Coping With Cable Denial #1

by Cap'n Dave

There are three forms of denial technology in common use today.  The first is the simplest: the negative trap.  This is merely a filter placed outside of the home (usually on a pole, inside a pedestal, or in a box mounted to the house) that blocks out certain channels.  The problems with this system are that a capital outlay is required for the homes that don't pay for the premium channels, and that someone has to come out to add or remove services.  In addition, a converter may be required for non-cable-ready equipment.

These negative traps are cylindrical in shape, about five inches long and one inch in diameter.  They are threaded with a male "F" connector on one end and a female "F" on the other.  Each one may block out one or more channels (always contiguous though), and are often used in series.  On channels where these are in use, your TV will show nothing, or a faint, "snowy" picture.

These could be removed, but the cable company will eventually notice and possibly get upset.  Better yet, older-style traps can be opened and wired straight through.  If they were then replaced, the cable company might never notice.  A clever person might steal someone else's traps to experiment with.  Newer traps are filled with epoxy and will have to be drilled out before being re-wired.  The experimenter will probably have to destroy a few of these to get the technique down.

A note for apartment dwellers: the traps for every unit in the building are usually in a box somewhere on the outside of the building.  This may (or may not!) have a lock on it.  In any case, the next time the cable company comes out there is a small but finite chance that they will notice all the traps missing on one particular unit.  To avoid this, drill out and rewire the traps, or remove every single trap in the box.  Better yet, share the joy with some other buildings.  This won't work for long, but it covers your tracks.

In the old days, the negative traps could be "burned out" by attaching 120 VAC to the cable, and flipping it on and off a few times.  Do not do this!  It won't work anymore (the traps burn out and no longer pass signal) and it's real obvious to the cable company what happened.  Melted coax is hard to hide.  Also, it sometimes catches on fire.  Kinda hard to explain to your insurance agent and/or the fire department.

The second common denial method is the interfering carrier.  In these systems, a "jamming" carrier is placed halfway between the video and audio carriers (at a frequency 2.25 MHz above the video).  This is removed by a "positive" trap placed inside the paying customer's home (threaded in line on the back of the box/VCR/TV.  They look just like a negative trap, described above.  In this case, the cable company only has to shell out for customers who are paying for the service.  However, the interfering carrier obliterates some of the picture information, and the filter blocks out even more.  This results in some degradation of the picture, especially the sharp details.  Cable companies often get complaints about this.

These channels (more than one denial method may be in use on the same system) can be identified by the loud screeching noise emitted from the TV.  Also, the picture should be flashing and/or full of lines.  The actual "jamming" effects may vary from TV to TV.  An article in the Spring 1993 issue described a crude method for blocking an interfering carrier.  I have not tried this, and have no idea how well this will work.

The third method is to scramble the picture, and lease the customer a converter/descrambler to recover the picture.  Not all converters can descramble!  And one brand is not likely to descramble the competition's scrambling scheme.  Also, unlike an earlier writer indicated, not all brands of converters have "booby traps" in them that activate on opening.  Some do (especially Pioneer), but probably far less than half of non-Pioneer boxes are so equipped.  If one were to "accidentally" trigger one of these, it would be prudent to return it and say the cat knocked it off the top of the TV.  As long as there are no other anti-tamper methods in use (labels, etc), this will probably work.  Especially if a female swapped the box.  Women virtually never pirate cable.  It's a man's game.

Scrambling is done in several ways.  The most popular is to amplify the voltage of the horizontal sync signal.  This prevents the TV from knowing when to draw the electron beam back to the left side of the screen.  Thus the picture "breaks up."  Usually the audio is undisturbed.  The cable descrambler lowers the voltage of the sync signal, and the TV again locks.

Now, about converters.  These boxes come in three flavors: non-addressable non-descrambling, non-addressable descrambling, and addressable descrambling.  The non-addressable non-descrambling converter is just a converter - it tunes the channels that non-cable-ready equipment can't tune, and converts them to channel 3.

The non-addressable descrambling converters can descramble and tune channels.  But they must be programmed by the cable company via some contact method (i.e., not through the cable).  They may have to open the box and program a chip, or use an infrared programming scheme.

The most sophisticated (and newest) form of converter descrambles and is addressable.  That is, the cable company can reprogram the box over the cable.  They will die, at least temporarily, if cut off from the data on the cable.  These are the only kind of boxes used for pay-per-view.

Contrary to popular opinion, these boxes do not "spy" on the customer.  They don't have tiny cameras or microphones in them.  Cable operators have enough trouble getting a signal to you to worry about that sort of thing.  In fact, the vast majority of cable systems are one way only, or at least one way over the cable.  This means that the company has no way to tell if a box is cloned.

On systems with instant pay-per-view (where the movie is bought from the box, not over the telephone) there are two ways of getting the data back to the cable company.  Phone return is the cheapest.  The box is attached to the phone line and it calls in, usually in the middle of the night.  The more advanced systems send the data back over the cable.  This system is gaining in popularity as the phone companies try to move into the cable business, and as they try to make the cable companies pay for using the phone lines.  Both of these schemes are sometimes used to monitor what people are watching.  (It's more like asking the box, "See what they are watching tonight at 7:00 pm and call me back."  The cable operators can't find out every time you switch channels.)

The costs of these converters vary from $30 to $50 for the simplest up to $150 for a top-of-the-line addressable unit.  "Wide open" units may often be purchased on the black market.  Check the ads in the back of Popular Science or Nuts & Volts.  (You do subscribe, don't you?  All hackers should.  Call 1-800-783-4624 now.)  These are also good sources for replacement remotes, in case you lose yours.  Remotes cost the cable company about $5 but they often charge $30 if you lose one, in addition to charging a couple of bucks a month.  Talk about your return on investment!  Remember, though, that it is illegal to own a converter box capable of receiving services to which you are not entitled.

Some "legitimate" cable companies are actually Mafia-owned fronts for obtaining converters.  Stories constantly circulate about systems with 2,000 customers ordering tens of thousands of boxes.  These converters are then diverted into the black market.  With the government raiding these shops, it may or may not still be safe to order boxes, though remotes are probably still O.K.

Positive traps can also be purchased from some of these suppliers, or can be built using parts from RadioShack.  Build a high-order notch reject filter, and tune it for best picture quality.  If there are several channels on the system blocked by an interfering carrier, a clever person might build and optimize (or buy) a single filter for channel 3 and use an inexpensive non-addressable converter to put the video out on channel 3.

Most converters can be opened easily, even though they often have some sort of "security" screws on them.  The nastiest one I've seen uses a head that is slightly oval.  You will know what I mean if you see one.  These can be removed by heating a plastic tube and pressing it down over the head before it cools.  Now you have a tool!  Pens make good sources for such plastic tubes.  Other kinds of security screws can be removed with improvised tools, or Vise-Grip pliers.  Tools have also been advertised in Nuts & Volts.

Cable TV companies do have the ability to "look" down the cable and see what equipment is attached, and what channel you are watching.  However, this requires skilled operators and expensive equipment (high frequency spectrum analyzers and TDR units).  It must be done at the house (or pedestal, pole, etc.) and is not usually done randomly.  This snooping can most likely be blocked by putting an amplifier before anything you don't want them to see.  They will see the amp, and nothing past it.  Higher quality amplifiers will do a better job.

Happy hacking!