Canadian regulator changes SHAKEN qualifications

The CRTC (Canadian Radio-television and Telecommunications Commission) issued a highly awaited decision on qualifications for Telephone Service Providers (TSPs) to participate in SHAKEN. Here’s an overview of the decision and how it impacts providers.

Previous rules

Prior to this decision, the CST-GA (Canadian Secure Token Governance Authority) had established criteria for TSPs to obtain SHAKEN certificates. Only TSPs with access to Canadian numbering resources were eligible.

In December 2020, Mitel Networks Corporation filed a Part 1 Application with the CRTC about this (link opens a zip file). In their application, Mitel asked the Commission to instruct the CST-GA to allow all TSPs to be eligible to receive SHAKEN certificates.

Mitel is a TSP, but they do not have direct access to numbering resources. Under the previous rules, they were ineligible to do SHAKEN call authentication. Mitel maintained that allowing all TSPs to participate would be in the public interest.

Delegate certificates

Here’s where the story takes an interesting turn.

In February 2021, the CISC (CRTC Industry Steering Committee) Network Working Group issued a status report, Framework for STIR/SHAKEN in Canada. The 34-page report covered many topics, including a discussion of “excluded TSPs.” The report identified two potential remedies:

1. Grant all TSPs the right to sign their own calls, i.e., the Mitel request.
2. Have excluded TSPs use delegate certificates issued by TNSPs (Telephone Number Service Providers).

The delegate certificate option was mentioned because it followed a section of the report that discussed ways that enterprises could seek get full attestation.

Those in favor, those opposed

Several interested parties filed comments to support or oppose Mitel’s application.

Those in favor included Microsoft, ISCC, TekSavvy, TCI. Microsoft argued that the current policy violates the principle of competitive neutrality. ISCC agreed, noting that the current policy would motivate customers to move their service to providers that could provide full attestation. TekSavvy argued that the delegate certificate solution is insufficient to address the concerns of resellers.

Those opposed included Shaw, Bell Canada, RCCI. They were concerned over the risk of abuse by ineligible TSPs. They also argued that SHAKEN is just launching this year, so time should be allowed for it to roll out.

SaskTel was supportive of the idea but suggested that the application should be delayed until other outstanding issues were resolved.

Distributel did take a side but asked the Commission to issue a decision quickly.

Mitel responded to those opposed with an observation that any TSP abusing SHAKEN could have its certificate revoked. They argued that it’s inappropriate to judge the reliability of a TSP based upon type of service it provides.

Commission decision CRTC 2021-267

The CRTC approved Mitel’s request. In CRTC 2021-267, the Commission ruled that excluding TSPs that do not have access to numbering resources is neither necessary nor appropriate.

The Commission directed the CST-GA to develop eligibility requirements, in collaboration with non-eligible TSPs, that prevent access to STI certificates only for TSPs that cannot be trusted.

Next steps

We find the timing for this process interesting. The CST-GA has to issue revised eligibility requirements by 60 days from 5 August 2021, which is 4 October 2021. This is just 57 days before the SHAKEN implementation deadline of 30 November 2021. Newly eligible TSPs are probably wondering if this leaves them enough time.

CRTC 2021-123 requires TSPs to file a SHAKEN implementation readiness assessment report with the Commission no later than 31 August 2021. Newly eligible TSPs are probably wondering how they should answer the questions to be addressed in this report.

TransNexus solutions

We offer STIR/SHAKEN solutions in our ClearIP and NexOSS software platforms. We can make your STIR/SHAKEN deployment a quick and easy process.

Contact us today to learn more.