Stemming Robocalls Worldwide: Best Practices for Leveraging STIR and/or SHAKEN
Robocalls and call spoofing are a growing, global problem. In the U.S. alone, illegitimate calls are wreaking havoc and costing approximately $10B+ in fraud each year according to the Federal Communications Commission (FCC). As the U.S. takes the lead in stemming this surge with the STIR/SHAKEN call authentication framework, other nations are taking steps to determine whether STIR and/or SHAKEN are viable call authentication tools for their unique needs. To make that determination, regulatory agencies in numerous countries are eager to learn best practices and lessons learned from the U.S., where efforts to end robocalls and call spoofing are well underway.
The question of call authentication around international calls also impacts U.S. carriers. Billions of legitimate international calls coming into the U.S. are at risk of being mislabeled as spam or blocked because the originating network cannot be authenticated.
In addition, the use of analytics and STIR/SHAKEN by the largest U.S. carriers has resulted in scammers shifting their tactics to send robocalls calls via service providers who haven’t yet put mitigation efforts in place. Small, unsuspecting providers around the world are their target. And international calls to those small to mid-sized carriers seem to be the biggest problem.
Although the FCC mandated that Communication Service Providers (CSPs) implement STIR/SHAKEN and/or robocall mitigation by this past June, and certify in the Robocall Mitigation Database (RMDB) what actions they’ve taken, there’s another deadline looming.
Starting September 28, Intermediate and Terminating Service Providers (TSPs) must reject traffic from those providers that have not registin the database to keep calls flowing.
Global issues, global solutions.
STIR (Secure Telephone Identity Revisited), a standard created by the IETF, is considered a universal standard that can be successfully deployed in any country to help authenticate calls using SIP-based services. STIR has also been tested extensively in the ATIS Robocalling Testbed, by domestic and international carriers, for numerous years. SHAKEN (Secure Handling of Asserted information using toKENs), on the other hand, was designed specifically for the U.S., and deals with governance issues in how the STIR efforts should be managed.
While the specifics of SHAKEN can’t be replicated everywhere because the way phone calls are assigned and managed varies country by country, it provides a model for each nation to determine their own version of SHAKEN based on their unique infrastructures, processes, laws and governance structures.
Progress in the U.S. and abroad.
Over 3,000 service providers have registered in the FCC database, and millions of calls have been signed using STIR/SHAKEN. That experience offers proven guidance for international carriers who are just starting to determine how STIR and SHAKEN, or other options, can mitigate robocalls and ensure legitimate calls get through. Here’s a quick recap:
- Canada: The Canadian Radio-Television and Telecommunications Commission (CRTC) is closely aligned with the U.S. on robocall mitigation strategies. The CRTC issued the compliance and enforce and telecom decision CRTC 2018-32 in 2018, which requires Canadian CSPs to join the Canadian Secure Token - Governance Authority (CST-GA) and to participate in the Secure Telephone Identity (STI) call authentication ecosystem using STIR/SHAKEN. The original 2019 deadline was pushed to November 2021.
- U.K.: Ofcom, the U.K.’s communications regulator, continues to explore prospects for leveraging STIR/SHAKEN. The UK is moving towards copper retirement and hoping to migrate the PTSN to VoIP by January 2025, making it simpler to implement STIR/SHAKEN. However, the UK doesn’t have a national telephone number database of assigned numbers, so STIR may not help. At the recent SIPNOC STIR/SHAKEN Virtual Summit, NICC (a UK tech forum) suggested a three-phased approach. The first phase would focus on resolving the issue in the U.K. around network numbers vs presentation numbers and which gets the attestation level. The second phase is the implementation of a central database, and the third phase will be based on success of the first two. Ofcom plans to develop a numbering database which would go live in 2022 and is in talks with the FCC, the CRTC in Canada, ACMA in Australia and ARCEP in France to share learnings.
- France: In 2019, ARCEP, the main regulator in France, decided to amend the French national number plan to relax geographical restrictions attached to TN prefixes to enable portability in two stages and allowed authentication and related services for operators who wanted to offer them. ARCEP also proposed an anti-spam measure to forbid automated systems that make more calls and transmit more messages than they receive from using specific geographical numbers, which was met with resistance by market players concerned about blocking legitimate calls. The measure was postponed.
Best practices and resources for call authentication.
As a pioneer in call authentication, co-author of STIR standards, and early contributor to the SHAKEN framework, Neustar plays an ongoing leadership role in defining industry standards with ATIS, IETF, and CRTC. We’re also the exclusive operator of the ATIS Robocalling Testbed, and lead the industry in commercial call authentication deployments.
We’ve also created International Call Authentication (STIR/SHAKEN) Frequently Asked Questions (FAQs) to help carriers internationally understand:
• Why robocalls and nuisance calls are such a big problem across the globe
• What actions the U.S. has taken regarding call authentication
• Updates on robocall/nuisance calls around the world
• What is STIR/SHAKEN
• What regulatory bodies mandate and enforce STIR/SHAKEN and other regulations in the U.S.
• Next steps
As we work with different nations on the best strategy forward, it’s clear that collaboration and commitment are key to ending this worldwide problem. Right now, all eyes on the U.S. to determine if STIR/SHAKEN significantly reduces the number of robocalls, how those efforts will impact treatment of international calls into the U.S., and which techniques can be adapted for use in other countries.