IEEE Spectrum February, 2013 - 32

Ralph Barclay was walking through the engineering library at Washington State
University, just minding his own business, when it called out to him. He couldn't
say why, it just did. ¶ It was a booklet, about 18 by 23 centimeters and maybe a
centimeter thick, on display in the library's new periodicals section. Its pale blue
cover proclaimed it to be the November 1960 issue of something called The Bell
System Technical Journal. It had been out for less than a week.
Barclay looked at the table of contents printed on its cover. Most
of the articles could put even the hardest of hard-core geeks to sleep
at 20 paces: "Magnetic Latching Relays Using Glass Sealed Contacts,"
"Molecular Structure in Crystal Aggregates of Linear Polyethylene,"
or the ever popular "Ionic Radii, Spin-Orbit Coupling, and the Geometrical Stability of Inorganic Complexes."
But one title caught his eye: "Signaling Systems for Control of
Telephone Switching." He flipped to the article and started skimming. Minutes passed. His original purpose for coming to the library
shelved for the moment, he sat down and began to read in earnest.
Barclay was just 18. Athletic and of medium build, with brown
hair and blue eyes, Barclay had started his first year at Washington
State's Pullman campus, about 50 miles [80 kilometers] south of
Spokane, just a couple of months earlier. "I was living in the dorm,"
he remembers, "and a lot of people in the dorm are looking for
ways to make cheap phone calls home to their girlfriends and parents and suchlike." One of the guys in the dorm had "somehow," he
says, acquired his own personal pay telephone. And although students weren't allowed to have telephones installed in their rooms,
for some reason the dorm rooms still had telephone lines in them.
Barclay's dorm had quite a few engineers in it-and engineers,
Barclay allows, are a problem. The engineers soon determined
that somebody had left the door unlocked to the building's telephone closet, the little room where all the telephone wires come
from. In the dark of night an operation was mounted. Certain
wires were cross-connected. Et voilà: A pay telephone line from
somewhere on campus ended up connected to the personal pay
phone in Barclay's dorm. Barclay and the other kids in the dorm
could now make telephone calls by depositing money in the pay
phone, just like usual. The difference was this: The owner of the
pay phone-apparently not a business major-was a nice guy and
returned the caller's money after each call.
Maybe it was this pay phone hack that caused Bells to ring in Barclay's brain when he spotted the article in the Bell System Technical
Journal. The article laid bare the technical inner workings of AT&T's
long-distance telephone network with clarity, completeness, and detail. It was all there: how the long-distance switching machines sang
to each other with single-frequency (SF) and multifrequency (MF)
tones, how 2600 hertz was used to indicate whether a telephone

This article is an excerpt from Exploding the Phone: The Untold Story of the
Teenagers and Outlaws Who Hacked Ma Bell © 2013 by Philip D. Lapsley;
reprinted with the permission of the publisher, Grove/Atlantic.
32

fEb 2013

NORTh AMERICAN

SPECTRUM.IEEE.ORG

had answered, what the frequencies were of the tones that made
up the MF digits, how overseas calls were made-it even included
simplified schematic diagrams for the electrical circuits necessary to
generate the tones used to control the network. Nothing was hidden.
By the time Barclay finished reading it, the vulnerability in AT&T's
network had crystallized in his mind: "I thought, this is a better
way than using a pay phone...this is a way to get around all that
other stuff and do it directly."
"It," of course, was making free calls.
The ability to absorb 64 pages of dry, technical mumbo jumbo
and spot the vulnerability is a rare one. The engineers from Bell
Labs who designed the system and wrote the article didn't see it.
Thousands of engineers in the future would read that article and
not see it. But 18-year-old Ralph Barclay did. The funny thing about
it is, once the hole is explained to you, it's obvious. But until it's
explained to you, most people would never think of it. Certain
people have minds that are tuned in a particular way to see things
like that. Ralph Barclay was one of those people.
To understand Barclay's insight we have to think back to the things
that made up AT&T's automated long-distance network-things like
the spectacularly named #4A crossbar switching system that was
the brains of the long-distance telephone network, and how the
machines talked to each other by speaking in tones. Because that's
what the Bell System Technical Journal described and that's where
Ralph Barclay spotted the flaw. Here's what he came up with:
Say you're in Seattle and, as always, you want to call your friend
Bill in Denver. With Barclay's hack, your first step is to pick up the
phone and dial directory assistance in any city-let's say New York
just for fun: 212-555-1212. Unlike today, calls to directory assistance
were free back then.
Seattle and New York are both big cities and have direct trunk
lines between them. On a given long-distance trunk line between
Seattle and New York, the switching machine in Seattle sends a
2600-Hz tone-7th octave E-to New York to indicate that the line
is idle. New York sends the same tone back to Seattle to indicate
that the line is not in use on its end either. Remember how in a
flight of fancy an AT&T manager described the switching machines
as "singing" to one another? This is the boring part of that song:
You can think of it as the machines monotonously whistling this
single note back and forth. It's almost like they're keeping each
other company, reassuring each other that they're both still there.
As you dial the last digit of the number for New York directory
assistance, the fancy switching machines and their signaling sys-

http://SPECTRUM.IEEE.ORG

Table of Contents for the Digital Edition of IEEE Spectrum February, 2013