|
|
|
|
|
|
Lawful analogue telephone tapping system
ATR — short for Automatische Telefoon Registratie
(Automatic Telephone Recordering) —
was an automated electronic system for lawful interception (LI)
of analogue telephone lines,
built at the Centrale Werkplaats
(Central Workshop) of the Dutch state-owned PTT
(now: KPN).
It was in use from 7 April 1971 to 15 December 2003, after which it
was replaced by the digital ETSI-NL 1
[1].
|
The ATR system was developed in-house by the Dutch telecom provider PTT 2
at its prestigious Dr. Neher Lab
in Leidschendam (Netherlands).
The equipment was built by the PTT's central workshop (CWP) in
The Hague (Netherlands).
The system generally consisted of a 19" rack — the so-called KOZE
interface 3 — that was placed inside the target telephone exchange, close to
the wiring rack of the analogue subscriber lines. A wire pair — carefully
hidden even from PTT service personnel — was connected in parallel to the
subscriber line and guided to the KOZE unit.
|
|
|
|
Each KOZE interface was implemented as a 10 x 16 cm Eurocard printed
circuit board (PCB), that was fitted inside the 19" rack.
Some cards were suitable for the interception of traffic information
(metadata) only, whilst other versions were also capable
of recording the actual call content (CC).
|
Depending on the warrant that was issued for a specific intercept job,
the appropriate interface was installed, so that the intercepting police
officer could not (accidentally) break the law.
From the KOZE unit, the intercepted line was guided via a leased line
to the tapping room of the police
(or intelligence service), where it was
terminated with an (analogue) ATR unit, such as the one shown in the image
on the right. The ATR formed the interface (known as the ISRA) between the
intercepted line and the peripherals, typically a printer
and one or two tape recorders.
|
|
|
|
The red front panel
of the KOZE interface featured here is marked F+G,
which means that it was capable of intercepting both metadata
and call content, in accordance with article 125 F and G of the
Dutch Code of Criminal Procedure.
ATR was replaced on 15 December 2003 by ETSI-NL
— a fully digital (largely software-based) system — at the event of which
old decommissioned KOZE cards were presented as a
token of commemoration to former users of
the system.
|
-
ETSI =
European Telecommunications Standards Institute.
In the current context it is used as the name of a common telecommunications
interception standard.
ETSI-NL is the Dutch implementation of this standard.
-
At the time, PTT was a state-owned telecom monopolist. In 1989,
it was privatized and renamed KPN.
-
KOZE = Koppel Overdrager Zender (Link Interface Transmitter).
|
|
The ATR system was developed by the PTT during the course of 1970 and
1971, at a time when there was an increasing demand for lawful interception.
Before this time, interception had been possible, but only at an ad-hoc
– improvised – scale, commonly inside the telephone exchange.
|
The introduction of the ATR system made it possible to intercept a
line without revealing its presence (no mysterious 'clicks' or 'tones'
on the line). The intercepted line was routed (covertly) to the KOZE-unit,
from which it was despatched to the intercepting party, which was
commonly the tapping room of a police station somewhere in the Netherlands,
as shown in this diagram:
At the top right is the regular telephone exchange, with the subscriber
lines coming in from the bottom right. All subscriber lines are first connected
to a wiring rack, or patch panel, from which they are wired to the exchange.
At the top left is a single KOZE-unit. Apart from the exchange, the targeted
line is also connected to the input of the KOZE-unit. After processing, the
metadata and (optionally) the call content, are passed via a
leased telephone line to the tapping room.
In practice, the KOZE-unit was placed outside the view of the average PTT engineer,
and the intercepting wires were hidden carefully inside the existing
wiring bundles, so that it would not be spotted by a casual (or malicious)
observer. Exposure could jeopardize a tapping operation.
At the tapping room – generally at a police station – the leased line that
carried the intercepted call was connected to an ATR-unit that
consisted of line interfaces, tone-decoders and audio-switchers.
The output of the ATR
(the so-called ISRA unit), was recorded simultaneously
onto two UHER 5000 tape recorders. 1
At the end of the conversation, the female voice of the PTT's
time information system, also known as
Tante Cor, 2 was automatically
recorded as a proof-of-time.
|
| |
Typical analogue police tapping room setup
|
When the targeted line was in rest, a guard tone was sent from the KOZE unit
at the exchange, to the ATR unit at the tapping room. The
(secret) guard tone
was randomly chosen between 1950 and 3050 Hz.
In addition a 3150 Hz signal was used as a ringer identification tone.
As soon as the line became active, the guard tone disappeared and the
ATR unit activated the recorders.
At the same time, a line with date, time and the dialled number was printed
on an external printer.
|
 |
-
The UHER Universal 5000
(first introduced in 1963) was later replaced by the
UHER Report 6000.
-
Tante Cor (aunt Cornelia), was the nickname of a dial-in information
service, provided by the PTT at the time. When dialled, a female voice
would read the current time: bij de volgende toon is het...
(at the next tone, the time is...).
The time from this PTT facility was guranteed to be correct.
➤ More
|
Like the analogue exchange, ATR used in-band signalling,
which means that any control tones (e.g. line-in-use,
ringing tone, etc.) were in the audible part of the spectrum (300-3500 Hz).
When the targeted line was in rest, a guard tone was sent from the KOZE-unit
at the exchange, to the ATR unit at the tapping room. As soon as the guard
tone disappeared, the ATR would start the recording. The frequency of the
guard tone was choosen randomly between 1950 and 3050 Hz at the start of
a tapping operation. This was done to avoid spoofing by the intercepted party.
If a fixed frequency guard tone had been used, all the intercepted party had
to do to avoid interception, is send a tone with that frequency along with
the conversation. Nevertheless there are documented cases in which frequencies
with a specific duration and amplitude
in the caller's voice or background noise (e.g. music) caused the recording
to stop [5].
This effect is known as talk-down. Among PTT engineers
and law enforcement interceptors it was commonly known as
aanzingen van tante Cor, 1
as it triggered the automatic recording of the spoken time message.
|
|
-
'Singing' Aunt Cornelia – the spoken time message – into
operation, by producing a tone of a certain frequency, amplitude and duration.
Could also be triggered by playing violin music in the background.
|
|
In 1934, PTT introduced a dial-in service that could be
used by subscribers to synchronise their clocks and watches. It produced a spoken message
with the current time, which was accurately synchronised to a so-called
master clock. Within the PTT, the service was nicknamed Tante Cor
(aunt Cornelia), after Cor Hoogendam 1 who lent her voice to the recorded
messages [8].
|
|
Play the sound clip above to hear what Tante Cor sounded like.
A typical message consisted of 'Bij de volgende toon is het ...'
('At the next tone, the time is ...') followed by the actual time in hours,
minutes and seconds.
The user heared two such messages before the line was disconnected.
The time was guaranteed to be correct and – with the PTT being state-owned –
was legally accepted.
The service is still available from PTT
(now: KPN) today, through their service number 0900-8002.
|
-
In 1969, the voice of Cor Hoogendam was replaced by the
voice of actress Willi Brill, and in 1992 by Joke van Driessen.
Nevertheless, the name Tante Cor remained in use.
|
Initially, the link between the KOZE-unit and the ATR in the tapping room,
was a leased analogue line with a randomly selected guard tone.
Some analogue lines were later replaced by ISDN lines
when tapping digital communications such as GSM.
Although the ISDN lines were not protected by encryption,
malicious eavesdropping was much harder than with the
analogue PSTN lines.
|
| |
GSM intercept room via ISDN2 line
|
In the ISDN-variant, the KOZE interface in the telephone exchange was replaced by a
so-called Decentralized Tapping Interface ({?DTI)
that was linked directly to the provider's digital Ericsson (GSM) exchange, 1
whilst the ATR in the tapping room was swapped for an
ATR/ISDN2 unit, with 425 Hz signalling to stop the recording at the end
of a conversation (busy tone).
In practice, the recording was sometimes unwittingly stopped if an
intermittend 425 Hz tone occured during a conversation.
This happened, e.g. when violin music was played in the background,
or when one of the intercepted parties — with a specific pitch of voice —
repeatedly said eh... eh... eh... [5].
|
|
-
At the time, the two major telecom providers in the Netherlands,
KPN Telecom
(formerly: PTT) and Libertel (now: Vodafone), both used
the same digital Ericsson exchange for their GSM networks.
The DTI unit
was not suitable for intercepting regular analogue telephone calls,
for which the KOZE unit remained in use.
|
|
|
KOZE
Link Interface Transmitter
|
|
|
The KOZE-unit was placed inside the exchange, connected to the line
under surveillance. It forms the interface, or bridge, between the tapped line and
the tapping room, and was often installed in such a
way that its wiring could not be detected visually by a casual (or malicious)
observer.
There were two types of KOZE interfaces: one for metadata only (F) and one
that could handle call content as well (F+G), both named after the
corresponding subs of Article 125 of the
Dutch Code of Criminal Procedure.
|
|
|
The tapped line was carried – via a leased line – to the tapping room,
which was usually located in a police station somewhere in the country.
The line ended in the ATR unit shown in the image on the right. The unit
shown here could handle up to 4 tapped lines, plus a 5th line that carried
the spoken time message from Tante Cor.
Each line terminates in a plastic box
that has sockets for two tape recorders, an amplifier and
a TCA-B metadata printer.
|
|
|
The traffic information (metadata) of incoming and outgoing calls
was registered by means of a special data recorder or printer, such as
the Swiss-made
TCA-B telephone call analyzer
shown in the image on the right.
It added the current time, the duration of the call,
the ID number of the exchange and the ID number of the operator, so that
the printed output could be used as legal evidence.
➤ More information
|
|
|
The intercepted phone conversation (content) was recorded on the professional
UHER 5000
two-track mono open-reel tape recorder shown in the image
on the right. The recording was started automatically (under control of
the ATR ISRA unit) when the guard tone disappeared.
After 1975 the UHER 5000 was succeeded by the UHER 6000, which was also
a two-track mono open-reel recorder.
➤ More information
|
|
|
|
In the Netherlands the laws & regulations for lawful interception are rather
scattered. Below is an overview of the governing laws at the time
of the ATR system described above. For further information, please refer to
the well-informed website of Buro Jansen & Janssen (Dutch) [6].
|
- Constitution
Dutch: Grondwet, Artikel 13 — This is the basic law against eavesdropping.
It controls communication via post, telephone and telegraph. The law does
not explicitly mention fax, e-mail and GSM (although these could arguably been seen
as a form of telegraphic data).
In all cases, a warrant is needed for tapping someone's communications.
- Criminal Law
Dutch: Wetboek van Strafrecht, Arikel 139c — This law prohibits interception
of communication. Excluded from this prohibition are wireless communications
and interception for technical reasons (e.g. quality control, maintenance, etc.).
- Telecommunications Law
Dutch: Wet op de Telecommunicatie, Chapter 13 — This law forces telecommunications
service providers to supply the technical means for lawful interception
by the police, the department of justice, and the intelligence services.
- Code of Criminal Procedure
Dutch: Wetboek van Strafvordering, Artikel 125 —
This law defines the conditions for intercepting communications.
Article 125 describes what can be tapped as part of a criminal investigation.
Article 125F controls the traffic information (metadata), whilst Article 125G
handles the call content (i.e. the actual conversation).
Depending on the issued warrant, the interceptor has access to
metadata only (F),
or both metadata and call content (F+G). For this reason,
the KOZE card — that was installed in the exchange on the tapped line —
has (F) or (F+G) printed on its front panel.
|
|
Although obtaining a warrant for intercepting communications is a complicated
matter [3], the general impression is that more taps are placed in the Netherlands
than in many other countries (including the USA) [3].
As an example: in 2016, the Dutch police placed 25,000 telephone and internet
taps and requested metadata of 60,000 subscribers (on a population of 17 million) [7]. 1
|
-
This does not include the number of taps placed by the intelligence
services AIVD
and MIVD,
but these figures are usually much lower.
For example: in 2017, the AIVD and MIVD placed a total of 3553
telephone taps, internet taps and microphones [7].
|
|
The ATR wiretapping system was introduced on 7 April 1971 and remained in
use for nearly 33 years. Eventually, it was closed down on 15 December 2003
when it was succeeded by the fully digital ETSI-NL –
the Dutch implementation of the European ETSI protocol for lawful interception.
|
At the event of the commissioning of ETSI-NL, former users of the
old ATR — such as district attorneys and police interceptors — were
given a wooden panel with a KOZE card,
as a token of commemoration
of the phased-out system.
The card was usually tilted to allow space for an engraved brass plaque
with the name of the recipient. The card in the image on the right does not
have a plaque an is therefore mounted horizontally. Note that the card shown
here has (F+G) on its front panel, indicating that
it was used for intercepting metadata and call content.
|
|
|
|
These cards were once the link between the intercepted line and the tapping room.
According to date markings
at the bottom of the PCB, the KOZE shown
here was designed on 30 July 1981, and built on 29 May 1985 at the Central
Workshop of the PTT (CWP) in Den Haag (Netherlands).
|
A good description of the ATR system is given in a court ruling
that was released on 4 July 2017 [5]. In this 1730 page document, in
which the possibility of manipulation of the various tapping systems
are investigated, the ATR and the
analogue tapping room
are described in great detail.
|
Over the years, various systems with similar features were developed
and used in other countries. A good example is the
RT-2000 that was
made from 1982 onwards by Radio Trevisan in Italy. It is based on
an UHER Report 4400, and can record up to four lines
simultaneously.
The RT-2000 had a built-in LED display that showed the dialled number,
and a built-in thermal printer for evidence registration.
➤ More information
|
|
|
The image on the right shows a Racom 2816 dialled number recorder (DNR),
which is similar to the TCA-B call analyser using in the ATR. The device
was made in the US and was able to print typical evidence data, such
as time-of-origin, duration of the call and the dialled number.
➤ More information
|
|
|
|
The ATR unit featured here, was used for many years in one of the tapping
rooms of the Dutch Police, and could handle up to four analogue subscriber
lines simultaneously, plus a fifth line that was permanently connected to
the spoken time message service of the PTT, known as
Tante Cor.
|
The system consists of a strong metal enclosure – standard PTT issue –
with a 19" 3U eurocard rack inside. The rack holds the line cards (two
for each tapped line), a separate board for the spoken time message
Tante Cor,
a 25Hz ringing current generator and a DC-DC converter
that transforms the standard 48V supply voltage of the exchange to 12V for the
ATR circuitry.
The image on the right shows the two cards of LINE 3 partly extracted from
the case. One of the cards consists of two boards.
The cards for LINE 4 and Tante Cor
are missing from this device.
|
|
|
|
Furthermore – according to a hand-written note – the interface card of
LINE 1 has been adapted for intercepting facsimile traffic (fax). As the
ATR units were frequently moved from one location to another, the case has
to metal grips at the sides that allow it to be handled and carried easily.
|
At one of the short sides is a standard PTT-issue junction box that accepts
up to four leased lines (i.e. the tapped lines) plus a fifth line on which
Tante Cor is available. At the other short side is the
fixed wiring that should be connected to the 48V power rail of an exchange
(or an external power supply unit connected to the local mains).
At the wide side (here at the top) of the case, are four terminator boxes
(ISRA) for connection of peripheral equipment
like printer
and one or two tape recorders,
plus a control box at the centre
for enabling/disabling each of the 4 ISRA boxes.
|
|
|
|
All interface cards in the 19" rack, the line control unit and the four
ISRA boxes, were developed built at the Central Workshop (CWP) of the PTT
in Den Haag (Netherlands). Note that the ISRA boxes and the line control unit
are housed in standard PTT-issue junction boxes, which were modified for
this application. Line detection, end-of-conversation detection and tape
recorder start/stop and under control of the ATR plug-in cards, whilst
the CLI data is handled by the
TCA-B telephone call analyzer/printer,
which is connected to the DA-15 socket of each the ISRA box.
|
|
ATR
|
|
Automatische Telefoon Registratie
Automatic Telephone Recordering.
|
|
ETSI
|
|
European Telecommunications Standards Institute
In this context, ETSI is used as the name for a telecommunications
intercept protocol. ETSI-NL is the Dutch variant of this protocol,
adapted to be in line with Dutch laws [2].
➤ More
|
|
CC
|
|
Call Content
The actual conversation in a telecommunications session.
|
|
CWP
|
|
Centrale Werkplaats
Central workshop of the PTT (now: KPN), located in The Hague (Netherlands).
|
|
DTI
|
|
Decentrale Tap Interface
Decentralized Tapping Interface.
Also known as mediation unit.
|
|
GSM
|
|
Global System for Mobile communications
World-wide standard for (digital) mobile voice and data communications,
developed by the
European Telecommunications Standards Institute (ETSI).
Originally known as Groupe Spécial Mobile,
but later renamed to the above.
➤ More
➤ Wikipedia
|
|
ISDN
|
|
Integrated Services Digital Network
Common name for the digital telephone network that replaced the older
analogue PSTN service. Currently being superceeded by IP-based switched
networks.
|
|
ISRA
|
|
Infra-Structuur en Rand-Apparatuur
Point of interface (Dutch: koppelvlak) between infrastructure (the line)
and peripheral equipment, such as (tape) recorders.
|
|
JTS
|
|
Justitiële Tapinterface Specificatie
Department of Justice Intercept Interface Specification.
|
|
KOZE
|
|
Koppel Overdrager Zender
Link Interface Transmitter. Placed at the telephone exchange
and connected to the targeted line as well as to a rented line
to the tapping room.
➤ More
|
|
KPN
|
|
Koninklijke PTT Nederland
Royal PTT Netherlands. New name for the former state-owned PTT,
after its privatization in 1989.
|
|
LEMF
|
|
Law Enforcement Monitoring Facility
Common name for the intercept facilities in the telephone exchange.
|
|
LI
|
|
Lawful Interception
Interception of communications (e.g. by placing a telephone tap)
by law enforcement agencies and intelligence services, withing the
framework of the governing laws.
|
|
MSC
|
|
Mobile Switching Center
Telephone exchange for digital mobile communications.
|
|
PSTN
|
|
Public Switched Telephone Network
Common name for the (old) analogue telephone network.
Also known as POTS (Plain Old Telephone System).
|
|
PTT
|
|
Staatsbedrijf der Posterijen, Telegrafie en Telefonie
Dutch state-owned telecom monopolist for Post, Telephone and Telegraph,
from 1915 to 1989.
Privatized in 1989 and split into Postbank (bank),
KPN (telecom)
and TPG (post).
➤ More
|
|
TIIT
|
|
Transport of Intercepted IP Traffic
Protocol for interception of e-mail and internet traffic,
developed in the Netherlands.
|
- Anonymous, Complete ATR system and KOZE interface board - THANKS !
Crypto Museum, August 2017 — May 2019.
- Bert-Jaap Koop et al., Aftapbaarheid van telecommunicatie
Interceptability of telecommunications (Dutch).
Tilburg Universiteit, November 2005.
- Wikipedia (NL), Telefoontap
Retrieved August 2017. ➤ English
- Wikipedia (NL), Neherlaboratorium
Retrieved August 2017.
- Conclusie van de advocaat-generaal bij de Hoge Raad der Nederlanden,
mr. D. Aben, naar aanleiding van het herzieningsverzoek van H. Baybasin.
Nr. 11/02065 H, 4 July 2017.
➤ pp. 263-271.
- Buro Jansen & Janssen, Wetten en regels over afluisteren
Phone tapping rules and regulations (Dutch).
24 October 1999.
- Huib Modderkolk, Voor het eerst duidelijkheid over tapstatistieken...
De Volkskrant (newspaper). 14 Maart 2018
- Beeld en Geluid WIKI, Tante Cor
Retrieved June 2019.
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Monday 21 August 2017. Last changed: Saturday, 12 August 2023 - 13:51 CET.
|
|
|
|
|
