130 lines
7.6 KiB
Plaintext
130 lines
7.6 KiB
Plaintext
+------------------------------------+
|
||
! INVESTIGATIVE PROCEDURES OF !
|
||
! ELECTRONIC TOLL FRAUD DEVICES !
|
||
! !
|
||
! OFF THE WALL <303> 443-3367 20 MEG !
|
||
+------------------------------------+
|
||
|
||
|
||
This section reviews the investiga tive procedures used by the Security
|
||
Department of Ma Bell.
|
||
|
||
Most of the discussion will concern Blue Box investigations because of the
|
||
frequency of the Blue Box cases referred to law enforcement officials for
|
||
prosecution.
|
||
|
||
The Security Department may initially discover evidence of ETF activity. This
|
||
may result from an analysis of calling patterns to particular numbers. Such
|
||
analyses may reveal abnormal calling patterns which possibly are the result of
|
||
ETF activit . Moreover, cases of suspected ETF are referred to the Security
|
||
Department from the various operating departments of Bell, from other telephone
|
||
companie , or from law enforcement officials. I some instances, detection and
|
||
indenti- fication of a calling station origin- ating suspected Blue Box tones
|
||
can be provided by use of a special non- monitoring test equipment.
|
||
|
||
If initial indications are that there is a substantial possibility tha a Blue
|
||
Box is being used on a partic- ular line, the Security Department determines
|
||
certain information about the line. The name of the subscriber to that line is
|
||
identified, and an inventory is made of the line and station equipment being
|
||
provided to him. A discreet background investi- gation (record) is conducted
|
||
to establish the subscriber's identity. After this preliminary data is gathere
|
||
, ETF detection units are installed on the suspected line to establish
|
||
"probable cause" for further investi- gation. If the "probable cause"
|
||
equipment indicates repeated ETF activity on the line, other equipment is then
|
||
installed to document such activity.
|
||
|
||
The "probable cause" equipment ascertains the presence of multi- frequency
|
||
tones on the subscribers end of the line which would not be present in normal
|
||
usage. The "probable cause" device now being used by some Bell central offices
|
||
register each and every application of 2600Hz tones in single-frequency (SF)
|
||
signalling and/ or 2600Hz tone followed by KP tones used in multi-frequency
|
||
(MF) signallin . As previously stated, such tones should not normally be
|
||
present on the line.
|
||
|
||
If "probable cause" is established, other detection, indentification and
|
||
documentation equipment is installed. The primary equipment now being used is
|
||
the dialed number recorder (DNR), coupled with an auxillary tape recorder. The
|
||
DNR is activated when the suspect subscriber's phone goes "off-hook" andb
|
||
prints on paper tape the following information concerning the call: The date
|
||
and time of the cal and the digits dialed over the suspect line. Moreover, the
|
||
DNR records on the paper tape an indicator of the presenc of 2600Hz tones on
|
||
the line and the presence of multi-frequency signalling tones on the
|
||
subscriber's line. The auxiliary tape recorder is activated *ONLY* after the
|
||
presence of 2600Hz tone on the line is detected by the DNR (indicating the use
|
||
of a Blue Box) . Once the tape recorder is activated, it records the tones
|
||
being emitted by the Blue Box, other signalling tones, and the ringing cycle on
|
||
the called en . It also records a minimum amount of ensuing conversation for
|
||
the purpose o (1) Establishing that the fraudulen call was consummated (2)
|
||
Establishing the identity of th fraudulent caller. The timing duration of the
|
||
tape recorder is pre-set. A tim of one-minute (including pulsing, ringing and
|
||
conversation) is the stand ard setting; however, if the Blue Box user is
|
||
suspected of making overseas calls, the timing may be set for 2 minutes because
|
||
of the greater time required by the Blue Box user to complete the call. Upon
|
||
termination of the call, the DNR automatically prints the time of termination
|
||
and the date. It should bu pinted out that the presence of 2600Hz tones *plus*
|
||
multi- frequncy signalling tones on a subscriber's line positively estab-
|
||
lishes that a Blue Box is being used t place a fraudulent call because such
|
||
tones are not normally originated from a subscribers line.
|
||
|
||
Once the raw data described above i gathered, the Security Department collects
|
||
and formulates the data into legally admissable evidence of crimina activity.
|
||
Such evidence will establish (1) that a fraudulent call was placed by means of
|
||
an ETF device, (2) that conversation ensued, (3) that the fraudulent call was
|
||
placed by an identified individual, and(4) that such call was not billed to the
|
||
subscriber number from which the Blue Box call originated. The evidence which
|
||
is then available consists of documents and also of expert witness testimony by
|
||
telephone company personnel concerning the contents of those documents, the
|
||
oper- ation of the Blue Box, and the oper- ation of the detection equipment.
|
||
(note- Similar techniques are used in the investigation of other forms of ETF.)
|
||
|
||
+-------------------------------------+
|
||
! THE PROSECUTION OF BLUE BOX USERS !
|
||
+-------------------------------------+
|
||
|
||
PRESENTATION OF EVIDENCE TO PROSECUTORS
|
||
------------ -- -------- -- -----------
|
||
|
||
|
||
The evidence accumulated by the Security Department is carefully review ed by
|
||
the Legal Department for the purpose of determining whether suff- icient
|
||
evidence exists to warrent the presentation of the evidence to law enforcement
|
||
officials. If the evidence does warrent such action, it is pres- ented under
|
||
appropriate circumstances to the proper law enforcement officials . In all
|
||
cases where prosecution is recommended, a professionally invest- igated and
|
||
documented summary of the case will be preparted and presented by the Security
|
||
Department to the prosecutor's office. Each case recommended for prosecution
|
||
will be prepared as completely as possible, usually necessitating little or no
|
||
pre-trial investigation for the prosecutor. The summary of the case will
|
||
include the following:
|
||
|
||
(a) A background of the case with detaZkof the defendant's activities and a
|
||
summary of all pertinent invest- igative steps and interviews conducted in the
|
||
course of the investigation.
|
||
(b) Identification of witnesses.
|
||
(c) Synopsis of pertinent points to which each witness can testify.
|
||
(d) Description of all documents and items of evidence and the suggest- ed
|
||
order of proof showing the chron- ology of events. The physical evidence
|
||
presented will normally consist of one or more of the following: magnetic
|
||
tapes from the auxilairy tape recorder, paper tapes from the DNR, worksheets
|
||
and notes prepared in connection with the analysis of each fraudulent call, the
|
||
suspect's toll billing records covering the period during which the fraudulent
|
||
activity occured, computer printouts which established probably cause or a
|
||
statement of the source of the "probable cause", and the tele- phone company
|
||
records of equipment being provided to the suspect.
|
||
|
||
(e) Upon request, the law applicable to the case.
|
||
|
||
|
||
Other pertinent Company records will be furnished under subpoena or demand of
|
||
lawful authority. If an arrest or search warrent is sought, the Security
|
||
representitives will cooperate fully and furnish affidavits required to support
|
||
the application for the warrent s, nevertheless, upon request, such
|
||
representatives will accompany the executing officers to assist in the
|
||
identification of any suspected ETF equipment found. The Security repre-
|
||
sentitive will also be available to suggest pertinent areas for interro- gation
|
||
of the persons suspected of engaging in the fraudulent activity.
|
||
|
||
|
||
OFF THE WALL <303> 443-3367
|
||
Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open
|
||
|