TransNexus Blog

At best, they could require the U.S. to implement STIR/SHAKEN [1], maybe. There will be significant technical and legal challenges in this. Overhauling or upgrading the existing switches is non trivial. This is just my opinion, but I predict this will result in legal battles and legal stalling on the part of the telcos. Even if all the telcos agreed to do this, there would be a period of time that nothing is enforced and even then, this has no impact on anyone outside of U.S. jurisdiction unless laws with teeth require amended agreements between the U.S. and non-U.S. telcos. I am not a lawyer, but I don't need to be one to see some of the ways this will play out and how this can turn into political posturing, deflection of responsibility and saber rattling between the U.S. and other countries. [1] - https://transnexus.com/whitepapers/stir-and-shaken-overview/

Architecturally there's no binding between phone number and subscriber identity except at the very edge of the network, for the very smallest retail customers. There is a design to federate this binding throughout the ecosystem using a PKI called STIR/SHAKEN [0], but it's absolutely a hard technical problem to get that rolled out 100% without breaking things. [0] https://transnexus.com/whitepapers/shaken-as/

> a technology designed to prevent robocalls altogether, recommended in a report more than a year ago and currently set to be implemented in Canada in 2019, has no such date here in the States. What’s the technology? Edit: https://transnexus.com/solutions/stir-and-shaken/stir-and-shaken-overv… ”STIR and SHAKEN use digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure. Each telephone service provider obtains their digital certificate from a certificate authority who is a trusted authority. The certificate technology enables the called party to verify that the calling number is accurate and has not been spoofed.”

We're still very early in the process. 1) Deploy caller ID signing. <--We are here. 2) Deploy policies to make inter-telco tracebacks easier and increase liability for carrying too much spam. 3) Drop unsigned traffic and shutdown spam friendly portions of the PSTN (analogous to open email relays). 4) Use the tracebacks and KYC to deter robocalling operations from getting onboarded and ban current customers who are robocalling. And keep them banned when they open new sockpuppet accounts. It'll never be completely eliminated. 5) See 4. Two-thirds of PSTN traffic is unsigned. https://transnexus.com/blog/2023/shaken-statistics-july/

Shaken/stir isn’t a panacea however: https://transnexus.com/blog/2022/shaken-statistics-november/

>I really hope AT&T starts censoring these damn spam calls. I've had 5 today. I got one (Verizon) just as I started reading the comments for this post. :( There are solutions[1], but you'll need to wait until next July[0],at least in the US. It's not a complete solution, but it should take care of the vast majority of scam calls. [0] https://www.fcc.gov/call-authentication [1] https://transnexus.com/whitepapers/stir-and-shaken-overview/

This is feasible if first responders and medical offices use SIP/VOIP providers who support SHAKEN/STIR. https://www.zdnet.com/article/at-t-comcast-successfully-test-shakensti… https://transnexus.com/whitepapers/understanding-stir-shaken/

There's already work underway to authenticate the actual source phone number of a caller: https://transnexus.com/whitepapers/stir-and-shaken-overview/ And to make sure the source is set to a value that the caller is allowed to possess. The problem isn't spoofing of numbers--because the utility is quite high for legitimate uses, like PBXes and after-hours doctor return calls for two examples--but the ability to spoof any number, not just numbers a caller is permitted to use.

SHAKEN/STIR is the answer to this and is being worked on. https://www.fcc.gov/call-authentication https://transnexus.com/whitepapers/understanding-stir-shaken/

There's a protocol being worked on called STIR/SHAKEN to address robocalls [0]. It's more like website / browser certificate PKI than spam filtering. Some of the major US telcos are working toward implementation already. [0] https://transnexus.com/whitepapers/understanding-stir-shaken/

Change might be coming. The SHAKEN/STIR framework to authenticate calls is making decent progress: https://transnexus.com/blog/2018/providers-responses-shaken-without-de… Once implemented incoming calls can be handled differently (e.g. UI differences on dialer, dropped to voicemail) based upon the attestation.

More info on SHAKEN/STIR: https://transnexus.com/whitepapers/understanding-stir-shaken/ http://nymag.com/intelligencer/2018/05/how-to-stop-spam-robocalls-with…

I believe international telecom industries are working[1][2] on it. I don't know an ETA. I signed up on their mailing list without knowing what to expect. The content of each email is beyond me but looking at the clout on the email signatures convinced me this was a serious and viable movement. TLDR; this is a technical approach to preventing number spoofing except where authorized. Presumably to be implemented by the international telecom industry. [1] https://transnexus.com/whitepapers/understanding-stir-shaken/ [2] https://datatracker.ietf.org/wg/stir/about/

There's not much you as an individual can do to stop it. I have the same issue with Comcast filling my PO Box with shitloads of junkmail. The phone system is designed to accept anyone calling on it, and there's no authentication mechanisms in place for securing it since it all has to interoperate and is built on dated standards. There are basically two solutions to stopping the problem (instead of treating the symptom). The first is to increase costs to make phone calls (voip made this basically free and it gets abused). This was the old deterrant. The other is to have providers work on an authentication method for their network, they are starting to do this with STIR/SHAKEN: https://transnexus.com/whitepapers/stir-and-shaken-overview/ Legislation won't help unless it is on the providers to require authentication.

There already is a proposed technological solution to this: https://transnexus.com/whitepapers/stir-and-shaken-overview/ The FCC has recently "demanded" US telecoms to implement this [0], but at this point I don't believe there is actually a regulatory requirement to do so. [0] https://docs.fcc.gov/public/attachments/DOC-354933A1.pdf

The eventual fix will be adopting ATIS SHAKEN and STIR protocols, which is, very roughly, signed caller ID. The FCC is now demanding it of carriers: https://docs.fcc.gov/public/attachments/DOC-354933A1.pdf (Background and open letters to carriers: https://www.fcc.gov/document/chairman-pai-demands-industry-adopt-proto… How it works, short version: https://transnexus.com/blog/2017/stop-spoofed-robocalls-with-stir-and-… How it works, long version: http://www.atis.org/01_resources/whitepapers/#shaken-studies (find in page for “SHAKEN” and “Caller ID”)

It looks like Canada is moving in this direction. Here is a PR piece (by a telecom technology vendor) that explains that the Canadian telecom regulator will require non-spoofable caller id by March 2019 [1]. The technology is called STIR and SHAKEN. (That's all I know; I'm no expert). The US FCC doesn't seem to be moving as quickly, if at all. [1] https://transnexus.com/blog/2018/canadian-regulators-mandate-caller-id…

We have a lot of progress under the form of STIR/SHAKEN. Now it doesn't prevent all types of spoofing but it makes the calls traceable back to the originating carrier. What happens is scammers get numbers with small carriers who interconnect with major ones. Eventually the reputable carriers notice spam from these smaller carriers and start dropping their calls (or banning them altogether). So the smaller carriers decide whether they want to see their legitimate traffic dropped or just ban the offending users (which is eventually what ends up happening). Scammers end up hopping to a different carrier so it's a cat-and-mouse game, but it's a lot more expensive to play now than it was with simple number spoofing. In parallel, numbers are starting to get reputations attached to them, similar to IP addresses. Some filtering takes advantage of that. Of course, spearfishing can continue unimpeded with someone buying a prepaid cell phone and using that to call a specific target. :( https://transnexus.com/whitepapers/understanding-stir-shaken/

I hope this addresses the abuse. See [1] It basically asks the telecom operators to implement digitally signed certificates. So it would work, if I understand it conceptually, like your web browser, when it receives https traffic unsigned certificate, or https traffic from a domain that's not part of the certificate chain. Therefore, this mandate will prevent 'spoofing'. And without spoofing, the spammers would necessarely have to reveal their identity, and there are already bunch of existing legislation to prevent them from doing this type of business. I missed important business calls when in US. Because they were calling using same area code where my sim card was registered, so I thought it was from the area local to me. It is horrible, I am sure people actually lost not just business value, but also had negative health impacting incidents, due to this abuse of telecommunications. [1] https://transnexus.com/whitepapers/understanding-stir-shaken/