AT&T Unable to Stop Subscriber Database Theft; 300 Million Names and Numbers May Have Been Harvested

Claims made in a federal lawsuit (pdf) by AT&T against two individuals and a Utah-based group of companies, reveal what may be the largest so called data mining, name and phone number harvesting scheme to be conducted in the United States. If proven accurate, this suit completely disassembles the whole -we have permission to call- fabrication, which leads from Utah, through several states, and right to the front door of my home.

Discovered in a short column in the Salt Lake Tribune newspaper, this suit may be the most shocking and eye opening development in the struggle to stop home security alarm telemarketers from their relentless activity. Given the sheer volume of complaints posted online, the claim that calls are only made to those who authorize them through so called “opt in” procedures, seems incredulous.

Phil Iverson and Chris J. Gose (individually), along with a group of companies associated with Forrest S Baker III, are accused in the suit (3:11-cv-020009-0 Northern District of Texas, Dallas Division) of repeatedly and deliberately accessing the AT&T network by engaging in multiple acts of fraud and deception to obtain valuable, private customer data from AT&T. Through the use of business telephone lines and the AT&T Caller ID service, the defendants were allegedly able to spoof outgoing calls and “trick” the AT&T customer name database into revealing the name associated with the number. This information, which is generally not commercially available, would be invaluable to telemarketers and the clients they serve.

The lengthy, first amended complaint states that hundreds of millions of phone calls were auto-dialed from and to dozens of locations across the United States, as early as May 2006 and continuing until at least June 2010. AT&T is unsure if the activity has ceased, as the defendants allegedly worked hard to conceal, move, and continue the operation. Using such strong language as “computer fraud, computer data theft, cable piracy, theft by deception, conversion, and criminal conversion”, the suit describes the operation as “series of cyber-attacks” that has cost AT&T millions of dollars.

Left unsaid is the potential cost to unwitting consumers who have never provided their phone number to anyone, yet have incurred the expense and aggravation associated with these relentless telemarketing calls.

HOW THE HARVESTING OPERATION WORKS

When a caller dials a land line telephone, and the recipient has Caller ID (CID) service, the name and number of the calling party appears on the CID screen. In order to provide this data, phone companies maintain a Customer Name Database (CNAM) which is used to provide the CID information. This database is the target of the so-called Data Miner or Harvester.

The process to access the network and thus the data is pretty simple. The Telemarketers (TMs) purchase multi-line phone and Caller ID service (in this case from AT&T). Using an auto-dialer and computer software, the TMs make outbound calls to their own numbers using a false or “spoofed” outgoing phone number. As the phone rings, a query is made to the AT&T CNAM database so that the calling party’s name, as well as number, is displayed on the receiving phone. This process happens in about 500 milliseconds, or the time it takes for the phone to ring twice. The name matching the spoofed number displays on the TMs receiving phone (computer) and is captured. The TMs now have a confirmed, active phone number, with the matching name.

According to the suit, the defendants initiated phone service with AT&T in Utah in October 2004. The agreement was with a Forrest S Baker III associated company, Feature Films for Families, Inc. of which Iverson was the “IT Manager”. In May of 2006, AT&T detected about 3 million automated, “no duration” calls being received by two phone numbers Feature Films had purchased from AT&T.  The calls had originated from a different carrier, Quest, and none were answered. Each call was made one after another, using spoofed numbers not associated with Feature Films. This led AT&T’s network fraud department to suspect data mining.

Contacted by AT&T, Phil Iverson explained that Feature Films had been calling themselves in order to test telemarketing equipment, and that there would be no further activity of this kind. AT&T stated that the calls continued and by June 2006 had disconnected the Caller ID service from Feature Films phone lines.

THE OPERATION MOVES TO TEXAS & GEORGIA

The operation allegedly moved to Dallas, Texas in September 2006 with the activation of eight phone lines by CCI Communications, which appears to have supplied the lines to Feature Films. Over the next nine months more than 21 million calls were made to the Dallas phone numbers acquired by CCI.  The calls were in sequential order and lasted an average of six seconds. As stated by AT&T in their suit, “those calls could have no legitimate purpose”.

In July 2007, AT&T executives observing the calling activity, contacted Iverson who stated that a charitable organization had provided the blocks of numbers to confirm as active before a telemarketing campaign. According to the suit, a conversation was held between AT&T and executives with Feature Films, to include Forrest S Baker III, Mike Bills, Greg Cope, Iverson, and Gose, in which they were informed that the Caller ID service would be suspended. Later in July, AT&T also blocked CCI’s ability to spoof outgoing calls from its’ Dallas numbers except for those specifically assigned to them.

(Individuals identified in Paragraph #60 of the lawsuit)

In the meantime, Iverson through CCI had allegedly set up a similar operation in Georgia, acquiring eight phone lines. From November 2006 until September 2008, CCI made 112 Million calls to its Georgia phone numbers, using “sequentially-numbered, spoofed phone numbers, each of which generated a Customer Name Database query.

The calls were restarted in Dallas a second time in April through June 2008, again with “sequentially-numbered” spoofed phone numbers, and an average duration of 1.36 seconds. AT&T observed over 22 Million calls in this particular batch.

THE HARVESTERS ARE ON THE MOVE

It seems that the process was to simply relocate, use a different corporate shell, and continue the operation. Through  “Blue Skye” they allegedly set up 40 phone lines in Chicago. Vera, LC established phone service in the Nashville area of Tennessee, participating in millions of calls.

The group moved back to Dallas between December 2008 and June 2010 and into southeast Texas, establishing operations at three different locations in Houston. In six different batches, AT&T alleges that affiliated entities like Vera, LC and All Things Family, Inc. made almost 60 Million calls to their Houston phone lines between January 2009 and June of 2010.

(Photos of the Alleged Houston Locations)

The suit also discusses operations in Charlotte, San Francisco, Indianapolis, Overland Park Kansas, San Diego, and Kansas City all in the same manner and style as the previously described.

THE UTAH GROUP HAS LONG HISTORY OF COMPLAINTS

The Utah group of companies  has a long history of complaints about their telemarketing activities. According to the Utah Better Business Bureau, the main organization Feature Films for Families Inc. had their accreditation revoked, currently has an “F” rating, and has an “There is an alert for this business” link on their review page.

Other tangles with regulators and plaintiffs include:

August 2006 – Missouri Attorney General Jay Nixon secures an assurance of voluntary compliance and an agreement to pay $70,000 for abusing the Missouri No Call list.

March 2009 – Verizon Wireless settles a lawsuit against Feature Films for illegally calling Verizon Wireless customers to advertise the movie “The Velveteen Rabbit”. The agreement includes a $25,000 cash settlement.

June 2009 – The Federal Communication Commission (FCC) issues a CITATION against Kids First aka Family Feature Film – Forrest Baker, Owner – for violations of the Communications Act of 1934. This complaint was regarding the same “Velveteen Rabbit” telemarketing.

December 2009 – The Tennessee Regulatory Authority, Consumer Services Division entered into a settlement agreement with Corporations for Character (a related Forrest S Baker Company) for violations of the TN Do-Not-Call telephone Solicitation Law, with an agreed penalty of $18,000. The respondent admitted no wrong doing.

March 2011 – The Pennsylvania Attorney General agreed to end its’ investigation into claims that Feature Films violating the PA Telemarketing Registration Act (and others) by soliciting consumers on the PA Do Not Call registry. The company agreed to pay $3,000 in civil penalties and $2,000 in investigative costs.

May 2011 – The Federal Trade Commission and the U.S. Department of Justice filed a complaint against Forrest S Baker III, Feature Films for Families Inc. (and others). They allege that the defendants repeatedly called numbers on the National DNC Registry, called consumers who previously asked them to stop calling, failed to identify the name of the caller or seller making the call, and other claims.

In many cases the Utah group paid a small sum, while admitting no wrong doing.  It’s interesting that the time line of the telemarketing complaints is not that different from the time line outlined in the AT&T phone number harvesting lawsuit. The final disposition of the most recent cases has not been determined.

300 MILLION CALLS MADE TO CAPTURE SUBSCRIBER NAMES

It’s clear that a database of active phone numbers and matching names would be quite valuable to a major telemarketing operation. Implied in the lawsuit is the idea that these numbers were captured for a purpose, and indeed they have a shelf life. Consumers change phone numbers all the time so the need for a harvester to continue the operation makes sense.There  is no evidence that the harvesting activity has stopped. In fact AT&T says that while they have worked hard since 2006 to do just that, it’s uncertain if they have.

117. Although the named corporate Defendants, to the best of AT&T’s knowledge, have stopped purchasing services directly from AT&T to accomplish their data mining, it is possible – if not probable – that Defendants will continue to engage in similar schemes under different guises, or use other carriers’ services to launch unauthorized data mining attacks on AT&T and unlawfully invade AT&T’s network facilities and steal information from AT&T’s electronic CNAM database, as they have already done.

The AT&T electronic CNAM database is constantly revised and updated as new telephone numbers are issued and assigned to relocated or new subscribers, and as old telephone numbers are returned by departing subscribers and reassigned to other subscribers. As a result, Defendants need to continue their data mining of AT&T’s electronic CNAM database to keep their own unlawfully-obtained, mirror database “current.” Otherwise, Defendant’s “mirrored” database would quickly become outdated and of limited use to them. (emphasis added) Thus, there can be little question that Defendants intend to, and will, continue their data mining unless and until they are enjoined from doing so by this Court.

118. Indeed, Defendants’ use of various networks and carriers to deliver data mining calls to the AT&T PRIs and ordinary AT&T telephone lines purchased by Defendants, as described above, demonstrates that Defendants intend to continue their illegal, fraudulent, and unauthorized data mining activity and are deliberately trying to avoid detection of such continued activity.

There is little evidence presented that AT&T really has the ability to stop them. The alleged use of other providers like Quest to originate calls, the change from sequential dialing to random dialing to disguise the activity, and access to offshore call centers leaves this consumer with little confidence that the harvesters can even be stopped. Regular readers who may have recognized some of the names in this piece, stay tuned. I’ll connect the dots soon!

Advertisements

13 Responses to AT&T Unable to Stop Subscriber Database Theft; 300 Million Names and Numbers May Have Been Harvested

  1. Janet says:

    Absolutely amazing that this has been allowed to continue for so many years. I can’t count the number of times my telephone rings twice each day. When I am unfortunate enough to answer, of course no one is there. Now I know why. My name & number are being harvested by goodness knows how many telemarketing operatives.

    • Mark says:

      I found the following information for the culprits on the contact page of their website:

      Web: familytv.com
      Email: custserv@familytv.com & custservcan@familytv.com
      Phone: 1-800-FAMILY-TV (1-800-326-4598) or 1-800-347-2833
      Business hours: Mon–Fri 9:30 a.m. – 6:00 p.m. MST
      3rd & 4th Saturday of the month 9:00 a.m. – 1:00 p.m. EST
      Mailing address: PO Box 572410, Murray, UT 84157

      Their website is registered to:
      Feature Films for Families
      James Fair (domains@familytv.com)
      (801)263-8555
      5286 S. 320 W.
      Suite A-116
      Murray, UT 84107

  2. So these are the guys behind “Tom” the telemarketing computer?

  3. 1911man says:

    Jim, Got an “artificial intelligence” prerecorded call on behalf of South Carolina Fraternal Order of Police a couple of weeks ago. When I called back on the CID number, the operator greeted me by calling me by name even though I blocked my CID!!!! I wondered how they did that and now I know that they were “farming” ATT’s data. Wow, ATT’s complaint looks like these Utah TM’s are in a world of hurt!!!!!!

    • StopTom says:

      Yes, the Forrest S Baker III group has been affiliated with the FOP calls. It would make sense that they would use the interactive prerecorded voice clips too. I’ll cover that in the next post.
      –Jim

  4. db says:

    Hi,

    Can this number harvesting technique still get your number when you have ‘Line Caller ID Block’? As opposed to ‘Per-Call Caller ID Block’…

    TIA,

    db

    • StopTom says:

      DB:

      The technique, as described in the lawsuit, has nothing to do with the calls we dial or receive. They were allegedly inserting blocks of numbers into the Caller ID, to generate a display on the ringing phone, which is also theirs. If the call started to ring then they would know a) it’s a working number, and b) the name associated with it. They would dial millions of numbers in sequence to generate a Caller ID display of the associated name.

      Hope that helps!

  5. GoodJob! says:

    Fascinating story! Thanks for dissecting the technicalities. But that suit was re landline phone numbers. Guessing mega crooks like these “Family” guys are harvesting cell numbers the same way(?)

    Such a rabbit hole, probably no way to really stop it as newer crooks will always step up to take the place of the prior crooks who may be put out of business by being caught.

    And a socalled “Family” company… those guys are completely without conscience.
    Pathetic.

    • StopTom says:

      They used landlines to call themselves but as they dialed sequentially the targeted numbers could be wireless or landlines.

  6. slr543 says:

    Can this be reported to slashdot? That’s a tecchie bulletin board where a possible technical workaround can be discussed. We need to spread the word as far and wide as possible to bring these sewer pipe sucking life forms to justice.

  7. ShootFirst says:

    Had one a while back, indeed pitching security monitoring. “What? You do realize you just called a Texas number, yes? I have a dozen or so loaded magazines of home security. Why do I need yours?”

    *click*

  8. bo gus says:

    Some of the defendants phone numbers are listed publicly. I wonder how they would like to get a few hundred calls asking them to stop with the harassment.

  9. Erik says:

    I live in South Florida and receive calls from Tom in OR.. I just want it to stop.

%d bloggers like this: