FCC Chairman Warns of 'Regulatory Intervention' as He Criticizes Carriers' Anti-Robocall Plans (thehill.com) 147
The Federal Communications Commission will consider "regulatory intervention" if the major telecommunications carriers don't set up a system this year to stop spoofed robocalls, FCC chairman Ajit Pai said Wednesday. "It's time for carriers to implement robust caller ID authentication," Pai said in a statement, noting that some companies have already committed to carrying out protocols, known as the SHAKEN/STIR framework, in 2019. A report adds: Pai sent letters to major wireless carriers in November demanding that they adopt industry-wide frameworks to crackdown on the practice of "spoofing," where robocallers mask a call's origin with a fraudulent number on their caller ID. On Wednesday, the FCC chair followed up with another demand that they implement caller authentication systems this year and a threat over the repercussions if they don't comply. You can read responses from carriers FCC's website.
Re: (Score:1)
Weak ass midterms and hilarious party infighting is a curious idea of ascension. Then again, I suppose crawling into the shit-filled toilet from the sewer is technically ascending.
Re: (Score:3)
I turned on my American telephone for my upcoming US trip next week. Since I've turned it on, I've signed up for the "Do not call registry" which I'm quite sure does nothing. I've been receiving on average 3-5 phone calls a day from Kissimmee Florida to inform me that my medicare will not cover a hip some surgery if I wait any longer. Every call claims quite forcefully that "This is your last warning" of which I keep hoping it is true... it's not. If I press 2, it should add me to th
Re: (Score:2)
And as I state
Re: (Score:2)
The issue is that a ton of companies have moved to VOIP, and/or have a lot of internal numbers but want calls to appear to becoming from the official, published business number so they look legitimate. It's going to be harder to google one of a thousand numbers to see if they are legitimate than one main business line.
Legitimate companies do have some fairly solid reasons to spoof their numbers.The big problem is that instead of putting any sorts of controls on this, the telecos took the cheap, easy way out
Re: Uh-oh (Score:4, Insightful)
Spoofing isn't the problem. Unauthenticated spoofing is the problem. The CID needs to be taken out of the hands of the businesses, and put in to the hands of the telecoms. They can then work with the companies to present the appropriate CID. It would be no problem for a company to register their main number, and say "calls from all these other numbers should appear to come from this one, here's proof we own this one" It's that proof part that we're skipping.
It always surprises me how quickly idealistic engineers design systems that fail to include ANY security/authentication system, and expect that humans will play nice. We know that simply doesn't work, it's been proven repeatedly for pretty much as long as humans have existed. It's not hard to authenticate ownership of the main number, phone it! There's no reason why the end user needs to be able to spoof any number they please without proving first that they own that number.
Re: (Score:2)
>But for some reason they refuse to do so leaving us subject to this never ending flow of spam phone calls.
Ask yourself one question: aside from the scammers themselves, who profits from the phone-scam industry?
Re: (Score:3)
Well...there's also the question of exactly WHAT will get implemented. Just because we're told that a regulation will do something we desire doesn't mean it won't do a lot of things we don't desire, even if it actually does do what we desire. I don't know the SHAKEN/STIR framework, and I certainly haven't analyzed how it works, or in what ways it could be manipulated.
Re: Uh-oh (Score:5, Funny)
The SHAKEN/STIR framework involves sharing Vodka Martinis with the CEOs of various telecoms.
Re:Uh-oh (Score:4, Insightful)
It annoys the wealthy, so of course he's moving to eliminate it. There's no dissonance.
Re: (Score:2)
Same reason Bernie Madoff went to jail - he stole from the rich. If he had just done what Wells Fargo or Steve Mnuchin did and stole from working stiffs, he'd probably have a job at the White House - under either a Dem or GOP administration.
Re:Uh-oh (Score:4, Funny)
Re: (Score:2)
I would bet some hard cash that they use either a whitelist or some program that enables a whitelist because they would be bombarded by sheer quantity otherwise.
Re: (Score:2)
Wait, are you trying to insinuate that the "wealthy" have their own national phone system completely separate from the rest of us? Staggering. "Hey Bob, new rich guy, yup just hit the 15 million mark. We gotta install all that extra cabling to his house, and plumbing too. Crap! We also have to reprogram another group of servants to never ever ever ever ever ever EVER say a word about any of this. Oh jeez, we also have to train that schmuck on proper Rich Person Telephone Network use. I wonder if anyone let the Rich Person IT department know yet."
I get the joke... But some of it is closer to reality than you think.
Rich people do have separate communications networks, maybe not based in wires, in fact a lot of it is person based to ensure that not any idiot can accidentally call the Queen of England (I believe Prince Charles has an exception). Often rich or important people will not have a direct line that doesn't go through at least one form of filter, usually this is a person who redirects or dumps your call but now we've got heuristic programs
Re: (Score:2)
Re: (Score:2)
That sounds suspiciously like a secretary.
Closer to a PA (Personal Assistant) and that is pretty much it and how it's been done for decades. Rich people would hire people to take their calls, answer the door, et al 24/7. We also call them valets (calling them a butler is incorrect, butlers manage the household staff, a valet sees to his lordship's person).
My experience is in working in state government (in Australia). It's very, very hard to get through to a senator if you're not on his whitelist. Any unidentified number will be dropped or ignor
Re: (Score:1, Offtopic)
Uh-oh. What will Slashdot do now? Pai made a statement that the hive mind agrees with. The cognitive dissonance will be terrible.
Meh, The Republican plan will be for consumers to pay 50 dollars extra to get rid of Robocalls, Trump will refuse to enact it unless we get a Canadian Wall, and arrest Hellery.
Re: (Score:1)
We need a Canadian wall! Made of ice and 100 yards tall! It's the only way to keep the White Walkers out,
Re: (Score:1)
Re: (Score:1)
You do get that the 0.01% are the ones that benefit from globalism, right? The more workers, the less they get paid. All that "race to the bottom" happening in other countries only helps the 0.01% here to the extent they can ship the work there. For maximum profit, we need the race to the bottom happening here.
Re: (Score:2)
Re: (Score:2)
Deserves a Funny mod, but I never get any to give.
Re: (Score:2)
We need a Canadian wall! Made of ice and 100 yards tall! It's the only way to keep the White Walkers out,
Could we make it of Molson?
Re: (Score:2)
Ah, you're thinking of putting the wall on the Canadian side to keep the US out. Fair enough.
Re: (Score:2)
Ah, you're thinking of putting the wall on the Canadian side to keep the US out. Fair enough.
I knew as soon as I posted it that Molson was a lame choice. If I drink Canadian beer, It's Maudite - even if it comes from Quebec.
How about a wall of Resin IPA from Sixpoint? If you haven't tried that (and like IPA) I highly recommend it: https://sixpoint.com/beers/res... [sixpoint.com]
Re: (Score:2)
maudite taste like shit try a pit caribou
Fortunately, I have no idea what shit tastes like, and have no intention of learning.
Maudite is a malt heavy, high gravity beer, and a decent example of the genre. I'd be surprised if it actually tastes like feces, but will defer to your experience.
Re: (Score:2)
We need a Canadian wall! Made of ice and 100 yards tall! It's the only way to keep the White Walkers out,
As a proud Canadian I support the building of a Canadian wall to keep the orange one out of my country.
Re: (Score:3, Funny)
Re: (Score:2)
You forgot pay off your student loans, get a lower interest rate, or extend your cars warranty.
We've been trying to reach you about your cars extended warranty... Yes, can you extend the warranty on my 1969 Chevelle? (it's going to need an entirely new power train soon it's only got like 200k miles on it)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
How would the inability to spoof your caller-id information prevent you from communicating with anyone who wanted to hear from you?
Granted, there may be implementation details that could be easily abused for other purposes - can't say I've even glanced at any of the recommended solutions.
Re: (Score:1)
Resistance was futile. He has been assimilated.
Re:Uh-oh (Score:5, Insightful)
Personally, I'm opposed to the idea that anybody's purely evil. I think people are driven by motivations we just don't understand or don't agree with.
From that perspective, I'll wildly speculate with no evidence or context! That's what Slashdotters do best!
By threatening regulation instead of actually proposing regulation, Pai has actually opened the door for carriers to avoid compliance. They can present timelines pulled from dark and smelly orifices, promising that they'll be compliant sometime in 2083, and Pai can then turn around and issue statements that the FCC is now working "for the people" and "working with carriers to ensure timelines are met". Any further push by the public to accelerate the standards' implementation will just be called political posturing, led by the Deep State to undermine the FCC's authority.
Meanwhile, the big carriers will demand subsidies to implement this new standard, and in the name of system-wide compatibility, they will insist the government adopt (and mandate) another new standard, conveniently authored by several industry insiders, and which relies on a software patent with exorbitant licensing fees, just-so-unfortunately out of reach for a startup carrier's budget.
To be clear, this post is intended to be modded "Funny". Please do not let it be "Insightful". For the sake of all Americans, I hope to be completely wrong.
Re:Uh-oh (Score:5, Funny)
Re: (Score:2, Flamebait)
...
...Jackass.
Re: (Score:1)
That is a really insightfull view of the situation. I think we need to closely consider this.
Re: (Score:1)
When did that "Comments Filter" with tabs appear? (Score:2)
A few minutes ago I noticed the "Comments Filter" below the post button. It has tabs for the primary dimensions of moderation, so (for example) clicking on the "Funny" tab immediately shows the current 2 funny comments on this story.
Is this a new feature? Or have I been blind, and if so, for how long? Now I don't have to waste time with the text searches on "funny"? Fewer annoying false positives (as distinct from actually bad moderation)?
By the way, the "Funny" comment to which this reply is attached is no
Re: (Score:2)
Uh-oh. What will Slashdot do now?
Naively wait and hope - for Ajit Pai to push as hard for this as he did to bring down Net Neutrality.
Re: (Score:2)
The summary states that some companies are already in compliance, and he's threatening the others with regulation. That tells me that it should be easy enough to see which companies are paying him. It's the ones who are already in compliance and just want to make sure their competitors are hit with more cost.
"Who are you...?" (Score:2)
..."And what have you done with Chairman Pai?"
Re: (Score:2)
He's just learning how to better play the game. He can issue regulations. But did he? No. He said he might at some point in the distant future if telecos don't say that they're working on something that they'll implement sometime after that distant future.
"Tell me you're going to do something, and all is well." is vastly different than, "You are hereby ordered to do this, on this timeline, with this punishment if you don't comply. No extensions."
I can see why it's taking so long, though (Score:3)
After all, they had to devote significant time into coming up with that acronym.
Finally Ajit Pai does something for consumers (Score:4, Informative)
Re: (Score:2)
I only answer calls from numbers I know now, or if I'm expecting a call from that organization. Disabled voicemail completely. SMS doesn't generate a notification any more.
Ajit Pai just has not sold out yet. (Score:2)
Robocallers FAILED to purchase Pai and now they will pay the price.
Don't expect a fully working solution because that likely would upset Pai's owners.
It says something is wrong when officials replace citizen with consumer and it DOES impact thinking to do so. I am NOT a consumer, I am a citizen, a human and not merely a cog in your machine.
Don't answer (Score:1)
It's gotten so bad that I no longer answer calls from unknown and random numbers anymore. If they want to talk, leave me a voicemail.
Re: (Score:1)
Why is number spoofing even possible? (Score:1)
Re: (Score:3)
Re: (Score:2)
Why do idealistic engineers always fail to account for human nature?
The security aspects of this are not technically difficult in the slightest, and yet instead the system was designed to trust everyone. Imagine designing a large corporate network that way: "I get root, you get root, he gets root, everybody gets root!", and that's also a place where bad actors are easily detected and "disconnected", yet no company would ever allow their admin to do that. Any system that gives full authority to every user WI
Re:Why is number spoofing even possible? (Score:5, Informative)
Mostly because businesses now run a VOIP system that translates a bunch of machines into a business account and they need to be able to set their public caller ID as their main business number that can direct your call to who you need and not some random VOIP address of X person trying to call you which might not even be a valid number at all, or just a number of that specific caller in Y department.
The issue has been already solved but in a different format: domain registrars for web addresses with SSL certificates, so a system like that but for phone numbers would be a good start perhaps?
Re:Why is number spoofing even possible? (Score:4, Interesting)
Re: (Score:1)
Your provider is taking steps on their own to ensure that their customers are following the rules. Imagine if you are a carrier who often works with multi-state corporations who have a huge number of phone numbers allocated to a global system, this might get unruly pretty quickly, and it would be much easier if you just accepted anything they sent you.
Now imagine that you are an enormous phone company (ILEC) that sells service to many, many smaller phone companies (CLECs), and with number porting, the phone
Re: (Score:2)
It's expensive for the ILECs to keep track of a master list.
How much does it cost to have a database with a few million rows these days?
Re: (Score:1)
The database is the cheap part. The Expensive Part is maintaining the records in the database, dealing with conflicts, educating staff on this new system they must now use, ensuring they are not violating any laws with the implementation of the system, etc.
WHAT WE NEED (Score:2)
Re: (Score:2)
At 7:20 this morning I was awakened by a stupid call with the Microsoft services scam . ... Following that i received four more calls trying to send me Medicaid braces before noon.
And you think a law banning all sales calls would stop that? You think it was a sales call, and that it was made from someone in the US subject to US law?
Wow. No wonder you get so many scam callers. You must be the most naive person on the planet. You're a prime target.
Good start, but far from effective (Score:2)
Trying to force accurate caller ID is a good START, if it ever happens. However, it will not STOP the calls from occurring. It might help us DEAL with the calls. It might help report calls (if there was a way to do so). But as long as there is no enforcement and no tools for consumers and no criminal penalties, the calls will just keep right on coming. I don't know about you, but having an accurate ID on my home phone does nothing to prevent such calls from: Irritating me. Interrupting me. Waking me
Bummer (Score:2)
The calls which spoof your exchange were easy to spot. Now it will just go back to being numbers I don't recognize from other area codes. Seems criminal that Android doesn't have a standard option to use whitelisting for phone calls and disable alerts for voice mail left by numbers not on the list.
Idea for robust caller ID (Score:4, Informative)
First of all, it is important to realize that there can, in fact, be legitimate reasons to spoof a phone number... for example, calling from a direct dial out line for a business, but wanting the main business head office number to show up on the caller ID instead, which might even be located in a different country or state.
So given that, much of the problem becomes how to enable spoofing where it is legitimate, but to not present a spoofed number as the caller when it is not.
A carrier, when receiving a call that is on its own exchange always knows the exact number that is being called from (we will call that phone number A), the number that is being called (we will call that phone number B), and also knows what number the caller is wanting to spoof as (if any, which we will call phone number C). Whether the caller is trying to spoof or not, the carrier for A adds a temporary entry int a local cache that tracks outgoing calls, indicating that it is making a call from A to B. This entry is kept alive only for a minute or two at most before being deleted.
If the caller does not want to spoof, then assume that C = A, and the remainder of this paragraph can be ignored. If the caller wants to spoof, then the following additional steps must be performed. The carrier for A tries to tell the carrier for C that it wants to use that carrier to spoof to spoof, making a call to #B. This request might pass through a number of other carrriers, so let us assume that the carrier for C sees the number that is calling it as X, since it is possible that the carrier for A, or any intermediate carrier might be conspiring to spoof. If the carrier for C allows the number X to be spoofed with C, then the carrier for C will then ask the carrier for X if it is presently making a call from X to B. If it does, then it adds an entry in its own cache that it is making a call from C to B. If the carrier for C does not recognize X as a number it can spoof for, then the request is ignored entirely, and the carrier for C will not do anything. Please note, that if X has been illegitimately spoofed, but X is still legitimately recognized by C as being a number it can spoof for, then the carrier for X as reached by C will not issue any response, so C doesn't have any obligation to add an entry to its table in that case.
Whether or not the caller from A is trying to spoof, the carrier for A concurrently rings the carrier for B. The carrier for B, seeing the number C as being the number claimed to be called from, asks the carrier for C (as seen from B) if it is currently making a call to B. If the answer is yes, then the number shown in call display can be assumed to be valid. If C does not respond, then no number should show up.
This whole verification process should take a few seconds at most, and can happen concurrently with the ringing of the line. A person who answers quickly might not get a verified caller ID until after they have already picked up the phone.
The cached entries, as I said, are temporary, and are individually deleted after being present for a short time (one or two minutes would likely be enough time to be sure that the call is really valid).
This is just something I came up with when I had some spare time and thought about it while I was taking the bus to work one day.... there might still be vulnerabilities, but I wasn't able to find them..
Re: (Score:2)
Re: (Score:3)
Much simpler (but it will require the telcos to do some WORK) is just require legitimate businesses that want to spoof their legitimate head office number to register the spoofed numbers with the telco. The telco can then certify that the spoofed numbers are legitimate. Telcos could even charge money for this service.
Re: (Score:2)
You need some kind of reverse lookup to verify that the call is really coming from where it appears to be, otherwise it can be too easy to spoof.
Re: (Score:2)
The local exchange knows the real number originating the call. If that caller wants to spoof a different number, they need to register with the local exchange. If there is no registered spoof number, then no spoofing.
Re: (Score:2)
Re: (Score:2)
It gets a lot more complicated when your business works with SIP trunks. Adding/deleting/modifying DIDs can be done pretty much in real time. Traffic also might not be routed to the expected endpoint, although it is still valid.
Re: (Score:2)
First of all, it is important to realize that there can, in fact, be legitimate reasons to spoof a phone number... for example, calling from a direct dial out line for a business, but wanting the main business head office number to show up on the caller ID instead, which might even be located in a different country or state.
Already sorted in two ways in the UK.
1. We did away with regional number codes years ago, 0141 does not mean the originator is in Glasgow any more. Modern packet switched networks have made this redundant. By modern I mean the one's we've had installed for over 25 years.
2. Businesses do not buy a direct line for every single employee. They install what are called PABX (Private Automatic Branch Exchanges) which means you only need to plug 1 line in (but often will have more). So the person dialling out
Re: (Score:2)
which means you only need to plug 1 line in (but often will have more). So the person dialling out from that company can easily ID as the company's main number without spoofing.
As soon as you "plug" a second line into a PBX you have a reason and a need to "spoof". Having a PBX makes it more important to be able to spoof, not less.
There is no legitimate case for caller ID spoofing that cannot be solved though another method.
Most blanket absolute statements are false.
Re: (Score:2)
Sarcasm noted.
However, yes... it is fully sensible. There is nothing wrong with a company wanting its 1-800 number to show up instead of some direct-dial line. And if the caller's direct dial-out line might not even be in the same city as the recipient, how would presenting that number be a win for the receiver? The idea of routing
Re: (Score:2)
I will agree that ideally we want to a K.I.S.S. approach, but in actuality the solution I suggested has only one extra level of complexity over even a straight reverse lookup approach. This complexity is only required because there are lawful and legitimate uses for spoofing, as I mentioned previously, and that the admittedly much more straightforward approach of just routing through the spoofed exchange would place an additional burden on that exchange because it must manage that connection for the durat
Re: (Score:2)
Except you can't route the caller ID any differently than the phone call itself... that would require a complete overhaul of every exchange, not just those at endpoints, and would provide no useful incremental upgrade path. Until at least a majority of exchanges supported it, it would generally be completely useless. You could, as I thought you were suggesting, route the entire ca
Re: (Score:2)
You misunderstand.... I am suggesting that a caller who spoofs his number and doesn't expect you to be able to potentially call that number back *should* be treated as an unverified caller, exactly as if they had sent no caller ID inf
Re: (Score:2)
Well, first of all, the endpoint would recognize it as a number that actually belongs to that exchange.
Secondly, when the caller places an outgoing call from an updated exchange, that caller's endpoint adds an entry into its temporary cache that it is making
Re: (Score:2)
No, actually, you didn't... it seemed to me that you suggested that what I was describing wouldn't work just because the exchange that the number is actually coming from had spoofed the #, so you can't rely on its validity, but in general, that won't actually work because when the reverse lookup is done on the number, it would end up at a *different* exchange than the caller.
Conspiring with another exchange to permit number spoofing would still necessitate that the spammer have complete control over how
Move To Australia (Score:2)
We implemented a Do Not Call register backed by legislative penalties ages ago and I've never had a robocall on my mobile (cell). .. and there are other benefits...
Universal Healthcare
Never seen a gun in public in 50 years unless it was on a policeman or security guard
Metric!
Proper coffee.
Kangaroos!
Drop Bears...
Rugby... not that costume game you play..
No Ajit Pai
you do have cool rockets though... we don't have rockets...
Re: (Score:2)
Re: (Score:2)
The locals won't even drink that poison... I think we ship it all to the USA
Doesn't bother me (Score:4, Insightful)
Re: (Score:3)
You've minimized the inconvenience in your case, which is great. With a better system, however, you'd never have had to put in any effort to setting your system up - or be distracted again by future spoofed calls. THAT'S how it should be.
Re: (Score:1)
Problem with this method is, putting them in your spam blocker is bad for you, not them. They use a random number every time. Since they don't use the same number again anyway, you've just blocked a potential legitimate caller in the future, and not them. Spammer's next call will be from a different number.
Your Problem is not solved. You've created another one for yourself in the future when you meet a new friend, or try to do business with someone else, and they are blocked and you don't even know it
Will it work as poorly as Do Not Call registry? (Score:1)
Unfortunately whatever they implement will be about as effective as the Do Not Call Registry was.... not at all. The scammers always find a way around rules and they count fines as the price of doing business.
Finally something Pai and I agree on. (Score:2)