FCC Will Mandate STIR/SHAKEN Caller ID Authentication The problem of illegal robocalls is getting worse. A recent report from Transactions Network Services (TNS) found that the number of such robocalls increased by 49 percent from 2018 to 2019 and grew even faster in the second half of 2019 than in the first. The average consumer received 325 unwanted robocalls in 2019, and in total, Americans receive more than 300 million robocalls each day.

As the volume of calls continues to increase, scammers are also going all-out in tactics that try to fool users into answering their calls. So-called “neighbor spoofing,” in which a recipient’s local exchange is spoofed, rose 40% year-over-year. Legitimate toll-free numbers are also being spoofed to disguise fraudulent calls, with high-risk calls from toll-free numbers more than doubling between 2018 to 2019 as robocall operations shifted from spoofing Voice over IP numbers to spoofing toll-free numbers. TNS found that they are “increasingly spoofing legitimate customer-care numbers from trusted brands to try to trick consumers. (RCR Wireless News, March 4, 2020).

In this environment, the FCC had no choice but to respond. Chairman Ajit Pai announced last week that on March 31st, the FCC will vote on and presumably approve new rules requiring the industry to implement caller ID authentication using the so-called “STIR/SHAKEN” technological standards.

SHAKEN/STIR is short for Signature-based Handling of Asserted information using toKENs for Secure Telephone Identity Revisited. It is a protocol that provides a digital signature for every call, so an illegitimate call is identified and blocked. STIR/SHAKEN utilizes digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure. It enables phone companies to verify the accuracy of caller ID information that is transmitted with a call. According to Pai:

Industry-wide implementation would reduce the effectiveness of illegal spoofing, allow law enforcement to identify bad actors more easily, and help phone companies identify calls with illegally spoofed caller ID information before those calls reach their subscribers All of us are fed up with robocalls—including me...We’ve taken many steps to stem the tide of spoofed robocalls. I’m excited about the proposal I’m advancing today: requiring phone companies to adopt a caller ID authentication framework called STIR/SHAKEN. Widespread implementation will give American consumers a lot more peace of mind when they pick up the phone. Last year, I demanded that major phone companies voluntarily deploy STIR/SHAKEN, and a number of them did. But it’s clear that FCC action is needed to spur across-the-board deployment of this important technology. There is no silver bullet when it comes to eradicating robocalls, but this is a critical shot at the target. (FCC March 6, 2020 News Release).

The Commission estimates that thanks to STIR/SHAKEN, the benefits of eliminating the wasted time and nuisance caused by illegal scam robocalls will exceed $3 billion annually. Moreover, when paired with call analytics, STIR/SHAKEN will help protect consumers from fraudulent robocall schemes that cost Americans approximately $10 billion annually.

The FCC decision to mandate STIR/SHAKEN does not come without controversy. After the agency asked carriers to adopt the protocol in June last year, only some complied. After years of robocall complaints, Congress finally got tired of waiting for the Commission to take mandatory action. Last December it adopted the Telephone Robocall Abuse Criminal Enforcement and Deterrence Act, better known as the TRACED Act. TRACED took steps in the battle against illegal robocalls including required the agency to require voice service providers to implement STIR/SHAKEN in their networks within 18 months of the law’s enactment. The TRACED Act also:

• Extended the FCC’s statute of limitations on robocall offenses and increases potential fines:
• Requires an annual FCC report on robocall enforcement and allows for it to formally recommend legislation:
• Prevents carriers from charging for STIR/SHAKEN, and shields them from liability for reasonable mistakes:
• Requires the Attorney General to convene an interagency task force to look at prosecution of offenders: and,
• Permits the Justice Department to prosecute offenders.

The new FCC mandate would require originating and terminating voice service providers to implement STIR/SHAKEN in the Internet Protocol (IP) portions of their networks by June 30, 2021. However, on March 31st, the Commission will also release a Further Notice of Proposed Rulemaking, which would propose giving one-year extensions of this deadline for small and rural providers. The Commission will also seek public comments on implementing other aspects of the TRACED Act, including requirements that voice service providers work toward deploying caller ID authentication in the non-IP parts of their networks.

Let us hope that STIR/SHAKEN is finally adopted by all carriers and quickly.