Paging for Free (June, 1987)
--------------------------
By Bernie S.

Did you ever want a beeper or paging service but decide against it because of
the cost? Well, in many areas the local voice-paging system can be used without
charge!

First, a brief description of how a voice-paging system works. Many
voice-paging systems work by broadcasting all paging traffic on the same radio
frequency in the VHF band around 150 MHz. All pagers on that system are tuned
to the same radio frequency but each one has an audio tone decoder tuned to a
unique sequence of audio tones. Every subscriber is assigned a different local
or toll-free phone number that people should call when they want to reach him
through his pager. When that number is dialed, the caller hears a tone, which
prompts him to start his verbal message. This is limited to a few seconds,
after which another tone cuts him off. This voice message is then temporarily
stored in an audio tape buffer or a digital memory subsystem before being
routed to the paging transmitter. A unique tone sequence is broadcast just
prior to the voice message, which triggers the appropriate paging receiver so
the subscriber only hears messages intended for him and not everyone else s on
that same frequency. The pager times out after the fixed-length message is
over.

A couple of years ago while listening to the local voice-paging channel on my
scanner; I figured that anybody could just call any one of those phone numbers
and get their message on the air. So after calling some numbers above and below
my friend's voice pager number I found that this was true - I heard myself on the
scanner. Problem was, you had to listen to everyone else's messages, too. Some
kind of selective tone decoder for the scanner was in order - the cheaper the
better. Also, some kind of tone encoding system was needed that anyone had
access to, so why not use touch tones? After some experimenting, I found that a
touch-tone decoder chip with two 2N2222 transistors and a few resistors and
capacitors (about $10 total at Radio Shack) could be used to decode the * (or
any other) touch tone from the scanner's audio section and switch the audio on
to the speaker. It all fit quite nicely into a matchbox-sized container taped to
the back of my portable scanner, and could be powered by the scanner batteries.

Now, when anyone called any of the paging system phone numbers and preceded
their voice message with the * touch tone, the scanner speaker would sound off
and allow me to hear it. At least a full second of tone was needed to unlock
the decoder chip. Whoever was assigned that pager number would also hear the *
tone and the message, so it wasn't entirely private, but it was free and you
could take a "free ride"  on any of the several hundred pager phone numbers to
help avoid detection. The scheme worked quite well for over a year and it never
was found out. Those paging me had to be careful not to give out their regular
phone numbers or exact locations over the air, so a simple code was devised to
allow a "modified" phone number to be broadcast without giving the intended one
away.

If you already own a portable scanner, you already have most of a voice-pager.
A programmable unit is needed to find the proper radio-paging frequency, but
once you know it, a less expensive crystal unit can be used. The paging system
phone numbers can be found by dialing numbers above and below a known pager
number (ask somebody who has one or call the paging company and tell them you
forgot yours). A schematic for the tone-decoder chip circuit is included if you
buy it at Radio Shack, but the hook-up to your scanner s audio section depends
on your model. You can usually get a schematic for your scanner by writing the
manufacturer, and a friendly hardware hacker can help you with the hookup
details if you re not electronically inclined. If you can bear listening to all
the other paging traffic while waiting for your messages, you can skip the
modification altogether and just tune in.

Scanner World in Albany, New York, probably has the lowest scanner prices
around. They sell a crystal-controlled, pocket size, single-channel receiver
that's ideal for this application for only $39. Be sure to specify the right
frequency before ordering it, though. Since you'll want to leave your unit
turned on most of the time, it's cheaper to use rechargeable Ni-Cd batteries.
One could get fancy and add a 555 timer IC to the circuit which would
automatically time-out and shut the audio off after the message is over, but
turning the scanner off and back on again will reset it just the same. Some
mobile scanners have enough room in them to mount the extra circuitry right
inside, but portables are too tight a squeeze.

You probably don't need to be reminded that theft of telecommunications
services is a crime, and that calling the same pager number repeatedly (not
very smart, and unnecessary anyway) could be considered harassment. But if one
is reasonably careful about what is broadcast, changes the pager number
frequently, and places calls from pay phones when possible, the chances of
being found are almost zero.