Subject: [stir] Comments/Queries?

From: Travis Russell <[email-masked]>
Date: Tue, 10 Dec 2013 12:31:54 -0800 (PST)

Looking at the following paragraph:

For numbers where the caller has suppressed textual caller identification, number spoofing can be used to retrieve this information, stored in the so-called Calling Name (CNAM) database.

It is my experience that spoofing is simply accomplished via VoIP servers modifying the SIP fields. There are a number of ways this has been facilitated - you can call a spoof service where the call is terminated on a VoIP server, and when prompted enter the telephone number you want to appear as the calling party (works great - I have tried this myself). The VoIP server than re-originates the call and sends it to the called party with the new "spoofed" identity. 

I am not familiar with any cases where the spoofed identity was retrieved from a SNAM server (although I may be wrong in this case). 

In the paragraph immediately after:

For anonymization, the caller does not necessarily care whether the number is in service, or who it is assigned to, and may switch rapidly and possibly randomly between numbers.  Anonymization facilitates automated illegal telemarketing or telephony denial-of-service attacks, as described above, as it makes it difficult to blacklist numbers.  

A hacker or fraudster will typically use a "hit list" when doing this, because fraud management systems look for calls to/from unassigned numbers (many operators assign "dark numbers" in their number ranges to identify hackers looking for assigned numbers). They will try to use assigned numbers of legitimate subscribers to alleviate discovery by FMS or network "traps" where dark numbers are assigned. It is the fact that they are using legitimate subscriber identities that makes it impossible to black list, because you are effecting the good subscribers service.

QUESTION: How will validation/verification work in the case of number portability where a number once assigned to one operator is now assigned to another operator? Has consideration been given to updates through the number portability process in these cases or is this a mute point?

-- 
HYPERLINK "http://www.oracle.com/"Description: Oracle
Travis Russell | Technologist, Sr. Mgr
Phone: HYPERLINK "tel:+1%209194602172"+1 9194602172 | Mobile: HYPERLINK "tel:+1%209194121167"+1 9194121167 
Oracle CGBU Product Marketing
5200 Paramount Pkwy | Morrisville, North Carolina 27560 

HYPERLINK "http://www.oracle.com/commitment"Description: Green Oracle

Oracle is committed to developing practices and products that help protect the environment

---

From: Brian Rosen <[email-masked]>
Date: Tue, 10 Dec 2013 17:24:37 -0500

The caller name comes from a database queried by the calling telephone number.  Usually, the display name in the SIP message is not used.  That’s not always true (enterprise internal PBX for example).  Certainly, if you receive the call from a POTS phone, whatever is in the SIP signaling for display name is not even available to the called party or her service provider. 

The conventional implementation is the database is operated by the calling service provider.  The called service provider dips the database with the calling party TN obtained in the signaling.  

If you can spoof the calling party number, you can cause the name to be any name that is already in the database.

The fraud management systems you are referring to sound like the ones inbound systems call centers use to identify fraudulent inbound callers.  I’m not aware of any service provider attempting to identify fraudulent callers on behalf of a typical residential or enterprise customer.

We have most certainly considered number portability in this system.  The credentials will change when numbers port.  The old credential will become invalid (or the coverage of the credential will change if the credential has more than one TN associated with it).  A new credential will be issued, or an existing credential will get another TN associated with it.

We did agree that we could have some delay of this (or, rather, that we would not attempt to invalidate cacheing of credentials.  If, following a port, the old holder could spoof the call for some minutes, or even hours, that would probably be okay.

Brian

On Dec 10, 2013, at 3:31 PM, Travis Russell <[email-masked]> wrote:

> It is my experience that spoofing is simply accomplished via VoIP servers modifying the SIP fields. There are a number of ways this has been facilitated – you can call a spoof service where the call is terminated on a VoIP server, and when prompted enter the telephone number you want to appear as the calling party (works great – I have tried this myself). The VoIP server than re-originates the call and sends it to the called party with the new “spoofed” identity.
>  
> A hacker or fraudster will typically use a “hit list” when doing this, because fraud management systems look for calls to/from unassigned numbers (many operators assign “dark numbers” in their number ranges to identify hackers looking for assigned numbers). They will try to use assigned numbers of legitimate subscribers to alleviate discovery by FMS or network “traps” where dark numbers are assigned. It is the fact that they are using legitimate subscriber identities that makes it impossible to black list, because you are effecting the good subscribers service.
>  
> Phone: +1 9194602172 | Mobile: +1 9194121167 
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir

---

From: Travis Russell <[email-masked]>
Date: Tue, 10 Dec 2013 14:38:23 -0800 (PST)

Thanks Brian for the clarifications. The FMS I am referring to are the FSM used by service providers that look for anomalies in subscriber behaviors. These systems look at behaviors of inbound and outbound callers, and provide alarms/flags to the fraud department when there is an anomaly occurring. One "trick" used by fraud investigators is to assign dark numbers throughout their number ranges. When the dark number is hit several times, it indicates a hacker trying to create a hit list. There are a number of variations to this technique but it is common for fraudsters to spend a fair amount of time honing their hit lists prior to launching an attack. 

The FMS also looks for short calls, velocity of calls, etc to identify anomalies, and there are thresholds in the network that fraudsters eventually discover to ensure they "fly under the radar" of these systems. All of that said to make the point that fraudsters absolutely care about the numbers being legitimate to prevent detection by the many systems put in place by fraud departments. 

In the case of the calling party name, is it thought that the name display is critical to this process? My understanding is that the number itself is the critical element, and the name is just a convenience provided to subscribers. There are many errors in the calling name database so personally I don't even pay attention to that anymore. The number on the other hand is absolutely important. By the way, in wireless communications, the calling party name is driven by the address book on the device itself, and not CNAM. 

I mention this because in the problem statement it sounds like the calling party name is of equal importance to validation as the number. 

From: Brian Rosen [mailto:[email-masked]] 
Sent: Tuesday, December 10, 2013 5:25 PM
To: Travis Russell
Cc: [email-masked] List
Subject: Re: [stir] Comments/Queries?

The caller name comes from a database queried by the calling telephone number.  Usually, the display name in the SIP message is not used.  That's not always true (enterprise internal PBX for example).  Certainly, if you receive the call from a POTS phone, whatever is in the SIP signaling for display name is not even available to the called party or her service provider. 

The fraud management systems you are referring to sound like the ones inbound systems call centers use to identify fraudulent inbound callers.  I'm not aware of any service provider attempting to identify fraudulent callers on behalf of a typical residential or enterprise customer.

Brian

On Dec 10, 2013, at 3:31 PM, Travis Russell <HYPERLINK "mailto:[email-masked]"[email-masked]> wrote:

-- 
HYPERLINK "http://www.oracle.com/"

HYPERLINK "http://www.oracle.com/commitment"

_______________________________________________
stir mailing list
HYPERLINK "mailto:[email-masked]"[email-masked]
https://www.ietf.org/mailman/listinfo/stir

---

From: Brian Rosen <[email-masked]>
Date: Tue, 10 Dec 2013 17:45:58 -0500

What users look at for numbers they have not memorized is name.  They can’t tell anything from the number.

In the IETF work, we have split  name and number.  We’ll come up with the number solution first, and then work on name.  The name discussions are on a separate list (cnit).

Most of the bad calls we see are from what I usually call “pink” service providers.  They aren’t actually complicit, but they look the other way as their subscribers spoof name and number.  They don’t run FMS systems.  I am told that wholesale divisions of major carriers sometimes are the unwitting origination carrier, because there are many instances of permitted “spoofing” (call centers calling on behalf of another enterprise for example) which means they don’t scrutinize calling party number on the wholesale side.  However, the majority of the bad calls come from these “pink” carriers.  

We all agree we need to get the number reliable first.

Brian

On Dec 10, 2013, at 5:38 PM, Travis Russell <[email-masked]> wrote:

> Thanks Brian for the clarifications. The FMS I am referring to are the FSM used by service providers that look for anomalies in subscriber behaviors. These systems look at behaviors of inbound and outbound callers, and provide alarms/flags to the fraud department when there is an anomaly occurring. One “trick” used by fraud investigators is to assign dark numbers throughout their number ranges. When the dark number is hit several times, it indicates a hacker trying to create a hit list. There are a number of variations to this technique but it is common for fraudsters to spend a fair amount of time honing their hit lists prior to launching an attack.
>  
> The FMS also looks for short calls, velocity of calls, etc to identify anomalies, and there are thresholds in the network that fraudsters eventually discover to ensure they “fly under the radar” of these systems. All of that said to make the point that fraudsters absolutely care about the numbers being legitimate to prevent detection by the many systems put in place by fraud departments.
>  
> In the case of the calling party name, is it thought that the name display is critical to this process? My understanding is that the number itself is the critical element, and the name is just a convenience provided to subscribers. There are many errors in the calling name database so personally I don’t even pay attention to that anymore. The number on the other hand is absolutely important. By the way, in wireless communications, the calling party name is driven by the address book on the device itself, and not CNAM.
>

---

From: Jonathan Cronin <[email-masked]>
Date: Tue, 10 Dec 2013 21:36:02 -0500

> What users look at for numbers they have not memorized is name.  They can’t tell anything from the number.

...
> We all agree we need to get the number reliable first.

Let me second this.  If the end user can get authenticated reliable caller identification (which may require more than name)
they don’t care about the calling number.  But that’s for the future.

Jonathan

Jonathan Cronin
[email-masked]
781 861 0670

EGH, Inc.
55 Waltham Street
Lexington, MA 02421

---

From: Travis Russell <[email-masked]>
Date: Wed, 11 Dec 2013 03:50:22 -0800 (PST)

Thanks Brian,

Agreed. But remember most of us use our cell phones these days, and the name comes from your address book based on number. 

Calling name will be a challenge since the service providers providing CNAM services to the operators are challenged to get the names right. And if you send a correction to your own name it sometimes does not get fixed permanently as the next bulk load reverts back to the old files. 

I like the label of "pink" service providers. There are also those that offer spoofing as a service. You call a freephone number, your call is terminated on the VoIP switch where you are asked for the number you want to appear, and the call re-originated. These come through as legitimate calls to the major service providers, and when tracing the call you can only trace as far back as the spoofing service. Perfectly legitimate companies by the way, as there is nothing illegal about spoofing your number. 

I only provide all this info because it is important for all of us to understand the problem and how it manifests itself within service provider networks.

From: Brian Rosen [mailto:[email-masked]] 
Sent: Tuesday, December 10, 2013 5:46 PM
To: Travis Russell
Cc: [email-masked] List
Subject: Re: [stir] Comments/Queries?

What users look at for numbers they have not memorized is name.  They can't tell anything from the number.

In the IETF work, we have split  name and number.  We'll come up with the number solution first, and then work on name.  The name discussions are on a separate list (cnit).

Most of the bad calls we see are from what I usually call "pink" service providers.  They aren't actually complicit, but they look the other way as their subscribers spoof name and number.  They don't run FMS systems.  I am told that wholesale divisions of major carriers sometimes are the unwitting origination carrier, because there are many instances of permitted "spoofing" (call centers calling on behalf of another enterprise for example) which means they don't scrutinize calling party number on the wholesale side.  However, the majority of the bad calls come from these "pink" carriers.  

Brian

On Dec 10, 2013, at 5:38 PM, Travis Russell <HYPERLINK "mailto:[email-masked]"[email-masked]> wrote:

From: Brian Rosen [mailto:[email-masked]] 
Sent: Tuesday, December 10, 2013 5:25 PM
To: Travis Russell
Cc: HYPERLINK "mailto:[email-masked]"[email-masked] List
Subject: Re: [stir] Comments/Queries?

Brian

---

From: Brian Rosen <[email-masked]>
Date: Wed, 11 Dec 2013 08:46:32 -0500

Inline

> Agreed. But remember most of us use our cell phones these days, and the name comes from your address book based on number.
Not the problem calls - they aren’t in your address book.

> Calling name will be a challenge since the service providers providing CNAM services to the operators are challenged to get the names right. And if you send a correction to your own name it sometim…
Yes, there are quite a few challenges.  You might go back into the archive of the knit list (and this list just before we created cnit) where some solutions were proposed.
>  
> I like the label of “pink” service providers. There are also those that offer spoofing as a service. You call a freephone number, your call is terminated on the VoIP switch where you are asked for the number you want to appear, and the call re-originated. These come through as legitimate calls to the major service providers, and when tracing the call you can only trace as far back as the spoofing service. Perfectly legitimate companies by the way, as there is nothing illegal about spoofing your number.
The mechanisms we are discussing would stop this unless the spoofing service was authorized to place calls on the numbers it was using.

---

From: Michael Hammer <[email-masked]>
Date: Wed, 11 Dec 2013 15:26:56 +0000

AFAIK, the freephone SPs are authorized to originate the calls on those
numbers.

So, that is NOT spoofing.  Let's not water down the meaning of terms.

The goal is to stop someone from using numbers not assigned or delegated to
them.

Mike

From: stir [mailto:[email-masked]] On Behalf Of Brian Rosen
Sent: Wednesday, December 11, 2013 8:47 AM
To: Travis Russell
Cc: [email-masked] List
Subject: Re: [stir] Comments/Queries?

Inline

On Dec 11, 2013, at 6:50 AM, Travis Russell <[email-masked]>
wrote:

Thanks Brian,

Agreed. But remember most of us use our cell phones these days, and the name
comes from your address book based on number.

Not the problem calls - they aren't in your address book.

Calling name will be a challenge since the service providers providing CNAM
services to the operators are challenged to get the names right. And if you
send a correction to your own name it sometimes does not get fixed
permanently as the next bulk load reverts back to the old files.

Yes, there are quite a few challenges.  You might go back into the archive
of the knit list (and this list just before we created cnit) where some
solutions were proposed.

I like the label of "pink" service providers. There are also those that
offer spoofing as a service. You call a freephone number, your call is
terminated on the VoIP switch where you are asked for the number you want to
appear, and the call re-originated. These come through as legitimate calls
to the major service providers, and when tracing the call you can only trace
as far back as the spoofing service. Perfectly legitimate companies by the
way, as there is nothing illegal about spoofing your number.

The mechanisms we are discussing would stop this unless the spoofing service
was authorized to place calls on the numbers it was using.  

I only provide all this info because it is important for all of us to
understand the problem and how it manifests itself within service provider
networks.

-- 
 <http://www.oracle.com/> 
Travis Russell | Technologist, Sr. Mgr
Phone:  <tel:+1%209194602172> +1 9194602172 | Mobile:  <tel:+1%209194121167>
+1 9194121167 
Oracle CGBU Product Marketing
5200 Paramount Pkwy | Morrisville, North Carolina 27560

 <http://www.oracle.com/commitment> 

Oracle is committed to developing practices and products that help protect
the environment

What users look at for numbers they have not memorized is name.  They can't
tell anything from the number.

In the IETF work, we have split  name and number.  We'll come up with the
number solution first, and then work on name.  The name discussions are on a
separate list (cnit).

Most of the bad calls we see are from what I usually call "pink" service
providers.  They aren't actually complicit, but they look the other way as
their subscribers spoof name and number.  They don't run FMS systems.  I am
told that wholesale divisions of major carriers sometimes are the unwitting
origination carrier, because there are many instances of permitted
"spoofing" (call centers calling on behalf of another enterprise for
example) which means they don't scrutinize calling party number on the
wholesale side.  However, the majority of the bad calls come from these
"pink" carriers.  

Brian

On Dec 10, 2013, at 5:38 PM, Travis Russell <
<mailto:[email-masked]> [email-masked]> wrote:

Thanks Brian for the clarifications. The FMS I am referring to are the FSM
used by service providers that look for anomalies in subscriber behaviors.
These systems look at behaviors of inbound and outbound callers, and provide
alarms/flags to the fraud department when there is an anomaly occurring. One
"trick" used by fraud investigators is to assign dark numbers throughout
their number ranges. When the dark number is hit several times, it indicates
a hacker trying to create a hit list. There are a number of variations to
this technique but it is common for fraudsters to spend a fair amount of
time honing their hit lists prior to launching an attack.

The FMS also looks for short calls, velocity of calls, etc to identify
anomalies, and there are thresholds in the network that fraudsters
eventually discover to ensure they "fly under the radar" of these systems.
All of that said to make the point that fraudsters absolutely care about the
numbers being legitimate to prevent detection by the many systems put in
place by fraud departments.

In the case of the calling party name, is it thought that the name display
is critical to this process? My understanding is that the number itself is
the critical element, and the name is just a convenience provided to
subscribers. There are many errors in the calling name database so
personally I don't even pay attention to that anymore. The number on the
other hand is absolutely important. By the way, in wireless communications,
the calling party name is driven by the address book on the device itself,
and not CNAM.

I mention this because in the problem statement it sounds like the calling
party name is of equal importance to validation as the number.

-- 
 <http://www.oracle.com/> 
Travis Russell | Technologist, Sr. Mgr
Phone:  <tel:+1%209194602172> +1 9194602172 | Mobile:  <tel:+1%209194121167>
+1 9194121167 
Oracle CGBU Product Marketing
5200 Paramount Pkwy | Morrisville, North Carolina 27560

 <http://www.oracle.com/commitment> 

Oracle is committed to developing practices and products that help protect
the environment

From: Brian Rosen [ <mailto:[email-masked]> mailto:[email-masked]] 
Sent: Tuesday, December 10, 2013 5:25 PM
To: Travis Russell
Cc:  <mailto:[email-masked]> [email-masked] List
Subject: Re: [stir] Comments/Queries?

The caller name comes from a database queried by the calling telephone
number.  Usually, the display name in the SIP message is not used.  That's
not always true (enterprise internal PBX for example).  Certainly, if you
receive the call from a POTS phone, whatever is in the SIP signaling for
display name is not even available to the called party or her service
provider. 

The conventional implementation is the database is operated by the calling
service provider.  The called service provider dips the database with the
calling party TN obtained in the signaling.  

If you can spoof the calling party number, you can cause the name to be any
name that is already in the database.

The fraud management systems you are referring to sound like the ones
inbound systems call centers use to identify fraudulent inbound callers.
I'm not aware of any service provider attempting to identify fraudulent
callers on behalf of a typical residential or enterprise customer.

We have most certainly considered number portability in this system.  The
credentials will change when numbers port.  The old credential will become
invalid (or the coverage of the credential will change if the credential has
more than one TN associated with it).  A new credential will be issued, or
an existing credential will get another TN associated with it.

We did agree that we could have some delay of this (or, rather, that we
would not attempt to invalidate cacheing of credentials.  If, following a
port, the old holder could spoof the call for some minutes, or even hours,
that would probably be okay.

Brian

On Dec 10, 2013, at 3:31 PM, Travis Russell <
<mailto:[email-masked]> [email-masked]> wrote:

For numbers where the caller has suppressed textual caller identification,
number spoofing can be used to retrieve this information, stored in the
so-called Calling Name (CNAM) database.

It is my experience that spoofing is simply accomplished via VoIP servers
modifying the SIP fields. There are a number of ways this has been
facilitated - you can call a spoof service where the call is terminated on a
VoIP server, and when prompted enter the telephone number you want to appear
as the calling party (works great - I have tried this myself). The VoIP
server than re-originates the call and sends it to the called party with the
new "spoofed" identity.

I am not familiar with any cases where the spoofed identity was retrieved
from a SNAM server (although I may be wrong in this case).

For anonymization, the caller does not necessarily care whether the number
is in service, or who it is assigned to, and may switch rapidly and possibly
randomly between numbers.  Anonymization facilitates automated illegal
telemarketing or telephony denial-of-service attacks, as described above, as
it makes it difficult to blacklist numbers. 

A hacker or fraudster will typically use a "hit list" when doing this,
because fraud management systems look for calls to/from unassigned numbers
(many operators assign "dark numbers" in their number ranges to identify
hackers looking for assigned numbers). They will try to use assigned numbers
of legitimate subscribers to alleviate discovery by FMS or network "traps"
where dark numbers are assigned. It is the fact that they are using
legitimate subscriber identities that makes it impossible to black list,
because you are effecting the good subscribers service.

QUESTION: How will validation/verification work in the case of number
portability where a number once assigned to one operator is now assigned to
another operator? Has consideration been given to updates through the number
portability process in these cases or is this a mute point?

-- 
 <http://www.oracle.com/> 
Travis Russell | Technologist, Sr. Mgr
Phone:  <tel:+1%209194602172> +1 9194602172 | Mobile:  <tel:+1%209194121167>
+1 9194121167 
Oracle CGBU Product Marketing
5200 Paramount Pkwy | Morrisville, North Carolina 27560

 <http://www.oracle.com/commitment> 

Oracle is committed to developing practices and products that help protect
the environment

_______________________________________________
stir mailing list
 <mailto:[email-masked]> [email-masked]
 <https://www.ietf.org/mailman/listinfo/stir>
https://www.ietf.org/mailman/listinfo/stir

---

From: "Gorman, Pierce A [NTK]" <[email-masked]>
Date: Wed, 11 Dec 2013 16:06:42 +0000

Is the goal to prevent misuse or only to validate calling number where/when possible and therefore imply when potential misuse may have occurred (because of a lack of validation)?

Best regards,

Pierce Gorman

From: Michael Hammer [mailto:[email-masked]]
Sent: December 11, 2013 9:27 AM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Re: [stir] Comments/Queries?

AFAIK, the freephone SPs are authorized to originate the calls on those numbers.
So, that is NOT spoofing.  Let's not water down the meaning of terms.

The goal is to stop someone from using numbers not assigned or delegated to them.

Mike

From: stir [mailto:[email-masked]] On Behalf Of Brian Rosen
Sent: Wednesday, December 11, 2013 8:47 AM
To: Travis Russell
Cc: [email-masked]<mailto:[email-masked]> List
Subject: Re: [stir] Comments/Queries?

Inline
On Dec 11, 2013, at 6:50 AM, Travis Russell <[email-masked]<mailto:[email-masked]>> wrote:

Thanks Brian,

Phone: +1 9194602172<tel:+1%209194602172> | Mobile: +1 9194121167<tel:+1%209194121167>

From: Brian Rosen [mailto:[email-masked]]
Sent: Tuesday, December 10, 2013 5:46 PM
To: Travis Russell
Cc: [email-masked]<mailto:[email-masked]> List
Subject: Re: [stir] Comments/Queries?

Brian

On Dec 10, 2013, at 5:38 PM, Travis Russell <[email-masked]<mailto:[email-masked]>> wrote:

Phone: +1 9194602172<tel:+1%209194602172> | Mobile: +1 9194121167<tel:+1%209194121167>

From: Brian Rosen [mailto:[email-masked]]
Sent: Tuesday, December 10, 2013 5:25 PM
To: Travis Russell
Cc: [email-masked]<mailto:[email-masked]> List
Subject: Re: [stir] Comments/Queries?

Brian

On Dec 10, 2013, at 3:31 PM, Travis Russell <[email-masked]<mailto:[email-masked]>> wrote:

Phone: +1 9194602172<tel:+1%209194602172> | Mobile: +1 9194121167<tel:+1%209194121167>

_______________________________________________
stir mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/stir

________________________________

This e-mail may contain Sprint proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message.

---

From: Brian Rosen <[email-masked]>
Date: Wed, 11 Dec 2013 11:21:29 -0500

I think he was talking about services that let you show any number you want as calling party TN.  That would NOT be allowed with stir.

Brian

On Dec 11, 2013, at 10:26 AM, Michael Hammer <[email-masked]> wrote:

> So, that is NOT spoofing.  Let’s not water down the meaning of terms.
>

---

From: Brian Rosen <[email-masked]>
Date: Wed, 11 Dec 2013 11:22:39 -0500

Yes, although you recognize that we also have to deal with phase in, and situations such as PSTN-PSTN that we can’t realistically affect.

Brian

---

From: Michael Hammer <[email-masked]>
Date: Wed, 11 Dec 2013 16:41:39 +0000

Yeah, I guess to be more precise, 

allow receiver to know, when they can validate, that the number is good, 

or when they can't validate, to know that they don't know.

Mike

From: Brian Rosen [mailto:[email-masked]] 
Sent: Wednesday, December 11, 2013 11:23 AM
To: Gorman, Pierce A [NTK]
Cc: Michael Hammer; [email-masked]; [email-masked]
Subject: Re: [stir] Comments/Queries?

Yes, although you recognize that we also have to deal with phase in, and
situations such as PSTN-PSTN that we can't realistically affect.

Brian

On Dec 11, 2013, at 11:06 AM, Gorman, Pierce A [NTK]
<[email-masked]> wrote:

Is the goal to prevent misuse or only to validate calling number where/when
possible and therefore imply when potential misuse may have occurred
(because of a lack of validation)? 

Best regards,

Pierce Gorman

Mike

From: stir [ <mailto:[email-masked]> mailto:[email-masked]] On
Behalf Of Brian Rosen
Sent: Wednesday, December 11, 2013 8:47 AM
To: Travis Russell
Cc:  <mailto:[email-masked]> [email-masked] List
Subject: Re: [stir] Comments/Queries?

Inline

On Dec 11, 2013, at 6:50 AM, Travis Russell <
<mailto:[email-masked]> [email-masked]> wrote:

Thanks Brian,

 

 

Brian

Brian

 

  _____  

This e-mail may contain Sprint proprietary information intended for the sole
use of the recipient(s). Any use by others is prohibited. If you are not the
intended recipient, please contact the sender and delete all copies of the
message.

---

From: "Gorman, Pierce A [NTK]" <[email-masked]>
Date: Wed, 11 Dec 2013 17:08:56 +0000

Yes.  I think that is the goal.

Actual prevention of misuse implies far more than what can be practically achieved in a global context with a protocol implementation.

Pierce Gorman

From: Michael Hammer [mailto:[email-masked]]
Sent: December 11, 2013 10:42 AM
To: [email-masked]; Gorman, Pierce A [NTK]
Cc: [email-masked]; [email-masked]
Subject: RE: [stir] Comments/Queries?

Mike

Cc: Michael Hammer; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>

Yes, although you recognize that we also have to deal with phase in, and situations such as PSTN-PSTN that we can't realistically affect.

Brian

On Dec 11, 2013, at 11:06 AM, Gorman, Pierce A [NTK] <[email-masked]<mailto:[email-masked]>> wrote:

Best regards,

Pierce Gorman

From: Michael Hammer [mailto:[email-masked]]
Sent: December 11, 2013 9:27 AM
To: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [stir] Comments/Queries?

Mike

Inline

Thanks Brian,

Brian

Brian