Initially produced by Northern Telecom (better known as “Nortel”), all Millennium-related assets had been bought by Quortech in March 2000¹⁾ which continued to produce, sell and service the phones. As of 2012, Quortech has disappeared from the public²⁾ and seems only to continue to produce said phones while all customer-facing operations are carried WiMacTel - which also happens to own and operate since March 2014 all of Canadas payphones³⁾.

There is plenty of information floating around the internet regarding the Millennium-payphones - but most websites only offer a small piece of the available information. As the whole phreaking-scene is quite old, too, websites tend to go offline and with it some files and information missing. We'll try to provide you with a complete rundown of information and files.

Please note, that information and files provided in the repository - https://github.com/muccc/millennium are generally provided “as is” and not checked for facts.

Information that can be found here on the Wiki should be correct - but please feel free to correct any errors you may encounter.

A list of devices in the Millennium-range can be found here.

A list of boards/PCBs, that have been taken out of one phone and analyzed, can be found here.

Contrary to many - if not pretty much all - payphones (either COCOT⁴⁾ or BOCOT⁵⁾), the Millennium phones don't just work out of the box. While other telephones may be configured on site with help of an On-Screen-menue, voiceprompts or even remote-telemetry, the Millennium phones can only be operated^{That is not 100% correct - keep reading…} when beeing able to make a connection to the so called Millennium Manager. This backend provides the phone with configuration and rates and also receives feedback from the phone like alarms or maintenance-requests.
Phone, meet Millennium Manager
The Millennium Manager is said to cost around 1 Million US-Dollars if to be bought and there are not many know running instances of it - one is at WiMacTel/Quortech. Price aside, another reason for this might be, that the software only runs on HP Tandem-servers

In order to connect to the Millennium Manager, the phones use their built-in modem, which connects at 1200 Baud using an unknown protocol. Marketing-material suggests, that this connection might indeed be done using X.25/Frame Relay ( unverified). It is also rumored, that the connection doesn't use 8n1 but 5n1 instead (Baucode) ( unverified).

As mentioned before, there is an exception to the rule: Nortel produced a few so called “Demonstration Units” (also marked as such on the sticker on the rear) which are indeed capable of working without a connection to the Millennium Manager. Whether is achieved by providing the phones in question with a custom firmware or introducing an additional control-PCB is unknown and subject of current investigation. According to a former Nortel engineer, “demo code” still needs to be loaded on each device, as even on demonstration units the configuration is stored in RAM which is kept alive by a super-capacitor. However, we have found that this information is not true. Demo-Code is a special version of the Firmware (residing in the main-firmware-chip U2), which is quite similar to a regular Firmware - except that it features a few more service-menus (for example to for setting the time). Additionally, the whole configuration-tables, that would normally be downloaded from the NCC are stored in the secondary firmware-chip (X1) and copied to RAM at runtime.

Those phones accept either money or special encoded magstripe cards. It is highly probable, that the phones reading the cards are only looking for a pre-programmed verification-string on the card in order to deem them “valid” - phones connected to a Millennium Manager can also be programmed to do this as a preliminary verification before calling the backend to validate the card.

There are mentions of a tool called the Millennium Maximizer - a handheld device that plugs into the phone and allows on-site programming of the features like the advertising-texts or quick-dial-buttons.

There are no known images or details of this device. After having a call with one of the former Nortel-engineers⁶⁾ it is confirmed, that there is no such thing as “On-Site programming”. The Millennium Maximizer is an application, that runs on the Tandem-server.

The leaked manual - supposedly stolen from a Telus-Facility - offers a comprehensive, but probably not complete list of so OP-codes that can be entered directly on the device to access certain test and/or functions (chapter 4 and 5).

In order to access this menu, a password and a PIN is needed. The default password - if not changed in the Millennium Manager - is CRASERV (2727378). This default code used to initiate the installation-routine, if the phone never had a connection to the Millennium Manager (or forgot all its settings). Additionally, a PIN-code is needed. A list of all allowed PIN-codes is provided to the phone by the Millennium Manager when downloading its configuration. While CRASERV is still used nowadays (November 2014) by Telus-operated phones, Bell is said to have changed it sometime to GODOPIT and again to a now unknown code in december 2004.

1. Extracting the standalone-firmware of a demonstration unit and make it available to other phones
2. Verify rumor, that someone already recreated a Millennium Manager
3. Recreate our very own Millennium Manager