Please ELI5: What is the tech behind this? How is he able to do this?
Contrary to what other people said, you don't need a special line or to involve a specialized company. Almost all opensource VOIP systems allow you to spoof caller ID with a configuration setting or a little scripting/programming.
It's not illegal to spoof caller ID in the US. Many companies spoof a main call-in number from all of their employee's desks. Some morally bankrupt companies like the New York Times have been found to spoof invalid phone numbers when they harass people through their phone system.
These robo-callers call my cellphone at all hours of the day and night. It really reduces my quality of life. I have to have my phone on at night because I'm perpetually on call. There was a span of nearly a month where I was woken up between 1AM and 3AM by someone telling me I won a cruise vacation.
Caller ID spoofing is probably the technology that best shows how poor engineering when thinking through communication protocols can have a massive negative impact on the world.
Caller ID spoofing is also the technology that allows people to "SWAT" celebrities all the time (using just a home PC) with virtually zero chance of ever getting caught.
The kind of odd thing is that these robo-calls have programmed such a gut negative reaction in me to anyone calling me that I will now go to great lengths to not do business with any company that calls me on the phone. Due to getting unrequested phone calls from them, I've dropped a domain registrar, an x86 server manufacturer, and an insurance company. One voice call is all it takes and I am done with the company... even if it is during business hours. I just cannot, and will not, work with a company that calls my personal cell phone with out first being asked to.
If his service was purely playing an automated IVR message and the live call center he hot-transferred to was someone else, I could see him making a custom solution to cut costs. But it'd be fairly easy to make that volume of calls via most enterprise level autodialers without raising any eyebrows as long as there were enough agent licenses to support it.
Most autodialers bake in regulatory compliance functionality and warnings, but the laws that apply are so specific to an individual user that those features can be disabled or overridden and they leave it up to the client to understand what laws their calling must adhere to.
For example, the guy in question would have been legally fine to spam 100mm calls in three months if they had been business landlines, as the federal law they're leveraging for their fine only applies "to emergency phone lines, wireless phones, or residential telephone lines"[1]
[1]In the first paragraph of the order: http://transition.fcc.gov/Daily_Releases/Daily_Business/2017...
:) I hate to break it to you, but phone companies aren't really all that interested in shutting anything down. It's a multi-faceted problem. There isn't a good (agreed upon) way to authenticate calls. Even if that were the case, phone companies are not going to be jumping on the idea of retrofitting the old parts of the network with reverse proxies for this new authenticator.
[0]: http://www.sangoma.com/products/digital-telephony-cards/