Carl Haywood

[alex57601]

Will tonight be doing time for the many, well-known crimes committed...

http://www.thepress.co.uk/news/3724910.___Orgy_of_offending____by_railway_cheat/

‘Orgy of offending’ by railway cheat

A teenager who used a stolen ticket machine to print £148,000 worth of “free” first class rail passes has been jailed.

Carl Anthony Haywood’s joyriding spree on the rail network was described by his own barrister as “an orgy of offending”, stemming from an infatuation with the railway. He was sentenced to 12 months in a Young Offenders Institute at York Crown Court yesterday. When he appeared, Judge Peter Hunt said: “His joyriding on the railway has been his life.”

Haywood, 19, formerly of Rosebery Terrace, off Leeman Road, York, committed the offences between July 2007 and January 2008.

The court heard how he deceived train staff into issuing tickets by claiming he had lost his first class Rover pass. Worth £860, these tickets cost £15 to replace. The ticket entitles the holder to first class travel across the country for set periods.

He even told one ticket issuer what code was needed for his machine to produce the replacement ticket.

On one occasion, he was caught with 191 such tickets, together worth £148,000. On another, he masqueraded as a railway employee in a bid to get free travel.

He was caught out on a train in southern England, after which a court sent him to prison on remand.

Ms Helen Hendry, mitigating, said Haywood’s fascination with the railways came from being entitled to free train travel as a child because his father worked for the railways. “His whole life became the railways” as he got to know staff on routes he travelled, she said.

“He found ways the system could be defrauded and exploited it to gain free travel. He was on a complete orgy of offending,” she said.

Haywood pleaded guilty to 14 offences. Two charges were for dishonesty by handling stolen ticket machines. The other 12 were counts of fraud, including passing off a falsely-issued Rover rail ticket as genuine on seven occasions, and falsely claiming to be a railway employee. He was also sentenced for possessing articles for use in fraud.

 

[JoshW1992]

Very clever, but idiotic

 

[Broken Viking]

True, true...I'll confess to having done a few FE's in my time, but I wouldn't ever try anything on that scale...And even I'd have the decency to travel only in second class when doing it, and ensuring that I was the last to occupy any available seat!

...But on the other side of the coin, I suppose it could be said that at least there was one person in the World who wasn't confused by the old ticketing system before the stealth increase simplification of it all... :razz:

 

[me123]

I hate to say this, but he did do rather well! That said, he's getting the time he deserves; and that should teach him his lesson. I wonder if he considers his punishment to be "worth the crime"?

 

[rmt]

I wonder if he considers his punishment to be "worth the crime"?

If I should bump into him, I'll try and find out..

 

[P156KWJ]

bloody hell! didn't realise he dressed as a TOC employee to get free travel too hock:

 

[Craig]

Just like a certain caravan did.

 

[djw1981]

I like the way they say £48k cannot be recovered. Makes me think about some other countries criminal law systems where the family would be required to pay for failing to bring the child up correctly, or rather like a student loan it would be removed with tax from his future earnings until paid off.

I had also naively assumed that an Advantix would require a login.

 

[Gizmogle]

I thought that Avantix machines stopped working if you didn't take them back to a base station or whatever?

 

[Broken Viking]

Hail All!

I thought that Avantix machines stopped working if you didn't take them back to a base station or whatever?

In an ideal world, this would be the case...But on the other hand, remember that this guy (This thread is the first I've heard about his existance, I don't know him elsewhere at all) managed to swipe a working and presumably already logged-in Avantix machine, and might've scrolled out all of his illegal tickets the moment he returned home.

Bear in mind also that Avantix machines are all PDA-based and use MS Windows CE as their underlying operating system...So if there was some form of "theft/no return" protection mechanism, he might've figured out how to disable that at OS level. Though a much simpler hack, continually turning back the system clock might have thwarted it as well. hock:

The only way that an Avantix device could be fully protected against such theft and misuse in future would be:

• Use of non-standard, custom-built hardware with an unusual, non-documented processor architecture,
• Sealed units and batteries, with secure data/power connections (Preferably all wire-free) meaning that a stolen unit couldn't be recharged via household means, and would only stay "live" for a maximum of nine hours,
• No COM, LPT, USB, IRDA or PSTN connectivity whatsoever,
• Custom proprietry software and operating system, meaning that a thief/hacker would have to learn the system first before he could find a way of exploiting or circumventing it,
• Use of physical operators keys that would need to be inserted into the device before it would accept any commands. These could be attached to Guard's belts, meaning that a blatantly "swiped" Avantix would leave the key hanging off the Guards belt, and an unusable machine. 8)

Farewell...
>> Death <<

 

[me123]

Or, even more simply, if there was a log-in perhaps he knew one? A complete conjecture there.

 

[Ascot]

One down one more to go.

 

[Broken Viking]

One down one more to go.

Is that me that ye are referring to? hock:

I'll point out that I'm more or less a White Hat when it comes to anything related to Hacking...And although I would like to have a chance to test the security of Avantix machines by pilfering one (With prior consent from the relevant TOC of course) and exploring the options and security flaws on them, any tickets that I'd print out would be returned unused along with the device to it's owning TOC...And such test tickets would be low-value runs anyway, such as a Farnborough > Brookwood CDR. 8)

This matter does make me think a little more about the ability of Avantix machines though...Surely - As this case proves - An Avantix machine shouldn't really be able to issue any type of ticket more valuable than a weekly? :?
Although the on-board issuance of singles, returns and weeklies makes perfect sense - Especially when unmanned stations are served - When was the last time anyone boarded a train and bought a £350+ ALR from the Guard? hock:

In the case of more valuable tickets such as ALRs and monthly/annual seasons being required when a passenger has boarded at an unmanned station; I would say that a much more sensible practice would be to issue that passenger a single or return to the next staffed station in the usual manner, where they may purchase their season or ALR (Or whatever) and have the cost of the aforementioned ticket deducted from the price of the pass or rover that they are buying. 8)

Farewell...
>> Death <<

 

[1D53]

Especially when unmanned stations are served - When was the last time anyone boarded a train and bought a £350+ ALR from the Guard? hock:
[/b]

Good mate of mine bought two from the guard on an Advantix in the same transaction!

 

[Aureol]

Is that me that ye are referring to? hock:

Nah mate, he be referring to another well known fare dodger...

 

[68]

Will tonight be doing time for the many, well-known crimes committed...

http://www.thepress.co.uk/news/3724910.___Orgy_of_offending____by_railway_cheat/

Well he won't do it again!

 

[Tom C]

Advantix does have a time limit on it. If its away from a docking station for more than a certain number of hours then it will suspend and cannot be reused. It also has a time out on the log in and will prompt you to reenter a username and password if it is not used for certain period of time.

Advantix has the facility to issue the same range of tickets that the booking office does (except railcards) however seasons are mostly locked out however it can be set up to issue OTW & Annual tickets if the TOC wants it (and I know one that does at least).

 

[Broken Viking]

Hail All!

Good mate of mine bought two from the guard on an Advantix in the same transaction!

Ye Gods! Did he have a Platinum AMEX card to hand or something?!?!? hock:

Personally - If I was a commercial Guard - I wouldn't be willing to accept cash payment for one ALR, let alone two. It'd be far too much of a security risk for my liking...

Nah mate, he be referring to another well known fare dodger...

[Death breathes a huge sigh of relief...The BTP aren't after him just yet! ]

Advantix does have a time limit on it. If its away from a docking station for more than a certain number of hours then it will suspend and cannot be reused. It also has a time out on the log in and will prompt you to reenter a username and password if it is not used for certain period of time.

Ahh...But the main question there is the length of the timeout. No pilferage timer could allow an "away" period of less than nine hours by default programming (A wise TOC would reduce this appropriateley of course) as it has to be assumed by the manufacturer that any Avantix device could be used on a very long run such as Penzance - Aberdeen (Via Bristol TM, Birmingham No Smoking, and Edinburgh) with an obscene number of diversions and a normal end-to-end timing of up to eight hours! hock:

As for the password timeout: Is there any kind of setting that a Guard can use to disable it if they wish? Knowing human nature as it relates to computers...Most Guards would probabally turn it off if they had the option to do so, simply because the constant PIN entry request would annoy the heck out of them. After all...Consider why virtually no-one has a password protected screen-saver on their home computer!

Advantix has the facility to issue the same range of tickets that the booking office does (except railcards) however seasons are mostly locked out however it can be set up to issue OTW & Annual tickets if the TOC wants it (and I know one that does at least).

Personally - If I was responsible for Avantix - This is one of the first things that I would remove to prevent theft of high-value tickets. Day singles and returns, Savers/Opens, and weeklies would be fine by me...But putting the ability to issue a genuine 4-week ALR on a handheld device that can easily be stolen and misused (Or simply operated by an unauthorised party whilst the Guard is in the toilet) would be far greater a security risk than I would be willing to accept. hock:

Farewell...
>> Death <<

 

[Ascot]

[Death breathes a huge sigh of relief...The BTP aren't after him just yet! ]

That can be arranged

 

[Broken Viking]

That can be arranged

Preferably not...With my car only being suitable for short journeys, the last thing that I would need to deal with is being banned from the NR network! hock:

Farewell...
>> Death <<

 

[37412]

Good mate of mine bought two from the guard on an Advantix in the same transaction!

Bet he was loving that with the 5% commision, about £35 there!

 

[Aureol]

Preferably not...With my car only being suitable for short journeys, the last thing that I would need to deal with is being banned from the NR network! hock:

Farewell...
>> Death <<

Serves you right for driving an old Reliant Robin

 

[Broken Viking]

Hail All!

Bet he was loving that with the 5% commision, about £35 there!

Do Guards earn a comission on the tickets that they sell? That's the first I've ever heard of such things! hock:

On the other hand though - Assuming that is the case - That at least answers my question as to why people would choose to be commercial Guards over non-commercial... 8)

Serves you right for driving an old Reliant Robin

Do I look like a right "Delboy" to ye? I may trade the odd bit o' crap on eBay from time to time, but I've never held a market stall and I've never lived in a tower block in Peckham! hock::razz:

For reference: My first car is actually a Peugeot 406, my other car is a Dennis Dart (Or whatever Stagecoach send around the 2 route), my third car (For short trips) is a 450, and my fourth and fastest car is a 390! :roll:8)

Farewell...
>> Death <<

 

[djw1981]

Hail All! Ye Gods! Did he have a Platinum AMEX card to hand or something?!?!? hock:

Personally - If I was a commercial Guard - I wouldn't be willing to accept cash payment for one ALR, let alone two. It'd be far too much of a security risk for my liking...

But think of the commission!

it has to be assumed by the manufacturer that any Avantix device could be used on a very long run such as Penzance - Aberdeen (Via Bristol TM, Birmingham No Smoking, and Edinburgh) with an obscene number of diversions and a normal end-to-end timing of up to eight hours! hock:

But there are crew changes on that route, so the maximum length of a guards turn plus X is probably the main number.

 

[metrocammel]

Hail All!

Bear in mind also that Avantix machines are all PDA-based and use MS Windows CE as their underlying operating system...So if there was some form of "theft/no return" protection mechanism, he might've figured out how to disable that at OS level. Though a much simpler hack, continually turning back the system clock might have thwarted it as well. hock:

The only way that an Avantix device could be fully protected against such theft and misuse in future would be:

• Use of non-standard, custom-built hardware with an unusual, non-documented processor architecture,
• Sealed units and batteries, with secure data/power connections (Preferably all wire-free) meaning that a stolen unit couldn't be recharged via household means, and would only stay "live" for a maximum of nine hours,
• No COM, LPT, USB, IRDA or PSTN connectivity whatsoever,
• Custom proprietry software and operating system, meaning that a thief/hacker would have to learn the system first before he could find a way of exploiting or circumventing it,
• Use of physical operators keys that would need to be inserted into the device before it would accept any commands. These could be attached to Guard's belts, meaning that a blatantly "swiped" Avantix would leave the key hanging off the Guards belt, and an unusable machine. 8)

Farewell...
>> Death <<

Or bring back SPORTIS...... far more non standard, so even the geekiest of computer geeks would have a job hacking into it.. :P

But there are crew changes on that route, so the maximum length of a guards turn plus X is probably the main number.

Im sure someone like Tom C will be able to confirm this, but afaik, the timeout delay is a considerable length of time, as some remote locations do not have docking stations, so the machine may be away from a (DRU equivallent?) for around 24hrs?

 

[Coxster]

On the other hand though - Assuming that is the case - That at least answers my question as to why people would choose to be commercial Guards over non-commercial... 8)

I'd actually be quite interested to know what TOCs other than SWT have seperate commercial and non-commercial guards. Anyone know?

my other car is a Dennis Dart (Or whatever Stagecoach send around the 2 route)

Dart SLFs (with ALX200 bodywork) operate the route 2, judging by the badging on the back. Been stuck behind enough of the things when not on filtering-friendly two wheels! Surprised they don't get wedged between parked cars up Pinewood sometimes. Seen a few 'Mexican standoffs' up there before on the eastern end of the loop Highly comical... yet rather boring... so I'll be quiet now.

 

[Broken Viking]

Hail!

Dart SLFs (with ALX200 bodywork) operate the route 2, judging by the badging on the back. Been stuck behind enough of the things when not on filtering-friendly two wheels!

I've been stuck behind 'em once or twice as well when driving...Although unlike 99.9% of vehicle owners on the road, I'm not bothered about getting stuck behind a bus for a few stops. Personally, I'd rather be behind them and out of their way, insted of in front of them and holding the service up with my invaribly crap driving! hock:8)

Surprised they don't get wedged between parked cars up Pinewood sometimes. Seen a few 'Mexican standoffs' up there before on the eastern end of the loop Highly comical... yet rather boring... so I'll be quiet now.

Aye indeed...My back garden looks out onto the western edge of the 'park, and all too often - When I'm outside enjoying a cigarette - I see buses having to come to a sharp halt to either let oncoming traffic pass, or to squeeze through a very tight gap.
Indeed...On one recent occasion, I actually witnessed a bus have to make a rather risky several-point turn on the soft verge there as the gap between parked cars was too narrow for the bus to make it through! hock:

Right after seeing this, I actually wrote a fully detailed letter to Hampshi*e CC asking for them to sort out the Pinewood bus issue as soon as possible, and they did write back to me...But it was only with the typical council response of We can't do it because of cost, resources, the fact that Gordon Brown supports Everton, and the fact that we're a faceless government organisation who are more 1337 than you, etc etc etc...

Farewell...
>> Death <<

 

[Tom C]

Im sure someone like Tom C will be able to confirm this, but afaik, the timeout delay is a considerable length of time, as some remote locations do not have docking stations, so the machine may be away from a (DRU equivallent?) for around 24hrs?

The docking station is a direct replacement for the old DRU except rather than being a modified APTIS machine it is a PC however the docking station readouts are actually remarkably simular to what came off the tally roll

I am fairly sure you are right about the 24 hour time out, being at a suburban depot it is highly unlikely that it would ever trigger although I have known staff to forget to go off shift and put the PDA in a docking bay which gives a specific "blue screen" error.

Or bring back SPORTIS...... far more non standard, so even the geekiest of computer geeks would have a job hacking into it.. :P

SPORTIS was a magnificant machine, providing that the fares that you issue are local as the memory on a SPORTIS was very small. Also with SPORTIS you had to carry the full version of the NFM however with Advantix you now have a edited version with all the fares taken out but all the validity information you need (although I should point out that the edited version is a Southern idea which we also use and is very useful and I don't know if other TOC's do the same).

Personally - If I was responsible for Avantix - This is one of the first things that I would remove to prevent theft of high-value tickets. Day singles and returns, Savers/Opens, and weeklies would be fine by me...But putting the ability to issue a genuine 4-week ALR on a handheld device that can easily be stolen and misused (Or simply operated by an unauthorised party whilst the Guard is in the toilet) would be far greater a security risk than I would be willing to accept.

SPORTIS also had the facility to issue various other tickets although they were buried in menus and the paper ticket stock was not ideal.

Its there because most stations and lines have no booking office facilities and it is there to give passengers the full range of tickets (again except railcards and tickets which require a reservation, although the machine can be hooked up to the reservation system). Its main purpose is for Credit Card payments though chip and pin although anyone who has tried the new bluetooth job will know that it is a huge PITA!.

I'd actually be quite interested to know what TOCs other than SWT have seperate commercial and non-commercial guards. Anyone know?

Silverlink may have been one, I don't think the conductors at Willesden who did the NLL and Clapham J issued tickets but the county ones did.

SWT have the right idea by leaving trains within the suburban PF area to be dealt with by revenue staff whilst they concentrate on the doors what with the frequent stops.

 

[JIMBOBJAM]

if you saw the yorkshire post a couple of saturdays back you'd know..