


UPLOADED BY: LEX LUTHOR
DATE: FRI APR 20 02:16:44 PM


$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$                                     
$  ---------------------------------  
$  !   INVESTIGATIVE PROCEDURES.   !  
$  !--------------------------------  
$                                     
$                OF                   
$                                     
$  ---------------------------------  
$  ! ELECTRONIC TOLL FRAUD DEVICES !  
$  ---------------------------------  
$                                     
$                                     
$        Typed and Uploaded by:       
$                                     
$$$$$$$$$$$$-=>Lex Luthor<=-$$$$$$$$$$
$                                     
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
 
 
      **INVESTIGATIVE PROCEDURES**
      --------------- -----------
 
 
   This section reviews the investiga
tive procedures used by the Security
Department of Ma Bell.
 
   Most of the discussion will
concern Blue Box investigations
because of the frequency of the Blue
Box cases referred to law enforcement
officials for prosecution.
 
   The Security Department may
initially discover evidence of ETF
activity. This may result from an
analysis of calling patterns to
particular numbers. Such analyses may
reveal abnormal calling patterns which
possibly are the result of ETF activit
. Moreover, cases of suspected ETF are
referred to the Security Department
from the various operating departments
of Bell, from other telephone companie
, or from law enforcement officials. I
some instances, detection and indenti-
fication of a calling station origin-
ating suspected Blue Box tones can be
provided by use of a special non-
monitoring test equipment.
 
   If initial indications are that
there is a substantial possibility tha
a Blue Box is being used on a partic-
ular line, the Security Department
determines certain information about
the line. The name of the subscriber
to that line is identified, and an
inventory is made of the line and
station equipment being provided to
him. A discreet background investi-
gation (record) is conducted to
establish the subscriber's identity.
After this preliminary data is gathere
, ETF detection units are installed
on the suspected line to establish
"probable cause" for further investi-
gation. If the "probable cause"
equipment indicates repeated ETF
activity on the line, other equipment
is then installed to document such
activity.
 
   The "probable cause" equipment
ascertains the presence of multi-
frequency tones on the subscribers end
of the line which would not be present
in normal usage. The "probable cause"
device now being used by some Bell
central offices register each and
every application of 2600Hz tones in
single-frequency (SF) signalling and/
or 2600Hz tone followed by KP tones
used in multi-frequency (MF) signallin
. As previously stated, such tones
should not normally be present on the
line.
 
   If "probable cause" is established,
other detection, indentification and
documentation equipment is installed.
The primary equipment now being used
is the dialed number recorder (DNR),
coupled with an auxillary tape
recorder. The DNR is activated when
the suspect subscriber's phone goes
"off-hook" andb prints on paper tape
the following information concerning
the call: The date and time of the cal
and the digits dialed over the suspect
line. Moreover, the DNR records on the
paper tape an indicator of the presenc
of 2600Hz tones on the line and the
presence of multi-frequency signalling
tones on the subscriber's line. The
auxiliary tape recorder is activated
*ONLY* after the presence of 2600Hz
tone on the line is detected by the
DNR (indicating the use of a Blue Box)
. Once the tape recorder is activated,
it records the tones being emitted by
the Blue Box, other signalling tones,
and the ringing cycle on the called en
. It also records a minimum amount of
ensuing conversation for the purpose o
   (1) Establishing that the fraudulen
call was consummated
   (2) Establishing the identity of th
fraudulent caller. The timing duration
of the tape recorder is pre-set. A tim
of one-minute (including pulsing,
ringing and conversation) is the stand
ard setting; however, if the Blue Box
user is suspected of making overseas
calls, the timing may be set for 2
minutes because of the greater time
required by the Blue Box user to
complete the call. Upon termination of
the call, the DNR automatically prints
the time of termination and the date.
It should be pointed out that the
presence of 2600Hz tones *plus* multi-
frequncy signalling tones on a
subscriber's line positively estab-
lishes that a Blue Box is being used t
place a fraudulent call because such
tones are not normally originated from
a subscribers line.
 
   Once the raw data described above i
gathered, the Security Department
collects and formulates the data into
legally admissable evidence of crimina
activity. Such evidence will establish
   (1) that a fraudulent call was
placed by means of an ETF device,
   (2) that conversation ensued,
   (3) that the fraudulent call was
placed by an identified individual,
and(4) that such call was not billed
to the subscriber number from which
the Blue Box call originated. The
evidence which is then available
consists of documents and also of
expert witness testimony by telephone
company personnel concerning the
contents of those documents, the oper-
ation of the Blue Box, and the oper-
ation of the detection equipment.
(note- Similar techniques are used in
 the investigation of other forms of
ETF.)
 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 
 
Read part 2, on the prosecution of
blue box users.
 
Done


Press Q to continue: X