Click for homepage
ATR
Lawful analogue telephone tapping system

ATR — short for Automatische Telefoon Registratie (Automatic Telephone Recordering) — was an automated electronic system for lawful interception (LI) of analogue telephone lines, built at the Centrale Werkplaats (Central Workshop) of the Dutch state-owned PTT (now: KPN). It was in use from 7 April 1971 to 15 December 2003, after which it was replaced by the digital ETSI-NL [1]. 1

The ATR system was developed in-house by the Dutch telecom provider PTT 2 at its prestigious Dr. Neher Lab in Leidschendam (Netherlands). The equipment was built by the PTT's central workshop (CWP) in The Hague (Netherlands).

The system generally consisted of a 19" rack — the so-called KOZE interface 3 — that was placed inside the target telephone exchange, close to the wiring rack of the analogue subscriber lines. A wire pair — carefully hidden even from PTT service personnel — was connected in parallel to the subscriber line and guided to the KOZE unit.
  
KOZE card (Link Interface Transmitter)

Each KOZE interface was implemented as a 10 x 16 cm Eurocard printed circuit board (PCB), that was fitted inside the 19" rack. Some cards were suitable for the interception of traffic information (metadata) only, whilst other versions were also capable of recording the actual call content (CC).

Depending on the warrant that was issued for a specific intercept job, the appropriate interface was installed, so that the intercepting police officer could not (accidentally) break the law.

From the KOZE unit, the intercepted line was guided via a leased line to the tapping room of the police (or intelligence service), where it was terminated with an (analogue) ATR unit, such as the one shown in the image on the right. The ATR formed the interface (known as the ISRA) between the intercepted line and the peripherals, typically a printer and one or two tape recorders.
  
Recorder and printer connected to tapping unit

The red front panel of the KOZE interface featured here is marked F+G, which means that it was capable of intercepting both metadata and call content, in accordance with article 125 F and G of the Dutch Code of Criminal Procedure. ATR was replaced on 15 December 2003 by ETSI-NL — a fully digital (largely software-based) system — at the event of which old decommissioned KOZE cards were presented as a token of commemoration to former users of the system.

  1. ETSI = European Telecommunications Standards Institute. In the current context it is used as the name of a common telecommunications interception standard. ETSI-NL is the Dutch implementation of this standard.
  2. At the time, PTT was a state-owned telecom monopolist. In 1989, it was privatized and renamed KPN.
  3. KOZE = Koppel Overdrager Zender (Link Interface Transmitter).

Tapping room with single-line setup Recorder and printer connected to tapping unit 4-line analogue ATR tapping unit ISRA interfaces for up to four lines Line selector and tape recorder interface Plug-in units KOZE card (Link Interface Transmitter)
A
×
A
1 / 7
Tapping room with single-line setup
A
2 / 7
Recorder and printer connected to tapping unit
A
3 / 7
4-line analogue ATR tapping unit
A
4 / 7
ISRA interfaces for up to four lines
A
5 / 7
Line selector and tape recorder interface
A
6 / 7
Plug-in units
A
7 / 7
KOZE card (Link Interface Transmitter)

Analogue PSTN lines
The ATR system was developed by the PTT during the course of 1970 and 1971, at a time when there was an increasing demand for lawful interception. Before this time, interception had been possible, but only at an ad-hoc – improvised – scale, commonly inside the telephone exchange.

The introduction of the ATR system made it possible to intercept a line without revealing its presence (no mysterious 'clicks' or 'tones' on the line). The intercepted line was routed (covertly) to the KOZE-unit, from which it was despatched to the intercepting party, which was commonly the tapping room of a police station somewhere in the Netherlands, as shown in this diagram:

KOZE-unit placed at the tapping point in the telephone exchange

At the top right is the regular telephone exchange, with the subscriber lines coming in from the bottom right. All subscriber lines are first connected to a wiring rack, or patch panel, from which they are wired to the exchange. At the top left is a single KOZE-unit. Apart from the exchange, the targeted line is also connected to the input of the KOZE-unit. After processing, the metadata and (optionally) the call content, are passed via a leased telephone line to the tapping room.

In practice, the KOZE-unit was placed outside the view of the average PTT engineer, and the intercepting wires were hidden carefully inside the existing wiring bundles, so that it would not be spotted by a casual (or malicious) observer. Exposure could jeopardize a tapping operation.

At the tapping room – generally at a police station – the leased line that carried the intercepted call was connected to an
ATR
-unit that consisted of line interfaces, tone-decoders and audio-switchers. The output of the
ATR
(the so-called ISRA unit), was recorded simultaneously onto two UHER 5000 tape recorders. 1 At the end of the conversation, the female voice of the PTT's time information system, also known as Tante Cor, 2 was automatically recorded as a proof-of-time.

ATR-unit placed at the (remote) tapping room
Typical analogue police tapping room setup

When the targeted line was in rest, a guard tone was sent from the KOZE-unit at the exchange, to the ATR-unit at the tapping room. The (secret) guard tone was randomly chosen between 1950 and 3050 Hz. In addition a 3150 Hz signal was used as a ringer identification tone. As soon as the line became active, the guard tone disappeared and the ATR-unit activated the recorders. At the same time, a line with date, time and the dialled number was printed on an external printer.

  1. The UHER Universal 5000 (first introduced in 1963) was later replaced by the UHER Report 6000.
  2. Tante Cor (aunt Cornelia), was the nickname of a dial-in information service, provided by the PTT at the time. When dialled, a female voice would read the current time: bij de volgende toon is het... (at the next tone, the time is...). The time from this PTT facility was guranteed to be correct.  More

Guard tone
Like the analogue exchange, ATR used in-band signalling, which means that any control tones (e.g. line-in-use, ringing tone, etc.) were in the audible part of the spectrum (300-3500 Hz). When the targeted line was in rest, a guard tone was sent from the KOZE-unit at the exchange, to the ATR-unit at the tapping room. As soon as the guard tone disappeared, the ATR would start the recording. The frequency of the guard tone was choosen randomly between 1950 and 3050 Hz at the start of a tapping operation. This was done to avoid spoofing by the intercepted party.

If a fixed frequency guard tone had been used, all the intercepted party had to do to avoid interception, is send a tone with that frequency along with the conversation. Nevertheless there are documented cases in which frequencies with a specific duration and amplitude in the caller's voice or background noise (e.g. music) caused the recording to stop [5]. This effect is known as talk-down. Among PTT engineers and law enforcement interceptors it was commonly known as aanzingen van tante Cor, 1 as it triggered the automatic recording of the spoken time message.

  1. 'Singing' Aunt Cornelia – the spoken time message – into operation, by producing a tone of a certain frequency, amplitude and duration. Could also be caused by playing violin music in the background.

Tante Cor
In 1934, PTT introduced a dial-in service that could be used by subscribers to synchronise their clocks and watches. It produced a spoken message with the current time, which was accurately synchronised to a so-called master clock. Within the PTT, the service was nicknamed Tante Cor (aunt Cornelia), after Cor Hoogendam 1 who lent her voice to the recorded messages [8].

Play the sound clip above to hear what Tante Cor sounded like. A typical message consisted of 'Bij de volgende toon is het ...' ('At the next tone, the time is ...') followed by the actual time in hours, minutes and seconds. The user heared two such messages before the line was disconnected. The time was guaranteed to be correct and – with the PTT being state-owned – was legally accepted. The service is still available from PTT (now: KPN) today, through their service number 0900-8002.

  1. In 1969, the voice of Cor Hoogendam was replaced by the voice of actress Willi Brill, and in 1992 by Joke van Driessen. Nevertheless, the name Tante Cor remained in use.

ISDN and GSM lines
Initially, the link between the KOZE-unit and the ATR in the tapping room, was a leased analogue line with a randomly selected guard tone. Some analogue lines were later replaced by ISDN lines when tapping digital communications such as GSM. Although the ISDN lines were not protected by encryption, malicious eavesdropping was much harder than with the analogue PSTN lines.

ATR/ISDN2-unit placed at the (remote) tapping room
GSM intercept room via ISDN2 line

In the ISDN-variant, the KOZE interface in the telephone exchange was replaced by a so-called Decentralized Tapping Interface (DTI) that was linked directly to the provider's digital Ericsson (GSM) exchange, 1 whilst the ATR in the tapping room was swapped for an ATR/ISDN2 unit, with 425 Hz signalling to stop the recording at the end of a conversation (busy tone). In practice, the recording was sometimes unwittingly stopped if an intermittend 425 Hz tone occured during a conversation. This happened, e.g. when violin music was played in the background, or when one of the intercepted parties — with a specific pitch of voice — repeatedly said eh... eh... eh... [5].

  1. At the time, the two major telecom providers in the Netherlands, KPN Telecom (formerly: PTT) and Libertel (now: Vodafone), both used the same digital Ericsson exchange for their GSM networks. The DTI-unit was not suitable for intercepting regular analogue telephone calls, for which the KOZE-unit remained in use.

Equipment used in ATR
Koppel Overdrager Zender (Link Interface Transmitter) ATR ISRA unit Telephone line analyzer with printer UHER 5000 recorder
KOZE   Link Interface Transmitter
The KOZE-unit was placed inside the exchange, connected to the line under surveillance. It forms the interface, or bridge, between the tapped line and the tapping room, and was often installed in such a way that its wiring could not be detected visually by a casual (or malicious) observer.

There were two types of KOZE interfaces: one for metadata only (F) and one that could handle call content as well (F+G), both named after the corresponding subs of Article 125 of the Dutch Code of Criminal Procedure.

  
KOZE card (Link Interface Transmitter)

ATR - ISRA   Tapping room
The tapped line was carried – via a leased line – to the tapping room, which was usually located in a police station somewhere in the country.

The line ended in the ATR unit shown in the image on the right. The unit shown here could handle up to 4 tapped lines, plus a 5th line that carried the spoken time message from Tante Cor. Each line terminates in a plastic box that has sockets for two tape recorders, an amplifier and a TCA-B metadata printer.

  
4-line analogue ATR tapping unit

Printer   TCA-B
The traffic information (metadata) of incoming and outgoing calls was registered by means of a special data recorder or printer, such as the Swiss-made TCA-B telephone call analyzer shown in the image on the right.

It added the current time, the duration of the call, the ID number of the exchange and the ID number of the operator, so that the printed output could be used as legal evidence.

 More information

  
TCA-B telephone call analyzer

Recorder   UHER 5000
The intercepted phone conversation (content) was recorded on the professional UHER 5000 two-track mono open-reel tape recorder shown in the image on the right. The recording was started automatically (under control of the ATR ISRA unit) when the guard tone disappeared.

After 1975 the UHER 5000 was succeeded by the UHER 6000, which was also a two-track mono open-reel recorder.

 More information

  
UHR 5000 with lid removed

Lawful interception
In the Netherlands the laws & regulations for lawful interception are rather scattered. Below is an overview of the governing laws at the time of the ATR system described above. For further information, please refer to the well-informed website of Buro Jansen & Janssen (Dutch) [6].

  • Constitution
    Dutch: Grondwet, Artikel 13 — This is the basic law against eavesdropping. It controls communication via post, telephone and telegraph. The law does not explicitly mention fax, e-mail and GSM (although these could arguably been seen as a form of telegraphic data). In all cases, a warrant is needed for tapping someone's communications.

  • Criminal Law
    Dutch: Wetboek van Strafrecht, Arikel 139c — This law prohibits interception of communication. Excluded from this prohibition are wireless communications and interception for technical reasons (e.g. quality control, maintenance, etc.).

  • Telecommunications Law
    Dutch: Wet op de Telecommunicatie, Chapter 13 — This law forces telecommunications service providers to supply the technical means for lawful interception by the police, the department of justice, and the intelligence services.

  • Code of Criminal Procedure
    Dutch: Wetboek van Strafvordering, Artikel 125 — This law defines the conditions for intercepting communications. Article 125 describes what can be tapped as part of a criminal investigation. Article 125F controls the traffic information (metadata), whilst Article 125G handles the call content (i.e. the actual conversation).

    Depending on the issued warrant, the interceptor has access to metadata only (F), or both metadata and call content (F+G). For this reason, the KOZE card — that was installed in the exchange on the tapped line — has (F) or (F+G) printed on its front panel.
Although obtaining a warrant for intercepting communications is a complicated matter [3], the general impression is that more taps are placed in the Netherlands than in many other countries (including the USA) [3]. As an example: in 2016, the Dutch police placed 25,000 telephone and internet taps and requested metadata of 60,000 subscribers (on a population of 17 million) [7]. 1

  1. This does not include the number of taps placed by the intelligence services AIVD and MIVD, but these figures are usually much lower. For example: in 2017, the AIVD and MIVD placed a total of 3553 telephone taps, internet taps and microphones [7].

Close down
The ATR wiretapping system was introduced on 7 April 1971 and remained in use for nearly 33 years. Eventually, it was closed down on 15 December 2003 when it was succeeded by the fully digital ETSI-NL – the Dutch implementation of the European ETSI protocol for lawful interception.

At the event of the commissioning of ETSI-NL, former users of the old ATR — such as district attorneys and police interceptors — were given a wooden panel with a KOZE card, as a token of commemoration of the phased-out system.

The card was usually tilted to allow space for an engraved brass plaque with the name of the recipient. The card in the image on the right does not have a plaque an is therefore mounted horizontally. Note that the card shown here has (F+G) on its front panel, indicating that it was used for intercepting metadata and call content.
  
ATR intercept board

These cards were once the link between the intercepted line and the tapping room. According to date markings at the bottom of the PCB, the KOZE shown here was designed on 30 July 1981, and built on 29 May 1985 at the Central Workshop of the PTT (CWP) in Den Haag (Netherlands).

Tilted KOZE board on wooden panel ATR intercept board ATR interface card front panel Connection to the rack-mount backplane Top view of the KOZE board Label at the bottom Markings on the bottom side of the board Acidentally or deliberately damaged IC on the decommissioned KOZE card
B
×
B
1 / 8
Tilted KOZE board on wooden panel
B
2 / 8
ATR intercept board
B
3 / 8
ATR interface card front panel
B
4 / 8
Connection to the rack-mount backplane
B
5 / 8
Top view of the KOZE board
B
6 / 8
Label at the bottom
B
7 / 8
Markings on the bottom side of the board
B
8 / 8
Acidentally or deliberately damaged IC on the decommissioned KOZE card

Literature
A good description of the ATR system is given in a court ruling that was released on 4 July 2017 [5]. In this 1730 page document, in which the possibility of manipulation of the various tapping systems are investigated, the ATR and the analogue tapping room are described in great detail.


Similar equipment
RT-2000
Over the years, various systems with similar features were developed and used in other countries. A good example is the RT-2000 that was made from 1982 onwards by Radio Trevisan in Italy. It is based on an UHER Report 4400, and can record up to four lines simultaneously.

The RT-2000 had a built-in LED display that showed the dialled number, and a built-in thermal printer for evidence registration.

 More information

  
RT-2000 wire tapping recorder

RACOM 2816
The image on the right shows a Racom 2816 dialled number recorder (DNR), which is similar to the TCA-B call analyser using in the ATR. The device was made in the US and was able to print typical evidence data, such as time-of-origin, duration of the call and the dialled number.

 More information

  
RACOM 2816P in leather briefcase




Interior
The ATR unit featured here, was used for many years in one of the tapping rooms of the Dutch Police, and could handle up to four analogue subscriber lines simultaneously, plus a fifth line that was permanently connected to the spoken time message service of the PTT, known as Tante Cor.

The system consists of a strong metal enclosure – standard PTT issue – with a 19" 3U eurocard rack inside. The rack holds the line cards (two for each tapped line), a separate board for the spoken time message Tante Cor, a 25Hz ringing current generator and a DC-DC converter that transforms the standard 48V supply voltage of the exchange to 12V for the ATR circuitry.

The image on the right shows the two cards of LINE 3 partly extracted from the case. One of the cards consists of two boards. The cards for LINE 4 and Tante Cor are missing from this device.
  
Two cards for each tapped line

Furthermore – according to a hand-written note – the interface card of LINE 1 has been adapted for intercepting facsimile traffic (fax). As the ATR units were frequently moved from one location to another, the case has to metal grips at the sides that allow it to be handled and carried easily.

At one of the short sides is a standard PTT-issue junction box that accepts up to four leased lines (i.e. the tapped lines) plus a fifth line on which Tante Cor is available. At the other short side is the fixed wiring that should be connected to the 48V power rail of an exchange (or an external power supply unit connected to the local mains).

At the wide side (here at the top) of the case, are four terminator boxes (ISRA) for connection of peripheral equipment like printer and one or two tape recorders, plus a control box at the centre for enabling/disabling each of the 4 ISRA boxes.
  
Close-up of the line selector and one tape recorder interface (ISRA)

All interface cards in the 19" rack, the line control unit and the four ISRA boxes, were developed built at the Central Workshop (CWP) of the PTT in Den Haag (Netherlands). Note that the ISRA boxes and the line control unit are housed in standard PTT-issue junction boxes, which were modified for this application. Line detection, end-of-conversation detection and tape recorder start/stop and under control of the ATR plug-in cards, whilst the
CLI
data is handled by the TCA-B telephone call analyzer/printer, which is connected to the DA-15 socket of each the ISRA box.

19 Close-up of the line selector and one tape recorder interface (ISRA) Two cards for each tapped line Line interface Control board 1 Control board 2 10 Patch blocks
C
×
C
1 / 8
19
C
2 / 8
Close-up of the line selector and one tape recorder interface (ISRA)
C
3 / 8
Two cards for each tapped line
C
4 / 8
Line interface
C
5 / 8
Control board 1
C
6 / 8
Control board 2
C
7 / 8
10
C
8 / 8
Patch blocks

Glossary
ATR   Automatische Telefoon Registratie
Autmatic Telephone Recordering.
ETSI   European Telecommunications Standards Institute
In this context, ETSI is used as the name for a telecommunications intercept protocol. ETSI-NL is the Dutch variant of this protocol, adapted to be in line with Dutch laws [2].
CC   Call Content
The actual conversation in a telecommunications session.
CWP   Centrale Werkplaats
Central workshop of the PTT (now: KPN), located in The Hague (Netherlands).
DTI   Decentrale Tap Interface
Decentralized Tapping Interface. Also known as mediation unit.
GSM   Global System for Mobile communications
World-wide standard for (digital) mobile voice and data communications, developed by the European Telecommunications Standards Institute (ETSI). Originally known as Groupe Spécial Mobile, but later renamed to the above.  More  Wikipedia
ISDN   Integrated Services Digital Network
Common name for the digital telephone network that replaced the older analogue PSTN service. Currently being superceeded by IP-based switched networks.
ISRA   Infra-Structuur en Rand-Apparatuur
Point of interface (Dutch: koppelvlak) between infrastructure (the line) and peripheral equipment, such as (tape) recorders.
JTS   Justitiële Tapinterface Specificatie
Department of Justice Intercept Interface Specification.
KOZE   Koppel Overdrager Zender
Link Interface Transmitter. Placed at the telephone exchange and connected to the targeted line as well as to a rented line to the tapping room.  More
KPN   Koninklijke PTT Nederland
Royal PTT Netherlands. New name for the former state-owned PTT, after its privatization in 1989.
LEMF   Law Enforcement Monitoring Facility
Common name for the intercept facilities in the telephone exchange.
LI   Lawful Interception
Interception of communications (e.g. by placing a telephone tap) by law enforcement agencies and intelligence services, withing the framework of the governing laws.
MSC   Mobile Switching Center
Telephone exchange for digital mobile communications.
PSTN   Public Switched Telephone Network
Common name for the (old) analogue telephone network. Also known as POTS (Plain Old Telephone System).
PTT   Staatsbedrijf der Posterijen, Telegrafie en Telefonie
Dutch state-owned telecom monopolist for Post, Telephone and Telegraph, from 1915 to 1989. Privatized in 1989 and split into Postbank (bank), KPN (telecom) and TPG (post).
TIIT   Transport of Intercepted IP Traffic
Protocol for interception of e-mail and internet traffic, developed in the Netherlands.
References
  1. Anonymous, Complete ATR system and KOZE interface board - THANKS !
    Crypto Museum, August 2017 — May 2019.

  2. Bert-Jaap Koop et al., Aftapbaarheid van telecommunicatie
    Interceptability of telecommunications (Dutch).
    Tilburg Universiteit, November 2005.

  3. Wikipedia (NL), Telefoontap
    Retrieved August 2017.  English

  4. Wikipedia (NL), Neherlaboratorium
    Retrieved August 2017.

  5. Conclusie van de advocaat-generaal bij de Hoge Raad der Nederlanden,
    mr. D. Aben, naar aanleiding van het herzieningsverzoek van H. Baybasin.
    Nr. 11/02065 H, 4 July 2017.  pp. 263-271.

  6. Buro Jansen & Janssen, Wetten en regels over afluisteren
    24 October 1999.

  7. Huib Modderkolk, Voor het eerst duidelijkheid over tapstatistieken...
    De Volkskrant (newspaper). 14 Maart 2018

  8. Beeld en Geluid WIKI, Tante Cor
    Retrieved June 2019.
Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Monday 21 August 2017. Last changed: Saturday, 15 June 2019 - 10:33 CET.
Click for homepage