- VoiceOps - lists.voiceops.org

Update on STIR/SHAKEN
by marylou＠backuptelecom.com July 12, 2023

July 12, 2023

I spoke with my FCC contact today and was told to read the last order issued in March so his response wasn't crystal clear. He said the FCC is still in the process of deciding which types of companies can sign with a third-party vendor's token and which ones can't. I told him my concern is that the ITG is going to start blocking traffic in August and companies won't know that they aren't compliant because their wholesale provider told them they were fine. I specifically asked, "If the ITG decides a company should have had its own token, will you give them time to get one?" He said they have a process for handling these issues, but he didn't come out and say "Yes" so here's what I would suggest since the process can sometimes take longer than the 30 days they give you to comply. If you are using a third-party provider whose signing with their token. At least complete the preliminary steps to qualify for your own STIR/SHAKEN token. That way if they do come to you and tell you that you need to get it on a moment's notice, you won't be fighting the clock so much. The pre-requisites for filing with the STI-PA to become an approved carrier are: 1. Order your own OCN (aka company code from NECA) IPES is the correct type for all VOIP carriers 2. Have your 499 up to date and fees paid. If you've never filed a 499A yet, get your 499 filer ID and submit your first 499-A. (All carriers delivering long-distance traffic in the US should have already completed this step anyways). 3. Robocall Mitigation Plan filed. There are multiple companies helping carriers get their STIR/SHAKEN certificate, so it doesn't matter if you use my services or anyone else's. I just want to make sure everyone is aware of what they need to do to make sure their traffic doesn't get blocked because thats a lot harder to fix than getting a certificate/token is! MARY LOU CAREY BackUP Telecom Consulting Office: 615-791-9969 Cell: 615-796-1111

1 0

STIR/SHAKEN warning!
by marylou＠backuptelecom.com July 12, 2023

July 12, 2023

I've heard from several clients that their upstream carrier told them they don't need to worry about being STIR/SHAKEN compliant because they are taking care of everything for them. THAT IS NOT CORRECT! Every phone company is required to have its own certificate/token! It doesn't matter if you're a reseller or a facilities-based carrier. Whoever bills the customer is the carrier of record and is responsible for signing the customer's calls with THEIR OWN certificate/token. While an upstream carrier can sign calls for your company, they must sign with YOUR certificate/token - not their own because they don't have a direct connection with your customer. Please understand that you're putting your network at risk when you share a token with another company because there's no way to differentiate between traffic when it's all under the same certificate/token. If your upstream carrier signs all their customer's traffic with their token, it only takes one bad customer to shut their whole network down. The only way to protect your company from other companies' mistakes is to make sure your upstream carrier is signing your calls with your certificate/token. One may not think they can get away with using someone else's certificate/token because it would be difficult to monitor the call stream for offenders. Let me just tell you the ITG can easily compare the Robocall Mitigation Database with the Approved Carriers list to locate the companies that don't have their own certificate/token. They don't need to look at traffic to determine that. Please don't play Russian roulette with your company because it's not worth losing your whole business over the cost of a certificate/token. Getting your own certificate/token can take anywhere from 2 weeks to 2 months depending on where you are in the process. From what I've heard, the FCC will start blocking traffic in August so if you haven't started the process....do so now! MARY LOU CAREY BackUP Telecom Consulting Office: 615-791-9969 Cell: 615-796-1111

6 9

STIR/SHAKEN warning!
by nathana＠fsr.com July 7, 2023

July 7, 2023

Thanks; I had no idea this was a thing. -- Nathan From: Paul Timmins [mailto:paul at timmins.net] Sent: Friday, July 7, 2023 2:39 PM To: Nathan Anderson Cc: Voice Ops Subject: Re: [VoiceOps] STIR/SHAKEN warning! Always worth pointing out that in March 2020, Somos rolled out TFNIdentity. We have it set up on customers who want to source from their TFNs, I haven't seen many carriers actually look it up, but it does exist. On Jul 7, 2023, at 5:34 PM, Nathan Anderson via VoiceOps <voiceops at voiceops.org > wrote: I suspect things might be different now (& I just haven't kept up), but although it is clearly *possible* to transmit a TFN as the calling number / CID, I seem to remember that even just a mere few years ago, it was HIGHLY discouraged, and if you ever were to receive a call bearing a TFN as its CID, it had a very high likelihood of being fraudulent or spam. This was of course back when the vast, vast majority of TFNs were essentially implemented as a call forward or alias to a number that hung off of a local exchange. So of course outbound calls that many? most? companies with TFNs would make would typically be sourced from their local exchange number(s) and not from the TFN (s) (unless maybe a given company had a PRI and their provider allowed them to source calls from their TFN?). Thus the expectation for a long time (as I understood it) was that TFNs were truly inbound-only and should be treated as such. Loosely tangentially related, as a purely anecdotal report, I will note that I have yet to see a S/S signature/PASSporT attached to ANY calls made *to* ANY of our TFNs, via any of the 3 SIP wholesalers we have used as both RespOrgs & for actual traffic. -- Nathan From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of David Frankel via VoiceOps Sent: Friday, July 7, 2023 7:52 AM To: 'Ivan Kovacevic'; 'Voice Ops' Subject: Re: [VoiceOps] STIR/SHAKEN warning! Ivan asks: ???How are you handling TFN atestations???? When the signer of a call gives A-level attestation, it means that the signer knows that the caller ???is authorized to use??? the calling number. The signer can ???know??? that in any of a variety of ways. For toll-free numbers, the most sophisticated and secure is probably via Delegate Certificates. SOMOS, the North American Toll-Free Number Administrator, has commented about this in a current FCC proceeding: https://www.fcc.gov/ecfs/document/10605623514445/1 As the signer, there are other ways you could determine that the caller is authorized to use the number. For example, you could solicit some documentation from them (like an invoice from their RespOrg and/or service provider) and you could call the number and verify that your caller answers. The regulations (today) do not specify exactly how you ???know??? so you (as the signer) need to act in the spirit of the rules. This problem is not unique to toll-free numbers. I might have a geographic number that I obtain from provider A (and that???s how I get inbound calls to the number), but I make outbound calls from that number via providers B and C for redundancy and cost reasons. Bear in mind that providers can set their own rules for what calls they will accept and what attestations they will assign, and those rules can be more restrictive than what might be dictated by regulation. For example, a provider might say ???I will only assign A-level attestation to calls that use calling numbers assigned by me.??? That???s their prerogative. In fact, a provider might say: ???I will only accept calls that use calling numbers assigned by me. Those calls will get A-level attestation. I will reject all other calls.??? There are no rules (to my knowledge) that prohibit providers from setting these kinds of rules. From: VoiceOps <voiceops-bounces at voiceops.org> On Behalf Of Ivan Kovacevic via VoiceOps Sent: Friday, July 7, 2023 7:27 AM To: Voice Ops <voiceops at voiceops.org> Subject: Re: [VoiceOps] STIR/SHAKEN warning! Hopefully on-topic. How are you handling TFN atestations? Although a part of NANP - it's a different technology at the network level in terms of chain of authority and routing. RespOrg manages the number, but can provision and use many carriers to make outbound calls using the TFN Caller ID (and to receive inbound calls via the same TFN)... RespOrgs is not necessarily a carrier - who and how checks that RespOrg has the authority in case of delegated attestation. I may be overcomplicating it in my mind.. but it doesn't feel like the regulation maps 1-to-1 over to TFNs... Just wondering what everyone's experience is. Thanks, Ivan _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

2 1

STIR/SHAKEN warning!
by nathana＠fsr.com July 7, 2023

July 7, 2023

I suspect things might be different now (& I just haven't kept up), but although it is clearly *possible* to transmit a TFN as the calling number / CID, I seem to remember that even just a mere few years ago, it was HIGHLY discouraged, and if you ever were to receive a call bearing a TFN as its CID, it had a very high likelihood of being fraudulent or spam. This was of course back when the vast, vast majority of TFNs were essentially implemented as a call forward or alias to a number that hung off of a local exchange. So of course outbound calls that many? most? companies with TFNs would make would typically be sourced from their local exchange number(s) and not from the TFN (s) (unless maybe a given company had a PRI and their provider allowed them to source calls from their TFN?). Loosely tangentially related, as a purely anecdotal report, I will note that I have yet to see a S/S signature/PASSporT attached to ANY calls made *to* ANY of our TFNs, via any of the 3 SIP wholesalers we have used as both RespOrgs and for actual traffic. -- Nathan From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of David Frankel via VoiceOps Sent: Friday, July 7, 2023 7:52 AM To: 'Ivan Kovacevic'; 'Voice Ops' Subject: Re: [VoiceOps] STIR/SHAKEN warning! Ivan asks: ???How are you handling TFN atestations???? When the signer of a call gives A-level attestation, it means that the signer knows that the caller ???is authorized to use??? the calling number. The signer can ???know??? that in any of a variety of ways. For toll-free numbers, the most sophisticated and secure is probably via Delegate Certificates. SOMOS, the North American Toll-Free Number Administrator, has commented about this in a current FCC proceeding: https://www.fcc.gov/ecfs/document/10605623514445/1 As the signer, there are other ways you could determine that the caller is authorized to use the number. For example, you could solicit some documentation from them (like an invoice from their RespOrg and/or service provider) and you could call the number and verify that your caller answers. The regulations (today) do not specify exactly how you ???know??? so you (as the signer) need to act in the spirit of the rules. This problem is not unique to toll-free numbers. I might have a geographic number that I obtain from provider A (and that???s how I get inbound calls to the number), but I make outbound calls from that number via providers B and C for redundancy and cost reasons. Bear in mind that providers can set their own rules for what calls they will accept and what attestations they will assign, and those rules can be more restrictive than what might be dictated by regulation. For example, a provider might say ???I will only assign A-level attestation to calls that use calling numbers assigned by me.??? That???s their prerogative. In fact, a provider might say: ???I will only accept calls that use calling numbers assigned by me. Those calls will get A-level attestation. I will reject all other calls.??? There are no rules (to my knowledge) that prohibit providers from setting these kinds of rules. From: VoiceOps <voiceops-bounces at voiceops.org> On Behalf Of Ivan Kovacevic via VoiceOps Sent: Friday, July 7, 2023 7:27 AM To: Voice Ops <voiceops at voiceops.org> Subject: Re: [VoiceOps] STIR/SHAKEN warning! Hopefully on-topic. How are you handling TFN atestations? Although a part of NANP - it's a different technology at the network level in terms of chain of authority and routing. RespOrg manages the number, but can provision and use many carriers to make outbound calls using the TFN Caller ID (and to receive inbound calls via the same TFN)... RespOrgs is not necessarily a carrier - who and how checks that RespOrg has the authority in case of delegated attestation. I may be overcomplicating it in my mind.. but it doesn't feel like the regulation maps 1-to-1 over to TFNs... Just wondering what everyone's experience is. Thanks, Ivan

2 1

STIR/SHAKEN warning!
by nathana＠fsr.com July 7, 2023

July 7, 2023

Good catch. I just casually scrolled through the list of companies in the Robocall Mitigation Database & stumbled across a Panamanian company and an Australian company that both claim to have "complete" STIR/SHAKEN implementations. Yet I can confirm that neither company shows up either in the 499 Filer ID database, nor in iconectiv's list of Service Provider accounts that they have authorized to have access to the STI-PA and to generate SP tokens. The FCC FRNs for both companies were also generated fairly recently. I wonder if these foreign companies got concerned about making sure that international calls originating from their networks were getting signed with a high attestation on ingress into the U.S., arranged for this to be the case with whomever they are interconnecting with over on our shores, thought that they had to be listed in the RMD for some reason (do they? Are int'l telecoms required to be in the RMD and file an actual mitigation plan if they want to originate calls to the U.S.?), also assumed/misunderstood that having another party sign & attest their calls for them is enough to claim a "complete" implementation, and so that's why they filed the way they did. (Trying to be generous / assume the best here.) Since implementing S/S in the U.S. requires a 499 Filer ID, it is actually kind of infuriating that the RMD does not have 499 Filer ID as a required field on their form. That would nip this issue right in the bud if they did. -- Nathan -----Original Message----- From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of Markus via VoiceOps Sent: Thursday, July 6, 2023 1:07 PM To: voiceops at voiceops.org Subject: Re: [VoiceOps] STIR/SHAKEN warning! Am 04.07.2023 um 07:35 schrieb Paul Timmins: >> What if I'm an European telecom operator and have US-based end-users (via SIP) who are calling to the US and who would like to signal their United States A-number to the called party? >> >> What if I'm an European telecom operator and have Euro end-users (via SIP) who are calling to the US and who would like to signal their European A-number to the called party? >> >> If I try to register here - https://authenticatereg.iconectiv.com/register - "Country: United States" is hard-coded. >> >> Is there a way for Euro TSPs to get STIR/SHAKEN without creating a US entity/company just for this purpose? > > I'm pretty sure it's the job of whoever is providing gateway services into the USA to sign the call, and that anyone in the STIR/SHAKEN system in the US has some sort of regulatory nexus here where they could be held legally responsible. It's all about finding a throat to choke if there's misconduct. I asked iconectiv that question and now I have clarity: Me: "I have some fundamental questions about STIR/SHAKEN: What if I'm an European telecom operator and have US-based end-users (via SIP) who are calling to the US and who would like to signal their United States A-number to the called party? -> Do we need to get a STIR/SHAKEN certificate? [...]" iconectiv: "The revised SPC token Access Policy requires providers seeking to register with the STI-Policy Administrator (STI-PA) to: 1) Have a current form 499A on file with the FCC; 2) Have been assigned an Operating Company Number (OCN); [...] Me: "Since registering as 499A and getting an own OCN is only possible for US companies, I figure getting a STIR/SHAKEN certificate through you is currently not possible for non-US companies. Is that correct?" iconectiv: "That is correct." The confusion also came from the fact that many non-US companies that registered in the Robocall Mitigation Database - https://fccprod.servicenowservices.com/rmd?id=rmd_listings - chose "Complete STIR/SHAKEN implementation" or "Partial STIR/SHAKEN implementation", which, unless they also have a US subsidiary, seems to be a lie. Probably they chose something that looked cool in the dropdown box, or were too lazy to develop a Robocall Mitigation Plan (this is what you gotta upload as DOCUMENT if you choose "No STIR/SHAKEN implementation". I also noticed some non-US companies just uploaded some random document to the database, like a high school report or just some random letters or words... so much about the quality of that database. Good luck Markus _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

3 3

STIR/SHAKEN warning!
by nathana＠fsr.com July 6, 2023

July 6, 2023

Good catch. I just casually scrolled through the list of companies in the Robocall Mitigation Database & stumbled across a Panamanian company and an Australian company that both claim to have "complete" STIR/SHAKEN implementations. Yet I can confirm that neither company shows up either in the 499 Filer ID database, nor in iconectiv's list of Service Provider accounts that they have authorized to have access to the STI-PA and to generate SP tokens. The FCC FRNs for both companies were also generated fairly recently. I wonder if these foreign companies got concerned about making sure that international calls originating from their networks were getting signed with a high attestation on ingress into the U.S., arranged for this to be the case with whomever they are interconnecting with over on our shores, thought that they had to be listed in the RMD for some reason (do they? Are int'l telecoms required to be in the RMD and file an actual mitigation plan if they want to originate calls to the U.S.?), also assumed/misunderstood that having another party sign & attest their calls for them is enough to claim a "complete" implementation, and so that's why they filed the way they did. (Trying to be generous / assume the best here.) Since implementing S/S in the U.S. requires a 499 Filer ID, it is actually kind of infuriating that the RMD does not have 499 Filer ID as a required field on their form. That would nip this issue right in the bud if they did. -- Nathan -----Original Message----- From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of Markus via VoiceOps Sent: Thursday, July 6, 2023 1:07 PM To: voiceops at voiceops.org Subject: Re: [VoiceOps] STIR/SHAKEN warning! Am 04.07.2023 um 07:35 schrieb Paul Timmins: >> What if I'm an European telecom operator and have US-based end-users (via SIP) who are calling to the US and who would like to signal their United States A-number to the called party? >> >> What if I'm an European telecom operator and have Euro end-users (via SIP) who are calling to the US and who would like to signal their European A-number to the called party? >> >> If I try to register here - https://authenticatereg.iconectiv.com/register - "Country: United States" is hard-coded. >> >> Is there a way for Euro TSPs to get STIR/SHAKEN without creating a US entity/company just for this purpose? > > I'm pretty sure it's the job of whoever is providing gateway services into the USA to sign the call, and that anyone in the STIR/SHAKEN system in the US has some sort of regulatory nexus here where they could be held legally responsible. It's all about finding a throat to choke if there's misconduct. I asked iconectiv that question and now I have clarity: Me: "I have some fundamental questions about STIR/SHAKEN: What if I'm an European telecom operator and have US-based end-users (via SIP) who are calling to the US and who would like to signal their United States A-number to the called party? -> Do we need to get a STIR/SHAKEN certificate? [...]" iconectiv: "The revised SPC token Access Policy requires providers seeking to register with the STI-Policy Administrator (STI-PA) to: 1) Have a current form 499A on file with the FCC; 2) Have been assigned an Operating Company Number (OCN); [...] Me: "Since registering as 499A and getting an own OCN is only possible for US companies, I figure getting a STIR/SHAKEN certificate through you is currently not possible for non-US companies. Is that correct?" iconectiv: "That is correct." The confusion also came from the fact that many non-US companies that registered in the Robocall Mitigation Database - https://fccprod.servicenowservices.com/rmd?id=rmd_listings - chose "Complete STIR/SHAKEN implementation" or "Partial STIR/SHAKEN implementation", which, unless they also have a US subsidiary, seems to be a lie. Probably they chose something that looked cool in the dropdown box, or were too lazy to develop a Robocall Mitigation Plan (this is what you gotta upload as DOCUMENT if you choose "No STIR/SHAKEN implementation". I also noticed some non-US companies just uploaded some random document to the database, like a high school report or just some random letters or words... so much about the quality of that database. Good luck Markus _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

2 1

800 Lookup
by voiceops＠ics-il.net July 6, 2023

July 6, 2023

Is there a better place to look up toll-free number information than https://www.800forall.com/SearchWhoOwns.aspx ? My only connection to that is a Google search. As we're auditing our invoices, I'm finding services we're being billed for that don't match current customers. I think I can get everything I need from the above link, just didn't know if there were better or more appropriate tools out there. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest Internet Exchange http://www.midwest-ix.com

1 0

SentryPeer: A distributed peer to peer list of bad IP addresses and phone numbers collected via a SIP Honeypot
by ghenry＠suretec.co.uk July 4, 2023

July 4, 2023

Hi all, I hope you don't mind the post, but thought this might be of use and in the spirit of release early, release often I've done an alpha release: https://github.com/SentryPeer/SentryPeer There's a presentation too if you'd like to watch/read where I hope to go with this: https://blog.tadsummit.com/2021/11/17/sentrypeer/ Working on the API and web UI next, then the p2p part of it. Feel free to submit any feature requests or have a play :-) Thanks for reading and any feedback is welcome! -- Kind Regards, Gavin Henry.

4 9

TWC Voice Contact
by calvine＠gmail.com July 3, 2023

July 3, 2023

Does anyone have a contact at TWC/Spectrum Voice NOC? It appears they or their downstream is route advancing after ringing starts, preventing called numbers' Remote Call Forwarding from working.

1 0

STIR/SHAKEN Deadline June 30th
by marylou＠backuptelecom.com June 28, 2023

June 28, 2023

Hey all! Just a quick reminder regarding the June 30th Deadline for STIR/SHAKEN compliance. First of all, if you've completed the process of getting your certificate and signing calls, don't forget to do the final step which is updating the status of your Robocall Mitigation Plan. I just looked today and there are still lots of companies listed as partial or No STIR/SHAKEN implementation. https://fccprod.servicenowservices.com/rmd?id=rmd_welcome Also note, even if you have signed an agreement with an underlying carrier to sign your calls for you, you still need YOUR OWN TOKEN/certificate! I've been told by multiple phone companies that they didn't think they had to do anything for this deadline because they signed an agreement with their underlying carrier who told them they would take care of everything. That is NOT true! Only carriers that have a direct connection with their end-user customers can sign calls with an "A" or "B" classification. If someone is signing your calls for you, they can only do so with a "C" classification and that doesn't help you at all. If you have not completed STIR/SHAKEN, please for your own sake and the sake of your customers get the process started. I would at least recommend that you at the very least register with the STI-PA by this Friday at the link below. https://authenticatereg.iconectiv.com/register If you have customers, register as a service provider. If you need help or have any questions, feel free to call. MARY LOU CAREY BackUP Telecom Consulting Office: 615-791-9969 Cell: 615-796-1111

1 0