FCC Releases Request for Comment on Proposed Rule on Unlawful Robocalls and Call Blocking

Comments are due by Aug. 31, 2020.

The Federal Communications Commission is proceeding with a proposed rule on revisions to its rules implementing the Telephone Robocall Abuse Criminal Enforcement and Deterrence Act (TRACED Act) in a request for comment announced Friday .

It states: “The commission proposes to require voice service providers to respond to certain traceback requests, mitigate bad traffic when notified of such traffic by the commission, and implement effective measures to prevent new and renewing customers from using its network to originate illegal calls; to extend the safe harbor for blocking based on reasonable analytics including Caller ID authentication information to network-based blocking without consumer consent so long as the blocking is specifically designed to block calls that are highly likely to be illegal and is managed with sufficient human oversight and network monitoring to ensure that blocking is working as intended; and to require terminating voice service providers to provide a list of individually blocked calls that were placed to a particular number at the request of the subscriber to that number. These proposals, taken together, implement the TRACED Act and continue the commission’s fight against illegal and unwanted robocalls while taking further steps to ensure that wanted calls are protected.”

Comments are due on or before Aug. 31, 2020, and reply comments are due on or before Sept. 29, 2020.

In advance of Friday’s proposed rule, the FCC on July 16 voted to adopt an order on call blocking and labeling that includes two safe harbors for voice service providers and some protections for legitimate calls, ACA International previously reported.

During the meeting, the FCC also issued a Further Notice of Proposed Rulemaking (FNPRM) seeking comment on additional steps to protect consumers from robocalls and better inform them about provider blocking efforts. The notice specifically seeks comment on whether to obligate phone companies to better police their networks against illegal calls, and whether to require them to provide information about blocked calls to consumers for free. In addition, the notice seeks comment on notification and effective redress mechanisms for callers when their calls are blocked, and on whether measures are necessary to address the mislabeling of calls.

The July 31 proposed rule is a summary of the commission’s fourth FNPRM, in CG Docket No. 17-59, FCC 20-96, adopted on July 16, 2020, and released on July 17, 2020.

The contents of it were discussed in the open hearing and an FCC press release , providing insight into changes that were made from the draft.

Comments, identified by CG Docket No. 17-59, may be submitted online at http://apps.fcc.gov/​ecfs/​ .

FCC GRANTS SAFE HARBOR FOR ROBO CALL BLOCKING

July 2020

The Federal Communications Commission (FCC) has now approved “two safe harbors from liability for the unintended or inadvertent blocking of wanted calls, thus eliminating a concern that kept some companies from implementing robust robocall blocking efforts.”(https://docs.fcc.gov/public/attachments/DOC-365564A1.pdf).

The two safe harbors “are meant to provide further assurance to phone companies and allow them to strengthen their efforts in the battle against illegal and unwanted robocalls.” The FCC’s decision further implements provisions of the Pallone-Thune TRACED Act which became law last December.

The first safe harbor will protect phone companies that “use reasonable analytics, including caller ID authentication information, to identify and block illegal or unwanted calls from liability.”

The second safe harbor “protects providers that block call traffic from bad actor upstream voice service providers that pass illegal or unwanted calls along to other providers, when those upstream providers have been notified but fail to take action to stop these calls.”

The five FCC commissioners – also seeks comment on further rule changes to “protect consumers from robocalls and better inform them about provider blocking efforts.” A Fourth Further Notice of Proposed Rulemaking included in the decision seeks comment on (a) “whether to obligate phone companies to better police their networks against illegal calls, and … require them to provide information about blocked calls to consumers for free” and (b) “notification and effective redress mechanisms for callers when their calls are blocked, and on whether measures are necessary to address the mislabeling of calls.”

"American consumers are sick and tired of unwanted robocalls,

this consumer among them. Caller ID authentication

will be a significant step towards ending the scourge of spoofed robocalls.

It's time for carriers to implement robust caller ID authentication." – FCC Chairman Ajit Pai

How Will Caller ID Authentication Help Consumers?

Caller ID authentication is a new system aimed at combating illegal caller ID spoofing. Such a system is critical to protecting Americans from scam spoofed robocalls and would erode the ability of callers to illegally spoof a caller ID, which scammers use to trick Americans into answering their phones when they shouldn't. Additionally, consumers and law enforcement alike could more readily identify the source of illegal robocalls and reduce their frequency and impact. Industry stakeholders are working to implement caller ID authentication, which is sometimes called STIR-SHAKEN. Once implemented, it should greatly help the accuracy of caller ID information and should allow voice service providers to provide helpful information to their consumers about which calls to answer.

What Does STIR-SHAKEN Mean?

STIR-SHAKEN is a framework of interconnected standards. STIR-SHAKEN are acronyms for the Secure Telephone Identity Revisited (STIR) and Signature-based Handling of Asserted Information

Using toKENs (SHAKEN) standards. This means that calls traveling through interconnected phone networks would have their caller ID "signed" as legitimate by originating carriers and validated by other carriers before reaching consumers. STIR-SHAKEN digitally validates the handoff of phone calls passing through the complex web of networks, allowing the phone company of the consumer receiving the call to verify that a call is in fact from the number displayed on Caller ID.

What Is the FCC Doing?

The FCC is leading the push for industry adoption of these standards to help consumers as quickly as possible. The Commission prompted real progress in call authentication by starting a formal inquiry in July 2017, seeking public input on the best way to establish a reliable system to verify the caller ID information that appears on the recipient's phone. This resulted in a North American Numbering Council-recommended framework for implementing an industry-developed standard to help prevent illegal attempts to trick consumers through caller ID spoofing. STIR-SHAKEN should establish a reliable authentication system that will help strengthen call-blocking services and unmask spoofed calls.

In November 2018, Chairman Pai demanded that the phone industry adopt a robust call authentication system to combat illegal caller ID spoofing and implement that system within a year. Chairman Pai sent letters to the major voice providers asking them to outline their plans to protect their customers and implement the STIR-SHAKEN standards—and do so without delay. In February 2019, Chairman Pai welcomed many carriers' commitments to meeting his timeline for implementation, called on others to "catch up," and made clear that the FCC would consider regulatory intervention if necessary. In June 2019, the Commission adopted a Notice of Proposed Rulemaking, that proposed and sought comment on mandating implementation of STIR-SHAKEN if the end-of-2019 deadline wasn't met.

Chairman Pai also scheduled a STIR-SHAKEN Robocall Summit for July 11 to examine the industry's progress toward meeting his deadline and to identify any challenges to the deployment of the STIR-SHAKEN framework and discuss how best to overcome them. In March 2020, the Commission adopted new rules requiring all originating and terminating voice service providers to implement caller ID authentication using STIR-SHAKEN technological standards in the Internet

Protocol (IP) portions of their networks by June 30, 2021. The Commission also adopted a Further Notice of Proposed Rulemaking to take public comment on additional caller ID authentication rules.

June 09, 2020

Continuing its campaign against illegal robocalls, particularly the spoofed variety, the Federal Communications Commission (FCC) on June 9, 2020, proposed a $225 million fine – the “largest in the FCC’s 86-year history” – against “Texas-based health insurance telemarketers for apparently making approximately 1 billion illegally spoofed robocalls.”(https://docs.fcc.gov/public/attachments/DOC-364824A1.pdf).

The FCC accuses “John C. Spiller and Jakob A. Mears, who used business names including Rising Eagle and JSquared Telecom” in connection with Rising Eagle making “approximately 1 billion spoofed robocalls across the country during the first four-and-a-half months of 2019 on behalf of clients that sell short-term, limited-duration health insurance plans.”

In its lengthy and detailed Notice of Proposed Liability For Forfeiture (NALF) the agency outlines how the “The robocalls falsely claimed to offer health insurance plans from well-known health insurance companies such as Aetna, Blue Cross Blue Shield, Cigna, and UnitedHealth Group“ (https://docs.fcc.gov/public/attachments/FCC-20-74A1.pdf). According to the FCC’s investigation, which was assisted by the USTelecom Industry Traceback Group, a consumer who indicated an interest in speaking with a representative of one of those companies was “transferred to a call center with no affiliation to the named companies, where call center representatives then would attempt to convince the consumer to purchase an insurance product sold by one of Rising Eagle’s clients.”

Further, as a result of the spoofing, which the NALF asserts violated the Truth In Caller ID Act component of the Telephone Consumer Protection Act (TCPA), the FCC found that the calls “targeted millions of Do Not Call list participants, and were received on many wireless phones without prior consumer consent.” Moreover, “the scam also caused the companies whose caller IDs were spoofed to become overwhelmed with angry call-backs from aggrieved consumers. At least one company was hit with several lawsuits because its number was spoofed, and another was so overwhelmed with calls that its telephone network became unusable.”

The accused parties have 30 days to respond to the NALF with the FCC.

As a double down on the alleged violators, the State Attorneys General (AG) of seven states (Arkansas, Indiana, Michigan, Missouri, North Carolina, Ohio and Texas), on the same day, brought a parallel lawsuit under the Telephone Consumer Protection Act and relevant state consumer protection statutes in Federal District Court in Houston, Texas (https://www.mlive.com/public-interest/2020/06/michigan-attorney-general-joins-lawsuit-over-billions-of-illegal-robocalls.html). That lawsuit raises various TCPA violations, including caller ID spoofing, along with counts for violating state consumer protection statutes addressing, among other conduct, “false and deceptive acts.” The State AGs seek injunctive relief and $1500 per call for TCPA violations and costs. The plaintiffs also seek damages under their individual state statutes.

The collective actions further demonstrate the focus of both the FCC and state authorities on combatting illegal robocallers, particularly when caller ID spoofing is involved.

As the Federal Communications Committee (FCC) works to cut down on robocalls, a new mandate has been issued that will impact the Toll-Free Number (TFN) status in the SMS/800 TFN Registry.

Per the new rule, all disconnected numbers – including disconnected Toll-Free Numbers – may not go into SPARE status until forty-five (45) days after their date of disconnection. Please Note: The 4-month (120 days) maximum time before automatically returning to spare has not changed. The updated FCC rule is below.

The FCC will enforce this new rule change in the second quarter of 2020.

Voice service providers would be required to implement the called ID authentication under the proposal set for a vote March 31.

3/10/2020 FCCNEWS

The Federal Communications Commission issued its Report and Order and Further Notice of Proposed Rulemaking on mandating adoption of STIR-SHAKEN by voice service providers and additional measures to combat spoofed calls on Tuesday.

“This Report and Order and Further Notice of Proposed Rulemaking would take a critical step in the commission’s multi-pronged approach to ending illegal caller ID spoofing by requiring voice service providers to implement caller ID authentication technology,” it states.

Comments to the FCC are due May 15, 2020 and reply comments are due May 29, 2020.

FCC Proposed Requirements for Voice Service Providers

According to the FCC the order would: “require originating and terminating voice service providers to implement the STIR-SHAKEN caller ID authentication framework in the Internet Protocol (IP) portions of their networks by June 30, 2021, a deadline that is consistent with the TRACED Act, which was recently passed by Congress.”

Additional Caller ID Authentication Proposals in the Further Notice Include:

• Propose to implement caller ID authentication and other provisions of the Telephone Robocall Abuse Criminal Enforcement and Deterrence (TRACED) Act, including through proposals to: Grant an extension for compliance with the STIR-SHAKEN implementation mandate for small voice service providers so long as those providers implement a robocall mitigation program.

• Propose to implement caller ID authentication and other provisions of the TRACED Act, including through proposals to:

- Grant an extension for compliance with the STIR-SHAKEN implementation mandate for small voice service providers so long as those providers implement a robocall mitigation program.

- Require voice service providers using non-IP technology to either (i) upgrade their networks to IP to enable STIR-SHAKEN implementation, or (ii) work to develop non-IP caller ID authentication technology and implement a robocall mitigation program in the interim.

- Establish a process by which a voice service provider may be exempt from the STIR-SHAKEN implementation mandate if the provider has achieved certain implementation benchmarks.

- Prohibit voice service providers from imposing additional line item charges on consumers and small businesses for caller ID authentication.

The proposed rules build on FCC Chairman Ajit Pai’s request last year for phone companies to voluntarily implement STIR-SHAKEN and the Telephone Robocall Abuse Criminal Enforcement and Deterrence (TRACED) Act signed into law in 2019.

The TRACED Act directs the FCC to require voice service providers to implement STIR-SHAKEN in their networks within 18 months of the law’s enactment, according to a news release from the FCC . The FCC will vote on these new rules during its March 31 meeting .

United States of America

Federal Comnunications Commission

February 4, 2020

VIA CERTIFIED MAIL - RETURN RECEIPT REQUESTED

To:

Official Correspondence from the Federal Communications Commission

Re:

Dear Mr.

We are writing to encourage _____________ to assist the Federal Communications Commission

in stopping the flow of malicious robocalls originating from sources outside the United States.

Combatting harmful and abusive robocallers is the Commission's top consumer protection priority.

Unfortunately, many of the worst offenders originate overseas. Using "spoofed" and falsified numbers, foreign robocallers often pose as American companies, and even the U.S. government, in order to deceive and defraud American consumers.

Over the last year, one of the most prominent phone scams has involved individuals

impersonating agents from the Social Security Administration to trick people into divulging personal information or transferring money .1 In addition to falsely claiming to be government representatives, these callers often use spoofing technology to make the caller ID look like a government number. This scam cost consumers more than $19 million in the last year.2 There is good reason to believe that most of these "Social Security" calls came from foreign call centers.

Tracebacks by the USTelecom Industry Traceback Group and the Commission have found that

_____________ is being used as a gateway into the United States for many apparently illegal

robocalls that originate overseas. As the point of entry for this traffic into the U.S. telephone network, _____________ is uniquely situated to assist government and industry efforts to combat

illegal robocalls. Congress recently addressed the importance of industry efforts to trace back such calls to their origin in the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement Deterrence Act (TRACED Act) by directing the Commission to register a consortium to conduct private-led efforts to trace back suspected unlawful robocalls. Congress also encouraged the Commission to take appropriate enforcement actions for voice service providers that do not participate in private-led efforts to trace back the origin of suspected unlawful robocalls or that originate or terminate substantial amounts of unlawful robocalls. We encourage _______ to take measures to prevent the flow of apparently illegal traffic originating outside the United States.

In furtherance of this objective, the Commission requests information about business practices

regarding the foreign traffic that your company carries. Pursuant to our authority under Sections 227 and 403 of the Communications Act (47 U.S.C. §§ 227,403), we request that you provide responses to the following questions:

1. What technical and procedural processes does _________have in place to detect or identify

call traffic that is likely to be illegal, particularly for calls with foreign origination (e.g.,

detecting unusual call patterns or large call volumes)?

2. What procedures does __________ employ to ensure that the Caller ID information

associated with foreign call traffic ha􀁑 not been unlawfully spoofed?

3. What percentage of your company's traffic comes from foreign sources?

4. What percentage of your clients are located in a country other than the United States?

5. Does ________ advertise its services in foreign countries?

6. Have you taken any actions in the last six months to either terminate or restrict foreign traffic

that you suspected to be illegal?

We request your detailed response by February 17, 2020. That response should be sent

electronically to S__ Y__ at __________@fcc.gov.

If we hope to stop the spread of robocalls, providers and government agencies must work

together. We encourage _____________to remain vigilant, and we will continue to monitor your

cooperation with public and private efforts to identify the actors behind foreign robocalls and take lawful actions to thwart unwanted and unlawful traffic.

Sincerely,

Enforcement Bureau

UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

WASHINGTON, DC 20580

Bureau of Consumer Protection

Division of Marketing Practices Associate Director

January 29, 2020

Warning Regarding Assisting and Facilitating Illegal Robocalls

Dear [____________]:

This letter is to provide you with information about laws and regulations enforced by the

Federal Trade Commission (“FTC”) that may bear upon your business activities as a Voice over

Internet Protocol (“VoIP”) service provider.

The FTC, the nation’s consumer protection agency, enforces the Federal Trade

Commission Act (“FTC Act”), 15 U.S.C. § 45, which prohibits unfair or deceptive acts or

practices in or affecting commerce. The FTC also enforces the Telemarketing Sales Rule

(“TSR”), 16 C.F.R. Part 310, which prohibits deceptive and abusive telemarketing practices.

Section 310.3(b) of the TSR prohibits “assisting and facilitating” certain specified conduct.1

Under that provision, “it is unlawful for any person or entity to provide substantial assistance or

support to a seller or telemarketer when that person or entity knows or consciously avoids

knowing that the seller or telemarketer is engaged in any act or practice that violates Sections

310.3(a), (c), or (d), or Section 310.4 of the TSR,” which prohibit, among other conduct, the

following:

• Making a false or misleading statement to induce any person to pay for goods or

services or to induce a charitable contribution (16 C.F.R. § 310.3(a)(4));

• Misrepresenting a seller or telemarketer’s affiliation with any government agency (16

C.F.R. § 310.3(a)(2)(vii));

• Transmitting false or deceptive caller ID numbers (16 C.F.R. § 310.4(a)(8));

• Initiating or causing the initiation of calls that deliver prerecorded messages, unless

the person called provided the seller express written permission to call (16 C.F.R. §

310.4(b)(v)); and

• Initiating or causing the initiation of telemarketing calls to numbers listed on the

National Do Not Call Registry, unless the person called provided express written permission.

We also want to bring to your attention that the FTC recently sued a VoIP service

provider for allegedly violating the TSR, 16 C.F.R. Part 310. In that case, FTC v. Educare, the

FTC alleged that defendant Globex Telecom, Inc. assisted and facilitated telemarketers it knew,

or consciously avoided knowing, were violating the TSR’s prohibitions on calls delivering

prerecorded messages.

In addition to FTC regulations and the FTC’s December 2019 action against a provider of

VoIP services, you should also be aware that the United States Department of Justice (“DOJ”)

recently brought civil actions against two VoIP companies and their owners. In those cases, DOJ

alleged that the defendants were committing and conspiring to commit wire fraud by knowingly

transmitting robocalls that impersonated federal government agencies.

We hope you will review this letter and the attached materials in detail. Please direct any

inquiries regarding this letter to ________@ftc.gov or (202) 326-3120.

A copy of the FTC’s Amended Complaint is attached as Appendix B.

Sincerely,

Associate Director

Appendix A (TSR)

Appendix B (Educare Amended Complaint)

January 30, 2020

Federal Trade Commission staff sent letters to 19 Voice over Internet Protocol (VoIP) service providers warning them that “assisting and facilitating” illegal telemarketing or robocalling is against the law.

“VoIP service providers play a unique role in the robocall ecosystem, allowing fraudsters and abusive telemarketers to call consumers at a fraction of a penny per minute,” said FTC Bureau of Consumer Protection Director Andrew Smith. “These warning letters put VoIP providers on notice that we will take action when they knowingly facilitate illegal robocalls.”

The letters warn the VoIP service providers that the FTC may take legal action against them if they assist a seller or telemarketer who they know, or consciously avoid knowing, is violating the agency’s Telemarketing Sales Rule (TSR). The FTC is not disclosing the names of the companies and/or individuals to whom it sent the warnings.

The letters note several types of conduct that may violate the TSR, including:

· making a false or misleading statement to induce a consumer to buy something or contribute to a charity;

· misrepresenting a seller or telemarketer’s affiliation with any government agency;

· transmitting false or deceptive caller ID numbers;

· initiating pre-recorded telemarketing robocalls, unless the seller has express written permission to call; and

· initiating telemarketing calls to consumers whose phone numbers are on the National Do Not Call Registry, with certain exceptions.

The letters stress that combatting illegal telemarketing is a top priority of the Commission, with a special emphasis on stopping illegal robocalls. They cite two cases the FTC has brought in this area, one against a defendant named James B. Christiano and another against a VoIP service provider called Globex Telecom.

The FTC can seek civil penalties and court injunctions to stop TSR violations. It also can seek money to refund to consumers who were defrauded via illegal telemarketing calls.

The Federal Trade Commission works to promote competition, and protect and educate consumers. You can learn more about consumer topics and file a consumer complaint online or by calling 1-877-FTC-HELP (382-4357). Like the FTC on Facebook, follow us on Twitter, read our blogs, and subscribe to press releases for the latest FTC news and resources.

FCC to require anti-robocall tech after “voluntary” plan didn’t work out

Pai follows Congress' orders, requires carriers to verify Caller ID accuracy.

JON BRODKIN - 3/6/2020, 2:16 PM

Phone companies would be required to deploy technology that prevents spoofing of Caller ID under a plan announced today by Federal Communications Commission Chairman Ajit Pai.

Pai framed it as his own decision, with his announcement saying the chairman "proposed a major step forward... to protect consumers against spoofed robocalls." But in reality the FCC was ordered by Congress and President Trump to implement this new rule. The requirement on the FCC was part of the TRACED Act that was signed into law in December 2019. Pai previously hoped that all carriers would deploy the technology voluntarily.

"I'm excited about the proposal I'm advancing today: requiring phone companies to adopt a caller ID authentication framework called STIR-SHAKEN," Pai said in his announcement. "Widespread implementation will give American consumers a lot more peace of mind when they pick up the phone." The FCC will vote on the measure at its March 31 meeting.

The STIR and SHAKEN protocols use digital certificates, based on public-key cryptography, to verify the accuracy of Caller ID. STIR-SHAKEN would work best if all phone companies adopt it because it can only verify Caller ID when both the sending carrier and receiving carrier have deployed the technology. Robocallers who spoof real numbers to hide their identities would get flagged by STIR-SHAKEN. Depending on how each carrier implements it, flagged calls could be passed on to consumers with a warning or be blocked entirely.

FURTHER READING

Ajit Pai orders phone companies to adopt new anti-robocall tech in 2019

Carriers have already been adopting STIR-SHAKEN, but Pai said not all companies have done so. "Last year, I demanded that major phone companies voluntarily deploy STIR-SHAKEN, and a number of them did," Pai said. "But it's clear that FCC action is needed to spur across-the-board deployment of this important technology."

STIR-SHAKEN can be used by mobile phone providers and home VoIP services, but landline providers have said they can't deploy it on the older TDM services that run on traditional copper phone lines. That won't change with the FCC action, as the underlying US law and Pai's proposal only "require originating and terminating voice service providers to implement STIR-SHAKEN in the Internet Protocol (IP) portions of their networks."

The requirement would apply to big carriers by June 30, 2021 and to small and rural providers one year later. In addition to mobile providers, companies that offer IP-based phone service over cable or fiber lines would have to comply.

Robocalls from outside US a major problem

While STIR-SHAKEN might help reduce robocalls or slow their growth, it's not enough on its own to solve the large and complicated robocall problem. For one thing, a lot of robocalls originate from overseas. The FCC recently sent letters to seven US-based voice providers "that accept foreign call traffic and terminate it to US consumers," saying these companies' services are "being used as a gateway into the United States for many apparently illegal robocalls that originate overseas." In a related action, the Department of Justice sued two small companies that allegedly connected hundreds of millions of fraudulent robocalls from Indian call centers to US residents.

FURTHER READING

FCC accuses carriers of being “gateways” for foreign robocallers

The new US law that ordered the FCC to require SHAKEN/STIR gave the FCC discretion on how to regulate calls from overseas. Congress told the FCC to "consider" how the commission can "establish obligations on international gateway providers that are the first point of entry for these calls into the United States, including potential requirements that such providers verify with the foreign originator the nature or purpose of calls before initiating service." But it's up to the FCC on whether to take further action on that point.

We asked Pai's office if his plan will have any impact on spoofed calls that originate from overseas and will update this article if we get an answer. The full text of Pai's plan hasn't been released yet.

Dec 31 2019

Trump signs the TRACED Act, the first federal anti-robocall law

The law implements new consumer protections, gives more teeth to law enforcement efforts and takes other steps to combat unwanted robocalls.

President Trump this week signed the TRACED Act, the first federal law designed to curb unwanted robocalls. With the problem of robocalls running rampant, the legislation passed with strong support in both the Democratic-led House and the Republican-led Senate.

The legislation takes on the problem from multiple fronts. First, it gives the Federal Communications Commission (FCC) more authority to go after the scammers responsible for unwanted robocalls. It allows the FCC to go after scammers the first time they break the law and extends the statute of limitations by up to four years in some cases. It also ups the financial penalties against robocallers.

Additionally, it encourages stronger Justice Department criminal prosecution of unlawful robocalls by requiring the FCC to provide the DOJ with evidence of criminal robocall violations.

Next, the law requires all carriers to eventually implement new technologies to authenticate caller-ID information, preventing call spoofing -- at no additional line-item cost to consumers. As Congress notes in its summary of the law, many illegal robocalls use call spoofing so the call appears to be coming from a trusted number.

The FCC is already planning to mandate that carriers implement its SHAKEN/STIR authentication system to help combat robocalls. In March, AT&T and Comcast announced that they successfully tested the first SHAKEN/STIR-authenticated call between two different telecom networks.

Meanwhile, the law additionally says consumers should also get access to robocall blocking at no additional line item charge on their bill.

The law also requires the FCC to put new limits on robocalls that are legal, even without consumer consent -- such as calls from financial institutions regarding potentially fraudulent transactions. Specifically, the law calls for new limits on the kinds of organizations that may make such calls, who can receive such calls and the number of calls allowed under the exemption.

The TRACE Act also clarifies that when a person gets a new phone number, robocallers cannot keep calling to look for the person previously had that number.

It also requires the FCC to work to stop one-ring scams and helps the FCC and carriers trace back the origin of unlawful robocalls.

The law passed in the House earlier this month by a vote of 417 to 3, and it passed in the Senate by voice vote.

During the legislative debate, Congress put out a white paper with data on the extent of the robocall problem: In 2018, there were an estimated 48 billion robocalls, up over 64 percent since 2016, according to YouMail. Meanwhile, First Orion predicts that this year 44.6 percent of all calls to mobile phones will be scam calls.

In a statement, the cloud communications company Twilio said the legislation should have a notable impact: "The law will aid efforts among law enforcement authorities, government agencies and the communications industry to stop the bad calls and restore consumers' faith that they will receive the calls they want. With its strong emphasis on the implementation of the SHAKEN/STIR protocol and consumer protection efforts, we expect to see a dramatic change in the robocall landscape in the next 12 to 18 months."

December 2019

Section-by-Section Summary

Pallone-Thune TRACED Act

The Pallone-Thune TRACED Act is bipartisan, bicameral legislation that is supported by Chairman Frank Pallone, Jr. (D-NJ), Sen. John Thune (R-SD), Ranking Member Greg Walden (R-OR), Sen. Ed Markey (D-MA), Communications and Technology Subcommittee Chairman Mike Doyle (D-PA) and Ranking Member Latta (R-OH). The legislation will turn back the tide of illegal robocalls.

Americans are receiving more illegal robocalls than ever before. In 2018, there were an estimated 48 billion robocalls, up over 64 percent since 2016, according to YouMail. First Orion predicts that this year 44.6 percent of all calls to mobile phones will be scam calls. In 2018, the Federal Communications Commission (FCC or Commission) received 232,000 consumer complaints of unwanted calls, a nearly 35 percent increase since 2015.

Section 1

This section names the bill the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act (Pallone-Thune TRACED Act).

Section 2

The section defines the term “Commission” to mean the Federal Communications Commission.

Section 3

Consistent, sustained enforcement is key for making sure illegal robocallers stop their practices.

Under the law today, the FCC has a short statute of limitations to bring robocall violations, and the Commission is barred by process requirements from going after first time offenders. A longer statute of limitations, a streamlined process for going after illegal robocallers, and authority to impose greater fines, will help deter bad actors.

This section allows the FCC to go after scammers the first time they break the law and extends the statute of limitations by up to four years in some cases, in order to give the FCC and law enforcement agencies enough time to prosecute illegal robocallers. It adds an additional penalty for intentional violations of up to $10,000. It further requires the FCC to issue an annual report to Congress on illegal robocallers detailing its enforcement activities so Congress can make sure the robocalling problem is being addressed. The report also requires the FCC to provide Congress with proposals for decreasing the number of robocalls through additional legislation.

Section 4

Many of the illegal robocalls that are made today are done using disguised caller-ID, so the call looks like it is coming from a trusted source.

Prepared by the Committee on Energy and Commerce

This section requires all carriers, over time, to implement a new technology to make sure that caller-ID information is appropriately authenticated with no additional line item charge for consumers on their bill. It also helps ensure rural parts of the country with older technology are not left behind. Specifically, this section requires the FCC to recognize the burdens and barriers to adopting this technology across the country and to address those barriers. To the extent some carriers need additional time to implement this technology, the FCC will find alternative methodologies for authenticating calls, and those carriers will need to implement separate robocall mitigation strategies. This provision also includes a safe harbor to help incentivize carriers to authenticate calls and block unlawful robocalls, where appropriate.

Section 5

Robocalls are on the rise, and the government must be better coordinated in enforcing the important laws that protect consumers from unlawful calls.

This section requires the Attorney General, in consultation with the FCC, to convene an interagency task force to study the government prosecution of robocall violations. Among other things, the task force will: (1) determine how federal law and budgetary constraints inhibit enforcement of the robocall violations; (2) identify existing and additional policies and programs to increase coordination between federal departments and agencies and the states for enforcing and preventing violations of the robocall violations; and (3) identify existing and potential international policies and programs to improve coordination between countries in enforcing robocall violations and similar laws.

Section 6

Robocallers sometimes get access to numbers from the FCC.

This section requires the FCC to determine how its policies regarding access to number resources could be modified to reduce the number of illegal robocallers.

Section 7

To ensure that new technologies are used to best protect consumers, the FCC needs to put consumers first.

This section requires the FCC to complete a rulemaking within one year to help protect consumers from receiving unwanted calls or text messages, using in part, new methods for authenticating calls, while also protecting those that do not have access to call authentication.

Section 8

Under current law, some robocalls can be made without consent, but consumers need to be protected from receiving too many calls from too many people.

Section 8 requires the FCC to implement consumer protections on the FCC’s exempted classes of robocalls. These consumer protections must specifically include limits on:

(1) the classes of parties that may make such calls,

(2) the classes of parties that may be called, and

(3) the number of calls allowed under the exemption.

Prepared by the Committee on Energy and Commerce

Section 9

Too often consumers receive a torrent of robocalls that are intended for the person that previously had their phone number.

This section requires the FCC to issue a report to Congress to ensure the FCC is quickly making available the reassigned number database it agreed to implement in December of 2018. This section also clarifies that when a consumer gets a new phone number, robocallers cannot keep calling to look for the person that had that phone number before.

Section 10

Consumers should to have access to robocall blocking at no additional line item charge on their bill, and there needs to be transparency and redress for consumers and callers when a call is blocked.

This section makes sure those services are offered with no additional line item charge on their bill and that consumer and callers have transparency as to when a number has been blocked and effective redress. This section also ensures important calls like those from public safety are not wrongly blocked.

Section 11

Many robocallers have not been deterred by civil penalties against unlawful robocalls. There are criminal penalties against certain types of robocalling, and the Department of Justice (DOJ) should take a more active role in prosecuting scammers and fraudsters.

This section requires the FCC to submit evidence of certain criminal robocall violations to the DOJ for criminal prosecution and would require the FCC to publish a report annually disclosing how frequently the FCC submitted such evidence in an effort to increase criminal prosecutions by the DOJ.

Section 12

One-ring scams are when an overseas scammer makes a call to a consumer’s number attempting to induce the consumer to call the scammer’s number back, potentially resulting in hefty charges.

This section requires the FCC to initiate a proceeding to protect consumers from one-ring scams, including by working with foreign governments to address one-ring scams and by incentivizing carriers to stop calls made to perpetrate one-ring scams, among other things.

Section 13

In recent years, carriers have banded together to coordinate and trace back the origin of unlawful robocalls. However, many carriers still do not participate and the process could be better used to enforce laws that protect us from unlawful calls.

This section requires the FCC to register a consortium of companies engaged in private-led efforts to trace back the origin of suspected unlawful robocalls. It creates a certification process for when carriers have or

Prepared by the Committee on Energy and Commerce

have not participated in a private-led effort to traceback the origin of a suspected unlawful robocall. This section also requires the FCC to publish a report on the participation by carriers in private-led efforts to trace back the origin of suspected unlawful robocalls and take appropriate enforcement action.

Section 14

Robocalls have particularly plagued hospitals recently, including by robocalling doctors while they are on-call and calling patients disguised as hospital officials to solicit sensitive information about the patient or family.

This section requires the FCC to establish a Hospital Robocall Working Group to, among other things, issue best practices to help voice service providers combat unlawful robocalls made to hospitals and to help hospitals protect themselves from robocalls. It also requires the FCC to initiate a proceeding to determine whether the voluntary adoption of the practices can be facilitated.

Section 15

This section specifies that if any provision of this act, or the amendments made by this act, are found to be invalid, the remainder of the bill shall not be affected.

NTCA discusses barriers to SHAKEN faced by rural carriers

JANUARY 20, 2020

In a meeting with the FCC on January 14, 2020, the NTCA explained that 93% of its members have IP-enabled switches, yet most are unable to participate in STIR-SHAKEN. The problem is not a lack of IP-enabled equipment. The problem, says the NTCA, is that upstream carriers are unwilling to exchange voice traffic with rural carriers over IP.

The NTCA also observed statements in filings by large nationwide carriers indicating that they intend that “IP interconnection will take place on a nationwide basis, and at a relatively small number of places.” The result of this approach, says the NTCA, is that rural providers would be “required to deliver calls to distant points of interconnection that may be several states and hundreds or even thousands of miles away from the rural area where such calls originate.”

That’s why rural carriers are forced to use TDM, and that’s why they can’t participate in STIR-SHAKEN. The rules of the road need to change, says the NTCA.

The NTCA also raised issues with intercarrier compensation. In an all-IP world, rural providers would be forced to bear the full cost of transport for voice traffic without any universal service support. The economics threaten universal service, which has long been a policy goal in telecommunications.

Finally, the NTCA noted that there are no alternatives in place for authenticating calls that originate and/or terminate on TDM networks. This raises significant risk that legitimate calls from rural customers will go unanswered. It also raises risks that spoofers will use rural telephone numbers.

NTCA proposals

To address these problems, the NTCA urged the FCC should do two things:

1. Promote IP interconnection by adopting a simple default rule that would maintain existing interconnection points and transport responsibilities for voice calls between operators, regardless of whether a call is exchanged in TDM or IP.
2. Increase efforts to address authentication alternatives on TDM networks.

Further details are available in the NTCA’s ex parte filing.

California enacts law to mandate STIR-SHAKEN

OCTOBER 7, 2019

The governor of California, Gavin Newsom, signed the Consumer Call Protection Act of 2019 on October 2, 2019. This law requires telecommunications service providers to implement STIR-SHAKEN on or before January 1, 2021.

The legislation was brought forward by California Senator Ben Hueso (D-San Diego).

“Fraud by robocallers is the number one consumer complaint in the country, and the volume of these calls has increased dramatically in recent years,” said Sen. Hueso, Chair of the Senate Energy, Utilities and Communications Committee. “The surge in illegal robocalls disproportionately impacts Californians, who receive the second highest number of robocalls in the nation. The State must take steps to ensure that its consumers can reliably answer their telephones without the fear of fraud.”

The new law states that “nothing in this act requires a telecommunications service provider to employ call blocking.”

The legislation updates the California Public Utilities Code.

FCC chief says

Proposed new rules would extend robocall blocking to international calls and text messages.

JULY 8, 2019 11:16 AM PDT

Robocalls could be blocked from international callers and text messages.

Josh Miller/CNET

Federal Communications Commission Chairman Ajit Pai has proposed another set of robocall rules, this time to ban malicious calls that spoof caller IDs in text messages and international calls. The FCC will vote on the anti-spoofing rules on Aug. 1, and they already have the support of more than 40 state attorneys general, Pai said Monday.

These new rules would close the loopholes in targeting international callers, including one-way interconnected VoIP calls, and scammers using text messaging. They are part of the FCC's "multi-pronged approach to battle the noxious intrusion of illegal robocalls, as well as malicious caller ID spoofing," Pai said. Last month, the FCC voted unanimously on a proposal to give mobile phone companies greater power to "aggressively block" unwanted robocalls.

According to Pai, robocalls often come from overseas, with scammers spoofing their numbers to trick people into answering. "Call center fraudsters often pretend to be calling from trusted organizations and use pressure tactics to steal from Americans," he said.

The rules aim to extend the Truth in Caller ID Act to text messages or international calls as intended under the passage of the Ray Baum's Act last year.

According to the FCC, the Ray Baum's Act gave the agency the authority to broaden bans on illegal spoofing to text messages, calls originating outside the US, and calls using voice over IP. The Truth in Caller ID Act passed in 2009 already prohibits misleading or inaccurate caller ID "spoofing" with the intent to defraud for domestic callers, the agency said. But it doesn't apply to text messages or international calls.

A senior FCC official said on a call with press that Congress needed to give explicit authority to federal agencies to allow them to police bad actors overseas. That's what the Ray Baum's Act did. The FCC's proposed regulation takes advantage of that authority.

The Federal Trade Commission has already had some success targeting domestic offenders under other statutes. In March, the FTC shut down four companies for illegally spoofing numbers to pitch debt-relief services, home security systems, fake charities, auto warranties and Google search results services.

July 2019

The Federal Communications Commission (FCC) is warning consumers about a recent wave of robocall scams in which a user's phone rings once before the caller hangs up.

The agency issued a warning last week about the "One Ring" or "Wangiri" calls, urging those targeted by the scam not to call the numbers back.

"These calls are likely trying to prompt consumers to call the number back, often resulting in per minute toll charges similar to a 900 number," the FCC said. "Consumers should not call these numbers back."

The robocaller may dial a consumer's number repeatedly and hope the target calls back, the FCC said.

The FCC said the recent wave of calls appeared to be using the "222" country code of Mauritania in West Africa. Recent calls have been targeted at consumers in New York state and Arizona, the agency said.

The FCC in February issued a report that found U.S. phones were hit by 48 billion robocalls last year. The report predicted that almost 50 percent of all calls made to U.S. cellphones this year will be spam.

Lawmakers have attempted to combat the surge in robocalls.

Sens. John Thune (R-S.D.) and Sen. Ed Markey (D-Mass.) reintroduced legislation earlier this year called the Telephone Robocall Abuse Criminal Enforcement and Deterrence (TRACED) Act, which would give the federal government the authority to slap offenders with fines of up to $10,000 per call.

TAGS JOHN THUNE ED MARKEY ROBOCALLS SCAMS FCC

by Michaela Chesin

Arizona Republic

August 4, 2020

The settlement of a Department of Justice lawsuit against two companies owned by a Paradise Valley couple is awaiting court approval.

A Phoenix couple accused of facilitating hundreds of millions of fraudulent robocalls would be prohibited from ever operating a telecom business under a proposed settlement with the U.S. Department of Justice.

It is a first-of-its-kind effort by the Justice Department to hold a telecom carrier responsible as a facilitator of fraud schemes.

The DOJ alleged that Nicholas and Natasha Palumbo, operating as VoIP carriers, transmitted calls from entities to other carriers within the United States, and ultimately individual phones. The DOJ alleged foreign-based call centers, which fraudulently claimed to be affiliated with government and business entities, used the service to place robocalls to U.S. victims.

“The defendants also sold U.S. phone numbers to foreign entities, which were used as victim call-back numbers as part of massive robocalling fraud schemes,” the Department of Justice wrote in a March news release.

The defendants allegedly were warned numerous times that they were facilitating fraudulent robocalls and yet continued to enable the fraud schemes targeting individuals in the United States, according to the news release.

Settlement of the DOJ's lawsuit against Nicholas and Natasha Palumbo'stelecommunications companies is awaiting court approval.

Under the proposed settlement, the Palumbos’ admit no wrongdoing. Nor are they required to pay a fine or provide restitution to victims. But the settlement prohibits them from operating a VoIP business or providing toll-free services.

VoIP, or Voice over Internet Protocol, allows phone calls to be made over the internet.

“Everybody should be really happy to see the Palumbo case because it’s the Justice Department treating carriers that don’t actively try to stop fraud as being part of the fraud,” said Alex Quilici, founder of YouMail, a California-based developer of voicemail and robocall blocking software. The company's database of robocalls helped the government collect evidence against the Palumbos'.

“It should stop the worst of these calls from getting through over time,” he said.

The proposed settlement follows a U.S. Supreme Court decision reinforcing the ban on robocalls in July. In December 2019, President Trump also signed a bill into law giving authorities more enforcement powers intended to speed up measures the industry has taken to identify robocalls.

United States v. Palumbo

Nicholas Palumbo and Natasha Palumbo own Ecommerce National, which does business as TollFreeDeals.com and SipRetail.com.

The DOJ claims the Palumbos used the companies, operated out of their Paradise Valley home, as intermediaries between foreign fraudsters and American consumers.

The feds received a preliminary injunction in March, forcing the Palubmos’ to cease operation.

In their lawsuit, authorities allege the Palumbos’ companies were “gateway carriers,” providing access to fraudsters whose schemes resulted in massive financial losses to elderly and vulnerable victims. Gateway carriers are typically paid for each call they connect to U.S. phone systems, according to court filings.

The fraudsters are often located at call centers abroad, mostly operating out of India, according to court filings. Many impersonate U.S. government officials, foreign government officials or well-known American businesses.

The DOJ claims the Palumbos knowingly facilitated millions of these robocalls.

Court filings detail the experience of several victims.

One was an 84-year-old retired Marine who lost more than $9,000 after fraudsters told him they were with the Social Security Administration and that a car in Houston had been rented using his Social Security number. The fraudsters told him the vehicle had been found by local police with evidence of drugs and money laundering. He was told there was a warrant for his arrest.

Another victim, according to the filings, was a 36-year-old man who had recently received U.S. citizenship. The scammers told the man, who was living in Brooklyn, that there was a warrant for his arrest. He emptied his bank account in an attempt to rectify the situation.

Affidavits by Special Agent Marcy Ralston of the Social Security Administration’s Office of the Inspector General and Postal Inspector Samuel Bracken noted suspicious payments to the Palubmos’ company, TollFreeDeals. They said the Palumobos' were aware that fraudulent robocalls were being placed using their system, and continued despite many notices, inquiries, warnings and subpoenas concerning the fraudulent robocalls.

The Palumbos declined to comment to The Arizona Republic.

Their attorney, Theodor Bruening, said he believes the Palumbos were singled out by the DOJ because their business is the smallest among nearly 200 VoIP carriers and the government wants to make an example of them.

Nicholas Palumbo has been in the VoIP business for 17 years and had never been accused of wrongdoing, Bruening said, noting that his clients admit no wrongdoing in this case.

“They cannot determine whether it’s a robocall or not, any more than the post office can open your mail,” he said of the Palumbos. When the Palumbos received warnings about patterns of fraud, they took those claims seriously, Bruening said.

But Quilici, the YouMail founder, said that even if the Palumbos’ didn’t know fraudulent calls were being made using their system, other companies were collecting evidence of it and informing them of the suspicious activity. After receiving evidence that fraudulent calls were placed on their network by one of their customers, the Palumbos should have cut off that customer, he said.

“They had so much evidence from USTelecom and others who wrote them and told them, ‘You guys are carrying illegal traffic. Here's the scale of that traffic. Here's the evidence of that traffic. What are you gonna do?’

“And if their answer was, ‘Oh I don't know, I don’t believe you,’ then that's not a very good answer,” Quilici said.

According to Nicholas Palumbo’s LinkedIn, he is currently the CEO of BuyEnergyTaxCredits.com and Director of Business Development at Charles Kirkland Companies. Both Palumbos are listed as the executive team for Management Consulting Pro, where they are called “experts at reducing expenses and increasing the bottom-line for medium to large companies.”

Civil forfeiture complaint

In a separate civil forfeiture case in the Northern District of Georgia, the government seeks to seize more than $389,000 of the Palumbos funds earned through their telecom business.

The action seeks "to forfeit funds derived from robocall-based scams and other techno scams, including government impersonation scams, that were seized from bank accounts controlled by Nicholas Palumbo," according to court filings.

Court filings note the Palumbos ignored numerous complaints from USTelecom, AT&T, Department of Homeland Security and other United States Government agencies regarding fraudulent robocalls entering the United States through their company's network. The complaint also alleges the Palumbos' company received money from individuals who directly received money from victims, and transferring money between bank accounts.

New York man pursues lawsuit against Palumbos

A day after the DOJ filed its lawsuit against the Palumbos, a caterer in New York filed a civil complaint against them alleging they had violated the Telephone Consumer Protection Act.

The TCPA restricts telemarketing calls and the use of automatic telephone dialing systems and artificial prerecorded voice messages.

Dov Zeitlin, who filed the lawsuit, “got a lot of robocalls" and was fed up with it, according to his attorney, Robert J. Tolchin. "You never know who the hell is responsible for these robocalls.”

Tolchin said Zeitlin moved forward with his case after the government released affidavits from the federal civil case.

Using the affidavits, Zeitlin accuses the Palumbos of being responsible for certain robocalls in the Eastern District of New York “to defraud through facilitating the delivery of vast numbers of fraudulent telephone calls to victims, among other fraudulent conduct,” according to court filings.

“We’re not talking about a few calls, we’re talking about hundreds of millions of calls," he said. “These people are hiding in the shadows. And these people making the technology, they are putting the technology out there that lets these people hide in the shadows.”

In a July 13 court findings, the defendants moved to dismiss the case arguing that Zeitlin does not know that the robocalls he received were transmitted by the Palumbos, but rather guesses that they were.

“That lawsuit is completely baseless because it seeks to hold the Palumbos responsible for unwanted robocalls,” wrote Bruening. “Since the Palumbos operated a VoIP carrier – i.e. they only transmitted other people’s calls, they never placed any – they are not responsible for people receiving unwanted robocalls any more than the US Postal Service is responsible for transmitting unwanted mail.”

A rise in robocalls

In June, Phoenix was the seventh-most spammed city in the nation, receiving more than 70 million robocalls, according to the most recent data compiled by YouMail. In 2019, Phoenix saw over a billion robocalls.

Quilici, the YouMail CEO, said he has seen a significant rise of robocalls in the last five years because it has become easier and cheaper to make the mass calls.

“At the peak in the October of 2018, it was up to almost 6 billion a year,” he said. “It was absolutely nuts how fast it grew.”

Telecommunication companies play a role, because many people use telecommunication companies as a way to get on the U.S. network from overseas. “Wholesale VoIP carriers can be kind of a gateway for the bad guys to get on and make calls,” Quilici said.

Quilici’s database traced evidence in the DOJ’s case against the Palumbos.

“Now you can find the bad guys, easily collect evidence and then use that to shut down the carriers carrying the bad-guy traffic, if the carrier’s not actively trying to stop it,” he said.

The TRACED act, signed by President Trump in 2019, intends to make it easier for consumers to identify robocalls and avoid answering them. The legislation also requires telecom carriers to implement, at no charge, a number-authentication system to help consumers identify who’s calling. It also increases penalties for robocallers who disregard the law.

Quilici expects with these developments robocalls won’t again reach the highs seen in 2018. But he expects they will continue to be an annoyance.

“It will just take a grinded-out effort from a lot of people, carriers and everybody else, to get that number down,” he said. “It’s just simply too easy to make these calls.”

Protect yourself from robocalls

The FTC recommends hanging up on illegal calls, especially if the caller is trying to sell something or persuade you to pay for an alleged activity.

You can then file the call as a complaint with the FTC and the National Do Not Call Registry.

Quilici recommends consumers protect themselves from these calls by purchasing a robocall blocking app, he said.

Reach reporter Michaela Chesin by email at mchesin@gannett.com or by phone at 702-834-2494, or find her on Twitter @caeli_chesin.

August 5, 2020

We've had inquires recently about Ringless Voicemail. Here's an article that addresses it.

Sales folks are so creative.

Always looking to obtain the upper hand in a COVID-ravaged market, sales teams will often dream up highly novel ways to generate consumer engagement. Compliance folks need to be ever-wary of TCPA risk created by fanciful new engagement practices.

Here’s an example.

A moving company decides to use ringless voicemail drops to communicate with consumers who enter a phone number into a website field but that who never actually click a button to create an account or submit their contact information to the business. The thinking is—presumably—that the consumer is in the market for moving services (why else would he/she be on the website?) so reaching out to them as soon as a phone number is entered is a good way to identify leads. Sure the consumer never completed the form or formally submitted the number (i.e. provided consent) to be called, but—the thinking goes—that risk can be ameliorated by using ringless voicemail since, you know, that doesn’t trip the TCPA.

Creative. But ever so wrong.

As we’ve reported previously, users of ringless voicemail solutions continue to get hammered with TCPA rulings determining that RVM technology does indeed constitute a “call” subject to the TCPA. While the original line of cases on the issue looked at the rather odd (read: bad) argument that RVM is not a “call” because voicemail constitutes an “information service,” the most recent line of cases has rejected the more robust (read: good) argument that RVM does not trigger the TCPA because RVM drops are not made using a number assigned to a wireless carrier.

Well in a new case out of Nevada the creative moving-company Defendant managed to lose both arguments at once—and at the pleadings stage, no less. That’s actually really tough to accomplish. But not in a good way.

In Caplan v. Budget Van Lines, Case No. 20-CV-130 JCM, 2020 U.S. Dist. Lexis 136865 (D. Nv. July 31, 2020) the Court held that Defendant’s use of RVM to solicit consumers that entered a phone number in a website field but did not actually submit their data to the company by clicking a submit button triggered the TCPA. The Defendant had moved to dismiss the complaint arguing both that RVM is not a “call” because voicemails are an “information service”—again, stop making this argument folks it does not hold water— and because RVM do not interact with the cellular network—a fact which is technically true but almost certainly not alleged on the face of the complaint.

The Caplan court had little trouble rejecting both arguments. The “information service” argument is essentially gibberish and the Court waved it away by noting that text messages are also “information services”—a highly dubious categorization, BTW—but have always been subject to the TCPA. As to the “cellular network” argument the court found that Defendant was trying to elevate “form over substance.” Notably, a properly supported motion raising the “cellular network” angle should be a winner in some cases—the text of the statute simply does not apply to informational RVM’s deployed to business class landlines—but the fact that the messages at issue likely qualified as marketing completely guts this argument (pre-recorded marketing calls to landlines are covered by the TCPA.) So the Defendant lost its critical substantive defense at the pleadings stage and ceded a huge merits win to the class pre-certification, while highlighting a critical common issue. Where have we seen that before?

But while TCPA defendants continues to struggle with the ins and outs of class action defense, the larger issue here is that Caplan is now the FIFTH case to hold ringless voicemails are subject to the TCPA—with zero cases holding otherwise. So for those involved with TCPA compliance—be highly cautious anytime your sales team suggests deploying RVM to contact unconsented, screenscraped, skip traced, or “fielded-but-not-submitted” phone numbers.  Trouble.

They can also open the door to scams.

By Ryan Tracy and Sarah Krouse

Aug. 15, 2020 The Wall Street Journal

When you receive a robocall, chances are someone like Nick Palumbo collects roughly $0.0024 a minute. Those fractions of a cent can add up to millions of dollars. Mr. Palumbo accumulated more than $3.2 million on the hundreds of millions of calls routed through a telecom operation based in his Paradise Valley, Ariz., home last year.

Two phone companies run by Mr. Palumbo are among dozens of little-known carriers that serve as key conduits in America’s telecom system. But the rise and fall of those companies also illustrates a flaw in that system: The business model of these carriers can support fraud on a massive scale.

In the span of a few years, one of Mr. Palumbo’s carriers became the largest conduit for Social Security impostor calls coming into the U.S. from overseas, according to authorities. It connected swindlers posing as officials from the Social Security Administration with victims who relinquished their money or personal information. Such scams in total bilked U.S. consumers out of at least $38 million in 2019, according to Federal Trade Commission data and government officials.

More government impostor robocalls were traced to Mr. Palumbo’s carriers than any other phone company for much of 2019 and the early months of 2020, according to USTelecom, a trade group that runs a call-tracing system. He says he didn’t know the calls were scams when his companies passed them along. On March 24 a federal judge temporarily barred Mr. Palumbo’s phone operations from carrying any more calls in the U.S. following a civil lawsuit from the Justice Department. He shut down Ecommerce National LLC, which did business as TollFreeDeals.com, and SIP Retail LLC, his lawyer said.

Nick Palumbo accumulated more than $3.2 million on the hundreds of millions of calls routed through a telecom operation based in his Paradise Valley, Ariz., home last year. Authorities said one of Mr. Palumbo’s carriers became the largest conduit for Social Security impostor calls coming into the U.S. from overseas. Mr. Palumbo said he didn’t know the calls were scams.

Mr. Palumbo and dozens of other little-known telecom carriers work in the shadows of giants such as AT&T Inc., routing phone calls in bulk from one part of the telephone network to another and charging customers a fraction of a cent each time. These small carriers took hold in the decades following the 1984 breakup of AT&T’s phone system monopoly, which was designed to lower the costs of long-distance calls. They mushroomed during the introduction of internet-based calling services in the 2000s.

The emergence of these small phone companies was in many ways a positive development for consumers who now pay less for long-distance calls. The downside is that the system wasn’t designed to discern between legitimate and illegitimate calls, which are sometimes mixed together as they are passed along. U.S. regulators generally didn’t require these carriers to block calls and in some cases forbade them from doing so as a way of limiting anticompetitive behavior. Some telecommunications experts say that opened the door for smaller carriers to hustle business from robocallers, or simply turn a blind eye to suspect traffic.

Big carriers thus far have largely been able to avoid government penalties by demonstrating their efforts to verify legitimate traffic, in some cases hiring third-party companies to spot bad calls and flash a “Scam Likely” message to your phone.

Here is how the scams typically work: First robocallers blast out a large number of calls embedded with a prerecorded message claiming to be a representative of the Social Security Administration or another government agency. If the calls originate overseas, as many do, foreign carriers forward them to U.S. carriers that contract with each other to send and receive the traffic over the internet, using routers to find the cheapest path. A major U.S. carrier then typically makes the final connection to your phone.

When you answer, the prerecorded voice on the other end of the line claims you’re the victim of a stolen identity or a participant in criminal activity and that you need to call a number to fix the issue. If you fall for that premise, a swindler will use a mix of threats and reassurances during a live conversation to extract as much of your personal information or money as possible in exchange for supposedly clearing your good name.

Smaller carriers say the U.S. government should be going after scammers who are originating these robocalls. Law-enforcement officials say it is difficult to punish scammers directly, in part because many are based overseas. Instead authorities are targeting the small domestic telecom carriers that carry the calls into the U.S. and testing a relatively new legal argument in the telecom world: that carriers should be held responsible for policing any bad behavior that passes through their networks. Federal agencies have over the last year won injunctions curtailing the business of two other carriers, and have written warning letters to dozens of others.

One of the earliest targets of the government’s crackdown was the 39-year-old Mr. Palumbo, a well-known figure within this community of tiny phone carriers that swap tips and cut deals in online forums or annual telecom conferences in Las Vegas. There are varying views within that community about his level of responsibility. Some said he should have vetted his customers more carefully or cut them off when he saw red flags; others said he followed standard industry practices.

Mr. Palumbo said there are many legitimate uses of robocalls, such as telemarketing, and because he relayed calls rather than placing them, he had no way of knowing which calls were scams. “We can’t listen to the calls,” he said in an interview. “The system doesn’t allow us to, nor do we have the authority to.”

Mr. Palumbo’s lawyer said his client acted appropriately after receiving warnings about problematic calls, including notifying the customer who sent the calls. Even if his companies did more vetting, Mr. Palumbo says he wouldn’t know the source of calls because his clients were telecom carriers, not call originators. “It is really difficult to know who the customer’s customers are,” he said.

In Search of $250 Million

Long before he got into the telecom industry Mr. Palumbo knew he wanted to make an impact in the business world.

He started at eight years old, while growing up outside Buffalo, N.Y., “selling suckers, hawking pencils, clipping lawns [and] snowplowing,” he wrote in an autobiographical essay published in the 2014 book “Rainbows In Cobwebs.” “Anything that would earn some money.”

In college, he worked as a nightclub bouncer and started a business selling paintball supplies online, staying up late drinking Red Bull and working on the product catalog. He recalled telling a friend he would be worth $50 million someday, but secretly set a goal of $250 million.

His introduction to the telecom industry came in 2003, when he began selling access to toll-free numbers. In 2009, he moved to Arizona and began working as an agent arranging call-routing contracts between telecom carriers. He met his future wife, Natasha, in 2013 on a friend’s boat on Lake Pleasant near Phoenix. The following year he hired her.

Robo Relay

One Arizona couple relayed overseas robocalls that prosecutors say bilked U.S. consumers. Nick Palumbo, who led the operation, said he didn’t know the calls were illegal and took action when he learned they had been used in scams. Natasha Palumbo declined comment.

How it allegedly worked

1. The Palumbos’ phone companies, which operated from the couple’s U.S. home, received call traffic and directed calls to U.S. carriers.

2. Overseas scammers, many of whom were in India in this case, blasted out calls themselves, used a call center or both.

3. Overseas carriers forwarded the calls to the U.S.

4. The U.S. carriers passed calls on to big carriers

5. The big U.S. carriers passed calls through to U.S. customers.

6. Customers received recordings or live calls from the money-seeking scammers who often pretended to be with a U.S. government agency.

Business was good, but unsteady, Mr. Palumbo said in the interview. In 2016, several deals he arranged fell apart, robbing him of expected paydays. He decided to become a carrier himself.

He was able to do so from his home. He created an account with SipNav LLC, a company that leases access to call-switching equipment and software. SipNav accounts start at a minimum of 2,000 simultaneous calls for $1 a month, according to its website. Starting a phone company that operates over the internet—known as a voice over internet protocol or VOIP provider—takes at least $10,000 because of the need to prepay vendors before ramping up call volumes, he said. He declined to provide his exact costs.

“SipNav has no tolerance for Illegal robocalls” and is “doing everything in its control to help mitigate these illegal actions,” the company said in a statement.

Outfits like SipNav provide another important link in the robocall supply chain. They provide online portals for small telecom carriers to configure pricing, track call traffic and onboard clients. Mr. Palumbo had to find customers – or set up a website and let them find him.

Mr. Palumbo said his business took off, thanks to contacts in the telecom industry, trade shows, and customers who found him through online searches or LinkedIn. His clients included phone companies in India, which authorities say is a hot spot for robocalls. Gaurav Soni, the owner of one of those clients, ICore VOIP, found Mr. Palumbo via a Google search for U.S. telecom companies in early 2019, Mr. Soni said in an interview. “There are so many companies who are working like Nick,” Mr. Soni said.

Mr. Soni said he signed up with Mr. Palumbo online. Mr. Palumbo didn’t ask about the origin of the calls ICore would be sending, Mr. Soni said. Mr. Soni said he ran a phone company, not a call center, and wasn’t aware of the content of calls sent to the U.S. He said he understood his customers to be legitimate call centers that offer services such as information-technology help.

Mr. Palumbo eventually attracted enough clients to become the connection point for billions of calls to the U.S. telephone network. At their peak, Mr. Palumbo’s businesses had 38,000 phone lines, paying 80 cents per line a month. Clients paid about $0.0024 per minute for internet-based calling, according to business invoices included in court documents.

His businesses pulled in $3.2 million of revenue in 2019, or $266,000 a month.

A Morning Raid in Arizona

That good fortune ended on the morning of January 28, 2020 not long after Mr. Palumbo and his wife completed an ordinary morning of watching TV, having breakfast and preparing their daughter for preschool. As Mr. Palumbo carried his 3-year-old to the car, federal agents stood at the gates of his property with their guns pointed at him, he said in an interview and court documents.

“Put your daughter down,” one said, as Mr. Palumbo recalled it. He says he spent the next 90 minutes in handcuffs while officers searched the $2.3 million home, hauling out computers and paperwork.

Mr. Palumbo’s wife was also named as a defendant in the government’s case and was CEO of one of the companies involved. She declined to comment through a lawyer.

One alleged victim of a scam that started with a call transmitted by one of Mr. Palumbo’s companies was John Knox, a retired fire marshal who died in March. He sent $9,800 to a scammer who called him on May 23, 2019, according to court filings and a February interview with Mr. Knox. The swindler, whose call was passed along by the company, left a voice mail saying Mr. Knox’s Social Security number had been compromised.

“I’m usually sharp as a tack. That day they caught me,” Mr. Knox said in an interview, adding that he had been dealing with family turmoil at the time.

After the raid on Mr. Palumbo, the Federal Communications Commission in February began sending public warning letters to other small carriers. One was Karl Douthit, CEO of Los Alamitos, Calif.-based provider Piratel LLC, who says the FCC singled him out unfairly. Piratel hasn’t been associated with nearly as many robocall traces as Mr. Palumbo’s companies, and has long been vetting customers to avoid getting stiffed on bills, he said: “We have turned away more customers than we have kept.”

Mr. Douthit said the business of connecting calls over the internet is rife with opportunities to make a “quick buck” routing a high volume of calls without asking questions. He said he didn’t work with Mr. Palumbo.

Others defended Mr. Palumbo. Dean Hansen, a telecom consultant who filed a court brief in support of Mr. Palumbo as part of the government’s case, described him as a friendly, savvy businessman who followed standard industry practices.

Tracking the Fraud

Prosecutors said they uncovered the participation of Mr. Palumbo’s companies using a process called “traceback,” a system developed by trade group USTelecom that follows a call backward to identify the phone companies that connected it. USTelecom had traced many such calls to the companies and notified Mr. Palumbo each time, according to court filings.

Mr. Palumbo didn’t dispute receiving notifications from USTelecom, but said USTelecom never told him he was an outsize conduit of suspect calls until after the government brought its case.

Sometimes the traffic had obvious red flags, such as calls coming from overseas posing as 911, the Justice Department said. Mr. Palumbo’s lawyer said he blocked the 911 number after receiving a complaint and acted appropriately after receiving the USTelecom warnings. Each time, he warned the carrier who sent the problematic call and blocked the phone number in question.

But prosecutors said the scam calls continued for months over Mr. Palumbo’s network, even after the warnings. And they pointed out during the case that scammers can easily switch numbers once one is blocked.

In one June 2019 episode, USTelecom notified Mr. Palumbo of a Social Security scam call that had been relayed by his company, and he identified the source of the call as a customer from India. A USTelecom representative emailed back with a warning: The calls were “a massive illegal calling campaign.” Mr. Palumbo replied that he reamed out the client, according to court documents. In an interview this week, he identified the client as Mr. Soni, the ICore owner who found him on Google.

Mr. Soni said he shut down the account of the customer who sent the call Mr. Palumbo identified. The pair continued doing business through 2019, they both said.

Mr. Palumbo could’ve blocked ICore’s account if he was worried about the calls, Mr. Soni said. “How would I force him to open my account?” he said. “They never used to ask, ‘Who are you?’ They want the money and the calls, that’s it.”

Mr. Palumbo’s lawyer says his client acted appropriately by notifying ICore, and he understood that problem accounts had been shut down.

Mr. Palumbo’s companies didn’t have a compliance program, his lawyer told the federal judge, though it did have a template for onboarding new clients. Mr. Palumbo said in an interview that he checked customers’ references but it was possible for clients, including international ones, to sign up by filling out an online form.

Industry standards on how much vetting is required are vague or nonexistent, Mr. Palumbo’s lawyer said. Government rules encourage carriers to connect calls regardless of their origin rather than ask questions, executives at other telephone companies said.

“We connect calls. We do not block calls. That goes against our complete DNA,” said Lamar Carter, CEO of All Access Telecom Inc., a VOIP provider based in Forney, Texas.

The FCC in July asked for public input on the idea of requiring phone companies to conduct due diligence on high-volume customers. Those regulations, which the FCC hasn’t formally proposed, could require phone companies to ask questions about whether a customer is running a legitimate business before they allow someone to make high volumes of calls.

The shutdowns of Mr. Palumbo’s companies haven’t ended the flow of robocalls in the U.S. Volumes are on the rise again following a significant slowdown during the beginning of the coronavirus pandemic. From March to May, government agencies moved to quickly tamp down on Covid 19-related scams, and global shutdowns stymied some fraudsters’ ability to access call centers.

“The worry for us is of course that the volume just shifts to another player. That very well may be what’s happening,” said Gail Ennis, inspector general at the Social Security Administration, which assisted the Justice Department with the Palumbo case. “It’s going to be a marathon, not a sprint.”

Warning letters are part of coordinated campaign to combat illegal telemarketing

The Federal Trade Commission today sent joint letters with the Federal Communications Commission (FCC) to three companies providing Voice over Internet Protocol (VoIP) services, warning them that routing and transmitting illegal coronavirus-related scam robocalls is itself illegal and may lead to federal law enforcement against them.

The agencies allege that two of the providers are routing coronavirus-related fraud robocalls originating overseas. The letters follow three joint FTC/FCC warning letters sent to VoIP service providers in early April. Today’s letters, like the ones sent last month, alert the recipients that they have been identified as routing and transmitting coronavirus-related scam robocalls, and tell them to stop such conduct immediately or face potential law enforcement actions.

“We never tolerate illegal robocallers, but it’s especially abhorrent when scammers exploit pandemic-related anxiety,” said FTC Chairman Joe Simons. “These VoIP providers must stop allowing illegal scam calls to reach consumers.”

“We expect nothing less from these providers than shutting down this scam robocall traffic,” said FCC Chairman Ajit Pai. “These companies can access our nation’s phone networks to provide legitimate services to consumers and businesses, not to facilitate floods of scam robocalls. They need to stop this traffic and not let it back on their networks—or face losing their access to the American phone system.”

The agencies sent a separate letter to USTelecom – The Broadband Association (USTelecom), a trade association that represents U.S.-based telecommunications-related businesses. The letter thanks USTelecom for identifying and mitigating fraudulent robocalls that are taking advantage of the coronavirus national health crisis, and notes that the USTelecom Industry Traceback Group (Traceback Group) has helped identify various entities that appear responsible for originating or transmitting coronavirus-related scam robocalls.

The letter further notifies USTelecom that if, after 48 hours of the release of the letter, any of the specified originating or gateway providers continue to route or transmit the specified originators’ robocalls on American networks, the FCC will: 1) authorize other U.S. providers to block all calls coming from that gateway or originating provider; and 2) authorize other U.S. providers to take any other steps as needed to prevent further transmission of unlawful calls from the originator.

The agencies sent the three letters to the following providers: 1) Intelepeer Cloud Communications, LLC of San Mateo, California; 2) PTGi International Carrier Services, Inc. of Washington, DC and; 3) RSCom Ltd. of Aurora, Ontario, Canada.

The letters notify the recipients that the FTC and FCC obtained information about their conduct working in conjunction with the Traceback Group. The letters to Intelepeer and PTGi also state that the companies refused to disclose to the Traceback Group the names of those responsible for initiating the calls, making it difficult for U.S. providers to protect consumers from illegal robocall traffic.

Refusing to cooperate with the Traceback Group is “particularly problematic,” the letters state, in that hampering U.S. authorities’ ability to identify and stop malicious robocalls capitalizes on public anxiety about the ongoing global health crisis.

Investigations conducted with help from the Traceback Group revealed that PTGi appears to be a gateway provider for fraudulent COVID-19 robocalls originating from a Germany-based wholesale provider. They also revealed that RSCom, also a gateway provider, appears to be transmitting calls from Voice Are Us, Ltd., a telecom company based in the United Kingdom.

In January, the FTC sent letters to 19 VoIP service providers warning them that “assisting and facilitating” illegal telemarketing or robocalling is against the law. In late March and early April, the FTC sent 12 additional letters (three of which were sent jointly with the FCC) to VoIP service providers and other companies, warning them that they may be assisting illegal telemarketing relating to coronavirus. All of the FTC's recent warning letters to VoIP service providers cite the FTC's case against Globex Telecom, a VoIP provider that the FTC charged in 2019 with assisting and facilitating illegal telemarketing.

As noted in previous warning letters, the FTC may take legal action independently if it finds VoIP service providers or others are assisting a seller or telemarketer who they know, or consciously avoid knowing, is violating the agency’s Telemarketing Sales Rule (TSR). The FTC can seek civil penalties and court injunctions to stop TSR violations. It also can seek money to refund to consumers who were defrauded via illegal telemarketing calls.

Updated statistics about the number of Do Not Call complaints show a drop in complaint volume. View the latest statistics here.

The Federal Trade Commission works to promote competition, and protect and educate consumers. You can learn more about consumer topics and file a consumer complaint online or by calling 1-877-FTC-HELP (382-4357). Like the FTC on Facebook, follow us on Twitter, read our blogs, and subscribe to press releases for the latest FTC news and resources.

Aug 21, 2020

by Eric J. Troutman

This is really remarkable.

A cell phone carrier was allegedly spamming its own customers with illegal robotexts, while its CEO ignored requests from a consumer that the texts stop.

Those are the allegations in a putative nationwide TCPA class action brought by a consumer in Georgia aganst T-Mobile and a court held this week that the case can move forward.

The case involves allegedly unwanted marketing texts from T-Mobile. Goofy stuff like: “Tap into T-Mobile Tuesdays! Score free stuff and great deals every week – just for being a customer.”

The Plaintiff in the TCPA suit contends he didn’t want the messages so he (allegedly) e-mailed T-Mobile’s CEO John Legere twice, asking him to turn off T-Mobile’s text messages to him. When Legere (allegedly) ignored his requests, Plaintiff filed a putative TCPA class action against T-Mobile seeking to recover $500.00 for each and every text that the company sent to consumers without maintaining an internal DNC policy.

This could add up to billions of dollars if the allegations of the complaint are true. Uh oh.

T-Mobile first responded to the class action in odd fashion by arguing that Plaintiff wasn’t really hurt by the texts so the case should be dismissed. This argument, predictably, went nowhere as I wrote about a few minutes ago.

But the second part of the decision in Persichetti v. T-Mobile United States, CIVIL ACTION NO. 1:19-CV-02424-JPB, 2020 U.S. Dist. LEXIS 150814 (N.D. Ga.  Aug. 17, 2020) might be even more important (and damaging.)

First some background. The TCPA’s regulations prevent a telemarketer from sending marketing messages without an internal DNC list. Notably this requirement may (or may not) apply regardless of whether an ATDS is used. So while T-Mobile might have had a good ATDS defense in the Eleventh Circuit, the Internal DNC claim is problematic. If it exists. We’ll get to that.

In Persichetti the Plaintiff’s internal DNC claim was based upon allegations that T-Mobile’s CEO ignored his requests to be placed on the company’s internal DNC list. From there, the Plaintiff infers that there T Mobile has no internal DNC list. Hence every single marketing text message T Mobile sent to consumers was illegal under the TCPA’s regulations.

And at $500.00 a text, well… billions are at stake. All because T-Mobile’s CEO ignored an email from a consumer. That’s TCPAWorld for you.

T-Mobile argued to the Court in Persichetti that it can’t be that easy. The regulations—T-Mobile argued—do not allow for a private right of action to enforce this section. Only the FCC can come down on marketers for failing to maintain proper internal policies.

Frankly, T-Mobile is probably right about the law here, but the optics were just too much to overcome. The Court disagreed holding directly that the suit can go forward noting T-Mobile’s CEO was notified of the problem but the texts continued:

Here, Plaintiff alleges that after he received the unwanted messages, he called Defendant’s customer service department to ask Defendant to stop sending the messages. When that failed, Defendant twice emailed Defendant’s CEO to stop the unwanted messages. Plaintiff even alleges that Defendant communicated to him that it was “unable to stop” sending him the unwanted text messages.

In light of these facts the Court finds that T-Mobile is stuck in the case.

Remarkable stuff. It remains to be seen whether the underlying facts are true but T-Mobile is certainly facing an uphill battle on the legal arguments at the moment. We’ll keep an eye on this one.

Meeting via conference call yesterday, the Federal Communications Commission has formally adopted a rule that will require phone carriers to deploy STIR-SHAKEN call authentication technology by June 30, 2021.

STIR-SHAKEN is technology that allows a carrier to verify the caller ID information matches the caller’s actual phone number. It is intended to stop individuals who spoof phone numbers by using different caller ID information to make it look like someone else is calling.

The FCC had originally mandated that carriers deploy the technology by the end of last December, but that deadline came and went without any of the major carriers fully deploying it.

“Widespread implementation of STIR-SHAKEN will reduce the effectiveness of illegal spoofing, allow law enforcement to identify bad actors more easily, and help phone companies identify — and even block — calls with illegal spoofed caller ID information before those calls reach their subscribers,” said Ajit Pai, commissioner of the FCC, during the meeting. “Most importantly, it will give consumers more peace of mind when they answer the phone.”

The FCC also announced during its meeting yesterday that it is moving forward with Further Notices of Proposed Rulemaking that will seek comment on:

Expanding the STIR-SHAKEN implementation mandate to cover intermediate voice service providers

Extending the implementation deadline by one year for small voice service providers pursuant to the TRACED Act

Adopting requirements to promote caller ID authentication on voice networks that do not rely on IP technology

Implementing other aspects of the TRACED Act.

The FCC’s hand in mandating the adoption of STIR-SHAKEN was forced by the enactment of the TRACED Act, which made compliance with STIR-SHAKEN mandatory for all voice service providers.

The FCC estimates that the deployment of STIR-SHAKEN could save individuals as much as $3 billion annually by no longer wasting time and the nuisance of receiving scam calls.

Carriers have been announcing deployments of STIR-SHAKEN implementations, but have yet to roll out the technology across all of their calls. Carriers are quick to point out that STIR-SHAKEN does nothing to verify the content of a call, just the number the call is being made from.

Wednesday, August 26, 2020

WASHINGTON – The U.S. District Court for the Eastern District of New York has permanently barred two individuals and two companies that transmitted massive volumes of fraudulent robocalls from operating as intermediate voice-over-internet-protocol (VoIP) carriers conveying telephone calls into the U.S. telephone system, the Department of Justice announced today.  The consent decree entered yesterday by United States District Judge Eric R. Komitee resolves a civil complaint brought by the United States Attorney’s Office for the Eastern District of New York and the Department’s Consumer Protection Branch.

As alleged in a civil complaint filed earlier this year, in United States v. Nicholas Palumbo, et al., spouses Nicholas and Natasha Palumbo of Scottsdale, Arizona, and their companies, Ecommerce National LLC d/b/a TollFreeDeals.com and SIP Retail d/b/a sipretail.com, received millions of internet based calls every day from other entities, often located abroad.  The defendants transmitted those calls first to other carriers within the United States, and ultimately to the phones of individuals, knowing that the calls were fraudulent government and business-imposter robocalls. 

Many of the robocalls were made by individuals impersonating government investigators conveying false and alarming messages, such as the victim recipient’s social security number or other personal information had been compromised or otherwise connected to criminal activity, the recipient faced imminent arrest, the recipient’s assets were being frozen, the recipient’s bank and credit accounts had suspect activity, the recipient’s benefits were being stopped, and the recipient faced imminent deportation – each designed to frighten the recipient into paying large sums of money.  Often the numbers that appeared as the originating or caller-ID numbers were “spoofed” to make it appear that they originated from legitimate government or business offices in the United States when in fact they were made by overseas scammers, often located in India.  The defendants also sold to foreign call centers toll-free and other U.S. numbers that were left in fraudulent robocall messages on victims’ phones to deceive them into believing that the calls were legitimate and originated in the United States. These calls led to significant financial losses to victims throughout the United States and the Eastern District of New York, many of whom were elderly and vulnerable.

“The consent decree is a milestone in protecting the public, especially elderly and other vulnerable persons, from predatory robocall schemes that can cause catastrophic losses to victims in this district and throughout the country,” stated Acting United States Attorney Seth D. DuCharme.

“The Department is committed to protecting vulnerable Americans, particularly America’s seniors, from those who seek to steal their hard earned savings,” stated Acting Assistant Attorney General Ethan Davis of the Department of Justice’s Civil Division.  “The Department will prosecute both those who place fraudulent robocalls, and those who knowingly facilitate such calls for profit.  The Department recognizes the exceptional work of the Social Security Administration and Postal Inspection Service in investigating this case.”

“The Court's decision sends a clear message to gateway carriers who knowingly do business with scammers targeting Americans from overseas,” stated Gail S. Ennis, Inspector General for the Social Security Administration.  “We will continue to pursue those who facilitate these scam calls by allowing them into the U.S. telephone network.  I want to thank the Department of Justice for its support throughout this investigation and its commitment to protecting Americans from this insidious form of fraud and theft.”

Under the terms of the consent decree entered yesterday, the defendants agreed to be permanently barred from using the U.S. telephone system to deliver prerecorded messages through automatic means, carrying VoIP calls destined for phones in the United States, and providing any U.S. phone numbers to other individuals or entities.  In addition, the defendants are permanently barred from serving as employees, agents or consultants to any person or entity engaged in these activities. 

This case was handled by Assistant U.S. Attorneys Bonni Perlin and Dara Olds of the United States Attorney’s Office for the Eastern District of New York and Trial Attorneys Ann F. Entwistle and Charles B. Dunn of the Civil Division’s Consumer Protection Branch, in coordination with the Social Security Administration Office of the Inspector General and the U.S. Postal Inspection Service.  Investigative support was also provided by the U.S. Treasury Inspector General for Tax Administration, U.S. Immigration and Customs Enforcement’s Homeland Security Investigation’s El Dorado Task Force and U.S. Secret Service.  The Federal Trade Commission and the Federal Communications Commission also provided pertinent data.  

Additional information about the Consumer Protection Branch and its enforcement efforts may be found at http://www.justice.gov/civil/consumer-protection-branch.  For more information about the U.S. Attorney’s Office for the Eastern District of New York, visit its website at https://www.justice.gov/usao-edny.   

Well folks the Governor of Louisiana declared a state of emergency today ahead of the expected landfall of Tropical Storm/Hurricane Laura and Tropical Depression 14/Tropical Storm/Hurricane Marco.

Obviously all of us here at TCPAworld.com are rooting for everyone in the path of those storms to come out of this safe and sound.

For callers–particularly marketers–making calls to consumers within the state of Louisiana it is important to take note of the impact of this declaration of emergency on your ability to call.

Take a look at Louisiana Laws Revised Statutes Section 45:844.31.

Per that section, “[d]uring a state of emergency as declared by the governor, no telephonic solicitor shall engage in telephonic solicitation except [as specified below.]”

The statute broadly defines telephonic solicitation to include “any voice or data communication made by a telephonic solicitor to a residential telephonic subscriber for the purpose of encouraging a sale or rental of or investment in property, consumer goods, or services; or for the purpose of encouraging an extension of credit for property, consumer goods, or services; or for the purpose of obtaining information that will or may be used for the direct solicitation of a sale or rental of or investment in property, consumer goods, or services or an extension of credit for such purposes; or for the solicitation of a contribution to a charitable organization, except for the American Red Cross.”

So if you’re calling residential numbers in Louisiana and you aren’t the Red Cross, look out.

Some key exemptions, however:

• Calls can continue if the telephonic solicitation is in response to an express request of the person called... But note that aged leads won’t pass muster as consent for purposes of this section expires six months after the “express request” is granted.
• Calls can continue in connection with existing debt or contract, payment or performance of which has not been completed at the time of such call.
• Calls can be made to any person with whom the telephonic solicitor has an existing business relationship, or a prior business relationship that was terminated or lapsed within six months of such call.
• The telephonic solicitation is on behalf of an organization, which has nonprofit status under Section 501(c)(3) or (6) of the Internal Revenue Code, unless such organization utilizes the services of a paid professional solicitor, as defined in R.S. 51:1901(6).
• The telephonic solicitation is for the purpose of conducting marketing research, public opinion polling, or similar activities that does not involve telephonic solicitation or selling or obtaining information that will or may be used for telephonic solicitation or selling.
• The telephonic solicitation constitutes political activity. (i.e. calls for the sole purpose of urging support for or opposition to a political candidate or ballot issue provided that the callers identify themselves or calls made for the sole purpose of conducting political polls or soliciting the expression of opinions, ideas, or votes or calls made by any newspaper or periodical in the state, which is qualified to be the official journal of the state or any parish, municipality, school board, or other political subdivision, as provided by Chapters 2 and 4 of Title 43 of the Louisiana Revised Statutes of 1950.)

So although unsolicited marketing calls must cease, the great residents of the State of Louisiana can still expect to receive unsolicited political robocalls. Fun.

SEPTEMBER 1, 2020

Comments were filed on the FCC’s fourth further notice of proposed rulemaking on robocall blocking issued on July 17, 2020. Comments were received from 32 organizations. We’ve summarized these comments for you.

Overview

Here are some recurring themes found in the comments filed:

• There was no support for call blocking based solely upon the results of STIR-SHAKEN. Several commenters made the point that call authentication should be used with reasonable analytics and is not intended to stand on its own.
• There was no support for call blocking based upon the absence of STIR-SHAKEN authentication. There are many reasons why a call may not have been authenticated or the authentication token may not have survived transit across the telephone network. Too many good calls would get blocked if the criteria were the absence of a SHAKEN identity token.
• Comments from voice service providers and some associations were in favor of a safe harbor for network blocking, also known as provider-initiated blocking.
• Comments from high-volume callers were generally opposed to safe harbor for network blocking. Reasons given were that consumers would not be able to opt out, and blocked calls would not appear in blocked call reports for their subscribed number(s).
• High-volume callers and their associations were adamant that they must receive immediate notification of blocked calls and speedy redress for calls blocked or labeled in error. A few commenters discounted concerns that such notifications would help bad actors, saying that these fraudsters know when their robocalls are being blocked anyway, but legitimate high-volume callers often don’t.
• Some voice service providers were opposed to immediate notification of call blocking, while others were okay with it.
• A few voice service providers were opposed to a requirement to provide lists of blocked calls upon request. Others were okay with it, as long as they had flexibility over how to format and provide the information.

These comments were filed in response to the FCC’s Third Report and Order, Order on Reconsideration, and Fourth Further Notice of Proposed Rulemaking regarding proceeding 17-59, In the Matter of Advanced Methods to Target and Eliminate Unlawful Calls.

Comment summaries

You can click links to jump to the commenters listed below. The heading over each comment summary provides a link to their comment filed with the FCC.

• ACA – America’s Communications Association
• Ad Hoc Telecom Users Committee
• A group of 10 financial service firms
• AT&T Services
• Cloud Communications Alliance
• Comcast
• Competitive Carriers Association
• CTIA
• Electronic Transactions Association
• Encore Capital Group
• Enterprise Communications Advocacy Coalition
• First Orion
• INCOMPAS
• Insights Association
• National Association of Federally-Insured Credit Unions
• National Opinion Research Center
• NCTA – The Internet & Television Association
• Neustar
• Noble Systems
• NTCA – The Rural Broadband Association
• Numeracle
• Professional Association for Customer Engagement (PACE)
• RingCentral
• Securus Technologies
• T-Mobile
• Telnyx
• Transaction Network Services
• Twilio
• USTelecom – The Broadband Association
• Voice on the Net Coalition
• WTA – Advocates for Rural Broadband
• ZipDX

ACA – America’s Communications Association

• Discourage the FCC from adopting more prescriptive requirements for redress as a result of call blocking. The Commission should let requirements from the Third Order take hold before considering further requirements.
• FCC should wait before adopting requirements for providers to block calls from unauthenticated calls. Unauthenticated calls will include many legitimate calls for the foreseeable future.
• FCC should adopt a well-crafted safe harbor for network-level call blocking.
• FCC should not pursue enforcement action against small providers who fail to cooperate with traceback. First, the Commission should encourage education of these providers. If a provider fails to cooperate, the FCC should first ask the provider why they didn’t cooperate. Enforcement action should only be pursued after a demonstrated pattern of non-compliance.

Ad Hoc Telecom Users Committee

• The FCC should adopt a ceiling for the “reasonable amount of time” allowed for carriers to resolve caller complaints about inappropriate blocking.
• The Commission should not permit carriers to use call blocking to sell additional services that guarantee that calls will be transmitted without blocks or labels.
• The FCC should set a floor for minimal acceptable analytics that carriers must use for blocking.
• The FCC should not extend safe harbor to network blocking until carriers and analytics providers can:
• Establish that the analytics work
• Provide immediate notice to callers when their calls are blocked
• Provide timely redress for inappropriate blocking.
• The FCC should require terminating voice service providers to provide a list of individually blocked calls to subscribers.

A group of 10 financial service firms

Ten financial services companies filed joint comments.

• Lawful calls continue to be blocked.
• The FCC should require immediate notification of call blocking and a remedy for erroneous blocking within 24 hours. If the blocking provider needs more time to investigate, they should remove the block and/or derogatory label within 24 hours while they continue to investigate.
• Telephone numbers confirmed by legitimate companies should effectively be whitelisted so that calls from such numbers would not be blocked or derogatorily labeled in the future.
• The FCC should prohibit voice service providers from blocking unsigned calls originated by providers unable to implement STIR-SHAKEN.

AT&T Services

• The FCC should adopt safe harbor for provider-initiated call blocking (e.g., network blocking), but without being overly prescriptive.
• The Commission should not authorize call blocking based solely on STIR-SHAKEN, which only authenticates the telephone number displayed in caller ID, not the content of the call.
• The FCC should require providers to cooperate with tracebacks initiated through the registered traceback consortium (ITG). Providers should be required to cooperate by taking actions consistent with the ITG’s policies and procedures, not just respond.
• The Commission should adopt USTelecom’s robocall mitigation proposal. Providers would be required to self-certify that they:
• Take reasonable steps to avoid originating illegal robocall traffic
• Will cooperate with law enforcement and the industry traceback consortium.
• Blocked call lists are useful for opt-in/opt-out blocking services but are impractical, costly, and unnecessary for provider-initiated call blocking.

Cloud Communications Alliance

• Asks FCC to mandate real time notification of call blocking as a condition of safe harbor.
• Use the IETF SIP response code 608
• Mislabeling is tantamount to blocking, so redress processes should apply to labeling.
• Providers should be required to respond to traceback requests.

Comcast

• The FCC should expand safe harbor to include network-level blocking and consider extending safe harbor to other forms of blocking, such as anonymous call rejection.
• The Commission should ensure that redress procedures are realistic and fair to all parties.
• Comcast supports requirement for providers to respond to complaints about erroneous call blocking within one week.
• The Commission should not set a concrete timeline for resolving such complaints, as resolving complaints depends on a variety of factors beyond a provider’s control.
• The FCC should give providers flexibility when producing blocked call lists. If providers are required to produce blocked call lists, they should be allowed to do so in the format and manner of their choosing.
• Calls blocked at the network level should be excluded from blocked call lists, since they never make it far enough to be associated with a particular customer’s call logs.
• The Commission should take other measures to protect consumers without imposing unnecessary burdens. These measures include:
• Know your customer
• Responding to traceback requests.

Competitive Carriers Association

• The FCC should adopt robust safe harbor protection for call blocking.
• Unauthenticated calls from providers with delayed compliance deadlines should not be blocked because their calls were not authenticated.

CTIA

• The FCC should adopt a network-level blocking safe harbor.
• The Commission should consider additional safe harbors, such as for the unintended or inadvertent misidentification of the level of trust for individual calls.
• The FCC should maintain flexibility as it seeks to ensure adequate redress mechanisms. The Commission need not impose more extensive and prescriptive redress mechanisms.
• The Commission should not require providers to provide a list of individually blocked calls that were placed to a particular number at the request of a subscriber to that number. The record does not demonstrate that consumers demand information about missed robocalls. They complain about too many robocalls. Claims of blocking in error—which fuel requests for redress mandates—come from calling parties.

Electronic Transactions Association

• Legitimate callers must have a challenge mechanism to address calls blocked in error.
• The FCC should not be prescriptive when it comes to call blocking disputes. There should not be a specific time commitment.

Encore Capital Group

• Voice service providers should provide advance notice when a number is flagged as suspicious and may be blocked.
• When a number is blocked, the caller should receive immediate notification, an explanation using uniform language, and prompt redress when a caller asserts its calls have been erroneously blocked.
• Safe harbor must be contingent on adopting these standards.

Enterprise Communications Advocacy Coalition

• ECAC proposes a 24-hour response when a legal caller requests recourse for unjustified call blocking and a five-business day response to concerns about inaccurate call labeling.
• Terminating carriers and their analytics partners should not receive safe harbor protection unless they receive verified caller information.
• Terminating carriers and their analytics partners should not receive safe harbor protection if they charge callers to fix erroneous blocking or labeling.
• ECAC supports a verified identity process.

First Orion

• First Orion provided a table summarizing free registration and redress arrangements of three analytics providers and six service providers.
• No additional requirements for labeling redress are authorized or required. The TRACED Act requires redress for blocking, not labeling.

INCOMPAS

• The FCC should not permit additional call blocking based upon caller ID authentication. Call blocking should be based on a combination of call analytics factors, not just authentication.
• It would be premature to permit call blocking based upon caller ID authentication, since some voice service providers will not be able to participate in STIR-SHAKEN.
• The FCC should not extend a safe harbor over call blocking based solely on call authentication. Safe harbor based upon reasonable analytics, which will include call authentication when available, is sufficient.
• Any new requirements for call authentication imposed on TDM or small providers should align with rural call completion efforts.
• The FCC should encourage and support certificate delegation in STIR-SHAKEN.

Insights Association

• The FCC should require voice service providers to provide timely notification to callers when calls are blocked.
• Voice service providers and call blocking/labeling service providers should give callers advance notification that calls from their originating phone numbers deserve blocking.
• Safe harbor for mislabeling and blocking calls must hinge on prompt and advance notification to callers and a swift process for caller redress. Insights Association is less worried about the timeframe for redress response than for resolution.

National Association of Federally-Insured Credit Unions

• Call block notification provided to callers must be fast, if not immediate, so that it can be acted upon swiftly. For this reason, a SIP code, ISUP code or intercept message is most desirable. Any controls to limit access to thee notifications to legitimate callers, such as requesting notifications or registering with a service provider, must be easily identifiable, accessible and free-of-charge. Credit unions should be permitted to register or request notifications once for all service providers.
• The Commission’s concern that meaningful notification of call blocking might benefit illegal callers is understandable. But without transparency from service providers, illegal callers will still recognize when their calls are being blocked and alter their tactics. Lawful callers, however, will be left confused and forced to pay others for assistance. Both basic fairness and the language of the TRACED Act demand transparency for legitimate callers.
• Service providers should be required to track erroneous blocking and labeling. This information should be used to establish supportable benchmarks for “reasonable” analytics.
• Disputes should be resolved in 24 hours.

National Opinion Research Center

• Transparent and adequate redress requires clear notice and immediate resolution. This could be an audible signal that is distinct from busy or disconnect signals.
• The Commission should require providers maintain a public website listing the numbers they block or label.
• Terminating providers should only be permitted to block calls signed with full (A) attestation after application of objective, defined criteria and investigation into the call.
• The Commission should not extend safe harbor before establishing rules for timely notice and prompt remediation for erroneous blocking.

NCTA – The Internet & Television Association

• The FCC should extend safe harbor to cover the following:
• Unintended misidentification of the level of trust for a call
• Network-based blocking.
• The FCC should not permit blocking based only on caller ID authentication.
• The FCC should establish an end date for the use of TDM tandems and TDM intermediate providers.
• The Commission should require voice service providers to respond to all traceback requests from the Commission, law enforcement, or the Traceback Group.
• The Commission should require all providers to mitigate bad traffic when notified by the Commission.
• The Commission should not require providers to mitigate new and renewing customers from using their networks to originate illegal calls. Wait for the complete implementation of STIR-SHAKEN.
• The FCC should not require service providers to produce lists of individually blocked calls placed to a particular number at the request of a subscriber. Let providers decide what types of information to provide.
• The FCC should not require providers to respond to redress requests within a specific timeline.

Neustar

• The FCC should encourage calling parties to use market-based solutions to avoid and address adverse effects of incorrect caller ID authentication
• Delegate certificates will allow enterprises to sign their own calls.
• Caller should contact the originating service provider to correct caller ID authentication.
• Commercial solutions are available that correct wrongly blocked or mislabeled calls.
• The Commission should not impose a deadline for redress, nor mandate a specific notification system, which would make it easier for bad actors to evade blocking.

Noble Systems

• The FCC has a statutory mandate to define a per-call blocking notification.
• Blocking notifications are necessary for the Commission to meet its other mandates.
• Assertions that blocking notifications are harmful, unnecessary, or unwanted are not supported by the evidence.
• The scope and definition of “reasonable analytics” for call blocking is unclear and arbitrary. Algorithms are hidden. Besides, reasonableness will ultimately be determined from the perspectives of the calling and called parties, not the algorithm.
• Safe harbor should not be available for blocking calls with full attestation.

NTCA – The Rural Broadband Association

• Voice providers must adopt a process for rapid redress of false positives that inadvertently block or mislabel legitimate or wanted calls.
• The FCC should require providers to deliver an intercept message to calling parties to inform them that their call has been blocked or labeled.
• The NTCA supports the proposal to require terminating providers to provide to their subscribers, upon request, a list of blocked calls.
• Redress processes for call blocking should be adopted equally in all respects for call labeling.

Numeracle

• Advocates end-to-end call verification, where large-volume callers are vetted by a trusted entity.
• Carriers should not get safe harbor protection for blocking calls unless they use this third-party vetting information.
• The FCC should make participation in traceback mandatory.

Professional Association for Customer Engagement (PACE)

• Callers should receive a real-time indicator that a call is being or has been blocked. This should be both an audio intercept and a SIP error code to the caller.
• Voice service providers should provide callers with information about calls that were blocked because of reasonable analytics if the caller credibly asserts that the calls were blocked wrongfully.
• Voice service providers should be required to maintain a central point of contact with whom callers interact to identify and rectify wrongful blocking.
• Safe harbor should not be permitted for providers once notified that their call analytics are blocking legal and wanted calls.
• Outside review should be available to resolve disputes about over blocking.

RingCentral

• The FCC should require immediate transparency when calls are blocked, but not for labeling decisions. This would provide information to address erroneous blocking without giving away too much information to bad actors.
• Immediate notification of blocked calls should be done with a SIP code or a TDM cause code. Alternatively, the Commission could require the use of an intercept message.
• Calls that fail authentication for invalid certificates should be treated differently from those that lack authentication. Calls that fail authentication could be reasonably blocked. The absence of authentication is not sufficient cause to block.

Securus Technologies

• The FCC should not allow voice service providers to solely rely on caller ID verification to block calls.
• The Commission should require robust redress mechanisms that clearly articulate a timeframe for unblocking.
• The FCC should require providers to provide prompt notice of blocked calls using SIP and ISUP codes. If a call is sent over TDM at any time along the call path, the specific ISUP code used for blocking should be translated to a similar SIP code that can be received by the originating carrier to indicate that a block has occurred.
• The Commission should require blocking providers to make a list of individually blocked calls available to consumers and originating providers upon request.

T-Mobile

• Safe harbor should be extended to network blocking.
• The FCC should not impose additional redress or mislabeling requirements. In the TRACED Act, Congress addressed the redress issue for blocked calls. Congress could have done the same for mislabeled calls, but it did not.
• If a T-Mobile customer does not answer a mislabeled call, it goes to voicemail. While scammers may not leave voicemails, legitimate callers do. T-Mobile customers who think a call was mislabeled are encouraged to report the mislabeling on T-Mobile’s website. Callers that think their numbers have been incorrectly labeled can also report the issues to T-Mobile.
• The Commission should not set timelines or methods for responding to unblocking requests from blocked callers. There is no evidence that carriers are not already effectively providing redress.
• No further steps are required to prevent blocking of emergency public safety calls.

Telnyx

• The FCC should implement SIP code 608 as the call blocking notification standard.
• The Commission should implement a time frame of three business days for terminating parties to respond to blocking reports.

Transaction Network Services

• The FCC should not impose additional redress options for blocked calls.
• Voice service providers should not be required to provide real time notification when a call is blocked. This would make it easier for bad actors to circumvent reasonable analytics.
• The FCC should not specify a minimum time for responses to claims of erroneous blocking. Circumstances vary, and some requests may require more time to respond.

Twilio

• Concrete guidance on redress mechanisms would help stop erroneous blocking and labeling.
• The FCC should impose reasonable time limits for prompt notice of blocking or labeling and quick redress of erroneous blocking or labeling.
• The Commission should mandate the use of intercept codes, like SIP codes.
• The Commission should require providers to provide on request lists of calls they have blocked and labeled. Providers should have flexibility in the form of notice.
• Safe harbor should not be extended further. For example, safe harbor should not be extended to network blocking. The Commission should observe the effects of the current safe harbors to see whether further safe harbors are needed.
• The Commission should expand protection from blocking emergency and critical care calls, such as from law enforcement officers, not just PSAPs.

USTelecom – The Broadband Association

• Voice service providers should be required to respond to traceback requests.
• Originating voice service providers (including gateway providers for calls originated in other countries) should be required to mitigate bad traffic. However, the Commission should not prescribe specific methods to do so.
• The FCC should extend safe harbor to network blocking.

Voice on the Net Coalition

• The FCC should not allow blocking based solely on call authentication. Authentication should be considered with other reasonable analytics.
• VON opposes Commission adoption of specific steps to prevent new and renewing customers from placing illegal calls. Instead, each provider should develop its own plan.
• VON supports the proposal to give providers the flexibility to use SIP code 608 (call rejected) for timely notification of blocked calls.
• The Commission should establish a specific response time requirement to resolve disputes. It may take time to obtain the necessary information from sources outside of the provider’s control.

WTA – Advocates for Rural Broadband

• WTA opposes call blocking solely on the basis of caller ID authentication.
• WTA opposes call blocking by intermediate providers.
• WTA supports calling party verification process that begins with contacting the terminating voice service provider that blocked calls.
• WTA opposes network-based blocking that would eliminate the right and ability of customers to opt out.
• WTA suggests that small and rural LECs need more time to respond to traceback requests.
• WTA opposes requirements for free blocked call lists to requesting customers.

ZipDX

• Foreign-sourced calls should be prohibited from using USA caller-IDs.
• Web consent to receive calls should apply precisely to one named seller and should expire after three call attempts or 14 days, whichever comes first.

by Eric J. Troutman

I guess I should have seen this coming but I didn’t.

After forcefully battling to keep the TCPA on the books just last term, the U.S. Government has weighed in on the new Supreme Court TCPA ATDS debate–but instead of arguing for an expansive reading of the statute the Government is asking the Supreme Court to narrowly interpret the statute to only apply to dialers that randomly or sequentially generate numbers to be called. 

This really does change everything.

And no I’m not just talking about the compelling legal points raised in the brief, although I must say the brief is outstanding. The brief reads-to me at least- with much more persuasive force than the Opening briefs in Barr. The grammatical analysis of the TCPA’s ATDS definition is elegant and compelling– far better than most of the tortuous I’m-trying-to-explain-something-I-don’t-really-understand arguments you tend to see in these briefs. And the cut-to-the-chase policy analysis is outstanding as well.

Yes, as with most Supreme Court briefs, the Government’s position is confidently and directly conveyed and seemingly leaves little room for doubt.

But  the potent advocacy in the brief is not the key here–  The Government has now (finally) spoken authoritatively on the scope of the TCPA’s current ATDS definition. 

After all of the battling, all of the wrangling, all of the advocacy to the FCC–there it is. A quiet filing the afternoon before Labor Day that nearly everyone missed. The Government has now had its say– the TCPA only applies to random fire dialers. Great. Now we know.

Pack it up folks. We win. Right?

It is not the arguments of the Government that are so critical, it is the fact that the Government’s position is that the TCPA is to be narrowly read and applied. I mean, that’s everything right there. This isn’t like Barr where the government was arguing whether the TCPA is constitutional; this is the government weighing in on what the TCPA was intended to cover. That feels pretty authoritative; just like an FCC ruling interpreting the Act but from a different wing of the federal government.

And sure, technically, a position statement taken by the US Government made in a advocacy piece to the Supreme Court is probably not binding (probably) but do we really expect the Supreme Court to disagree?

I mean sure its technically too early to call this one for the good guys, but read this brief folks– Facebook– Government Brief. I’m convinced. And I have a very hard time believing that SCOTUS will ignore the Government’s position on the intended narrow reach of a federal statute.

So now the real question: with the U.S. Government wading into this fight and directly advocating that Congress intended no more than to regulate random-fire dialers how can anyone really debate the issue further?

I wonder whether Mr. Duguid himself–and his counsel-might start to think about simply laying down their weapons at this point. You’re on the wrong side of this thing guys. The U.S. Government has literally spoken on the issue– the TCPA was not designed to do what you thought it was. Accept it and move on.

Let’s discuss policy to the policy makers– not SCOTUS. That’s not where you want to be with this Court and you know it. (Big picture guys.) It’s in everyone’s best interest to get this statute cleaned up but that has to start on the Hill.

Just concede your points and lobby Congress to give you a new law. The Government has now given us clarity as to the scope of the existing law. That’s all anyone wanted to begin with. Leave it alone and let SCOTUS focus on stuff that is actually debatable. This just isn’t anymore.

So sayeth the Czar.

href="https://tcpaworld.com/2020/11/21/fcc-hits-california-telemarketer-with-almost-10-million-fine-over-spoofed-political-ad-in-california-primary/" >21 NOV 2020

The election is over.  The fallout from the last one isn’t.

The FCC recently issued a nearly $10,000,000 fine against San Diego telemarketer Kenneth Moser, dba Marketing Support Systems. 

In late May 2018, on the eve of a contentious primary, Mr. Moser made 47,610 prerecorded voice message calls to residents of the California 76th State Assembly District in San Diego.  Mr. Moser defamed Philip Graham, one of eight candidates for the open State Assembly seat.  To do so, he repeated already disproven allegations against Mr. Graham about a sexual assault that never occurred.  The message implored primary voters: “We do not need any more creeps in Sacramento.”

Mr. Moser spoofed the number, using the phone number of a competitor that, according to the FCC, Mr. Moser “has a long and contentious relationship with.”  The FCC emphasized that it based its fine Mr. Moser’s decision to spoof its competitor’s number.

The FCC rejected Mr. Moser’s arguments against the fine, clarifying that the steep fine “does not hinge on the truthfulness or factual accuracy of the prerecorded message or Moser’s knowledge thereof.”  The FCC also rejected Mr. Moser’s argument that the fine violated his constitutional due process rights.  According to the FCC, Mr. Moser received sufficient notice and an opportunity to respond.

Mr. Moser must pay the fine thirty days from the FCC’s November 18 Order.

The United States Federal Communications Commission – better known as the FCC (News - Alert) – has a lot on its plate, to say the least. When the nuisance that is robocalls earned public enemy status, STIR-SHAKEN was put in place, but initial policy implementation didn’t quite cover all the bases.

Today, the FCC announced that based on recommendations from the Cloud Communications Alliance (CCA) the Secure Telephone Identity Governance Authority (STI-GA) will abridge requirements in robocall prevention policy.

“Under the previous policy, many VoIP providers – including CCA members – were disqualified from participating in the call authentication framework even though the FCC would require participation," said Mark Iannuzzi, Chairman of CCA Government Affairs Committee and CEO of TelNet (News - Alert).

Specifically speaking, the new FCC policy allows CCA members to leverage STIR-SHAKEN via FCC Robocall Mitigation Database. The initial policy put forth by STI-GA required service providers have direct access to telephone numbers, disqualifying a number of CCA members from implementing STIR-SHAKEN and creating an environment for competitive disadvantage.

"This is great news not just for providers, but for their customers and consumers who will be better assured of the identity of callers. In turn, providers will be able to more quickly and accurately trace back to the source of a call and identify bad actors easily,” Iannuzzi continued.

OCTOBER 21, 2020 You probably know about the benefits STIR-SHAKEN call authentication will provide to consumers: by identifying caller ID spoofing, it will help bring unwanted and illegal robocalls under control. But what about enterprise callers? How will SHAKEN help you? Let’s look.

Challenges for enterprise callers

Telecommunications has been getting more difficult for enterprise callers:

• People are wary of robocalls—answer rates are down.
• Service providers have been using call analytics to identify, label, and block suspected robocalls—enterprise outbound calls often get blocked too.

STIR-SHAKEN will be invaluable

If you run an enterprise outbound call center, you should be planning for STIR-SHAKEN. It will become table stakes for several reasons:

• As consumers see more calls verified, they will become less likely to answer unverified calls.
• Call analytics will tend to favor authenticated calls and penalize unsigned calls.
• Rich Call Data, an extension to STIR-SHAKEN, can present enterprise calls in a brand-compliant way to increase call answer rates using information such as:
• Your caller name
• Your organization’s logo
• Reason for the call.

STIR-SHAKEN deployment considerations

When planning for STIR-SHAKEN, an enterprise call center manager should be thinking about a few important considerations:

• How quickly can you get your outbound calls signed?
• Subscribers are already getting signed calls on some networks.
• What attestation level will your calls get?
• You want full attestation, but that can be difficult to get, especially if you originate calls with multiple outbound service providers using numbers from a variety of telephone number providers.
• Can you include Rich Call Data with your calls?
• Full RCD support is not yet available on handsets, but you need to prepare.

Acting in response to yet another requirement of the TRACED Act, the Federal Communications Commission (FCC) has taken steps to protect consumers from “one-ring scams.”  As the Commission explained in its November 30, 2020 Report and Order (https://docs.fcc.gov/public/attachments/FCC-20-171A1.pdf),  “in the one-ring scam, the scammer typically places a call and causes it to disconnect after one ring, in order to induce the called party to call back and incur toll charges, of which the scammer gets a share.”

Section 12 of the TRACED Act directed the FCC “to consider measures to encourage voice service providers to prevent one-ring scam calls from reaching consumers, including rules that providers may block calls likely associated with one-ring scams.” Additionally, the Act called for the Commission to consider how it could “require international gateway providers, which are the point of entry for calls into the United States, to verify with the foreign originator the nature or purpose of calls before transmitting them for completion to U.S. consumers….” The Congress also directed the FCC to consider how it could work with law enforcement agencies, foreign governments and entities providing call blocking services to address these scam calls. Finally, the FCC is to consider, in consultation with the Federal Trade Commission, how to on better educating consumers on how to avoid such calls.

Founded on its previous initiatives to allow call blocking or illegal robocalls, the FCC expressly enable[s] voice service providers to block calls that are highly likely to be associated with one-ring scams.” In doing so the agency “extend[s] to one-ring scam blocking our recently adopted safe harbor for inadvertent blocking of wanted robocalls using reasonable analytics.”

Some argued that a new rule focused on one-ring scam calls was unnecessary in light of prior FCC actions on call blocking. However, the Commission acted to “remove any doubt that voice service providers may lawfully use reasonable analytics to identify and block calls that appear to be one-ring scam calls, even if such identification proves to be erroneous in any particular instance; that they may do so without fear of liability for inadvertently blocking wanted calls; and that they may do so on a network-wide basis.”

The Report and Order further general describes the FCC’s commitment to expanded collaborative efforts, including working with the interagency group, led by the Attorney General, on the subject of one-ring scams, collaborating with the FTC on consumer education, and “enhancing enforcement coordination and cooperation with foreign governments aimed at combatting unlawful cross-border schemes such as one-ring scams.”

Another TRACED Act mandate now on the books.

FCC Released: November 18, 2020

Secure Telephone Identity Governance Authority Revises Token Access Policy to Eliminate Direct Access to Telephone Numbers Requirement

WC Docket No. 17-97

This Public Notice serves as an informational announcement that, on November 18, 2020, the Secure Telephone Identity Governance Authority (Governance Authority) issued an update to its Service Provider Code (SPC) Token Access Policy.[1] Under the revised policy, an entity will no longer need direct access to telephone numbers to participate in the STIR-SHAKEN caller ID authentication framework.

The Governance Authority, managed by a board consisting of representatives from across the voice service industry, defines the policies and procedures for which entities can acquire a digital certificate necessary to participate in STIR-SHAKEN.[2] One such policy is the SPC Token Access Policy, which establishes three requirements an entity must meet to in order to receive a certificate. In its current iteration, the SPC Token Access Policy requires an entity seeking a certificate, among other things, to “[h]ave direct access to telephone numbers from the North American Numbering Plan Administrator . . . and National Pooling Administrator.”[3]

The newly revised SPC Token Access Policy removes and replaces the requirement that an entity have direct access to telephone numbers to receive a certificate. In place of that requirement, the revised policy requires that an entity must be listed in the Federal Communications Commission’s (Commission) forthcoming Robocall Mitigation Database.[4] The Governance Authority announced that the new policy will be effective upon the Commission’s Robocall Mitigation Certification filing deadline and that, until then, “the current SPC token access policy remains in effect.”[5]

The Commission has recognized concerns raised by some stakeholders that the current SPC Token Access Policy prevents certain categories of voice service providers from participating in STIR-SHAKEN.[6] In recognition of these concerns, the Commission granted an extension to voice service providers that cannot obtain a certificate due to the SPC Token Access Policy “until it is feasible for a provider to participate in STIR-SHAKEN due either to the possibility of compliance with the Governance Authority policy or a change in the Governance Authority policy.”[7] The Commission further “recognize[d] that a voice service provider may not be able to immediately come into compliance with its caller ID authentication obligations after it becomes eligible to receive a certificate,” and found that it “will not consider a voice service provider that diligently pursues a certificate once it is able to receive one in violation of our rules.”[8]

[1] Press Release, ATIS, New Secure Telephone Identity Governance Authority Policies Advance Industry Illegal Robocall Mitigation Goals (Nov. 18, 2020), https://www.atis.org/press-releases/new-secure-telephone-identity-governance-authority-policies-advance-industry-illegal-robocall-mitigation-goals/ (Governance Authority Press Release).

[2] See Call Authentication Trust Anchor, Implementation of TRACED Act Section 6(a)—Knowledge of Customers by Entities with Access to Numbering Resources, WC Docket Nos. 17-97 and 20-67, Report and Order and Further Notice of Proposed Rulemaking, 35 FCC Rcd 3241, 3246, para. 9 (2020) (First Caller ID Authentication Report and Order and Further Notice).

[3] See STI Governance Authority, STI-GA Policy Decisions Document (2020), https://sti-ga.atis.org/wp-content/uploads/sites/14/2020/11/201118-STIGA-Board-Policy.pdf.

[4] Governance Authority Press Release. In September, the Commission adopted rules requiring voice service providers to file certifications, maintained in a publicly accessible database, that their traffic is either “signed with STIR-SHAKEN or . . . subject to a robocall mitigation program.” Call Authentication Trust Anchor, WC Docket No. 17-97, Second Report and Order, FCC 20-136, at 44, para. 82 (2020) (Second Caller ID Authentication Report and Order).

[5] Governance Authority Press Release. The Commission directed the Wireline Competition Bureau (Bureau) to issue a Public Notice announcing both when voice service providers may begin filing certifications in the Robocall Mitigation Database and establishing the deadline for filed certifications. Second Caller ID Authentication Report and Order at 44-45, para. 83. The Commission further directed the Bureau to set the filing deadline no earlier than June 30, 2021. Id.

[6] Second Caller ID Authentication Report and Order at 24, para. 49; First Caller ID Authentication Report and Order and Further Notice, 35 FCC Rcd at 3259, para. 39 n.145.

[7] Second Caller ID Authentication Report and Order at 24, para. 50.

[8] Id.

September 22, 2020 FTC news release

Globex Telecom, Inc. and an affiliated company will pay a total of $1.9 million to settle Federal Trade Commission and State of Ohio charges that they facilitated a scheme that peddled bogus credit card interest rate relief, illegally charging consumers millions of dollars. The settlement marks the end of the FTC’s first consumer protection case against a Voice over Internet Protocol (VoIP) service provider.

The FTC and Ohio alleged that Globex provided a company called Educare Centre Services with the means to make calls to U.S. consumers, including illegal robocalls, to market Educare’s phony credit card interest rate reduction services.

“Bombarding people with unwanted robocalls is illegal – and so is selling bogus credit card interest rate reduction services with an upfront fee,” said Andrew Smith, Director of the FTC’s Bureau of Consumer Protection. “We will continue to go after companies like Educare that target people using these unlawful practices, and VoIP service providers like Globex who knowingly help them violate the law.”

The FTC and Ohio charged that both Globex and Educare were controlled by Mohammed Souheil, Globex’s former CEO and president, who was named in the lawsuit along with a number of other corporations and individuals. All the individuals named in this action are Canadian nationals and reside outside of the U.S.

Mohammad Souheil, Prolink Vision, S.R.L., and 9896988 Canada, Inc.

Souheil, along with two corporations under his control, will be prohibited from participating in any telemarketing in the U.S. and from violating the Telemarketing Sales Rule (TSR). These defendants will also be prohibited from marketing debt relief products or services of any kind, and from using misrepresentations in the sale or marketing of any product or service. They, collectively, are subject to a monetary judgment of $7.5 million, which is largely suspended due to an inability to pay. They will be required to pay $150,000.

Globex Telecom, Inc. and 9506276 Canada, Inc.

In addition to paying $1.95 million, Globex and its U.S.-based subsidiaries will be prohibited from hiring Souheil, any of Souheil’s immediate family members, and defendants Charles Kharouf and Sam Madi, to work for Globex or any U.S.-based subsidiary.

These defendants will also be required to abide by client screening and monitoring provisions. For example, Globex and its subsidiaries will not provide VoIP and related services to clients who pay with stored value cards or cryptocurrency, or to clients who do not have a public-facing website or social media presence. They will be required to conduct a screening and review process for all potential clients, and to re-screen any existing client who is subject to a subpoena from the government or similar investigative request.

In addition, Globex and its subsidiaries will be required block any calls made by their clients that appear to come from certain suspicious phone numbers, including emergency numbers like 911, unassigned or invalid numbers, or international numbers that would charge consumers a large amount should they attempt to dial it. They will also be required to block calls using spoofing technology, and to terminate their relationship with any telemarketer or other high-risk client that receives three or more USTelcom Traceback Requests (an official industry complaint about unlawful calls) or line carrier complaints in a 60-day period.

Educare Centre Services, Inc.; Tripletel, Inc.; Sam Madi; Wissam Jalil; and Charles Kharouf

These defendants were sued by the FTC and Ohio for their roles in managing the overseas call centers and other components of the credit card interest rate reduction scheme. Under the terms of their settlements, they will be prohibited from participating in any telemarketing in the United States, from marketing debt relief products or services of any kind, and from using misrepresentations in the sale or marketing of any product or service.

Educare, Madi, and Kharouf will be subject to a judgment of $7.5 million that is largely suspended based on inability to pay. Educare and Madi will be required to forfeit all funds frozen in Educare’s bank accounts. Jalil and Tripletel will be subject to a $2.8 million judgment  that is largely suspended based on inability to pay. They will be required to forfeit all funds frozen in Tripletel’s bank account

If any of the defendants are found to have misrepresented their ability to pay, the full amounts of their judgments will be immediately due.

The Commission vote approving the stipulated final orders was 3-0-2, with Commissioners Rebecca Kelly Slaughter and Christine S. Wilson recorded as not participating. The FTC filed the proposed orders in the U.S. District Court for the Western District of Texas.

NOTE: Stipulated final orders have the force of law when approved and signed by the District Court judge.

Dec 3, 2020 FTC news release

Alcazar Networks and its owner provided a gateway for tens of millions of illegal calls, agency alleges

Voice over Internet Protocol (VoIP) service provider Alcazar Networks Inc. and its owner settled Federal Trade Commission charges that they facilitated tens of millions of illegal telemarketing phone calls, including some calls from overseas and some that displayed spoofed caller ID numbers.

The proposed settlement bars the defendants from similar misconduct in the future, imposes a monetary penalty, and requires them to screen and monitor their customers. This is the FTC’s second case against a VoIP service provider.

“These defendants acted as a gatekeeper, introducing tens of millions of illegal calls into the U.S.—including robocalls and other calls that impersonated 911 emergency numbers or the government,” said Andrew Smith, Director of the Bureau of Consumer Protection. “The FTC and our law enforcement partners will not tolerate VoIP providers and other companies that assist and facilitate illegal robocallers and scammers.”

According to the FTC’s complaint, Alcazar and its owner Gavin Grabias have assisted and facilitated illegal robocalls, in violation of the FTC’s Telemarketing Sales Rule (TSR). They allegedly continued to do so even after they learned that customers were using their service to initiate calls to numbers on the FTC’s Do Not Call (DNC) Registry and calls displaying spoofed caller ID numbers, including displaying “911.”

The FTC contends the defendants provided VoIP services to an Indian company named E. Sampark, which fraudulently displayed “911” as the caller ID number and dialed calls impersonating the Social Security Administration.

Another Alcazar customer, Derek Bartoli (who was the subject of an FTC action for allegedly violating the TSR), allegedly made more than 50 million illegal telemarketing calls using Alcazar’s services after Alcazar learned Bartoli was calling consumers on the DNC Registry without permission to do so. In addition, many if not all of Bartoli’s calls were robocalls that displayed spoofed caller ID numbers, also in violation of the TSR. These calls used Alcazar’s VoIP services during 2018 and pitched “medical alarms.”  

The proposed order settling the FTC’s complaint prohibits the defendants from violating the TSR, or assisting anyone else in doing so. The order also permanently bans the defendants from assisting telemarketers or overseas customers with dialing robocalls or calls to phone numbers on the DNC Registry—regardless of whether those customers purportedly have permission to do so.

In addition, the order requires the defendants to:

• implement automated procedures to block calls that display the caller ID number as “911,” related emergency numbers, or unassigned, or invalid numbers;
• require that all calls after June 30, 2021, be authenticated under the STIR-SHAKEN Authentication Framework;
• screen current and prospective customers, including high-risk customers, before providing them with VoIP services; and
• end current business relationships with customers who fail to pass a reasonable screening process.

Finally, the order imposes a $105,562 monetary judgment against the defendants, payable to the FTC no later than seven days after its entry by the court.

The Commission vote approving the complaint and proposed stipulated order was 5-0, with Commissioner Christine S. Wilson issuing a separate concurring statement. The FTC filed the complaint and proposed order in the U.S. District Court for the Middle District of Florida.

Dec 01, 2020

The United States Federal Communications Commission – better known as the FCC (News - Alert) – has a lot on its plate, to say the least. When the nuisance that is robocalls earned public enemy status, STIR-SHAKEN was put in place, but initial policy implementation didn’t quite cover all the bases.

Today, the FCC announced that based on recommendations from the Cloud Communications Alliance (CCA) the Secure Telephone Identity Governance Authority (STI-GA) will abridge requirements in robocall prevention policy.

“Under the previous policy, many VoIP providers – including CCA members – were disqualified from participating in the call authentication framework even though the FCC would require participation," said Mark Iannuzzi, Chairman of CCA Government Affairs Committee and CEO of TelNet (News - Alert).

Specifically speaking, the new FCC policy allows CCA members to leverage STIR-SHAKEN via FCC Robocall Mitigation Database. The initial policy put forth by STI-GA required service providers have direct access to telephone numbers, disqualifying a number of CCA members from implementing STIR-SHAKEN and creating an environment for competitive disadvantage.

"This is great news not just for providers, but for their customers and consumers who will be better assured of the identity of callers. In turn, providers will be able to more quickly and accurately trace back to the source of a call and identify bad actors easily,” Iannuzzi continued.

DEC 10, 2020

Oral arguments were heard on December 8 in a case before the U.S. Supreme Court (SCOTUS) that could decide the fate of the Telephone Consumer Protection Act of 1991 (TCPA). The Court’s ruling in this case, Facebook v Duguid, could have huge implications for laws and regulations against unwanted robocalls. Here’s an overview.

What’s an Automatic Telephone Dialing System?

The TCPA was enacted to restrict telemarketing calls made with an Automatic Telephone Dialing System (ATDS). To do this, the legislation had to define what an ATDS is. Here’s the definition used in the law:

(1) The term ‘automatic telephone dialing system’ means equipment which has the capacity —
(A) to store or produce telephone numbers to be called, using a random or sequential number generator; and
(B) to dial such numbers.

Although this definition seems simple enough, it’s been ground zero for landmark court cases that have revealed weaknesses and vagueness in the definition.

First, the phrase “store or produce telephone numbers to be called, using a random or sequential number generator” has given judges fits. Does the number generator provision apply to both verbs, “store” and “produce,” or does it only apply to “produce”? What does it mean to store a telephone number using a number generator?

Narrow definition

A narrow interpretation has been found in some court cases, where both “store” and “produce” are linked with the number generator requirement. This narrow definition would make it easy for robocall perpetrators to escape the TCPA. They could simply claim that their dialing system doesn’t do all those things.

Broad definition

A broad interpretation has been made in other court findings, where only the number generator provision only applies to “produce.” This makes TCPA effective against more robocall perpetrators, but it also could ensnare callers in other scenarios.

One word can make a huge difference

The word “capacity” has proven difficult. It would include any device that’s capable of doing something, regardless of whether it’s actually used that way.

For example, today’s smart phones are capable of being used as an ATDS, with the right software. Does that mean smartphone users are now subject to the TCPA? Can they be prosecuted and fined for making calls to people without express consent, even if they don’t use their phone to blast out robocalls?

What’s at stake

If the Court sides with the Plaintiff, Duguid, and his quest for a broad definition of ATDS, then the TCPA would remain effective against a wider class of robocall activity. However, it could potentially be used against callers using smart phones, which are capable of being used as an ATDS, even in situations where the caller was not using that capability.

Facebook seeks a narrow definition of ATDS. If the SCOTUS agrees, then the TCPA would be in jeopardy. High-volume callers could easily avoid the TCPA by using an ATDS that doesn’t fit the narrow definition. This could unleash a tidal wave of robocalls.

Predictions

Eric Troutman, an attorney who specializes in TCPA cases, has commented that, before oral arguments, he would have given Facebook an 85% chance of success in their quest for a narrow ruling on the ATDS definition. After hearing oral arguments, however, he thinks the odds are more like 60-40 in favor of Facebook.

Attorneys from K&L Gates wrote a review of the oral arguments. They believe that the conservative members of the Court (Thomas, Alito, Gorsuch, Kavanaugh, Barrett) seem to favor the narrow interpretation argued by Facebook. Justice Sotomayor seemed to favor the broad interpretation. It was unclear what position Roberts, Breyer, and Kagain seemed to prefer from their questions.

The SCOTUS is expected to issue its decision by mid-2021.

* Verizon has helped customers avoid nearly nine billion robocalls to date; with a year of industry-wide declines in pesky, unwanted calls for the first time in history

• This week, Verizon Wireless certified with the FCC and confirmed implementation of technology to combat caller ID spoofing, more than two years ahead of industry deadline

BASKING RIDGE, NJ — Dec. 03, 2020 — Earlier this week, Verizon Wireless confirmed at the Federal Communications Commission (FCC) that the company was more than two years ahead of an FCC requirement that all service providers implement the call authentication technology STIR-SHAKEN, which helps address Caller ID spoofing, by June 2021. Verizon has been driving adoption of STIR-SHAKEN, an industry-wide effort that helps verify that a call is in fact from the number displayed on the Caller ID and not spoofed.

As an industry leader that’s taken action early and often, including urging Congress and the FCC to require all service providers to implement this technology, Verizon completed its wireless network upgrade to STIR-SHAKEN in March of 2019. As noted in the certification filing, not only is the company more than two years ahead of the FCC deadline, but it has also begun to exchange substantial volumes of STIR-SHAKEN-enabled calls with other early adopters.

Nearly nine billion calls and counting

To date, Verizon has protected over 75 million customers from nearly nine billion unwanted calls – and counting.

As a result of continued efforts on behalf of customers within the network and application levels, Verizon has seen a year of declines in the volume and frequency of robocalls industry-wide for the first time in history, according to Verizon’s robocall analytics partner Transaction Network Services.

Nov 30, 2020

AT&T, Lumen and US Cellular filed requests with the FCC for deadline extensions to implement STIR-SHAKEN. Verizon asked for a ruling to confirm that they don’t have to deploy STIR-SHAKEN in part of their network. Here’s an overview.

AT&T

In their petition for deadline extension, AT&T explained the following:

1. They made a network routing adjustment in mid-2020 to address network congestion during the COVID-19 global pandemic. As a result of this adjustment, a tiny amount of their VoLTE-originated traffic travels on an IP end-to-end basis, but over a portion of the network that lacks STIR-SHAKEN signing capabilities.
2. Recent routing adjustments involves calls entering their network on its wholesale IP platform and terminating to AT&T’s VoLTE customers using network elements that cannot retain the SHAKEN header information.

AT&T requested a one-year extension of the June 30, 2021 STIR-SHAKEN implementation deadline.

Lumen

In their request for extension, Lumen explained the following:

• They anticipate that they will be able to implement STIR-SHAKEN across their IP networks by June 30, 2021. However, they have experienced the following delays:
• Their vendors frequently miss deadlines
• Software bugs take longer than expected to fix
• Even properly tested software can fail to operate properly when loaded into network equipment that turns out to lack compatibility with STIR-SHAKEN technology.
• Therefore, Lumen requested an additional six months to complete implementation.
• Lumen will have in place a robust robocall mitigation program for the duration of the requested extension.

US Cellular

In their motion for extension of time, US Cellular explained the following:

• U.S. Cellular supports two wireless networks. One is VoLTE/IMS, which is packet-based. The other is a CDMA network, which is circuit-based.
• They plan to migrate their CDMA customers to the VoLTE network. However, this process will take well beyond June 30, 2021.
• They ask an extension until the CDMA migration is complete. They did not name a specific date, but requested a “reasonable extension of time.”
• They are not aware of fraudulent robocall traffic originating from their network. They indicated that they would take swift action to stop such calls if they arise, and to participate timely and fully to traceback requests.

Verizon

In their petition for declaratory ruling or limited extension, Verizon asked for the following:

1. A declaratory ruling on whether the STIR-SHAKEN requirement applies to a service they provide that uses fiber-to-the-premises (FTTP) and plain old telephone system (POTS) service. They refer to this service as FTTP-SIP. It uses SIP as part of the network signaling but does not have advanced VoIP features. Verizon assumes that the TRACED Act and FCC SHAKEN orders do not apply, but they ask the FCC to confirm.
2. If the FCC rules that Verizon must implement SHAKEN/STIR with its FTTP-SIP service, then Verizon requested a three year extension from the June 30, 2021 deadline.

Nov 20 2020

The FCC Second Report and Order was published in the Federal Register today, which sets its effective date, at which point it will be written into the rules, at December 17, 2020. These rules contain several deadline dates. Here’s a quick overview.

Second Report and Order key points

The Commission adopted their Second Report and Order for the Call Authentication Trust Anchor on September 29, 2020. Here are the key points in the Second Report and Order:

1. Service providers originating calls with NANP calling numbers must do either STIR-SHAKEN or robocall mitigation (if they qualify for an extension) on every call they originate with a NANP calling number.

• Many OSPs will do SHAKEN on some calls, robocall mitigation on others.

2. Every service provider that originates or transports calls with NANP calling numbers must file a certification with the FCC explaining how they use SHAKEN and/or robocall mitigation. This certification filing will be publicly accessible in a Robocall Mitigation Database.

3. Every service provider must refuse to transit or terminate calls from upstream providers that do not have a certification on file.

Deadline dates

Since the Second Report and Order was published in the Federal Register on November 17, 2020, it will take effect on December 17, 2020. However, this effective date does not change the deadlines in the order itself; December 17 is when the new requirements are written into the rules.

Here are the deadline dates that appear within the rules:

June 30, 2021

• Voice service providers shall
• Fully implement STIR-SHAKEN in their IP networks.
• Those who are eligible for an exemption will use a robocall mitigation program on calls they originate.
• File a certification with the FCC in a new portal for the Robocall Mitigation Database.
• In this certification, each service provider shall explain how they use STIR-SHAKEN and/or robocall mitigation to prevent the origination of illegal robocalls on their network.
• Intermediate providers shall
• Pass unaltered to the subsequent provider in the call path any authenticated caller identification information it receives with a SIP call
• Authenticate unsigned calls. This requirement is excused if the intermediate provider cooperatively participates with the industry traceback consortium.
• Providers with non-IP networks shall provide documented proof that they are participating, either on their own or through representatives, as members of groups working to develop a non-IP caller ID authentication solution.

September 28, 2021

• Intermediate and terminating voice service providers shall not accept calls from an upstream provider that does not have a certification on file in the Robocall Mitigation Database.

June 30, 2021

• Voice service providers must have filed for a Section 214 discontinuance in order to receive the exemption for STIR-SHAKEN processing on services scheduled for such discontinuance.

June 30, 2022

• Voice service providers discontinuing services under Section 214 must have discontinued the service.

June 30, 2023

• The exemption for small voice service providers with 100,000 or fewer voice subscriber lines ends. Such providers must begin STIR-SHAKEN call authentication.

Dec 1 2020 - The United States Federal Communications Commission – better known as the FCC (News - Alert) – has a lot on its plate, to say the least. When the nuisance that is robocalls earned public enemy status, STIR-SHAKEN was put in place, but initial policy implementation didn’t quite cover all the bases.

Today, the FCC announced that based on recommendations from the Cloud Communications Alliance (CCA) the Secure Telephone Identity Governance Authority (STI-GA) will abridge requirements in robocall prevention policy.

“Under the previous policy, many VoIP providers – including CCA members – were disqualified from participating in the call authentication framework even though the FCC would require participation," said Mark Iannuzzi, Chairman of CCA Government Affairs Committee and CEO of TelNet (News - Alert).

Specifically speaking, the new FCC policy allows CCA members to leverage STIR-SHAKEN via FCC Robocall Mitigation Database. The initial policy put forth by STI-GA required service providers have direct access to telephone numbers, disqualifying a number of CCA members from implementing STIR-SHAKEN and creating an environment for competitive disadvantage.

"This is great news not just for providers, but for their customers and consumers who will be better assured of the identity of callers. In turn, providers will be able to more quickly and accurately trace back to the source of a call and identify bad actors easily,” Iannuzzi continued.

Here's the answer.

Calls without digital tokens attached will show 'spam likely' or other negative terms in the caller ID screen. That's why your ASRs are dropping!

Feb 2, 2021

Washington, DC - ATIS and the Secure Telephone Identity Governance Authority (STI-GA) today announced release of the STI-GA 2020 Year-End Report, providing an overview of the technical and policy accomplishments of the STI-GA. The STI-GA is an industry-founded and industry-driven body that, through diverse industry leadership, is working to mitigate illegal caller ID spoofing.

In terms of technical accomplishments, the STI-GA's work is ensuring the SHAKEN framework is fully implemented, stable and ready for expansion. Developed by the ATIS-SIP Forum IP-NNI Task Force, STIR-SHAKEN is the solution to authenticate caller ID that was first selected by the industry and later mandated by the FCC. Implementing SHAKEN required continued development of the technical framework, the Secure Telephone Identity Policy Administrator (STI-PA) system, as well as approval of STI Certification Authorities (STI-CAs) that are required to assign certificates to authorized service providers (SPs).

Using the STI-PA system to verify SP authorization and test SP implementation capabilities, a total of 74 SPs had been cleared to join the STIR-SHAKEN ecosystem by the end of 2020. The FCC STIR-SHAKEN implementation mandate is set for June 30, 2021. Having so many providers register so early is evidence of the tremendous industry confidence in the viability and effectiveness of the SHAKEN solution and Governance Authority.

SHAKEN implementation was also advanced by the STI-GA's approval of STI Certification Authorities (STI-CAs) that are required to assign certificates to authorized service providers (SPs). Eight STI-CA's were fully approved in 2020.

In terms of policy contributions, the STI-GA issued an updated Service Provider Code (SPC) token Access Policy. The SPC token is granted to service providers who qualify under the policy to participate in the STIR-SHAKEN ecosystem. The STI-GA also issued its Revocation and Reinstatement processes designed to remove any bad actor service providers from the ecosystem.

Thus, in terms of both technical viability and policy, the robust SHAKEN framework is now ready for broader industry use and anticipated expansion in 2021, boosting the industry's ability to mitigate illegal caller ID spoofing. Learn about the accomplishments of the STI-GA in the report.

About the STI-GA

The Secure Telephone Identity Governance Authority (STI-GA) is the industry-led effort to support the timely deployment of the STIR-SHAKEN protocol and framework. The STI-GA Board consists of representatives from the following stakeholders:

• Chair - Linda Vandeloop, AT&T
• Vice Chair - Glenn Clepper, Charter Communications; appointed by NCTA - The Internet & Television Association
• Clinton Lee, Jackson Energy Authority; appointed by the America's Communications Association
• Nathan Sutter, Nex-Tech Wireless; appointed by the Competitive Carriers Association
• Indra Chalk, T-Mobile; appointed by CTIA
• Greg Rogers, Bandwidth; appointed by INCOMPAS
• Dave Frigen, Wabash Communications; appointed by NTCA - The Rural Broadband Association
• Chris Oatway, Verizon; appointed by US Telecom
• Gunnar Halley, Microsoft; appointed by the VON Coalition
• Michael Starkey, QSI Consulting, Inc.; appointed by Western Telecommunications Alliance and TEXALTEL
• Tim Kagele, Comcast
• Darah Franklin, Google

Learn more about the industry-led STI-GA and its critical contributions toward combatting illegal robocalling.

About ATIS
As a leading technology and solutions development organization, the Alliance for Telecommunications Industry Solutions (ATIS) brings together the top global ICT companies to advance the industry's business priorities. ATIS' 150 member companies are currently working to address 6G, 5G, illegal robocall mitigation, Smart Cities, wireless emergency alerts, artificial intelligence-enabled networks, distributed ledger technology, cybersecurity, IoT, emergency services, quality of service, billing support, operations, and much more. These priorities follow a fast-track development lifecycle - from design and innovation through standards, specifications, requirements, business use cases, software toolkits, open source solutions, and interoperability testing.

ATIS is accredited by the American National Standards Institute (ANSI). ATIS is the North American Organizational Partner for the 3rd Generation Partnership Project (3GPP), a founding Partner of the oneM2M global initiative, a member of the International Telecommunication Union (ITU), as well as a member of the Inter-American Telecommunication Commission (CITEL). For more information, visit www.atis.org. Follow ATIS on Twitter and LinkedIn.

FCC Requires All Voice Providers to Implement STIR-SHAKEN or Adopt Robocall Mitigation Plans by Mid-2021

By Paul B. Hudson and John C. Nelson Jr.

The Federal Communications Commission (FCC) extended its June 2021 deadline for certain small, non-IP, and other voice service providers to implement STIR-SHAKEN call authentication to reduce illegal and unwanted robocalls but required all providers relying on such extensions to prepare written robocall mitigation plans.

All U.S. voice providers and foreign providers delivering calls to the United States for termination must submit a certification of their implementation of STIR-SHAKEN or a robocall mitigation plan, and all voice service providers will have a new duty not to accept calls directly from service providers that have not submitted such certifications. These new rules set forth in the FCC's Second Report and Order (Second R&O) will significantly impact the operations and reporting obligations of nearly every voice service provider.

Background

As explained in our advisories and posts tracking the TRACED Act's implementation, in March 2020, the Commission began adopting and implementing certain robocall enforcement rules and mechanisms. Those included the establishment of a "traceback" consortium dedicated to identifying and tracing illegal robocalls, the adoption of a new rule requiring all originating and terminating voice service providers to implement the STIR-SHAKEN caller ID authentication framework in all IP portions of their networks by June 30, 2021, and safe harbor protections for providers that unintentionally or inadvertently block lawful calls.

Extensions of STIR-SHAKEN Implementation Deadline

The Second R&O grants the following extensions of the June 30, 2021, STIR-SHAKEN implementation deadline.

Two-Year Extension for Small Providers

Providers with 100,000 or fewer voice subscriber lines are granted until June 30, 2023, to implement STIR-SHAKEN on the IP portions of their networks. Subscriber line counts include all business and residential fixed subscriber lines and mobile phones and aggregated over all of the provider's affiliates.

Extension for Non-IP Portions of Provider Networks

Providers are granted a continuing extension of the STIR-SHAKEN implementation deadline for the non-IP (i.e., TDM) portions of their networks. However, such providers must either:

• (1) Completely upgrade their non-IP networks to IP and implement the STIR-SHAKEN framework; or
• (2) Work to develop a non-IP authentication solution by participating, either on its own or through a third-party representative (such as a trade association of which the provider is a member), as a member of a working group, industry standards group, or consortium until an effective non-IP caller ID authentication framework is fully developed and available on the commercial market.

One-Year Extension for Providers With Services Scheduled for Section 214 Discontinuance

Any provider that has or will file a Section 214 discontinuance application on or before June 30, 2021, is granted a one-year compliance extension to June 30, 2022.

Extension for Providers That Cannot Obtain STIR-SHAKEN Certificates

Participation in STIR-SHAKEN requires a certificate from the program's Governance Authority, which is only issued to providers that file an FCC Form 499-A, have an Operating Company Number (OCN), and can obtain direct access to telephone numbers. The FCC granted these providers an extension until they can obtain a certificate.

The FCC left the door open for provider-specific extensions, "expecting" (but not mandating) providers to file extension requests by November 20, 2020, that specifically address the undue hardships they believe the June 30, 2021, implementation deadline will place upon their resources and technical abilities. The FCC expects to resolve timely requests no later than March 30, 2021.

Robocall Mitigation Program Requirements for Providers Granted Extension

All voice service providers that rely on an extension and do not completely implement STIR-SHAKEN by June 30, 2021, must implement and document a robocall mitigation program designed to reduce unlawful robocalls originating on their networks. The FCC requires all programs to include:

• (1) Detailed practices that can reasonably be expected to significantly reduce the origination of illegal robocalls;
• (2) Compliance with the described practices; and
• (3) Participation in industry traceback efforts.

The Enforcement Bureau is empowered to prescribe more specific robocall mitigation obligations for any voice service provider it finds has implemented a deficient robocall mitigation program.

All Voice Service Providers Must Submit Certifications and Reject Traffic From Uncertified Providers

The FCC requires every voice service provider to file a certification that its traffic is either signed with STIR-SHAKEN call authentication or subject to a robocall mitigation program. Robocall mitigation certifications must detail the specific "reasonable steps" they have taken to avoid originating illegal robocall traffic.

Additional details such as company contact information will be required, and the FCC plans to announce additional details and a certification deadline during the second quarter of 2021. Providers will have an ongoing obligation to submit updated certifications within 10 days of any change.

The certifications will be used to support a public database. Beginning 90 days after the certification deadline, intermediate and terminating providers will be prohibited from accepting traffic directly from providers not shown in the database as having provided a compliant certification. This rule effectively places an additional duty on all terminating and intermediate providers to monitor the certification database to verify the listing of voice service providers with which they interconnect and to block traffic from non-certified providers.

Intermediate Provider Obligations

The Second R&O requires intermediate carriers to pass unaltered any authenticated Identity header for SIP (IP) calls that they receive from a STIR-SHAKEN participant to the subsequent provider in the call path unless removal is necessary for technical reasons to complete the call or for security reasons where the header presents a threat to its network security.

With respect to unauthenticated calls received in TDM or SIP format, intermediate providers have three options before passing a call to a subsequent provider in SIP:

• (1) Authenticate such calls with "gateway" or "C"-level attestation;
• (2) Authenticate such calls using another method "consistent with industry standards"; or
• (3) In lieu of authenticating each such call, cooperatively participate with the industry traceback consortium and respond to all traceback requests from the FCC, law enforcement, or the consortium.

Prohibition on Line Item Charges for Caller ID Authentication

The Commission prohibits providers from imposing additional line item charges on consumer or small business subscribers for caller ID authentication. This prohibition extends to the cost of upgrading network elements that are necessary to implement caller ID authentication, any recurring costs associated with the authentication and verification of calls, and any costs associated with technology needed to display caller ID authentication information on subscribers' phones.

FEBRUARY 24, 2021

The Industry Traceback Group (ITG) just published a new report, Combatting Illegal Robocalls, with interesting statistics on scam robocalls in the U.S. and progress on eradicating them through traceback. Here are highlights of this report.

About the ITG

USTelecom — The Broadband Association created the ITG in 2015 to foster cooperation in combatting illegal robocalls. In 2020, the FCC designated the ITG as the Robocall Traceback Consortium, an official role established by the TRACED Act.

We described the traceback process in a blog post on robocall traceback in the U.S. The process starts from the robocall recipient and uses an online portal to organize a process where each voice service provider identifies the next upstream provider from which they received the robocalls.

Report highlights

The report provides some interesting statistics.

Illegal robocalls continue to evolve

• In 2020, Americans fell for scam callers 270% more often than in 2019.
• 90% of scam calls from abroad now show up as U.S. numbers.
• 89% of seniors receive at least one robocall per week.
• 56% receive at least seven robocalls per week.
• The FCC estimates that the cost of wasted time and nuisance caused by scam robocalls exceeds $3 billion each year.
• Fraudulent robocall schemes cost Americans about $10 billion annually.

Traceback highlights in 2020

This traceback relies on timely compliance and participation from providers. Over time, the process has become more efficient and effective, as demonstrated by these ITG statistics from 2020:

• The ITG initiated more than 2,500 tracebacks representing hundreds of millions of robocalls.
• They conducted approximately 215 tracebacks per month.
• Up 115% from 2019 and 975% from 2018
• They received 75 subpoenas/civil investigative demands, which was up 275% from 2019.
• The ITG supported nearly a dozen enforcement actions targeting nearly 50 individuals and entities.
• The average time to complete a traceback was approximately four days, down 50% from 2019.
• The average time to complete an individual traceback segment (“hop”) ws now less than one day.
• Many providers regularly respond in less than 30 minutes.

See the full report Combatting Illegal Robocalls for further details.

Regulatory compliance with traceback

In the Fourth Report and Order on Advanced Methods to Target and Eliminate Unlawful Robocalls (CG Docket No. 17-59) released December 30, 2020, the FCC required voice service providers to participate in traceback. Here are important quotes from the order:

We adopt our proposal to require all voice service providers to respond to traceback requests from the Commission, civil and criminal law enforcement, and the Consortium...

Some commenters express concern that traceback requests may not go to the correct contact within the organization. We encourage voice service providers to publicly designate a point of contact for such requests...

We generally expect responses within a few hours, and certainly in less than 24 hours absent extenuating circumstances. Patterns of delayed response may lead to Commission enforcement.

Legislation has been reintroduced in the U.S. Senate to require the FCC to issue rulemaking that establishes a Critical Call List of calling numbers that are not eligible to be blocked by voice service providers. Here’s an overview.

The Data Analytics Robocall Technology (DART) Act, S.357, was introduced February 24, 2021 by U.S. Senators Mike Crapo (R-Idaho) and Amy Klobuchar (D-Minnesota). The Senate passed this bill unanimously in December 2020, but it did not pass out of the House of Representatives before the end of the 116th Congress.

Legislation

The DART Act would require the FCC to do the following:

1. Maintain a list of numbers that are not eligible to be blocked by a voice service provider (Critical Call List)
2. Prepare reports to Congress on deployment and implementation of call blocking and caller ID authentication. These reports shall include:
• An analysis by the Commission of the effectiveness of call blocking tools
• Any legislative recommendations of the Commission.

The Critical Call List may include numbers used:

• For outgoing calls by a public safety answering point or a similar facility that is designated to originate or route emergency calls
• To originate calls from a government entity, such as a call generated during an emergency
• By a school or similar instution to provide school-related notifications such as weather-related closure or a school emergency
• For similar emergency purposes as determined by the Commission.

Deadlines

Deadlines for these measures are:

1. Critical Call List: 18 months after enactment of the DART Act
2. Reports to Congress: 180 days after the Commission receives any report under paragraph 90 of the Declaratory Ruling and Third FNPRM for Advanced Methods to Target and Eliminate Robocalls, released June 7, 2019, which called for “the Wireline Competition Bureau (WCB) and Public Safety and Homeland Security Bureau (PSHSB), to prepare two reports on the state of deployment of advanced methods and tools to eliminate such calls, including the impact of call blocking on 911 and public safety.”

Written by Tim Starks
MAR 1, 2021 | CYBERSCOOP

After a surprising lull at the onset of the COVID-19 pandemic, phone scammers are back, and showing signs of overlapping more and more with text messages and cyber elements.

Scammers are combining phone calls with tricks to circumvent two-factor authentication, using information they obtain online to make more targeted calls and, in some cases, mimicking the attack methods of hackers, government and industry officials say.

Phone scams that merge with other methods are growing more frequent and difficult to contend with, said Connecticut Attorney General William Tong. “I think it’s common and it’s dangerous, particularly the way that they’re able to cloak themselves or convince you that you need to respond to a particular call or email,” he said.

Internet technology has helped fuel a record number of robocalls thanks to the advent of voice-over IP, a tool that made mass calling convenient and more affordable. Estimates vary, but most studies conclude that U.S. consumers lose billions of dollars annually to phone scams.

Since early in the pandemic, the number of robocalls has hovered at between 3 and 4 billion robocalls per month, and somewhere in the vicinity of 2 billion scam calls within that number, said Alex Quilici, CEO of YouMail, a robocall blocking company. The figure is up from an estimated 2.9 billion in April 2020, some 1.2 billion of which were scam calls. In October 2019, though, YouMail estimated the robocall number at closer to 5.7 billion, roughly 2.4 billion of which were scam calls — a label the company applies to “clearly illegal” calls.

Several factors have pushed the overall numbers down after reaching that record high in late 2019, one of which is improving consumer savvy. That, in turn, has forced scammers to get creative.

“We’re doing way better on robocalls than we were,” said Quilici. “What happened, though, is with the pandemic, people got spoiled and said, ‘Hey, the robocalls went away,’ and now they’re starting to come back and it’s really noticeable.”

The numbers dropped at the pandemic’s outset, according to several experts, because physical call centers still play a role in the number of calls that go out. Those centers, like everyone else, were shutting down offices and adapting to working from other locations. A scam-busting activist featured in the New York Times recently boasted of turning on webcams at those call centers in places like India, where footage shows employees working in cubicles.

While phone scams might be showing more creativity, there is a history of them overlapping with other mediums.

Tech support scam calls usually have had a cybersecurity dimension. In that variety, fraudsters call up pretending to be from Microsoft or another vendor, then say they need access to a victim’s computer to remedy an apparent virus or other fictional technical issue. Finally, the swindlers install malware or try to sell worthless security products.

Tech support scams can also be conducted without phone calls, such as via email.

Quilici said that the real danger, however, is the increasing sophistication of scammers as opposed to just the volume. He said he can see those tech support scammers move toward, say, obtaining a targeted list online of people using a specific version of Windows.

“That’s my worry is that’s where this tech support stuff is going to head,” he said. “They’re going to find lists, they’re going to have information that’s about the person they’re calling that convinces a person they really know it’s them.”

In one kind of scam Proofpoint is seeing more often, the grifters send a text message pretending to be from a bank and ask if a made-up transaction was fraudulent. When the victim replies that they didn’t make that purchase, the scammers call, then swindle the victim into helping circumvent two-factor authentication to gain access to real bank accounts.

Increasingly, consumers have learned to not answer calls from unknown numbers or calls labeled spam by their carriers, said Jacinta Tobin, vice president of cloudmark operations for Proofpoint. But mobile phone users open almost all their text messages, she said.

“So there’s a kind of multimodal cumulative trust that builds, meaning if you get a text and a call from the same person, you’re more likely to trust that source,” she said.

USTelecom, a phone industry organization, established the Industry Traceback Group, which many observers have credited with helping crack down on scam callers. The group is a collaborative industry effort to trace the origins of illegal calls, and it also works closely with law enforcement and regulatory agencies. Josh Bercu, vice president of policy and advocacy, said the traceback program has increasingly been tracing back two kinds of cybersecurity-related calls.

In one variety, scammers make phishing calls in a bid to obtain credentials from call center workers, other employees or customers so they can “do the same thing any cybersecurity hacker can do,” Bercu said.

The other kind the group is increasingly tracing back is “telephonic denial of service (TDoS)” attacks that mimic the tactics of internet distributed denial of service attacks, with the TDoS offenders sometimes flooding a victim’s phone lines beyond their capacity and then demanding a ransom to stop.

One of the most infamous hacks of 2020, where hackers took over high-profile Twitter accounts including those of then-presidential candidate Joe Biden, came after a “phone spear phishing attack” on Twitter employees — although the social media company didn’t offer many more details.

What makes the numbers move

Besides the pandemic and the rise of voice-over IP, other factors affect the rise and fall of robocalls and scam calls, for good or ill.

Asked what’s challenging about battling phone scammers, an attorney in the Federal Trade Commission’s Bureau of Consumer Protection said the nature of telephonic infrastructure itself makes it difficult.

“The issue is that you’ve got a phone network that’s designed to be open source, and with a diffuse network that is designed to avoid outages in certain areas there can be almost an infinite number of pathways that travel from point A to point B, so that there’s redundancy in the system,” said the attorney, Will Maxson.

Designed more than 100 years ago, the copper line that transmits calls can’t carry very much data about a call source, either, Maxson said. That makes it relatively easy for scammers to spoof other numbers.

One thing that might help with that problem is the Federal Communications Commission mandate, under a 2019 law, for carriers to implement a set of caller ID authentication protocols known as STIR-SHAKEN.

Under STIR-SHAKEN, “calls traveling through interconnected phone networks would have their caller ID ‘signed’ as legitimate by originating carriers and validated by other carriers before reaching consumers,” the FCC touted. “Once implemented, it should greatly help the accuracy of caller ID information and should allow voice service providers to provide helpful information to their consumers about which calls to answer.”

The seasons can also drive scam calls numbers, with Proofpoint’s Tobin predicting a rise in Internal Revenue Service-themed fraud efforts as the tax filing deadline approaches.

Law enforcement and other regulatory agencies taking action against illegal callers can demonstrate an immediate impact. Quilici said that an operation in India in December, for instance, drove down overall numbers in January.

Tong and other attorneys general fear that a pending court case could hamper their joint effort to battle robocallers. In 2015, Congress enacted an amendment to a 1991 law, the Telephone Consumer Protection Act that placed restrictions on robocalls. That amendment allowed an exception to robocalls for collecting government debt. The Supreme Court last year struck down that exception.

Because of that Supreme Court ruling, a lower court ruled that the 1991 law’s robocall ban was unenforceable between 2015 and 2020. Last month, a group of attorneys general filed a friend of the court brief arguing against that lower court ruling.

One thing that probably won’t affect the battle against robocalls and scam calls is the shift to a new presidential administration, though, Maxson said.

“From my experience, it hasn’t changed at all really on this issue,” he said. “It’s been an enforcement priority for essentially every commissioner, for every chairman and chairwoman that I’ve worked under.”

Two ransomware groups that CrowdStrike dubs Sprite Spider and Carbon Spider are trying to boost revenue

Ransomware gangs that target big corporations for extortion have long designed their code to execute on Microsoft Windows systems because of the popularity of the operating software.

Now, though, crooks are increasingly applying that tactic to the “hypervisor” computer servers that organizations use to manage virtual machines as a way of maximizing their extortion schemes, security firm CrowdStrike said Friday.

Ransomware hackers have targeted hospitals and schools throughout the pandemic, a security challenge that the Biden administration has vowed to address. Alejandro Mayorkas, the newly installed Homeland Security secretary, on Thursday called ransomware attacks on U.S. public and private organizations an “epidemic” while pledging more government resources to fight the problem.  

Breaching a hypervisor is an efficient way for the scammers to encrypt all of the virtual machines running on that software system without having to individually infect each machine. The goal is to up the pressure on big organizations to pay out hefty ransoms.

In the second half of 2020, two Eastern European criminal groups that CrowdStrike calls Sprite Spider and Carbon Spider began deploying malicious code written for the Linux operating system and designed to affect ESXi, a type of hypervisor.

CrowdStrike did not name the organizations targeted by the malware, but the firm warned that other groups could emulate the activity. The company published details on the emerging technique in a blog post.

The emergence of the Linux-focused ransomware strains comes as organizations are increasingly using virtual machines to consolidate their IT networks. But that concentration of resources on a few servers also risks creating a “virtual jackpot” for ransomware gangs, as CrowdStrike researchers Eric Loui and Sergei Frankoff put it.

The evolution of the two cybercriminal groups mirrors the broader ransomware ecosystem that now thrives on a “ransomware-as-a-service” model that leases hacking tools to maximize profit. Shortly after the coronavirus pandemic took hold and the hospitality sector suffered, Carbon Spider shifted from targeting point-of-sale devices to large organizations as a business tactic, according to CrowdStrike.

“This development shows that the ransomware actors are continuing to find new targets, when we see more than one adversary evolve in this way, it likely signifies others will follow suit,” said Adam Meyers, CrowdStrike’s vice president of intelligence.

Four U.S. Senators – two from each side of the aisle – have introduced S. 594, the Anti-Spoofing Penalties Modernization Act of 2021.  The lead sponsor – Senator Susan Collins (R-ME) – is joined by Senators Gary Peters (D-MI), Josh Hawley (R- MO) and Kyrsten Sinema (D-AZ) (https://www.collins.senate.gov/newsroom/bill-crack-down-deceptive-tactic-used-robocallers-introduced-senators-collins-sinema-0).

The proposal would double the penalties currently permitted under Section 227(e)(5) of the Telephone Consumer Protection Act (TCPA), as amended by the Truth In Caller ID Act, for illegal robocalls that spoof the telephone number for caller identification purposes.

The current civil forfeiture penalty for each violation would increase from $10,000 to $20,000, or three times that amount for each day of a continuing violation. The current $1,000,000 maximum penalty for any continuing violation would increase to $2,000,000.

The bill has been referred to the Senate Committee on Commerce, Science and Transportation, of which Senators Peters and Sinema are members.

MARCH 2, 2021

Robocall activity plummeted during the first pandemic wave of March–April 2020. Since then, robocalls have been gradually increasing each month and have returned to pre-pandemic levels, despite increased use of robocall prevention measures. Let’s take a closer look.

Monthly robocalls peaked during 2020 at 4.8 billion in February. During March and April, monthly robocall volume dropped 41%, to just under 3 billion per month. CNN reported that the decline included both scam and legitimate robocalls:

The decline coincides with the shuttering of call centers in countries such as India, Pakistan and the Philippines, where workers who are placing unwanted robocalls don’t own laptops to support working from home and some have lost their jobs or been furloughed.

Since April 2020, monthly robocalls have been increasing an average of about 5% per month. Anecdotally we’ve heard about, and experienced for ourselves, an increase in spam robocalls, especially during February 2021.

Robocall prevention actions in 2020

How did this happen? It seems like there was considerable effort to prevent illegal robocalls during this time:

1. The FCC and FTC asked international gateway providers in February 2020, April 2020, and again in May 2020 to block scam robocalls from reaching U.S. consumers. This signaled a heightened level of scrutiny and enforcement from government regulators.

2. In May 2020, the FCC announced that it will no longer warn illegal robocallers before issuing penalties.

3. In June 2020 the FCC announced a $225 million fine against two Texas-based robocallers

4. In June 2020, the FCC issued a staff report on robocall blocking that touted widespread availability of robocall blocking services from voice service providers. Some providers initiated opt-out blocking by default. Many providers reported blocking millions of calls.

5. In July 2020, the FCC approved robocall blocking rules that provide safe harbor to protect voice service providers from liability if they inadvertently block wanted calls. These rules were published in the Federal Register in September 2020 and became effective in October 2020.

6. In July 2020, The FCC designated the Industry Traceback Group as the Registered Traceback Consortium.

7. In September 2020, the FTC and State of Ohio invoked a $2.1 million settlement against a VoIP service provider for bringing illegal robocalls into the U.S.

8. In October 2020, The FCC fined an Arizona-based telemarketer $37.5 million for illegal robocalls.

9. In October 2020, The FCC issued a report and order on one-ring (Wangiri) scam calls. The order explicitly enables voice service providers to block calls from telephone numbers that are highly likely to be associated with one-ring scams. The order also extended safe harbor for blocking such calls.

10. In February 2021, the Industry Traceback Group, which is the designated Robocall Traceback Consortium, reported on the progress made in 2020 in tracing illegal robocalls.

• Approximately 215 tracebacks per month, up 115% from 2019 and 975% from 2018
• Received 75 subpoenas/civil investigation demands, up 275% from 2019
• Supported nearly a dozen enforcement actions target nearly 50 individuals and entities
• Average time to complete a traceback was approximately four days, down 50% from 2019

11. On December 30, 2020, the FCC issued a report and order that requires voice service providers to participate in traceback.

Why are robocalls still increasing?

Money. Illegal robocalls are typically trying to sell something or swindle their victims using some sort of scam. The combination of financial motive and lack of effective mitigation, despite increased efforts, means that illegal robocalls are still with us, and growing.

Our STIR-SHAKEN products:

· Most affordable commercial solutions

· Work with any TDM and/or SIP network

· Include support with all aspects of deployment.

Robocall prevention in 2021

There are more robocall prevention initiatives coming in 2021:

• All voice service providers that originate calls with U.S. NANP calling numbers must perform STIR-SHAKEN call authentication by June 30, 2021.
• Exemptions are available for some categories of calls and service providers. However, any provider exercising an exemption must perform robocall mitigation on calls that they originate. Such providers must also describe their Robocall Mitigation Plan in a certification they will file with the FCC.
• Notice that this robocall mitigation requirement applies at origination, not termination. Many terminating service providers offer robocall prevention, but that doesn’t count for the new robocall mitigation mandate.
• All voice service providers that originate, transit, or terminate calls with U.S. NANP calling numbers must file a Robocall Mitigation Certification with the FCC by June 30, 2021.
• Voice service providers must refuse to accept calls with U.S. NANP calling numbers from originating or intermediate providers that do not have a Robocall Mitigation Certification on file.

Will new measures be sufficient?

The legislators who drafted the TRACED Act, and regulators that enforce it, certainly believe that call authentication and robocall blocking safe harbor will be sufficient to curb illegal robocalls.

However, there is a widely held belief in the industry that call authentication is necessary but not sufficient to reduce illegal robocalls. We agree with this view, for the following reasons:

• STIR-SHAKEN call authentication only tells the terminating provider that the calling number is not spoofed. It does not identify bad calls, nor is it intended to do that.
• Call analytics can identify suspicious calls—those calls likely to be robocalls. However, call analytics doesn’t work as well when the calling number is spoofed, especially neighbor-spoofed legitimate numbers. (There is an innovative technique to identify neighbor spoofing, but it is not available in all call scenarios.)
• Call authentication and call analytics are powerfully effective when used together. It should be both, not either/or.

The TRACED Act and regulations that enforce it require call authentication. Robocall mitigation is only required for use on origination of calls that are not authenticated with STIR-SHAKEN.

Several commentators have urged the FCC to require both call authentication and robocall mitigation, but the Commission has not done so, because the TRACED Act does not instruct them to issue such a rule.

Perhaps customer complaints will pressure voice service providers to perform call authentication and robocall mitigation at origination, and robocall prevention at termination on all calls. The regulations allow this, but do not require it.

MARCH 2, 2021

Robocall activity plummeted during the first pandemic wave of March–April 2020. Since then, robocalls have been gradually increasing each month and have returned to pre-pandemic levels, despite increased use of robocall prevention measures. Let’s take a closer look.

Monthly robocalls peaked during 2020 at 4.8 billion in February. During March and April, monthly robocall volume dropped 41%, to just under 3 billion per month. CNN reported that the decline included both scam and legitimate robocalls:

The decline coincides with the shuttering of call centers in countries such as India, Pakistan and the Philippines, where workers who are placing unwanted robocalls don’t own laptops to support working from home and some have lost their jobs or been furloughed.

Since April 2020, monthly robocalls have been increasing an average of about 5% per month. Anecdotally we’ve heard about, and experienced for ourselves, an increase in spam robocalls, especially during February 2021.

Robocalls are back.

Robocall prevention actions in 2020

How did this happen? It seems like there was considerable effort to prevent illegal robocalls during this time:

1. The FCC and FTC asked international gateway providers in February 2020, April 2020, and again in May 2020 to block scam robocalls from reaching U.S. consumers. This signaled a heightened level of scrutiny and enforcement from government regulators.
2. In May 2020, the FCC announced that it will no longer warn illegal robocallers before issuing penalties.
3. In June 2020 the FCC announced a $225 million fine against two Texas-based robocallers.
4. In June 2020, the FCC issued a staff report on robocall blocking that touted widespread availability of robocall blocking services from voice service providers. Some providers initiated opt-out blocking by default. Many providers reported blocking millions of calls.
5. In July 2020, the FCC approved robocall blocking rules that provide safe harbor to protect voice service providers from liability if they inadvertently block wanted calls. These rules were published in the Federal Register in September 2020 and became effective in October 2020.
6. In July 2020, The FCC designated the Industry Traceback Group as the Registered Traceback Consortium.
7. In September 2020, the FTC and State of Ohio invoked a $2.1 million settlement against a VoIP service provider for bringing illegal robocalls into the U.S.
8. In October 2020, The FCC fined an Arizona-based telemarketer $37.5 million for illegal robocalls.
9. In October 2020, The FCC issued a report and order on one-ring (Wangiri) scam calls. The order explicitly enables voice service providers to block calls from telephone numbers that are highly likely to be associated with one-ring scams. The order also extended safe harbor for blocking such calls.
10. In February 2021, the Industry Traceback Group, which is the designated Robocall Traceback Consortium, reported on the progress made in 2020 in tracing illegal robocalls.
• Approximately 215 tracebacks per month, up 115% from 2019 and 975% from 2018
• Received 75 subpoenas/civil investigation demands, up 275% from 2019
• Supported nearly a dozen enforcement actions target nearly 50 individuals and entities
• Average time to complete a traceback was approximately four days, down 50% from 2019

11. On December 30, 2020, the FCC issued a report and order that requires voice service providers to participate in traceback.

Why are robocalls still increasing?

Money. Illegal robocalls are typically trying to sell something or swindle their victims using some sort of scam. The combination of financial motive and lack of effective mitigation, despite increased efforts, means that illegal robocalls are still with us, and growing.

Robocall prevention in 2021

There are more robocall prevention initiatives coming in 2021:

• All voice service providers that originate calls with U.S. NANP calling numbers must perform STIR/SHAKEN call authentication by June 30, 2021.
• Exemptions are available for some categories of calls and service providers. However, any provider exercising an exemption must perform robocall mitigation on calls that they originate. Such providers must also describe their Robocall Mitigation Plan in a certification they will file with the FCC.
• Notice that this robocall mitigation requirement applies at origination, not termination. Many terminating service providers offer robocall prevention, but that doesn’t count for the new robocall mitigation mandate.
• All voice service providers that originate, transit, or terminate calls with U.S. NANP calling numbers must file a Robocall Mitigation Certification with the FCC by June 30, 2021.
• Voice service providers must refuse to accept calls with U.S. NANP calling numbers from originating or intermediate providers that do not have a Robocall Mitigation Certification on file.

Will new measures be sufficient?

The legislators who drafted the TRACED Act, and regulators that enforce it, certainly believe that call authentication and robocall blocking safe harbor will be sufficient to curb illegal robocalls.

However, there is a widely held belief in the industry that call authentication is necessary but not sufficient to reduce illegal robocalls. We agree with this view, for the following reasons:

• STIR/SHAKEN call authentication only tells the terminating provider that the calling number is not spoofed. It does not identify bad calls, nor is it intended to do that.
• Call analytics can identify suspicious calls—those calls likely to be robocalls. However, call analytics doesn’t work as well when the calling number is spoofed, especially neighbor-spoofed legitimate numbers. (There is an innovative technique to identify neighbor spoofing, but it is not available in all call scenarios.)
• Call authentication and call analytics are powerfully effective when used together. It should be both, not either/or.

The TRACED Act and regulations that enforce it require call authentication. Robocall mitigation is only required for use on origination of calls that are not authenticated with STIR/SHAKEN.

Several commentators have urged the FCC to require both call authentication and robocall mitigation, but the Commission has not done so, because the TRACED Act does not instruct them to issue such a rule.

Perhaps customer complaints will pressure voice service providers to perform call authentication and robocall mitigation at origination, and robocall prevention at termination on all calls. The regulations allow this, but do not require it.

.

800-213-5077

1,700,600

Toll Free

Toll Free

Synchrony Bank

Financial Customer Call

91.

800-853-6485

1,689,800

Toll Free

Toll Free

Health IQ

Medicare Insurance Spam

92.

877-647-8551

1,666,500

Toll Free

Toll Free

Wells Fargo

Bank/Credit Card Payment Reminder

93.

877-488-3538

1,666,500

Toll Free

Toll Free

Citibank

Bank/Credit Card Payment Reminder

94.

888-673-8490

1,659,800

Toll Free

Toll Free

Ally Financial

Debt Collector

95.

833-574-1910

1,642,400

Toll Free

Toll Free

Sequium

Debt Collector

96.

888-895-5629

1,633,600

Toll Free

Toll Free

Chinese Language Scam

Debt Collector

97.

206-922-0880

1,630,700

Seattle, WA

Global Crossing Local Services, Inc.

Amazon

Customer Call

98.

855-306-6998

1,622,000

Toll Free

Toll Free

Ally Financial

Bank/Credit Card Payment Reminder

99.

800-266-2278

1,621,600

Toll Free

Zipwhip

Comcast

Customer Call

100.

866-250-7212

1,613,700

Toll Free

Toll Free

Debt Collection Scam

Flu Shot Reminder

INTRODUCTION

1. Protecting Americans from the dangers of unwanted and illegal robocalls is our top

consumer protection priority.1 More than just an annoyance, these calls are a tool for scammers to take advantage of unsuspecting Americans. Bad actors often “spoof” or falsify caller ID information and deceive call recipients into believing they are trustworthy.2 Even in the midst of the COVID-19 pandemic, bad actors have continued their attempts to use illegal spoofing to target American consumers, once again illustrating the pervasiveness of this problem.3

2. As part of our multi-pronged approach to combat this vexing issue, 4 we have made it a priority to stop the practice of illegal caller ID spoofing.5 For instance, we have issued hundreds of millions of dollars in fines for violations of our Truth in Caller ID rules.6 We recently proposed a forfeiture of $225 million—the largest in the Commission’s history—for a company that made approximately one billion spoofed robocalls,7 and we proposed two forfeiture actions of almost $13 million and $10 million apiece against other entities for apparent spoofing violations.8 We have expanded our Truth in Caller ID rules to reach foreign calls and text messages.9 Pursuant to the TRACED Act, we have selected a consortium to conduct private-led traceback efforts of suspected illegal robocalls, which is particularly useful in instances where the caller ID information transmitted with a call has been

maliciously spoofed.

One key part of our broad efforts to thwart illegal caller ID spoofing has been our work to promote implementation of the STIR/SHAKEN caller ID authentication framework. The STIR/SHAKEN framework allows voice service providers to verify that the caller ID information transmitted with a particular call matches the caller’s number, while protecting consumer privacy and promoting the ability to complete lawful calls. Widespread implementation of STIR/SHAKEN will reduce the effectiveness of illegal spoofing, allow law enforcement to identify bad actors more easily, and help voice service providers identify calls with illegally spoofed caller ID information before those calls reach their subscribers. We have worked over the course of multiple years to promote caller ID authentication,12 and in 2019 Congress amplified our efforts by passing the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence (TRACED) Act, which directs the Commission to take numerous steps to promote and require STIR/SHAKEN implementation.13 In March of this year, building on the foundation laid by our prior work and by Congress, we adopted rules requiring voice service providers to implement the STIR/SHAKEN call authentication technology in the internet protocol (IP) portions of their phone networks by June 30, 2021.14

3. Today, we continue our work to promote the deployment of caller ID authentication technology and to implement the TRACED Act. After consideration of the record, we adopt rules implementing many of the proposals we made in the First Caller ID Authentication Report and Order and Further Notice. Among other things, we adopt rules governing intermediate providers and caller ID

authentication in non-IP networks, we implement the exceptions and extensions established by the TRACED Act, and we prohibit line-item charges for caller ID authentication.

II. BACKGROUND

5. As the telecommunications industry has advanced and expanded into IP-based telephony, costs have decreased as competition increased, benefitting consumers greatly. These benefits, however, have eroded the chains of trust that previously bound voice service providers together. Partly due to the rise of the Voice over Internet Protocol (VoIP) software, the telephony industry no longer consists only of a limited number of carriers that all trusted each other to provide accurate caller ID information. Because there are now a multitude of voice service providers and entities originating and transiting calls, bad actors can more easily take advantage of these weakened chains of trust to target consumers with illegally spoofed calls.15

6. Recognizing this vulnerability, technologists from the Internet Engineering Task Force (IETF) and the Alliance for Telecommunications Industry Solutions (ATIS) developed standards to allow the authentication and verification of caller ID information for calls carried over IP networks using the Session Initiation Protocol (SIP).16 Since voice service providers could no longer count on the multitude of entities in each call path to accurately pass the caller ID information, the goal was to create a system that allowed the identification information to safely and securely travel with the call itself. The result is the STIR/SHAKEN call authentication framework.

7. The framework is comprised of several different standards and protocols. The Secure Telephony Identity Revisited (STIR) working group, formed by the IETF, has produced several protocols for authenticating caller ID information.17 ATIS, together with the SIP Forum,18 produced the Signature- based Handling of Asserted information using toKENs (SHAKEN) specification, which standardizes how the protocols produced by STIR are implemented across the industry using digital “certificates.”19 At a high-level, the STIR/SHAKEN framework consists of two components: (1) the technical process of authenticating and verifying caller ID information; and (2) the certificate governance process that

maintains trust in the caller ID authentication information transmitted along with a call.

8. Technology. The STIR/SHAKEN technical authentication and verification processes rely on public key cryptography to securely transmit the information that the originating voice service provider knows about the identity of the caller and its relationship to the phone number it is using throughout the entire length of the call path, allowing the terminating voice service provider to verify the information on the other end.20 The encrypted caller ID information is contained within a unique header to the message used to initiate a SIP call (the SIP INVITE message), called an “Identity” header.21 While there is no technical mechanism within the STIR/SHAKEN framework that ensures this Identity header travels the entire length of the call path unaltered, the unbroken transmission of an unaltered Identity header from the originating voice service provider, through each intermediate provider, to the terminating voice service provider is critical to creating the end-to-end chain of trust that allows a terminating provider to know it has received accurate caller ID information.22

9. Because providers transmit the Identity header in a SIP INVITE and because SIP is IP- based, STIR/SHAKEN only operates in the IP portions of a provider’s network.23 If a call originates on a non-IP network, that voice service provider cannot authenticate the caller ID information; if it terminates on a non-IP network, that voice service provider cannot verify the caller ID authentication information. And if a call is routed at any point over an interconnection point or intermediate provider network that does not support the transmission of SIP calls, the Identity header will be lost.24 While standards bodies are currently working on non-IP call authentication solutions,25 and some vendors are developing potential non-IP solutions,26 there is yet to be an industry consensus on the path forward.27

10. In the STIR/SHAKEN framework, the provider adding the Identity header to the SIP INVITE can use three different levels of attestation to signify what it knows about the identity of the calling party. The highest level of attestation is called full or A-level attestation. A provider assigns an A-level attestation when it is the entry point of the call onto the IP network, it can confirm the identity of the subscriber making the call, and the subscriber is using its associated telephone number.28 The method

or process a provider uses to determine the legitimacy of the caller’s use of a telephone number is specific to each provider.29 As a result, a provider’s reputation is tied to the rigor of its evaluation process.30 The middle level of attestation is called partial or B-level attestation. A provider uses a B-level attestation to

indicate that it is the entry point of the call onto the IP network and can confirm the identity of the subscriber but not the telephone number.31 The lowest level of attestation is called gateway or C-level attestation. A provider uses a C-level attestation when it is the point of entry to the IP network for a call that originated elsewhere but has no relationship with the initiator of a call, such as when a provider is acting as an international gateway.32 A downstream provider can make use of a C-level attestation to trace a call back to an interconnecting service provider or the call’s entry point into the IP network.33 The STIR/SHAKEN standards envision these various attestation levels as information that can facilitate traceback and to enhance the spam identification solutions that terminating voice service providers enable for their customers.34

11. Governance. The STIR/SHAKEN framework relies on digital “certificates” to ensure trust. The voice service provider adding the Identity header includes its assigned certificate which says, in essence, that the voice service provider is the entity it claims to be and that it has the right to authenticate the caller ID information.35 To maintain trust and accountability in the voice service providers that vouch for the caller ID information, a neutral governance system issues the certificates.36 The STIR/SHAKEN governance model requires several roles in order to operate: (1) a Governance Authority, which defines the policies and procedures for which entities can issue or acquire certificates;37 (2) a Policy Administrator, which applies the rules set by the Governance Authority, confirms that certification authorities are authorized to issue certificates, and confirms that voice service providers are authorized to request and receive certificates;38 (3) Certification Authorities, which issue the certificates used to authenticate and verify calls;39 and (4) the voice service providers themselves, which, as call initiators, select an approved certification authority from which to request a certificate, and which, as call recipients, check with certification authorities to ensure that the certificates they receive were issued by the correct certification authority.40 Voice service providers use the digital certificates to indicate that they are trusted members of the ecosystem and their assertions to a calling party’s identity should be accepted.41

12. Under the current Governance Authority rules, a voice service provider must meet certain requirements to receive a certificate.42 Specifically, a voice service provider must have a current FCC Form 499A on file with the Commission, have been assigned an Operating Company Number (OCN), and have direct access to telephone numbers from the North American Numbering Plan Administrator (NANPA) and the National Pooling Administrator.43 The Governance Authority reviews this policy “at least on a quarterly basis,” or as needed.44

13. Commission Action to Promote STIR/SHAKEN. In 2017, the Commission released a Notice of Inquiry into STIR/SHAKEN, launching a broad examination of how to expedite its development and implementation.45 The Commission directed its expert advisory committee on numbering, the North American Numbering Council (NANC), to recommend “criteria by which a [Governance Authority] should be selected” and “a reasonable timeline or set of milestones for adoption and deployment” of STIR/SHAKEN.46 In its May 2018 report,47 the NANC made a number of recommendations regarding establishing and organizing a governance system and promoting STIR/SHAKEN implementation, which Chairman Pai then accepted.48 In November 2018, Chairman Pai sent letters to 14 major voice service providers urging them to implement a robust caller ID authentication framework by the end of 2019, asking providers for specific details on their progress and plans.49 In June 2019, the Commission adopted a Declaratory Ruling and Third Further Notice of Proposed Rulemaking that proposed and sought comment on mandating implementation of STIR/SHAKEN in the event that major voice service providers did not voluntarily implement the framework by the end of 2019.50 Commission staff closely tracked the implementation progress of major voice service providers.51 In December 2019, Congress enacted the TRACED Act, which contains numerous provisions directed at addressing robocalls, including through implementation of STIR/SHAKEN.52 Among other provisions

regarding caller ID authentication, the TRACED Act directed the Commission to require, no later than 18 months from enactment, all voice service providers to implement STIR/SHAKEN in the IP portions of their networks and implement an effective caller ID authentication framework in the non-IP portions of their networks.53

14. In March of this year, we released the First Caller ID Authentication Report and Order and Further Notice in which we adopted rules requiring voice service providers to implement the STIR/SHAKEN caller ID authentication framework in the IP portions of their networks by June 30, 2021.54 We also proposed and sought comment on requirements to strengthen STIR/SHAKEN to implement the TRACED Act. First, we proposed to extend the STIR/SHAKEN implementation mandate to intermediate providers and require them to both pass authenticated caller ID information unaltered and to authenticate unauthenticated calls they receive.55 Second, turning to TRACED Act implementation, we proposed to grant an extension for compliance with the implementation mandate for certain categories of voice service providers, specifically small voice service providers and voice service providers that materially rely on non-IP networks.56 Third, we proposed to require voice service providers using non-IP technology, which cannot support STIR/SHAKEN, to either (i) upgrade their networks to IP to enable STIR/SHAKEN implementation or (ii) work to develop non-IP caller ID authentication technology.57 Fourth, we proposed to implement a process, as directed by the TRACED Act, pursuant to which voice service providers may become exempt from the STIR/SHAKEN implementation mandate if we determine that they have achieved certain implementation benchmarks.58 Fifth, we proposed to prohibit voice service providers from imposing additional line item charges on consumer and small business subscribers for caller ID authentication.59 Sixth, we sought comment on how to address consumer confusion or competition issues related to call labeling.60 Finally, we sought comment, as directed by the TRACED Act, on whether and how to modify our policies regarding access to numbering resources to help reduce illegal robocallers’ access.61

15. Implementation Progress. As reported previously, major voice service providers fell into one of three categories regarding their implementation progress by the end of 2019: (1) voice service providers that upgraded their networks to support STIR/SHAKEN and began exchanging authenticated traffic with other voice service providers; (2) voice service providers that upgraded their networks to support STIR/SHAKEN but had not yet begun exchanging authenticated traffic with other voice service providers; and (3) voice service providers that had achieved limited, if any, progress towards upgrading their networks to support STIR/SHAKEN.62 Since the end of 2019, several major voice service providers have announced further progress in STIR/SHAKEN implementation. In February 2020, T-Mobile announced that it began exchanging authenticated traffic with Sprint,63 and in March 2020, Bandwidth announced that it has begun exchanging authenticated traffic with T-Mobile.64 In addition to the 14 major voice service providers discussed in detail in the First Caller ID Authentication Report and Order and Further Notice, other voice service providers and intermediate providers have made progress toward STIR/SHAKEN implementation as well.65 The Governance Authority reports that 34 voice service providers have been approved to participate in the STIR/SHAKEN framework through the governance system; 9 providers have completed the testing process and are finalizing their approval; and 52 providers have begun registration and are in some stage of the testing process.66

III. SECOND REPORT AND ORDER

16. Today, we take the next steps to promote the widespread deployment of caller ID authentication technology and implement the TRACED Act. In the Report and Order, we first address the definitions and scope of several terms used in the TRACED Act. Next, we adopt rules on caller ID authentication in non-IP networks. We assess the burdens and barriers to implementation faced by various categories of voice service providers and adopt extensions to the STIR/SHAKEN mandate based on our assessment. We also establish the required robocall mitigation program that voice service providers with an extension must implement and elaborate on the annual reevaluation process for extensions required by the TRACED Act. We then adopt rules implementing the exemption mechanism established by the TRACED Act for voice service providers that meet certain criteria regarding early STIR/SHAKEN implementation. We prohibit voice service providers from imposing additional line item charges for call authentication technology. Finally, to avoid gaps in a call path that could lead to the loss of caller ID authentication information, we expand our STIR/SHAKEN implementation mandate to encompass intermediate providers.

A. TRACED Act Definitions and Scope

17. In the First Caller ID Authentication Report and Order and Further Notice, we adopted definitions of several terms used in the TRACED Act. Specifically, we adopted definitions of “STIR/SHAKEN authentication framework” and “voice service” that closely align with the statutory language enacted by Congress.67 To provide an opportunity for further refinement of the definitions we adopted, we sought comment in the Further Notice on whether to alter or add to them.68 We also proposed in the Further Notice to interpret “providers of voice service” on a call-by-call basis rather than

a provider-by-provider basis in order to best effectuate Congressional direction.69 In other words, we proposed evaluating whether a specific entity is a voice service provider (i.e., “provider of voice service”) within the meaning of the TRACED Act on the basis of the entity’s role with respect to a particular call, rather than based on the entity’s characteristics as a whole. Today, we reaffirm our definitions of “STIR/SHAKEN authentication framework” and “voice service,” and adopt a rule codifying our proposed interpretation of “providers of voice service.”

18. Definition of “STIR/SHAKEN Authentication Framework.” The definition of “STIR/SHAKEN authentication framework” that we adopted in the First Caller ID Authentication Report and Order and Further Notice closely tracks the language Congress used in the TRACED Act.70 In the Report and Order, we defined “STIR/SHAKEN authentication framework” as “the secure telephone identity revisited and signature-based handling of asserted information using tokens standards.”71 We did not receive any comments in the record seeking clarification, so we reaffirm the definition we adopted previously.

19. Definition of “Voice Service.” We next reaffirm the definition of “voice service” that we adopted in the First Caller ID Authentication Report and Order and Further Notice.72 Specifically, we defined “voice service” as a service “that is interconnected with the public switched telephone network and that furnishes voice communications to an end user,” and which includes “without limitation, any service that enables real-time, two-way voice communications, including any service that requires [IP]- compatible customer premises equipment . . . and permits out-bound calling, whether or not the service is one-way or two-way voice over [IP].”73 The definition we adopted is identical to the language Congress included in the TRACED Act.74 We explained in the First Caller ID Authentication Report and Order and Further Notice that, based on the definition of “voice service” we adopted, our STIR/SHAKEN rules apply to “all types of voice service providers—wireline, wireless, and Voice over Internet Protocol (VoIP) providers,” including both two-way and one-way interconnected VoIP providers.75 And we clarified that voice service providers which lack control over the network infrastructure necessary to implement STIR/SHAKEN are not subject to our implementation requirements.76 Commenters that

address the issues nearly unanimously support our definition and interpretation of “voice service,”77 though several commenters seek further clarification.

20. First, NCTA and CenturyLink advocate for us to interpret our rules to apply to “over-the- top (OTT) service that possess technical control over the origination of calls on their platforms.”78 No commenter opposed these requests. We reiterate our belief that for STIR/SHAKEN to be successful, every service provider capable of implementing the framework must participate.79 We therefore conclude that to the extent a provider of OTT service provides “voice service,”80 and has control of the relevant network infrastructure to implement STIR/SHAKEN,81 it is subject to our rules.

21. NCTA further encourages us to revise the current definition of “interconnected VoIP” found in section 9.3 of our rules in order to “harmonize” it with our caller ID authentication regulations.82 Section 9.3 generally limits “interconnected VoIP service” to two-way interconnected VoIP and only includes one-way VoIP as “interconnected VoIP” in the context of the Commission’s 911 obligations.83 We understand the definition of “voice service” that Congress adopted in the TRACED Act to encompass both two-way and one-way interconnected VoIP.84 Because we rely on the statutory term “voice service” and because the meaning of that term is not limited by the definition of “interconnected VoIP” in section

9.3 of our rules, we see no reason to revisit of the definition of interconnected VoIP in section 9.3 in this proceeding.

22. Second, Microsoft argues that the definition of “voice service” should be read to exclude inbound-only VoIP service.85 Microsoft argues that this service is outside the scope of the STIR/SHAKEN standards,86 and that the reference to service that “permits out-bound calling” in the

TRACED Act definition precludes application of our requirement to inbound-only VoIP service. We disagree. We understand the TRACED Act—which defines “voice service” to mean “any service that is interconnected with the public switched telephone network and that furnishes voice communications to an end user” and includes, “without limitation, any service that enables real-time, two-way voice communications, including any service that . . . permits out-bound calling”—to establish a broad concept of voice service.87 We read the phrase “without limitation” as indicating that the subsequent phrase “permits out-bound calling” is not a limitation on the initial, general definition of “voice service,” which encompasses in-bound VoIP. Similarly, in the context of our Truth in Caller ID rules, we interpreted the term “interconnected” as used in a substantially similar definition of “voice service” in the RAY BAUM’s Act to include any service that allows voice communications either to or from the public switched telephone network (PSTN), regardless of whether inbound and outbound communications are both enabled within the same service.88 Because our STIR/SHAKEN rules impose obligations on both the originating and terminating side of a call, we believe that this broad reading of “interconnected” is also appropriate here. Further, reaching in-bound VoIP advances the purposes of the TRACED Act and widespread caller ID authentication. Our rules, consistent with the ATIS standards, require a voice service provider terminating a call with authenticated caller ID information to verify that information according to the STIR/SHAKEN framework.89 We thus reject Microsoft’s argument that reaching in- bound VoIP is unnecessary because the standards comprising STIR/SHAKEN do not assign actions to be taken when terminating a call.90

23. Definition of “Providers of Voice Service”—Call-by-Call Basis. Congress directed many of the TRACED Act caller ID authentication requirements to “providers of voice service.” We proposed in the First Caller ID Authentication Report and Order and Further Notice to interpret “providers of voice service” on a call-by-call—rather than entity-by-entity—basis.91 Under this interpretation, a provider of voice service is not subject to TRACED Act requirements for all services simply because some of its services fall under the definition of “voice service.”92 Instead, only those services that meet the TRACED Act definition of “voice service” are subject to TRACED Act obligations.93 We adopt our proposal. Both commenters that addressed the issue support our proposal.94 We find that the call-by-call approach best fits the TRACED Act’s structure because it gives meaning to Congress’s inclusion of a definition for “voice service” and because it best comports with the TRACED Act’s allocation of duties on the basis of call technology, e.g., differentiating duties between calls over IP and non-IP networks.

B. Caller ID Authentication in Non-IP Networks

24. The TRACED Act directs us, not later than June 30, 2021, to require voice service providers to take “reasonable measures” to implement an effective caller ID authentication framework in the non-IP portions of their networks.95 Given the large proportion of TDM-based networks still in use, we expect a significant number of calls to be outside the STIR/SHAKEN authentication framework in the near term. In light of this, it is critically important that we take strong action to address the issue of caller ID authentication in non-IP networks. To that end, we interpret the TRACED Act’s requirement that a voice service provider take “reasonable measures” to implement an effective caller ID authentication framework in the non-IP portions of its network as being satisfied only if the voice service provider is actively working to implement a caller ID authentication framework on those portions of its network. A voice service provider satisfies this obligation by either (1) completely upgrading its non-IP networks to IP and implementing the STIR/SHAKEN authentication framework on its entire network, or (2) working to develop a non-IP authentication solution. We adopt rules accordingly, and find that this approach best balances our goal of promoting the IP transition while simultaneously encouraging the development of a non-IP authentication solution for the benefit of those networks that cannot be speedily or easily transitioned.96 By adopting rules that are not overly burdensome, we leave voice service providers free to prioritize transitioning to IP, and we strongly encourage voice service providers to take advantage of this opportunity to do so.97

25. In the First Caller ID Authentication Report and Order and Further Notice, we proposed that a voice service provider satisfies the “reasonable measures” requirement under section 4(b)(1)(B) of the TRACED Act if it is able to provide us, upon request, with documented proof that it is participating, either on its own or through a representative, as a member of a working group, industry standards group, or consortium that is working to develop a non-IP solution, or actively testing such a solution.98 We explained that this proposal was consistent with our proposed approach to assessing whether a voice service provider is making “reasonable efforts” to develop a caller ID authentication protocol in the context of determining whether to limit or terminate an extension of compliance granted under section 4(b)(5)(B) for non-IP networks. We adopt a new rule reflecting this proposal and clarify its specific requirements.

26. Under our rule, a voice service provider satisfies its obligations if it participates through a third-party representative, such as a trade association of which it is a member or vendor. While our proposal did not include mention of trade associations or vendors, we agree with CCA that it would be best to broaden the scope of this requirement by including such representatives within the bounds of our requirement.99 Some industry groups have already established working groups dedicated to examining potential non-IP call authentication technologies.100 Allowing for such representatives will reduce the burden of this obligation on individual voice service providers and minimize the potential negative impact of broad and inexpert participation identified in the record,101 while ensuring that all voice service

providers remain invested in developing a solution for non-IP caller ID authentication. A wider range of efforts will encourage a greater number of industry partnerships, increasing resource and information sharing and speeding the development of a non-IP solution.

27. We expect the benefits of this approach to be numerous, and the costs to voice service providers comparatively small. While some commenters provided estimates of the cost of replacing their non-IP networks,102 none provided estimates of the cost of working to develop a caller ID authentication solution for non-IP networks. Given that our firm but flexible approach permits voice service providers to satisfy this obligation by participating either on their own or through a representative, as members of a working group or consortium that is working to develop or actively testing a non-IP solution, we expect that any related compliance costs will be quite limited. By comparison, the benefits of voice service providers either upgrading their non-IP networks to IP to support STIR/SHAKEN or working to develop a caller ID authentication solution for non-IP networks will be considerable, not only in the less tangible benefits they will have for consumers by reducing the waste and frustration resulting from illegal robocalls, but in terms of actual monetary savings. Indeed, as we found in the First Caller ID Authentication Report and Order and Further Notice, the monetary benefits of STIR/SHAKEN are likely to be in the billions of dollars.103 The greater the number of voice service providers that implement an effective caller ID authentication framework—either by upgrading their non-IP networks to IP and implementing STIR/SHAKEN, or by developing and implementing an effective non-IP solution—the more effective these frameworks will be in combatting illegal robocalls, and the more of the expected benefits will be realized. Thus, the rules we adopt today will help achieve these savings while simultaneously minimizing the cost of compliance.

28. We disagree with ATIS’s contention that we should not adopt rules governing non-IP caller ID authentication until the joint ATIS/SIP Forum IP-NNI Task Force concludes its work investigating the viability of non-IP caller ID authentication frameworks.104 Given that this task force is precisely the kind expressly contemplated, and indeed, mandated, by our order today, we see no reason to delay these rules. Indeed, the Task Force’s existence is confirmation that we have construed the “reasonable measures” standard in a manner that appropriately dovetails with current industry efforts to develop a non-IP solution.105 Further, the rules we adopt today are required by Congressional direction to mandate voice service providers to take “reasonable measures” to implement a non-Internet Protocol no later than June 30, 2021; we have no discretion to wait until a given task force has concluded its work to adopt rules.

29. Although CTIA argues that requiring voice service providers to participate in industry standards groups committed to developing or actively testing a non-IP solution “may not improve the development” of such solutions, and would in fact “divert resources from STIR/SHAKEN deployment and other robocalls mitigation efforts,” it offers no alternative interpretation of the “reasonable measures”

standard mandated by Congress in the TRACED Act.106 We must impose a meaningful mandate to fulfill Congress’s direction to require “reasonable measures to implement” a non-IP caller ID authentication solution.107 Requiring voice service providers that choose not to upgrade their non-IP networks to IP to contribute to groups and organizations that are working to test or develop a non-IP solution strikes a balance between promoting caller ID authentication solutions for TDM networks, as required by the TRACED Act, and leaving resources free to invest in IP networks. By allowing participation through a working group, consortium, or trade association, we allow voice service providers to efficiently pool their expertise and resources with the goal of not replicating one another’s efforts and more efficiently developing a non-IP solution. We therefore are not convinced by CTIA’s arguments that the requirement we adopt will unduly stunt STIR/SHAKEN deployment or that voice service providers will have “few resources left to dedicate to industry standards groups.”108

30. We are likewise unconvinced by TransNexus’s conclusory claim that participating in a working group would not constitute a “reasonable effort” to implement an effective caller ID authentication framework on non-IP networks.109 Contributing to an industry-led body dedicated to pooling expertise and resources in the hopes of developing and/or testing non-IP solutions is a reasonable and efficient strategy for encouraging the creation and deployment of such solutions.

31. Out-of-Band STIR. We decline to mandate out-of-band STIR for non-IP networks. Out- of-band STIR is a proposed non-IP solution whereby caller ID authentication information is sent across the Internet, out-of-band from the call path.110 Commenters have widely divergent views as to the viability of out-of-band STIR as a method of effective caller ID authentication in non-IP networks. While a handful advocate for the implementation of out-of-band STIR as the best method of ensuring effective call authentication in non-IP networks,111 with Neustar even claiming that this solution should be widely available in advance of the June 30, 2021 implementation deadline,112 many others contend that out-of-

band STIR is not yet a viable solution.113 Comcast claims that out-of-band STIR is an untested, time- consuming, and costly solution that would require the re-creation of multiple network functions in parallel to IP networks.114 Given the undeniably sharp divide between commenters and the absence of sufficient testing and implementation to demonstrate the viability of out-of-band STIR as an industrywide solution, we find that it is not possible to conclude, based on the record before us, that out-of-band STIR is an effective non-IP solution. We find that significant industry consensus is an important predicate to deeming a non-IP solution “effective,” given that cross-network exchange of authenticated caller ID information is a central component to caller ID authentication. Thus, we cannot at this time mandate adoption of out-of-band STIR by voice service providers in the non-IP portions of their networks.115 At the same time, we observe that opponents of this technology have offered no meaningful alternative solutions. To those that would oppose this possible solution without mention of an alternative, we take this opportunity to note that standards work requires both constructive input and compromise on the part of all parties and stakeholders.

32. Effective Non-IP Caller ID Authentication Framework. As we explain in the context of the extension of the implementation deadline for certain non-IP networks, we will continue to evaluate whether an effective non-IP caller ID authentication framework emerges from the ongoing work that we require. Consistent with that section, we will consider a non-IP caller ID authentication framework to be effective only if it is: (1) fully developed and finalized by industry standards; and (2) reasonably available such that the underlying equipment and software necessary to implement such protocol is available on the commercial market.116 If and when we identify an effective framework, we expect to revisit our “reasonable measures” requirement and shift it from focusing on development to focusing on implementation. We encourage voice service providers and others to put forward a framework they view as effective for our consideration. We also will continue to monitor progress in developing a non-IP authentication solution and may revisit our approach to the TRACED Act’s “reasonable measures” requirement if we find that industry has failed to make sufficient progress in either transitioning to IP or developing a consensus non-IP authentication solution. We stand ready to pursue additional steps toensure more fulsome caller ID authentication in non-IP networks, including by revisiting our non- prescriptive development-based approach if needed.

33. Legal Authority. We find authority for these rules under section 4(b)(1)(B) of the TRACED Act. That section expressly directs us to obligate voice service providers to take “reasonable measures” to implement an effective caller ID authentication framework in the non-IP portions of their networks and is a clear source of authority for these non-IP obligations.117

34. We also conclude that section 251(e) of the Communications Act of 1934, as amended (the Act), provides additional independent authority to adopt these rules. Section 251(e) provides us “exclusive jurisdiction over those portions of the North American Numbering Plan (NANP) that pertain to the United States.”118 Pursuant to this provision, we retain “authority to set policy with respect to all facets of numbering administration in the United States.”119 Our exclusive jurisdiction over numbering policy enables us to act flexibly and expeditiously with regard to important numbering matters.120 When bad actors unlawfully falsify or spoof the caller ID that appears on a subscriber’s phone, they are using numbering resources to advance an illegal scheme. Mandating that voice service providers take “reasonable measures” to deploy an effective caller ID authentication framework in the non-IP portions of their networks will help to prevent the fraudulent exploitation of NANP resources by permitting those providers and their subscribers to identify when caller ID information has been spoofed. Section 251(e) thus grants us authority to mandate that voice service providers take “reasonable measures” to implement an effective caller ID authentication framework in the non-IP portions of their networks in order to prevent the fraudulent exploitation of numbering resources. Moreover, as the Commission has previously found, section 251(e) extends to “the use of . . . unallocated and unused numbers”; it thus gives us authority to mandate that voice service providers implement an effective caller ID authentication framework to address the spoofing of unallocated and unused numbers.121

35. Finally, we find authority under the Truth in Caller ID Act. Congress charged us with prescribing regulations to implement that Act, which made unlawful the spoofing of caller ID information “in connection with any voice service or text messaging service . . . with the intent to defraud, cause harm, or wrongfully obtain anything of value.”122 Given the constantly evolving tactics by malicious callers to use spoofed caller ID information to commit fraud, we find that the rules we adopt today are necessary to enable voice service providers to help prevent these unlawful acts and to protect voice service subscribers from scammers and bad actors. Thus, section 227(e) provides additional independent

authority for these rules.123

C. Extension of Implementation Deadline

36. The TRACED Act includes two provisions for extension of the June 30, 2021 implementation date for caller ID authentication frameworks. First, the TRACED Act states that we “may, upon a public finding of undue hardship, delay required compliance” with the June 30, 2021 date for caller ID authentication framework implementation for a “reasonable period of time.”124 Second, we “shall grant a delay of required compliance” with the June 30, 2021 implementation date “to the extent that . . . a provider or class of providers of voice services, or type of voice calls, materially relies on a non-[IP] network for the provision of such service or calls” “until a call authentication protocol has been developed for calls developed over non-[IP] networks and is reasonably available.”125

37. Under either extension provision, an extension may be provider-specific or apply to a “class of providers of voice service, or type of voice calls.”126 We must annually reevaluate any granted extension for compliance.127 When granting an extension of the implementation deadline under either provision, we must require impacted voice service providers to “implement an appropriate robocall mitigation program to prevent unlawful robocalls from originating on the network of the provider.”128

38. Based on these directives and for the reasons discussed below, we grant the following extensions from implementation of caller ID authentication: (1) a two-year extension to small, including small rural, voice service providers; (2) an extension to voice service providers that cannot obtain a certificate due to the Governance Authority’s token access policy until such provider is able to obtain a certificate; (3) a one-year extension to services scheduled for section 214 discontinuance; and (4) as required by the TRACED Act, an extension for the parts of a voice service provider’s network that rely on technology that cannot initiate, maintain, and terminate SIP calls until a solution for such calls is reasonably available.129 We further direct the Wireline Competition Bureau (Bureau) to reevaluate extensions annually, and we require any voice service provider that receives an extension to implement and certify that it has implemented a robocall mitigation program by June 30, 2021.

1. Assessment of Burdens and Barriers to Implementation and Extensions for Undue Hardship

39. The TRACED Act grants us the discretion to extend a voice service provider’s obligation to comply with the June 30, 2021 caller ID authentication implementation mandate upon a public finding of undue hardship.130 It states that the extension may be “for a reasonable period of time . . . as necessary

. . . to address the identified burdens and barriers.”131 In connection with our determination of whether to grant an extension, the TRACED Act specifically directs us, not later than December 30, 2020 “and as

appropriate thereafter,” to assess any burdens and barriers to implementation of caller ID authentication technology by (1) voice service providers that use time-division multiplexing network technology (TDM), a non-IP network technology; (2) small voice service providers; and (3) rural voice service providers.132 It further directs us to assess burdens and barriers created by the “inability to purchase or upgrade equipment to support the call authentication frameworks . . . or lack of availability of such equipment.”133 The TRACED Act does not require us to grant undue hardship extensions to the categories of entities for which we must evaluate burdens and barriers to implementation, nor does it limit us to granting undue hardship extensions to entities within the categories for evaluation that it identifies. Based upon our review of the record, including our evaluation of burdens and barriers to implementation by certain categories of entities as directed by the TRACED Act, we grant extensions to: (1) small, including small rural, voice service providers; (2) voice service providers that cannot obtain the certificate necessary for STIR/SHAKEN; and (3) services subject to a discontinuance application. We decline to grant requested extensions for non-IP services, for larger rural voice service providers, due to equipment unavailability, for enterprise calls, for intra-network calls, or due to compatibility issues.

40. Extension for Small Voice Service Providers. The TRACED Act specifically directs us to evaluate whether to grant an extension based on undue hardship for small voice service providers. In the First Caller ID Authentication Report and Order and Further Notice, we proposed granting a one-year implementation extension due to undue hardship for small, including small rural, voice service providers.134 After reviewing the record, we grant a two-year extension for small voice service providers, which we define as those with 100,000 or fewer voice subscriber lines.

41. The record reflects that a barrier to STIR/SHAKEN implementation for small voice service providers is the substantial cost, despite resource constraints, to implement STIR/SHAKEN.135 For instance, according to CTIA, “many small providers face financial and resource constraints that other providers do not” as “[s]mall providers are driving toward the mandate deadline, but with fewer employees and smaller budgets, they may require more time to transition to STIR/SHAKEN.”136 Small voice service providers must also balance limited resources and expenses with other required technology transitions.137 Most recently, commenters explain that the COVID-19 pandemic has monopolized substantial available resources, increasing the burden on small voice service providers.138

42. Relatedly, the record demonstrates that equipment availability issues specifically impact small voice service providers. Such providers rely on third-party vendor solutions, particularly software solutions, to implement STIR/SHAKEN, and these solutions may be prohibitively expensive for some

small voice service providers.139 For instance, WISPA asserts that “[s]ome vendor’s minimum fees could exceed a small provider’s entire voice revenues.”140 WTA agrees that the upfront expenses “could cause a budget shortage for small providers that have a limited, set multi-year budget that is already dedicated to new deployments, staff, etc.”141 Further, ACA Connects expresses concern over a lack of transparency regarding the costs and relative advantages of available vendor solutions as its smaller voice service provider members, with limited budgets, must carefully apportion funds for STIR/SHAKEN deployment.142 Indeed, small voice service providers report they have “been quoted annual rates from different vendors that range from the low five figures to the low six figures, not including any upfront costs to install the solution,” with no explanation for the rate disparity.143 The record reflects that as medium and large voice service providers start to widely deploy STIR/SHAKEN, new and improved solutions will emerge, increasing competition among vendors and decreasing costs.144 In addition, multiple commenters contend that small voice service providers are unable “to procure ready-to-install solutions” from a variety of vendors “on the same timeframe as the nation’s largest voice service providers.”145 According to NTCA, its members “are typically ‘at the mercy’ of vendors that respond to the larger operator community muc[h] faster, likely based on the latter’s market share and buying power.”146 As a result, timing and availability of these vendor solutions may be out of the control and reach of small voice service providers.147 Further, commenters contend that these vendor solutions remain at an early stage of development and “far from ‘ready to install’ solutions.”148

43. We are convinced by this record that an extension is appropriate for small voice service providers. The record largely supports our proposal for an implementation extension for small voice

service providers,149 and we agree with these commenters that an extension is warranted to allow small providers sufficient time to address challenges such as equipment cost and availability. For instance, according to ACA Connects, NTCA, WISPA, and WTA, vendor costs may be prohibitively expensive for small voice service providers and could result in budget shortages.150 Additional time will allow voice service providers confronted with budget shortages to spread costs over a longer time horizon.151 Further, small voice service providers claim vendor solutions are still in nascent stages of development,152 and an extension will allow vendors that work with small voice service providers more time to develop solutions and offer those solutions at a lower cost as the market matures.153

44. Transaction Network Services and AT&T contend that we should not grant a blanket extension for small voice service providers. 154 These commenters claim that such an extension would be overinclusive because not all small voice service providers face identical hardships,155 and allege that illegal robocalls may originate from these providers.156 We disagree. The overwhelming record support persuades us that small voice service providers, as a class, face undue hardship, and supports the need for a blanket implementation extension for such providers to give them the necessary time to implement STIR/SHAKEN.157 Further, as ACA Connects contends, granting extensions on a case-by-case basis for small voice service providers would “inundate the Commission with extension requests from a multitude of small providers, many of them presenting evidence of the same or similar implementation burdens” and “consume funds that would be better spent working towards implementation of STIR/SHAKEN.”158 We do not find that this extension will unduly undermine the effectiveness of STIR/SHAKEN. As small voice service providers account for only a small percentage of voice subscribers, an extension covering these providers will account for the unique burdens they face while ensuring that many subscribers benefit from STIR/SHAKEN.159 Further, the prevalence of STIR/SHAKEN will encourage small voice service providers that can afford to do so to implement the framework as soon as possible to provide the protections it offers to their subscribers. And small voice service providers—like all providers subject to an extension—are obligated to implement a robocall mitigation program to combat the origination of illegal robocalls during the course of the extension.160

45. We conclude that the extension we grant should run for two years, subject to possible extension pursuant to the evaluation discussed below. Multiple commenters advocated for an extension longer than one year.161 For instance, WISPA and Atheral contend that small voice service providers require an extension of at least two years beyond the implementation deadline to “budget for and absorb the cost of needed upgrades”162 and to “allow for the development of vendor solutions and reduction in cost to more affordable levels as volume scales.”163 We expect this extension for small voice service providers will drive down implementation costs by allowing these providers to benefit from a more mature market for equipment and software solutions necessary to implement STIR/SHAKEN.164 Small

voice service providers have also filed estimates of the cost of implementing STIR/SHAKEN on their networks.165 The additional implementation time will allow these providers to spread the cost of implementation across a longer time horizon. We find that an implementation deadline of two-years allows for sufficient time—but no more than necessary—for small voice service providers to meet the challenges of implementing STIR/SHAKEN on their networks. Our guiding principle in setting this deadline is to achieve ubiquitous STIR/SHAKEN implementation to combat the scourge of illegal caller ID spoofing as quickly as possible. This extension should also ease the additional burdens placed on small voice service providers by the COVID-19 pandemic, which has consumed significant resources.166

46. We decline at this time NTCA’s requests to tie an implementation extension until June 30, 2023 to “the vendor community delivering solutions in 2020,” and to grant additional implementation time for small voice service providers “unable to obtain vendor solutions by the end of 2020.”167 In the interest of promoting ubiquitous STIR/SHAKEN implementation, we decline at this time to grant a longer extension for small voice service providers that may face continued implementation challenges in the future. We find that a longer extension would discourage the swift development of effective vendor solutions and slow the deployment of STIR/SHAKEN to the detriment of consumers. We also find that a longer extension would unnecessarily rely on speculation about marketplace realities several years from now. The Bureau may grant a further extension if it determines such an extension is appropriate in its annual reevaluation.

47. Finally, we establish that, as proposed in the First Caller ID Authentication Report and Order and Further Notice,168 a provider is a “small provider[] of voice service”169 for purposes of this extension if it has 100,000 or fewer voice subscriber lines (counting the total of all business and residential fixed subscriber lines and mobile phones and aggregated over all of a provider’s affiliates). In the First Rural Call Completion Order, the Commission determined that the 100,000-subscriber-line threshold ensured that many subscribers would continue to benefit from our rules while also limiting the burden on smaller voice service providers.170 Similarly, we find that, in the caller ID authentication context, limiting the implementation extension for small voice service providers to those that have 100,000 or fewer voice subscriber lines balances the needs of these providers and the importance of widespread and effective STIR/SHAKEN implementation. We received support in the record for this definition of “small providers of voice service.”171

48. We decline at this time USTelecom’s post-circulation request to exclude voice service providers within the 100,000-subscriber-line threshold that “originate a disproportionate amount of traffic relative to their subscriber base, namely voice service providers that serve enterprises and other heavy

callers through their IP networks.”172 While we see value in the policy goals that underlie USTelecom’s request, implementing its suggestion would require a difficult line-drawing exercise. USTelecom did not offer any support for its proposed criteria to identify parties that originate a disproportionate amount of traffic,173 nor are we able to identify criteria in the limited time available in which we have confidence.174 We are open to revisiting this issue should we determine that the extension creates an unreasonable risk of unsigned calls from a specific subset of small voice service providers.

49. Extension for Voice Service Providers That Cannot Obtain a Certificate. In the First Caller ID Authentication Report and Order, we acknowledged the concerns raised by Cloud Communications Alliance regarding whether all voice service providers are able to obtain the certificates used for the intercarrier exchange of authenticated caller ID information under the Governance Authority’s current policies.175 And in the Further Notice, we asked whether we should grant an implementation extension for any other voice service providers or classes of voice service providers, or types of calls.176 In response, commenters advocated for an extension for voice service providers that cannot obtain a certificate because they are ineligible to file FCC Form 499A, obtain an Operating Company Number, or obtain direct access to telephone numbers—each of which is a prerequisite to obtaining a certificate under current Governance Authority policy.177

50. Because it is impossible for a service provider to participate in STIR/SHAKEN without access to the required certificate and because some voice service providers are unable to obtain a certificate at this time, we determine that a limited extension is necessary. Multiple commenters contend that the Governance Authority’s policy excludes voice service providers that lease numbers rather than obtain them directly from NANPA.178 In particular, one-way VoIP voice service providers have no

means to obtain direct access to numbers, so they cannot obtain the certificate necessary to comply with their duty to implement STIR/SHAKEN.179 Therefore, we grant an extension to voice service providers that cannot obtain a certificate due to the token access policy. We grant this extension until it is feasible for a provider to participate in STIR/SHAKEN due either to the possibility of compliance with the Governance Authority policy or a change in the Governance Authority policy. We recognize that a voice service provider may not be able to immediately come into compliance with its caller ID authentication obligations after it becomes eligible to receive a certificate, and we will not consider a voice service provider that diligently pursues a certificate once it is able to receive one in violation of our rules.180 We expect the extension we establish will decrease costs by relieving such providers from the obligation to upgrade their networks until they can meaningfully participate in STIR/SHAKEN. We recognize that industry has made progress on resolving the gap between Governance Authority certificate access policies and the scope of duties we have established pursuant to the TRACED Act, and we continue to urge speedy resolution of these issues.181

51. Extension for Services Scheduled for Section 214 Discontinuance. In the First Caller ID Authentication Report and Order and Further Notice, we also sought comment on whether to consider any additional categories of extensions.182 In response to AT&T’s request,183 we grant a one-year extension based on undue hardship to cover services for which a provider has filed a pending section 214 discontinuance application on or before the June 30, 2021, STIR/SHAKEN implementation deadline.184 This extension will allow voice service providers time to either complete the discontinuance process and “avoid incurring unnecessary expense and burden to implement STIR/SHAKEN” for services “that are scheduled to sunset,” or to implement STIR/SHAKEN for any such services that are not discontinued.185 We agree with AT&T that voice service provider resources “are better spent upgrading networks that will

have the potential to reap the full benefits of the IP transition and STIR/SHAKEN.”186 We expect that this extension will decrease costs by obviating the need to upgrade components of a voice service provider’s network that will be sunset. We underscore that a one-year extension means that voice service providers have until June 30, 2022, to either discontinue the legacy service or implement STIR/SHAKEN if the service has not actually been discontinued, unless the provider obtains a waiver of this requirement for good cause shown. If we determine that a voice service provider filed a discontinuance application in bad faith to receive this extension, we will terminate the extension and take appropriate action.

52. Voice Service Providers That Use TDM—An Extension Would Be Superfluous. The TRACED Act specifically directs us to evaluate whether to grant an extension to voice service providers that use TDM network technology. The record reflects that a major barrier to implementation of a caller ID authentication framework for voice service providers that use TDM technology is the lack of a standardized caller ID authentication framework for non-IP networks.187 Because the STIR/SHAKEN framework is an IP-only solution, these voice service providers must expend substantial resources upgrading network software and hardware to be IP compatible in order to implement the only currently available standardized caller ID authentication solution.188 According to commenters, voice service providers that use TDM networks also face availability and cost issues regarding necessary equipment to upgrade the software and hardware to convert their networks to IP.189 Further, small or rural voice service providers that use TDM technology may have fewer resources and require additional time for transitioning their networks to IP technology.190 Multiple commenters agree that “[e]ven if a [voice service provider] has upgraded its own network to all-IP technology, if that [voice service provider] exchanges substantial traffic through legacy TDM tandems, such tandems will similarly present obstacles to STIR/SHAKEN deployment.”191

53. Although we proposed in the First Caller ID Authentication Report and Order and Further Notice to grant the same extension to voice service providers that use TDM technology under the undue hardship standard that we grant to providers that materially rely on non-IP technology,192 we conclude that a separate and identical extension is redundant and creates administrative duplication. We want to avoid granting two separate extensions, with associated filing and review requirements, that serve identical purposes. Because the TRACED Act includes a required extension for voice service providers that “materially rel[y]” on non-IP technology,193 we decline to grant a separate extension to voice service providers that use TDM technology under the undue hardship standard.194 Although AT&T contends that

“an extension for TDM networks is independently warranted,” it does not explain its position.195 In fact, AT&T concedes that “the extension outcomes are the same.”196 We find the non-IP extension sufficiently addresses AT&T’s concern that there is not yet a STIR/SHAKEN-equivalent solution for TDM networks. To the extent there is any lack of clarity, we confirm that TDM networks are included in the non-IP extension established below, and subject to its terms.197

54. Rural Voice Service Providers—A Separate Extension Is Unnecessary. The TRACED Act specifically directs us to evaluate whether to grant an extension based on undue hardship to rural voice service providers. The record reflects that the burdens and barriers to STIR/SHAKEN implementation for rural voice service providers are often encompassed by those for small voice service providers or voice service providers that use non-IP network technology because these voice service providers also tend to be rural.198 To the extent rural voice service providers rely on non-IP technology, which is incompatible with STIR/SHAKEN, they encounter the burdens already described for such providers.199 Similarly, the rural voice service providers that describe specific burdens to implementation—such as availability of vendor solutions that may be prohibitively expensive with few reasonable alternatives—are small voice service providers.200 Although CTIA generally states that there are potential financial and resource constraints for larger rural voice service providers, it does not identify any specific implementation challenges faced by these providers.201 Indeed, at least one larger rural voice service provider, TDS Communications, a Wisconsin-based voice service provider that serves nearly 900 rural, suburban, and metropolitan communities throughout the United States, has begun to invest in STIR/SHAKEN deployment.202

55. In the First Caller ID Authentication Report and Order and Further Notice, we sought comment on our proposed view that it would be unnecessary to grant a separate implementation extension for rural voice service providers as the challenges faced by these providers are already addressed by the small voice service provider extension and the extension for voice service providers that materially rely on a non-IP network.203 After review of the record, we adopt our proposal and decline to adopt a separate extension for rural providers.204 The majority of commenters in the record did not differentiate rural voice.

204 While we decline to grant an extension to this class of voice service providers, a voice service provider that believes that it faces an undue hardship may submit a filing that details its specific circumstances.

service providers from those that are small and referred to them interchangeably.205 As noted above, the rural voice service providers that called for an extension are themselves small voice service providers.206 NCTA contends that a dedicated extension for rural providers is “unnecessary” because “the vast majority of rural providers will qualify for the small provider extension” or the extension for voice service providers that rely on non-IP networks.207 We agree with NCTA that “there does not seem to be a strong basis for granting any form of relief” to rural voice service providers that do not qualify as small voice service providers.208 Further, TDS reports that it had completed work in 2019 to evaluate, select, and lab test a vendor solution to allow it to integrate STIR/SHAKEN into the IP portions of its network.209 Because one large rural voice service provider has already invested in STIR/SHAKEN deployment to best serve its customers,210 we expect that other similarly situated rural voice service providers have also begun or would be capable of having begun the implementation process. We conclude that it would be improper to reach a blanket finding of undue hardship for rural voice service providers because (1) the record does not show that larger rural providers face undue hardship; and (2) our separate finding of undue hardship for small voice service providers relieves small rural voice service providers of the obligation to implement, such that they will no longer face undue hardship for the duration of the extension. Further, an extension for rural voice service providers would not only be unnecessary, but also harmful to the goal of widespread implementation.

56. We also decline the request by CTIA and USTelecom for an extension for vaguely- defined “regional” voice service providers that do not fall within our 100,000 or fewer voice subscriber line threshold.211 CTIA only generally describes potential financial and resource constraints for these voice service providers,212 and neither commenter sufficiently defines this class of providers or explains why we should grant an extension on the basis of undue hardship to providers with the resources that are necessary for serving a large number of subscribers. We similarly decline the request by Madison Telephone Networks for an extension until 2024 or 2025 for rural providers in high cost areas to “relieve financial pressure.”213 We decline to grant this extension as Madison Telephone Networks does not demonstrate why this is a unique class of providers requiring an extension of this length. Further, we expect the majority of these voice service providers are also small or materially rely on non-IP technology and therefore will be covered by either or both of those extensions.214

57. Equipment Availability—A Separate Extension Is Unnecessary. In the First Caller ID

Authentication Report and Order and Further Notice, we sought comment on Congress’s direction to consider whether to grant a separate extension on the basis of “the inability to purchase or upgrade equipment to support the call authentication frameworks under this section, or lack of availability of such equipment.”215 We conclude that our extension for small voice service providers adequately addresses challenges with regard to obtaining necessary equipment and that a separate or additional extension is unnecessary. As discussed above, the record reflects that equipment availability specifically impacts small voice service providers.216 This is not a surprise, as it is likely that larger voice service providers have the resources and negotiating leverage to obtain the equipment they need much more quickly than small providers. Granting an extension solely for equipment unavailability may discourage larger voice service providers from putting forward sufficient effort to obtain necessary equipment. Further, no commenter has identified any specific equipment availability issue for large voice service providers— commenters merely speak in general terms.217 Granting an ex ante extension on this basis would introduce difficult line-drawing questions as to when equipment is “unavailable” for which the record does not suggest a solution and that are not necessary to resolve in light of the extension for small voice service providers.218

58. Enterprise Calls—An Extension Would Be Counterproductive. In the First Caller ID Authentication Report and Order and Further Notice, we sought comment on whether we should grant an extension for undue hardship for enterprise calls.219 We described the concerns of some commenters that the standards for attestation do not fully account for the situation where an enterprise subscriber places outbound calls through a voice service provider other than the voice service provider that assigned the telephone number.220 In such enterprise calling scenarios, commenters claimed, it would be difficult for an outbound call to receive A-level attestation 221 because the outbound call “will not pass through the

authentication service of the [voice] service provider that controls th[e] numbering resource.”222 The record developed in response to our Further Notice reflects challenges for voice service providers to attest to enterprise calls with A-attestation in this and other circumstances, meaning that such calls would be authenticated with B- or C-level attestation.223 Based on these challenges, some commenters argue that we should grant an extension in compliance with the STIR/SHAKEN implementation mandate for enterprise calls so that these calls will not receive caller ID authentication until industry standards groups resolve the enterprise issue, rather than receiving a lower level of attestation in the interim.224 We agree with the record opposition,225 and we decline to grant an implementation extension to enterprise calling cases.

59. First, we agree with those commenters that argue that an implementation extension may discourage the swift development of technical solutions for enterprise calls.226 Although commenters offer different perspectives on the timing of a solution that would allow enterprise calls to receive A-level attestation,227 the record reflects that industry is “working hard to achieve authentication with A-level attestation this year.”228 It is our goal to encourage this work, rather than remove the beneficial incentive created by the STIR/SHAKEN mandate. We decline, however, to go so far as some commenters suggest and “[r]equir[e] the prompt finalization of standards that will enable voice providers that originate

enterprise calls to provide an A-level attestation.”229 As industry stakeholders, standards bodies, and the Governance Authority are actively working to finalize standards and solutions to complex enterprise calling cases,230 we do not wish to intervene in the process.231 At the same time, we continue to encourage—and expect—industry to promptly resolve the outstanding challenges for complex enterprise use cases and business models, and we will closely monitor progress on this issue.

60. We are also not persuaded by claims that authenticating enterprise calls with B- or C- level attestation poses a major problem.232 These commenters contend that enterprise calls without an A- level attestation may be blocked, mislabeled as potentially fraudulent, or lead to illegal robocallers authenticating their own calls.233 However, they fail to explain how the alternative—an enterprise call without authenticated caller ID information—is preferable to one that receives B- or C-level attestation.234 Notably, NCTA reports that “[i]n [its] members’ experiences, partial (‘B’) attestation can be achieved more quickly than complete (‘A’) attestation for enterprise calls,” and accordingly, partial attestation is “a reasonable implementation approach in this context.”235 Similarly, Hiya, an analytics company, commits that it “currently has no plans—nor is it aware of any plans by other parties in the industry—to either block calls or label them as potentially fraudulent solely due to lack of ‘full’ or ‘A’ level attestation.”236 It also asserts “that voice service providers and analytics engines will not use attestation level as the sole determinant for reputation scoring of a caller,” and instead, “attestation information is one of the many data points that inform analytics-driven call labeling and call blocking.”237 Transaction Network Services also explains that “STIR/SHAKEN attestations—‘good’ or ‘bad’—will not have the effects that some commenters suggest” as it “endeavors to incorporate STIR/SHAKEN attestations as one factor in its analysis” and “does not recommended making call-blocking decisions based on the failure of STIR/SHAKEN authentication.”238 Indeed, we have previously stated that “a call-blocking program might block calls based on a combination of factors.”239 Even assuming that calls with B- or C-level attestation will be treated meaningfully worse than calls without authenticated caller ID information—a conclusion that, again, is not substantiated by the record—concerns over the treatment of calls authenticated consistent with current STIR/SHAKEN standards does not amount to an undue hardship in the implementation of STIR/SHAKEN technology, which is the standard by which Congress directed us to evaluate undue hardship extension requests.240 In light of these conclusions and our and Congress’s goal of ubiquitous STIR/SHAKEN implementation in IP networks, we will not grant an extension for enterprise calls.

61. Intra-Network Calls—An Extension Would Be Counterproductive. In the First Caller ID Authentication Report and Order and Further Notice, we established distinct authentication requirements for inter-network calls and for intra-network calls. In the case of inter-network calls, an originating voice service provider must “authenticate caller [ID] information for all SIP calls it originates and that [it] will exchange with another voice service provider or intermediate provider.”241 Because establishing trust between providers is not necessary for calls that transit a single network, we adopted a different obligation for intra-network calls that solely transit the network of the originating voice service provider. Specifically, in recognition of the fact that “certain components of the STIR/SHAKEN framework . . . are not necessary for calls that a voice service provider originates and terminates on its own network,” we concluded a voice service provider satisfies its intra-network authentication obligation so long as it authenticates and verifies “in a manner consistent with the STIR/SHAKEN framework, such as by including origination and attestation information in the SIP INVITE used to establish the call.” 242

62. A number of commenters that exchange all traffic with other providers through non-IP interconnection points—and thus have no obligation under our rules to implement STIR/SHAKEN with respect to inter-network calls—seek an extension from the intra-network authentication requirement. These voice service providers seek such relief because compliance requires network upgrades, and they

would prefer to delay investing in these necessary upgrades until they are able to participate in STIR/SHAKEN both within their own network and with regard to calls exchanged with other voice service providers, which require many of the same upgrades.243

63. We decline to grant the requested extension because we do not find that it rises to the level of undue hardship. Commenters favoring an extension contend that requiring them to invest in compliance solely as to intra-network calls would require unreasonably burdensome network upgrades that, in their view, produce limited benefits.244 But these commenters fail to explain why implementation would be more burdensome for them than for other voice service providers. In fact, implementation maybe less costly because our standard for intra-network IP calls is only that they are authenticated “in a manner consistent with the STIR/SHAKEN framework” which does not require those upgrades necessary to enable cross-provider authentication and verification. The TRACED Act requires an assessment of burdens and barriers, not a cost-benefit analysis, and parties seeking an extension have failed to show that they face atypical burdens and barriers on the basis of the intra-network authentication requirement. We nonetheless note that the benefits of our intra-network requirement are greater than parties favoring an extension contend. As we have explained, STIR/SHAKEN implementation provides benefits to consumers even at the intra-network level.245 Specifically, implementing STIR/SHAKEN within a voice service provider’s own network directly benefits consumers as it enables a voice service provider to authenticate all calls among its customers.246 To that end, we agree with commenters that while voice service providers work toward IP interconnection, “[t]here is no reason to deny consumers” the “immediate benefits” of authenticated caller ID information for calls on their voice service provider’s own network.247 Further, the record reflects that many providers that face challenges regarding IP interconnection are small providers, to which we have granted a two-year extension in compliance with the STIR/SHAKEN mandate.248 Providers so situated will therefore have additional time to negotiate IP interconnection agreements before being subject to the intra-network mandates.249

Further, granting such an extension would impede the progress of the IP transition and further delay STIR/SHAKEN implementation—contrary to our goal of ubiquitous deployment of caller ID authentication technology.250 We agree with Comcast that it is essential to “encourage the IP transition by, among other things, adopting policies in this proceeding that induce providers to prioritize the implementation of IP-enabled call authentication through STIR/SHAKEN.”251 As AT&T observes, an extension for intra-network calls of providers that do not interconnect in IP would “discourag[e] voice service providers from coming to a negotiated resolution and transitioning to IP” at the interconnection point.252 By denying this extension, we “increase the[] incentive to negotiate creative and commercially reasonable interconnection agreements” to ensure that customers receive STIR/SHAKEN benefits.253

64. Provider-Specific Extensions. We decline at this time to grant any extensions to individual voice service providers. We recognize, as INCOMPAS and CenturyLink suggest, that some providers may face specific circumstances in all or part of their IP networks that constitute undue hardship.254 The Commission will be in a better position to evaluate those requests, however, in response to specific petitions that establish in detail the basis for the requested extension, rather than through establishing a general principle in response to the vague and general concerns about technology or compatibility issues that INCOMPAS and CenturyLink set forth. A voice service provider that believes that it faces an undue hardship within the meaning of the TRACED Act may file in this docket an individual petition requesting an extension. We direct the Bureau to seek comment on any such petitions and to issue an order determining whether to grant the voice service provider an extension. We expect any voice service provider seeking an extension to file its request by November 20, 2020, and we direct the Bureau to issue a decision no later than March 30, 2021.255 Given the importance of widespread

STIR/SHAKEN implementation, to be granted an extension a voice service provider must demonstrate in detail the specific undue hardships, including financial and resource constraints, that it has experienced and explain why any challenges it faces meet the high standard of undue hardship to STIR/SHAKEN implementation within the timeline required by Congress.

2. Extension for Certain Non-Internet Protocol Networks

65. Section 4(b)(5)(B) of the TRACED Act directs that “the Commission shall grant a delay of required compliance . . . for any provider or class of providers of voice service, or type of voice calls, only to the extent that such a provider or class of providers of voice service, or type of voice calls, materially relies on a non-[IP] network for the provision of such service or calls . . . until a call authentication protocol has been developed for calls delivered over non-[IP] networks and is reasonably available.”256 In implementing this provision, we impose the same obligations on voice service providers that receive the extension as we impose in the mandate requiring voice service providers to implement an effective caller ID authentication framework in the non-IP portions of their networks.257 We find that doing so ensures that all voice service providers with non-IP network technology are subject to the same burdens and are working together to develop a non-IP solution as envisioned by the TRACED Act. We also find that such action most efficiently carries out the goals of protecting consumers from illegal robocalls on non-IP networks, and encourages a general transition to IP and the wider implementation of STIR/SHAKEN.

66. Eligibility for this Extension. Under the TRACED Act, we must grant an extension for voice service providers or types of voice calls that “materially rel[y] on a non-[IP] network.”258 We interpret this provision to mean that those portions of a voice service provider’s network that do not use SIP technology are eligible for an extension of the implementation deadline of June 30, 2021.259 In the First Caller ID Authentication Report and Order and Further Notice, we proposed defining “non-[IP] network[s]” as those portions of a voice service provider’s network that rely on technology that cannot initiate, maintain, and terminate SIP calls.260 We adopt our proposal because we believe this to be a straightforward implementation of Congress’s direction in the TRACED Act, which also provides that extensions may be voice service provider-specific or apply to a class of voice service providers or type of voice calls.261 In determining whether a voice service provider or type of voice calls “materially relies” on such a non-SIP capable network, we proposed to interpret “material[]” to mean “important or having

an important effect”262 and, consistent with our call-by-call interpretation of the TRACED Act, we proposed to read “reli[ance]” with reference to the particular portion of the network in question.263 We adopt these proposed interpretations, which received no opposition in the record, and we therefore consider reliance on a non-IP network as material if that portion of the network is incapable of using SIP.264 Put another way, if a SIP-incompatible portion of a voice service provider’s network is used for the provision of voice service, that portion of the network is eligible for an extension of the implementation deadline. The record reflects support for this interpretation.265 We acknowledge the concerns raised by AT&T and others regarding the prevalence of non-IP networks,266 and find that their prevalence only increases the importance of taking action to encourage widespread caller ID authentication across all networks while the IP transition is ongoing.

67. Duration of Extension. The TRACED Act directs that the non-IP extension shall end once “a call authentication protocol has been developed for calls delivered over non-[IP] networks and is reasonably available.”267 In determining whether a caller ID authentication protocol meets this standard, we adopt the test proposed by Alaska Communications, with some modifications. Consistent with Alaska Communications’ proposal, we conclude that a caller ID authentication protocol “has been developed” if we determine that the protocol is fully developed and finalized by industry standards.268 We agree with commenters that such a protocol must be standards-based and ready for implementation.269 We also find that a caller ID authentication protocol is “reasonably available” if the underlying equipment and software necessary to implement such protocol is available on the commercial market.270 We believe this approach is a workable and clear standard, and has support from the record.271 And as we have explained, we adopt the same standard for determining whether a caller ID authentication protocol is “effective” for purposes of our mandate on non-IP networks, ensuring a harmonious approach to our rules regarding non-IP caller ID authentication technology. Alaska Communications suggests that we adopt an additional requirement for determining whether a caller ID authentication protocol is “reasonably available.”272 Specifically, Alaska Communications suggests that the “knowledge, training, and expertise necessary to operate the equipment and implement the standard [must be] sufficiently widespread among the small, rural, and other non-IP service providers” in receipt of an extension in order for the standard to be “reasonably available.”273 We decline to adopt this requirement because doing so could create a perverse incentive for voice service providers to be willfully ignorant of newly developed protocols so as to prolong an extension. It also would require an unreasonably complicated inquiry into the knowledge and practices of numerous small voice service providers. We further find such a requirement to be unnecessary ex ante without a specific protocol and associated requirements in front of us.

68. As we explained in the context of the mandate on non-IP networks, we will continue to monitor industry progress towards the development of a non-IP caller ID authentication solution. If we find after providing notice and an opportunity for comment that a non-IP solution meets these criteria, we will both modify the non-IP implementation mandate and phase out the non-IP implementation extension to account for this new solution. Cooperative Telephone Company suggests that we grant a limited five- year extension of the June 30, 2021, deadline for implementing a caller ID authentication framework “for those service providers currently using a TDM network that have less than 1,000 subscriber lines.”274 Cooperative Telephone Company argues that such small and rural telephone companies have “scarce resources” which would not cover both the demands of their customers and new regulations for non-IP technology.275 We decline to do so given that such an extension would not be consistent with the timeframe that Congress established in the TRACED Act for the non-IP extension—which is to last until a non-IP solution becomes reasonably available—not for a fixed period of years.276 Alaska Communications suggests that we “grant a permanent exemption for the few non-SS7-connected switches remaining” because such switches are unique.277 We find adopting this proposal unnecessary at this time. In the absence of a developed solution, we are not yet in a position to determine whether any technical exceptions could be necessary and appropriate.

69. Obligations of Voice Service Providers Receiving an Extension. The TRACED Act provides that we should limit or terminate an extension of compliance if we determine in a future assessment that a voice service provider “is not making reasonable efforts to develop the call authentication protocol” for non-IP networks.278 To be consistent with our approach in mandating that voice service providers take “reasonable measures” to implement an effective caller ID authentication framework in the non-IP portions of their networks, we find that a voice service provider satisfies the “reasonable efforts” requirement under section 4(b)(5)(D) if it is able to provide the Commission, upon request, with documented proof that it is participating, either on its own, in concert with a vendor, or through a representative, as a member of a working group, industry standards group, consortium, or trade association that is working to develop a non-IP solution, or actively testing such a solution.279 We also conclude this requirement both promotes the IP transition and encourages the development of a non-IP authentication solution for the benefit of those networks that cannot be speedily or easily transitioned.280

3. Reevaluating Granted Extensions

70. Section 4(b)(5)(F) of the TRACED Act requires us annually to reevaluate and revise as necessary any granted extension, and “to issue a public notice with regard to whether such [extension] remains necessary, including why such [extension] remains necessary; and when the Commission expects to achieve the goal of full participation.”281 As we proposed in our First Caller ID Authentication Report and Order and Further Notice,282 we direct the Bureau to reevaluate the extensions we have established annually, and to revise or extend them as necessary.283 We adopt this proposal because the Bureau is in the best position to undertake this fact-intensive and case-by-case evaluation, particularly in the context of evaluating extensions for undue hardship. Pursuant to the TRACED Act, we direct the Bureau to issue a Public Notice seeking comment to inform its annual review and consider the comments it receives before issuing a Public Notice of its decision as to whether to revise or extend an extension.284 The record

reflects support, and no opposition, for this reevaluation process.285

71. Scope of Bureau’s Authority. We permit the Bureau to decrease, but not to expand, the scope of entities that are entitled to a class-based extension based on its assessment of burdens and barriers to implementation. Specifically, if the Bureau concludes in its review that a class-based extension should be extended beyond the original end date set by the Commission, it may choose to do so for all or some recipients of the extension, as it deems appropriate, based on its assessment and after providing notice and an opportunity for comment. As suggested by ACA Connects, we clarify that the Bureau may not, however, terminate an extension for some or all recipients prior to the extension’s originally set or newly extended end date.286

72. Assessment of Burdens and Barriers. The TRACED Act directs the Commission to assess burdens and barriers to implementation by December 30, 2020, and “as appropriate thereafter.”287 We find it appropriate to reassess burdens and barriers to implementation by voice service providers that we granted an extension in conjunction with evaluating whether to maintain, modify, or terminate the extension.288 Accordingly, we direct the Bureau to assess burdens and barriers to implementation faced by those categories of voice service providers subject to an extension when it reviews those extensions on an annual basis or on petition. Coordinating an assessment of burdens and barriers to implementation with our extension reevaluations will inform the Bureau’s decision to extend or revise any granted extensions. It will also provide a basis for the Bureau to revise the scope of entities that are entitled to an extension. We find that aligning the periodic reassessment of burdens and barriers to implementation with any review of extensions is the best reading of the relevant statutory language. We read “appropriate” in this section to tie the timing of our future assessments to our annual extension reevaluations.289 We received no comments in the record to our proposal in this regard.290

4. Robocall Mitigation Program

73. Section 4(b)(5)(C)(i) of the TRACED Act directs us to require any voice service provider that has been granted an extension to implement, during the time of the extension, “an appropriate robocall mitigation program to prevent unlawful robocalls from originating on the network of the provider.”291 In the First Caller ID Authentication Report and Order and Further Notice, we sought comment on USTelecom’s proposal to obligate voice service providers to file certifications describing

their robocall mitigation programs in lieu of a prescriptive approach.292 In today’s Report and Order, we adopt this proposal and give voice service providers the flexibility to decide the specific contours of an effective robocall mitigation program that best suits the needs of their networks and customers. We additionally create a certification process and database to aid in enforcement efforts and prohibit intermediate providers and terminating voice service providers from accepting voice traffic from voice service providers not listed in the database. These steps will ensure that the only voice traffic to traverse voice networks in the U.S. is from those voice service providers that have either fully implemented STIR/SHAKEN on their entire networks or that have implemented a robocall mitigation program on those portions of their networks that are not STIR/SHAKEN-enabled.

74. Providers Subject to the TRACED Act’s Robocall Mitigation Program Requirement. Based on the statutory text, we read the requirement to implement a robocall mitigation program to apply to all voice service providers that receive an extension on the basis of undue hardship or material reliance on a non-IP network.293 The record reflects support for this approach.294 Securus argues that we should not impose a robocall mitigation program requirement on voice service providers—even voice service providers granted an extension—whose networks uniquely pose “nearly zero” risk of originating high volumes of illegal robocalls.295 We decline to adopt this suggestion because the TRACED Act obligates us to require “any provider subject to such [extension to] implement an appropriate robocall mitigation program.”296 Neustar recommends that we require “all voice service providers [to] utilize robocall mitigation solutions, regardless of whether they implement STIR/SHAKEN in their networks,”297 and ZipDX argues that providers which have implemented STIR/SHAKEN should institute robocall mitigation programs for any calls they authenticate with C-level attestation.298 We decline to adopt these suggestions. We agree with commenters that under the TRACED Act robocall mitigation “is intended to be an interim approach for addressing potential unlawful robocalls until the provider has implemented

STIR/SHAKEN.”299 While USTelecom argues we can find authority under other provisions of the Act,300 we need not reach that issue. First, regardless of whether we could rely on an alternative source of authority, we find it appropriate to defer to Congress’s recent, specific guidance on the subject.301 Moreover, while USTelecom argues that such a requirement “will provide benefits independent of call authentication solutions, including before and after full deployment of such solutions,”302 we find such a requirement to be inappropriate at this juncture. We cannot yet know whether requiring voice service providers to expend additional resources on robocall mitigation even after STIR/SHAKEN implementation would be an efficient use of their resources, and we do not wish to place additional burdens on voice service providers already working to comply with the June 30, 2021, STIR/SHAKEN implementation deadline. We will revisit this conclusion if we determine that additional robocall mitigation efforts are necessary in addition to STIR/SHAKEN after the caller ID authentication technology is more widespread.

75. Robocall Mitigation Program Requirements. The TRACED Act directs us to require all voice service providers granted an extension—whether on the basis of undue hardship or material reliance on a non-IP network—to “implement an appropriate robocall mitigation program to prevent unlawful robocalls from originating on the[ir] network[s].”303 As suggested by USTelecom, we require voice service providers subject to an extension to “take[] reasonable steps to avoid originating illegal robocall traffic.”304 With one exception noted below, we find that a non-prescriptive approach to robocall mitigation requirements gives voice service providers “the flexibility to react to traffic trends they view on their own networks and react accordingly.”305 This approach also allows voice service providers to innovate and “draw from the growing diversity and sophistication of anti-robocall tools and approaches available.”306

76. We require voice service providers subject to an extension to document and publicly certify how they are complying with these requirements. We find that such a requirement will encourage voice service providers to ensure that they are taking “reasonable steps.” We have previously found that requiring self-evaluation is an effective means of promoting compliance with our rules.307 Such a requirement also enables us to evaluate a voice service provider’s “reasonable steps” to determine whether they are sufficient. This public certification requirement will facilitate our ability to enforce a

prohibition on intermediate providers and terminating voice service providers from accepting voice traffic from voice service providers with insufficient or ineffective robocall mitigation programs.

77. While we adopt a non-prescriptive approach to voice service providers’ robocall mitigation programs, we find it necessary to articulate general standards, both to guide voice service providers in preparing their programs and to ensure that the statutory obligation to implement a robocall mitigation program is enforceable. We clarify that a robocall mitigation program is sufficient if it includes detailed practices that can reasonably be expected to significantly reduce the origination of illegal robocalls.308 In addition, for its mitigation program to be sufficient, the voice service provider must comply with the practices it describes. We will also consider a mitigation program insufficient if a provider knowingly or through negligence serves as the originator for unlawful robocall campaigns.309 At the same time, we agree with Verizon that “different types of network providers should have different types of robocall mitigation programs,”310 and we welcome voice service providers adopting approaches that are innovative, varied, and adapted to their networks.

78. The record also convinces us that participation in industry traceback efforts is of utmost importance in the absence of STIR/SHAKEN implementation.311 To that end, we require voice service providers, as part of their robocall mitigation programs, to commit to cooperating with the Commission, law enforcement, and the industry traceback consortium in investigating and stopping any illegal robocallers that it learns are using its service to originate calls.312 We find that this baseline requirement to participate in traceback efforts is a necessary aspect of any attempt to mitigate illegal robocalls, as it permits voice service providers and enforcement agencies to identify illegal robocallers and prevent them from further abusing the voice network.313 Without a means to identify and bring enforcement actions against the sources of illegal robocalls, such bad actors will continue their operations unchecked and emboldened. We underscore that this is a necessary, but not sufficient, component of a voice service provider’s robocall mitigation program which, as we have explained, must include other steps to ensure that a provider is not the source of illegal robocalls.

79. We decline at this time to impose other more prescriptive requirements for robocall mitigation programs, such as mandating an analytics-based robocall mitigation program, as proposed by

Transaction Network Services,314 or know-your-customer policies, as suggested by Consumer Groups.315 While we acknowledge that such practices and policies may be effective aspects of a robocall mitigation program316—and we encourage voice service providers to incorporate them into their own robocall mitigation programs—we decline specifically to mandate them, as we agree with commenters that argue that there is no one-size-fits-all robocall mitigation solution that accounts for the variety and scope of voice service provider networks.317 For example, a small voice service provider with few subscribers may not have a need to implement comprehensive analytics given its small size. Similarly, a voice service provider with limited means may choose a solution suited to its budget and business model.318 We also decline Neustar’s suggestion that we “ensure that providers implement robocall mitigation solutions for both originating and terminating calls.”319 The TRACED Act’s mandate plainly requires only robocall mitigation programs that “prevent unlawful robocalls from originating on the network of the provider.”320

80. Deficient Robocall Mitigation Programs. If we find that our non-prescriptive approach to robocall mitigation is not satisfactorily stemming the origination of illegal robocalls, we agree with NTCA and Verizon that we should be ready to impose more prescriptive obligations on any voice service provider whose robocall mitigation program has failed to prevent high volumes of illegal robocalls.321 We thus direct the Enforcement Bureau to prescribe more specific robocall mitigation obligations for any voice service provider it finds has implemented a deficient robocall mitigation program. Such robocall mitigation obligations would be chosen as appropriate to resolve the specific voice service provider’s prior shortcomings. In such instances, the Enforcement Bureau will release an order explaining why a particular mitigation program is deficient and, among other things, prescribe the new obligations needed to rectify those deficiencies, including any milestones or deadlines. We find that action by the Enforcement Bureau is appropriate in responding to issues on a case-by-case basis.322 If we find that our non-prescriptive approach to robocall mitigation programs is falling short on a widespread basis, we will not hesitate to revisit the obligations we impose through rulemaking at the Commission level.

81. Voice Service Provider Certification and Database. To promote transparency and effective robocall mitigation, we require all voice service providers—not only those granted an extension—to file certifications with the Commission regarding their efforts to stem the origination of

illegal robocalls on their networks. Specifically, as proposed by USTelecom,323 and with the support of all parties that commented on the issue in the record,324 we require all voice service providers to certify that their traffic is either “signed with STIR/SHAKEN or . . . subject to a robocall mitigation program” that includes “tak[ing] reasonable steps to avoid originating illegal robocall traffic,” and committing to cooperating with the Commission, law enforcement, and the industry traceback consortium in investigating and stopping any illegal robocallers that it learns are using its service to originate calls.325 For those voice service providers that certify that some or all of their traffic is “subject to a robocall mitigation program,” we require such voice service providers to detail in their certifications the specific “reasonable steps” that they have taken “to avoid originating illegal robocall traffic.”326 This requirement will promote transparency and accountability in light of our non-prescriptive approach to the robocall mitigation program requirements. While only voice service providers with an extension will be obligated to implement a robocall mitigation program, we impose the certification requirement on all voice service providers because doing so will help us and others to hold all voice service providers accountable for the voice traffic they originate, and give us and others a snapshot of the progress of STIR/SHAKEN implementation and the variety of robocall mitigation practices adopted by voice service providers.327

82. Voice service providers must file certifications via a portal on the Commission’s website that we will establish for this purpose. We will also establish a publicly accessible database in which we will list such certifications. Establishing a database will aid in monitoring compliance with our robocall mitigation requirement and facilitate enforcement action should such action be necessary.328 We direct the Bureau to establish this portal and database, provide appropriate filing instructions and training materials, and release a Public Notice when voice service providers may begin filing certifications. We direct the Bureau to release this Public Notice no earlier than March 30, 2021, and to establish a deadline for the filing of certifications no earlier than June 30, 2021.329 We also direct the Bureau to issue guidance and a protective order regarding the treatment of any confidential and highly confidential information included in certifications. We do so to protect voice service providers that are worried that public disclosure of their robocall mitigation programs may give bad actors the information they need to undermine their programs, or necessitate disclosure of competitively sensitive information. If we find that a certification is deficient in some way, such as if the certification describes a robocall mitigation

program that is ineffective,330 or if we find that a provider nonetheless knowingly or negligently originates illegal robocall campaigns, we may take enforcement action as appropriate. Enforcement actions may include, among others, removing a defective certification from the database after providing notice to the voice service provider and an opportunity to cure the filing, or requiring the voice service provider to submit to more specific robocall mitigation requirements, and/or imposition of a forfeiture.331

83. We also require voice service providers filing certifications to provide the following identification information in the portal on the Commission’s website:

(1) the voice service provider’s business name(s) and primary address;

(2) other business names in use by the voice service provider;

(3) all business names previously used by the voice service provider;

(4) whether a voice service provider is a foreign voice service provider; and

(5) the name, title, department, business address, telephone number, and email address of a central point of contact within the company responsible for addressing robocall-mitigation-related issues.

84. This information will be made publicly available in the database, and reporting such information presents a minimal burden on voice service providers.332 We find that requiring a voice service provider to report contact information for the person responsible for addressing robocall- mitigation-related issues will facilitate inter-provider cooperation and enforcement actions should issues arise.333 We also require voice service providers to submit to the Commission via the appropriate portal any necessary updates to the information they filed in the certification process within 10 business days.334 This requirement will ensure that we and all voice service providers have up-to-date data without overburdening voice service providers with unnecessary filings.

85. Obligations on Intermediate Providers and Terminating Voice Service Providers. As suggested by multiple commenters,335 we prohibit intermediate providers and terminating voice service providers from accepting voice traffic directly from any voice service provider that does not appear in the database, including a foreign voice service provider that uses NANP resources that pertain to the United States to send voice traffic to residential or business subscribers in the United States.336 Effective 90 days after the deadline for robocall mitigation program certifications set forth in the Bureau Public Notice establishing the robocall mitigation database and portal, intermediate providers and terminating voice

service providers are subject to this prohibition.337 The record reflects support for this requirement.338

86. We agree with Verizon that, “by prohibiting downstream service providers from accepting traffic from providers that are not in [the database], the Commission can deny a service provider access to the regulated U.S. voice network if it determines that the service provider’s STIR/SHAKEN or robocall mitigation practices are inadequate.”339 In this way, we can police the voice traffic that voice service providers originate by removing or restoring a voice service provider’s listing on the database, after providing notice of any certification defects and providing an opportunity to cure. Furthermore, as voice service providers monitor the database to ensure they remain compliant with our rules, they must necessarily review the listings of voice service providers with which they interconnect to ensure that such certifications are sufficient. In so doing, industry continually reviews itself to ensure compliance with our rules, amplifying the effectiveness of our own review. This rule will further encourage all voice service providers to implement meaningful and effective robocall mitigation programs on their networks during the period of extension from the STIR/SHAKEN mandate. In turn, this rule will help prevent illegal robocall traffic from reaching terminating voice service providers and their subscribers.340

87. NTCA and ACA argue that we should require intermediate providers and terminating voice service providers to give notice to an originating voice service provider whose traffic they will block because it is not listed in the robocall mitigation database.341 NTCA argues that this will “enable legitimate providers to cure honest mistakes on their part or ‘glitches’ in the database.”342 We decline to adopt this suggestion as we find that the framework we adopt provides adequate notice to voice service providers of the need to file sufficient certifications, including a 90-day period between the deadline for certifications and the prohibition on intermediate and terminating voice service providers accepting traffic from originating voice service providers not in the database. Second, adopting this suggestion would place potentially costly obligations on compliant intermediate providers and terminating voice service providers to provide adequate notice to noncompliant originating voice service providers. Such compliant providers may be unable to provide notice for lack of having or being able to obtain a noncompliant provider’s contact information—opening themselves up to potential enforcement action for lack of compliance. Lastly, we will give notice and an opportunity to cure to voice service providers whose certifications are deficient before we take enforcement action such as de-listing the provider from the database.

We decline to adopt to USTelecom’s proposal that we require intermediate providers to file a certification to their compliance with this rule.343 We see no clear need to impose a burdensome belt-and-suspenders paperwork requirement on providers that are already subject to this obligation by rule. We similarly decline ZipDX’s proposal that intermediate providers must “[i]mplement[] a Robocall Mitigation Program applicable to calls [they do] not authenticate.”344 Pursuant to the TRACED Act, robocall mitigation is meant to stem the origination of illegal robocalls, and ZipDX does not explain

specifically how an intermediate provider could itself prevent the origination of illegal robocalls. We find the rule we establish—whereby intermediate providers are prohibited from accepting traffic from an originating voice service provider that has not certified to a robocall mitigation program—best leverages the role of intermediate providers to combat illegal robocalls within our greater robocall mitigation scheme.

88. Foreign Voice Service Providers. In the First Caller ID Authentication Report and Order and Further Notice, we sought comment on mechanisms to combat robocalls originating abroad.345 The record contains several comments expressing support for combating robocalls originating abroad by requiring foreign voice service providers that wish to appear in the database to follow the same requirements as domestic voice service providers,346 and we do so today. Thus, foreign voice service providers that use NANP numbers that pertain to the United States to send voice traffic to residential and business subscribers in the United States must follow the same certification requirements as domestic voice service providers in order to be listed in the database. Because we prohibit domestic intermediate providers and terminating voice service providers from accepting traffic from foreign voice service providers that use NANP numbers that pertain to the United States and are not listed in the database, we create a strong incentive for such foreign voice service providers to file certifications.347

89. We find that this result will encourage foreign service providers to choose to institute robocall mitigation programs and file certifications to be listed in the database and thus have their traffic be accepted by domestic intermediate and terminating voice service providers. The measures we adopt today will also enable foreign voice service providers to continue using U.S. telephone numbers to send voice traffic to U.S. subscribers under the same certification procedures that will apply to U.S. voice service providers and thereby help prevent the fraudulent exploitation of NANP resources and reduce the volume of illegal voice traffic entering the United States. Ensuring that foreign voice service providers using U.S. telephone numbers comply with the certification requirements prior to being listed in the database is especially important in light of the prevalence of foreign-originated illegal robocalls aimed at

U.S. consumers and the difficulty in eliminating such calls.348

90. We find persuasive the argument by ZipDX that the definition in the initially circulated and publicly released draft Order, which defined “foreign voice service provider” as “any entity that is authorized within a foreign country to provide international voice service,” was unduly narrow and excluded non-U.S. providers that do not possess any authorization to provide service from being able to

file certifications and be listed in the database.349 In response, we revise our rules to establish that an entity is a “foreign voice service provider” if such entity has the ability to originate voice service that terminates in a point outside a foreign country or terminate voice service that originates from points outside that foreign country. Specifically, we define “foreign voice service provider” to mean “any entity providing voice service outside the United States that has the ability to originate voice service that terminates in a point outside that foreign country or terminate voice service that originates from points outside that foreign country.” We find that this approach captures voice traffic originating from a broader range of foreign voice service providers than the one that initially appeared in the draft.

91. Under the rules we adopt, foreign voice service providers that use U.S. telephone numbers to send voice traffic to U.S. subscribers must file the same certification as U.S. voice service providers in order to be listed in the database. Specifically, to be listed in the database, these providers must certify either that they have implemented STIR/SHAKEN or comply with the robocall mitigation program requirements outlined above by “tak[ing] reasonable steps to avoid originating illegal robocall traffic” and committing to cooperating with the Commission, U.S. law enforcement, and the industry traceback consortium in investigating and stopping any illegal robocallers that it learns are using its service to originate calls.350 If we find that a voice service provider’s certification is deficient or the provider fails to meet the standards of its certification, we will pursue enforcement including de-listing the provider from the database.351 We further note that, as discussed above, we require voice service providers—including foreign voice service providers that wish to be listed in the database—to submit to the Commission any necessary updates regarding any of the information they filed in the certification process within 10 business days.

92. Although USTelecom, following circulation and public release of a draft of this Order, has changed its position and now suggests seeking further comment on this approach, we nevertheless take action today given the crucial and urgent importance of protecting Americans from illegal and fraudulent foreign-originated robocalls.352 USTelecom, along with CTIA, suggest that our action today could result in unforeseen technical issues, or the blocking of legitimate calls.353 ZipDX disagrees with this suggestion, arguing that any impact that could arise would be minimal and could be promptly resolved.354 As our rules related to foreign-originated voice traffic that we take today will not begin to affect such voice traffic until June 2021, we are optimistic that voice service providers will have time to resolve any identified issues before the deadline.355 Should voice service providers identify concrete evidence of technical problems or likely blocking of legitimate calls, we encourage them to provide us such information so that we can consider whether to make any modifications to this rule.

5. Alternative Methodologies During an Extension

93. The TRACED Act directs us to “identify, in consultation with small providers of voice service, and those in rural areas, alternative effective methodologies to protect consumers from unauthenticated calls during any” extension from compliance with our STIR/SHAKEN implementation

mandate.356 Given that caller ID authentication frameworks are not yet ubiquitous—and thus most calls that transit U.S. voice networks are unauthenticated—we understand Congress’s concern in this provision to be about protecting consumers from unauthenticated, illegally spoofed robocalls.357 We therefore interpret a methodology to be “effective” if it is likely to substantially reduce the volume of illegal robocalls reaching subscribers.358 We find that this definition tracks the overall purpose of the TRACED Act which is “to reduce illegal and unwanted robocalls” through various mechanisms.359 We sought comment in the First Caller ID Authentication Report and Order and Further Notice from small and rural voice service providers on such alternative effective methodologies.360 The record we received in response demonstrates that such alternative methodologies either already exist or are in development.361 To fulfill this obligation, we identify the following alternative effective methodologies recommended by small and rural voice service providers, as well as other commenters:

· Innovative Systems reports that its landline call blocking service is “fully developed and currently installed at 207 landline providers” and, in the last nine years, “has challenged over 19 million suspected spam calls and blocked another 12 million calls that were from phone numbers off the FCC’s weekly robocall and telemarketing consumer complaint data reports.”362 It states that “greater consumer protection can be achieved by having this alternative methodology installed on all landlines using an opt-out strategy at no cost, versus a purchase to opt-in by the customer.”363

· Neustar reports that its robocall mitigation service “helps voice service providers block calls from illegal robocallers and helps end users identify robocalls.......................................................................................... [b]y combining authoritative

data . . . with behavior insights.”364

· Transaction Network Services reports that “[c]all analytics have proven successful in identifying a large number of the problematic calls being transmitted today.......................................................................... Reasonable call analytics are

widely available from multiple vendors, many of which offer low-investment services that can be deployed in smaller networks at a reasonable cost.”365

Additionally, the recent call blocking report released by the Consumer and Governmental Affairs Bureau identified various available effective methodologies for protecting subscribers from illegal calls, a sample of which is reproduced below:366

Business name

Blocking/labeling services offered

Estimate on number of calls blocked or labeled

Default, opt-in, or opt- out

AT&T—Wireless

Network-level blocking

Call Protect or Call Protect Basic, free

Call Protect Plus

Call Protect and Call Protect Plus, since 2016, blocked fraudulent calls or labeled suspicious calls; nearly 1.3 billion suspected fraud and over 3 billion other calls blocked or labeled.

Network-level blocking is default

Call Protect is opt-out, since 2019

Call Protect Plus is opt-in

AT&T—VoIP

Network-level blocking

Digital Phone Call Protect, free

Blocked over 46 million and spam warnings for 36 million.

Network-level blocking is default

Digital Phone Call Protect is opt-in

Call Control (third- party analytics company)

Software-based call blocking

Blocked over one billion calls.

N/A

Comcast—Wireline

Network-level blocking

Anonymous Call Rejection, Selective Call Rejection, free

Customers can sign up for Nomorobo blocking service, free

Over 158 million calls blocked in Dec. 2019. Anonymous Call Rejection blocked nearly 37 million calls in Dec. 2019.

Selective Call Rejection blocked over five million calls in Dec. 2019.

Network-level blocking is default

Anonymous Call Rejection is opt-in, but will be offered opt-out; Selective Call Rejection is opt-in

Nomorobo is opt-in

Cox

Edge Blocking, free

Anonymous Call Rejection, Selective Call Rejection, free

Customers can sign up for Nomorobo blocking service, free.

14.6% of calls are blocked through one of these tools; Edge Blocking is 65% of the blocked calls and Anonymous Call Rejection is 29%t.

Edge Blocking is opt-out

Anonymous Call Rejection and Selective Call Rejection are opt-in

First Orion (third- party analytics company)

Scam ID and Scam Block

Since 2017, identified over 22 billion scam calls.

N/A

Hiya (third-party

Call blocking

Since 2016, blocked or

N/A

analytics company)

labeled nearly 1.3 billion suspected fraud calls and over 3 billion other suspect calls.

Nomorobo (third- party analytics company)

Call blocking

As of April 30, 2020, blocked over 1.6 billion robocalls.

N/A

T-Mobile

Scam ID, free

Scam Block, free

Name ID, free for some plans

Since 2017, identified over 21 billion scam calls and blocked over 5 billion of those calls.

Scam ID is opt-out for post-paid customers

Scam Block is opt-in

Verizon—Wireless

Network-level blocking

Call Filter, free

Since 2017, blocked hundreds of millions of calls.

Network-level blocking is default

Call Filter is opt-out

Verizon—Wireline

Network-level blocking

Spam Alert, free

VoIP customers can sign up for Nomorobo blocking service, free

Since 2017, blocked hundreds of millions of calls.

Network-level blocking is default

Spam Alert is default Nomorobo is opt-in

6. Legal Authority

94. The TRACED Act expressly directs us to grant extensions for compliance with the STIR/SHAKEN implementation mandate, require any voice service provider subject to such an extension to implement a robocall mitigation program to prevent unlawful robocalls from originating on its network,367 and place unique obligations on providers that receive an extension due to material reliance on non-IP network technology.368 The TRACED Act thus provides a clear source of authority for the rules we adopt today.

95. We conclude that section 251(e) of the Act provides additional, independent authority to adopt the extensions and associated requirements. That section gives us exclusive jurisdiction over numbering policy and enables us to act flexibly and expeditiously with regard to important numbering matters.369 When bad actors unlawfully falsify or spoof the caller ID that appears on a subscriber’s phone, they are using numbering resources to advance an illegal scheme. The extensions and associated requirements will help to prevent the fraudulent exploitation of NANP resources by permitting those providers and their subscribers to identify when caller ID information has been spoofed.

96. We conclude that section 251(e) gives us authority to prohibit intermediate providers and voice service providers from accepting traffic from both domestic and foreign voice service providers that

do not appear in our newly established database.370 As we concluded in the First Caller ID Authentication Report and Order, our exclusive jurisdiction over numbering policy provides authority to take action to prevent the fraudulent abuse of NANP resources.371 Illegally spoofed calls exploit numbering resources whenever they transit any portion of the voice network—including the networks of intermediate providers. Our action preventing such calls from entering an intermediate provider’s or terminating voice service provider’s network is designed to protect consumers from illegally spoofed calls, even while STIR/SHAKEN is not yet ubiquitous. Verizon agrees that section 251(e) gives us ample authority to ensure foreign VoIP providers “submit to the proposed registration and certification regime by prohibiting regulated U.S. carriers from accepting their traffic if they do not.”372

97. We additionally find authority in the Truth in Caller ID Act.373 We find that the rules we adopt today are necessary to enable voice service providers to help prevent these unlawful acts and to protect voice service subscribers from scammers and bad actors, and that section 227(e) provides additional independent authority for the rules we adopt today.374

D. Voluntary STIR/SHAKEN Implementation Exemption

98. While the TRACED Act directs us to require each voice service provider to implement STIR/SHAKEN in its IP network,375 section 4(b)(2) of the TRACED Act frees a voice service provider from this requirement if we determine, by December 30, 2020, that “such provider of voice service”: (A) “in [IP] networks”—(i) “has adopted the STIR/SHAKEN authentication framework for calls on the [IP] networks of the provider of voice service; (ii) has agreed voluntarily to participate with other providers of voice service in the STIR/SHAKEN authentication framework; (iii) has begun to implement the STIR/SHAKEN authentication framework; and (iv) will be capable of fully implementing the STIR/SHAKEN authentication framework” not later than June 30, 2021; and (B) “in non-[IP] networks”—(i) “has taken reasonable measures to implement an effective call authentication framework; and (ii) will be capable of fully implementing an effective call authentication framework” not later than June 30, 2021.376

99. Below, we read section 4(b)(2) of the TRACED Act as creating two exemptions: one for IP calls and one for non-IP calls. To ensure that the exemption only applies where warranted and to provide parties with adequate guidance, we expand on each of the prongs that a voice service provider

must meet to obtain an exemption, and adopt rules accordingly. We find that the best way to implement the TRACED Act’s exemption provision in a timely manner is via a certification process and thus adopt rules requiring that a voice service provider that wishes to receive an exemption submit a certification that it meets the criteria for the exemptions that we have established pursuant to section 4(b)(2)(A), section 4(b)(2)(B), or both. To guard against the risk of gaps and improper claims of the exemption, we require voice service providers that receive an exemption to file a second certification after June 30, 2021, stating whether they, in fact, achieved the implementation goal to which they previously committed in their initial certification. Last, we find that the TRACED Act’s exemption provision does not extend to intermediate providers. We adopt these rules pursuant to the authority expressly granted us by section 4(b)(2) of the TRACED Act.377

1. Relationship of IP Networks and Non-IP Networks Provisions

100. As proposed in the Further Notice of Proposed Rulemaking,378 we read section 4(b)(2) of the TRACED Act as creating two exemptions: one for IP calls and one for non-IP calls. Thus, a voice service provider may seek the exemption for its “IP networks” if it meets all four criteria for all calls it originates or terminates in SIP, and a voice service provider may seek the exemption for its “non-IP networks” if it meets both the criteria for all non-SIP calls it originates or terminates. This approach is consistent with the views of the commenters that touched upon this issue in the record.379

101. We find that this reading best implements Congress’s policy and is consistent with principles of statutory construction when considering the statute as a whole. As AT&T observes, the structure of the TRACED Act “recognizes that implementation of a caller ID authentication framework will differ for IP networks and non-IP networks.”380 Given the presence of the word “and” between the IP and non-IP networks criteria, we recognize that the exemption could potentially be read as applying only if the voice service provider meets both the IP and non-IP networks criteria. Yet such a reading would render the exemption an empty set or nearly so because of the absence of an effective solution for non-IP caller ID authentication at present, such that few, if any, voice service providers will be able to claim that they will be capable of “fully implementing” an effective non-IP caller ID authentication framework by June 30, 2021.381 Our reading cabins the nullity risk more narrowly, thus better effectuating Congress’s goal of creating a meaningful exemption.382

102. Our approach also further encourages prompt deployment of STIR/SHAKEN. We understand the statutory exemption to both encourage and reward early progress in deployment. Therefore, by giving voice service providers a path to exemption solely for their IP networks—the only types of networks on which STIR/SHAKEN can effectively operate—our approach will effectuate Congress’s intent to encourage faster progress in STIR/SHAKEN deployment. And by separating IP and

non-IP calls in this way, we align our exemption process with the call-by-call vision of a caller ID authentication implementation mandate that subjects different parts of a voice service provider’s network to different requirements.

2. Threshold for IP Networks Exemption

103. To ensure that the exemption only applies where warranted and to provide parties with adequate guidance, we expand on each of the four substantive prongs laid out in the TRACED Act that a voice service provider must meet to obtain an exemption.

104. Prong (i)—Adoption of STIR/SHAKEN. In the Further Notice of Proposed Rulemaking, we proposed to interpret the phrase “has adopted the STIR/SHAKEN authentication framework for calls on the [IP] networks of the provider of voice service”383 in prong (A)(i) to mean that the voice service provider has publicly committed, via a certification, to complete implementation of STIR/SHAKEN by June 30, 2021.384 In light of the comments in the record, we modify this proposal to require that the voice service provider has completed the network preparations necessary to deploy the STIR/SHAKEN protocols on its network, including, but not limited to, by participating in test beds and lab testing, or completing commensurate network adjustments to enable the authentication and validation of calls on its network consistent with the STIR/SHAKEN framework.

105. We agree with commenters that focusing on network preparations will provide significant concrete evidence that a voice service provider is taking the necessary steps in its STIR/SHAKEN implementation, and will thus offer confirmation that a provider has adopted the STIR/SHAKEN authentication framework.385 We further agree with AT&T that our original certification-based proposal would not provide specific measurable criteria by which to assess a provider’s progress.386 Simply issuing a commitment will not do as much to ensure that voice service providers are actually doing so as will an obligation to undertake the network preparations necessary to operationalize the STIR/SHAKEN protocols on their networks. Taking the necessary first steps to participate in STIR/SHAKEN more affirmatively demonstrates a voice service provider’s commitment and preparedness to implement an effective caller ID authentication framework than a general declaration of intent that may or may not be accompanied by concrete steps. We disagree with T-Mobile’s unsupported contention that our previous proposal would be preferable.387 While a public commitment to complete implementation of STIR/SHAKEN by June 30, 2021 would be a welcome initial step, we conclude that the better approach is to require voice service providers to undertake the preparations necessary to implement this framework, rather than merely issuing a pledge to do so.

106. Prong (ii)—Participation with Other Providers. In the Further Notice of Proposed Rulemaking, we proposed to read the phrase “has agreed voluntarily to participate with other providers of voice service in the STIR/SHAKEN authentication framework” in prong (A)(ii)388 to require that the voice service provider has written, signed agreements with at least two other voice service providers to exchange calls with authenticated caller ID information.389 After reviewing the record, we revise this

proposal to require that the voice service provider has demonstrated its voluntary agreement to participate with other voice service providers in the STIR/SHAKEN framework by completing formal registration (including payment) and testing with the Policy Administrator.390

107. We agree with commenters that such an action would signal both a public and financial commitment to working with other voice service providers sufficient to confirm a provider’s coordination efforts.391 Registering with the Policy Administrator is a necessary predicate to participation with other voice service providers in the STIR/SHAKEN framework, and was formulated by the industry to allow the exchange of authenticated traffic without requiring dedicated agreements between voice service providers. Completing formal registration and testing with the Policy Administrator thus signals both a voice service provider’s technical readiness and willingness to participate with other providers in the STIR/SHAKEN framework. We further agree with AT&T, CTIA, and CCA that our initial proposal ignores certain market realities by assuming that every provider of voice services will require multiple agreements to exchange traffic destined to every point on the PSTN.392 Given that some voice service providers may not require two or more interconnection arrangements, let alone multiple agreements with other providers, to exchange their IP-based traffic, imposing a two-agreement requirement to demonstrate voluntary participation in the STIR/SHAKEN framework would be arbitrary and might even inject artificial inefficiencies into such arrangements.393 Our revised interpretation of prong (A)(ii) more closely aligns with the language and intended purpose of the statute, and better encourages STIR/SHAKEN implementation without introducing potential inefficiencies. Exchanging traffic using certificates assigned through the governance system is exactly the way STIR/SHAKEN is designed to work.394 Encouraging voice service providers to complete formal registration and testing with the Policy Administrator is thus the most appropriate and reasonable interpretation of the requirement in prong (A)(ii).

108. Prong (iii)—Begun to Implement. As proposed in the Further Notice of Proposed Rulemaking,395 we implement the phrase “has begun to implement the STIR/SHAKEN authentication framework” in prong (A)(iii) by requiring that the voice service provider has completed the necessary network upgrades to at least one network element (e.g., a single switch or session border controller) to enable the authentication and verification of caller ID information consistent with the STIR/SHAKEN standards.396 This interpretation requires a voice service provider to make meaningful progress on implementation by the time of certification, while taking into account that voice service providers will have limited time between adoption of this Order and the December 30, 2020 deadline for exemption determinations.397 While CCA argues that our approach is unachievable and overly prescriptive, we

disagree.398 To the contrary, our approach accounts for the abbreviated timeframe by giving voice service providers the flexibility to choose to complete upgrades on the network element which they can upgrade most efficiently.399

109. In this case, we find USTelecom’s suggestion that we require voice service providers to establish the capability to authenticate originated traffic and/or validate such traffic terminating on their networks to be excessively vague, and it is unclear how little or how much voice service providers would be required to do under such a rule.400 Depending on the voice service provider, simply “establishing” the capability to authenticate originated traffic and/or validate such traffic terminating on their networks could consist of fully implementing this capability or merely attaining this capability without actually deploying it in one’s network. To the extent that USTelecom—which does not provide a rationale for its proposal—is concerned that the standard we adopt will be too easily met, we are confident that the opportunity to verify implementation of an effective authentication framework will help identify any voice service providers that fail to meet their STIR/SHAKEN implementation commitments.

110. Prong (iv)—Capable of Fully Implementing. Last, and as proposed in the Further Notice of Proposed Rulemaking,401 we implement the obligation to “be capable of fully implementing the STIR/SHAKEN authentication framework” not later than June 30, 2021, in prong (A)(iv) so as to require that the voice service provider reasonably foresees that it will have completed all necessary network upgrades to its network infrastructure to be able to authenticate and verify caller ID information for all SIP calls exchanged with STIR/SHAKEN-enabled partners by June 30, 2021.402 After considering the arguments in the record, we agree with T-Mobile that our proposal is preferable to USTelecom’s narrower alternative of requiring a certification that all consumer VoIP and VoLTE traffic originating or terminating on a voice service provider’s network either is or will be capable of authentication and validation by June 30, 2021.403 This requirement falls short of our implementation mandate, which requires that all calls be subject to caller ID authentication and verification—not just consumer VoIP and VoLTE traffic—except for those subject to the narrow and time-limited extensions we adopt today. To grant an exemption for voice service providers that will be capable of anything short of full compliance would indefinitely leave out calls the TRACED Act and our rules thereunder require to be subject to caller ID authentication. Such an approach also is inconsistent with the statute, which requires “full[] implementation[]” by June 30, 2021, so it is appropriate for us to demand that a provider reasonably foresee that it will meet that standard, rather than set a bar that is more easily cleared at the twelve-month mark but that heightens the risk of a voice service provider ultimately falling short just six months later. While we understand AT&T’s point that voice service providers with more complex, diverse networks will necessarily have more complicated and costly STIR/SHAKEN implementation requirements, we do not think that our proposal is “overly rigid” or “ambiguous.”404 Nor do we agree with CCA that it is “overly prescriptive.”405 Rather, we institute a clear requirement that voice service providers “reasonably foresee” that they will be able to meet the standard Congress established by the deadline that Congress established. This interpretation gives as much latitude to voice service providers as possible to achieve the desired benchmarks while still requiring some basis for the claim that a provider is “capable of fully

implementing the STIR/SHAKEN authentication framework.”406

3. Threshold for Non-IP Networks Exemption

111. Under the TRACED Act, a voice service provider is excused from the requirement to take reasonable measures to implement an effective caller ID authentication framework in the non-IP portions of its network if the Commission finds that it: (1) has taken reasonable measures to implement an effective caller ID authentication framework in the non-IP portions of its network; and (2) will be capable of fully implementing an effective caller ID authentication framework in the non-IP portions of its network not later than June 30, 2021.407 While we anticipate that in the non-IP context few if any voice service providers will seek to take advantage of this exemption because of the difficulties in “fully implementing an effective caller ID authentication framework” by June 30, 2021, we nevertheless adopt standards for determining whether a voice service provider has met both requirements necessary to receive an exemption under section 4(b)(2)(B) of the TRACED Act for the non-IP portions of its network, as required by the TRACED Act.

112. In the Further Notice of Proposed Rulemaking, we sought comment on section 4(b)(2)(B) and whether there was an “acceptable interpretation of the ‘fully implementing’ prong that would make it more achievable for voice service providers to qualify for the exemption.”408 We further sought comment on what constitutes an “effective” call authentication framework and “reasonable measures” for purposes of this section.409 We now find that a voice service provider satisfies the first prong—requiring reasonable measures to implement an effective caller ID authentication framework—if it can certify that it is working to develop a non-IP authentication solution. Because the statutory language is similar to that used to establish the non-IP mandate,410 we find it appropriate to harmonize our interpretation of these two provisions.411 AT&T supports a proposal to require providers to participate in either standards development for a TDM call authentication framework or implement a robust robocall mitigation program as two options for satisfying the “reasonable measures” prong of this section.412 We agree as to the former suggestion, but we find the latter suggestion unduly overlaps with the distinct robocall mitigation program requirement under the statute.

113. We implement the provision in section 4(b)(2)(B)(ii) of the TRACED Act that voice service providers be “capable of fully implementing an effective caller ID authentication framework in

the non-IP portions of their networks not later than [June 30, 2021]” by requiring that the voice service provider reasonably foresees that it will have completed all necessary network upgrades to its infrastructure to be able to authenticate and verify caller ID information for all non-IP calls originating or terminating on its network as provided by a standardized caller ID authentication framework for non-IP networks.413 This approach is consistent with our approach to the fourth prong of the IP network exemption, in which we construe “fully implementing” to mean that caller ID information is able to be authenticated and verified for all calls exchanged with technically-able partners. Further, it is consistent with our evaluation of when a non-IP caller ID authentication framework is “reasonably available,” and we consistently consider such a framework to be “effective” only when it is standardized. We find that this approach gives as much latitude to voice service providers as possible to achieve the desired result within the prescribed timeframe while again requiring some basis for the claim—here, that the provider be “capable of fully implementing an effective caller ID authentication framework.”414

4. Compliance Certifications

114. As proposed in the Further Notice of Proposed Rulemaking,415 we find that the best way to implement the TRACED Act’s exemption provision is via a certification process. Specifically, we require a voice service provider that seeks to receive an exemption to submit a certification that it meets the criteria for the IP networks exemption that we have established pursuant to section 4(b)(2)(A), the criteria for the non-IP networks exemption that we have established pursuant to section 4(b)(2)(B), or both, as appropriate for its network(s). Given the inherent and obvious difficulty of making individualized determinations of whether providers qualify for the IP networks exemption on such a truncated timeframe, we find that a certification process is necessary to allow us to meet Congress’s deadline for completion of exemption determinations by December 30, 2020. This approach is unopposed, and both T-Mobile and AT&T support the use of a certification process “as the appropriate vehicle for a voice service provider to assert its qualification for either or both of the statutory exemptions.”416

115. Each voice service provider that seeks to qualify for either the section 4(b)(2)(A) or the section 4(b)(2)(B) exemption, or both, must have an officer of the voice service provider sign a compliance certificate stating under penalty of perjury that the officer has personal knowledge that the company meets each of the stated criteria. Such an attestation is necessary to ensure the accuracy of the underlying certification.417 We also require the voice service provider to submit an accompanying statement explaining, in detail, how the company meets each of the prongs of each applicable exemption so that the Commission can verify the accuracy of the certification.418

116. As proposed in the Further Notice of Proposed Rulemaking,419 all certifications submitted pursuant to this requirement must be filed no later than December 1, 2020. All certifications and

supporting statements must be filed electronically in WC Docket No. 20-68, Exemption from Caller ID Authentication Requirements, in the Commission’s Electronic Comment Filing System (ECFS).420 We direct the Bureau to provide additional directions and filing information regarding the certifications— including issuing protective orders governing the submission and review of confidential and highly confidential information, where necessary421—by November 9, 2020, or in the Public Notice announcing Office of Management and Budget approval of this process, whichever comes sooner. And we direct the Bureau to review the certifications and accompanying documents for completeness and to determine whether the certifying party has met the requirements we have established. We further direct the Bureau to issue a list of parties that have filed complete, valid compliance certifications and that will thus receive the exemption(s) on or before December 30, 2020.

117. Because of the limited time for review of certifications, we proposed in the Further Notice of Proposed Rulemaking that any voice service providers that file inadequate certifications would not receive an opportunity to cure and instead would be subject to the general duty we established to implement STIR/SHAKEN by June 30, 2021.422 We adopt this proposal here. We find this consequence to be reasonable and appropriate because the purpose of the certification is merely to determine which voice service providers would, in the absence of the STIR/SHAKEN obligation, nonetheless be able to implement STIR/SHAKEN in a timely manner. While we are sympathetic to AT&T’s suggestion that we permit voice service providers a chance to cure and revise their certifications should they be found deficient, the extremely truncated timeline for review of certifications prevents us from allowing such options.423 Simply put, there is insufficient time to permit voice service providers to revise and resubmit certifications that the Bureau has deemed deficient and for the Bureau to review such resubmitted certifications prior to the statutory December 30, 2020 deadline for completion of exemption determinations. Voice service providers must do their best to demonstrate in their initial certifications that they have met all the statutory requirements necessary to qualify for an exemption. Moreover, as stated above, we find the inability of voice service providers to “cure” deficient certifications to be insignificant given the purpose of the certification.

118. Implementation Verification. The section 4(b)(2)(A) and (B) exemptions are, by their nature, based on a voice service provider’s prediction of its future ability to implement STIR/SHAKEN by June 30, 2021. As we explained in the Further Notice of Proposed Rulemaking, we believe that Congress intended for us to verify, after the fact, that voice service providers claiming the exemption completed full implementation in accordance with their commitments.424 Such a review is consistent with the TRACED Act both because the broad structure of section 4 aims toward full implementation of caller ID authentication and because sections 4(b)(2)(A)(iv) and 4(b)(2)(B)(ii) each state that a voice service provider may receive the exemption only if it “will” be capable of “fully” implementing a caller ID authentication framework (STIR/SHAKEN or “an effective call authentication framework,” respectively).425 This approach is unopposed in the record, and T-Mobile correctly notes that without such verification, the voluntary exemption could be misused as a loophole by voice service providers, thereby diminishing the ultimate effectiveness of STIR/SHAKEN implementation, the success of which depends on the participation of a critical mass of voice service providers.426 To guard against the risk of gaps and abusive claims of the exemption, and as proposed in the Further Notice of Proposed

Rulemaking,427 we therefore require voice service providers that receive an exemption to file a second certification after June 30, 2021, stating whether they, in fact, achieved the implementation goal to which they previously committed.

119. As proposed in the Further Notice of Proposed Rulemaking, the certification must be filed electronically in WC Docket No. 20-68, Exemption from Caller ID Authentication Requirements, in ECFS subject to the same allowance for confidentiality and requirements for sworn signatures and detailed support as the initial certifications.428 This process will not only help the Bureau to verify the accuracy of the certification, but will assist it in conducting its review while at the same time ensuring that any confidential or proprietary information included by filers remains safe from disclosure. We direct the Bureau to issue a Public Notice no later than three months after June 30, 2021, setting a specific deadline for the certifications and providing detailed filing requirements. We direct the Bureau to seek public comment on these certifications. Following review of the certifications, supporting materials, and responsive comments, we direct the Bureau to issue a Public Notice, no later than four months after the date of filing of the certifications, identifying which voice service providers achieved the implementation goal to which they previously committed. As suggested in the record,429 we clarify that voice service providers that certified in December of 2020 that they have already fully implemented the necessary STIR/SHAKEN requirements, and for which the Bureau accepted the certification, need not file a second certification. This second filing is required only from those voice service providers that have not yet “fully implemented” STIR/SHAKEN by the time of their initial December 2020 certification, but have committed to doing so by June 30, 2021.

120. We disagree with T-Mobile’s assertion that there is little value is seeking public comment on voice service providers’ certifications.430 While T-Mobile is correct that a review of whether a voice service provider has conformed to the terms of its exemption declarations and implemented STIR/SHAKEN will require a technical analysis, we anticipate that the considered comments of market participants, technical and trade associations, and industry professionals can inform and enrich the Bureau’s analysis of any such technical issues.431 Further, allowing comments is critical to maintaining a clear and transparent process. Moreover, to the extent that parties must submit confidential information, the Bureau will issue protective orders governing submission and review akin to those we have employed in numerous other contexts.432 There is thus no risk that any voice service provider will be obligated to publicly disclose “sensitive network information” as part of this certification and comment process.433

121. As proposed in the Further Notice of Proposed Rulemaking, if a voice service provider cannot certify to full implementation upon the filing of the second certification but demonstrates to the Bureau that (1) it filed its initial certification in good faith—i.e., with a reasonable expectation that it would be able to achieve full implementation as certified—and (2) made similarly good faith efforts to complete implementation, the consequence for such a shortcoming is the loss of the exemption and

application of the general rule requiring full STIR/SHAKEN implementation, effective immediately upon release of the Bureau Public Notice identifying which voice service providers achieved the implementation goal to which they previously committed. We find that an immediate effective date is required to ensure that certain voice service providers do not receive an extension not granted to similarly situated voice service providers simply because they filed a certification they later failed to meet. If the Bureau finds that a voice service provider filed its initial certification in bad faith or failed to take good faith steps toward implementation, we will not only require that voice service provider to fully implement STIR/SHAKEN immediately, but will further direct the Bureau to refer the voice service provider to the Enforcement Bureau for possible enforcement action based on filing a false initial certification.434

5. Voice Service Providers Eligible for Exemption

122. We proposed in the Further Notice of Proposed Rulemaking to interpret the TRACED Act’s exemption process to apply only to voice service providers and to exclude intermediate providers.435 We adopt that approach here. No commenters addressed this issue in the record. In the TRACED Act, Congress directs the Commission to require “provider[s] of voice service” to implement STIR/SHAKEN in the IP portions of their networks.436 The exemption provisions in section 4(b)(2) of the TRACED Act similarly refer to “provider[s] of voice service.”437 Because the obligation on intermediate providers to implement the STIR/SHAKEN authentication framework is being adopted pursuant to our authority in the Truth in Caller ID Act and section 251(e),438 we do not believe that the exemption process, which is mandated under and governed by the TRACED Act, needs to apply to such intermediate providers.439 We do not find that there is a compelling policy argument in favor of extending the TRACED Act’s exemption process to intermediate providers. The exemption process as laid out in the TRACED Act will not have long-term benefits to providers, since even those that qualify for the exemption must be capable of fully implementing either the STIR/SHAKEN authentication framework or an effective call authentication framework not later than June 30, 2021.440 Given this, we are disinclined to add further administrative and regulatory complication where not required by the TRACED Act.

E. Line Item Charges

123. We adopt our proposal in the First Caller ID Authentication Report and Order and Further Notice to prohibit voice service providers from imposing additional line item charges on consumer or small business subscribers for caller ID authentication.441 The record reflects support for this

proposal,442 and we believe adopting it is a straightforward implementation of Congress’s direction and authority in the TRACED Act to “prohibit providers of voice service from adding any additional line item charges to consumer or small business customer subscribers for the effective call authentication technology.”443

124. We are unconvinced by arguments opposed to the rule we adopt today. MT Networks argues that we should instead affirmatively permit voice service providers to list caller ID authentication “as a billable feature on their line.”444 Because MT Networks fails to explain how such an alternative course of action would be consistent with the text of the TRACED Act, we decline to adopt such a suggestion. Securus argues that the prohibition on line item charges should not apply to inmate calling service providers.445 We similarly decline to adopt such an exemption for these providers, as the TRACED Act’s prohibition on line item charges extends to all “providers of voice service,” which includes inmate calling service providers.446

125. Other commenters argue that we should go even further than the TRACED Act and prohibit voice service providers from recouping costs of caller ID authentication and other robocall mitigation solutions entirely.447 We decline to take such action because doing so would go beyond the directive in the TRACED Act, and because we recognize that implementation of caller ID authentication imposes cost on voice service providers.448 Additionally, the record shows that some voice service providers may not have enough resources simply to absorb the cost of implementing caller ID authentication.449 By not prohibiting cost recovery through alternate means, we promote the investment by all voice service providers in caller ID authentication solutions for their networks.450

126. As proposed, we interpret “consumer” in this context to mean residential mass market

subscribers, and adopt a rule consistent with this interpretation.451 We interpret “consumer” to refer to individual subscribers because we believe this interpretation will protect individuals from receiving line item charges on their bills. We received no opposition in the record to our proposal. We also adopt our proposal to interpret “small business” to refer to business entities that meet the Small Business Administration definition of “small business.”452 We adopt this definition of “small business” because it reflects the judgment of the Small Business Administration, which has expertise in this area. We received no opposition in the record for this interpretation. We decline to adopt RadNet’s proposal that we prohibit voice service providers “from charging healthcare facilities and providers, regardless of size, for call authentication technology,”453 because the TRACED Act establishes the classes of entities that Congress intended to protect from additional line item charges for caller ID authentication: consumers and small business subscribers.454 Additionally, healthcare facilities that meet the standard for “small business” that we establish are covered by our rule, and so separate protection for such healthcare facilities would be redundant. Healthcare facilities that exceed the definition of “small business” are in a better position to negotiate billing arrangements with voice service providers than small businesses and residential mass market subscribers. Thus, providing them with the same protections would be unnecessary.

127. We also adopt our proposal to implement this section of the TRACED Act by prohibiting voice service providers from imposing a line item charge for the cost of upgrading network elements that are necessary to implement caller ID authentication, for any recurring costs associated with the authentication and verification of calls, or for any display of caller ID authentication information on their subscribers’ phones.455 Caller ID authentication solutions work by allowing the originating voice service provider to authenticate the caller ID information transmitted with a call it originates, and the terminating provider to verify that the caller ID information transmitted with a call it receives is authentic and act on the information provided after verification. The record reflects that voice service providers must upgrade their existing network elements to enable caller ID authentication,456 and pay recurring maintenance and other operating fees in order to actively authenticate caller ID information.457 And, for caller ID authentication technology to be meaningful for subscribers, voice service providers may choose to display caller ID authentication information to their end users. We find that the prohibition as adopted covers the full scope of costs “for” providing caller ID authentication to consumer and small business subscribers.458

128. CenturyLink argues that this is too expansive a reading of the TRACED Act’s

language.459 Instead, CenturyLink suggests that, to be more aligned with the language of the TRACED Act, we only prohibit line items for costs “related to the basic signing of calls and verifying of Identity headers.”460 We fail to see how costs associated with, for example, network upgrades that are necessary to implement caller ID authentication are not “for” such technology, and CenturyLink does not explain why we should read “for” in this context so narrowly. We also note that we do not prohibit cost recovery for such costs by alternative means.

F. Intermediate Providers

129. To further promote effective, network-wide caller ID authentication, we adopt the proposal from our First Caller ID Authentication Report and Order and Further Notice to extend our STIR/SHAKEN implementation mandate to intermediate providers.461 The STIR/SHAKEN framework enables an end-to-end system for authenticating the identity of the caller.462 For this system to work, the Identity header must travel the entire length of the call path—even when a call transits the networks of intermediate providers.463 Thus, intermediate providers play a crucial role in this system. In the First Caller ID Authentication Report and Order and Further Notice, we proposed imposing obligations on intermediate providers for calls they receive with authenticated and unauthenticated caller ID information.464 For calls with authenticated caller ID information that an intermediate provider receives and will exchange in SIP, we proposed requiring an intermediate provider to pass any Identity header associated with that call, unaltered, to the subsequent provider in the call path.465 And for calls an intermediate provider receives without authenticated caller ID information that it will exchange in SIP, we proposed requiring the intermediate provider to authenticate that call with “gateway” or “C”-level attestation before passing it to the subsequent intermediate or voice service provider in the call path.466 With modifications, we adopt both of these proposals.

1. Authenticated Calls

130. We adopt our proposal to require intermediate providers to pass any Identity header that they receive to the terminating voice service provider or subsequent intermediate provider in the call path. This means, technically, that the intermediate provider must forward the Identity header downstream in the SIP INVITE.467 By placing this requirement on intermediate providers, we ensure that SIP calls can benefit from STIR/SHAKEN regardless of what provider transits the call. This proposal received wide support, and no opposition, in the record.468 INCOMPAS, which notes that it represents a number of entities that act as intermediate providers, agrees that “[t]he success of STIR/SHAKEN ultimately depends on the broad participation of voice service providers, including, wherever technically feasible, intermediate providers.”469 AT&T, Comcast, and Verizon also all confirm the importance of adopting this rule. AT&T notes that “requiring intermediate providers to pass through Identity header information is necessary to ensure that calls retain authentication information across the entire call path.”470 Comcast writes that “[a]chieving truly nationwide call authentication requires the participation of all providers involved in transmitting voice calls, including intermediate providers.”471 And Verizon emphasizes that regulatory action is necessary to ensure intermediate provider involvement in the system.472 We agree with these assertions.

131. Additionally, we further adopt our proposal to require intermediate providers to pass the Identity header unaltered.473 We find that this requirement is necessary to prevent a downstream provider from tampering with the Identity header and thus undermining the end-to-end chain of trust between the originating and terminating voice service providers. Commenters support this approach,474 with NCTA stating that it is necessary to “maintain the integrity of the authentication information and reduce the potential for inadvertent error or intentional manipulation,”475 and Hiya noting that “having access to untampered identity headers will significantly aid analytics and, as a result, the detection of illegal robocalls.”476 This requirement ensures that all SIP calls benefit from STIR/SHAKEN, increasing the effectiveness of STIR/SHAKEN in combating illegally spoofed robocalls and fraudulent robocall schemes.477 And although entities acting as intermediate providers will face implementation costs in order to forward unaltered Identity headers, they will not face the recurring costs necessary to authenticate

and verify caller ID information.478 Moreover, we expect these one-time implementation costs to be far less than the benefits of this intermediate provider requirement because the inclusion of intermediate providers is important to achieving the benefits discussed in the First Caller ID Authentication Report and Order.479 Requiring intermediate providers to pass the Identity headers that they receive to the subsequent intermediate provider in the call path or the terminating voice service provider is crucial to ensuring end- to-end caller ID authentication and unlocking these benefits for consumers and providers alike.

132. The record convinces us, however, to modify our proposal to allow an intermediate provider to strip the Identity header in two narrow circumstances: (1) for technical reasons where necessary to complete the call, and (2) for security reasons where an intermediate provider reasonably believes the Identity header presents a threat to its network security. Several commenters explain that these are legitimate reasons why an intermediate provider might need to strip the Identity header.

133. In identifying the limited technical reasons an intermediate provider may need to strip the Identity header, the industry standards group ATIS explains that it may be necessary to strip an Identity header for call completion in cases such as Government Emergency Telecommunications Service (GETS) call processing;480 INCOMPAS identifies instances where the Identity header may be too large to successfully transit the network;481 and we recognize it may be necessary to strip the Identity header before exchanging a call with a non-IP provider or at a non-IP interconnection point. We emphasize that the technical necessity exception is narrow and limited to circumstances that are necessary to complete the call. The technical necessity exception does not extend to failures or inadequacies in an intermediate provider’s network. As the technology supporting STIR/SHAKEN advances and improves, it may be possible to transmit headers in circumstances where it previously was not. As such, we will continue to monitor the use of this exception and adjust its outer limits as needed. Commission staff will not hesitate to refer reports of intermediate providers abuse of this exception to the Enforcement Bureau.

134. Regarding the security exception, Verizon advocates that we allow intermediate providers to act should Identity headers become “an attack vector used by bad actors.”482 We agree and so do not prohibit an intermediate provider from stripping the Identity header when it reasonably believes the header presents an imminent threat to its network security. We do not, however, permit an intermediate provider to strip the header if it believes the Identity header has been tampered with or is fraudulent short of presenting an imminent security threat.483 This narrow exception does not empower the intermediate provider to make determinations on behalf of other providers in the call path or to

interfere with the verification process defined in the SHAKEN standards.484 Instead, our goal is to permit an intermediate provider to act in the face of an imminent security threat to its network. We emphasize that intermediate providers must employ this exception sparingly, and the exception will not apply where an intermediate provider strips Identity headers routinely instead of maintaining reasonable network security. Furthermore, since no commenter identified a circumstance where an intermediate provider would need to alter the Identity header, we specify that intermediate providers may not alter Identity headers under any circumstance.

135. Relatedly, we prohibit an originating voice service provider from sending excessively large headers with the goal of evading STIR/SHAKEN compliance by forcing an intermediate provider to strip the header before exchanging the call with a subsequent downstream provider. We would consider such conduct a violation of our rule requiring an originating voice service provider to authenticate caller ID information for calls it originates and exchanges with another voice service provider or intermediate provider.485

136. ACA Connects proposes that we prohibit intermediate providers from passing a call they have received in SIP to a downstream provider in TDM when there is a downstream IP option available.486 We decline to adopt this proposal because, at this early stage, we do not wish to interfere with call routing decisions for the sake of promoting STIR/SHAKEN. Providers must consider a variety of factors when routing calls, including cost and reliability, and we do not believe at this stage that preserving STIR/SHAKEN headers should swamp all other considerations. For the same reason, we decline to adopt USTelecom’s suggestion to require gateway providers to pass international traffic only to downstream providers that have implemented STIR/SHAKEN.487 Finally, while we do not require intermediate providers to append duplicative Identity headers to calls that they transit,488 we decline to prohibit this practice at this stage of STIR/SHAKEN deployment across the voice network.489 AT&T contends that, if intermediate providers append duplicative Identity headers, it would add additional complexity and consume bandwidth for other providers.490 However, this issue received little attention in the record and, at this time, we have no reason to think it is a practice industry will adopt widely. We decline to be overly prescriptive at this early stage of deployment, and we will monitor this issue for any problems that develop.

2. Unauthenticated Calls

137. We also adopt a modified version of the proposed authentication requirement on intermediate providers for unauthenticated calls. Specifically, we require that an intermediate provider authenticate the caller ID information of a call that it receives with unauthenticated caller ID information that it will exchange with another intermediate provider or terminating voice service provider as a SIP call. However, a provider is relieved of this obligation if it (i) cooperatively participates with the industry traceback consortium and (ii) responds to all traceback requests it receives from the Commission, law enforcement, or the industry traceback consortium regarding calls for which it acts as an intermediate

provider.491 Our final requirement differs from our proposed requirement in two ways. First, we do not require an intermediate provider to authenticate with a C-level or gateway attestation. Instead, if a provider chooses to authenticate the caller ID information of an unauthenticated call that it receives, we require only that a provider authenticate the caller ID information consistent with industry standards. And second, our modified requirement allows participation with the industry traceback consortium as an alternative option for compliance.

138. In the First Caller ID Authentication Report and Order and Further Notice, we proposed requiring intermediate providers to authenticate caller ID information for unauthenticated traffic that they receive with a C-level attestation, and tentatively concluded this requirement would improve traceback efforts and analytics. Some commenters—including major voice service providers that have reported substantial progress in STIR/SHAKEN implementation—endorse our reasoning that such a rule is in compliance with the industry standards,492 would enhance traceback capabilities,493 and would benefit call analytics.494 Neustar argues that intermediate providers should authenticate caller ID information for calls that they transmit that lack such information because “it allows the terminating voice service provider to more easily traceback otherwise unauthenticated calls, and provides additional information that can be used to facilitate innovation in the robocall analytics space.”495 And T-Mobile explains that intermediate provider authentication would be useful to terminating voice service providers because “[h]aving some information regarding this large subset of calls to enable traceback and strengthen analytics is preferable to having no information on which to make blocking and labeling decisions.”496

139. We modify our proposal to require attestation consistent with industry standards rather than specifically requiring C-level attestation because this approach better aligns with our goal of promoting implementation of the industry-defined caller ID authentication standards rather than interfering with their technical application. This modification brings our intermediate provider rules in line with the STIR/SHAKEN obligations we imposed on originating and terminating voice service providers. In the First Caller ID Authentication Report and Order and Further Notice, we explained that for compliance with our rules it would be sufficient to adhere to the three standards that comprise the foundation of the STIR/SHAKEN framework—ATIS-1000074, ATIS-1000080, and ATIS-1000084—and all documents referenced therein.497 Recognizing that industry standards are not static, we framed the most recent versions of these standards as the baseline requirements for compliance.498 We follow that approach here and establish that compliance with the most current version of these three standards as of September

30, 2020, including any errata as of that date or earlier, represents the minimum requirement for intermediate providers to satisfy our rules. We encourage innovation and improvement to the STIR/SHAKEN framework, so long as any changes or additions do not compromise the baseline call authentication functionality envisioned by ATIS-1000074, ATIS-1000080, and ATIS-1000084.499

140. Beyond harmonizing our requirements on intermediate providers and originating and terminating voice service providers, this modification responds to record interest in allowing, where possible, intermediate providers to authenticate caller ID information with a higher level of attestation than a C-level attestation.500 It is not our intent to preclude or interfere with efforts to accommodate this interest; only to ensure the caller ID information for such calls be authenticated. To that end, we agree with commenters that argue we should not require intermediate providers to authenticate calls with a specific level of attestation,501 and require instead that intermediate providers authenticate the caller ID information for unauthenticated calls consistent with industry standards as described above. This clarification allows for and encourages industry progress, and we look forward to seeing progress on the numerous proposals in the record to allow for more robust authentication of such calls.502

141. Although we establish this requirement, in response to arguments that our proposal was unduly burdensome in some cases,503 we allow for an intermediate provider to register and participate with the industry traceback consortium as an alternative means of complying with our rules. Several commenters claim that a requirement for intermediate providers to authenticate the caller ID information of all unauthenticated calls that they receive would cause bandwidth problems within provider networks.504 Several commenters also express concern that an attestation requirement would undermine the efficacy of STIR/SHAKEN by “pollut[ing] the ecosystem” with “billions of useless attestations,”

causing customer harm and confusion.505 Further, some commenters contend that such a requirement would not lead to the benefits that we proposed would accrue.506 Other commenters in the record push back on these concerns,507 and because of the potential value of more ubiquitous authentication, we do not find that these concerns justify the elimination of this requirement entirely. We find that attestation of previously unauthenticated calls will provide significant benefits in facilitating analytics, blocking, and traceback by offering all parties in the call ecosystem more information, and we thus allow attestation of unauthenticated calls as one method for compliance. This conclusion is consistent with our analysis in the First Caller ID Authentication Report and Order, where we found that the benefits of requiring providers to authenticate calls will substantially outweigh the costs.508

142. While we make this conclusion, we acknowledge record concerns about the cost of requiring intermediate provider authentication and thus offer an alternative method of compliance that we anticipate will be less burdensome and will nonetheless facilitate traceback of calls. Specifically, establish that an entity acting as an intermediate provider is relieved of the requirement to authenticate the caller ID information of unauthenticated calls it receives if it (i) cooperatively participates with the industry traceback consortium, and (ii) responds to all traceback requests it receives from the Commission, law enforcement, or the industry traceback consortium for calls for which it acts as an intermediate provider.509

143. Providing this option addresses intermediate provider concerns over the burden that an authentication requirement would place on their networks. It further allows for continued evaluation of the role intermediate providers play in authenticating the caller ID information of the unauthenticated calls that they receive amid the continued deployment of the STIR/SHAKEN framework. By ensuring that all calls which transit the voice network either receive some form of attestation or are carried by an intermediate provider that is registered with the industry traceback consortium, terminating voice service providers will have more data about a call that can be used to support traceback efforts and call analytics, and prevent future illegal robocalls—further increasing the net benefits offered by STIR/SHAKEN. Additionally, providing this option for intermediate providers aligns with the robocall mitigation requirements we adopt today. By requiring intermediate providers and many originating voice service providers to engage in practices that promote traceback, we will ensure broad participation through the entire call path to determine the source of illegal robocalls. Although the obligation to either authenticate or participate in the industry traceback consortium with respect to unauthenticated calls will place costs on intermediate providers, we have no reason to believe that our additional mandate will fundamentally

disturb our cost-benefit calculus for STIR/SHAKEN implementation.510

144. We find it unnecessary to adopt CTIA’s suggestion to require intermediate providers serving as international gateways to register with the Commission.511 Under the rules we adopt, such providers are required either to authenticate the caller ID information of the foreign-originated calls that they receive and will transit on their networks or to register with the industry traceback consortium and participate in traceback efforts. Both options we adopt address call tracing more directly than a mere registration requirement, and we are reluctant to create multiple overlapping registration requirements for providers that choose the latter option. We can revisit CTIA’s suggestion should the measures we adopt prove insufficient.

3. Limiting Intermediate Provider Requirements to IP Networks

145. In the First Caller ID Authentication Report and Order and Further Notice, we proposed limiting our caller ID authentication obligations on intermediate providers to IP calls.512 We adopt our proposal with modifications. First, we adopt this proposal for calls with authenticated caller ID information that an intermediate provider receives. In so doing, we limit the requirement that intermediate providers pass any received Identity header unaltered to IP calls, that is, calls that the intermediate provider receives in SIP and exchanges with a terminating provider or another intermediate provider in SIP. Commenters support limiting our rule to IP calls,513 and doing so harmonizes our rules for intermediate providers with our rules applying to originating and terminating voice service providers.514

146. Second, we modify this proposal for calls with unauthenticated caller ID information that an intermediate provider receives. To the extent that an intermediate provider chooses to comply with the rules we adopt today by authenticating the caller ID information of the unauthenticated calls that it receives, as Comcast suggests,515 we clarify that this requirement applies to all unauthenticated calls an intermediate provider receives that it will exchange with a subsequent provider in SIP, regardless of whether the intermediate provider receives the call in SIP. In other words, if the intermediate provider chooses to authenticate the caller ID information of unauthenticated calls, the obligation applies if the intermediate provider transmits the call downstream in SIP. We make this modification in recognition of the fact that calls without authenticated caller ID information may have originated on non-IP networks or have been exchanged at non-IP interconnection points and thus do not have an existing Identity header. In those instances, the obligation to authenticate the caller ID information according to industry standards applies whether or not the call was received by the intermediate provider in SIP.

147. We decline to adopt Comcast’s proposal that intermediate providers exchanging traffic in TDM install TDM-to-VoIP gateways.516 At this time, we believe that such a requirement would be

unduly burdensome.517 Furthermore, it would go beyond both Congress’s and our approach to addressing the issues around non-IP technology and caller ID authentication, which aim to strike a balance between encouraging the IP transition and the development of non-IP solutions for the benefit of those networks that cannot be speedily or easily transitioned. We will continue to monitor the development of technical solutions to the issue of TDM exchange and are prepared to return to this proposal if circumstances warrant.

4. Definition of Intermediate Provider

148. We adopt our proposal from the First Caller ID Authentication Report and Order and Further Notice to use the definition of “intermediate provider” found in section 64.1600(i) of our rules.518 This section provides that an “intermediate provider” is “any entity that carries or processes traffic that traverses or will traverse the [PSTN] at any point insofar as that entity neither originates nor terminates that traffic.”519 We further determine that as with our interpretation of “providers of voice service,” we assess the definition of “intermediate provider” on a call-by-call basis for the purpose of our call authentication rules. A single entity therefore may act as a voice service provider for some calls on its network and an intermediate provider for others. Intermediate providers play a critical role in ensuring end-to-end call authentication. We believe that this broad definition will best promote the widespread deployment of the STIR/SHAKEN framework that is necessary to benefit consumers.

149. We sought comment in the First Caller ID Authentication Report and Order and Further Notice on whether we should use a narrower definition of intermediate provider, such as the one we use in the context of rural call completion.520 One commenter advocates for a narrower definition that would “not include in its scope an ISP that is only incidentally transmitting voice traffic,” because this “could place a substantial burden on small, rural ISPs transmitting Non-Interconnected VoIP or Interconnected VoIP via a third-party service provider they have no relationship with.”521 As we explained in the First Caller ID Authentication Report and Order and Further Notice, the STIR/SHAKEN framework relies on the transmission of information in the Identity header of a SIP INVITE.522 We understand that there are circumstances where a call set up using SIP signaling will then use other paths to exchange the media packets containing voice data.523 Because we have limited our rules to the exchanging of SIP calls, to the extent that an ISP is only transmitting voice traffic of a call that does not involve the exchange of a SIP INVITE, we believe it is already excluded from our rules.

5. Legal Authority

150. We find that we have the authority to place caller ID authentication obligations on intermediate providers and alternatively to require that they register and participate with the industry traceback consortium under section 251(e) of the Act. In the First Caller ID Authentication Report and Order, we concluded that our exclusive jurisdiction over numbering policy provides authority to require voice service providers to implement STIR/SHAKEN in order to prevent the fraudulent abuse of NANP resources.524 In the Further Notice, we proposed that this same analysis provides the Commission

authority to impose STIR/SHAKEN implementation requirements on intermediate providers.525 Several commenters support this view.526 Calls that transit the networks of intermediate providers with illegally spoofed caller ID are exploiting numbering resources in the same manner as spoofed calls on the networks of originating and terminating providers, and so we find authority under section 251(e).

Consistent with the First Caller ID Authentication Report and Order and Further Notice,527 we adopt our proposal concluding that the section 251(e)(2) requirements do not apply in the context of our establishing STIR/SHAKEN requirements.528

151. We find additional, independent authority under the Truth in Caller ID Act. The Truth in Caller ID Act charged the Commission with prescribing rules to make unlawful the spoofing of caller ID information “in connection with any voice service or text messaging service . . . with the intent to defraud, cause harm, or wrongfully obtain anything of value.”529 We agree with T-Mobile that this provides us with authority to mandate that intermediate providers adopt “a framework that will minimize the frequency with which illegally spoofed scam calls will reach consumers.”530 We found authority in the First Caller ID Authentication Report and Order for our STIR/SHAKEN implementation mandate on originating and terminating voice service providers under the Truth in Caller ID Act.531 We explained that “the rules we adopt today are necessary to enable voice service providers to help prevent these unlawful acts and to protect voice service subscribers from scammers and bad actors.”532 That same analysis applies to intermediate providers that, as noted, play an integral role in the success of STIR/SHAKEN across the voice network.

152. Verizon, the only commenter to challenge our legal authority, argues that we lack authority under either section 251(e) or the Truth in Caller ID Act to require an intermediate provider to authenticate with a C-level attestation the caller ID information for unauthenticated calls it receives.533 It asserts that “‘C’ attestations do not attest to the accuracy of numbers and indeed have nothing to do with numbering resources,” and consequently that section 251(e) does not provide us with authority; it further argues that “‘C’ attestations have nothing to do with the spoofing problem” and so could not be required under the Truth in Caller ID Act.534 As an initial matter, Verizon’s objections are less pressing because of the modifications we made to our final rule—requiring only authentication consistent with industry standards or registration and participation with the industry traceback consortium. Furthermore, we do not agree that C-level attestations “have nothing to do with” numbering resources or spoofing. The STIR/SHAKEN standards expressly include the option of C-level attestation, and we think it apparent

that this component of “a technology specifically designed to counteract misuse of numbering resources” through spoofing relates both to our authority under section 251(e) 535 and the Truth in Caller ID Act.

When bad actors unlawfully falsify or spoof the caller ID that appears on a subscriber’s phone, they are using numbering resources to advance an illegal scheme. Mandating that intermediate providers authenticate unauthenticated calls or participate in traceback efforts will help to prevent and remediate the fraudulent exploitation of NANP resources and illegal spoofing of caller ID information.

G. Other Issues

153. No Additional Exceptions from Originating Voice Service Provider Caller ID Authentication Mandate. We reject the record requests to grant limited exceptions from our caller ID authentication rules.536 Verizon argues that we should free a voice service provider from our caller ID authentication rules in certain circumstances where, in its view, it would be “inadvisable or inappropriate for the originating carrier to place a signature on a call.”537 Verizon, USTelecom, and CTIA argue that these circumstances include “periods of substantial network congestion,” such as national emergencies or natural disasters, or during periods of network maintenance.538 Verizon further argues that a voice service provider should not be required to authenticate caller ID information in certain complicated calling cases.539 We decline to grant these categorical exceptions from our mandate. Our goal is ubiquitous deployment of caller ID authentication technology, and no commenter explains with specificity why its concerns outweigh that goal. To the contrary, national emergencies and natural disasters are among the times when caller ID authentication is most important.540 In those instances, affected individuals must be able to rely on the caller ID information they receive and avoid bad actors taking advantage of an ongoing emergency or its aftermath. And while we do not grant an exception for complicated calling cases, we underscore that, to the extent a certain calling case is not accounted for by industry standards, application of caller ID authentication is not called for by our rules. We explained in the First Caller ID Authentication Report and Order that “[c]ompliance with the most current versions of . . . three standards as of March 31, 2020, including any errata as of that date or earlier, represents the minimum requirement to satisfy our rules.”541

154. Non-Substantive Rule Revision. We revise section 64.6301(a)(2) of our rules542 to make two non-substantive changes. First, the adopted rule inadvertently omitted the word “it.” Second, the

adopted rule referred to “caller ID authentication information,” inconsistent with other terms in the rules. The rule as revised provides that a voice service provider shall “authenticate caller identification information for all SIP calls it originates and that it will exchange with another voice service provider or intermediate provider and, to the extent technically feasible, transmit that call with authenticated caller identification information to the next voice service provider or intermediate provider in the call path.”543 We make these revisions without seeking notice and comment pursuant to section 553(b)(3)(B) of the Administrative Procedure Act, which states that an agency for good cause may dispense with rulemaking if it finds that notice and comment are “impracticable, unnecessary, or contrary to the public interest.”544 Here, notice and comment are unnecessary because correcting the rule does not have a detrimental effect on the parties regulated by rule and does not alter the regulatory framework established by the First Caller ID Authentication Report and Order.

IV. PROCEDURAL MATTERS

155. Final Regulatory Flexibility Analysis. As required by the Regulatory Flexibility Act of 1980 (RFA),545 an Initial Regulatory Flexibility Analysis (IRFA) was incorporated into the First Caller ID Authentication Report and Order and Further Notice.546 The Commission sought written public comment on the possible significant economic impact on small entities regarding the proposals addressed in the First Caller ID Authentication Report and Order and Further Notice, including comments on the IRFA.547 Pursuant to the RFA, a Final Regulatory Flexibility Analysis is set forth in Appendix B. The Commission’s Consumer and Governmental Affairs Bureau, Reference Information Center, will send a copy of this Second Report and Order, including the FRFA, to the Chief Counsel for Advocacy of the Small Business Administration (SBA).548

156. Paperwork Reduction Act. This document contains new or modified information collection requirements subject to the Paperwork Reduction Act of 1995 (PRA), Public Law 104-13. It will be submitted to the Office of Management and Budget (OMB) for review under Section 3507(d) of the PRA. OMB, the general public, and other Federal agencies are invited to comment on the new or modified information collection requirements contained in this proceeding. In addition, we note that pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198, we previously sought comment on how the Commission might further reduce the information collection burden for small business concerns with fewer than 25 employees.549

157. Congressional Review Act. The Commission has determined, and the Administrator of the Office of Information and Regulatory Affairs, Office of Management and Budget, concurs that this rule is “non-major” under the Congressional Review Act, 5 U.S.C. § 804(2). The Commission will send a copy of this Second Report and Order to Congress and the Government Accountability Office pursuant to 5 U.S.C. § 801(a)(1)(A).

158. Contact person. For further information about this proceeding, please contact

Mason Shefa, FCC Wireline Competition Bureau, Competition Policy Division, 445 12th Street, S.W., Washington, D.C., 20554, at (202) 418-2962, or mason.shefa@fcc.gov.

V. ORDERING CLAUSES

159. Accordingly, IT IS ORDERED, pursuant to sections 4(i), 4(j), 227(e), 227b, 251(e), and 303(r), of the Communications Act of 1934, as amended (the Act), 47 U.S.C. §§ 154(i), 154(j), 227(e), 227b, 251(e), and 303(r), that this Second Report and Order IS ADOPTED.

160. IT IS FURTHER ORDERED that Part 64 of the Commission’s rules IS AMENDED as set forth in Appendix A, and that any such rule amendments that contain new or modified information collection requirements that require approval by the Office of Management and Budget under the Paperwork Reduction Act SHALL BE EFFECTIVE after announcement in the Federal Register of Office of Management and Budget approval of the rules, and on the effective date announced therein.

161. IT IS FURTHER ORDERED that, pursuant to sections 1.4(b)(1) and 1.103(a) of the Commission’s rules, 47 CFR §§ 1.4(b)(1), 1.103(a), this Second Report and Order SHALL BE EFFECTIVE 30 days after publication in the Federal Register, except for the addition of sections 64.6303(b), 64.6305(b), and 64.6306 to the Commission’s rules that have not been approved by OMB. The Federal Communications Commission will publish documents in the Federal Register announcing the effective dates of these provisions.

162. IT IS FURTHER ORDERED that the Commission SHALL SEND a copy of this Report and Order to Congress and to the Government Accountability Office pursuant to the Congressional Review Act, see 5 U.S.C. § 801(a)(1)(A).

163. IT IS FURTHER ORDERED that the Commission’s Consumer and Governmental Affairs Bureau, Reference Information Center, SHALL SEND a copy of this Second Report and Order, including the Final Regulatory Flexibility Analysis (FRFA), to the Chief Counsel for Advocacy of the Small Business Administration.

FEDERAL COMMUNICATIONS COMMISSION

Marlene H. Dortch Secretary

APPENDIX A

Final Rules

The Federal Communications Commission amends part 64 of Title 47 of the Code of Federal Regulations as follows:

PART 64 – MISCELLANEOUS RULES RELATING TO COMMON CARRIERS

* * * * *

1. Amend section 64.6300 by redesignating paragraphs (e) through (g) as paragraphs (j) through

(l) and paragraphs (c) and (d) as paragraphs (f) and (h), respectively, and adding new paragraphs (c) through (e), (g), and (i) to read as follows:”

§ 64.6300 Definitions

* * * * *

(c) Foreign voice service provider. The term “foreign voice service provider” refers to any entity providing voice service outside the United States that has the ability to originate voice service that terminates in a point outside that foreign country or terminate voice service that originates from points outside that foreign country.

(d) Governance Authority. The term “Governance Authority” refers to the Secure Telephone Identity Governance Authority, the entity that establishes and governs the policies regarding the issuance, management, and revocation of Service Provider Code (SPC) tokens to intermediate providers and voice service providers.

(e) Industry traceback consortium. The term “industry traceback consortium” refers to the consortium that conducts private-led efforts to trace back the origin of suspected unlawful robocalls as selected by the Commission pursuant to 47 CFR 64.1203.

* * * * *

(g) Robocall Mitigation Database. The term “Robocall Mitigation Database” refers to a database accessible via the Commission’s website that lists all entities that make filings pursuant to 47 CFR 64.6305(b).

* * * * *

(i) SPC token. The term “SPC token” refers to the Service Provider Code token, an authority token validly issued to an intermediate provider or voice service provider that allows the provider to authenticate and verify caller identification information consistent with the STIR/SHAKEN authentication framework in the United States.

* * * * *

2. Amend section 64.6301 by revising paragraph (a) to read as follows:

§ 64.6301 Caller ID authentication.

(a) STIR/SHAKEN implementation by voice service providers. Except as provided in 47 CFR 64.6304 and 64.6306, not later than June 30, 2021, a voice service provider shall fully implement the STIR/SHAKEN authentication framework in its Internet Protocol networks. To fulfill this obligation, a voice service provider shall:

* * * * *

(2) authenticate caller identification information for all SIP calls it originates and that it will exchange with another voice service provider or intermediate provider and, to the extent technically feasible, transmit that call with authenticated caller identification information to the next voice service provider or intermediate provider in the call path; and

* * * * *

3. Amend Subpart HH by adding sections 64.6302 to 64.6307 to read as follows:

§ 64.6302 Caller ID authentication by intermediate providers.

Not later than June 30, 2021, each intermediate provider shall fully implement the STIR/SHAKEN authentication framework in its Internet Protocol networks. To fulfill this obligation, an intermediate provider shall:

(a) pass unaltered to the subsequent intermediate provider or voice service provider in the call path any authenticated caller identification information it receives with a SIP call, subject to the following exceptions under which it may remove the authenticated caller identification information:

(1) where necessary for technical reasons to complete the call; or

(2) where the intermediate provider reasonably believes the caller identification authentication information presents an imminent threat to its network security; and

(b) authenticate caller identification information for all calls it receives for which the caller identification information has not been authenticated and which it will exchange with another provider as a SIP call, except that the intermediate provider is excused from such duty to authenticate if it:

(1) cooperatively participates with the industry traceback consortium; and

(2) responds fully and in a timely manner to all traceback requests it receives from the Commission, law enforcement, and the industry traceback consortium regarding calls for which it acts as an intermediate provider.

§ 64.6303 Caller ID authentication in non-IP networks.

Except as provided in 47 CFR 64.6304 and 64.6306, not later than June 30, 2021, a voice service provider shall either:

(a) upgrade its entire network to allow for the initiation, maintenance, and termination of SIP calls and fully implement the STIR/SHAKEN framework as required in 47 CFR 64.6301 throughout its network; or

(b) maintain and be ready to provide the Commission on request with documented proof that it is participating, either on its own or through a representative, including third party representatives, as a member of a working group, industry standards group, or consortium that is working to develop a non- Internet Protocol caller identification authentication solution, or actively testing such a solution.

§ 64.6304 Extension of implementation deadline.

(a) Small voice service providers.

(1) Small voice service providers are exempt from the requirements of 47 CFR 64.6301 through June 30, 2023.

(2) For purposes of this paragraph (a), “small voice service provider” means a provider that has 100,000 or fewer voice service subscriber lines (counting the total of all business and residential fixed subscriber lines and mobile phones and aggregated over all of the provider’s affiliates).

(b) Voice service providers that cannot obtain a SPC token. Voice service providers that are incapable of obtaining a SPC token due to Governance Authority policy are exempt from the requirements of 47

CFR 64.6301 until they are capable of obtaining a SPC token.

(c) Services scheduled for section 214 discontinuance. Services which are subject to a pending application for permanent discontinuance of service filed as of June 30, 2021, pursuant to the processes established in 47 CFR 63.60 through 63.100, as applicable, are exempt from the requirements of 47 CFR 64.6301 through June 30, 2022.

(d) Non-IP networks. Those portions of a voice service provider’s network that rely on technology that cannot initiate, maintain, and terminate SIP calls are deemed subject to a continuing extension. A voice service provider subject to the foregoing extension shall comply with the requirements of 47 CFR 64.6303 as to the portion of its network subject to the extension.

(e) Provider-specific extensions. The Wireline Competition Bureau may extend the deadline for compliance with 47 CFR 64.6301 for voice service providers that file individual petitions for extensions by November 20, 2020. The Bureau shall seek comment on any such petitions and issue an order determining whether to grant the voice service provider an extension no later than March 30, 2021.

(f) Annual reevaluation of granted extensions. The Wireline Competition Bureau shall, in conjunction with an assessment of burdens and barriers to implementation of caller identification authentication technology, annually review the scope of all previously granted extensions and, after issuing a Public Notice seeking comment, may extend or decline to extend each such extension, and may decrease the scope of entities subject to a further extension.

§ 64.6305 Robocall mitigation and certification.

(a) Robocall mitigation program requirements.

(1) Any voice service provider subject to an extension granted under 47 CFR 64.6304 that has not fully implemented the STIR/SHAKEN authentication framework on its entire network shall implement an appropriate robocall mitigation program as to those portions of its network on which it has not implemented the STIR/SHAKEN authentication framework.

(2) Any robocall mitigation program implemented pursuant to paragraph (a)(1) of this section shall include reasonable steps to avoid originating illegal robocall traffic and shall include a commitment to respond fully and in a timely manner to all traceback requests from the Commission, law enforcement, and the industry traceback consortium, and to cooperate with such entities in investigating and stopping any illegal robocallers that use its service to originate calls.

(b) Certification and database.

(1) Not later than the date established in a document released by the Wireline Competition Bureau establishing the Robocall Mitigation Database and portal (amending this paragraph (b)), a voice service provider, regardless of whether it is subject to an extension granted under 47 CFR 64.6304, shall certify to one of the following:

(i) it has fully implemented the STIR/SHAKEN authentication framework across its entire network and all calls it originates are compliant with 47 CFR 64.6301(a)(1)-(2);

(ii) it has implemented the STIR/SHAKEN authentication framework on a portion of its network and calls it originates on that portion of its network are compliant with paragraphs 47 CFR 64.6301 (a)(1)-(2), and the remainder of the calls that originate on its network are subject to a robocall mitigation program consistent with paragraph (a); or

(iii) it has not implemented the STIR/SHAKEN authentication framework on any portion of its network, and all of the calls that originate on its network are subject to a robocall mitigation program consistent with paragraph (a).

(2) A voice service provider that certifies that some or all of the calls that originate on its network are subject to a robocall mitigation program consistent with paragraph (a) shall include the following information in its certification:

(i) identification of the type of extension or extensions the voice service provider received under 47 CFR 64.6304, if the voice service provider is not a foreign voice service provider;

(ii) the specific reasonable steps the voice service provider has taken to avoid originating illegal robocall traffic as part of its robocall mitigation program; and

(iii) a statement of the voice service provider’s commitment to respond fully and in a timely manner to all traceback requests from the Commission, law enforcement, and the industry traceback consortium, and to cooperate with such entities in investigating and stopping any illegal robocallers that use its service to originate calls.

(3) All certifications made pursuant to paragraph (b)(1)-(2) shall:

(i) be filed in the appropriate portal on the Commission’s website; and

(ii) be signed by an officer in conformity with 47 CFR 1.16.

(4) A voice service provider filing a certification shall submit the following information in the appropriate portal on the Commission’s website.

(i) the voice service provider’s business name(s) and primary address;

(ii) other business names in use by the voice service provider;

(iii) all business names previously used by the voice service provider;

(iv) whether the voice service provider is a foreign voice service provider; and

(v) the name, title, department, business address, telephone number, and email address of one person within the company responsible for addressing robocall mitigation-related issues.

(5) A voice service provider shall update its filings within 10 business days of any change to the information it must provide pursuant to paragraphs (b)(2)-(4) of this section.

(c) Intermediate provider and voice service provider obligations. Beginning ninety days after the deadline for certifications filed pursuant to paragraph (b) of this section, intermediate providers and voice service providers shall only accept calls directly from a voice service provider, including a foreign voice service provider that uses North American Numbering Plan resources that pertain to the United States to send voice traffic to residential or business subscribers in the United States, if that voice service provider’s filing appears in the Robocall Mitigation Database in accordance with paragraph (b) of this section.

§ 64.6306 Exemption.

(a) Exemption for IP networks. A voice service provider may seek an exemption from the requirements of 47 CFR 64.6301 by certifying on or before December 1, 2020, that, for those portions of its network served by technology that allows for the transmission of SIP calls, it:

(1) has adopted the STIR/SHAKEN authentication framework for calls on the Internet Protocol networks of the voice service provider, by completing the network preparations necessary to deploy the STIR/SHAKEN protocols on its network including but not limited to participation in test beds and lab testing, or completion of commensurate network adjustments to enable the authentication and validation of calls on its network consistent with the STIR/SHAKEN framework;

(2) has agreed voluntarily to participate with other voice service providers in the STIR/SHAKEN authentication framework, as demonstrated by completing formal registration (including payment) and testing with the STI Policy Administrator;

(3) has begun to implement the STIR/SHAKEN authentication framework by completing the necessary network upgrades to at least one network element—e.g., a single switch or session border controller—to enable the authentication and verification of caller identification information consistent with the STIR/SHAKEN standards; and

(4) will be capable of fully implementing the STIR/SHAKEN authentication framework not later than June 30, 2021, which it may only determine if it reasonably foresees that it will have completed all necessary network upgrades to its network infrastructure to enable the authentication and verification of caller identification information for all SIP calls exchanged with STIR/SHAKEN-enabled partners by June 30, 2021.

(b) Exemption for non-IP networks. A voice service provider may seek an exemption from the requirement to upgrade its network to allow for the initiation, maintenance, and termination of SIP calls and fully implement the STIR/SHAKEN framework as required by 47 CFR 64.6301 throughout its network by June 30, 2021, and from associated recordkeeping and reporting requirements, by certifying on or before December 1, 2020, that, for those portions of its network that do not allow for the transmission of SIP calls, it:

(1) has taken reasonable measures to implement an effective call authentication framework by either:

(i) upgrading its entire network to allow for the initiation, maintenance, and termination of SIP calls, and fully implementing the STIR/SHAKEN framework as required in 47 CFR 64.6301 throughout its network; or

(ii) maintaining and being ready to provide the Commission on request with documented proof that it is participating, either on its own or through a representative, including third party representatives, as a member of a working group, industry standards group, or consortium that is working to develop a non- Internet Protocol caller identification authentication solution, or actively testing such a solution; and

(2) will be capable of fully implementing an effective call authentication framework not later than June 30, 2021, because it reasonably foresees that it will have completed all necessary network upgrades to its network infrastructure to enable the authentication and verification of caller identification information for all non-Internet Protocol calls originating or terminating on its network as provided by a standardized caller identification authentication framework for non-Internet Protocol networks by June 30, 2021.

(c) Certification submission procedures. All certifications that a voice service provider is eligible for exemption shall be:

(1) filed in the Commission’s Electronic Comment Filing System (ECFS) in WC Docket No. 20-68, Exemption from Caller ID Authentication Requirements, no later than December 1, 2020;

(2) signed by an officer in conformity with 47 CFR 1.16; and

(3) accompanied by detailed support as to the assertions in the certification.

(d) Determination timing. The Wireline Competition Bureau shall determine whether to grant or deny timely requests for exemption on or before December 30, 2020.

(e) Implementation verification. All voice service providers granted an exemption under paragraphs (a) and (b) of this section shall file an additional certification consistent with the requirements of paragraph

(c) of this section above on or before a date specified in a document issued by the Wireline Competition Bureau (amending this paragraph (e)) that attests to whether the voice service provider fully implemented the STIR/SHAKEN authentication framework because it completed all necessary network upgrades to its network infrastructure to enable the authentication and verification of caller identification information for all SIP calls exchanged with STIR/SHAKEN-enabled partners by June 30, 2021. The Wireline Competition Bureau, after issuing a Public Notice seeking comment on the certifications, will, not later than four months after the deadline for filing of the certifications, issue a Public Notice identifying which voice service providers achieved complete implementation of the STIR/SHAKEN authentication framework.

(1) If a voice service provider cannot certify to full implementation upon the filing of this second certification, but demonstrates to the Wireline Competition Bureau that (1) it filed its initial certification in good faith—i.e., with a reasonable expectation that it would be able to achieve full implementation as initially certified—and (2) it made a good faith effort to complete implementation, the consequence for such a shortcoming is the loss of the exemption and the application of the implementation requirements of 47 CFR 64.6301 and 64.6303, effective immediately upon release by the Wireline Competition Bureau of the Public Notice identifying which voice service providers achieved full implementation of the STIR/SHAKEN authentication framework.

(2) If a voice service provider cannot certify to full implementation upon the filing of this second certification, and the Wireline Competition Bureau finds that the voice service provider filed its initial certification in bad faith or failed to make a good faith effort to

complete implementation, then (A) the voice service provider is required to fully implement the STIR/SHAKEN authentication framework immediately upon release by the Wireline Competition Bureau of the Public Notice identifying which voice service providers achieved full implementation of the STIR/SHAKEN authentication framework and (B) the Wireline Competition Bureau shall refer the voice service provider to the Enforcement Bureau for possible enforcement action based on filing a false initial certification.

§ 64.6307 Line item charges.

Providers of voice service are prohibited from adding any additional line item charges to consumer or small business customer subscribers for the effective call authentication technology required by 47 CFR 64.6301 and 64.6303.

(a) For purposes of this section, “consumer subscribers” means residential mass-market subscribers.

(b) For purposes of this section, “small business customer subscribers” means subscribers that are business entities that meet the size standards established in 13 CFR Part 121, subpart A.

Issues Largest Robocall Fine in FCC History, Demands Providers Cease-and-Desist

From Illegal Robocalls, Launches Robocall Response Team, Renews Federal-State

Collaboration

WASHINGTON, March 17, 2021—Today, FCC Acting Chairwoman Jessica Rosenworcel

announced her first set of anti-robocall actions during the March Open Meeting to kick off

efforts to combat unwanted robocalls.

These actions include issuing the largest robocall fine in FCC history, demanding certain voice

providers cease-and-desist from facilitating illegal robocalls, launching a Robocall Response

Team, and delivering letters to the Federal Trade Commission, Department of Justice, and the

National Association of State Attorneys General to renew state-federal partnerships to combat

the proliferation of illegal robocalls.

“Unwanted robocalls are not only a nuisance, but they also pose a serious risk to consumers

who can inadvertently share sensitive, personal information in response to bad actors’

malicious schemes. I’m proud to unveil my first set of actions to put a renewed focus on what

the FCC can do to combat the issue that we receive the most complaints about. I believe closer

coordination within the agency and between federal and state partners can help in addressing

this consumer epidemic. Also, today’s cease and desist letters should serve as a warning sign to

other entities that believe the FCC has turned a blind eye to this issue. We certainly haven’t and

we’re coming for you,” said Rosenworcel.

Specifically, Rosenworcel’s anti-robocall initiatives include:

The issuance of a $225 million fine to Texas telemarketers—the largest fine in FCC

history—for illegally spoofing approximately 1 billion robocalls to sell short-term, limitedduration

health insurance plans. The robocalls falsely claimed to offer health insurance plans

from well-known health insurance companies such as Aetna, Blue Cross Blue Shield, Cigna,

and UnitedHealth Group.

The delivery of cease-and-desist letters to six voice providers that have consistently violated

FCC guidelines on the use of autodialed and prerecorded voice message calls and in one case

had received prior agency warnings to stop carrying out suspected illegal robocall traffic

operations.

The recipients of the cease-and-desist letters include:

 RSCom, a Canada based company, continues to transmit robocalls despite having

received a warning on May 20, 2020 to cease carrying suspected illegal robocall traffic

immediately. Since the May 20, 2020 warning letter, RSCom has appeared in 112

tracebacks conducted by the Traceback Consortium. These traceback operations

involved COVID-19 scam calls, Social Security Administration and Internal Revenue

Service imposter scam calls, Apple imposter scam calls, electric utility disconnection

scam calls, and fraudulent sweepstakes winner calls.

 Stratics Networks, a Canada based company that transmits and originates robocall

traffic, has been found to help facilitate fraudulent calls related to COVID hardship

programs, student loan offers, political campaign calls, and discounts and upgrades for

services through AT&T and DirecTV.

 Yodel Technologies, a Florida based provider that transmits and originates robocalls,

claimed to obtain call recipients’ consent based on general consumer disclaimers on

websites advertising sweepstakes offers or insurance. Yodel has been found to

facilitate fraudulent calls related to Social Security Administration imposters, health

insurance calls, and debt reduction services for mortgages and credit cards.

 Icon Global, a U.K. based company that transmits and originates robocall traffic, has

been found to facilitate fraudulent calls inundating the D.C. metropolitan police

department with robocalls, Apple imposter calls, and Social Security Administration

imposter calls.

 IDT Corporation, a New Jersey based multinational provider, is believed to transmit

illegal robocall traffic on behalf of one or more of its clients. Those robocalls include:

COVID-19 fraudulent incentives and health insurance related calls; various Social

Security Administration Scams; fraudulent calls threatening to disconnect utilities

requesting payment; fictional refunds from Amazon and computer services providers

calls; and credit card fraud related calls. IDT failed to respond to several Industry

Traceback Group inquiries, including a recent September 2020 notice.

 Third Rock Telecom, a Canada based provider, is suspected to transmit illegal

robocall traffic on behalf of one or more of its clients. Those robocalls include fictional

Apple/iCloud account breach related calls; various Social Security Administration

Scams; credit card fraud; fraudulent business listing allegedly approved by Google;

and debt reduction offers under suspected fictional COVID-19 hardship programs.

The robocall cease-and-desist letters instruct the six identified voice providers to investigate

and, if necessary, cease transmitting the identified traffic immediately and take steps to prevent

their network from continuing to be a source of apparent illegal robocalls. Downstream voice

service providers will be authorized to block all voice provider traffic if the warned providers

do not take steps to effectively mitigate illegal traffic within 48 hours or if they fail to inform

the FCC and the Traceback Consortium within 14 days of these letters the steps they’ve taken

to implement effective measures to prevent customers from using your network to make illegal

calls. Failure to act within the deadline may result in the FCC issuing a notice to all U.S.-based

voice service providers that they may permanently block all call traffic transmitting from their

networks.

The launch of a Robocall Response Team, a group of 51 FCC staff members across six

bureaus and offices tasked with coordinating and implementing the agency’s anti-robocall

efforts. The Robocall Response Team will bring together Commission efforts to enforce the

law against providers of illegal robocalls, develop new policies to authenticate calls and trace

back illegal robocalls, and educate providers and other stakeholders about what they can do to

help.

The delivery of letters to the Federal Trade Commission, Department of Justice, and the

National Association of State Attorneys General seeking to renew partnerships to combat

robocalls. The letters highlight a renewed interest in coordination between the FCC and other

federal and state entities could ultimately benefit consumers and expresses Rosenworcel’s

commitment to fight robocall scams by leveraging the knowledge, skills, and jurisdictional

reach of cooperating organizations to share critical investigative information and collaborate on

cases.

###

The Federal Communications Commission’s (FCC) Acting Chairwoman Jessica Rosenworcel laid out a series of concrete agency actions to further combat robocalls as the last item on the Commission’s March 17, 2021 Open Meeting. https://docs.fcc.gov/public/attachments/DOC-370865A1.pdf

In doing so she noted that “unwanted robocalls are not only a nuisance, but they also pose a serious risk to consumers who can inadvertently share sensitive, personal information in response to bad actors’ malicious schemes. I’m proud to unveil my first set of actions to put a renewed focus on what the FCC can do to combat the issue that we receive the most complaints about.” (emphasis supplied). More to come?

The anti-robocall initiatives announced by Acting Chairwoman Rosenworcel include:

First, the Commission approved a $225 million forfeiture against Texas telemarketers for “illegally spoofing approximately 1 billion robocalls to sell short-term, limited duration health insurance plans. The robocalls falsely claimed to offer health insurance plans from well-known health insurance companies such as Aetna, Blue Cross Blue Shield, Cigna, and UnitedHealth Group.” The FCC had proposed such a fine last year.

Second, the Acting Chairwoman announced that the agency had delivered “cease-and-desist letters to six voice providers that have consistently violated FCC guidelines on the use of autodialed and prerecorded voice message calls…. [D]ownstream voice service providers will be authorized to block all voice provider traffic if the warned providers do not take steps to effectively mitigate illegal traffic within 48 hours or if they fail to inform the FCC and the Traceback Consortium within 14 days of these letters the steps they’ve taken to implement effective measures to prevent customers from using your network to make illegal calls.”

Third, the Acting Chairwoman announced launch of “a Robocall Response Team, [which is] a group of 51 FCC staff members across six bureaus and offices tasked with coordinating and implementing the agency’s anti-robocall efforts. The Robocall Response Team will bring together Commission efforts to enforce the law against providers of illegal robocalls, develop new policies to authenticate calls and trace back illegal robocalls, and educate providers and other stakeholders about what they can do to help.”

Finally, the Commission has sent letters to the Federal Trade Commission, Department of Justice and National Association of Attorneys General “seeking to renew partnerships to combat robocalls.” According to the announcement, “the letters highlight a renewed interest in coordination between the FCC and other federal and state entities could ultimately benefit consumers and expresses [the Acting Chairwoman’s] commitment to fight robocall scams by leveraging the knowledge, skills, and jurisdictional reach of cooperating organizations to share critical investigative information and collaborate on cases.”

Verizon says that it is exchanging more than 24 million calls daily with U.S. wireless carriers using STIR-SHAKEN, a standard designed to ensure that customers are not “spoofed.” So far, Verizon says that it has “protected” more than 75 million customers from more than 10 billion spam calls.

The goal of STIR-SHAKEN is to ensure that the ID shown on the receiver device’s Caller ID is the actual caller. Verizon said last December that it certified STIR-SHAKEN with the FCC and had implemented the technology.

A press release said that it now is using STIR-SHAKEN with about 80% of the U.S. wireless industry, including with “the no. 2 and no. 3 wireless carriers” – no doubt T-Mobile and AT&T. It also says it is working with “a major wireline provider.”

Verizon STIR-SHAKEN

“This latest STIR-SHAKEN milestone is a key part of our overall efforts to combat these unwanted calls,” Verizon Consumer Group EVP and CEO Ronan Dunne said in a press release about the Verizon STIR-SHAKEN implementation. “There is always more to be done, but this is yet another important step for the industry and customers should rest assured that we remain vigilant in our efforts to take down the bad guys and protect them.”

Verizon said that robocall traffic significantly increased since the COVID-19 pandemic lockdowns started. The carrier said it took steps that have reduced robocalls to Verizon by between 250 million and 500 million per month during 2021.

It did this by using USTelecom’s Industry Traceback Group to identify where robocalls originate and insisting that its wholesale customers do the same. The carrier also created and expanded honeypots, which are lines that identify and surveil robocall campaigns. The goal is to identify the source and alert law enforcement. Verizon now has more than 200,000 honeypots across its wireless and toll free numbers.

The FCC adopted rules requiring the use of STIR-SHAKEN on March 31, 2020. The deadline for implementation in the IP portions of carrier networks is June 30. However, several carriers—including Verizon—said that they planned to implement the rules early.

MARCH 31, 2021 -- Four voice service providers had requested deadline extensions for STIR-SHAKEN deployment. Two have been denied, and two have been withdrawn.

These deadline extension requests were filed in November 2020:

• AT&T had requested a one-year extension.
• They made a network routing adjustment in mid-2020 to address network congestion during the pandemic. This sent a small portion of their network traffic across a portion of the network that lacks STIR-SHAKEN capability.
• AT&T withdrew this request on March 29, 2021.
• Lumen had requested a six-month extension.
• Their software vendors frequently miss deadlines. Lumen thought they could make the deadline, but requested an extension in case they experienced further delays.
• Lumen withdrew this request on March 29, 2021.
• US Cellular had requested a “reasonable extension of time.”
• They are migrating CDMA customers to their VoLTE network and requested an extension until this migration is complete.
• Verizon had requested a declaratory ruling or limited extension.
• A portion of their network, which they call FTTP-SIP, uses fiber-to-the-premises and plain old telephone system (POTS) service.
• Verizon requested a declaratory ruling on whether the STIR-SHAKEN mandate applies to this portion of their network.
• If the FCC rules that the STIR-SHAKEN mandate applies, then Verizon requested a three-year extension.

FCC ruling

The Commission issued an order that denied the remaining petitions from US Cellular and Verizon.

In response to US Cellular, the Commission ruled that:

• US Cellular does not face undue hardship.
• The mandate does not require STIR-SHAKEN over non-IP interconnections.
• The mandate does not require providers to complete implementation of IP interconnections by the deadline.

In response to Verizon, the Commission ruled that:

• Verizon does not face undue hardship.
• While Verizon asserts that the upgrades would be costly, it does not claim that they may be prohibitively expensive as those the Commission found justified a class extension for small providers.
• Though Verizon describes this service as “end-of-life,” it is not analogous to section 214 discontinuance because Verizon describes no plan to imminently discontinue the service.

APRIL 1, 2021 -- The U.S. Supreme Court today issued a decision in the Facebook v. Duguid case. This decision resolves a longstanding legal dispute over whether courts should use either a narrow or a broad definition of “Automatic Telephone Dialing System” (ATDS) when interpreting the Telephone Consumer Protection Act of 1991 (TCPA).

The Supreme Court issued a unanimous decision in favor of Facebook, which argued that the narrow definition should be used.

This decision could open a flood of robocalls from high-volume callers. With this decision, they can easily evade the TCPA by using an ATDS that falls outside of the narrow definition.

We’ll summarize the background and decision here.

The TCPA

The TCPA includes a definition of an Automatic Telephone Dialing System (ATDS), or “autodialer:”

(1) The term ‘automatic telephone dialing system’ means equipment which has the capacity —
  (A) to store or produce telephone numbers to be called, using a random or sequential number generator; and
  (B) to dial such numbers.

Court cases

In court cases brought against high-volume callers using autodialers, defense attorneys have used a narrow definition of ATDS to argue that the TCPA does not apply to their clients because they were using an autodialer that falls outside of the TCPA definition.

From these cases, two different interpretations of this the ATDS definition have emerged from court decisions:

1. Broad. Neither a random number generator nor a sequential number generator is required. The autodialer merely has the capacity to store numbers to be called and dial them.
2. Narrow. The autodialer must have the capacity of using a random or sequential number generator to store or produce the numbers to be dialed.

Some court decisions have been handed down using the broad definition, while others have been decided using the narrow definition. Today’s decision in favor of Facebook settles the question in favor of the narrow definition.

Implications

Eric Troutman, an attorney with deep experience in TCPA law, has written that, if the Supreme Court finds in favor of the narrow definition of ATDS, which they now have done, then that will leave American cell phones open to a blitz of calls from so-called predictive dialers that do not meet the narrow ATDS definition.

Legislative response

Senator Ed Markey (D-Mass), one of the original authors of the TCPA, joined with Congresswoman Anna Eshoo (CA-18) to issue the following statement in response to the Supreme Court decision:

“Today, the Supreme Court tossed aside years of precedent, clear legislative history, and essential consumer protection to issue a ruling that is disastrous for everyone who has a mobile phone in the United States. It was clear when the TCPA was introduced that Congress wanted to ban dialing from a database. By narrowing the scope of the TCPA, the Court is allowing companies the ability to assault the public with a non-stop wave of unwanted calls and texts, around the clock.”
“Fortunately, we can and will act to make right what the Supreme Court got wrong. We plan to soon introduce legislation to amend the TCPA, fix the Court’s error, and protect consumers. If the Justices find their private mobile phones ringing non-stop from now until our legislation becomes law, they’ll only have themselves to blame.”

APRIL 7, 2021 - The CRTC has postponed the STIR-SHAKEN deadline in Canada. They issued a decision on 6 April 2021 in response to interventions filed by Canadian Telephone Service Providers (TSPs) and industry associations. Here’s an overview of their decision.

Previous decisions

The CRTC has previously mandated that Canadian TSPs must use STIR-SHAKEN with IP-based calls:

• CRTC 2018-32, issued 25 Jan 2018, was the initial requirement, with a deadline of 31 Mar 2019.
• CRTC 2019-402, issued 9 Dec 2019, pushed the deadline to 30 Sep 2020.
• CRTC 2019-403, also issued 9 Dec 2019, established the Canadian Secure Token Governance Authority (CSTGA).
• CRTC 2019-402-2, issued 15 Sep 2020, pushed the deadline back to 30 Jun 2020.

The new decision

In this decision, CRTC 2021-123, the CRTC addressed the following issues raised in the intervention filings:

Should the implementation of STIR-SHAKEN be imposed as a condition of offering and providing telecommunications services?The CRTC said yes, TSPs must implement STIR-SHAKEN in their IP-based networks as a condition of providing service. The benefits of providing call authentication to reduce the harm caused by nuisance calls outweighs the implementation burden.If STIR-SHAKEN implementation is required, when should the requirement become effective?The CRTC said some technical and policy issues have yet to be resolved. Therefore, they pushed back the following deadlines:

• TSPs are required to submit an Implementation Readiness Assessment Report by 31 Aug 2021.
• TSPs must implement STIR-SHAKEN by 30 Nov 2021.

TSPs must have access to numbering resources to receive a certificate to sign SHAKEN calls. Other TSPs, such as resellers, would be at a commercial disadvantage because their calls would be signed at a lower level of attestation. The CRTC was asked to address this issue.The CRTC said that a Part 1 application was filed on 21 Dec 2020 requesting the CRTC to instruct the CSTGA to allow all TSPs to receive certificates. The CRTC will address the certificate access issue in response to this application.

Implementation Readiness Assessment Report

In an appendix to their decision, the CRTC provided additional information about the Implementation Readiness Assessment Report, which is due 31 Aug 2021. A list of requirements is included in this expandable view:

• Implementation Readiness Assessment Report requirements

Ongoing status reports

TSPs must also provide a status report every six months on their continuing efforts to deploy STIR-SHAKEN.

• The May reports are due May 31 of each year, starting 31 May 2022. Each report covers the period from the first day of September to the last day of February.
• The November reports are due November 30, starting 30 Nov 2022. Each report covers the period from the first day of March to the last day of August.

Last month Federal Communications Commission (FCC) Acting Chairwoman Jessica Rosenworcel announced a multi-faceted agenda to combat unwanted robocalls

On April 13, 2021, the Acting Chairwoman fired a second salvo in the ongoing battle, announcing the agency’s “latest efforts to protect consumers from unwanted and scam robocalls and spoofed calls” https://docs.fcc.gov/public/attachments/DOC-371553A1.pdf. The latest efforts include the following three components:

• First – “In anticipation of the agency’s second Call Blocking Report, the FCC’s Consumer and Governmental Affairs Bureau issued a Public Notice and sent letters to major phone companies and third-party developers of call blocking tools to get updated information about their efforts to enable customers to block unwanted calls. The Bureau seeks to learn more about the tools available to consumers, their effectiveness, and any potential impact on 911 services and public safety.”
• Second – “The FCC also sent robocall cease-and-desist letters to two companies that appear to be transmitting multiple unlawful robocall campaigns that market auto warranties and credit card debt reduction service, or claim, falsely, to be from the Social Security Administration or other well-known companies.… Today’s letters follow a batch of six cease-and-desist letters sent by the agency last month.”
• Third – “[T]he agency launched a new effort to itemize the completion of the FCC’s work to protect consumers from illegal robocalls, using the tools Congress gave [the agency] in the TRACED Act. The new webpage outlines the agency’s progress in using its strengthened enforcement authority, progress on updated call blocking rules, and steps taken to implement new Caller ID authentication technology. It also details the agency’s work to address one-ring scams, protect hospitals from illegal robocalls, and establish a reassigned numbers database.”

APRIL 14, 2021 - The FCC issued cease-and-desist letters to two voice service providers. These letters instruct the providers to effectively mitigate illegal robocall traffic within 48 hours. If they do not, downstream voice service providers will be authorized to block all their traffic.

These letters were sent to the following carriers:

• R Squared Telecom
• Tellza

In the letters, the FCC also required these providers to inform the FCC and the Traceback Consortium within 14 days of the steps taken to implement effective measures to prevent customers from using the network to make illegal calls.

The FCC sent similar letters to six providers last month. Each provider responded by stating that they had stopped carrying the offending traffic. Each provider also explained how it will prevent customers from making illegal calls in the future.

APRIL 19, 2021 - USTelecom and several carrier representatives met with FCC officials to alert them to a potential loophole in the Commission’s Robocall Mitigation Database scheme. The loophole could enable foreign-originated illegal traffic to reach U.S. consumers without any meaningful constraints.

Robocall Mitigation Database

Paragraphs 82-86 of the FCC’s Second Report and Order In the Matter of Call Authentication Trust Anchor requires all voice service providers to file a robocall mitigation certification with the Commission. This will be filed in a new portal and database, called the Robocall Mitigation Database (RMD), which the FCC will provide.

Intermediate and terminating providers will be prohibited from accepting traffic directly from any voice service provider that does not appear in the database.

USTelecom describes the issue

In a recent ex parte filing, USTelecom described confusion over what they called the “Intermediate Provider Loophole.”

“In our experience, much of the industry has read section 64.6305(c) as requiring that every upstream provider—originating or intermediate—in the call path needs to be in the database for the next intermediate or terminating provider to accept traffic from it. The text of the rule and text in the order, however, may best be read to suggest otherwise, namely that only the originating provider needs to be in the database for the next provider to take the traffic.”

How did USTelecom arrive at this interpretation? They cited three sources in their filing:

The definition of “voice service” in paragraph 19 of the Second Order is “any service that is interconnected with the public switched telephone network and that furnishes voice communications to an end user.”

• Intermediate providers don’t provide service to end users.

Paragraph 89 of the Second Order says that “We find the rule we establish—whereby intermediate providers are prohibited from accepting traffic from an originating voice service provider that has not certified to a robocall mitigation program—best leverages the role of intermediate providers to combat illegal robocalls within our greater robocall mitigation scheme.”

• In this citation, the FCC clearly identifies originating service provider, not just the next upstream provider.

Paragraph 87 of the Second Order says that “By affirmatively adding such providers we give intermediate and terminating voice service providers confidence that any provider not listed in the Robocall Mitigation Database is out of compliance with our rules, rather than leaving the potential for uncertainty about whether a provider is noncompliant or simply was not required to be included in the database because it does not originate traffic.”

• This statement also states that traffic originators are required to be in the database.

Given those citations, USTelecom believes the Second Order requires that only the originating provider must have a certification on file in the RMD.

That would leave a huge loophole in the scheme. Intermediate providers could take traffic from any other intermediate provider regardless of their database status.

USTelecom asked the Commission to provide additional comment to clarify the rules.

Counterarguments

USTelecom presents a persuasive list of citations to support their interpretation. However, there are other citations that seem to go the other way:

In paragraph 87, the Second Order states that voice service providers “must necessarily review the listings of voice service providers with which they interconnect to ensure that such certifications are sufficient.”

• This seems to indicate that the certification applies to the next upstream provider, not the originating provider.

Footnote 340 of the Second Order says that the FCC “will import all listings from the Intermediate Provider Registry into the RMD on a rolling basis so that all registered intermediate providers are represented therein.”

• Why do that if the RMD filing requirements only apply to originating providers, not the next upstream provider?

These citations seem to indicate that the FCC intends to require RMD certification filings from the next upstream provider.

As a practical matter, this would also be easier in terms of compliance. Providers know who their upstream providers are. They can periodically check the RMD to confirm that their upstream providers have a certification on file. How would they check every possible foreign originating provider?

At any rate, we wholeheartedly agree with USTelecom that the Commission should clarify this rule.

APRIL 26, 2021 - The FCC has opened the portal to accept robocall mitigation certification filings from voice service providers. All providers that transmit calls with U.S. NANP calling numbers must have a registration on file by June 30, 2021.

Filing requirement

This filing requirement was included in the FCC’s Second Report and Order on call authentication, STIR/SHAKEN (WC 17-97), paragraphs 82–83.

We require all voice service providers to certify that their traffic is either “signed with STIR/SHAKEN or… subject to a robocall mitigation program” that includes “tak[ing] reasonable steps to avoid originating illegal robocall traffic,” and committing to cooperating with the Commission, law enforcement, and the industry traceback consortium in investigating and stopping any illegal robocallers that it learns are using its service to originate calls.
For those voice service providers that certify that some or all of their traffic is “subject to a robocall mitigation program,” we require such voice service providers to detail in their certifications the specific “reasonable steps” that they have taken “to avoid originating illegal robocall traffic…
Voice service providers must file certifications via a portal on the Commission’s website that we will establish for this purpose.

Filing process

The Robocall Mitigation Database (RMD) is available for public viewing. To submit a certification, you need an FCC Registration Number and must use it to log in.

All filers are required to provide the following information:

-Identification information for the voice service provider and point of contact

-The certification option that you are using. These options include:

1. Complete STIR/SHAKEN implementation
2. Partial STIR/SHAKEN implementation
3. No STIR/SHAKEN implementation

- Check the declaration and provide an officer’s e-signature.

Only one of these three certification options can be selected.

After answering these questions, providers that certify a complete STIR/SHAKEN implementation are done.

Providers that certify either a partial STIR/SHAKEN implementation or no STIR/SHAKEN implementation are also required to upload a document that explains the following:

-The specific reasonable steps the voice service provider has taken to avoid originating illegal robocall traffic as part of its robocall mitigation program

-The type(s) of extensions received under 47 CFR § 64.6304.

Filers may request that some information in their certification be withheld from public inspection. To do so, the filer must submit a confidentiality request in the FCC Electronic Comment Filing System (EFCS) and submit two versions of their certification, a redacted version for public viewing and a full version for the Commission.

https://fccprod.servicenowservices.com/rmd?id=rmd_welcome

Don't become the FCC's Poster Child for filing an inadequate, incomplete, non-substantive Robocall Mitigation Plan (RMP") and avoid making the mistakes many Companies appear to be making with their RMP submissions; RMPs are NOT "Superficial" or "Certification" style documents; RMPs must contain "Substance" and "Details" regarding the specific steps your Company has taken to implement robocall mitigation measures, including Know Your Customer, data analytics, and other critical elements necessary to demonstrate the seriousness of your mitigation efforts.

If your Company needs help, contact The CommLaw Group's Robocall Mitigation Response Team now!

June 30, 2021 is rapidly approaching. Virtually all voice service providers (“VSPs”) are required to make applicable STIR/SHAKEN filings with the Federal Communications Commission (“FCC”). Smaller SVPs (100,000 or less subscriber lines), while not required to make full STIR/SHAKEN filings, still must file robocall mitigation plans (“RMPs”) by that date. Moreover, SVPs must have their RMPs in place and operational by May 6, 2021.

The FCC has cast a wide net this time; even one-way SVPs and those who may have previously been exempt from certain regulatory requirements are required to file.

The FCC’s RMP database is open, and SVPs are already beginning to file. It is extremely important that SVPs prepare and timely file complete and thorough RMPs; failure to do so will likely result in fines and other sanctions by the FCC, not to mention the fact that, because terminating carriers are required to check the RMP database, non-compliant SVPs risk having their calls blocked by the terminators.

What RMPs Must Contain

The FCC requires that a VSP develop a RMP that:

• details the reasonable steps taken to avoid originating illegal robocalls
• demonstrates a commitment to respond to traceback requests to cooperate with investigations and stopping illegal robocalls
• is filed in the RMP database.

While this may appear simple, the devil is in the details. The FCC is not shy about rejecting incomplete RMPs, which will effectively void them and subject the non-compliant SVP to the consequences listed above. Some of the RMPs that have been already filed appear incomplete and will likely be rejected by the FCC.

A good RMP will contain detailed (but not necessarily lengthy) descriptions of an SVP’s:

• acceptable use policy
• know your customer procedures (e. information that confirms the customer’s identity)
• telephone number authorization
• monitoring
• investigation of suspicious activity and traceback
• blocking
• plan update information.

Ensure Compliance

In order to make sure that your company is compliant with the myriad of RMP requirements, SVPs are well-advised to work with counsel who understands the nature of their businesses and can prepare RMPs tailored to their needs while meeting the FCC’s requirements. The CommLaw Group is actively working with dozens of clients to develop their RMPs and other arrangements to ensure compliance. We have a template that we will send to any SVP which lays out the expectations and provides your company with the necessary regulatory guidance. We will also prepare and file your RMP.

NEED HELP WITH ROBOCALL MITIGATION AND COMPLIANCE?

The CommLaw Group Can Help!

Given the complexity and evolving nature of the FCC’s rules, regulations and industry policies & procedures around Robocall Mitigation and Compliance issues (e.g., Stir/Shaken, TRACED Act, FCC Rules & Regulations, US Telecom Industry group, ATIS, NECA, VoIP Numbering Waivers, Know Your Customer (effective May 6, 2021) and the private sector ecosystem), and anticipating the potential torrent of client questions and concerns, The CommLaw Group formed a “Robocall Mitigation Response Team” to help clients (old and new) tackle their unique responsibilities. The potential blocking of your company’s voice (and other) traffic due to non-compliance is very real, and very scary. Your company must be certain it achieves sufficient comfort knowing that it is doing everything it can, as efficiently and intelligently as it can, to achieve the level of compliance needed to avoid sleepless nights as the June 30, 2021 deadline approaches.

CONTACT US NOW, WE ARE STANDING BY TO GUIDE YOUR COMPANY’S COMPLIANCE EFFORTS

Rob Jackson – Tel: 703-714-1316 / E-mail: rhj@CommLawGroup.com
Ron Quirk – Tel: (703) 714-1305 / E-mail: req@CommLawGroup.com

May 6, 2021 - The Federal deadlines to install and operate Stir-Shaken tokens on your network are almost here. The first is June 1st, the second is June 30th, and unless you are exempt as a very small call producer, you are affected.

We are concerned that if you wait too long, we will not be able to accommodate your needs to meet the June deadlines.

To help you along a little bit, this offer: Connect with us now, but don’t turn- up until you need to in June, or whenever you are ready.

Connect to Prescott-Martini stir-shaken service prior to June 15th, and receive…

· 1,000,000 tokens, free,

· No obligation to turn up your production service prior to June 30th or until you are ready,

· Our initial install fee will be charged, but will not be due until one week after the connection and initial testing period,

· Start your production token generation at any time you wish.

Call us right now to get your connection appointment set, in time to meet the deadlines that are coming quickly!

Canadian Radio-television and Telecommunications Commission

Compliance and Enforcement and Telecom Decision CRTC 2021-123

Ottawa, 6 April 2021

STIR/SHAKEN implementation for Internet Protocol-based voice calls

The Commission directs telecommunications service providers (TSPs) to implement STIR/SHAKEN to authenticate and verify caller identification (ID) information for Internet Protocol (IP)-based voice calls as a condition of offering and providing telecommunications services, effective 30 November 2021. In addition, the Commission directs TSPs to file STIR/SHAKEN implementation readiness assessment reports by 31 August 2021 and to add certain details to those reports.

Background

1. In Compliance and Enforcement and Telecom Notice of Consultation 2019-404 (the Notice), the Commission issued a call for comments on its proposal to require Canadian carriers and other telecommunications service providers that provide voice telecommunications services in Canada (collectively, TSPs) to implement STIR/SHAKENFootnote1 to authenticate and verify caller identification (ID) information for Internet Protocol (IP)-based voice calls as a condition of offering and providing telecommunications services pursuant to sections 24 and 24.1 of the Telecommunications Act (the Act), effective 30 September 2020.

2. The Commission had previously determined in Compliance and Enforcement and Telecom Decision 2018-32 that TSPs should implement measures to authenticate and verify caller ID information for IP-based voice calls. The deadline, which the Commission has extended twice, is now 30 June 2021, as set out in Compliance and Enforcement and Telecom Decision 2019-402-2.

3. In Compliance and Enforcement and Telecom Decision 2019-403, the Commission approved the Canadian telecommunications industry’s proposal to establish the Canadian Secure Token Governance Authority (CSTGA) as the Governance Authority as part of the deployment of STIR/SHAKEN. The CSTGA is tasked, among other things, with the selection of the Policy Administrator (PA) and Certificate Authority (CA), which are necessary for the implementation of STIR/SHAKEN.

4. The Commission received interventions in response to the Notice from Mr. Marc Nanni; Bell Canada; Bragg Communications Incorporated, carrying on business as Eastlink (Eastlink); the Canadian Communication Systems Alliance (CCSA); Competitive Network Operators of Canada (CNOC); the Canadian Voice Peering Project; Cogeco Communications inc. (Cogeco); the Independent Telecommunications Providers Association (ITPA); the Internet Society Canada Chapter (ISCC); Quebecor Media Inc., on behalf of Videotron Ltd. (Videotron); Rogers Communications Canada Inc. (RCCI); Saskatchewan Telecommunications (SaskTel); Shaw Communications Inc. (Shaw); TELUS Communications Inc. (TCI); and Xplornet Communications Inc.Footnote2

Issues

1. The Commission has identified the following issues to be addressed in this decision:

-Should the implementation of STIR/SHAKEN be imposed on TSPs as a condition of offering and providing telecommunications services

-If the implementation of STIR/SHAKEN is imposed on TSPs as a condition of offering and providing telecommunications services, when should the requirement to implement STIR/SHAKEN become effective

-Other matters

Should the implementation of STIR/SHAKEN be imposed as a condition of offering and providing telecommunications services?

Positions of parties

1. Bell Canada, CNOC, Cogeco, RCCI, SaskTel, Shaw, TCI, and Videotron, did not object to mandating that TSPs implement STIR/SHAKEN as a condition of offering and providing telecommunications services (hereafter, condition of service).

2. Bell Canada added that the condition of service should apply symmetrically to all TSPs, with the exception of TSPs that do not issue their own telephone numbers, which should be exempt. Bell Canada submitted, however, that there should be a process for TSPs to petition the CSTGA or another relevant authority to request an exemption from the condition of service for reasons and criteria determined by relevant authorities and/or the Commission. Conversely, Cogeco, RCCI, and Shaw argued that STIR/SHAKEN must be deployed by all TSPs in Canada, no matter their size. In RCCI’s view, widespread adoption is critical, and if some carriers are not required to implement STIR/SHAKEN, it will greatly erode the benefits sought

3. Although they agreed that STIR/SHAKEN will have value in addressing caller ID spoofing, the CCSA and the ITPA disagreed with the idea of making STIR/SHAKEN implementation a condition of service. The ITPA expressed concern that STIR/SHAKEN implementation would be overly burdensome for smaller TSPs as a result of (i) the number of resources required and the cost of implementation, especially considering that there will be no corresponding retail revenue streams; (ii) the lack of control that smaller TSPs have over hardware and software availability; and (iii) the requirements for establishing IP interconnections with bigger TSPs. Given that its members are still mostly connected through time-division multiplexing interconnection with bigger TSPs, the ITPA pointed out that only a very small portion of ITPA members’ voice traffic would be able to carry STIR/SHAKEN authentication

4. Therefore, the ITPA concluded that expending scarce capital resources on a service that will, at present, apply only to extremely low traffic volumes and few interconnecting circuits would be a heavy-handed approach. The ITPA added that given the potentially severe consequences, such an approach would not be a proportionate regulatory measure and would violate subparagraph 1(a)(ii) of the 2006 Policy Direction,Footnote3 which states that the Commission should, when relying on regulation, use measures that are efficient and proportionate to their purpose and that interfere with the operation of competitive market forces to the minimum extent necessary to meet the policy objectives. The CCSA and Eastlink raised similar concerns, and the CCSA specifically supported the ITPA’s position. The ITPA submitted, in the alternative, that if the Commission decides to reiterate its expectation that the industry should implement STIR/SHAKEN, then the Commission should only require that small TSPs do so when the majority of their traffic is IP-based and routed over IP interconnecting trunks.

5. Shaw submitted that the Commission should adopt a phased approach by, for example, first placing a requirement on TSPs to integrate with and test against the PA. Then, in a subsequent decision, the Commission could require TSPs to activate STIR/SHAKEN on their Session Initiated Protocol (SIP) links with other TSPs. Similarly, SaskTel submitted that the Commission should supervise the development and implementation of STIR/SHAKEN by issuing various decisions rather than imposing a general requirement by condition of service. SaskTel argued that this will allow the Commission to render decisions on specific issues as they arise. The ITPA supported SaskTel’s position.

Commission’s analysis and determinations

1. The intervener TSPs, even those that rejected the proposal described in paragraph 1, supported the implementation of STIR/SHAKEN per se. The concerns raised are related to the mechanism for requiring TSPs to implement STIR/SHAKEN and the scope and extent of such a requirement.

2. Regarding whether an obligation to implement STIR/SHAKEN should apply to the same extent to all TSPs, for STIR/SHAKEN to work effectively and achieve its purpose, it must be implemented across all IP-based networks. Excluding some TSPs from the obligation to implement STIR/SHAKEN, or delaying their obligation to implement it, would undermine the effectiveness of the system. Further, delaying the implementation of STIR/SHAKEN until a TSP’s entire network is IP-based, or until the networks of all TSPs are IP-based, could have the unacceptable result of precluding Canadians from having the tools to verify the authenticity of calls for years, if not decades. Implementing the framework on whatever IP portions of the network exist at least provides some level of protection with respect to calls that travel over those portions of a TSP’s network. Furthermore, the Commission notes that the burden on a TSP is not necessarily related to the size of a TSP. The resources required to purchase and install the software and equipment in order to implement STIR/SHAKEN will, in large part, depend on the extent to which a TSP’s network is IP-based.

3. The Commission therefore concludes that the burden imposed on all TSPs, and in particular smaller TSPs, of upgrading the IP portion of their networks to enable them to implement STIR/SHAKEN is outweighed by the important and ever more urgent objective of ensuring an effective authentication and verification caller ID system in order to reduce the harm caused by nuisance calls

4. In light of the above, the Commission determines that all TSPs must be able to authenticate and verify caller ID information using the STIR/SHAKEN framework for IP-based calls in order to provide the necessary protection to called parties. Further, the Commission determines that it is appropriate to invoke its powers pursuant to sections 24 and 24.1 of the Act as the mechanism for imposing the requirement on TSPs to implement STIR/SHAKEN as a condition of offering and providing telecommunications services.

If the implementation of STIR/SHAKEN is imposed as a condition of offering and providing telecommunications services, when should the requirement to implement STIR/SHAKEN become effective?

Positions of parties

1. Bell Canada, CCSA, CNOC, Cogeco, Eastlink, RCCI, SaskTel, Shaw, TCI, and Videotron objected to the 30 September 2020 implementation date, which the Commission has since extended, on the basis that this date was not achievable. These interveners argued that the condition of service should not take effect until the STIR/SHAKEN framework is developed, implemented, and operationalized in TSPs’ networks. Further, they submitted that STIR/SHAKEN is an extremely complex project that requires an extensive core network build and individual TSP-to-TSP testing. They also submitted that the STIR/SHAKEN technical and operational framework is still being developed, and that a number of issues must still be resolved, including the development of interface standards with the CSTGA, PA, and CA; handset display standards; and attestation rules. Without handsets that can display the authentication, STIR/SHAKEN cannot fulfill its purpose. RCCI and SaskTel suggested that the Commission use the CRTC Interconnection Steering Committee (CISC) in the development of technical or procedural solutions. Videotron submitted that a national campaign would be required to educate telecommunications service end-users about the authentication system and how it works.

2. Bell Canada also proposed, if no other arrangement is made, a coming into force date of 1 July 2022 for STIR/SHAKEN, arguing that the condition of service should not come into force until the following conditions are met:

-TSPs have received, lab and field tested, and operationalized the software upgrades necessary to enable IP switching and routing equipment to transmit STIR/SHAKEN tokens.

-Stakeholders have had a reasonable amount of time to attempt to negotiate and agree upon common and universally applicable Canadian attestation best practices and token display rules.

-The Commission-approved governance ecosystem (i.e. the CSTGA, the PA, and the CA) has been fully put in place and is operational and issuing certificates. TSPs have then had at least three months to fully integrate their networks, with CAs facilitating the seamless issuance of tokens from CAs to certified TSPs.

3. CNOC and the ISCC suggested that the Commission should refrain at this point in time from imposing a firm date for the deployment of STIR/SHAKEN. Eastlink proposed a staged implementation, beginning with only the largest telephone companies in the country. As stated above, the ITPA adopted a similar position, indicating that smaller TSPs should only be required to implement STIR/SHAKEN when the majority of their traffic is IP-based and interconnected with bigger TSPs through IP-based interconnections.

Commission’s analysis and determinations

1. Since the close of this proceeding, many of the issues raised by the interveners have either been resolved, or significant progress toward resolving them has been made. In addition to the Commission’s latest approval of a nine-month extension of the implementation deadline to 30 June 2021, key developments include the following:

-The establishment of the CSTGA and selection of the CA, and the resulting functioning of the CSTGA since 30 September 2020.

-The testing of equipment and software by some TSPs.

-The use by some TSPs of STIR/SHAKEN to authenticate calls within their IP voice networks.

-Progress in negotiations regarding the development of standards and best practices, and the imminent filing of an interim report from the CISC Network Working Group.

-Increased availability of vendor equipment, software, and compatible phones.

2. However, some technical and policy issues have yet to be resolved, which will likely preclude a complete deployment of the STIR/SHAKEN framework by 30 June 2021.

3. Further, pursuant to Compliance and Enforcement and Telecom Decisions 2019-402 and 2019-402-1, TSPs are required to submit a report providing a short overview of STIR/SHAKEN implementation (referred to hereafter as the implementation readiness assessment report), within two months of the implementation date. Given the approved extension of the implementation date to 30 June 2021, this report is now due by 31 August 2021.

4. The Commission considers that TSPs should have a reasonable amount of time following the filing of the implementation readiness assessment report before the requirement imposed under sections 24 and 24.1 of the Act becomes effective, to allow for the resolution of technical and policy-related issues, including those that may be identified in the report, and to finalize the integration of STIR/SHAKEN capability. To that end, the Commission considers that a 90-day period following the deadline for submitting the implementation readiness assessment report would be appropriate.

5. In light of all of the above, pursuant to sections 24 and 24.1 of the Act, the Commission directs that, as a condition of offering and providing telecommunications services, TSPs must implement STIR/SHAKEN in order to authenticate and validate IP-based voice calls, effective 30 November 2021

6. In addition, the Commission directs TSPs to submit an implementation readiness assessment report, including the information set out in Appendix 1 of this decision, by 31 August 2021. The Commission also directs TSPs to provide to the Commission, every six months, starting 31 May 2022 and continuing until the Commission decides otherwise, a status report containing the information set out in Appendix 2 to this decision.

Other matters

Clarification regarding the condition of service

Positions of parties

1. The ITPA submitted that a condition of service should apply on a carrier-by-carrier basis and only for those aspects of a carrier’s operations that are solely under the control of that carrier. Further, a condition of service should only apply to IP-based voice calls. The ITPA thus proposed to define “IP-based voice call” as a call that is SIP-based from the end-point of origination (i.e. the handset) all the way to the end-point of termination (i.e. the handset), including any networks used to transit between origination and termination.

2. Bell Canada also submitted that the condition of service should be clarified to specify that STIR/SHAKEN applies only to (i) IP voice calls that are SIP-based end-to-end, and (ii) voice calls made to devices, or other customer equipment, that are able to receive and transmit STIR/SHAKEN attributes, as defined and approved by applicable authorities.

Commission’s analysis and determinations

1. The Commission’s determinations to date have clearly provided that the obligation on TSPs to implement STIR/SHAKEN applies only to IP-based voice calls. That is to say, it applies to calls that travel over a TSP’s IP-based network, including any portion of its network that is able to initiate, transit, or terminate IP-based calls. The Commission did not limit this obligation to IP-based end-to-end calls made to handsets or other devices that are able to receive and transmit STIR/SHAKEN attributes

2. The specific authentication and verification information that TSPs must transmit under various circumstances is still being clarified as the STIR/SHAKEN guidelines continue to be developed. Once these guidelines are finalized, the Commission can provide further guidance as required.

Access to the STIR/SHAKEN framework to authenticate calls

Positions of parties

1. Cogeco and the ISCC submitted that, should the CSTGA allow only TSPs that have numbering resources to obtain a certificate, other types of TSPs, such as resellers, would be at a commercial disadvantage given that the underlying service provider will have to provide a low level of attestation to calls originating from non-participant TSPs.

Commission’s analysis and determinations

1. The Commission notes that since the filing of these comments the CSTGA has published the eligibility conditions on its website. These conditions establish that a TSP must have access to numbering resources in order to receive a certificate, with the result that some of the TSPs that are required to implement STIR/SHAKEN cannot have access to certificates.

2. In response to the establishment of these conditions, a Part 1 application was filed on 21 December 2020 requesting that the Commission instruct the CSTGA to allow all TSPs to be able to implement STIR/SHAKEN by receiving certificates directly from the CA. Accordingly, the Commission will address the issue of access by TSPs to certificates in the context of its determinations in the aforementioned application.

Policy Directions

1. The 2006 Policy Direction and the 2019 Policy DirectionFootnote4 (collectively the Policy Directions) state that the Commission, in exercising its powers and performing its duties under the Act, shall implement the policy objectives set out in section 7 of the Act in accordance with the considerations set out therein, and should specify how its decisions can, as applicable, promote competition, affordability, consumer interests, and innovation

2. The Commission’s decision to require TSPs to authenticate and verify IP-based voice calls using the STIR/SHAKEN framework serves to protect Canadians from the harms of nuisance calls and advances the policy objectives set out in paragraphs 7(a), (b), (f), (g), (h), and (i) of the Act. The implementation of STIR/SHAKEN will be an efficient and effective means to providing consumers with a tool to identify the level of trustworthiness of a call. This tool will empower consumers to take the appropriate actions in responding to incoming calls. Furthermore, the measures imposed in this decision are symmetrical and competitively neutral given that they apply equally to all TSPs

3. Accordingly, the Commission considers that its decision is consistent with the Policy Directions.

Secretary General

Related documents

-Call for comments – Authentication/verification measures for caller identification for IP-based voice calls – Implementation of STIR/SHAKEN framework, Compliance and Enforcement and Telecom Notice of Consultation CRTC 2019-404, 9 December 2019

Establishment of the Canadian Secure Token Governance Authority, Compliance and Enforcement and Telecom Decision CRTC 2019-403, 9 December 2019

-CISC Network Working Group – Status of implementation by telecommunications service providers of authentication/verification measures for caller identification, Compliance and Enforcement and Telecom Decision CRTC 2019-402, 9 December 2019; as amended by Compliance and Enforcement and Telecom Decisions CRTC 2019-402-1, 13 December 2019; and 2019-402-2, 15 September 2020

Measures to reduce caller identification spoofing and to determine the origins of nuisance calls, Compliance and Enforcement and Telecom Decision CRTC 2018-32, 25 January 2018; as amended by Compliance and Enforcement and Telecom Decisions CRTC 2018-32-1, 24 October 2018; and 2018-32-2, 18 December 2018

Appendix 1 to Compliance and Enforcement and Telecom Decision 2021-123

TSPs must submit an implementation readiness assessment report to the Commission no later than 31 August 2021, describing the state of implementation of STIR/SHAKEN as of 30 June 2021.

The implementation readiness assessment report must include the following information:

-statistics identifying

1. the percentage of authentication/verification-enabled trunks used for IP voice traffic in relation to the total number of voice trunks,
2. the percentage by month of the number of authenticated/verified voice calls in relation to the total number of voice calls, and
3. tracking by level of authentication (e.g. trusted, partial trust, no trust) for calls delivered to customers;

-the status and result of TSPs’ STIR/SHAKEN implementation readiness, specifically

1. whether the STIR/SHAKEN authentication uses an analytic engine or whether the Verstat parameter is sent to the end-user;

2. a brief description of the TSP’s IP voice network capacity to

• perform complete intra-network STIR/SHAKEN-compliant calls,
• authenticate and transmit the authentication information to the next TSP in the call path when originating a call,
• receive and verify the caller ID information when terminating a call,
• send the Verstat parameter to wireless and landline end-users when an analytic engine is not used,
• transmit the STIR/SHAKEN information when transiting a call received on an IP interconnection from an upstream TSP and sent on an IP interconnection to a downstream TSP,
• authenticate unsigned calls received from an upstream TSP that either terminate on the TSP’s IP network or are sent to a downstream TSP through an IP interconnection,
• handle diverted calls,
• handle toll-free calls,
• handle emergency calls, and
• handle legitimate spoofed calls;

3. a brief description of the status of the TSP’s IP interconnection with other TSPs, including network-to-network interface and user-to-network interface interconnections;

4.a brief description of the solution adopted to handle enterprise clients; an

5. the status and results of equipment testing and participation in those tests

-information regarding the state of the standards, specifically:

1. the status of authentication/verification standards and their subordinate standards, as well as any other related standards; and

2. identification of Canadian-specific requirements and the efforts that are being made to incorporate these requirements into the appropriate standards.

Appendix 2 to Compliance and Enforcement and Telecom Decision 2021-123

TSPs must also provide to the Commission, every six months, starting 31 May 2022 and continuing until the Commission decides otherwise, a status report on their continuing efforts to deploy STIR/SHAKEN. These reports are due to the Commission on the last days of May and November, covering the period from the first day of September to the last day of February (for the May report) and from the first day of March to the last day of August (for the November report). 

Those status reports must provide details on any changes in network capability in relation to the information that was provided in the implementation readiness assessment report and described in Appendix 1.

Footnotes

Footnote 1

STIR stands for Secure Telephone Identity Revisited. SHAKEN stands for Signature-based Handling of Asserted Information using toKENs. It is a suite of protocols and procedures intended to combat caller identification (ID) spoofing by providing authentication and verification of caller ID information.

Return to footnote1referrer

Footnote 2

Two additional individuals also filed submissions on the record of this proceeding, but they did not comment on the issue raised in Compliance and Enforcement and Telecom Notice of Consultation 2019-404.

Return to footnote2referrer

Footnote 3

Order Issuing a Direction to the CRTC on Implementing the Canadian Telecommunications Policy Objectives, SOR/2006-355, 14 December 2006

Return to footnote3referrer

Footnote 4

Order Issuing a Direction to the CRTC on Implementing the Canadian Telecommunications Policy Objectives to Promote Competition, Affordability, Consumer Interests and Innovation, SOR/2019-227, 17 June 2019

Company acts to protect customers and its brand in seeking an end to abusive and illegal practice

Marriott International, Inc. (NASDAQ: MAR) today filed a lawsuit in federal court in Virginia against the unknown perpetrators (“John Does”) responsible for illegal and fraudulent “robocalls” misusing Marriott’s name.

The suit claims these bad actors are using Marriott’s brand for their own commercial gain in violation of state and federal laws. Marriott will aggressively pursue the identities of the robocallers to halt these illegal acts affecting Marriott customers and others.

Illegal robocalls are an abusive and deceptive form of telemarketing, with over 18 billion pre-recorded telephone calls in the U.S. in 2020. Four months into 2021, that figure has already reached 7.2 billion.* Marriott, its customers and the American public at large have been aggressively targeted by these robocallers.

To induce consumers to purchase the promotion, the robocallers falsely represent that they are agents or employees of Marriott. Illegal robocalls in the U.S. fraudulently claiming to be from Marriott increased dramatically in 2020 – to a peak of seven million per month.

“Marriott has undertaken this federal lawsuit against illegal robocalls primarily to protect our customers, but also to protect our brand name and intellectual property,” said Stephanie Linnartz, President, Marriott International. “Marriott’s fight will not stop with the filing of today’s complaint– we will continue to consider and leverage all tools at our disposal to identify and bring to justice the bad actors behind these illegal and fraudulent robocalls.”

Marriott leveraged the capabilities of two industry leaders in the fight against illegal robocalls: the Industry Traceback Group (ITG) and YouMail, Inc. The ITG, which is designated by the Federal Communications Commission as the official robocall traceback consortium, rapidly identifies the origination point of illegal robocalls. YouMail, a company that protects consumers with app-based call protection services, identifies problematic numbers and robocalls using a combination of its recently patented audio fingerprinting technology, call patterns, and consumer feedback. Marriott is working together with both the ITG and YouMail to identify the perpetrators and track their activity.

On December 3, 2020, Marriott updated and re-issued a public statement to confirm that Marriott is not responsible for the fraudulent robocalls, nor has it authorized them. Marriott has received many consumer complaints about fraudulent robocalls mentioning Marriott, leading the company to file this lawsuit to halt the deceptive and abusive telemarketing acts, practices and trademark violations. In addition to the lawsuit, Marriott has provided information about the ongoing scam to the Federal Trade Commission and made clear that the Company will work with regulators in their efforts to stop these illegal robocalls.

How Consumers Can Protect Themselves
There are a number of steps consumers can take to help protect themselves from these illegal and fraudulent robocalls:

• Know the facts:
• 
  
• If you answer the phone and hear a recorded message instead of a live person, it's a robocall.

• Marriott is not associated with and does not authorize any robocalls using prerecorded messages.

• Marriott has not and will not provide any contact or personal information to the perpetrators making these fraudulent phone calls.

• What should I do if I receive a robocall?
• Do not provide any personal or credit card information.
• End the call immediately.
• Report robocalls to the Federal Trade Commission and the Federal Communications Commission.
• Contact your phone company to learn more about the blocking and labeling solutions that may be available to protect you from unwanted and illegal calls.

For more information on phone scams, visit the Federal Trade Commission’s consumer information page.

*YouMail Robocall Index Historical Robocalls by Time

https://fccprod.servicenowservices.com/rmd?id=rmd_welcome

Welcome to the Robocall Mitigation Database. Pursuant to 47 CFR § 64.6305(b), all voice service providers must file certifications to this Database providing detailed information regarding their implementation of the STIR/SHAKEN caller ID authentication framework and/or a robocall mitigation program.

Through this webpage, members of the public may download voice service providers' certifications. In addition, through the portal found on this webpage, voice service providers may submit their certifications.

You may find an active listing of all voice service providers that have submitted sufficient certifications by clicking View Database below or by downloading the CSV file below. Please note that you may need additional software to view the CSV file.

A voice service provider must possess an FCC Registration Number (FRN) to submit a certification. If you are a voice service provider and would like to submit a certification, and you have an FRN, please click the "Log in" button below. If you wish to submit a certification but do not have an FRN, please click "Create Account" below. After creating an FRN, please return to this page to log in. Full Database submission instructions are available here.

When viewing the Robocall Mitigation Database, if you believe there are errors with the content or function of the database, or if you require special assistance with submitting a filing, please email FCC staff at RobocallMitigationDatabase@FCC.gov.

OMB Control Number: 3060-1285

By John Eggerton - May 21 2021

Targets smaller operators with larger volume of illegal robocalls

The FCC has voted unanimously to shorten the deadline for some smaller voice providers to use the STIR/SHAKEN caller ID regime, meant to weed out unwanted robocalls, but smaller cable operator voice providers want to make sure the FCC isn't casting a too wide net.

The FCC said that some new evidence suggests that a "small subset" of smaller voice service providers were responsible for an "increasing quantity" of illegal robocalls.

The FCC set a June 30, 2021 deadline for most voice service providers, including larger cable operators, to implement STIR/SHAKEN, but gave smaller providers—fewer than 100,000 subs—more time.

But in a vote at its Thursday (May 20) public meeting, the commission said it would shorten that by a year (June 2022) for smaller providers "which originate an especially larger amount of traffic."

"We recently discovered that some smaller companies are pumping large volumes of traffic onto our networks and a lot of it looks suspiciously like robocalls," said FCC acting chair Jessica Rosenworcel. "It’s time to change course. So here we propose to cut back on the extension for smaller providers that are sending these junk calls. Implementing STIR/SHAKEN—and doing it faster as we propose here—will help reduce robocalls over time."

The FCC sought comment on how to best define that subset that poses "a heightened risk of originating an especially large amount of illegal robocall traffic," as well as whether it should do more to improve oversight of the smaller providers it identifies as requiring the shortened deadline.

ACA Connects, which represents smaller providers, said it will keep an eye on the proceeding going forward to make sure the FCC is aiming at the right target.

“ACA Connects represents small voice providers that have an established presence in their communities and take their obligations seriously," said Brian Hurley, ACA Connects VP of regulatory affairs. "We intend to participate in this proceeding to ensure it remains squarely focused on the correct target – the 'subset' of providers responsible for originating large volumes of illegal robocalls – and that it avoids sweeping in ACA Connects members and other legitimate providers that are not the source of this problem.”

These Are the Third Tranche of Enforcement Bureau Cease and Desist Letters

--

WASHINGTON, May 18, 2021—FCC Acting Chairwoman Jessica Rosenworcel today announced the latest FCC action to combat illegal robocalls and spoofing campaigns that target and defraud consumers. The FCC’s Enforcement Bureau sent cease and desist letters to VaultTel Solutions and Prestige DR VoIP demanding that they immediately cease carrying illegal robocall campaigns on their networks and report to the Commission the concrete steps they implemented to prevent a recurrence of these operations.

“We need to use every tool we have to get these junk calls off of our networks,” said Rosenworcel. “From these new cease-and-desist letters to STIR/SHAKEN implementation to large fines and our robocall mitigation database, we are going to do everything we can to protect consumers from these nuisance calls. We’re not going to stop until we get robocallers, spoofers, and scammers off the line.”

Investigations by the Enforcement Bureau, in conjunction with the industry-led Traceback Consortium, indicate that these companies each transmitted multiple illegal robocall campaigns on their networks. The FCC has made clear that, should this practice not end immediately, other network operators will be authorized to block traffic from these companies altogether. The Bureau issued similar letters to other companies in March and April. In response to the previous letters, most of those companies appear to have stopped facilitating robocall campaigns and taken steps to prevent reoccurrences. The FCC will continue to monitor all these companies’ activities and, should a reoccurrence take place, stands ready to authorize the blocking of traffic from any of these duly warned companies.

Today’s letters make clear that VaultTel Solutions and Prestige DR VoIP must take steps to “effectively mitigate illegal traffic” within 48 hours. If they fail to inform the Commission and the Traceback Consortium within fourteen days of the steps taken to implement effective measures to prevent their clients from using their network to make illegal calls. If they do not take such steps, other networks will be authorized to block traffic from these companies.

Phone Companies Must Block Calls From Non-Filers

--

WASHINGTON, April 20, 2021—The Federal Communications Commission today launched the Robocall Mitigation Database through which voice service providers are required to inform the agency of their robocall mitigation efforts. As of September 28, 2021, phone companies must refuse to accept traffic from voice service providers not listed in the Robocall Mitigation Database.

The new Robocall Mitigation Database includes a portal through which voice providers must file certifications regarding their efforts to stem the origination of illegal robocalls on their networks. Companies that were granted an extension for compliance with the call authentication mandate contained in the TRACED Act and FCC rules – generally small companies and/or providers of non-IP-based services – must file detailed reports on the steps they are taking to ensure they are not the source of illegal calls.

“Protecting consumers from scammers that use robocall and spoofing tools is a top priority,” said FCC Acting Chairwoman Jessica Rosenworcel. “To succeed, we not only need an all-hands-on-deck response from government, but we need industry commitment and focus. Our message to providers is clear: certify under penalty of perjury the steps you are taking to stop illegal robocalls, or we will block your calls.”

Call authentication, based on STIR/SHAKEN technological standards, enables voice service providers to verify that the caller ID information transmitted with a call matches the caller’s phone number. Use of these standards will help combat scammers’ use of caller ID spoofing to mask their true identity and trick consumers by appearing to call from local or other trusted numbers. It will also allow law enforcement, the FCC, and industry to more quickly and effectively trace back scam calls to their source.

The FCC, acting under authority granted by the TRACED Act, previously required providers with IP-based phone networks to implement the STIR/SHAKEN framework by June 30, 2021. The FCC also required voice service providers with non-IP network technology either to upgrade their non-IP networks to IP and implement these standards, or work to develop a non-IP caller ID authentication solution. Providers that received an extension of time to come into compliance with these STIR/SHAKEN obligations must adopt robocall mitigation programs. The database launched today will be the portal through which originating providers report on their compliance with these obligations. The FCC’s Wireline Competition Bureau formally launched the database and provided filing details in a Public Notice released today.

May 23, 2021

Everyone hates robocalls. If you are a voice service provider, a white label provider, or reseller of these services whether via TDM or SIP, then you need to know what the FCC has directed providers to implement.

If you support more than 100,000 lines you must implement SHAKEN for SIP connections or Robocall Mitigation for TDM lines. If you support fewer than 100,000 lines, you have the options to select SHAKEN for SIP or Robocall Mitigation for TDM. This is the most common path forward for small providers by Implementing Robocall Mitigation to meet June 30th deadline.

Every service provider who serves end users must certify they have implemented either a Robocall Mitigation Program or SHAKEN in their network. The filing of certifications needs to be submitted after June 30, 2021. Will you be ready?

Service providers must block all calls from any service provider that is not in the FCC database. This must become effective 90 days after the deadline for robocall mitigation program certifications. This affects all the main carriers, VoIP resellers, UCaaS providers, some MSPs, and all OTT providers. There will be penalties for non-compliance. Any provider located outside of the US that wants their calls to be verified when calling clients in USA/Canada, need to work with a North American Partner in order to satisfy these requirements. All the enterprises the providers support will want their calls marked as ‘verified’.

These solutions are new to most providers. In a recent survey, 51% of the providers have not started implementation, only 22% have started, a few (5%) have finished while 22% didn’t know what to do. This means that 73% need to learn more about the technologies, responsibilities, and legal issues for dealing with robocalls. The June 30, 2021 date for compliance is approaching fast.

JUNE 14, 2021 USTelecom filed reply comments with the FCC that were sharply critical of recent filings in the Robocall Mitigation Database (RMD) seeking blanket confidentiality for providers’ robocall mitigation plans. Here’s what’s happening.

USTelecom complaint

In their reply comments, USTelecom responded to the FCC Wireline Competition Bureau’s request for comments on a protective order for RMD collection. Here’s is the crux of their complaint:

Recent filings in the RMD seeking blanket confidentiality for providers’ robocall mitigation plans are of deep concern and threaten the transparency and accountability that the RMD is intended to create.

The Bureau should ensure that robocall mitigation plans are public by default, and only truly confidential and sensitive information is withheld from full public view.

USTelecom cites the FCC’s Second Report and Order, which states that the intent of the confidentiality provision is to avoid giving bad actors the information they need to undermine the provider’s programs, or disclose sensitive competitive information.

Confidential

RMD confidential filings

On June 14, 2021, we reviewed robocall mitigation plans in the RMD for providers that filed a request for confidentiality. Here’s what we found:

There were 552 robocall mitigation plans filed in the RMD.

There are 50 redacted plans in the RMD, which is 9% of the plans filed.

Of the redacted plans, 46 are fully or almost fully redacted, which is 92% of the redacted plans. USTelecom seems to have a point here.

Of the four partially redacted plans, we found the following redactions:

One redacted the their robocall mitigation contact name.

Another redacted the name of an underlying service provider.

The last two redacted some details of their robocall mitigation methods.

41 of the 46 fully redacted plans (89%) were nearly identical in the following respects:

They had a cover page with the company name

They had the same table of contents

After the table of contents, there were 10 pages of fully redacted content.

The PDF file properties indicate that the source document was written by Doug Eidahl. Searching LinkedIn, we found a Doug Eidahl who works for Vantage Point Solutions, in Mitchell, South Dakota.

Federal lawmakers are continuing to push for an end to robocalls by increasing penalties for automated, illegal calls through the Deter Obnoxious, Nefarious, and Outrageous Telephone (DO NOT) Call Act.

U.S. Majority Leader Charles Schumer and Sen. Kirsten Gillibrand joined others in the Senate calling for an end to scam calls that often target and victimize the elderly.

“This vital piece of legislation will give the FCC the tools needed to combat scammers who grossly violate the Telephone Consumer Protection Act and, all too often, target and defraud senior Americans,” said Gillibrand. “I am a fierce advocate of the DO NOT Call Act, and will do everything I can to put sensible protections in place and put an end to unsolicited robocalls.”

Nearly 4.5 billion robocalls were made across the country in April alone, according to YouMail, with more than 229 million in New York State.

The DO NOT Call Act would do the following:

• Clarify violations under the Telephone Consumer Protection Act (TCPA), which outlaws robocalls;
• Allow prison terms of up to one year for willfully and knowingly violating the TCPA;
• Allow prison terms of up to three years for aggravated violations of the TCPA;
• Double the maximum penalties under the TCPA for falsifying caller ID, from $10,000 to $20,000.

July 18, 2021 On Thursday, the Federal Communications Commission unanimously approved a report and order under Section 10a of the Telephone Robocall Abuse Criminal Enforcement and Deterrence (TRACED) Act to implement a streamlined process for private entities to report calls that may be unlawful and callers who are using legitimate businesses’ caller IDs.

“The new online portal will allow such entities to alert agency investigators of concerning incidents, including floods of robocalls like those that have been known to clog up hospital phone lines,” according to a news release from the FCC .

When a private entity submits a report through the online portal, it will collect their contact information and details about the robocall campaign they are concerned about, according to the FCC. The Consumer and Governmental Affairs Bureau may then initiate an investigation to stop the robocalls and may work with federal and/or state partners to address the issue.

The report and order also requires private entities using the portal to submit certain minimum information including, but not necessarily limited to, the name of the reporting private entity; contact information, including at least one individual name and means of contacting the entity (e.g., a phone number); the caller ID information displayed; the phone number(s) called; the date(s) and time(s) of the relevant calls or texts; the name of the reporting private entity’s service provider and a description of the problematic calls or texts.

The new process will not affect the current informal complaint process that the Consumer and Governmental Affairs Bureau manages, according to the FCC.

The bureau will implement the portal once it receives the requisite approvals from the Office of Management and Budget. The report and order will take effect 30 days after it is published in the Federal Register.