Mr. Michael MacPherson,
Clerk of the Standing Committee on Industry,
Science and Technology
Re: Public call for comments dated 4 March 2020 to the Standing Committee on Industry, Science and Technology concerning a study on fraud calls.
1. On 20 February 2020, the Standing Committee on Industry, Science and Technology adopted a motion to study the influx of fraud calls in Canada, including robocalls, ghost calls, and spam calls. COMsolve Inc. (“COMsolve”) is please to provide the following comments in response to its calls for public comment.
2. COMsolve is one of Canada’s fastest growing private companies with operations in Alberta, BC, and Ontario. We provide technology services to the Canadian telecommunications industry and are actively involved in activities aimed at reducing the influx of robocalls and spoofed calls which together make up the largest volume of complaints by consumers to the Canadian Radio-television and Telecommunications Commission (“CRTC”). Specifically, COMsolve is chairing CRTC Interconnection Steering Committee (“CISC”) sub-working groups to develop a call traceback process (“NTTF038”) and STIR [Secure Telephony Identity Revisited]/SHAKEN [Signature-based Handling of Asserted information using toKENs] framework in Canada (“NTTF040”). We are also a bidder to implement key portions of the STIR/SHAKEN framework so that telecommunications service providers can exchange trusted certificates about the origin of calls. COMsolve is also operating as the Canadian Number Administrator on behalf of the industry, and as such receives a number of complaints by consumers wondering how spammers “got their number”.
3. These comments are specifically addressing the Canadian implementation path for STIR/SHAKEN. In Compliance and Enforcement and Telecom Decision (CETD) 2018-32, the CRTC determined that authentication and verification of caller identification (ID) information for Internet Protocol (IP)-based voice calls (hereinafter referred to as “SIP calls”) should be implemented by all telecommunication service providers that provide voice telecommunications services (“voice service providers”) in Canada by no later than 31 March 2019 to empower Canadians to better protect themselves against nuisance calls. This deadline was subsequently extended to 30 September 2020.
Background
4. For the purpose of this submission, it is important understand that an illegally spoofed call involves deliberately falsifying the telephone number and/or name relayed as the caller ID information to disguise the identity of the caller. There are legitimate purposes for spoofing a number such as pharmacy notifications. Illegally spoofed calls may be for harmful or fraudulent purposes.
5. The implementation of STIR/SHAKEN has a number of limitations. First, STIR/SHAKEN was not intended to inform the party receiving a call whether the call is fraudulent (i.e., the telephone number may not be spoofed but the caller could be a scammer) or legal.
6. Second, as envisioned for the initial Canadian STIR/SHAKEN implementation, a full caller attestation will not be possible unless the call:
(a) originates in Canada;
(b) the originating voice service provider network use SIP technology to handle the call (i.e., not from your plain old copper telephone line or legacy PBX);
(c) the call travels end-to-end between all intermediate voice service providers without changing back to a legacy format at any intermediate point; and
(d) there is an authenticated and verified association of the entity behind the call to the number being used to deliver the call.
Calls originating from outside Canada, or via legacy networks will merely receive a gateway attestation. This means that the signing provider can only certify the entry point of the call onto its telephone network, but has no relationship to the initiator of the call i.e., the signer is not asserting anything other than “this is the point where the call entered my network”. Future iterations of the Canadian implementation of STIR/SHAKEN may address some of these limitations.
7. Once STIR/SHAKEN is implemented, it is up to the terminating voice service provider to label the call for the recipient. Labels could parallel the STIR/SHAKEN attestations, or they could contain ratings like “Likely Spam”, a checkmark/or x, or even a happy/sad face emoji. There are no agreed standards for the call rating display to the call recipient and what is displayed may be determined by an analytics engine using the STIR/SHAKEN certificate as but one input.
Recommendations
8. Analytics Requires Enterprise Identity to Protect Legal Callers: Canada has had the foresight to not yet allow voice service providers to use analytics engines to block calls (using artificial intelligence or otherwise). Now that STIR/SHAKEN is about to be deployed, there will be increased pressure to implement analytics-based call blocking solutions (or call rating systems such as “likely spam”) to block calls that do not have a clear attestation as to caller identity. However, there are other steps that must be implemented before analytic engines are let loose on the Canadian public. This is necessary to prevent businesses, first responders, schools and hospitals (to name but a few) from having legal calls improperly blocked or labeled as spam.
9. Default Blocking Only with Deployment of Enterprise Identity: Allowing voice service providers to block communications by default on an opt-out basis based on the varied analytics would create inconsistencies as identical lawful calls from the same caller could be rated inconsistently across multiple analytics entities. Analytics identify legal callers, including life and safety calls, as fraudulent thus potentially creating harm to the called parties.
10. Visibility into Call Treatment for Legal Callers: Additionally, carriers and their analytics partners do not inform legal callers of how their calls are labeled and/or blocked. Because of these errors and lack of feedback from carriers and their partners to lawful callers, the voice channel will continue to be rendered a less effective means of communication despite consumer preference to receive voice communications from companies they do business with. As a result of inefficient redress process with inclusion of Enterprise Identity for legal callers, many carriers will inevitably press for protections to eliminate liability for blocking legitimate calls. Requiring visibility into call treatment by analytics for legal callers, will improve reasonableness and accuracy of call treatment.
11. While COMsolve fully supports the deployment of STIR/SHAKEN by voice service providers, STIR/SHAKEN was designed to provide consistent trace back to determine the originating carrier, but STIR/SHAKEN does not determine whether a call is legal or illegal, or wanted or unwanted. STIR/SHAKEN in combination with analytics-based call blocking is the best way to deal with unwanted spoofed calls (and robocalls), but there is a pressing need for the following two recommendations to be implemented in parallel:
(i) Vetted Enterprise Identity: the ability for legal callers to identify to carriers and their analytics partners that they are making legal calls from telephone numbers they are authorized to use; and
(ii) Visibility into Call Treatment: a centralized method of recourse to those individuals, businesses and other entities who feel their calls are being improperly blocked or labelled. All of which is respectfully submitted,
Yours truly,
Ofir Smadja
CEO and Founder, COMsolve Inc.
Full Attestation: The signing provider (i.e., the originating voice service provider) certifies that it: (1) is responsible for the origination of the call onto the IP based service provider voice network; (2) has a direct authenticated relationship with the customer and can identify the customer; and (3) has established a verified association with the telephone number used for the call.
Section 36 of the Telecommunications Act provides: “Except where the Commission approves otherwise, a Canadian carrier shall not control the content or influence the meaning or purpose of telecommunications carried by it for the public.”
Numeracle, Inc. Comments, CG Docket No. 17-59, WC Docket No. 17-97, at 3 (rec. January 29, 2020) (Numeracle Comments) https://ecfsapi.fccgov/file/101311857929629/Numeracle_Comments_Robocall_Report_01302020.pdf
Numeracle and Appriss Ex Parte, CG Docket 17-59, available at: https://ecfsapi.fcc.gov/file/10530193220084/Littman%20and%20Nakazawa%20Ex%20Parte%20Numeracle%20an d %20Appriss.pdf
For more information about the Parliament’s Standing Committee to adopt “a motion to study the influx of fraud calls in Canada, including robocalls, ghost calls, and spam calls” please follow: