Subject: [stir] U.S. Senate hearing on robocalls July 10, 2013

From: Henning Schulzrinne <[email-masked]>
Date: Fri, 5 Jul 2013 15:43:42 +0000

http://www.commerce.senate.gov/public/index.cfm?p=Hearings

Stopping Fraudulent Robocall Scams: Can More Be Done?<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>
Democratic Press Office - (202) 224-8374
Jul 10 2013 10:00 AM
Russell Senate Office Building - 253

---

From: "Richard Shockey" <[email-masked]>
Date: Fri, 5 Jul 2013 12:10:43 -0400

Any agenda?  Who is testifying . 

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Henning Schulzrinne
Sent: Friday, July 05, 2013 11:44 AM
To: [email-masked]
Subject: [stir] U.S. Senate hearing on robocalls July 10, 2013

 
<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id
=c1eec086-3512-4182-ae63-d60e68f4a532&ContentType_id=14f995b9-dfa5-407a-9d35
-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&Y
earDisplay=2013> Stopping Fraudulent Robocall Scams: Can More Be Done?

Jul 10 2013 10:00 AM

---

From: Dan York <[email-masked]>
Date: Sat, 6 Jul 2013 10:59:22 +0000

Will anyone be able to watch this and perhaps post a summary?  I will unfortunately be in transit (heading to ICANN 47) but would be interested to learn what was said.

Dan

On Jul 5, 2013, at 12:11 PM, "Richard Shockey" <[email-masked]<mailto:[email-masked]>> wrote:

Any agenda?  Who is testifying ...

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Henning Schulzrinne
Sent: Friday, July 05, 2013 11:44 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [stir] U.S. Senate hearing on robocalls July 10, 2013

_______________________________________________
stir mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/stir

---

From: Henning Schulzrinne <[email-masked]>
Date: Sat, 6 Jul 2013 17:01:56 +0000

Usually, either CSPAN and/or the Senate web site will have a video recording.

________________________________
From: [email-masked] [[email-masked]] on behalf of Dan York [[email-masked]]
Sent: Saturday, July 06, 2013 6:59 AM
To: Richard Shockey
Cc: [email-masked]; Henning Schulzrinne
Subject: Re: [stir] U.S. Senate hearing on robocalls July 10, 2013

Dan

Any agenda?  Who is testifying …

---

From: "Mishra, Sanjay" <[email-masked]>
Date: Wed, 10 Jul 2013 13:25:49 -0400

Dan - The archived Senate hearing is available at the following URL:

http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532

The hearing were about 2 hours long. Ms Greisman and Mr. Bash were the first of the two witness panel. They introduced the issue of Robocalling and caller id spoofing. Nothing more said here that folks on this distro are not already overly aware. But, perhaps a good high-level summary to the US Senate.

(I think I spotted Henning sitting just behind Mr. Bash but had only partial camera view, so I could be wrong)

Senator McCaskill (chair) played/referred to following typical telemarketer (robocalls):

*         "This is Rachel from the Card holder services - Calling in references to your credit card to lower your interest rate..."

*         "Warning automotive warranty is about to expire, press 1 to speak to a Rep or press 2 and your file will be removed..."

*         Reference to the USA Today article on June 9, 2013 on Seniors get a warning on Medical Alert  scam (http://www.usatoday.com/story/money/personalfinance/2013/06/09/scam-medical-alert/2397189/)

The second panel included Mr. Rupy from USTA and Mr. Altschul of CTIA. Both these gentlemen essentially echoed same theme as earlier witnesses, but added more color, nothing new added...This was then followed by two last witnesses, Mr. Stein (Primus) and Mr. Foss,  who spoke about solution each have to identify spoofed telemarketer calls. Mr. Stein talked about Telemarketing guard (in short, it supposedly automatically identify suspected frequent, mass telemarketing calls)  and Mr. Foss talked about nomorobo  (identifying caller id + calling pattern) which he had previously presented to FTC and won a $50,000 award (FTC Robocall Challenge). Mr. Foss said, he is now working on the solution to be ready by end of summer....

Lastly, there was of course a mention of "common carriers can do more...."

>From the sub-committee website, here are the details on the speakers:
Witness Panel 1
Ms. Lois Greisman <http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=62e2fdd3-2cc6-4fca-ab16-f1978019cd48&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>
Associate Director, Division of Marketing Practices
Bureau of Consumer Protection, Federal Trade Commission

Mr. Eric Bash <http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=672a55e7-b30a-469f-8eea-3a9aa02ffaa4&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>
Associate Bureau Chief, Enforcement Bureau
Federal Communications Commission

Witness Panel 2

Mr. Kevin G. Rupy <http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=2f8df054-d7ef-40e6-868c-f37733d6fefc&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>
Senior Director, Law and Policy
United States Telecom Association

Mr. Michael F. Altschul <http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=89f31c54-0939-4e99-bf5b-34ce10fff8b1&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>
Senior Vice President and General Counsel
CTIA - The Wireless Association

Mr. Matthew Stein <http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=fbe25126-3be7-4654-a03f-3e480c8d7400&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>
Chief Technology Officer
Primus Telecommunications Inc.

Mr. Aaron Foss <http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=65a498c3-0ad9-4b3d-8b1c-915245e73719&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>
Freelance Software Developer
Nomorobo

Thanks
Sanjay

From: [email-masked] [mailto:[email-masked]] On Behalf Of Dan York
Sent: Saturday, July 06, 2013 6:59 AM
To: Richard Shockey
Cc: [email-masked]; Henning Schulzrinne
Subject: Re: [stir] U.S. Senate hearing on robocalls July 10, 2013

Dan

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 10 Jul 2013 18:01:40 +0000

The full testimony, significantly longer than the 5 minute version on video, is available by clicking on the name of the witness. You will see references to STIR in both the FCC and FTC testimony.

From: Mishra, Sanjay [mailto:[email-masked]]
Sent: Wednesday, July 10, 2013 1:26 PM
To: Dan York; Richard Shockey
Cc: [email-masked]; Henning Schulzrinne
Subject: RE: [stir] U.S. Senate hearing on robocalls July 10, 2013

Witness Panel 1

Witness Panel 2

Thanks
Sanjay

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Dan York
Sent: Saturday, July 06, 2013 6:59 AM
To: Richard Shockey
Cc: [email-masked]<mailto:[email-masked]>; Henning Schulzrinne
Subject: Re: [stir] U.S. Senate hearing on robocalls July 10, 2013

Dan

---

From: "Richard Shockey" <[email-masked]>
Date: Wed, 10 Jul 2013 15:04:46 -0400

Not a bad hearing actually.  What was clear to me was STIR is still no
silver bullet here. Any reasonable solution has to be a combination of
deployable technology and national legislative action.

I got the clear sense from Senator McCaskill that if Congress passed
legislation permitting the public hanging of RoboCallers and Caller ID
spoofers it would pass by unanimous consent. 

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Henning Schulzrinne
Sent: Wednesday, July 10, 2013 2:02 PM
To: 'Mishra, Sanjay'; Dan York; Richard Shockey
Cc: [email-masked]
Subject: Re: [stir] U.S. Senate hearing on robocalls July 10, 2013

The full testimony, significantly longer than the 5 minute version on video,
is available by clicking on the name of the witness. You will see references
to STIR in both the FCC and FTC testimony.

Cc: [email-masked] <mailto:[email-masked]> ; Henning Schulzrinne

http://www.commerce.senate.gov/public/index.cfm?p=Hearings
<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id
=c1eec086-3512-4182-ae63-d60e68f4a532>
&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532

The hearing were about 2 hours long. Ms Greisman and Mr. Bash were the first
of the two witness panel. They introduced the issue of Robocalling and
caller id spoofing. Nothing more said here that folks on this distro are not
already overly aware. But, perhaps a good high-level summary to the US
Senate.

(I think I spotted Henning sitting just behind Mr. Bash but had only partial
camera view, so I could be wrong)

Senator McCaskill (chair) played/referred to following typical telemarketer
(robocalls):

*        "This is Rachel from the Card holder services - Calling in
references to your credit card to lower your interest rate."

*        "Warning automotive warranty is about to expire, press 1 to speak
to a Rep or press 2 and your file will be removed."

*        Reference to the USA Today article on June 9, 2013 on Seniors get a
warning on Medical Alert  scam
(http://www.usatoday.com/story/money/personalfinance/2013/06/09/scam-medical
-alert/2397189/)

The second panel included Mr. Rupy from USTA and Mr. Altschul of CTIA. Both
these gentlemen essentially echoed same theme as earlier witnesses, but
added more color, nothing new added.This was then followed by two last
witnesses, Mr. Stein (Primus) and Mr. Foss,  who spoke about solution each
have to identify spoofed telemarketer calls. Mr. Stein talked about
Telemarketing guard (in short, it supposedly automatically identify
suspected frequent, mass telemarketing calls)  and Mr. Foss talked about
nomorobo  (identifying caller id + calling pattern) which he had previously
presented to FTC and won a $50,000 award (FTC Robocall Challenge). Mr. Foss
said, he is now working on the solution to be ready by end of summer.. 

Lastly, there was of course a mention of "common carriers can do more.."

Witness Panel 1

Ms. Lois Greisman
<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id
=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=62e2fdd3-2cc6-4fca-ab16-f
1978019cd48&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06
c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013> 
Associate Director, Division of Marketing Practices 
Bureau of Consumer Protection, Federal Trade Commission

Mr. Eric Bash
<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id
=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=672a55e7-b30a-469f-8eea-3
a9aa02ffaa4&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06
c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013> 
Associate Bureau Chief, Enforcement Bureau 
Federal Communications Commission

Witness Panel 2

Mr. Kevin G. Rupy
<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id
=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=2f8df054-d7ef-40e6-868c-f
37733d6fefc&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06
c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013> 
Senior Director, Law and Policy 
United States Telecom Association

Mr. Michael F. Altschul
<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id
=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=89f31c54-0939-4e99-bf5b-3
4ce10fff8b1&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06
c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013> 
Senior Vice President and General Counsel 
CTIA - The Wireless Association

Mr. Matthew Stein
<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id
=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=fbe25126-3be7-4654-a03f-3
e480c8d7400&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06
c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013> 
Chief Technology Officer 
Primus Telecommunications Inc.

Mr. Aaron Foss
<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id
=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=65a498c3-0ad9-4b3d-8b1c-9
15245e73719&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06
c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013> 
Freelance Software Developer 
Nomorobo

Thanks

Sanjay

From: [email-masked] <mailto:[email-masked]>
[mailto:[email-masked]] On Behalf Of Dan York
Sent: Saturday, July 06, 2013 6:59 AM
To: Richard Shockey
Cc: [email-masked] <mailto:[email-masked]> ; Henning Schulzrinne
Subject: Re: [stir] U.S. Senate hearing on robocalls July 10, 2013

Will anyone be able to watch this and perhaps post a summary?  I will
unfortunately be in transit (heading to ICANN 47) but would be interested to
learn what was said. 

Dan

On Jul 5, 2013, at 12:11 PM, "Richard Shockey" <[email-masked]
<mailto:[email-masked]> > wrote:

From: [email-masked] <mailto:[email-masked]>
[mailto:[email-masked]] On Behalf Of Henning Schulzrinne
Sent: Friday, July 05, 2013 11:44 AM
To: [email-masked] <mailto:[email-masked]> 
Subject: [stir] U.S. Senate hearing on robocalls July 10, 2013

 

Jul 10 2013 10:00 AM

_______________________________________________
stir mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/stir

---

From: Brian Rosen <[email-masked]>
Date: Wed, 10 Jul 2013 15:22:43 -0400

Given the direction we're going, it seems that what we need at least minimally in the U.S. is a reg or interpretation when VoIP interconnect occurs, the SPs may, at their discretion, refuse to accept calls that don't have valid source identity.

If we eventually got to a regulation that said all such calls MUST have source identity, that might be better, but many service providers don't want regulation if they can avoid it.  Allowing them to refuse calls that don't have good identity would get us a long way to our goal.

Brian
 
On Jul 10, 2013, at 3:04 PM, Richard Shockey <[email-masked]> wrote:

>  
> Not a bad hearing actually.  What was clear to me was STIR is still no silver bullet here. Any reasonable solution has to be a combination of deployable technology and national legislative action.
>  
> I got the clear sense from Senator McCaskill that if Congress passed legislation permitting the public hanging of RoboCallers and Caller ID spoofers it would pass by unanimous consent.
>  
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Henning Schulzrinne
> Dan – The archived Senate hearing is available at the following URL:
>  
> ·        “This is Rachel from the Card holder services – Calling in references to your credit card to lower your interest rate…”
> ·        “Warning automotive warranty is about to expire, press 1 to speak to a Rep or press 2 and your file will be removed…”
> ·        Reference to the USA Today article on June 9, 2013 on Seniors get a warning on Medical Alert  scam (http://www.usatoday.com/story/money/personalfinance/2013/06/09/scam-medical-alert/2397189/)
>  
> The second panel included Mr. Rupy from USTA and Mr. Altschul of CTIA. Both these gentlemen essentially echoed same theme as earlier witnesses, but added more color, nothing new added…This was then followed by two last witnesses, Mr. Stein (Primus) and Mr. Foss,  who spoke about solution each have to identify spoofed telemarketer calls. Mr. Stein talked about Telemarketing guard (in short, it supposedly automatically identify suspected frequent, mass telemarketing calls)  and Mr. Foss talked about nomorobo  (identifying caller id + calling pattern) which he had previously presented to FTC and won a $50,000 award (FTC Robocall Challenge). Mr. Foss said, he is now working on the solution to be ready by end of summer….
>  
> Lastly, there was of course a mention of “common carriers can do more….”
>  
> On Jul 5, 2013, at 12:11 PM, "Richard Shockey" <[email-masked]> wrote:
> 
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Henning Schulzrinne
> Stopping Fraudulent Robocall Scams: Can More Be Done?
> [email-masked]
> [email-masked]

---

From: "Dwight, Timothy M \(Tim\)" <[email-masked]>
Date: Wed, 10 Jul 2013 15:30:41 -0400

Oh if it were only that simple.

The volume of calls received today over VoIP peering interfaces, without valid source identity, is quite high (it varies, but I've seen it in the double digits, percentage-wise).  I assume these are not all robocalls.  Most are probably legitimate calls between parties who are blissfully unaware that the networks on which they rely, are failing to identify the caller.

tim

From: [email-masked] [mailto:[email-masked]] On Behalf Of Brian Rosen
Sent: Wednesday, July 10, 2013 2:23 PM
To: Richard Shockey
Cc: [email-masked]; 'Dan York'; Mishra, Sanjay; 'Henning Schulzrinne'
Subject: Re: [stir] U.S. Senate hearing on robocalls July 10, 2013

Brian

On Jul 10, 2013, at 3:04 PM, Richard Shockey <[email-masked]<mailto:[email-masked]>> wrote:

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Henning Schulzrinne
Sent: Wednesday, July 10, 2013 2:02 PM
To: 'Mishra, Sanjay'; Dan York; Richard Shockey
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [stir] U.S. Senate hearing on robocalls July 10, 2013

Witness Panel 1

Witness Panel 2

Thanks
Sanjay

Dan

---

From: Paul Kyzivat <[email-masked]>
Date: Wed, 10 Jul 2013 15:41:02 -0400

> spoofers it would pass by unanimous consent.

Let's go for it!

---

From: Brian Rosen <[email-masked]>
Date: Wed, 10 Jul 2013 15:41:36 -0400

Sure.  We have to get deployment going.

Suppose it went something like this:
We get the standard close to finished
We get some early deployment experience that looks good
Vendors deliver real code not very long after the RFCs are released.
The green vendors deploy in their networks, and everything looks solid.

Now, what I think we would like to see is the green carriers telling their wholesale and interconnect partners that they have a deadline to deploy what the green carriers have already deployed, and after the deadline, no more unverifiable calls will be accepted.

If even a few of the larger green carriers did it, that would force nearly uniform deployment, because the recalcitrant SPs need to get to the consumers served by the the carriers that demand verified source identity.  If most of them did it on somewhat similar time scales, then there wouldn't even be any shopping of wholesale business by customers who wanted to avoid deploying.

You could even imagine monitoring that had some target percentage of verified calls  from a wholesale customer or peer that tightened over time.

If we're doing what we say we are doing, there won't be any excuse to not deploy other than spending the $$ to get it done.  We're explicitly covering cases where we have express permission from a number holder to another entity that entitles that entity to place calls with the identity of the number holder. 

That does depend on whatever infrastructure we describe to handle credentials be deployed as well as SP infrastructure.  In some countries, that may take regulatory work, in others, it might be agreements among SPs, or both.

Brian

On Jul 10, 2013, at 3:30 PM, "Dwight, Timothy M \(Tim\)" <[email-masked]> wrote:

> The volume of calls received today over VoIP peering interfaces, without valid source identity, is quite high (it varies, but I’ve seen it in the double digits, percentage-wise).  I assume these are not all robocalls.  Most are probably legitimate calls between parties who are blissfully unaware that the networks on which they rely, are failing to identify the caller.
>  
> tim
>

---

From: Paul Kyzivat <[email-masked]>
Date: Wed, 10 Jul 2013 15:55:13 -0400

Brian,

This sounds plausible in the US. But what about international calls? It 
may take some countries a long time to sort this out, and international 
calls probably can't be blocked while that happens. Would some bad-boys 
be able to find a way to exploit that?

	Thanks,

On 7/10/13 3:41 PM, Brian Rosen wrote:
> Now, what I think we would like to see is the green carriers telling
> their wholesale and interconnect partners that they have a deadline to
> deploy what the green carriers have already deployed, and after the
> deadline, no more unverifiable calls will be accepted.
>
> If even a few of the larger green carriers did it, that would force
> nearly uniform deployment, because the recalcitrant SPs need to get to
> the consumers served by the the carriers that demand verified source
> identity.  If most of them did it on somewhat similar time scales, then
> there wouldn't even be any shopping of wholesale business by customers
> who wanted to avoid deploying.
>
> You could even imagine monitoring that had some target percentage of
> verified calls  from a wholesale customer or peer that tightened over time.
>
> If we're doing what we say we are doing, there won't be any excuse to
> not deploy other than spending the $$ to get it done.  We're explicitly
> covering cases where we have express permission from a number holder to
> another entity that entitles that entity to place calls with the
> identity of the number holder.
>
> That does depend on whatever infrastructure we describe to handle
> credentials be deployed as well as SP infrastructure.  In some
> countries, that may take regulatory work, in others, it might be
> agreements among SPs, or both.
>
> Brian
>
> On Jul 10, 2013, at 3:30 PM, "Dwight, Timothy M \(Tim\)"
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>> The volume of calls received today over VoIP peering interfaces,
>> without valid source identity, is quite high (it varies, but I’ve seen
>> it in the double digits, percentage-wise).  I assume these are not all
>> robocalls.  Most are probably legitimate calls between parties who are
>> blissfully unaware that the networks on which they rely, are failing
>> to identify the caller.
>> tim
>> *From:[email-masked] <mailto:[email-masked]>
>> [mailto:[email-masked] <mailto:[email-masked]>]*On Behalf
>> Of*Brian Rosen
>> *Sent:*Wednesday, July 10, 2013 2:23 PM
>> *To:*Richard Shockey
>> *Cc:[email-masked] <mailto:[email-masked]>; 'Dan York'; Mishra, Sanjay;
>> 'Henning Schulzrinne'
>> *Subject:*Re: [stir] U.S. Senate hearing on robocalls July 10, 2013
>> Given the direction we're going, it seems that what we need at least
>> minimally in the U.S. is a reg or interpretation when VoIP
>> interconnect occurs, the SPs may, at their discretion, refuse to
>> accept calls that don't have valid source identity.
>> If we eventually got to a regulation that said all such calls MUST
>> have source identity, that might be better, but many service providers
>> don't want regulation if they can avoid it.  Allowing them to refuse
>> calls that don't have good identity would get us a long way to our goal.
>> Brian
>> *From:[email-masked]
>> <mailto:[email-masked]>[mailto:[email-masked]
>> <mailto:[email-masked]>]*On Behalf Of*Henning Schulzrinne
>> *Sent:*Wednesday, July 10, 2013 2:02 PM
>> *To:*'Mishra, Sanjay'; Dan York; Richard Shockey
>> *Cc:[email-masked] <mailto:[email-masked]>
>> *Subject:*Re: [stir] U.S. Senate hearing on robocalls July 10, 2013
>> The full testimony, significantly longer than the 5 minute version on
>> video, is available by clicking on the name of the witness. You will
>> see references to STIR in both the FCC and FTC testimony.
>> *From:*Mishra, Sanjay [mailto:[email-masked]]
>> *Sent:*Wednesday, July 10, 2013 1:26 PM
>> *To:*Dan York; Richard Shockey
>> *Cc:[email-masked] <mailto:[email-masked]>; Henning Schulzrinne
>> *Subject:*RE: [stir] U.S. Senate hearing on robocalls July 10, 2013
>> The hearing were about 2 hours long. Ms Greisman and Mr. Bash were the
>> first of the two witness panel. They introduced the issue of
>> Robocalling and caller id spoofing. Nothing more said here that folks
>> on this distro are not already overly aware. But, perhaps a good
>> high-level summary to the US Senate.
>> (I think I spotted Henning sitting just behind Mr. Bash but had only
>> partial camera view, so I could be wrong)
>> ·“This is Rachel from the Card holder services – Calling in references
>> to your credit card to lower your interest rate…”
>> ·“Warning automotive warranty is about to expire, press 1 to speak to
>> a Rep or press 2 and your file will be removed…”
>> ·Reference to the USA Today article on June 9, 2013 on Seniors get a
>> (http://www.usatoday.com/story/money/personalfinance/2013/06/09/scam-medical-alert/2397189/)
>> The second panel included Mr. Rupy from USTA and Mr. Altschul of CTIA.
>> Both these gentlemen essentially echoed same theme as earlier
>> witnesses, but added more color, nothing new added…This was then
>> followed by two last witnesses, Mr. Stein (Primus) and Mr. Foss,  who
>> spoke about solution each have to identify spoofed telemarketer calls.
>> Mr. Stein talked about Telemarketing guard (in short, it supposedly
>> automatically identify suspected frequent, mass telemarketing
>> calls)and Mr. Foss talked about nomorobo  (identifying caller id +
>> calling pattern) which he had previously presented to FTC and won a
>> $50,000 award (FTC Robocall Challenge). Mr. Foss said, he is now
>> working on the solution to be ready by end of summer….
>> *Witness Panel 1*
>> *Ms. Lois
>> Greisman<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=62e2fdd3-2cc6-4fca-ab16-f1978019cd48&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>*
>> *Mr. Eric
>> Bash<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=672a55e7-b30a-469f-8eea-3a9aa02ffaa4&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>*
>> *Witness Panel 2*
>> **
>> *Mr. Kevin G.
>> Rupy<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=2f8df054-d7ef-40e6-868c-f37733d6fefc&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>*
>> *Mr. Michael F.
>> Altschul<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=89f31c54-0939-4e99-bf5b-34ce10fff8b1&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>*
>> *Mr. Matthew
>> Stein<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=fbe25126-3be7-4654-a03f-3e480c8d7400&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>*
>> Chief Technology Officer
>> *Mr. Aaron
>> Foss<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=65a498c3-0ad9-4b3d-8b1c-915245e73719&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>*
>> *From:[email-masked]
>> <mailto:[email-masked]>[mailto:[email-masked]]*On Behalf
>> Of*Dan York
>> *Sent:*Saturday, July 06, 2013 6:59 AM
>> *To:*Richard Shockey
>> *Cc:[email-masked] <mailto:[email-masked]>; Henning Schulzrinne
>> *Subject:*Re: [stir] U.S. Senate hearing on robocalls July 10, 2013
>> unfortunately be in transit (heading to ICANN 47) but would be
>> interested to learn what was said.
>>
>> Dan
>>
>>
>> <mailto:[email-masked]>> wrote:
>>
>>     *From:[email-masked]
>>     <mailto:[email-masked]>[mailto:[email-masked]]*On
>>     Behalf Of*Henning Schulzrinne
>>     *Sent:*Friday, July 05, 2013 11:44 AM
>>     *To:[email-masked] <mailto:[email-masked]>
>>     *Subject:*[stir] U.S. Senate hearing on robocalls July 10, 2013
>>       <http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&ContentType_id=14f995b9-dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisplay=7&YearDisplay=2013>
>>
>>     /Democratic Press Office - (202) 224-8374/
>>
>>
>>             Jul10201310:00 AM
>>

---

From: Brian Rosen <[email-masked]>
Date: Wed, 10 Jul 2013 16:03:28 -0400

Sure.  TNSTAFL.

I've heard that it might be less trouble than you might think.  For example, I hear the Nigerian regulator really doesn't like his country being the source of a lot of SPAM, and if we gave them some proven technology to avoid being the robocall/vishing source, they might just mandate it PDQ.  If you could get the national carrier to deploy, and start playing the same game with it's domestic partners, it might come along pretty much the same way.

The green carriers could, at a minimum, enforce a believable source (correct country code for example), even if it was not verified, and they could start telling their VoIP peering partners that they need to start deploying, albeit it probably a longer time frame than the domestic partners.

I suspect the problem is going to be that we need the out of band solution, because we will have lots of PSTN interconnect at the international level long after it's uncommon in places like North America.

Brian

On Jul 10, 2013, at 3:55 PM, Paul Kyzivat <[email-masked]> wrote:

> Brian,
> 
> This sounds plausible in the US. But what about international calls? It may take some countries a long time to sort this out, and international calls probably can't be blocked while that happens. Would some bad-boys be able to find a way to exploit that?
> 
> 	Thanks,
> 	
>

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 10 Jul 2013 20:07:12 +0000

There are two kinds of international calls:

(1) with a US "From" / caller ID, but originated outside the US, including both robocallers and legitimate call centers
(2) with an international callerID

I think the second  category is self-limiting (people would probably be happy to just block such calls, given that most people receive very few legit international calls or only from very specific numbers, such as friends and family) and the first would seem to be subject to the same considerations as domestic calls.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul Kyzivat
Sent: Wednesday, July 10, 2013 3:55 PM
To: [email-masked]
Subject: Re: [stir] U.S. Senate hearing on robocalls July 10, 2013

Brian,

	Thanks,

On 7/10/13 3:41 PM, Brian Rosen wrote:
> We get some early deployment experience that looks good Vendors 
> deliver real code not very long after the RFCs are released.
> identity.  If most of them did it on somewhat similar time scales, 
> then there wouldn't even be any shopping of wholesale business by 
> customers who wanted to avoid deploying.
>
> not deploy other than spending the $$ to get it done.  We're 
> explicitly covering cases where we have express permission from a 
> number holder to another entity that entitles that entity to place 
> calls with the identity of the number holder.
>
>> without valid source identity, is quite high (it varies, but I've 
>> seen it in the double digits, percentage-wise).  I assume these are 
>> not all robocalls.  Most are probably legitimate calls between 
>> parties who are blissfully unaware that the networks on which they 
>> rely, are failing to identify the caller.
>> tim
>> Of*Brian Rosen *Sent:*Wednesday, July 10, 2013 2:23 PM *To:*Richard 
>> Shockey *Cc:[email-masked] <mailto:[email-masked]>; 'Dan York'; 
>> Mishra, Sanjay; 'Henning Schulzrinne'
>> have source identity, that might be better, but many service 
>> providers don't want regulation if they can avoid it.  Allowing them 
>> to refuse calls that don't have good identity would get us a long way to our goal.
>> Brian
>> Not a bad hearing actually.  What was clear to me was STIR is still 
>> no silver bullet here. Any reasonable solution has to be a 
>> combination of deployable technology and national legislative action.
>> legislation permitting the public hanging of RoboCallers and Caller 
>> ID spoofers it would pass by unanimous consent.
>> *Sent:*Wednesday, July 10, 2013 2:02 PM *To:*'Mishra, Sanjay'; Dan 
>> York; Richard Shockey *Cc:[email-masked] <mailto:[email-masked]>
>> *Sent:*Wednesday, July 10, 2013 1:26 PM *To:*Dan York; Richard 
>> Shockey *Cc:[email-masked] <mailto:[email-masked]>; Henning 
>> Schulzrinne
>> http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRec
>> ord_id=c1eec086-3512-4182-ae63-d60e68f4a532
>> The hearing were about 2 hours long. Ms Greisman and Mr. Bash were 
>> the first of the two witness panel. They introduced the issue of 
>> partial camera view, so I could be wrong) Senator McCaskill (chair) 
>> played/referred to following typical telemarketer (robocalls):
>> *"This is Rachel from the Card holder services - Calling in 
>> references to your credit card to lower your interest rate..."
>> *"Warning automotive warranty is about to expire, press 1 to speak to 
>> a Rep or press 2 and your file will be removed..."
>> *Reference to the USA Today article on June 9, 2013 on Seniors get a 
>> (http://www.usatoday.com/story/money/personalfinance/2013/06/09/scam-
>> medical-alert/2397189/) The second panel included Mr. Rupy from USTA 
>> and Mr. Altschul of CTIA.
>> witnesses, but added more color, nothing new added...This was then 
>> working on the solution to be ready by end of summer....
>> Greisman<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&C
>> ontentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=62e
>> 2fdd3-2cc6-4fca-ab16-f1978019cd48&ContentType_id=14f995b9-dfa5-407a-9
>> d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthD
>> isplay=7&YearDisplay=2013>* Associate Director, Division of Marketing 
>> Practices Bureau of Consumer Protection, Federal Trade Commission 
>> *Mr. Eric
>> Bash<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&Conte
>> ntRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=672a55e
>> 7-b30a-469f-8eea-3a9aa02ffaa4&ContentType_id=14f995b9-dfa5-407a-9d35-
>> 56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDispl
>> ay=7&YearDisplay=2013>* Associate Bureau Chief, Enforcement Bureau 
>> Federal Communications Commission *Witness Panel 2*
>> **
>> *Mr. Kevin G.
>> Rupy<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&Conte
>> ntRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=2f8df05
>> 4-d7ef-40e6-868c-f37733d6fefc&ContentType_id=14f995b9-dfa5-407a-9d35-
>> 56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDispl
>> ay=7&YearDisplay=2013>*
>> Altschul<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&C
>> ontentRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=89f
>> 31c54-0939-4e99-bf5b-34ce10fff8b1&ContentType_id=14f995b9-dfa5-407a-9
>> d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthD
>> isplay=7&YearDisplay=2013>* Senior Vice President and General Counsel 
>> CTIA - The Wireless Association *Mr. Matthew
>> Stein<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&Cont
>> entRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=fbe251
>> 26-3be7-4654-a03f-3e480c8d7400&ContentType_id=14f995b9-dfa5-407a-9d35
>> -56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDisp
>> lay=7&YearDisplay=2013>*
>> Chief Technology Officer
>> Foss<http://www.commerce.senate.gov/public/index.cfm?p=Hearings&Conte
>> ntRecord_id=c1eec086-3512-4182-ae63-d60e68f4a532&Statement_id=65a498c
>> 3-0ad9-4b3d-8b1c-915245e73719&ContentType_id=14f995b9-dfa5-407a-9d35-
>> 56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1978a&MonthDispl
>> ay=7&YearDisplay=2013>*
>> Behalf Of*Dan York *Sent:*Saturday, July 06, 2013 6:59 AM 
>> *To:*Richard Shockey *Cc:[email-masked] <mailto:[email-masked]>; 
>> Henning Schulzrinne
>> <http://www.commerce.senate.gov/public/index.cfm?p=Hearings&ContentRe
>> cord_id=c1eec086-3512-4182-ae63-d60e68f4a532&ContentType_id=14f995b9-
>> dfa5-407a-9d35-56cc7152a7ed&Group_id=b06c39af-e033-4cba-9221-de668ca1
>> 978a&MonthDisplay=7&YearDisplay=2013>
>>

---

From: Hadriel Kaplan <[email-masked]>
Date: Thu, 11 Jul 2013 00:52:59 -0400

Yeah, I was impressed by some of the testimony from the speakers and Q&A from the Senators.

It's unfortunate they spent so much time on the Primus TeleGuard service and portrayed it as some form of silver bullet to the problem, when it only solves specific forms of robocalls, and even then only after there's sufficient negative feedback from people who were already called.  Mr. Altschul's response to it was more accurate and poignant than the people there seemed to realize as well, including for the American Airlines scenario.  Plus my hunch is Canadian carriers happen to have a more easily identifiable call origin model right now, and thus its more easily defendable currently.

Regardless, none of the robocall-blocking tactics I've seen will do much in the long run unless we get the caller-id's to at least be authenticate-able.  Once we know the caller-ids can't be randomly generated or spoof legitimate sources, doing whitelist/blacklist things will be a lot more tenable.

-hadriel

---

From: Dave Crocker <[email-masked]>
Date: Wed, 10 Jul 2013 22:08:43 -0700

> Regardless, none of the robocall-blocking tactics I've seen will do much
> in the long run unless we get the caller-id's to at least be
> authenticate-able.  Once we know the caller-ids can't be randomly
> generated or spoof legitimate sources, doing whitelist/blacklist things
> will be a lot more tenable.

Dumb question, since it seems clear that most folk already have a sense 
of the answer:  Once there are some telephone numbers getting validated, 
how will this get used and by what components in the system?

I'm asking for more detail that the above text has, so that it's 
possible to consider the specifics of what to change and how it will 
work, such as during initial years of only partial adoption.

Over in email-abuse land, a wide range of assumptions were made about 
the use of authenticated names, but the actual uses have had some surprises.

To the extent that there is agreement on the specific uses that are 
planned for validated telephone numbers, it can sometimes help to 
clarify engineering choices for the validation mechanism.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: "Wendt, Chris" <[email-masked]>
Date: Thu, 11 Jul 2013 13:53:13 +0000

I believe the combination of both tactics will be powerful and once caller-id validation becomes more prevalent and universal, it will make the call analytics, spoofing detection magic even more accurate, obviously.

Will be key for congress and/or others to give a clear signal that blocking or at least redirecting calls is appropriate and legal.  It's just defining "appropriate" scenarios may be hard.

On Jul 11, 2013, at 1:08 AM, Dave Crocker <[email-masked]> wrote:

> Dumb question, since it seems clear that most folk already have a sense of the answer:  Once there are some telephone numbers getting validated, how will this get used and by what components in the system?
> 
> I'm asking for more detail that the above text has, so that it's possible to consider the specifics of what to change and how it will work, such as during initial years of only partial adoption.
> 
> Over in email-abuse land, a wide range of assumptions were made about the use of authenticated names, but the actual uses have had some surprises.
> 
> To the extent that there is agreement on the specific uses that are planned for validated telephone numbers, it can sometimes help to clarify engineering choices for the validation mechanism.
> 
> d/
> 
> 
> -- 
> Dave Crocker

---

From: Henning Schulzrinne <[email-masked]>
Date: Thu, 11 Jul 2013 13:59:59 +0000

A crucial component will be that 

(1) *all* calls from a certain number are validated
(2) the receiver can know that this is the case ("DANE")

(2) can be a heuristic, given (1), but obviously explicit information is better. That way, targets that are particularly susceptible to individualized spoofing, such as financial institutions, can protect themselves first, just like they did by implementing TLS early on their web sites. That would prevent a fair amount of vishing. If we can then get the large outbound call centers to "incent" their carriers, most people will then only get three kinds of calls:
(a) validated business calls
(b) known numbers from friends and family
(c) unvalidated calls that are very likely to be robocalls and can, at least, be sent to voicemail and CAPTCHA

(2) may not be an Internet-facing directory, although that could be quite helpful. For example, this information could be contained in the LERG or other information made available by the numbering administrator.

-----Original Message-----
From: Dave Crocker [mailto:[email-masked]] 
Sent: Thursday, July 11, 2013 1:09 AM
To: [email-masked]
Cc: 'Dan York'; 'Mishra, Sanjay'; Henning Schulzrinne
Subject: Using Validated Numbers (was - Re: [stir] U.S. Senate hearing on robocalls July 10, 2013)

> Regardless, none of the robocall-blocking tactics I've seen will do 
> much in the long run unless we get the caller-id's to at least be 
> generated or spoof legitimate sources, doing whitelist/blacklist 
> things will be a lot more tenable.

d/

---

From: Michael Hammer <[email-masked]>
Date: Thu, 11 Jul 2013 14:36:58 +0000

Correct me if I am wrong, but I didn't think the LERG went to 10 digits.

Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Henning Schulzrinne
Sent: Thursday, July 11, 2013 10:00 AM
To: [email-masked]'; [email-masked]
Cc: 'Dan York'; 'Mishra, Sanjay'
Subject: Re: [stir] Using Validated Numbers (was - Re: U.S. Senate hearing
on robocalls July 10, 2013)

(2) can be a heuristic, given (1), but obviously explicit information is
better. That way, targets that are particularly susceptible to
individualized spoofing, such as financial institutions, can protect
themselves first, just like they did by implementing TLS early on their web
sites. That would prevent a fair amount of vishing. If we can then get the
large outbound call centers to "incent" their carriers, most people will
then only get three kinds of calls:
(a) validated business calls
(b) known numbers from friends and family
(c) unvalidated calls that are very likely to be robocalls and can, at
least, be sent to voicemail and CAPTCHA

(2) may not be an Internet-facing directory, although that could be quite
helpful. For example, this information could be contained in the LERG or
other information made available by the numbering administrator.

-----Original Message-----
From: Dave Crocker [mailto:[email-masked]] 
Sent: Thursday, July 11, 2013 1:09 AM
To: [email-masked]
Cc: 'Dan York'; 'Mishra, Sanjay'; Henning Schulzrinne
Subject: Using Validated Numbers (was - Re: [stir] U.S. Senate hearing on
robocalls July 10, 2013)

> things will be a lot more tenable.

Dumb question, since it seems clear that most folk already have a sense of
the answer:  Once there are some telephone numbers getting validated, how
will this get used and by what components in the system?

I'm asking for more detail that the above text has, so that it's possible to
consider the specifics of what to change and how it will work, such as
during initial years of only partial adoption.

Over in email-abuse land, a wide range of assumptions were made about the
use of authenticated names, but the actual uses have had some surprises.

To the extent that there is agreement on the specific uses that are planned
for validated telephone numbers, it can sometimes help to clarify
engineering choices for the validation mechanism.

d/

---

From: Hadriel Kaplan <[email-masked]>
Date: Thu, 11 Jul 2013 12:47:28 -0400

I think he meant the NPAC.

Even if the NPAC held the keys/certs, we'd still want a way to do STIR delegation...  because afaict the NPAC in its current form doesn't truly know the ultimate service provider.  It appears to only know the regulated "carrier" the number is assigned to, but that's not the ultimate service provider really.  There are hundreds of providers who aren't classified as "carriers", and don't want to be for legal/monetary reasons.  They pay a real "carrier" to handle the number porting, so the NPAC only has that official carrier in its database instead of the ultimate service provider.  That official carrier could be the one to sign the caller-id coming from its customer service providers, but we probably need a way for the real originating service provider to do it instead.

-hadriel

---

From: Brian Rosen <[email-masked]>
Date: Thu, 11 Jul 2013 13:55:18 -0400

This is very US specific, but

NPAC has two fields called "AltSPID" and "LastAltSPID", which are intended to hold SP IDs for number resell.  They are used in that way for several specific purposes, including the iTRS directory, where it holds the VRS or IP Relay provider SPID, and they are not "carriers".

Unfortunately, it has only the two fields, and the first is for the customer of the "carrier" and the last is for the SP the customer knows.  There could have been several other number delegations between them, which could not be recorded.  Use of these fields is optional for the carrier, but many carriers are beginning to do so.

It would be fairly easy to add the additional fields to capture the intermediate SPs, but doing so requires work at LNPA and in the NPAC code, although the latter is a greased pole (we like adding fields).  Associating certs with these records would be additional work, of course.

Brian

---

From: "Richard Shockey" <[email-masked]>
Date: Thu, 11 Jul 2013 14:07:22 -0400

Well they are all 10 digit .. but the NPAC has both the OCN,  the NECA
Operator Carrier Number as well as the SPID ALT-SPID identifiers which is
honored by the secondary carrier often in the breach.

This is an excellent point BTW that the structure of the existing national
numbering databases (plural!)  must in some way shape or form  be modified
to reflect the delegation model for a E.164 number. 

This highlights again the general issue that STIR is not in and of itself a
silver bullet but will require some matched actions by the National
Regulators to implement properly.  What are the Roles and Responsibilities
of the Carrier of Record for both the entity that has direct access to the
NANPA and the secondary operator who is not licensed to directly access the
NANP.  Though this discussion focuses on the North Americian problem it will
be perfectly applicable to other national jurisdictions when the issue
arises. 

That is precisely the subject of the open Comment Period at the FCC on
Numbering.

For those of you who would like to expand this 'conversation' directly the
FCC now is your chance! 

http://www.gpo.gov/fdsys/pkg/FR-2013-06-19/pdf/2013-13703.pdf

Comments due July 19.  

Don't delay,  file today !

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Hadriel Kaplan
Sent: Thursday, July 11, 2013 12:47 PM
To: Michael Hammer
Cc: [email-masked]; [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: [stir] Using Validated Numbers (was - Re: U.S. Senate hearing
on robocalls July 10, 2013)

Even if the NPAC held the keys/certs, we'd still want a way to do STIR
delegation...  because afaict the NPAC in its current form doesn't truly
know the ultimate service provider.  It appears to only know the regulated
"carrier" the number is assigned to, but that's not the ultimate service
provider really.  There are hundreds of providers who aren't classified as
"carriers", and don't want to be for legal/monetary reasons.  They pay a
real "carrier" to handle the number porting, so the NPAC only has that
official carrier in its database instead of the ultimate service provider.
That official carrier could be the one to sign the caller-id coming from its
customer service providers, but we probably need a way for the real
originating service provider to do it instead.

-hadriel

On Jul 11, 2013, at 10:36 AM, Michael Hammer <[email-masked]>
wrote:

> Subject: Re: [stir] Using Validated Numbers (was - Re: U.S. Senate 
> hearing on robocalls July 10, 2013)
> 
> (2) can be a heuristic, given (1), but obviously explicit information 
> is better. That way, targets that are particularly susceptible to 
> themselves first, just like they did by implementing TLS early on 
> their web sites. That would prevent a fair amount of vishing. If we 
> can then get the large outbound call centers to "incent" their 
> carriers, most people will then only get three kinds of calls:
> (2) may not be an Internet-facing directory, although that could be 
> quite helpful. For example, this information could be contained in the 
> LERG or other information made available by the numbering administrator.
> 
> Dumb question, since it seems clear that most folk already have a 
> sense of the answer:  Once there are some telephone numbers getting 
> validated, how will this get used and by what components in the system?
>

---

From: "Dwight, Timothy M \(Tim\)" <[email-masked]>
Date: Thu, 11 Jul 2013 14:54:47 -0400

Whether the NPAC plays any role seems like a North America -specific, largely-commercial distraction.  Certainly I would object to any effort to bias the square peg (solution) so that it fits that particular (need I say North America -specific?) round hole (NPAC).  

tim

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Hadriel Kaplan
Sent: Thursday, July 11, 2013 11:47 AM
To: Michael Hammer
Cc: Mishra, Sanjay; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [stir] Using Validated Numbers (was - Re: U.S. Senate hearing on robocalls July 10, 2013)

-hadriel

---

From: Henning Schulzrinne <[email-masked]>
Date: Thu, 11 Jul 2013 20:35:00 +0000

If all you have is a public-private key pair *for each number* (or final user), the "provider of record" (i.e., the one that's officially listed in the NPAC) can just hand the key pair to the customer. This works out as approximately the same, minus the administration part, i.e., whether the "real" entity contacts the NPAC and gets a cert, or the entity of record does. Until non-carriers can generally be handed numbers, there are sensitivities here.

-----Original Message-----
From: Hadriel Kaplan [mailto:[email-masked]] 
Sent: Thursday, July 11, 2013 12:47 PM
To: Michael Hammer
Cc: Henning Schulzrinne; [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [stir] Using Validated Numbers (was - Re: U.S. Senate hearing on robocalls July 10, 2013)

-hadriel

---

From: "Richard Shockey" <[email-masked]>
Date: Thu, 11 Jul 2013 17:31:56 -0400

+1  Well said ... 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Dwight, Timothy M (Tim)
Sent: Thursday, July 11, 2013 2:55 PM
To: Hadriel Kaplan; Michael Hammer
Cc: [email-masked]; [email-masked]; [email-masked]; Mishra,
Sanjay; [email-masked]
Subject: Re: [stir] Using Validated Numbers (was - Re: U.S. Senate hearing
on robocalls July 10, 2013)

Whether the NPAC plays any role seems like a North America -specific,
largely-commercial distraction.  Certainly I would object to any effort to
bias the square peg (solution) so that it fits that particular (need I say
North America -specific?) round hole (NPAC).  

tim

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Hadriel Kaplan
Sent: Thursday, July 11, 2013 11:47 AM
To: Michael Hammer
Cc: Mishra, Sanjay; [email-masked]; [email-masked]; [email-masked];
[email-masked]
Subject: Re: [stir] Using Validated Numbers (was - Re: U.S. Senate hearing
on robocalls July 10, 2013)

-hadriel

---

From: Hadriel Kaplan <[email-masked]>
Date: Thu, 11 Jul 2013 22:23:13 -0400

> Whether the NPAC plays any role seems like a North America -specific, largely-commercial distraction.  Certainly I would object to any effort to bias the square peg (solution) so that it fits that…

Yup, I was just expanding on Henning's example which indicated the LERG, and Michael pointed out the LERG doesn't identify the end numbers.
-hadriel