International SHAKEN — how that might work

Initially, STIR/SHAKEN will be rolled out country-by-country. Ever wonder how these separate deployments might be joined together? Here’s a quick overview of a roadmap for that.

Technical report road maps

ATIS has two technical reports on developing a structure for international SHAKEN:

1. ATIS-1000087, an Initial Cross-Border Mechanism that enables countries with similar interests and regulatory environments to federate their SHAKEN infrastructure and extend the trust environment to include both countries. Two countries federate by combining their lists of trusted Certification Authorities (STI-CAs).
2. ATIS-1000091, a Mechanism for International SHAKEN that provides a more general approach than the initial cross-border approach. With the general approach:
   • There would be an international SHAKEN registry based upon an IETF draft specification that would map E.164 country codes to STIR trust anchors. The interface to the international SHAKEN registry would be as specified in ATIS-1000087, 4.3.1.
   • Each country’s Policy Administrator would use a CVT (Call Validation Treatment) application to establish calling number reputations for countries. The PAs would use this to decide which countries in the international SHAKEN registry to trust.
   • Trusted countries could then share their trusted CA lists, as described in ATIS 1000087.

Neither of the ATIS technical reports require any changes to the existing SHAKEN specifications, but they do identify new interfaces and functions to exchange information between countries.

STIR/SHAKEN development by country

We don’t have official word from every country that’s studying STIR/SHAKEN. We know some not listed here are mulling it over. Here’s a quick overview from a representative sampling of countries that have published official statements about call authentication and robocall prevention.

United States

The TRACED Act was enacted on December 30, 2019, to instruct the Federal Communications Commission to issue orders for the implementation of STIR/SHAKEN by June 30, 2021.

The TRACED Act authorized the Commission to provide deadline extensions if warranted, but voice service providers using an extension would be required to use an appropriate robocall mitigation program on calls that it originates without STIR/SHAKEN call authentication. Note that some providers will use STIR/SHAKEN on some calls but robocall mitigation on others.

The FCC issued a first report and order on March 31, 2020, which mandated STIR/SHAKEN by June 30, 2021.

The Commission followed with a second report and order on September 29, 2020, which allowed deadline extensions in certain situations and provided further details about the requirements.

By June 30, 2021, all voice service providers must be using either STIR/SHAKEN or robocall mitigation on every call it originates and must file a certification with the FCC explaining how it uses either STIR/SHAKEN or robocall mitigation on every call it originates.

By September 28, 2021, every intermediate or terminating provider must check that each upstream provider from which it accepts calls has a certification on file. It must refuse calls from any upstream provider that does not have a certification on file.

Canada

CRTC is the Canadian communications regulator. It issued compliance and enforce and telecom decision CRTC 2018-32 on 25 January 2018, which requires Canadian voice service providers to deploy STIR/SHAKEN.

The due date was pushed back on 9 December 2019 and again on 15 September 2020. The current deadline is 30 June 2021.

United Kingdom

Ofcom is the UK communications regulator. They use the acronym CLI to describe Calling Line Identification. They have mentioned CLI authentication in their publication Promoting trust in telephone numbers, in which they explored the prospects for using STIR/SHAKEN in the UK.

The good news: the UK is on a path toward copper retirement. They plan to migrate the telephone network to VoIP and retire the PSTN by 1 January 2025. This would make STIR/SHAKEN easier to implement.

The bad news: the UK doesn’t have a national number database of assigned telephone numbers to indicate which numbers have been assigned and whether they’ve been ported to another provider.

Ofcom relied on a report from the NICC, a technical forum for the UK communications sector, Report into implementation of Secure Telephone Identity Revisited (STIR) in the UK, which stated that, without an IP network and a central database of numbers, STIR wouldn’t be much help.

It is possible to launch STIR without a numbering database, but this would only provide a pointer back to the network that originated a call, rather than whether they had any rights to use the associated CLI. Given the large volume of communications providers in the UK, this would be of limited value.

Given these circumstances, Ofcom has made plans to begin development of a numbering database, which would go live in 2022.

CLI authentication could then begin in 2022, with the expectation that it would grow over time until PSTN switch-off is complete around 2025.

France

ARCEP is the French communications regulator. They adopted a decision in 2019 to amend the French national number plan as follows:

1. Relax the geographical restrictions attached to telephone number prefixes to enable portability
2. Allow the introduction of an authentication mechanism to enable operators—if they so desire—to introduce authentication solutions.

ARCEP adopted a spam robocall preventive measure in 1 August 2019 that forbids the use of a geographical number (starting with 01 to 05) or a multi-purpose number (09) as the caller ID for international calls or messages when no authentication mechanism is in place.

The regulator also proposed a measure to forbid automated systems that make more calls and transmit more messages than they receive from using geographical numbers (starting with 01 to 05), mobile numbers (06-07) or multi-purpose numbers (09) as their caller ID.

Market players responded with concerns that the filtering solutions are not yet mature enough to handle this second requirement. They were concerned about blocking false positives.

ARCEP responded to these concerns by making this second measure take effect on 1 August 2019 only for mobile numbers (06-07). They postponed the second requirement for geographical numbers (01-05) and multi-purpose numbers (09) until 1 January 2021.

TransNexus solutions

We offer STIR/SHAKEN and robocall mitigation solutions in our ClearIP and NexOSS software platforms. Contact us today to learn more about these solutions.