Von Georg Elser am 22. Februar 2015 um 10:07 Uhr
John Thomas Draper aka Captain Crunch, 71, is one of the pioneers of early phreaking in the seventies. He was one of the first to exploit analog phone networks with so called Blue Boxes, allowing him to do free phone calls all over the world. One of his methods was using a toy whistle which was packaged in boxes of Cap’n Crunch cereal and precisely emitted a tone of 2600 Hz. The same frequency was used by AT&T long lines to indicate that a trunk line was ready and available to route a new call. Draper served several prison sentences in the late seventies for phone fraud. In our interview he talks about tapping guards and teaching Mexican drug cartel members how to phreak, hacking crisis hotlines of the White House and modern phreaking.
digitalista: Mr. Draper, please tell us how you started with computers.
John T. Draper: In the sixties I took an IBM System/360 assembler language course and I did programming on it using punched cards. They were a fucking hassle. I put them in a card reader and waited four hours for the result. Then I realized I made a mistake and forgot a semicolon at the end of a statement or something. The computer rejected my program.
digitalista: When did you pick the name “Captain Crunch”?
John T. Draper: I was on the 2111 conference, which was kind of like a big party line. You could only get on it with a Blue Box, so the amount of people who were on it were pretty elite. Not the script kiddy kind of people, but people that were very knowledgeable about how the system works. I just called myself John from San Jose. Later on a guy said “You got to pick a more creative handle than that!”. I replied “Has Captain Crunch been taken? No? Well that’s a surprise!”. So I picked the name … and then it stuck.
digitalista: When did you start phreaking?
John T. Draper: It was 1969. The phone company in the US was using what is called In-Band signaling. What that meant was that the signaling information was being sent over the same wire pair that we talk on. That was a very bad design decision – to say it the least – and opened big, big wide holes in the telephone network.
digitalista: Which phone networks were vulnerable?
John T. Draper: In this case, it worked everywhere. There was no place where it didn’t work. And I proved that by finding myself a crank phone. By cranking it you’re sending a ringing signal to the operator switchboard. The operator comes on and I say “Hey, I want to make a data call.” “Can you make a data call from that phone?” she says. “Yeah, all I have to do is just to acoustically couple it. Just stay off the line when I’m working on it”. She connected me up to an 800-number, I blew it off with 2600 Hz, churned it up and it worked. So I was able to make a blue box call on a crank phone. That goes just to show you that you could do it from any phone, anywhere. There was no place where I couldn’t do it.
digitalista: Why did you do it?
John T. Draper: Just the fact that it existed and it was so wide spread was very intriguing to me. I had to find a phone network where it didn’t work. I was unsuccessful. Every single phone network I got my hands on it worked!
digitalista: Later you served several sentences for phone fraud.
John T. Draper: The officials were very sensitive about this information getting out. What they didn’t expect me to do was to have phone phreak classes in jail because they’re such morons. They should have just hired me and I would have fixed these bugs in a couple of months. But nooo, they just threw their book at me, locked me up and threw away the key. That was their biggest mistake, because they just exposed me to the kind of people you don’t want to know how to do this.
So as a matter of survival when you’re in jail, you know I mean I was more kind of a geeky guy… I was reasonably fit, but not super strong, so I couldn’t really handle myself in a fight very well. So I found the biggest, meanest and nastiest person I could find and became good friends with them. Then I started teaching them how to use the blue box.
digitalista: Seriously, phone phreak classes in prison?
John T. Draper: I also had fun teaching everyone how to do it. It was a challenge to teach some Mexican drug cartel person how to use the phone safely.
digitalista: How do you feel about your time in prison?
John T. Draper: I had lots and lots of fun painting the names of the judges on the swine’s that were there. It was a government subsidized pig farm, they had cows and pigs and it was run by the inmates at Lompoc Federal Prison in California.
digitalista: Did you learn anything in prison which made your time in worthwhile?
John T. Draper: Well … I wanted to know when the guards were nearby. So I modified an FM radio to pickup prison frequencies of a 156 MHz which was close enough to the FM dial. I just had to take a few windings off from the coil to make the frequency go higher. They had an electric room where I mounted a switch in the inside of a radio. When I flipped that switch, now that radio was picking up their Walkie-Talkies. I had fun just teaching the other inmates how to do it.
digitalista: An oft-repeated story from the past says you once rang up the White House and talked to president Nixon. Is that true?
John T. Draper: Well, sort of true. I was scanning all the free 800-numbers in Washington, D.C., searching for interesting numbers. On one of the numbers I reached the person on the other end of the line was really nasty and told me to get off the line. After a few days of waiting around I decided to go back and re-investigate that number. I kind of had to bullshit my way through. Social engineer it. So I told them “This is AT&T White Plains Division, we have a translation on your 4A-network into the White House. What number have we reached?”. He said “You have reached the CIA crisis hotline number”. It turned out to be a number for CIA agents to use if there was a crisis. With the right scrambling equipment they could encrypt their call. To make the initial connection it was just a standard call though. So I wrote that number down... it would be very useful.
A couple of days later I go to a phone phreak party and there was a number that they had. I traded that number for the AT&T conference number which was really cool. I heard this phreak from downstairs, Adam, making the call: “Olympus please!” (supposedly President Nixon's secret code name) and when Nixon came on the line he said “Sir! We have a national crisis on our hands, sir. We run out of toilet paper!” and we hung up.
digitalista: Blue Boxing was also possible and very popular in Germany. A lot of phreaks with a Commodore Amiga rang up Bulletin Board Systems (BBS) for free and up/downloaded their stuff. Did you ever own an Amiga or C64?
John T. Draper: No, I never did. But I know that Commodore was very, very popular in Germany. I went to the CCC (Chaos Computer Club) congress in 1988 and 1989 and everybody was using Commodore’s C64 back then. It was like the system to use… also the Amiga.
digitalista: Have you ever been to Germany lately?
John T. Draper: I was there in 2011. I didn’t have much money and I posted it on my blog and on Twitter. I said “Hey guys, I am in Germany! If you want me to visit you, I will be visiting you. But you have to cover my train fare to go to your city. Three people take me up on it. I went to Gutersloh and stayed with a Mac programmer, very smart guy. After that I went so see some people in Mannheim.
digitalista: What are phreaker’s doing nowadays?
John T. Draper: I am somewhat removed from that scene. But I understand that people have moved on. Now everybody is hacking VoIP (Voice over IP) systems like Skype and things like that, where it’s possible to hijack a Skype connection and impersonate somebody else on Skype.
digitalista: What messenger would you recommend for secure calls then?
John T. Draper: I can tell you that the safest way to do it right now if you have an Android or iPhone/iPad is to download a program called Wickr. It is a text messaging program, there is no indication that a text message has been sent. There is no meta data. It uses forward security, which means that the session key is generated upon at the beginning of the session and at the end of it that key goes away. The key is not even stored on the server anymore. But you don’t have to deal with all that bullshit about setting everything up, because it is already set up. It’s very easy to use.
digitalista: How do you feel about secret services all around the world tapping communication nowadays?
Captain Crunch: That does not surprise me in the least. I’ve known that this hanky-panky has been going on since day one. I didn’t need Edward Snowden to tell me what was going on, I kind of knew it! But that guy has got balls, that’s for sure. He risks is lifestyle so people know what is going on. I mean.. hat’s off to him!
digitalista: The first whistleblower who revealed the existence of the NSA and its worldwide covert surveillance network was Perry Fellwock, a former NSA analyst. In 1971 he blew the whistle on ECHELON, a worldwide intelligence network.
John T. Draper: ECHELON back then was very secret, nobody knew much about it. It was a keyword system, where if you said a certain word - like “hijack”, “terrorist” - these keywords were than picked up on. The actual conversation was recorded, but it was not accessible. They couldn’t access that recording. All they could access was your metadata, including the phone number you called, your phone number, the date and time the call was made and what carrier the call was made over and so on. That reference was then stored in a file somewhere in the NSA’s big fat database. So they could go back to ten years and find out that you talked to your mum about getting your tooth drilled because you had toothache. That’s the kind of thing they do. And that’s been going on since the sixties!
digitalista: Let us talk about the present. What are you working on?
John T. Draper: I don’t have an opportunity for getting employment anymore. I can’t fine a job. There is no way in the states that they would hire a convicted felon. They’re just blacklisted. And I seem to attract what I call big talkers. They talk their shit, but they never go through it.
digitalista: You’re 71 now and also received several medical treatments. How is your health?
John T. Draper: When I was working in Bangkok/Thailand a while ago they diagnosed a degenerative spine disease. The doc said I need to go into surgery right away. The minute I got back within two days I was in the hospital. I did receive several other treatments, the most recent one in a clinic in Pattaya, Thailand. I’m back in the US now.
digitalista: Everything that has a beginning, has an ending. How do you feel about death in general?
John T. Draper: I try not to think about it. Even though I was in a hospital and looked at the other side of it. I saw it. And the doctors brought me back. I try not to think about it.
digitalista: What is your legacy? What would like people to think of you when they remember Captain Crunch?
John T. Draper: As a geek, as a nerd, as a person that experienced the computer revolution from day one… because I have experienced the computer revolution since day one.