$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $ $ $ --------------------------------- $ $ | INVESTIGATIVE PROCEDURES. | $ $ |-------------------------------- $ $ $ $ OF $ $ $ $ --------------------------------- $ $ | ELECTRONIC TOLL FRAUD DEVICES | $ $ --------------------------------- $ $ $ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $ $ $ Typed by: $ $ Lex Luthor $ $ $ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ ** INVESTIGATIVE PROCEDURES ** ------------------------------ This section reviews the investigative procedures used by the Security Department of Ma Bell. Most of the discussion will concern Blue Box investigations because of the frequency of the Blue Box cases referred to law enforcement officials for prosecution. The Security Department may initially discover evidence of ETF activity. This may result from an analysis of calling patterns to particular numbers. Such analyses may reveal abnormal calling patterns which possibly are the result of ETF activity. Moreover, cases of suspected ETF are referred to the Security Department from the various operating departments of Bell, from other telephone companies, or from law enforcement officials. In some instances, detection and identification of a calling station originating suspected Blue Box tones can be provided by use of a special non-monitoring test equipment. If initial indications are that there is a substantial possibility that a Blue Box is being used on a particular line, the Security Department determines certain information about the line. The name of the subscriber to that line is identified, and an inventory is made of the line and station equipment being provided to him. A discreet background investigation (record) is conducted to establish the subscriber's identity. After this preliminary data is gathered, ETF detection units are installed on the suspected line to establish "probable cause" for further investigation. If the "probable cause" equipment indicates repeated ETF activity on the line, other equipment is then installed to document such activity. The "probable cause" equipment ascertains the presence of multi-frequency tones on the subscribers end of the line which would not be present in normal usage. The "probable cause" device now being used by some Bell Central Offices register each and every application of 2600 hz tones in single-frequency (SF) signaling and/or 2600 hz tone followed by KP tones used in multi-frequency (MF) signaling. As previously stated, such tones should not normally be present on the line. If "probable cause" is established, other detection, identification and documentation equipment is installed. The primary equipment now being used is the dialed number recorder (DNR), coupled with an auxiliary tape recorder. The DNR is activated when the suspect subscriber's phone goes "off-hook" and prints on paper tape the following information concerning the call: The date and time of the call and the digits dialed other the suspect line. Moreover, the DNR records on the paper tape an indicator of the presence of 2600 hz tones on the line and the presence of multi-frequency signaling tones on the subscriber's line. The auxiliary tape recorder is activated * ONLY * after the presence of 2600 hz tone on the line is detected by the DNR (indicating the use of a Blue Box). Once the tape recorder is activated, it records the tones being emitted by the Blue Box, other signaling tones, and the ringing cycle on the called end. It also records a minimum amount of ensuing conversation for the purpose of: (1) Establishing that the fraudulent call was consummated (2) Establishing the identity of the fraudulent caller. The timing duration of the tape recorder is pre-set. A time of one-minute (including pulsing, ringing and conversation) is the standard setting; however, if the Blue Box user is suspected of making overseas calls, the timing may be set for 2 minutes because of the greater time required by the Blue Box user to complete the call. Upon termination of the call, the DNR automatically prints the time of termination and the date. It should be pointed out that the presence of 2600 hz tones * plus * multi-frequency signaling tones on a subscriber's line positively establishes that a Blue Box is being used to place a fraudulent call because such tones are not normally originated from a subscribers line. Once the raw data described above is gathered, the Security Department collects and formulates the data into legally admissible evidence of criminal activity. Such evidence will establish: (1) That a fraudulent call was placed by means of an ETF device, (2) That conversation ensued, (3) That the fraudulent call was placed by an identified individual, and (4) That such call was not billed to the subscriber number from which the Blue Box call originated. The evidence which is then available consists of documents and also of expert witness testimony by telephone company personnel concerning the contents of those documents, the operation of the Blue Box, and the operation of the detection equipment. (Note -- Similar techniques are used in the investigation of other forms of ETF.) Part 2 PRESENTATION OF EVIDENCE TO PROSECUTOR ------------ -- -------- -- ---------- The evidence accumulated by the Security Department is carefully reviewed by the Legal Department for the purpose of determining whether sufficient evidence exists to warrant the presentation of the evidence to law enforcement officials. If the evidence does warrant such action, it is presented under appropriate circumstances to the proper law enforcement official. In all cases where prosecution is recommended, a professionally investigated and documented summary of the case will be prepared and presented by the Security Department to the prosecutor's office. Each case recommended for prosecution will be prepared as completely as possible, usually necessitating little or no pre-trial investigation for the prosecutor. The summary of the case will include the following: (A) A background of the case with details of the defendant's activities and a summary of all pertinent investigative steps and interviews conducted in the course of the investigation. (B) Identification of witnesses. (C) Synopsis of pertinent points to which each witness can testify. (D) Description of all documents and items of evidence and the suggested order of proof showing the chronology of events. The physical evidence presented will normally consist of one or more of the following: magnetic tapes from the auxiliary tape recorder paper tapes from the DNR, work sheets and notes prepared in connection with the analysis of each fraudulent call, the suspect's toll billing records covering the period during which the fraudulent activity occurred, computer printouts which established probably cause or a statement of the source of the "probable cause", and the telephone company records of equipment being provided to the suspect. (E) Upon request, the law applicable to the case. Other pertinent Company records will be furnished under subpoena or demand of lawful authority. If an arrest or search warrant is sought, the Security representatives will cooperate fully and furnish affidavits required to support the application for the warrants, nevertheless, upon request, such representatives will accompany the executing officers to assist in the identification of any suspected ETF equipment found. The Security representative will also be available to suggest pertinent areas for interrogation of the persons suspected of engaging in the fraudulent activity. (I hope that this will help most of you who Blue Box and who commit other various Electronic Toll Fraud crimes to avoid detection of using a DTF. Also it would seem that they could get almost *no* proof if you went to pay phones instead of at your home.)