Comments on STIR/SHAKEN efficacy

The FCC requested comments on the efficacy of the STIR/SHAKEN call authentication as implemented and used in the United States. They will use the record to develop a report to Congress. This article summarizes the comments and recurring themes.

Recurring themes

Here are a few of the recurring themes we noticed in these comments:

Comments

There were 108 pages of comments from 13 filers. We’ve summarized these comments below. If you’d like to see more information, you can click the filer’s name above each summary to read that organization’s filing.

Aaron Woolfson, D.Kelly Daniels, E-TAG Working Group

• The FCC should require all voice service providers to use SIP transport.
• The originating provider may optionally place a token in a blockchain.
• Text messages should be required to use STIR/SHAKEN.
• There were three sets of comments from this group: first; second; third

ACA International and Associations

• The Commission should set a firm deadline for the IP transition.
• Enforcement against improper attestations must be enhanced, including penalties and stricter entry requirements for the Robocall Mitigation Database.
• Clearer guidance on Know Your Customer (KYC) standards is needed.
• Expand efforts to use branded calling and Rich Call Data.
• The Commission should eliminate exemptions related to token access and non-IP networks.
  • The Associations support the proposed alternative frameworks for non-IP call authentication.
• Strengthen the STI Governance Authority by increasing transparency, preventing token misuse, and adding board seats for enterprise callers and consumer protection organizations.
• The Commission should prohibit routing calls through TDM to strip out STIR/SHAKEN information.
• The following organizations participated in this filing: ACA International, ACA International, America’s Credit Unions, American Bankers Association, American Financial Services Association, Bank Policy Institute, Defense Credit Union Council, Independent Community Bankers of America, Mortgage Bankers Association, National Council of Higher Education Resources, Student Loan Servicing Alliance, and National Consumer Law Center on behalf of its low-income clients.

CTIA

• Branded Calling ID^™ (BCID) builds upon STIR/SHAKEN to provide the verified digital identity of the caller, typically an enterprise. This helps the called party decide whether to take the call.
• T-Mobile and Verizon have integrated BCID into their networks.
• CTIA urges the Commission to enforce the use of the ATIS STIR/SHAKEN standards.

INCOMPAS, Cloud Communications Alliance

• STIR/SHAKEN efficacy is undermined by the lack of IP interconnection across the service provider voice network.
• This has competitive consequences. The largest carriers can convey SHAKEN information, while smaller providers are unable to provide similar protection for their customers.
• The Commission should adopt a national IP interconnection policy that establishes a deadline IP transition.
• Industry is moving forward with Rich Call Data, an extension of STIR/SHAKEN, to provide a verified caller name, branding information, and the purpose of the call.
• Proprietary solutions threaten to reduce uptake and splinter the mechanisms. STIR/SHAKEN is a non-proprietary framework and is already widely adopted. Rich Call Data would further the goals of the TRACED Act.
• INCOMPAS and CCA urge the Commission to require Rich Call Data support through STIR/SHAKEN.

Lisa Bruce

• The increase in robocalls with no caller ID has been tremendous. It’s annoying and concerning. People are inundated with calls and taken advantage of.

NTCA-The Rural Broadband Association

• The “non-IP gap” undermines end-to-end successful transmission of STIR/SHAKEN call authentication information.
• The Commission should adopt clear and reasonable “rules of the road” for IP interconnection.

Numeracle, Inc.

• STIR/SHAKEN is fundamentally sound, but implementation gaps prevent it from becoming effective.
• The trust ecosystem, of which STIR/SHAKEN is a part, is missing other elements, such as Know-Your-Customer standards, standardized display capabilities, Rich Call Data display solutions, and analytics engines that frequently do not use STIR/SHAKEN data.
• CNAM is insecure, unauthenticated, unverified, and easily spoofed. It should be ended.
• The Commission should do the following:
  • Require universal participation in STIR/SHAKEN.
  • Sunset TDM and enable out-of-band STIR/SHAKEN solutions as a band-aid until all networks are IP.
  • Standardize display practices.
  • Sunset CNAM and transition to authenticated, verifiable identity display.

Satellite Industry Association

• The factors behind the indefinite extension for small providers that originate calls via satellite have not changed. A further extension is warranted.

T-Mobile USA, Inc.

• The Commission can take targeted action to enhance STIR/SHAKEN effectiveness.
• Forwarded calls should be sent with a diversion PASSporT to supplement the original SHAKEN signature.
• T-Mobile has observed spoofed calls with A-level attestation. Providers should use B- and C-level attestation when appropriate.
• The Commission should do the following:
  • Closely review the Robocall Mitigation Database and enforce compliance
  • Enforce third-party authentication rules
  • Continue to direct or permit call blocking providers that transmit illegal calls or fail to cooperate with traceback
  • Incentivize or require IP transition.

TransNexus

• Non-IP networks in the call path impair STIR/SHAKEN efficacy.
• While the number of SHAKEN-authorized providers continues to grow, the percentage of authenticated calls received at termination is dropping.
  • We believe that this reflects an increasing trend in routing calls over non-IP segments in the call path.
  • This tactic enables some authentication providers to “launder” their identity from their calls and evade accountability.
• The Commission should mandate providers that route calls over non-IP segments to either transition to IP networks or implement and use an effective non-IP call authentication mechanism from the STIR/SHAKEN framework.
• Branded Calling ID^™ (BCID) is having a positive impact on STIR/SHAKEN.
  • It leverages the Rich Call Data capabilities in STIR/SHAKEN.
  • It uses independent third-party vetting of the caller ID, call reason, and RCD information that is inserted into branded calls signaling.

USTelecom - The Broadband Association

• The Commission should address the growing problem of improper A-level attestation.
• Consistent attestation practices, improved Know-Your-Customer and Know-Your-Business procedures, and strengthened enforcement will ensure that STIR/SHAKEN continues to be effective.

Voice on the Net Coalition

• Traceback could be streamlined by starting with the provider that authenticated the call.
• The Commission must address the caller ID authentication gap from non-IP networks.
• The Commission should require all voice service providers to transition to IP by December 31, 2028, or two years after the effective date of such rules, whichever is later.

ZipDX LLC

• Authentication provider (signer) analytics can be used to gauge the likelihood that the call recipient will want the call. This is a powerful tool.
• Terminating providers should use such analytics to assess the signer’s reputation. This would deliver STIR/SHAKEN value to their customers.

TransNexus is a leader in developing innovative software to manage and protect telecommunications networks worldwide. The company has over 25 years of experience in providing telecom software solutions including toll fraud prevention, robocall mitigation and prevention, CDR and call analytics, advanced call routing, billing support, STIR/SHAKEN, and branded calling.

Contact us today to learn more.