The Silver Box and the #5 ACD Hack

If you think of a touch-tone phone, you probably think of it as having a 12-digit keypad (0-9, *, and #) arranged in a 3 x 4 layout.

But the specifications for touch-tones contemplated an additional column of four additional digits. On a civilian touch-tone phone these digits were called A, B, C, and D. On military AUTOVON phones they were called Flash Override, Flash, Immediate, and Priority. (Both civilian and military phones used the same touch tones, so the digits and tones were actually the same.)

"Silver box" was the name given to a touch-tone phone that had been modified to produce these fourth-column touch-tone digits.

There wasn't a tremendous amount you could do with a silver box, but one hack did achieve a certain amount of notoriety, and I somehow missed talking about it in Exploding The Phone. Back in the 1970s and 1980s if you dialed directory assistance (555-1212) and held down the D key as your call was going through, you would be dropped into a special maintenance mode of the equipment used for routing calls to operators. From there you could set up a loop-around circuit and you could even impersonate a directory assistance operator.

The equipment in question was something called a #5 automatic call distributor, or ACD. This was basically a #5 crossbar switch that had been modified to handle the task of distributing incoming calls to operators -- in this case, directory assistance operators. The first #5 ACD went into service in 1969.

In 2014 I spent some time talking to Bill Acker about his memories of this hack.

When you called directory assistance served by a #5 ACD, he says, "it gave audible ring until it found an operator. During that time, during the clicking, it was listening for a D tone, what we called a Priority tone at the time, because we knew it from AUTOVON.” When you hit it with that touch-tone digit, it would give you a 120 interruption-per-minute dial-tone -- in other words, an interrupted dial tone that sounded kind of like a fast busy signal. This was the special maintenance mode.

Once you had this dial tone, you could send it a single touch-tone digit. Acker remembers the digits as follows:

1 - allowed you to talk to the test board. They were generality very confused when we rang in. I remember doing it in Buffalo once and the guy answered with a puzzled tone and said, "This has never rung before!" Seattle said, "What's the big idea?"

2 - milliwatt test tone

6 and 7 gave you a loop-around. Silent, just clicked in. Good trucks, good transmission.

So, if you dialed 800-555-1212 and hit the D key at the right time, and then pressed 6, you'd be on one side of a loop. If your buddy did the same thing and pressed 7, he'd be connected to you, and you could talk for free.

Interestingly, says Acker, "Some directory assistance #5 ACDs -- St. Louis and Seattle for sure -- had a bug where, if you were on the loop around and one side dropped, they wouldn't disconnect cleanly. Incoming calls would come in on the other side of the loop. My favorite thing was to dial 800-555-1212 on two lines, set up the loop, hang up, and then wait for people to call in. It was fun to do, probably for a day or two, and then I never did it again."

Acker believes the #5 ACD hack was discovered by "a Seattle person, probably Bob or Chris Bernay. This must have been about 1971. Somewhere in there. Certainly no later than 1972. They lasted the
life of the ACDs, I recall."

A February 15, 1972 AT&T memo on "Fraudulent or Unauthorized Use of the Switching Network" by P. L. Vigilante, the Engineering Director - Switching, says,

No. 5 ACD - Imitating an Operator

Both access ports on the loop around test circuit can be seized by making a call to each, using an unauthorized tone during the set up of the call in the ACD. If one of these calls is released
the local office switches will release, but the switches in the ACD will hold operated. Consequently the next call on that trunk will be set up through the loop around circuits to the original caller, who
can act as an operator. [...] Due to the serious nature to the telephone company of such unauthorized usage it is requested that the No. 5 ACD loop around circuits be made busy until the correction
has been applied to the circuits.

(I thought I used to have an FBI file that mentioned something about the #5 ACD hack, but alas, I am unable to put my hands on it at this point and, in retrospect, I may have conflated this with something
else.)

Sources:

P. L. Vigilante, “Fraudulent or Unauthorized Use of the Switching Network,” February 15, 1972 (GL 72-02-080), http://explodingthephone.com/docs/dbx0311.pdf

A History of Engineering and Science in the Bell System: Switching Technology (1925-1975), 1982, pp. 372-373.

The Magician, "Everything you wanted to know about 1633 Hz but were afraid to ask," TAP #62 (Mar-Apr 1980), p. 4. http://www.scribd.com/doc/82750134/TAP-Magazine-Issue-62

Interviews with Bill Acker, May 2014.

Comments

[Frank Carson]

Understand some of the Jerry Lewis MDA Telethons in the '70s-early 80s also used No5 crossbar ACD for handling incoming calls. Same test mode with the 'D' key, etc.

[Account Deleted]

Nitpick: The AUTOVON levels were Flash Override, Flash, Immediate, and Priority, from A to D. Routine calls were dialed without a precedence level.

[Phil Lapsley]

Wow. Brain fade. Good catch, Todd, corrected!

[Phone Trips (Mark Bernay)]

This was a long time ago so I'm not sure, but I remember several details differently. First, I think you could press any of the A,B,C,or D keys as the call was going through, it didn't have to be D.

Second, you had to be HOLDING DOWN the key at the INSTANT the operator answered, you couldn't just press it once while it was ringing. So when you heard the ringing start, you would press and hold a key, then listen really carefully through the loud touchtone and you could barely hear the click of the operator answering, then you could let the key up.

Third, I think this was discovered by a guy named Sterling in Seattle, not Bob or Chris Bernay. I kind of remember Sterling telling me about this and thinking how weird it was that he was able to stumble across something like this.

[Dfroula]

The Bell System Practice that describes the ACD test arrangement is here:

http://www.telephonecollectors.info/index.php/browse/doc_download/7365-218-289-501pt-x1-ia

For those interested in details of how Ma Bell equipped the ACD test function.