The first time I called into an elevator, I picked up my iPhone and dialed the number—labeled on my list as the Crown Plaza Hotel in Chicago—and immediately heard two beeps, then a recording of a woman's voice, who told me to press one to talk. When I did, I was suddenly in aural space filled with the hum of motors and the muffled twanging of steel cables under tension. "Hello, can anyone hear me?" I asked the void. The void did not respond.

I hung up and tried another number on my list: A Hilton hotel in Grand Rapids, Michigan. After just one ring I heard a series of four tones and was immediately listening to the inside of another elevator. I heard a chime, perhaps a signal that it had reached a floor, followed by the rumble of what might have been a door opening. "Hi, is anyone in here?" I asked. This time I heard a few muffled voices, then a woman answered: "There are people in here, yes."

Sounding a little more excited than I intended, I asked if anyone was in an emergency situation, a strange question I felt compelled to lead with, to make sure I wasn't tying up the elevator's phone line when the occupants might need it. I got no answer except what sounded like the rumble of the door opening and closing again.

So I stayed on the line. A few seconds later, the elevator chimed, and I heard the noises of new people entering. I greeted them as I had the first passengers, but they didn't seem to hear me even after several attempts. "Turn it over," I heard a woman's voice say in a Midwestern accent. "The lady at the desk just said to hold it," a man said. I realized I was listening to a couple trying to figure out how to use their keycard to unlock the button for their floor of the hotel. I felt a transgressive excitement, a sense that I was eavesdropping on a conversation I shouldn't be hearing, and I instinctively hung up the phone.

This was my introduction to the illicit thrill of elevator phone phreaking. I had learned about this hobby—and received my list of working elevator phones—just a few days earlier from Will Caruana, a thirtysomething freelance security researcher. Caruana works a day job in airline customer service, mostly helping people find their lost luggage. But in his off hours, Caruana practices phreaking, a decades-old form of proto-hacking that explores the hidden features, bugs, and pathways of the global telephone system. At the Defcon hacker conference in Las Vegas today, Caruana will give a talk on a very specific subgenre of that pastime: phreaking elevator phones, the emergency call boxes legally mandated to be in every elevator in America, and largely left wide open to any caller who can determine their numbers.

Red Lights and Defaults

"I can dial into an elevator phone, listen in on private conversations, reprogram the phone so that if someone hits it in an emergency it calls a number of my choosing," Caruana told me in our first conversation. Elevator phones typically emit audible beeps in the elevator when they connect. But if someone has dialed into the phone of the elevator you're riding before you enter it, Caruana warned me, the only indication might be a red light on the phone's panel. "It’s hard to notice if you're not looking for it," Caruana says.

Over the last year, Caruana has assembled what he believes is the largest public list of elevator phone numbers, which he plans to make available to a limited audience—although he declined to say where exactly he's publishing it. He says he's releasing the list of 80-plus numbers not just because he wants to foster more elevator phone phreaking as an opportunity for whimsy and chance encounters, but also to draw attention to the possibility that elevator phones could be abused for serious privacy invasion and even sabotage. Call up most elevator phones and press 2, and you'll be asked to enter a password to reprogram them. In far too many cases, Caruana says, phone installers and building managers don't change those passwords from easily guessable default codes, allowing anyone to tamper with their settings.