Official Gazette. You'll
want to see if it's worth it to look up the entire patent at a PTDL.
Smaller libraries take the Gazette on microfiche or microfilm.
Microfiche is easier to use since you don't have to thread a machine.
The disadvantage is that the image produced on the reader is smaller
than that with microfilm. A small paper envelope holds each issue of the
Gazette on fiche. A single issue may consist of 10 or 15 individual
pieces of film.  The issues themselves are arranged by date and patent
numbers in a file cabinet with shallow, wide trays. Class 379 is usually
2/3d's of the way back in the packet. It's a laborious process to look
up several abstracts but it's okay to look up a few. And you'll get
motivated to get to the PTDL where the hardcopy volumes are.

32.    Microfilm is a different story. Looking up several abstracts is very
time consuming.  Threading the film onto the microfilm reader takes
time, patience and practice. Don't be afraid to ask for help. I've had
librarians admit that they have problems threading the machines. I do
most of my film reading on the microfilm readers that double as copiers.
These machines tend to be in good repair since they make money. It is
really silly to thread up a conventional reader, only to have to thread
another machine to make a copy when you see what you want. Looking up
abstracts this way gives you an insight into the patent process and
gives you practice for the PTDL. Patents are on 16mm film but it threads
the same as the larger film of the Gazette. Let's now look at what the
Patent and Trademark Deposit Libary has to offer.

33.    A few PTDL's have every patent ever issued on microfilm. Most don't.
Much of what we are interested in, though, goes back no more than 30
years. Every PTDL should have at least that many patents on file. Start
viewing the patents on your list in case you want to get going. You'll
see shelf after shelf with thousands of small boxes of microfilm. Most
PTDL's allow you to grab the roll yourself and start threading. You'll
also see the Gazette in hardcopy.  You'll appreciate immediately how
much faster it is to search those instead of looking at film versions of
the Gazette. Speaking of speed, every PTDL has a CD ROM machine that's
great for doing recent patent research. It's called CASSIS.

34.    CASSIS stands for Classification and Search Support Information
System.  Arrgh. It's a collection of CD's that allow you to look at
patent titles back to 1969 and abstracts back to 1988. In addition, it
allows you to do key word searches of the entire classification system.
You can put in words like telephone pole, toll fraud or payphone
housing, for example, and it will tell you what class those inventions
are in. It's a cross reference, in other words, to the massive Manual of
Classification that I mentioned previously. This keyword searching,
however, can be done with the  hardcopy Index to The U.S. Patent
Classification System. CASSIS is nice but you can do without it if you
are looking up a specific class and subclass.

35.    One tool I haven't used is the Automated Patent System or APS.
That's the main Patent and Trademark database. You can access it from at
least thirteen PTDL's across the country. I list those with a small
diamond on the opposite page.  This database has the full text of all
patents back to 1971! This is, I think, the same database that DIALOG
accesses for their patent information. The nearest  APS equipped libary
to me is in Los Angeles, never-the-less, I will check it out the next
time I go and report on how it works. I'm looking forward to using it.
For right now, I'm pulling a list of patents in the conventional way.

36.    You can run into quirks at the PTDL. Take a lot of change for the
copy machines. Don't assume that there will be a change machine.
Speaking of copy machines, you may be surprised at what you find. The
Sacramento PTDL has some from the late 1960's. These things spit out
copies with wet ink on blue print like paper. I'm not kidding. I have to
hang the copies on the tops of chairs to dry them off. The quality of
these copies is terrible. There is no way that you could use them for
OCR work. The illustrations on these pages took quite a bit of work with
my scanner to clean up. Some of them started as out as photocopies of
abstracts from the Gazette and not from the patent itself. It was easier
to get a good illustration that way instead of chasing pixels for hours.
There is hope, though, even for this problem. The Patent Office will
send you a clean copy of any patent for three dollars. See the section
below for details. Good luck with your searching and tell me about any
interesting patents you find.

G. TOOLS AND RESOURCES

The Internet

37.    The quickest way to look at patent information is to use the
Internet. It is also a confusing way. The 1994 APS or Automated Patent
System database has over 90,000 patents online. The easiest way to use
it is through the United States Patent and Trademark Office gopher. This
gopher seems poorly supported. I managed to connect to it through my
Delphi account for the first time as this goes to print. I simply did a
search of directories in gopher space using VERONICA. I chose the
VERONICA at SCS Nevada. I keyed in the word patent. Several screens of
information came back. I picked one choice labeled U.S. Patent and
Trademark Office. It lead into the same menu that I had seen before with
an .edu account. All of my previous attempts through Delphi did not
connect. Keep at it. I wanted to make sure that a gopher was available
because it is the simplest service for most people to use. The more
technically proficient can use the following information. I've also
included what town.hall.org says about connecting with FTP directly.
Here's what you'll see if you connect to the PTO gopher:

"U.S. Patent and Trademark Office Information
(via town.hall.org)

    1. About the Patent Full-Text/APS Distribution
    2. Keyword Search of the U.S.  Patent and Trademark     Office Data <?>
    3. WAIS source description for Patent index
    4. Help on performing WAIS searches

    1. About the Patent Full-Text/APS Distribution: This subdirectory
contains Full Text Patent Data for 1994. The data subdirectory is
organized by ranges of patent numbers.  We *highly* recommend that you
use WAIS to access this information. Transfer the file patent.src back
to your home system and put it with your other WAIS source files.

    3.  WAIS source description for Patent index:
(:source
   :version  3
   :ip-address "192.101.98.5"
   :ip-name "town.hall.org"
   :tcp-port 210
   :database-name "patent"
   :cost 0.00
   :cost-unit :free
   :update-time (:time interval :weekly:day 5 :hour 1 :min30 )
   :maintainer
"[e-mail]"
   :description
Patent Full-Text/APS File for 1994.  Field name abbreviations in the
original feed have been expanded into human-readable form.  The database
is maintained by the Internet Multicasting Service and is provided . ."

    Telnet? Not supported. Here's what happens if you try 192.101.98.5 ...:

"Connected to town.hall.org. You have reached the computers of the
Internet Multicasting Service. We do not support access by telnet, but
invite you to send a mail message to [e-mail] to access our
data archives or to [e-mail] to learn about our radio services.
You may also use the FTP service to town.hall.org.  Use your FTP client
to connect to town.hall.org and log in as username "anonymous" and use
your email address as the password."

38.    You can also use the internet to access the Patent and Trademark
Office bulletin board. Telnet into fed.world.gov. or try 192.239.92.201.
Fedworld is difficult to navigate.

Modem --

39.    The PTO BBS can be dialed directly. It's at [phone]. It goes
up to 9600. No account is necessary to access this information. It's a
useful bulletin board and you can download the contents of the current
Gazette. I'd recommend that you take a half hour or so and cruise around
in it.

Hardcopy Stuff --

40.    Patent Copies  You can get a copy of any patent for $3.00 from the
Patent and Trademark Office. That's a great bargain. It doesn't matter
how long the patent is either, all patents are three bucks. There is one
drawback -- getting your copies take four to six weeks. Still, this is
the best choice for many people. You could do your searching in the
Gazette  and then order promising copies by mail. It's also a cheaper
process than making copies at a PTDL when you have a long document to
get. The Patent Office told me that  all copies come on plain paper. So,
they should work fine for scanning or OCR work. Send a check or money
order to:

Commissioner of Patents and Trademarks
Box 9, Washington, DC  20231

41. More information? Call [phone]. All they need is your money
and a list of patent numbers. Nothing else. There's no form required.
I'm ordering a few patents to see what they look like. Can you imagine
the possibilities? A CD ROM designer could put, say, 30 cell phone
patents on a single disc. Text and pictures together. (By the way, all
the information is public domain and copyright free.) Or, you could put
all COCOT info on one CD. Let me know if you do this -- I'll let you
advertise for free in private line if you price them at an affordable
level. Your editor will, of course, need a copy of each one for
review. . .

Magazines

42. The most relevant magazine about patents for us is Inventor's
Digest. It's for the independent inventor and it has lots of interesting
information. It's ISSN number is 0883-9859. They're distributed by Fine
Print Distributors. Or call them at [phone]. Only four dollars a
copy.

Books

43. Most books on patents become outdated quickly. None deal with
telephones exclusively. Never-the-less, here are a few that I think are
worth a look:

1. Ardis, Susan. An Introduction to U.S. Patent Searching: The Process.
Libraries Unlimited Englewood, Colo. 1991.
2. Basic Facts About Patents. Dept. of Commerce, Patent and Trademark
Office.  Washington, D.C.  Rev. Oct. 1993.
3. Patent Profiles: Telecommunications. Dept. of Commerce, Patent and
Trademark Office.  Washington, D.C.  1984


------------------------------------

H. Example of A Bibliography of an Invention

Part 2. Patent Bibliographic Information (PATN)  on Patent No.
5,311,582: Integrated COCOT and Regulated Paystation Telephone System.


    WKU     Patent Number:              05311582
    SRC     Series Code:              8
    APN     Application Number:       0054178
    APT     Application Type:         1
    ART     Art Unit:                 264
    APD     Application Filing Date:  19930119
    TTL     Title of Invention:       Integrated COCOT and regulated
paystation
telephone system
    NCL     Number of Claims:         28
    ECL     Exemplary Claim Number:   1
    EXA     Assistant Examiner:       Loomis; Paul
    EXP     Primary Examiner:         Chin; Stephen
    NDR     Number of Drawings Sheets: 14
    INVT  Inventor Information
    NAM     Inventor Name:            Davenport; Marcus K.
    CTY     Inventor City:            Cumming
    STA     Inventor State:           GA
    --------------                    --------------------
    ISD     Issue Date:               19940510
    CTY     Inventor City:            Snellville
    STA     Inventor State:           GA
    --------------                    --------------------
    NAM     Assignee Name: International Teleservice Corporation
    STA     Assignee State:           FL
    COD     Assignee Type Code:       02
    CTY     Inventor City:            Woodstock
    COD     Parent Code:              71
    APN     Application Number:       740841
    APD     Application Filing Date:  19910806
    PSC     Parent Status Code:       03
    CTY     Inventor City:            Snellville
    CLAS  Classification
    OCL     Original U.S. Classification:                   379143
    XCL     Cross Reference Classification:               379155
    EDF     International Classification Edition Field:     5
    ICL     International Classification:                   H04M  342
    ICL     International Classification:                   H04M 1102
    ICL     International Classification:                   H04M 1512
    FSC     Field of Search Class:                          379
    FSS     Field of Search Subclass:150;143;144;145;146;154;
    UREF  U.S. Patent Reference
    PNO     Patent Number:                                  3863036
    ISD     Issue Date:                                          19750100
    NAM     Patentee Name:                                  McCrudder
    XCL     Cross Reference to U.S. Classification:   379146
    UREF  U.S. Patent Reference
    PNO     Patent Number:                                  4535555
    ISD     Issue Date:                                          19900600
    CLAS  Classification
    XCL     Cross Reference to U.S. Classification:    379144
    UREF  U.S. Patent Reference
    ICL     International Classification:                   H04M  342
    ISD     Issue Date:                                            19880800
    NAM     Patentee Name:                                  Kinushita et
        al.
    OCL     Original U.S. Classification:                379143
    UREF  U.S. Patent Reference
    PNO     Patent Number:                                   4924497
    ISD     Issue Date:                                            19900500
    NAM     Patentee Name:                                  Smith et al.
    OCL     Original U.S. Classification:                379150
    -----------------------------------
    UREF  U.S. Patent Reference
    PNO     Patent Number:                                  5113433
    ISD     Issue Date:                                          19920500
    NAM     Patentee Name:                                  Hird et al.
    XCL     Cross Reference to U.S. Classification:  379155
    UREF  U.S. Patent Reference
    PNO     Patent Number:                                  5150403
    ISD     Issue Date:                                           19920900
    NAM     Patentee Name:                                  Jordan
    XCL     Cross Reference to U.S. Classification:         379155
    UREF  U.S. Patent Reference
    Series 8000 Installation Guide by Protel, Inc., Document No. 000 313,
            Jul. 8, 1991.
    FRM   Legal Firm: Evenson, McKeown, Edwards & Lena

-------------------------------------

I. Background and Summary of the Invention on Patent 5,311,582

    Bacground of the Invention

    Presently, paystation telephone systems are manufactured and produced
to operate in a regulated line or coin line environment or in a
customer owned, coin operated telephone (COCOT) environment.
Paystations operable in the coin line mode are generally controlled via
a central office through the use of the telephone line ring/tip pair
and a ground line. The Bell Operating companies are examples of a
regulated system which control numerous paystations through out the
United States. In contrast, the COCOT systems are produced for
individual owners who maintain, service and operate the COCOT
paystations as a business for profit. COCOT paystations include a
microprocessor providing the intelligence to operate the paystation.
Programs are stored in the microprocessor's memory for carrying out the
features of the paystation. However, once conventional COCOT telephones
are installed in the field, the owner can not change any functional
operations of the paystation but rather can only affect certain
paystation characteristics such as calling rates, etc.

    Because each system is controlled differently, vendors supplying
paystations to regulated companies and individual customers currently
produce either two separate paystation units or a single unit which
requires the removal and insertion of circuit cards in order to change
the operation from a coin line telephone to a COCOT telephone. The use
of two different paystations has the disadvantages of not allowing the
paystations to be interchanged and increases a manufacturers overall
cost due to the necessity of carrying two distinct product lines. These
problems arise because each system is controlled differently -- coin
line systems by a central office and COCOT systems by the paystation
itself. It has heretofore been unable for vendors to integrate such
systems due to their individual control and operating characteristics.
For example, the paystation telephone must operate differently to carry
out such features as voice messaging, charging for incoming calls, coin
tone fraud prevention, safety checks, coin disposal (how the paystation
collects and refunds), dialing sequence (whether the paystation passes
the digits dialed directly to the telephone line or buffers the digits
and then sends them to the telephone line), voice prompts (where the
paystation voices a message to the paystation user), and the like, when
controlled via the central office in the regulated system or when
controlled via the microprocessor contained with the paystation in a
COCOT system. There is therefore needed a paystation telephone

system that integrates both a COCOT and a coin line system, without
requiring hardware modifications, and provides a wide range of
paystation features operable in either mode.

  Summary of the Invention

    In accordance with the present invention, the above-mentioned needs
are met by an integrated COCOT and regulated paystation telephone
system which  permits the functionality or features of the paystation
to be remotely programmed, in order to increase the versatility of the
paystation in either mode of operation. The features can thus be
selectively enabled or disabled when the paystation is connected to
either a regulated line or a business line.

    Pursuant to the invention, the integrated paystation telephone system
includes a central microprocessor coupled with an external  RAM memory
that stores the firm ware for operating the paystation telephone. Novel
circuitry is provided under the control of the microprocessor to
operate such functions as the power control and coin relay (the relay
which excepts or refunds a deposited coin) in either mode of operation.
A more detailed description of the power control and coin relay
circuitry is provided in co-pending application Ser. No. 07/740,576,
filed on even date herewith and entitled "Circuit for Firing Paystation
Coin Relay Using Power Derived From Telephone Tip/Ring Voltage, the
specification of which is herein incorporated by reference. Further,
call progress or answer supervision circuitry is provided to enhance
the availability of other paystation telephone features according to
the present invention. The call progress circuitry is described in
greater detail in co-pending application Ser. No. 07/745,594, filed on
even date herewith and entitled "Answer Supervision Circuit For
Paystation Telephone With Non Mute Microphone", the specification of
which is herein incorporated by reference.

    It is a advantage of the integrated COCOT and regulated paystation
telephone system of the present invention to be remotely configured to
operate in either a COCOT or coin line mode without requiring any
hardware changes. This is accomplished via the microprocessor reading a
status bit set in the firmware downloaded into the external RAM memory
to determine its mode of operation.     The paystation telephone system of
the present invention further allows for voice messaging
systems to be implemented for both coin line and COCOT operation. For
coin line operation, a microprocessor open circuits the coin relay such
that the central office signal refunding a caller's coin is inhibited.
This allows the voice message system to operate. The deposited coin is
then collected after the caller leaves his voice message and the phone
line is released.

    Another novel feature of the integrated paystation telephone system is
its operability to detect coin tone fraud via filters provided in the
call progress circuitry.  The microprocessor controls the filters such
that they detect when coin tones are being generated from the handset
microphone and, in response thereto, mutes the handset microphone so as
to disrupt the coin tone generation.

    Still another advantage of the present invention is the provision of a
safety program which detects if the paystation housing case is properly
grounded so as to avoid shocks to a caller resulting from an accidental
charging of the paystation housing case via an AC line. The
microprocessor operates to read a case ground sensor signal indicating
whether the case is grounded and to report the results thereof.

    Yet another advantage of the present invention is its operability to
determine the actual connect time between the calling and called
parties in order to determine whether overtime charges should be
applied for local calls. The call progress circuitry indicates when the
called party actually answers the phone which signals the
microprocessor to begin a local overtime timer set to a pre determined
time stored in the external memory. Once the timer expires, the
microprocessor generates a voice signal requesting  further money to
continue the call. Use of the actual connect time is an advantage over
the prior devices which normally begin timing after a pre-set delay
period once the call is made, e.g. 15-20 seconds. The present invention
provides for a more accurate timing of the conversation based on the
actual connect time.

     Another advantage of the present invention is its operability to
prohibit long distance or `one-plus` telephone calls when the cash box,
which receives the deposited coins, is stolen or otherwise missing. The
microprocessor is controlled via a program to read a cash box sensor to
determine its presence. If the sensor indicates the cash box is
missing, the microprocessor prohibits any coin tones from being output
over the phone line thus eliminating long distance phone call
capability in a regulated system. Furthermore, for local calls, the
microprocessor can keep open a circuit path from the telephone line tip
to ground such that the central office will not detect that the initial
calling rate, i.e. the amount of money to be charged for the call, for
a local call has been met. Hence, the central office will not allow a
local call.

    Still yet another advantage of the present invention is the provision
for the paystation telephone system to accept any type of credit or
bank card to be used for placing calling or credit card calls,
otherwise referred to as `zero-plus` calls. Whereas currently regulated
lines, such as the Bell operating companies, only allow use of their
own or related calling cards, the present invention provides a program
for the microprocessor to store a credit card number input by the
caller for comparison with stored credit card numbers which have been
approved for use by the particular paystation. These numbers can be
continuously changed via the down-loading feature into the external RAM
memory.

Other objects, advantages and novel features of the present invention
will become apparent from the following detailed description of the
invention when considered in conjunction with the accompanying
drawings. . . <End of Summary>


-------------------------

I. PATENT AND TRADEMARK LIBRARIES

NOTE: Asterisks denote APS or Automated Patent Search capability

Alabama: Auburn University [phone]*; Birmingham Public Library
    [phone]
Alaska:  Anchorage: Z. J. Loussac Public Library [phone]
Arizona: Tempe: Noble Library, Arizona State University [phone]*
Arkansas: Little Rock: Arkansas State Library [phone]
California: Los Angeles Public Library  [phone]; Sacramento
    California State Library [phone]; San Diego Public Library (619)
    236-5813; San Francisco Public Library (Not Yet Operational?);
    Sunnyvale Patent Clearinghouse [phone]
Colorado: Denver Public Library  [phone]
Connecticut: New Haven: Science Park Library [phone]
Delaware Newark: University of Delaware Library  [phone]
Dist. of Columbia Washington: Howard University Libraries [phone]
Florida: Fort Lauderdale: Broward County Main Library [phone]
    Miami-Dade Public Library [phone]; Orlando University of Central
    Florida [phone]; Tampa Campus Library, Univ. of South Florida
    [phone]
Georgia    Atlanta: Price Gilbert Memorial Library, Georgia Institute of
    Technology  [phone]
Hawaii: Honolulu: Hawaii State Public Library System [phone]
Idaho Moscow: University of Idaho Library  [phone]
Illinois: Chicago Public Library [phone]; Springfield Illinois
    State Library [phone]
Indiana:Indianapolis-Marion County Public Library [phone]; West
    Lafayette: Siegesmund Engineering Library, Purdue University
    [phone]
Iowa: Des Moines: State Library of Iowa [phone]
Kansas: Wichita: Ablah Library, Wichita State University  [phone]
Kentucky  Louisville Free Public Library  [phone]
Louisiana:  Baton Rouge Troy H. Middleton Library, Louisiana State
    University [phone]
Maine: Orono: Raymond H. Fogler Library, University of Maine Not Yet
    Operational
Maryland  College Park: Engineering and Physical Sciences Library,
    University of Maryland [phone]
Massachusetts: Amherst: Physical Sciences Library, University of
Massachusetts [phone]; Boston Public Library [phone]  Ext.
    265
Michigan: Ann Arbor Engineering Library, University of Michigan (313)
    764-5298; Big Rapids: Abigail S. Timme Library, Ferris State University
    [phone]; Detroit Public Library [phone]
Minnesota: Minneapolis Public Library and Information Center   (612)
    372-6570
Mississippi: Jackson: Mississippi Library Commission [phone]
Missouri: Kansas City: Linda Hall Library [phone] St. Louis
    Public Library [phone] Ext. 390
Montana: Butte: Montana College of Mineral Science and Technology
    Library [phone]
Nebraska: Lincoln: Engineering Library, University of Nebraska-Lincoln
    [phone]
Nevada: Reno University of Nevada, Reno Library [phone]
New Hampshire: Durham: University of New Hampshire Library (603) 862-
    1777
New Jersey: Newark: Public Library   [phone] Piscataway: Library
    of Science and Medicine, Rutgers University [phone]
New Mexico: Albuquerque: University of New Mexico Gen. Libary (505) 277-
    4412
New York: Albany New York State Library [phone]; Buffalo and Erie
    County Public Library  [phone]; New York Public Library:  (The
    Research Libraries) [phone]
North Carolina: Raleigh,  D.H. Hill Library, North Carolina State
    University   [phone] *
North Dakota: Grand Forks: Chester Fritz Library, University of North
    Dakota   [phone]
Ohio  Cincinnati and Hamilton County, Public Library of [phone]
    Cleveland Public Library [phone] *Columbus: Ohio State
    University  Libraries  [phone]; Toledo/Lucas County Public
    Library [phone]
Oklahoma: Stillwater, Oklahoma State University Center for International
    Trade Development  [phone]
Oregon:  Salem: Oregon State Library  [phone]
Pennsylvania  Philadelphia, The Free Library of  [phone];
    Pittsburgh, Carnegie Library of [phone]; University Park: Pattee
    Library, Pennsylvania State University  [phone]
Rhode Island: Providence Public Library [phone]
South Carolina: Charleston, Medical University of South Carolina
    Library  [phone] Clemson University Libraries [phone]
South Dakota: Rapid City,  Devereaux Library, South  Dakota School of
    Mines and Technology  Not Yet Op.
Tennessee: Memphis & Shelby County Public Library  and Information
    Center  [phone]  Nashville: Stevenson Science Library,
    Vanderbilt University [phone]
Texas: Austin, McKinney Engineering Library, University of Texas at
    Austin [phone] College Station: Sterling C. Evans Library,
     Texas A & M University   [phone] Dallas Public Library
    [phone] * Houston: The Fondren Library, Rice University
    [phone] Ext. 2587
Utah   Salt Lake City: Marriott Library,  University of Utah
    [phone] *
Virginia: Richmond: James Branch Cabell Library, Virginia
    Commonwealth University [phone]
Washington:  Seattle, Engineering Library, University of Washington
    [phone]
West Virginia  Morgantown: Evansdale Library, West Virginia University
    [phone]
Wisconsin   Madison: Kurt F. Wendt Library, University of Wisconsin
    Madison [phone]; Milwaukee Public Library
     [phone] *
Wyoming: Casper, Natrona County Public Library    Not Yet Operational

--------------------------------

J. class 379: telephonic communications
the whole enchilada -- your patent friend

1 DIAGNOSTIC TESTING, MALFUNCTION INDICATION, OR
ELECTRICAL CONDITION MEASUREMENT
2    .Including fault responsive disconnection of tested component
3    .Of hybrid, or echosuppressor or canceller
4     .Of repeater
5    .By loopback
6    .By analysis of injected tone signal
7    .For detection of eavesdropping device
8    .With blocking of normal usage
9    .Of centralized switching system
10        ..By automatic testing sequence (e.g.,programmable scanning)
11                ...Routiner
12        ..With dedicated testing line or trunk
13        ..of call timing or charging equipment
14        ..Of plural exchange network
15        ..Of automatic switching equipment
16        ..Of switching path
17        ..Of switching selector
18        ..By use of call address signal
19            ...Rapid manual connecting structure for test equipment
20        ..of switchboard element condition (e.g., lamp)
21    .Using portable test set (e.g., handset type)
22    .Of trunk or long line
23        ..Of line signalling
24        ..Electrical parameter measurement(e.g., attenuation)
25        ..Conductor identification or location
26        ..Fault identification or location (e.g., continuity, leakage)
27    .Of subscriber loop terminal
28        ..of data transmission instrument
29        ..Terminal arrangement to enable remote testing (e.g., testing
        interface)
30            ...Loop impedance (e.g., resistance,    capacitance)
31        ..Of line signalling generator (e.g., dial, tone code generator)
32    .Indication of non standardcondition of telephone equipment
33        ..Alarm or emergency (e.g., cut line)

34 SERVICE MONITORING OR OBSERVATION
35    . Listening-in or eavesdropping type

36 FREE CALLING FROM PAYSTATION

37 EMERGENCY OR ALARM COMMUNICATIONS
(E.G., WATCHMAN'S CIRCUIT)
38    .Personal monitoring (e.g., for the ill or infirm)
39    .Response to sensed non system condition
40        ..Automatic dialing
41        ..Transmission of recorded audio message
42        ..Plural conditions
43        ..Fire
44        ..Intrusion
45    .Central office responsive to emergency call or alarm (e.g., "911",
    operator position display)
46    .Called line or station condition responsive (e.g., recall if busy)
47    .Plural alarms over single line
48    .Announcement or alarm received at terminal stations (e.g.,"butt-in"
           alarm)
49    .Central station with plural substation
50    .By pulse or digital signal
51    .With automatic dialing or transmission of recorded audio message

52 INCLUDING AID FOR HANDICAPPED USER (E.G., VISUAL, TACTILE, HEARING
AID COUPLING)

53    WITH CONVERSATIONAL VIDEO COMMUNICATION (I.E., VIDEOPHONE)
54    .Switching control

55 HAVING NEAR FIELD LINK (E.G., CAPACITAVE, INDUCTIVE)

56 HAVING ELECTROMAGNETIC LINK FOR SPEECH OR PAGING SIGNAL (E.G., LIGHT
WAVE LINK)
57    .Control of selectively responsive paging arrangement over telephone
     line
58    .Radio telephone system or instrument
59        ..Zoned or cellular system
60            ...Having zoned/cellular system switching (e.g., hand-off)
61        ..Including cordless extension set (i.e., having single subscriber
         line access)
62            ...With privacy or lockout (e.g., identity verification)
63        ..Including supervisory or control signaling

64 HAVING SINGLE CHANNEL TELEPHONE CARRIER
65    .Including call signalling (e.g., ringing, off-hook, dialing)
66    .Over power line

67    WITH AUDIO MESSAGE OR STORAGE RETRIEVAL
68    .Dynamic audio signal recording or reproduction
69        ..Call originating
70        ..Call intercept or answering
71            ...Consecutive use of recorded phrases or words to form message
72            ...Sequential or repeated announcement during single call
            initiated cycle
73            ...Plural record carrier channels
74            ...Remote control over telephone line
75                ....Remote dictation
76                ....Announcement selection or replacement
77                ....Control by generated tone
78            ...Acoustic coupling
79            ...With specified call initiated control circuitry
80                ....Voice signal presence responsive
81                ....Call termination responsive (hang-up)
82                ....Having specified call initiation (e.g., ringing)
                responsive circuitry
83                ....Structural detail of storage medium drive
84            ...At switching facility (e.g., central office, switchboard)
85        ..Recording of telephone signal during normal operation
86            ...Inductive pickup
87        ..Reproduced signal distributed over telephone line
88     .Stored in digital form
89         ..Subscriber control of central office message storage or retrieval

90 TELEPHONE LINE OR SYSTEM COMBINED WITH DIVERSE ELECTRICAL SYSTEM OR
SIGNALLING (E.G., COMPOSITE)
91     .Credit authorization
92     .Polling (audience survey)
93     .With transmission of a digital message signal over a telephone line
94        ..Including switching station
95        ..Access restricting
96        ..Including terminal for display of digital information
97        ..By voice frequency signal (e.g., tone code)
98            ...By modulated audio  tone
99            ...Having acoustic link
100 .To produce visual-graphic copy reproduction (e.g., facsimile)
101 .Audio program distribution
102 .Remote control
103    ..of entrance or exit lock
104    ..With indication
105    ..From terminal
106 .Remote indication over
107 .Meter reading
108 .Telegraphy
109    ..Over telephone line

110 COMPOSITE SUBSTATION OR TERMINAL (E.G., HAVING CALCULATOR, RADIO)

111 WITH MEASUREMENT (E.G., CALL OR TRAFFIC    REGISTER)
112 .Computer or processor control
113    ..Call traffic recording
114 .Call charge metering or monitoring
115    ..Interexchange operations
116    ..Hardcopy record generating
117    ..Of station on polystation or party line
118        ...Identification of station
119    ..Hardcopy record generating (e.g., ticket          printing)
120        ...With line I.D. or class of service determination
121    ..At central office
122        ...With display
123        ...Paystation (e.g., escrow control)
124        ...Pulse counting or accumulating (e.g., "message metering")
125             ....Local or zone
126            ....Automatic message accounting
127            ....Having line identification (e.g., automatic #I.D.:"ANI"
128            ....Time of day     controlled
129        ...Manually set (e.g., key and lock)
130    ..At subscriber station
131        ...Time controlled
132            ....Paystation (e.g., escrow control)
133 .Call traffic recording or monitoring
134    ..At central station
135        ...With hardcopy record generation (e.g., ticket generation)
136        ...With display
137        ...Trunk usage (e.g., peg count)
138            ....All trunks busy metering
139        ...Counting the number    of completed connections
140    ..At subscriber
141        ...Mechanical register

142 WITH CALLING NUMBER DISPLAY OR RECORDING AT CALLED SUBSTATION

143 WITH CHECK OPERATED CONTROL (E.G., PAYSTATION)
144 .Other than coin
145 .Fraud or interference prevention
146 .Coin signalling or control
147    ..Coin box audit or totalizer
148    ..Denomination
149    ..Post-pay coin collection
150        ...Coin disposition (return or collection)
151        ...Upon connection to called station
152        ...Magnet, electromagnet, or relay controlled from central office
153        ...Paystation (e.g., control by refund key)
154 .At central office
155 .At terminal station (e.g., coin paystation)

156 MULTI-LINE OR KEY SUBSTATION SYSTEM WITH SELECTIVE SWITCHING AND
CENTRAL SWITCHING OFFICE CONNECTION
157 .With special service
158    ..Conferencing
159 .With intercom system
160     ..With connection of intercom station to subscriber line
161 .With exclusion or priority feature (e.g., lockout or privacy)
162 .Detail of hold circuitry
163    ..Electronic
164 .Line status indication or call alerting
165 .Switching or supervision feature (e.g., common control, digital)
166 .Detail of line circuit or line card

167 PRIVATE (E.G., HOUSE OR INTERCOM) OR SINGLE LINE SYSTEM
168 .Lockout
169    ..Central power source
170 .With paging
171 .Having plural stations with selective calling (e.g., master)
172    ..With call addressing
173 .With call addressing
174 .Including body or apparel supported terminal (e.g., headgear)
175     ..For underwater use (e.g., in diver's suit)
176 .With central power source

177 POLYSTATION LINE SYSTEM (I.E. PARTY LINE)
178 .Revertive call
179 .Call alerting     (ringing)
180    ..Full selective or tuned (e.g., harmonic)
181    ..Semi selective (e.g., line side, polarized)
182 .Automatic or unattended
183    ..Station identification
184    ..Lockout
185 .Portable or mobile
186 .Central power source
187 .Connected to central office

188 CALL OR TERMINAL ACCESS ALARM OR CONTROL
189 .Fraud or improper use mitigating or indication ("blue box","black
    box")
190 .Time out
191    ..At switching center
192        ...Of call duration (e.g., conversation timer)
193        ...Of specific equipment
194 .Lockout or double use signalling
195     ..In automatic system
196 .At switching center
197    ..Central office
198    ..PBX
199 At substation
200     ..Restrictive dialing    circuit

201 SPECIAL SERVICES
202 .Conferencing
203    ..Operator control
204    ..Subscriber control
205        ...Conference initiation by single calling station
206    ..At substation
207 .At plural exchanges
208 .Priority override (e.g., butt-in)
209 .Repetitive call attempts (e.g., camp on busy, retry)
210 .Call diversion (e.g., call capture)
211     ..Call forwarding
212    ..Call transfer
213    ..Intercept (e.g., dead or changed number)
214    ..Secretarial or answering service
215 .Call waiting
216 .Abbreviated dialing or direct call (e.g., hot line)
217 .Audible paging
218 .Performed by operator (e.g., butt-in, busy verification)

219 PLURAL EXCHANGE NETWORK OR INTERCONNECTION
220 .With interexchange network       routing
221    ..Alternate routing
222 .Toll center
223    ..With operator assistance
224 .Tandem switching center
225 .Multi-PBX interconnection
226 .Having a manual exchange
227    ..With an automatic exchange
228    ..Having signalling to operator
229 .Interexchange signaling
230     ..Signalling path    distinct from trunk (e.g., CCIS)
231     ..Central office-to-PBX signalling
232        ...PBX trunk groups
233        ...Direct inward dialing
234    ..PBX to central office signalling (e.g., direct outward dialing)
235    ..Voice frequency signalling over trunk
236    ..DC signalling over trunk
237        ...Pulse or digital signalling
238             ....Having signalling repeater
239            ....Using register  sender
240    ..Interexchange trunk  circuit
241        ...Glare or simultaneous seizure mitigation

242 CENTRALIZED SWITCHING SYSTEM
243 .Class of service    determination or    transmission
244    ..In common control system
245 .Identification
246     ..Of line or trunk
247        ...With display
248        ...Using matrix
249        ...For nuisance call mitigation
250 .Four wire switching
251 .With generating of call associated substation signal
252     ..For alerting signal at called station (e.g., ringing)
253        ...Electronic
254        ...Associated with connector
255        ...With interrupter
256    ..Having automatic or through ringing
257    ..For calling station (e.g., status or progress tones)
258 .Switching controlled in response to called station addressing
    signal
259     ..Including deflected electron beam switching device or mechanical
or optical switching control (e.g., fluidic)
260    ..With operator position or completion of call (e.g., dial "0")
261        ...Operator controlled register sender
262        ...Call extension by operator
263            ....With call indicator or announcer
264            ....A to B operator
265        ...Call distribution to operator
266            ....Call queuing
267        ...Operator's console
268    ..Having shared or common switching control
269        ...Distributed control
270        ...In-stage or interstage scanning (e.g., link scanning)
271        ...Having multistage switching
272            ....Path selection or routing
273                .....Alternate routing
274                    ......With busy or idle test
275                 .....Including marking circuit
276                     ......End to     end marking (e.g., self seeking)
277                .....With busy or idle test
278             ....Interstage junctor or "trunk"
279         ...Control reliability (e.g., reliability)
280         ...Including registering or storing device for call address signal
281             ....Conversion between dial pulse and voice frequency signal
282            ....Voice frequency receiver
283                 .....Dual tone multifrequency (DTMF) receiver
284            ....With processor
285            ....With magnetic memory
286            ....Signal processing (e.g., dial pulse analysis)
287            ....Electronic
288            ....Register-sender
289        ...Translator
290        ...With time division of Control or supervisory signals
291        ...With detail of crosspoint switching structure (e.g.,
        crossbar)
292            ....Electronic crosspoint (e.g.,solid state)
293    ..Having line finder
294        ...Including electronic element
295        ...Plural
296    ..With repeater
297    ..Having specified busy-idle test
298    ..Direct control
299        ...Step-by-step system
300            ....Having plural wiper sets
301            ....Having potential control
302            ....Having rotary switch
303            ....Coordinate system (e.g., X-Y)
304        ...All relay type
305        ...Having motor driven switch
306    ..With crosspoint switch detail
307    ..With power supply
308 .Switching apparatus for connecting calling line to operator's
    position
309     ..Call distribution or queuing
310 .Divided central (e.g., communication between switchboards)
311     ..Having signalling path feature
312 .Having multiple answering jacks for multiple line
313 .Multiple section switchboard
314    ..Auxiliary (e.g., overflow)
315 .With line-signal control
316    ..Spring-jack cut off
317    ..Relay cut off
318    ..Central power source
319 .Single switchboard (e.g., cord circuit)
320    ..Switchboard circuit
321    ..Connection to operator's terminal
322 .Power supply
323    ..Power to switching equipment
324    ..Central power source (e.g., common battery, line current feed)
325 .Structure of equipment
326    ..Wire or cable distribution
327        ...Main or intermediate
             distribution frame
328    ..Equipment mounting or support
329        ...Allowing movement of equipment (e.g., movable, modular)
330    ..Housing
331 .Having protective circuit
332 .Plug and socket

333 CONCENTRATOR OR TRUNK SELECTOR
334 .Concentrator distributor pair (e.g., line concentrator)
335 .Using crossbar or crosspoint switching

338 REPEATER (E.G., VOICE FREQUENCY)
339 .With signal conversion (e.g., dial to DTMF, analog to PCM)
340 .Having line length compensation or equalization
341 .Pulse or tone repeater
342     ..Electronic (e.g., logic circuitry)
343 .Controlled by a pilot or reference signal
344 .Controlled processes bi-directional signal
345 ..Including two to four wire conversion or hybrid circuit
346 .With frequency discriminator or negative impedance element
347 .With gain or attenuation control
348 . Transmission of power to distant repeater
349 .Having voice frequency transformer

350 SUPERVISORY OR CONTROL LINE SIGNALLING
351 .Signalling integrity protection (e.g., voice signal immunity)
352 .Substation originated
353     ..Conversion of signal form
354    ..With called number display
355    ..Repertory or abbreviated call signal generation
356        ...With dynamic memory
357        ...Insertable control elementor circuitry (e.g., card)
358        ...By motor driven dial rotating device
359        ...Pulse signal generating (card)
360    ..Voice frequency band signalling (e.g., reed devices)
361        ...Electronic (e.g., tone generator)
362    ..Pulse signal generator (e.g., rotary dial)
363        ...Control of motor driven rotating device
364        ...With nonrotary actuator (e.g., key or slide type)
365        ...Specified switching contact (e.g., contact spring)
366        ...With detail of dial return mechanism (e.g., driving spring,
        speed governor)
367        ...Finger wheel or mechanical adjunct  (e.g., finger stop)
368    ..Plural-switch number input device (keypad)
369    ..Detail of mounting of switch pad or dial
370        ...In handset
371    ..Magneto signalling
372 .Signal reception at substation
373    ..Incoming call alerting (e.g., ringing)
374        ...With music or audible music  generation
375        ...With electronic call sounder (tone ringer)
376        ...With visual indication of incoming call
377 .Using line or loop condition detection (e.g., line circuit)
378    ..With current controlling electromagnetic core device (Hall-effect)
379    ..With optical link between line and     switching system
380    ..By bridge circuit
381    ..Busy test or make busy
382    ..For ring trip or polarity reversal detection
383    ..Of plural lines
384        ...By scanning
385    ..Relayless
386 .Signal receiver (e.g, tone decoder)

387 SUBSTATION OR TERMINAL CIRCUITRY
388 .For loudspeaking terminal
389    ..For circuitry for voice control of transmission direction
390    ..With amplification or attenuation level control
391 .Sidetone control or hybrid circuit (einduction coil)
392    ..Suppression (e.g., antisidestone)
393 .Hold circuit
394 .Impedance matching or line equalizing
395 .Amplifying
396 .Visual signalling (lamp)
397 .Wire distribution

398 LINE EQUALIZATION OR IMPEDANCE MATCHING

399 SUBSCRIBER LINE OR TRANSMISSION LINE INTERFACE
400 .For line length compensation
401    ..Voltage boosting circuitry
402 .Hybrid circuit
403    ..With adjustable balance circuit
404        ...Automatic adjustment
405     ..Electronic noninductive
406 .Echo suppression, antisinging, or reverse path blocking
407    ..Disable or inhibit
408    ..Control by pilot frequency signal
409    ..Having variolosser or attenuator
410    ..Echo cancellation (e.g., phase opposition)
411        ...Having transversal filter
412 .Protective circuit
413 .Power supply (e.g. battery feed)

414 TRANSMISSION LINE CONDITIONING
415 .Reactance neutralizing
416 .Interference suppression
417    ..Anti-crosstalk

418 CALL SIGNAL GENERATING (RINGING OR TONE GENERATOR)

419 TERMINAL
420 .Having loudspeaking conversation capability (e.g., hands-free type
    or speakerphone)
421 .Having muting
422 .Switch or switch actuator structure
423    ..Line selection
424    ..Receiver or handset position responsive (e.g., hookswitch)
425        ...With mechanism for latching hookswitch or plunger against motion
426        ...Movable holder for receiver or handset
427        ...Having plunger and lever linkage
428 .Housing or housing component
429    ..Having distinct circuitry support structure (circuit board)
430    ..Body supported (e.g. headgear)
431    ..Separate housings for earphone and microphone (e.g., candlestick
    type)
432    ..Loudspeaking set
433    ..Handset structure
434    ..Specified terminal configuration (e.g., novelty type)
435    ..Wall set/convertible
436    ..Desk set
437    ..Protective structure
438    ..Of cord or connector
439        ...Antiseptic
440    ..Casing or enclosure

441 TERMINAL ACCESSORY OR AUXILIARY EQUIPMENT
442 .With circuit connection to terminal
443 .Including coupler (e.g., inductive)
444    ..Acoustic
445 .Locking device
446 .Telephone receiver support
447 .Attachable to terminal housing
448    ..Hookswitch operator
449    ..Handset holder (e.g., shoulder rest)
450    ..Clips onto terminal structure
451 .Protective structure
452    ..Antiseptic, disinfecting or disposable
453 .Hood or enclosure (booth)
454 .Support or stand
455    ..Handset holder
456    .Dialing tool

457 MISCELLANEOUS

---------------------

VI Who's Bugging You?: privateline talks with Chris Hall

About Chris Hall

Chris Hall is the Chief Operating Officer for Executive Protection
Associates, Inc.,  a worldwide company providing high-level
investigations, security consulting, and privacy protection strategy to
Industry, Individuals, and Celebrities.  Mr. Hall has over 15 years of
experience in Law, Business, Investigations, Professional Bodyguarding,
and Intelligence analysis. Mr. Hall has conducted covert surveillance,
counter-surveillance, intelligence gathering and analysis, and has lead
a team of up to 10 Bodyguards for a Fortune 500 employer, celebrities,
and dignitaries.

Mr. Hall maintains a business interest in an electronic engineering firm
that designs and markets electronic surveillance and counter-
surveillance equipment for public and private customers.  He is
currently assigned to Professional Executive Investigations, where he
heads EPAI's California  licensed Private Investigation Agency, and the
EPAI Training Division. He is the North American Regional Governor for
the IAPPS ( International Association of Personal Protection Specialists
( Bodyguards ).

Mr. Hall will be a regular contributor to private line  and can be
reached via e-mail at:  [e-mail]

Future Topics:

- Counter-Surveillance for fun and enjoyment.
- Personal Security
- Open-Source Intelligence Gathering.
- Social Engineering 101.
- Privacy Protection in the 90's.
- Off-Shore, and why you  need to be there.
- How to get a Second Legal passport.
- So you want to be a Monk, Knight, Doctor ? Then read on. . .
- How to get a  "refugee" passport and international status.

private line talks with Chris Hall . . .


NOTE: Chris Hall helped give a great talk at Def Con about electronic
security. He'll be a regular contributor to private line on a number of
subjects. This e-mail interview is about telephone security. My
questions are in italics.

TF: It seems there are three ways to monitor a telephone conversation: a
"hardwired" wiretap, an electronic bug or transmitter and REMOBS or
Remote Observation. Any others?

CH: A  body wire but that only gets one side of the conversation. And a
beige box or a lineman's handset, which is a kind of remote observation.

TF: What constitutes a wiretap?

CH: Any unauthorized ( by the tap-ee) monitoring of your telephone
communications or room conversation.

TF:  Do you come across many?

CH: In my years in the industry I have seen the number of discovered taps
increase by at least 60% in just the past five years.  Mostly in
industry -- high-tech, bio-tech, etc.

TF: A wiretap, to me, conjures up visions of policemen huddled in a
rented room, bent over a tape recorder. Perhaps across the street from
the observed site. Is this accurate or do they just leave the tape
recorder in place and change the tapes when needed?

CH: Police or Federal wiretaps usually are REMOBS ( Remote Observation
Posts ) and can be several miles away.  Most are usually unmanned and
recorded on digital tape or digitized and stored on disk for later analysis.
Most authorized taps are done at the central office, and routed to the
REMOB point where it can be either manned ( if a sensitive operation is
on-going) or unmanned.  It's kind of like modern surveillance for the
PI.  You used to be stuck in the back of a windowless van for hours on
end waiting for activity to video tape.  Now, with technology, I can use
a rented car, park it across from the subject location, use a pin-hole
camera shot through mylar in the turn signal, control it via radio with
a DTMF pad (pan, tilt, zoom), and have it transmit through a video
repeater and watch or record it miles away in my office or hotel room
 ( if out of town ) while eating a pizza and watching "Party of Five" on
the other TV.  The technology today is phenomenal.

TF: Can you detect a wiretap if it is off site?

CH: Central office taps are nearly impossible to detect.  Especially if it
is an authorized tap.  About the only way you will find out is when they
produce the transcript at the trial.

TF: Can you detect it if it is on site?

CH: Almost all taps on-site can be detected by a competent electronic
countermeasures technician.  Most ECM techs are sloppy.

TF: Let's talk specifics. Doesn't any device working off of line power
affect the electrical status of the line? Can't this change be detected?

CH: Yes, if it is using line power.  There are several crystal controlled
transmitter kits that work off of a battery and are very high impedance.
I have seen these used in training sessions and the telco people miss
them in a sweep of the line.  If a knowledgeable amateur places them
correctly, it is very difficult to locate them with line sweep gear.

TF: Ever run across any police wiretaps in your investigations? What
happened?

CH: Most wire taps we run across are either amateur or what we call
"wildcat" taps.  A wildcat tap is an unauthorized tap usually performed
by law enforcement to gain intelligence information.  They then use the
intel to build a case or to develop snitches.  We have run across a few
wildcat taps in our work and the resultant contact was not pleasant.

TF: Describe a typical bug.

CH: Typical bug is a crystal controlled FM transmitter with an electret mic
attached directly to it or remoted via thin wire to the target listening
position.  With surface mount technology they can be quite small and
powerful.

TF: Do most use line power or batteries?

CH: Cheap garbage uses line power, most higher end use batteries, high-
high end use external exciter like microwave energy and the like.

TF: You talked about the cheaper bugs at Def Con. These seem to be the
ones offered in catalogs, the so called "free oscillating types" that
use the VHF band. Correct?

CH: Those are the ones. They are garbage.  Most operate on Wide FM just
outside the standard FM radio band, are low powered and very frequency
unstable.  We use them in training, however, at the basic level.

TF: Do you see any of them in use or is this strictly low budget?

CH: Seventh graders bugging their sister's room, disgruntled employees
bugging the bosses office, that's about the extent of it.  Don't see any
in industrial espionage, but that doesn't mean we don't look for them

TF: Describe the difference between those bugs and the crystal
controlled ones.

CH: Crystal controlled use far more transistors and, of course, a
crystal for stability and power.  Most are battery powered and hide in
"nestled" frequencies near active services.  All I know of are FM.

TF: What freqs do these bugs use?

CH:I have seen Low VHF, High VHF (old fed stuff is near wireless mic
frequencies, new stuff is frequency hopping or spread spectrum).  Some
UHF,  but not too many.  Highest is usually near Military aero at around
300 MHz.

TF: What do they cost?

CH: From $50 to $200 in kit form.

TF: What's involved in a sweep? Walking around with a frequency counter?

CH: That's part of it, but it is much more extensive than that. Physical
search is the most important. That means opening every electrical
outlet, switch, light bulb base, etc., followed by an RF search over
time with a sub-audible marker tone, spectrum analysis looking for
anything that doesn't "belong", then a non-linear junction detector
sweep, plus some other methods (especially for fiber optics) that we
don't discuss.

TF: What is a "non linear junction sweep"?

CH: Basically a device that detects semi-conductors including surface
mount components (transistors), etc.  It is useful when sweeping a wall
and you can't tear off all of the drywall, but you want to be sure
nothing is behind it.

TF: Ever find any decoy bugs? That is, do people ever plant one that is
easy to find and leave behind another?

CH: Very common, in fact, that is a good way to test a prospective
electronic counter-measures service provider. Do it yourself.

TF: Ever find a transmitter but not find who did it?

CH: Most of the time, unless we have good background or advance
intelligence.  There are signatures in the business , however, that
point fingers.  It is a craft.

TF: What's the range on a good transmitter?

CH: In training I have seen up to four blocks on a battery powered telco
transmitter correctly placed, and with good receiving equipment.  Kind
of like using a cordless phone.

TF: What's the neatest technical installation you've seen?

CH: Hard wire burst transmitter.  They used a trace repair pen after
placing the microphone to draw the leads for the mic to the transmitter,
then painted over it.  The transmitter used a chip to store information
and then it transmitted it in "blips" which made it hard to detect.

TF: Any funny war story you can share?

CH: Not really funny but a client's employee kept getting a signal from
near a light switch at a clients residence on top of a hill.  The hill
above was a congested radio repeater site, and the employee called us
only after he had destroyed all the wallboard surrounding the light
switch looking for the "bug".  We found it was only a radio reflection
off of the metal cornering they use on drywall interiors from a 50,000
watt radio station.  We got all their business after that incident.

TF: Find many bosses syping on employees? How far do they go?

CH: We don't really run across this much since it is usually the boss
that hires us.  Have heard of it though.  Lots of companies monitor and
record fax traffic now.  How far they can go depends on what kind of
form you signed at the time of  your employment.  I have heard of them
going as far as they could, till they got caught.

TF: How are faxes and data transmissions intercepted?

CH: Usually logged, recorded and stored on a PC, then later analyzed
with software.

TF: Many offices use all digital PBX's. How does this affect monitoring
when you have a digital signal? More expensive equipment needed?

CH: It's more expensive to monitor at the switch, but not at the
individual telephone.  PBX people, though, are a weak link. They're low
paid and ripe for social engineering.  It is a weak area we analyze for
our clients.

TF: Ever hear of someone tapping an optic fiber line? Does the test
equipment for it allow a person to do such a thing?

CH: It's available now, and I have heard from very reliable sources that
there is a method that doesn't even involve a physical tap of the
line but it's mega expensive and although not classified, it's reserved
for the government types.

TF: What do you think of Zimmerman's effort to build a secure phone
based on PGP?

CH: I'd love to buy a license and distribute it !  I'm waiting and
watching. Like everyone else.

TF: Are scramblers silly?

CH: Cheap inversion scramblers are silly, STU phones and DES 3 are still
useful.  I use a transcrypt digital unit on my cell phone.  All of the
radios we use for our executive protection details are scrambled at a
high level.

TF: What is a transcrypt digital unit?

CH:Transcrypt International makes a surface mount board that mounts
inside a Motorola flip phone and mates to a Motorola supplied connector.
To activate it, you simply press two digits on the keypad of the flip
phone, and your voice is digitally encrypted and then decrypted at the
other end by a Transcrypt hardwire phone, or another cell phone with
compatible code and unit.  There is something like four trillion code
combinations to encrypt with. Those are programmed in by the dealer.  It
is a slick unit and we use them extensively.  It is digitally controlled
analog encryption and the voice channel sounds like static mixed with
modem tones.

TF: Is it possible to tap a line without making a physical connection?
That is, can you do it by induction? Like  a pickup microphone on a
guitar?

CH: Sure, all rules of electronics apply.  You would probably have to
amplify it and send it down another pair or via RF for any kind of
distance.

................

Chris Hall, C.O.O. Executive Protection Associates, Inc. * Opinions
Expressed are those of the author and NOT those of EPAI* EPAIWWW-
http://www.mps.ohio-state.edu/cgibin/hpp?spook_stuff.
html  IAPPS WWW-http://www.mps.ohio-state.edu/cgi
bin/hpp?Iapps_home.html

--------------------------------

VI FEDERAL TOLL FRAUD LAW

I discussed California Penal Code $502.7 in the first issue. It
prohibits both credit card fraud and electronic devices used to commit
toll fraud. 18 U.S.C. 1029 is the rough federal equivalent. It does not,
however, contain any specific language prohibiting electronic tone
generators like rainbow boxes, red boxes or blue boxes. It is, instead,
almost exclusively concerned with stolen codes and account numbers.  The
only electronic device it seems to prohibit are cloned cellular phones.
You may have wondered what gets the Secret Service involved with toll
fraud -- this law answers that question.  Here is the full text of Title
18 United States Code section 1029 as I went to print in November, 1994.
The digital telephony bill has since amended it. Those amendments will
be in issue number 6 that comes out in May, 1995. My comments are in
contained within asterisks.

$1029. Fraud and related activity in connection with access devices

(a) Whoever --
        (1) knowingly and with intent to defraud produces, uses, or traffics
in one or more counterfeit access devices;
        (2) knowingly and with intent to defraud traffics in or uses one or
more unauthorized access devices during any one-year period, and by such
conducts obtains anything of value aggregating $1,000 or more during
that period;
        (3) knowingly and with intent to defraud possesses fifteen or more
devices which are counterfeit or unauthorized access devices; or
        (4) knowingly, and with intent to defraud, produces, traffics in, has
control or custody of, or possesses device making equipment; shall, if
the offense affects interstate or foreign commerce, be punished as
provided in subsection (c) of this section.

*An access device is vaguely defined in section (e) later on. For now,
think of an access device as any stolen code, stolen credit card or
stolen telephone calling card. Any 'device' (a legal word of art)  used
to access someone else's account. You must run up a $1,000 bill before
the Feds can come in. In reality, the government  may not act at that
level because of their caseload. You never know. They also have to
connect you to the calls and the calls must cross state lines.*

    (b)(1) Whoever attempts to commit an offense under subsection (a) of
this section shall be punished as provided in subsection (c) of this
section.
        (2) Whoever is a party to a conspiracy of two or more persons to
commit an offense under subsection (a) of this section, if any of the
parties engage in any conduct in furtherance of such offense, shall be
fined an amount not greater than the amount provided as the maximum fine
for such offense under subsection (c) of this section or imprisoned not
longer than one--half of the period provided as the maximum imprisonment
for such offense under subsection (c) of this section, or both.

    (c) The punishment for an offense under subsection (a) or (b)(1) of
this section is --
        (1) a fine of not more than the greater of $10,000 or twice the value
obtained by the offense or imprisonment for not more than ten years, or
both, in the case of an offense under subsection (a)(2) or (a)(3) of
this section which does not occur after a conviction for another offense
under either subsection, or an attempt to commit an offense punishable
under this paragraph;
        (2) a fine of not more than the greater of $50,000 or twice the value
obtained by the offense or imprisonment for not more than fifteen years,
or both, in the case of a subsection (a)(1) or (a)(4) of this section
which does not occur after a conviction for another offense under either
such subsection, or an attempt to commit an offense punishable under
this paragraph; and
        (3) a fine of not more than the greater of $100,000 or twice the value
obtained by the offense or imprisonment for not more than twenty years,
or both, in the case of an offense under subsection (a) which occurs
after a  conviction for another offense under this subsection, or an
attempt to commit an offense punishable under this paragraph.

    (d) The United States Secret Service shall, in addition to any other
agency having such authority, have the authority to investigate an
offense under this section. Such authority of the United States Secret
Service shall be exercised in accordance with an agreement which shall
be entered into by the Secretary of the Treasury and the Attorney
General.

    *The Secret Service was first set up to fight counterfeiting during
Lincoln's time. They've had different duties through the years but they
are still used as the shock troops in many fraud related cases.*

(e) As used in this section - -

    (1) the term "access device" means any card, plate, code, account
number, or other means of account access that can be used, alone or in
conjunction with another access device to obtain money, goods, services,
or any other thing of value, or that can be used to initiate a transfer
of funds (other than a transfer originated solely by paper instrument);
    (2) the term "counterfeit access device" means any access device that
is counterfeit, fictitious, altered, or forged, or an identifiable
component of an access device or a counterfeit access device:
    (3) the term "unauthorized access device" means any access device that
is lost, stolen, expired, revoked, canceled, or obtained with intent to
defraud;
    (4) the term "produce" includes design, alter, authenticate, duplicate
or assemble;
    (5) the term "traffic" means transfer, or otherwise dispose of, to
another, or impression designed or primarily used for making an access
device or a counterfeit access device.
    (6) the term "device-making equipment" means any equipment, mechanism,
or impression designed or primarily used for making an access device or
a counterfeit access device.

*Does the definition of an access device include electronic tone
generators? Bruce Sterling, author of  The Hacker Crackdown thought so.
He wrote that "[s]tandard phreaking devices, such as blue boxes, used to
steal phone service from old fashioned mechanical switches are
unquestionably "counterfeit access devices." Redboxes  might be
questionable as well. Sterling, though, wrote his comments in 1991, two
years before the Brady case was decided.

    In US v Brady, 820 F.Supp. 346 (D. Utah 1993), aff'd 13F3d 334 a man
was accused of using and selling altered cellular phones in violation of
section 1029. Brady set up his phones to tumble calls. Tumbling confuses
a switch. It allows a call to be made without a bill to an account. The
government contended that his phones accessed the accounts of the telco
itself and hence constituted an access device. The court disagreed The
court held that since his tumbled calls did not access a subscriber
account they were not an access device within the meaning of  section
1029. They did state that he would have violated section 1029 if he had
cloned his  phones. Cloned phones do access at least two accounts. The
telco did keep an accounting of lost calls caused by tumbling. But that
is not the same as an account itself. Lost blue box and red box calls
are also kept track of  when and if discovered. The court, in fact,
specifically mentioned blue boxes in their decision. In so doing they
gave us all a lot more hope that the Secret Service will not kick in our
doors looking for tone generators:

            "The Government maintains that the charges for 'unmatched' calls
handled as thus described represent a "direct accounting loss" to
Cellular One within the meaning of section 1029 as construed in McNutt.
In effect, the Government argues that access to the cellular carrier's
system translates into access to the carrrier's own accounts through
which the cost of system usage is allocated within and between carriers.
    Yet the same reasoning would seem to apply to use of the older, less
sophisticated "blue boxes" used to gain access to the long distance
telephone system. A so called 'blue box' uses no account number or
access code at all; it emits a 2600Hz tone which permitted the user to
'free ride,' to gain access to the system and place long distance calls
which were not charged to any customer account [footnote deleted] See,
e.g., United States v. Foster, 580 F.2d 388 (10th Cir.1978); United
States v. Patterson, 528 F.2d 1037 (5th Cir.), cert. denied, 429 U.S.
942, 97 S.Ct. 361, 50 L.Ed.2d 313 (1976). Long distance calls placed
with blue boxes are listed in telephone company records in a fashion
similar to 'unmatched' cellular calls described by the Government's
witnesses. This court has not found a reported case in which a 'blue
box' used 'for the purposes of circumventing the charges on interstate
long-distance calls' has been deemed to be an account 'access device'
within the meaning of section 1029(e)(1) on the theory that the 'blue
box' gained access to the telephone company's own accounts.  See, e.g.,
United States v. Disla, 805 F.2d 1340."

    Isn't the law fun? Think you're safe? At least from the Feds? Maybe.
The court, after all, wasn't addressing the question of whether tone
generators were covered by section 1029, they were deciding on whether
a tumbling cellular phone was. These side opinions are called dicta. But
let me tell you folks, this is dammed powerful dicta.*

     (f) This section does not prohibit any lawfully authorized
investigative, protective or intelligence activity of a law enforcement
agency of the United States, a State, or a political subdivision of  a
State, or of an intelligence agency of the United States, or any
activity authorized under chapter 224 of this title. For purposes of
this subsection, the term "State" includes a State of the United States,
the District of Columbia, and any commonwealth, territory, or possession
of the United States.  -end-


MORE INFO? [e-mail]