Saturday, December 31, 2005

The Aqua Box Plans
Every true phreaker lives in fear of the dreaded FBI 'Lock In Trace'. For a long time, it was impossible to escape from the Lock In Trace. This box does offer an escape route with simple directions to it. This box is quite a simple concept, and almost any phreaker with basic electronics knowledge can construct and use it.

The Lock In Trace
A lock in trace is a device used by the FBI to lock into the phone users location so that he can not hang up while a trace is in progress. For those of you who are not familiar with the concept of 'locking in', then here's a brief description. The FBI can tap into a conversation, sort of like a three-way call connection. Then, when they get there, they can plug electricity into the phone line. All phone connections are held open by a certain voltage of electricity. That is why you sometimes get static and faint connections when you are calling far away, because the electricity has trouble keeping the line up. What the lock in trace does is cut into the line and generate that same voltage straight into the lines. That way, when you try and hang up, voltage is retained. Your phone will ring just like someone was calling you even after you hang up. (If you have call waiting, you should understand better about that, for call waiting intercepts the electricity and makes a tone that means someone is going through your line. Then, it is a matter of which voltage is higher. When you push down the receiver, then it see-saws the electricity to the other side. When you have a person on each line it is impossible to hang up unless one or both of them will hang up. If you try to hang up, voltage is retained, and your phone will ring. That should give you an understanding of how calling works. Also, when electricity passes through a certain point on your phone, the electricity causes a bell to ring, or on some newer phones an electronic ring to sound.) So, in order to eliminate the trace, you somehow must lower the voltage level on your phone line. You should know that every time someone else picks up the phone line, then the voltage does decrease a little. In the first steps of planning this out, Xerox suggested getting about a hundred phones all hooked into the same line that could all be taken off the hook at the same time. That would greatly decrease the voltage level. That is also why most three-way connections that are using the bell service three way calling (which is only $3 a month) become quite faint after a while. By now, you should understand the basic idea. You have to drain all of the power out of the line so the voltage can not be kept up. Rather sudden draining of power could quickly short out the FBI voltage machine, because it was only built to sustain the exact voltage necessary to keep the voltage out. For now, imagine this. One of the normal Radio Shack generators that you can go pick up that one end of the cord that hooks into the central box has a phone jack on it and the other has an electrical plug. This way, you can "flash" voltage through the line, but cannot drain it. So, some
modifications have to be done.

Materials
A BEOC (Basic Electrical Output Socket), like a small lamp-type connection, where you just have a simple plug and wire that would plug into a light bulb. One of cords mentioned above, if you can't find one then construct your own... Same voltage connection, but the restrainer must be built in (I.E. The central box) Two phone jacks (one for the modem, one for if you are being traced to plug the aqua box into) Some creativity and easy work.

Notice: No phones have to be destroyed/modified to make this box, so don't go out and buy a new phone for it!

Procedure
All right, this is a very simple procedure. If you have the BEOC, it could drain into anything: a radio, or whatever. The purpose of having that is you are going to suck the voltage out from the phone line into the electrical appliance so there would be no voltage left to lock you in with.

1.Take the connection cord. Examine the plug at the end. It should have only two prongs. If it has three, still, do not fear. Make sure the electrical appliance is turned off unless you want to become a crispy critter while making this thing. Most plugs will have a hard plastic design on the top of them to prevent you from getting in at the electrical wires inside. Well, remove it. If you want to keep the plug (I don't see why...) then just cut the top off. When you look inside, Low and Behold, you will see that at the base of the prongs there are a few wires connecting in. Those wires conduct the power into the appliance. So, you carefully unwrap those from the sides and pull them out until they are about an inch ahead of the prongs. If you don't want to keep the jack, then just rip the prongs out. If you are, cover the prongs with insulation tape so they will not connect with the wires when the power is being drained from the line.

2.Do the same thing with the prongs on the other plug, so you have the wires evenly connected. Now, wrap the end of the wires around each other. If you happen to have the other end of the voltage cord hooked into the phone, stop reading now, you're too fucking stupid to continue. After you've wrapped the wires around each other, then cover the whole thing with the plugs with insulating tape. Then, if you built your own control box or if you bought one, then cram all the wires into it and reclose it. That box is your ticket out of this.

3.Re-check everything to make sure it's all in place. This is a pretty flimsy connection, but on later models when you get more experienced at it then you can solder away at it and form the whole device into one big box, with some kind of cheap Mattel hand-held game inside to be the power connector. In order to use it, just keep this box handy. Plug it into the jack if you want, but it will slightly lower the voltage so it isn't connected. When you plug it in, if you see sparks, unplug it and restart the whole thing. But if it just seems fine then leave it.

Use
----
Now, so you have the whole thing plugged in and all... Do not use this unless the situation is desperate! When the trace has gone on, don't panic, unplug your phone, and turn on the appliance that it was hooked to. It will need energy to turn itself on, and here's a great source... The voltage to keep a phone line open is pretty small and a simple light bulb should drain it all in and probably short the FBI computer at the same time.
" the anarchist cookbook"
Operators

There are many types of operators in the network and the more common ones will be discussed.

TSPS Operator:

The TSPS [(Traffic Service Position System) as opposed to This Shitty Phone Service] Operator is probably the bitch (or bastard, for the female liberationists out there) that most of us are used to having to deal with. Here are his/her responsibilities:

1.Obtaining billing information for calling card or third number calls

2.Identifying called customer on person-to-person calls.

3.Obtaining acceptance of charges on collect calls.

4.Identifying calling numbers. This only happens when the calling number is not automatically recorded by CAMA(Centralized Automatic Message Accounting) & forwarded from the local office. This could be caused by equipment failures (ANIF- Automatic Number Identification Failure) or if the office is not equipped for CAMA (ONI- Operator Number Identification).

I once had an equipment failure happen to me & the TSPS operator came on and said, "What number are you calling FROM?" Out of curiosity, I gave her the number to my CO, she thanked me & then I was connected to a conversation that appeared to be between a frame man & his wife. Then it started ringing the party I wanted to originally call & everyone phreaked out (excuse the pun). I immediately dropped this dual line conference!

You should not mess with the TSPS operator since she KNOWS which number that you are calling from. Your number will show up on a 10-digit LED read-out (ANI board). She also knows whether or not you are at a fortress phone & she can trace calls quite readily! Out of all of the operators, she is one of the MOST DANGEROUS.

INWARD operator:

This operator assists your local TSPS ("0") operating connecting calls. She will never question a call as long as the call is within HER SERVICE AREA. She can only be reached via other operators or by a blue box. From a blue box, you would dial KP+NPA+121+ST for the INWARD operator that will help you connect any calls within that NPA only. (Blue Boxing will be discussed in a future file).

DIRECTORY ASSISTANCE Operator:

This is the operator that you are connected to when you dial: 411 or NPA-555-1212. She does not readily know where you are calling from. She does not have access to unlisted numbers, but she DOES know if an unlisted # exists for a certain listing.

There is also a directory assistance operator for deaf people who use teletypewriters. If your modem can transfer BAUDOT [(45« baud). One modem that I know of that will do this is the Apple Cat acoustic or the Atari 830 acoustic modem. Yea I know they are hard to find... but if you want to do this.. look around!) then you can call him/her up and have an interesting conversation. The number is: 800-855-1155. They use the standard Telex abbreviations such as GA for go ahead. they tend to be nicer and will talk longer than your regular operators. Also, they are more vulnerable into being talked out of information through the process of "social engineering" as Chesire Catalyst would put it.

Unfortunately, they do not have access to much. I once bullshitted with one of these operators a while back and I found out that there are 2 such DA offices that handle TTY. One is in Philadelphia and the other is in California. They have approx. 7 operators each. Most of the TTY operators think that their job is
boring (based on an official "BIOC poll"). They also feel that they are under-paid. They actually call up a regular DA number to process your request (sorry, no fancy computers!)

Other operators have access to their own DA by dialing KP+NPA+131+ST (MF).

CN/A operators:

CN/A Operators are operators that do exactly the opposite of what directory assistance operators are for. In my experience, these operators know more than the DA op's do & they are more susceptible to "social engineering." It is possible to bullshit a CN/A operator for the NON-PUB DA number (i.e., you give them the name & they give you the unlisted number. See the article on unlisted numbers in this cookbook for more info about them.). This is due to the fact that they assume that you are a fellow company employee. Unfortunately, the AT&T breakup has resulted in the break-up of a few NON-PUB DA numbers and policy changes in CN/A.

INTERCEPT Operator:

The intercept operator is the one that you are connected to when there are not enough recordings available to tell you that the number has been disconnected or changed. She usually says, "What number you calling?" with a foreign accent. This is the lowest operator lifeform. Even though they don't know where you are calling from, it is a waste or your time to try to verbally abuse them since they usually understand very little English anyway.

Incidentally, a few area DO have intelligent INTERCEPT Operators.

OTHER Operators:

And then there are the: Mobile, Ship-to-Shore, Conference, Marine Verify, "Leave Word and Call Back", Rout & Rate (KP+800+141+1212+ST), & other special operators who have one purpose or another in the network.

Problems with an Operator:

Ask to speak to their supervisor... or better yet the Group Chief (who is the highest ranking official in any office) who is the equivalent of the Madame in a whorehouse.

By the way, some CO's that will allow you to dial a 0 or 1 as the 4th digit, will also allow you to call special operators & other fun Tel. Co. numbers without a blue box. This is very rare, though! For example, 212-121-1111 will get you a NY Inward Operator.

Office Hierarchy

Every switching office in North America (the NPA system), is assigned an office name and class. There are five classes of offices numbered 1 through 5. Your CO is most likely a class 5 or end office. All long-distance (Toll) calls are switched by a toll office which can be a class 4, 3, 2, or 1 office. There is also a class 4X office called an intermediate point. The 4X office is a digital one that can have an unattended exchange attached to it (known as a Remote Switching Unit (RSU)).

The following chart will list the Office #, name, & how many of those office exist (to the best of my knowledge) in North America:

Class Name Abb Number Existing
1 Regional Center RC 12
2 Sectional Center SC 67
3 Primary Center PC 230
4 Toll Center TC 1,300
4P Toll Point TP N/A
4X Intermediate Point IP N/A
5 End Office EO 19,000
6 RSU RSU N/A

When connecting a call from one party to another, the switching equipment usually tries to find the shortest route between the class 5 end office of the caller & the class 5 end office of the called party. If no inter-office trunks exist between the two parties, it will then move upward to the next highest office for servicing calls (Class 4). If the Class 4 office cannot handle the call by sending it to another Class 4 or 5 office, it will then be sent to the next highest office in the hierarchy (3). The switching equipment first uses the high-usage interoffice trunk groups, if they are busy then it goes to the final; trunk groups on the next highest level. If the call cannot be connected, you will probably get a re-order [120 IPM (interruptions per minute) busy signal] signal. At this time, the guys at Network Operations are probably shitting in their pants and trying to avoid the dreaded Network Dreadlock (as seen on TV!).

It is also interesting to note that 9 connections in tandem is called ring-around-the-rosy and it has never occurred in telephone history. This would cause an endless loop connection [a neat way to really screw up the network].

The 10 regional centers in the US & the 2 in Canada are all interconnected. they form the foundation of the entire telephone network. Since there are only 12 of them, they are listed below:

Class 1 Regional Office Location NPA
Dallas 4 ESS 214
Wayne, PA 215
Denver 4T 303
Regina No. 2SP1-4W (Canada) 306
St. Louis 4T 314
Rockdale, GA 404
Pittsburgh 4E 412
Montreal No. 1 4AETS (Canada) 504
Telephone basics
To start off, we will discuss the dialing procedures for domestic as well as international dialing. We will also take a look at the telephone numbering plan.

North American Numbering Plan

In North America, the telephone numbering plan is as follows:

· 3 digit Numbering Plan Area (NPA) code , i.e., area code
· 7 digit telephone number consisting of a 3 digit Central Office (CO) code plus a 4 digit station number

These 10 digits are called the network address or destination code. It is in the format of:

Area Code Telephone #
--------- -----------

N*X NXX-XXXX

Where: N = a digit from 2 to 9
* = the digit 0 or 1
X = a digit from 0 to 9

Area Codes

Check your telephone book or the separate listing of area codes found on many bbs's. Here are the special area codes (SAC's):

510 - TWX (USA)
610 - TWX (Canada)
700 - New Service
710 - TWX (USA)
800 - WATS
810 - TWX (USA)
900 - DIAL-IT Services
910 - TWX (USA)

The other area codes never cross state lines, therefore each state must have at least one exclusive NPA code. When a community is split by a state line, the CO numbers are often interchangeable (i.e., you can dial the same number from two different area codes).

TWX (Telex II) consists of 5 teletype-writer area codes. They are owned by Western Union. These SAC's may only be reached via other TWX machines. These run at 110 baud (last I checked! They are most likely faster now!). Besides the TWX numbers, these machines are routed to normal telephone numbers. TWX machines always respond with an answerback. For example, WU's FYI TWX # is (910) 279-5956. The answerback for this service is "WU FYI MAWA".

If you don't want to but a TWX machine, you can still send TWX messages using Easylink [800/325-4112]. However you are gonna have to hack your way onto this one!

700:

700 is currently used by AT&T as a call forwarding service. It is targeted towards salesmen on the run. To understand how this works, I'll explain it with an example. Let's say Joe Q. Salespig works for AT&T security and he is on the run chasing a phreak around the country who royally screwed up an important COSMOS system. Let's say that Joe's 700 # is (700) 382-5968. Every time Joe goes to a new hotel (or most likely SLEAZY MOTEL), he dials a special 700 #, enters a code, and the number where he is staying. Now, if his boss received some important info, all he would do is dial (700) 382-5968 and it would ring wherever Joe last programmed it to. Neat, huh?

800:

This SAC is one of my favorites since it allows for toll free calls. INWARD WATS (INWATS), or Inward Wide Area Telecommunications Service is the 800 numbers that we are all familiar with. 800 numbers are set up in service areas or bands. There are 6 of these. Band 6 is the largest and you can call a band 6 # from anywhere in the US except the state where the call is terminated (that is why most companies have one 800 number for the country and then another one for their state.) Band 5 includes the 48 contiguous states. All the way down to band 1 which includes only the states contiguous to that one. Therefore, less people can reach a band 1 INWATS number than a band 6 number.

Intrastate INWATS #'s (i.e., you can call it from only 1 state) always have a 2 as the last digit in the exchange (i.e., 800-NX2-XXXX). The NXX on 800 numbers represent the area where the business is located. For example, a number beginning with 800-431 would terminate at a NY CO.

800 numbers always end up in a hunt series in a CO. This means that it tries the first number allocated to the company for their 800 lines; if this is busy, it will try the next number, etc. You must have a minimum of 2 lines for each 800 number. For example, Travelnet uses a hunt series. If you dial (800) 521-8400, it will first try the number associated with 8400; if it is busy it will go to the next available port, etc. INWATS customers are billed by the number of hours of calls made to their number.

OUTWATS (OUTWARD WATS): OUTWATS are for making outgoing calls only. Large companies use OUTWATS since they receive bulk-rate discounts. Since OUTWATS numbers cannot have incoming calls, they are in the format of:

(800) *XXX-XXXX

Where * is the digit 0 or 1 (or it may even be designated by a letter) which cannot be dialed unless you box the call. The *XX identifies the type of service and the areas that the company can call.

Remember:

INWATS + OUTWATS = WATS EXTENDER

900:

This DIAL-IT SAC is a nationwide dial-it service. It is use for taking television polls and other stuff. The first minute currently costs an outrageous 50-85 cents and each additional minute costs 35-85 cents. He'll take in a lot of revenue this way!

Dial (900) 555-1212 to find out what is currently on this service.

CO CODES

These identify the switching office where the call is to be routed. The following CO codes are reserved nationwide:

555 - directory assistance
844 - time. These are now in!
936 - weather the 976 exchange
950 - future services
958 - plant test
959 - plant test
970 - plant test (temporary)
976 - DIAL-IT services

Also, the 3 digit ANI & ringback #'s are regarded as plant test and are thus reserved. These numbers vary from area to area.

You cannot dial a 0 or 1 as the first digit of the exchange code (unless using a blue box!). This is due to the fact that these exchanges (000-199) contains all sorts of interesting shit such as conference #'s, operators, test #'s, etc.

950:

Here are the services that are currently used by the 950 exchange:

1000 - SPC
1022 - MCI Execunet
1033 - US Telephone
1044 - Allnet
1066 - Lexitel
1088 - SBS Skyline

These SCC's (Specialized Common Carriers) are free from fortress phones! Also, the 950 exchange will probably be phased out with the introduction of Equal Access.

Plant Tests:

These include ANI, Ringback, and other various tests.

976:

Dial 976-1000 to see what is currently on the service. Also, many bbs's have listings of these numbers.

N11 codes:
----------
Bell is trying to phase out some of these, but they still exist in most areas.

011 - international dialing prefix
211 - coin refund operator
411 - directory assistance
611 - repair service
811 - business office
911 - EMERGENCY

International Dialing

With International Dialing, the world has been divided into 9 numbering zones. To make an international call, you must first dial: International Prefix + Country code + National number.

In North America, the international dialing prefix is 011 for station-to-station calls. If you can dial International numbers directly in your area then you have International Direct Distance Dialing (IDDD).

The country code, which varies from 1 to 3 digits, always has the world numbering zone as the first digit. For example, the country code for the United Kingdom is 44, thus it is in world numbering zone 4. Some boards may contain a complete listing of other country codes, but here I give you a few:

1 - North America (US, Canada, etc.)
20 - Egypt
258 - Mozambique
34 - Spain
49 - Germany
52 - Mexico (southern portion)
7 - USSR
81 - Japan
98 - Iran (call & hassle those bastards!)

If you call from an area other than North America, the format is generally the same. For example, let's say that you wanted to call the White House from Switzerland to tell the president that his numbered bank account is overdrawn (it happens, you know!). First you would dial 00 (the SWISS international dialing prefix), then 1 (the US country code), followed by 202-456-1414 (the
national number for the White House. Just ask for Georgy and give him the bad news!)

Also, country code 87 is reserved for Maritime mobile service, i.e., calling ships:

871 - Marisat (Atlantic)
871 - Marisat (Pacific)
872 - Marisat (Indian)

International Switching:
------------------------

In North America there are currently 7 no. 4 ESS's that perform the duty of ISC (Inter-nation Switching Centers). All international calls dialed from numbering zone 1 will be routed through one of these "gateway cities". They are:

182 - White Plains, NY
183 - New York, NY
184 - Pittsburgh, PA
185 - Orlando, Fl
186 - Oakland, CA
187 - Denver, CO
188 - New York, NY

The 18X series are operator routing codes for overseas access (to be further discussed with blue boxes). All international calls use a signaling service called CCITT. It is an international standard for signaling.


Part II will deal with the various types of operators, office hierarchy, & switching equipment.

Operators

There are many types of operators in the network and the more common ones will be discussed.

TSPS Operator:

The TSPS [(Traffic Service Position System) as opposed to This Shitty Phone Service] Operator is probably the bitch (or bastard, for the female liberationists out there) that most of us are used to having to deal with. Here are his/her responsibilities:

1.Obtaining billing information for calling card or third number calls

2.Identifying called customer on person-to-person calls.

3.Obtaining acceptance of charges on collect calls.

4.Identifying calling numbers. This only happens when the calling number is not automatically recorded by CAMA(Centralized Automatic Message Accounting) & forwarded from the local office. This could be caused by equipment failures (ANIF- Automatic Number Identification Failure) or if the office is not equipped for CAMA (ONI- Operator Number Identification).

I once had an equipment failure happen to me & the TSPS operator came on and said, "What number are you calling FROM?" Out of curiosity, I gave her the number to my CO, she thanked me & then I was connected to a conversation that appeared to be between a frame man & his wife. Then it started ringing the party I wanted to originally call & everyone phreaked out (excuse the pun). I immediately dropped this dual line conference!

You should not mess with the TSPS operator since she KNOWS which number that you are calling from. Your number will show up on a 10-digit LED read-out (ANI board). She also knows whether or not you are at a fortress phone & she can trace calls quite readily! Out of all of the operators, she is one of the MOST DANGEROUS.

INWARD operator:

This operator assists your local TSPS ("0") operating connecting calls. She will never question a call as long as the call is within HER SERVICE AREA. She can only be reached via other operators or by a blue box. From a blue box, you would dial KP+NPA+121+ST for the INWARD operator that will help you connect any calls within that NPA only. (Blue Boxing will be discussed in a future file).

DIRECTORY ASSISTANCE Operator:

This is the operator that you are connected to when you dial: 411 or NPA-555-1212. She does not readily know where you are calling from. She does not have access to unlisted numbers, but she DOES know if an unlisted # exists for a certain listing.

There is also a directory assistance operator for deaf people who use teletypewriters. If your modem can transfer BAUDOT [(45« baud). One modem that I know of that will do this is the Apple Cat acoustic or the Atari 830 acoustic modem. Yea I know they are hard to find... but if you want to do this.. look around!) then you can call him/her up and have an interesting conversation. The number is: 800-855-1155. They use the standard Telex abbreviations such as GA for go ahead. they tend to be nicer and will talk longer than your regular operators. Also, they are more vulnerable into being talked out of information through the process of "social engineering" as Chesire Catalyst would put it.

Unfortunately, they do not have access to much. I once bullshitted with one of these operators a while back and I found out that there are 2 such DA offices that handle TTY. One is in Philadelphia and the other is in California. They have approx. 7 operators each. Most of the TTY operators think that their job is
boring (based on an official "BIOC poll"). They also feel that they are under-paid. They actually call up a regular DA number to process your request (sorry, no fancy computers!)

Other operators have access to their own DA by dialing KP+NPA+131+ST (MF).

CN/A operators:

CN/A Operators are operators that do exactly the opposite of what directory assistance operators are for. In my experience, these operators know more than the DA op's do & they are more susceptible to "social engineering." It is possible to bullshit a CN/A operator for the NON-PUB DA number (i.e., you give them the name & they give you the unlisted number. See the article on unlisted numbers in this cookbook for more info about them.). This is due to the fact that they assume that you are a fellow company employee. Unfortunately, the AT&T breakup has resulted in the break-up of a few NON-PUB DA numbers and policy changes in CN/A.

INTERCEPT Operator:

The intercept operator is the one that you are connected to when there are not enough recordings available to tell you that the number has been disconnected or changed. She usually says, "What number you calling?" with a foreign accent. This is the lowest operator lifeform. Even though they don't know where you are calling from, it is a waste or your time to try to verbally abuse them since they usually understand very little English anyway.

Incidentally, a few area DO have intelligent INTERCEPT Operators.

OTHER Operators:

And then there are the: Mobile, Ship-to-Shore, Conference, Marine Verify, "Leave Word and Call Back", Rout & Rate (KP+800+141+1212+ST), & other special operators who have one purpose or another in the network.

Problems with an Operator:

Ask to speak to their supervisor... or better yet the Group Chief (who is the highest ranking official in any office) who is the equivalent of the Madame in a whorehouse.

By the way, some CO's that will allow you to dial a 0 or 1 as the 4th digit, will also allow you to call special operators & other fun Tel. Co. numbers without a blue box. This is very rare, though! For example, 212-121-1111 will get you a NY Inward Operator.

Office Hierarchy

Every switching office in North America (the NPA system), is assigned an office name and class. There are five classes of offices numbered 1 through 5. Your CO is most likely a class 5 or end office. All long-distance (Toll) calls are switched by a toll office which can be a class 4, 3, 2, or 1 office. There is also a class 4X office called an intermediate point. The 4X office is a digital one that can have an unattended exchange attached to it (known as a Remote Switching Unit (RSU)).

The following chart will list the Office #, name, & how many of those office exist (to the best of my knowledge) in North America:

Class Name Abb Number Existing
1 Regional Center RC 12
2 Sectional Center SC 67
3 Primary Center PC 230
4 Toll Center TC 1,300
4P Toll Point TP N/A
4X Intermediate Point IP N/A
5 End Office EO 19,000
6 RSU RSU N/A

When connecting a call from one party to another, the switching equipment usually tries to find the shortest route between the class 5 end office of the caller & the class 5 end office of the called party. If no inter-office trunks exist between the two parties, it will then move upward to the next highest office for servicing calls (Class 4). If the Class 4 office cannot handle the call by sending it to another Class 4 or 5 office, it will then be sent to the next highest office in the hierarchy (3). The switching equipment first uses the high-usage interoffice trunk groups, if they are busy then it goes to the final; trunk groups on the next highest level. If the call cannot be connected, you will probably get a re-order [120 IPM (interruptions per minute) busy signal] signal. At this time, the guys at Network Operations are probably shitting in their pants and trying to avoid the dreaded Network Dreadlock (as seen on TV!).

It is also interesting to note that 9 connections in tandem is called ring-around-the-rosy and it has never occurred in telephone history. This would cause an endless loop connection [a neat way to really screw up the network].

The 10 regional centers in the US & the 2 in Canada are all interconnected. they form the foundation of the entire telephone network. Since there are only 12 of them, they are listed below:

Class 1 Regional Office Location NPA
Dallas 4 ESS 214
Wayne, PA 215
Denver 4T 303
Regina No. 2SP1-4W (Canada) 306
St. Louis 4T 314
Rockdale, GA 404
Pittsburgh 4E 412
Montreal No. 1 4AETS (Canada) 504