============================================================================ Organisational Unit Codes within B.T ============================================================================ 12/04/96 Psyclone/MED Organisational Unit Codes are most often come across by the phreaker when trashing his or her local telco site. Each telco site will most probably have its own array of code, which are used mainly for identification purposes. To you and me, their use comes into the art of social engineering. Anyone who has used BT Interview will be familiar with them, and should know that the operators are as likely to accept an OUC of FUK007 as any genuine one.. but just to do the job properly, you can usually find an OUC by looking at the top corner of any parked BT vehicle's windscreen. ========================= a) Why do OUC's even exist? OUCs were introduced by Project Sovereign in 1991 to provide a convenient illustration of the management reporting in the new organisation. Since then OUCs have become essential to many of BT's systems and processes. Needless to say, OUCs have also become necessary for infiltrating BT. It is simple to get hold of an OUC with matching name, but for access that requires this, simply use your head as an OUC generator and get imaginative. The more secure of systems will require an EIN (Employee Identification Number) in addition, which will certainly provide a problem for some. Other details that may be required are: rank/title, name of line manager, exchange line fone number, and finally the ultimate problem: the dreaded National Insurance number (sarcastic shudder). b) What are OUC's & how are they used? A typical code might be ABC123, each OUC represents an organisational unit and one or more posts. Each character of the OUC represents a layer of management. It is an objective of BT to achieve a maximum of 6 layers of management, and so there are up to 6 letters in an OUC depending on rank. Many people in BT have not yet grasped this concept, eg. (gospel truth) I called a number which requires an OUC to be stated before any info is given, and when prompted for an OUC by the operator I said "KRAD31337", and this operator (who told me he had been with BT for how many years) did not even hesitate before prompting me for what I wanted to know. Each major unit (typically a division) is represented by a single letter OUC, such as A. Unit A will be made up of a number sub-units (typically headed-up by a Director reporting to a division MD) with two letter codes eg. AA, AB, AH. Further sub-divisions follow the same pattern. For example, within unit AB might be smaller units ABA, ABB, ABF. Its fairly safe to say that the shorter the employee's OUC the higher his rank. The numbers and letters chosen have no special significance but some have still been chosen as they are easier to remember. Where there is cross-divisional working or so-called matrix management, the OUC should reflect the stable line management responsibility and not the 'dotted-line' relationships which may change from week to week. BT encourage individual responsibility and have issued a statement saying you should use your name and job title to identify yourself when engaged in verbal communication and that OUCs should not be quoted to customers. OUCs are primarily used in operational systems for management reports, to indicate management structure, or escalation paths. They may also be used for financial reporting such as people costs, job assignments, etc. where this is organisationally based. Most applications require the OUC at the level of the smallest unit to which the individual belongs. OUCs are also used as a very poor method of security as was described earlier. They are used in most strategic systems eg. MERIT, PRISM-MIS & NAS even though they are loosely based. (as the OUC can only describe the unit to which the individual belongs, ie the individual cannot personally identified). As an improved method of security BT have introduced EINs. These are Employee Identification Numbers and a different number is issued to each individual. They are 9 digits long, and I think that they were originally introduced about 10 months ago as part of an 'employee benefit scheme', rather than for security reasons. Inappropriate use of OUCs by BT people: 1. To indicate levels of financial authority, rank or status. An OUC may be shared by managers and non-managers alike. 2. Non-hierachially (eg AC reporting to AB). 3. With extensions such as suffices or other abbreviations. Here are some extracts from the BT data standard CIS/DMT/C200 which is BT issued internal file about OUCs : ` The naming strategy by which BT Organisational Unit Codes are assigned is based on the position of the post or unit within the management hierachy. Each post or unit is allocated a character which is unique within the scope of the post's immediate superior inthe hierachy. The linking together of these characters from the top of the tree down to the post or unit to be named yields the required (unique and un ambiguous) code. The BT Organisation Unit Code is structured as a sequence of characters ranging from 1 to 6 in length. The first 3 characters are chosen from particular sets of alphabetic characters and the following 3 are always alphanumeric. All letters must be upper case. The 4th, 5th and 6th characters in the sequence will be alphanumeric and are used to refer to any post or unit in the 3 lowest layers of management. Non-management staff will use the OUC of their line manager. Management and professional graded people (not staff) use the OUC or their line manager; except where for operational reasons they have to be uniquely coded so have their own code. Where there are more than 6 layers of management in the organisation. These exceptions must be approved by the Chairman or BT Management Board. ' Psyclone.