                    SHOPPER'S GUIDE TO COCOTS
                               by
                          Count Zero

        So you're walking down the street and you see a payphone.  Gotta make
an important call, so you dig into your pocket to get a dime.  Picking up the
handset, you suddently notice that they payphone wants a quarter for a local
call!  What the hell, and where did this synthesized voice come from?
        Let's make this article short and to the point.  COCOT is an acronym
for Customer Owned Coin Operated Telephone.  In other words, a COCOT is a phone
that is owned or rented by a paying customer (most likely, a hotel or donut
shop).  A COCOT is not a normal payphone. The telephone co. doesn't own it, and
the telephone line is usually a normal customer loop (unlike payphones,
where the phone line is a "special" payphone loop, allowing the use of
"coin tones" to indicate money dropped in!)  So!  A COCOT may look and
smell like a telephone company payphone, but it is not.
        Why do COCOT's exist?  Simple.  Money!  A customer owned
payphone is money in the bank!  You pay more for local calls and long
distance is typically handled by sleazy carriers that offer
bad/expensive service.  The owner/renter  of the COCOT opens the coinbox
and keeps the money him/herself!  Also, a particularly sleazy quality of
COCOT is the fact that it does not receive incoming calls.  This, of
course, is because of money.  If people are calling in to a COCOT, the
COCOT is not making money and businesses always want to make as much
money as possible even if it hurts the consumer.  Think about it.  It
really sucks to call someone at home from a COCOT and then not be able
to have him/her call you back to save money.  "Guess I'll have to keep
feeding the COCOT quarters!"
        Where is a good place to look for COCOTs?  Outside Dunkin Donut
shops, restaurants, clubs, bars, and outside/inside hotels and
'convenient' locations.
        How do I fugre out if I have found a COCOT?  Simple.  A COCOT
will have no telephone company logos on it.  It may look just like a
telephone company phone chrome with blue stickers and all that.  Also, a
COCOT typically charges more for a local call than a regular telephone
company  payphone.  (In Massachussetts, local calls are a dime.  In
places like New York City, they are 25 cents) A COCOT will most often
have a synthesized voice that asks you to "please deposit 25 cents" or
whatever.  Also, some fancy COCOTs will not look like payphones at all.
Some in hotels have weird LCD displays and look totally different, but
they always charge you more than a normal phone.
        I found this weird payphone in Boston that wants a quarter, and
this synthesized voice is harassing me.  When does the fun begin?  Soon.
First of all, you must understand that the COCOT is a mimic.
Essentially, it wants you to think that it is just a plain ol' payphone.
Pick up the handset.  Hear that dialtone?  Hah!  That dialtone is fake,
synthesized by the innards of the COCOT.  You are at the mercy of the
COCOT.  Remember a COCOT runs off of a normal customer loop so, unlike a
telephone company payphone where you must deposit money to generate coin
tones that are read by the central office, the security of a COCOT
depends solely on the COCOT phone itself.  It's as if you took your own
phone and put a sign on it saying "Please put 10 cents in this jar for
every call you make."  COCOTs are not naive.  They won't let you near
the unrestricted dialtone until you fork over the cash-ola.  Or so they
think!
        See, the Achilles' heel of the COCOT is the fact that all
payphones must let you make 1-800 calls for free!  It's not just a fact,
it's the law.  Now pick up the handset again and place a 1-800 call.
Any 1-800 number will do.  When they answer at the other end, just sit
there.  Do nothing.  Ignore them.  Wait for them to hang up the phone.
Here's an example.
        Dial 1-800-LOAN-YES.
        [Ring, Ring]...[click] "Hello, you wanna buy some money?  Hello?
HELLO?!" [CLICK]
        (You will now hear some static and probably a strange "waffling"
noise, like chh, chh, chh, chh, chh.)
        [CLICK] DIALTONE!
        Now what have we got here?  A dialtone?  Yes, you guessed it,
the dialtone you now hear is the unrestricted dialtone of the COCOT's
customer loop.
        So what?   So I got an "unrestricted dialtone".  Big Deal?
        Meathead!  With an unrestriced dialtone, all you need to do is
place a call via DTMF tones (the tones a touch-tone keypad generates).
Now, try dialing a number with the COCOT's keypad.  Whoa!  Waitasec, no
sound!  This is a typical lame attempt at protection by the COCOT.  Just
whip out your Radio Shack pocket tone dialer and try calling a number,
any number.  Place it just as if you were calling from a home phone.
Call a 1-900 sex line.  Call Guam.  You are free and the COCOT's
customer loop is being billed!
        Note:  some COCOTs are more sophisticated at protecting
themselves.  Some will reset when they hear the dialtone.  To get around
this, make a loud hissing sound with your mouth into the mouthpiece
after the 1-800 number hangs up.  Get your tone dialer ready near the
mouthpiece.  When you hear the dialtone, quickly dial the first digit of
the number you want to call.  If you hiss loudly enough, you may be able
to mask the sound of the dialtone and prevent the COCOT from resetting.
Once you dial the first digit of the number you are calling, the
dialtone will disappear (naturally).  You can stop hissing like an idiot
now.  Finish dialing your free phone call.  Also, some COCOT's actually
disable the handset after the call hangs up (in other words you can't
send DTMF tones through the mouthpiece).  Oh well, better luck next
time.
        However, most of the COCOT's I have run across only disable the
DTMF keypad.  So all you need is a pocket dialer to circumvent this!
        Other things to know:  Sure you can't call a COCOT, but it does
have a number.  To find out the COCOT's number, call one of the automated
ANI services that tell you the number you're dialing from.  Now try
calling the COCOT from another phone.  You will hear one of two things:
1) synthesized voice:  "Thank you" [DTMF tones] [CLICK] [hang up]; 2)
weird carrier.
        A COCOT's number is only used by the company that built or sold
the COCOT.  By calling up a COCOT, a technician can monitor its
functioning, etc.  In case number 1, you must enter a 3 or 4 digit
password and then you'll get into a voice menu driven program that'll
let you do "maintenance" stuff with the COCOT.  In case number 2, you
are hooked to the COCOT's 300 bps modem (Yes, a modem in a payphone).
Likewise, if you can figure out the communications settings, you'll be
into the COCOT's maintenance routines.
        Personally, I haven't had much luck (or patience) with calling
up and hacking COCOT maintenance functions.  I just like making free
phone calls from them!
        COCOT Etiquette:  Now, remember, you are making free phone
calls, but someone has to pay for them and that is the owner.  The
COCOT's customer loop is billed the cost of the calls, and if the owner
sees a big difference in the profits made on the COCOT (profit equals
coins from the COCOT minus the bill from the telephone company for
customer loop), they'll know something is up.  So the rule is don't
abuse them!  Don't call a 1-900 number and stay on the line for 12
hours!  If a COCOT is abused severely, an owner will eventually lose
money on the damn thing!  And that means bye bye COCOT.  Also, remember
that a record of all long distance calls is made to the COCOT's customer
loop and COCOT companies will sometimes investigate "billing
discreprancies" so don't call anyone you personally know unless you are
sure they are "cool".
        [RING RING] "Hello?"
        "Hello, this is Cointel, Inc.  We'd like to ask you a few
questions about a call you received from Boston on 2/12/91.  Could you
tell us the name and address of the person who placed the call?"
        Cool Dude:  "What?  I don't remember.  Go to hell! [SLAM!]"
        Meathead:  "Uh, sure, his name is John Smith.  You want his
address too?"
        Get the picture?  Good...
        COCOTs are a great resource if we use them wisely, like our
environment.  We've gotta be careful not to plunder them.  Make a few
long distance calls and then leave that particular COCOT alone for a
while.  Chances are your bills will be "absorbed" by the profit margin
of the owner and probably ignored but the smaller the owner's profit
margin gets, the more likely suspicions will be aroused.  'Nuff said!  I
have found COCOTs everywhere.  COCOT technology is relatively new,
though.  I know many towns that have none.  Check out big cities.
        As for a tone dialer, don't leave home without one!  A true
phreak always has a DTMF tone dialer at hand along with a red box!  My
personal favorite is the COMBO-BOX (red box plus DTMF).  Take a Radio
Shack 33-memory Pocket Dialer.  Open up the back.  Remove the little
3.579 MHz crystal (looks like a metal cylinder).  Unsolder it.  Solder
on a couple of thin, insulated wires where the crystal was attached.
Thread the wires through one of the "vents" in the back of the tone
dialer.  Get a hold of a 6.5536 MHz crystal (available through Fry's
Electronics, 89 cents a piece, phone number (415)770-3763).  Go out and
get some quick drying epoxy and a Radio Shack mini Toggle Switch, DPDT,
cat. #275-626.  Close the tone dialer, with the two wires sticking out
of one of the back vents.  Screw it up tight.  Now, attach the crystals
and wires to the switch with solder as in the diagram below.

                      |^^^^^|
                      |     XX <3.579 crystal>small one
                      |     |
toggle switch ->    ooooooooX    xxxxs <two wires>
                      |     |
                      |     XX <6.5536 crystal>big one
                      |     |
                       ^^^^^^

        Each "XX" prong in the diagram is actually two prongs.  Hook up
the two leads from the crystals to separate prongs (same with the
wires).
        Now, epoxy this gizmo to the side of the tone dialer.  Use a lot
of epoxy, as you must make the switch/crystals essentially embedded in
epoxy resin, as in the diagram below.

Front view --->    -----------------------
                   |                     | T <- toggle switch
                   |     oo   oo   oo    |---
                   |                     |  |
                   |                     |---
                   |     1    2     3    | B s <- two crystals
                   |                     |   |     (b=big, s=small)
                   |     4    5     6    |---       in epoxy "blob"
                   |                     |
                   |     7    8     9    |   ^ two wires running to back
                   |                     |          of unit
                   |     *    0     #    |
                   |                     |
                   -----------------------


                   -----------------------
Back view --->     |                     |
                 T | o     ____    o <--------------- vent (1 of 4)
                 --|     /      \        |
                |  |     |     <---------------- speaker
                 --|     |      |        |
                s B|     |      |        |
2 wires  ->      \----o  | ---- |  o     |
running into       |                     |
vent               |                     |
                   |                     |
                   |                     |
                   |                     |
                   -----------------------


        Make sure the epoxy is really gobbed on there.  You want to be
certain the switch and crystals are firmly attached and secure in a
matrix of epoxy (it doesn't conduct electricity, so don't worry about
shorting out the connections to the toggle switch).  Just don't gum up
the action of the switch!
        Basically, you've altered the device so you can select between
two crystals to generate the timing of the microprocessor in the tone
dialer.
        Turn on the tone dialer.  Now you can easily switch between the
two crystal types.  The small crystal will generate ordinary DTMF tones.
By simply flicking the switch, you generate higher tones, using the
memory function of the tone dialer, save five stars in the P1 location.
Now dial the P1 location using the big crystal.  Sure sounds like the
tones for a quarter, doesn't it!
        Carrying this around with you will always come in handy with
both telephone company payphones and COCOTs!  No phreak should be
without one!
        Information is power... share it!  And drink massive amounts of
Jolt Cola.  Trust me, it's good for you.  Keep the faith, and never stop
searching for new frontiers.





