Since Congress adopted the TRACED Act last December, the FCC has been on the defensive when it comes to illegal robocalls. The TRACED Act, which is short for the Telephone Robocall Abuse Criminal Enforcement and Deterrence Act, grew out of Congressional frustration with the agency’s inability to stop such calls. In fact, their frequency was increasing. With TRACED, Congress required the Commission to mandate that all voice service providers must implement STIR/SHAKEN in their networks within 18 months of the law’s enactment.   

SHAKEN/STIR is short for Signature-based Handling of Asserted information using toKENs for Secure Telephone Identity Revisited. It is a protocol that provides a digital signature for every call, so an illegitimate call is identified and blocked. STIR/SHAKEN utilizes digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure. It enables phone companies to verify the accuracy of caller ID information that is transmitted with a call. Importantly, STIR/SHAKEN only operates with Internet Protocol (IP) networks. 

In March the FCC released a Report and Order in Docket 17-97 requiring voice providers to implement STIR/SHAKEN in the IP portions of their networks by June 30, 2021.  This week the Commission adopted a Second Report and Order (Order) further implementing the TRACED Act.  This Order concentrates on carriers with non-IP networks and intermediate carriers.  It would do the following: 

Require voice service providers to either upgrade their non-IP networks to IP and implement STIR/SHAKEN, or work to develop a non-IP caller ID authentication solution.  

Establish extensions of the June 30, 2021 caller ID authentication implementation deadline for small voice service providers, voice service providers that are currently incapable of obtaining a “certificate” necessary to implement STIR/SHAKEN, services scheduled for discontinuance, and non-IP networks. 

Require voice service providers subject to an extension to implement a robocall mitigation program on the non-STIR/SHAKEN-enabled portions of their networks. 

Require all voice service providers to file a certification in a Commission database showing how they are acting to stem the origination of illegal robocalls.  

Establish a process by which providers that make early progress on caller ID authentication implementation can obtain an exemption from the June 30, 2021 deadline, as required by the TRACED Act. 

Prohibit voice service providers from adding any line item charges to the bills of consumer or small business customer subscribers for caller ID authentication technology, as required by the TRACED Act.  

Require intermediate providers to implement the STIR/SHAKEN caller ID authentication framework in the IP portions of their networks by June 30, 2021. 

The most important part of the Order appears to be the requirement that voice providers must upgrade the portions of their networks to IP and implement STIR/SHAKEN or develop an alternative call authentication technology.  According to the Commission, a voice service provider will satisfy its obligations if it participates through a third-party representative such as a trade association of which it is a member or vendor, that is seeking non-IP solutions to identifying calls.   

Allowing for such representatives will reduce the burden of this obligation on individual voice service providers and minimize the potential negative impact of broad and inexpert participation identified in the record, while ensuring that all voice service providers remain invested in developing a solution for non-IP caller ID authentication.  A wider range of efforts will encourage a greater number of industry partnerships, increasing resource and information sharing and speeding the development of a non-IP solution.  (Draft Second Report and Order, Docket 19-17, at para. 26.). 

Moreover, the Commission will consider a “non-IP caller ID authentication framework to be effective only if it is: (1) fully developed and finalized by industry standards; and (2) reasonably available such that the underlying equipment and software necessary to implement such protocol is available on the commercial market. 

The Second Report and Order will become effective 30 days after it appears in the Federal Register.  Hopefully it will move the industry toward fully adopting workable call authentication procedures to stop illegal robocalls.