Hacker News Reader

Comment by ravenstine | Hacker News Reader

I see people here saying that spoofed numbers is the problem. Maybe it's a big part of it, but at the end of the day, the phone companies are complicit with the criminals because there's no good reason that these robocalls can't be treated like a DoS attack.

These crooks make millions, of calls every year. My first employer was apparently making robocalls, though none of us were aware of it(there was a call center with actual human beings), and they were cracked down on by the FTC a few years ago.

https://www.ftc.gov/news-events/press-releases/2017/01/ftc-a...

The way I see it, there's no good technological reason why a system couldn't detect millions of calls coming from one place, compare that with the number of complaints and number-spoofs, and trigger an investigation. The dinosaur phone system needs to either go extinct or be reformed, and the telecom companies don't give a fuck. Every time I've asked either T-mobile or AT&T to block the relentless robocalls, they tell me to install some 3rd party Android app that fails to effectively block calls.

View on HN

Yup. It’s amusing to see people think there is some hard technical problem here.

Tie the problem of robocalls to the telcos losing money, and this problem will solve itself in months.

It would literally be a day. They pass the legislation and they would stop.

The lack of political will and the form of legislation are the questions.

If the rule is that telcos must eat the cost of a scam, they will drag it out in court and the consumer must still prove it.

If the rule is that each robocall that makes it through must be paid by the telcos (take the consumer out of this), then telcos will battle each other to try and insist that the other party is responsible.

At some point they may even come to a consensus and protocol that protects the customer.

I prefer this option.

There may be other options. Just don’t put the burden on the individual customer.

Edit: Even better, allow bounties so that lawyers can start hunting for robocalls that went through.

Set up a government department with a dozen people and a thousand phone lines distributed around the country and with different telcos. Record every call received. Fine telco $100k for every robocall. Increase fines steeply over time.

Way too complicated. Much easier would be to get a warrant for a trap and trace on the line known to be receiving these calls. Then disconnect the robocall lines.

> If the rule is that telcos must eat the cost of a scam, they will drag it out in court and the consumer must still prove it.

> If the rule is that each robocall that makes it through must be paid by the telcos (take the consumer out of this), then telcos will battle each other to try and insist that the other party is responsible.

I don't necessarily see these as guaranteed outcomes. You don't see this kind of behavior for banks, which are generally the ones liable for credit card fraud.

And then they'll add on a monthly robocall prevention fee to your bill. :P

They're testing the waters for that already, https://www.zdnet.com/article/at-t-to-auto-block-fraud-roboc...

These new telco blockers only work on VOIP lines, not copper-wire POTS phones. The service is not even available for POTS, it's only the major telcos creating a /r/selfhosted RoboKiller who make it available for the kinds of phone lines that go down in a power outage..

> It’s amusing to see people think there is some hard technical problem here.

One of the primary users of robocalls are politicians. I'm sure they'll get right on legislating against it. /sarc

(US) Politicians already gave themselves a loophole into unlimited unsolicited spam. So cleaning up other spammers would strengthen the quality of their spam channel, as consumers would be less jaded/more likely to pick up.

Does that loophole also apply to political action committees?

Yes. If the content of the message is "political speech" it is exempted from CAN-SPAM (which also covers cell phone calls) as an extension of first ammendment rights, regardless of who is doing the speaking.

https://www.ftc.gov/news-events/blogs/business-blog/2015/08/...

> (which also covers cell phone calls)

No, you are absolutely wrong. CAN-SPAM law for email is under the FTC's regulation and does nothing to restrict the ability of marketers to send initial unsolicited mailings. This isn't a first amendment question of exemption, the FTC is not authorized by statute to regulate noncommercial activity like a political campaign.

TCPA regulations for cellphone marketing are under the auspices of the FCC. You cannot send unsolicited commercial SMS and calls legally (there are some exemptions for pollsters and nonprofits). TCPA law also applies to political campaigns: https://www.fcc.gov/political-campaign-robocalls-robotexts

My non-tech savvy 82yo father has made a similar point to me: all these garbage phone calls that I get every day make me not trust ANY phone call that I receive. You'd think this would upset legitimate businesses that need to make calls.

Business would be a bit better if there weren’t robocalls. But free-rider/coordination challenges make it difficult for the diffuse category of all businesses to group together and fight it.

I got two unwanted robocalls in the last twenty years (central europe). This seems like a profoundly american issue.

Lucky you. Approximately no one in the countries that these calls originate from speaks any central European language, so they don't call.

AFAIK they're not a problem here in Australia either, and the language here could (charitably) be called English. I've never received one of these calls.

Aussie here, I get the odd one on mobile, but get a couple a week on my land line numbers.

Land line numbers are also registered with Do Not Call, but doesn't make any difference.

Answer the call and there will be either:

1) a few second pause and then a person will drop in with the call centre voice noise in the background.

2) a few second pause and if there is no sound (you saying "hello") it will hang up.

Those are usually from international call centres. In terms of locally based ones, got a couple during the election with a recorded voice saying "this is an important message from XYZ politician".

Unwanted calls are an issue in France as well afaik. Not necessarily robocalls but the fact that there isn't a way to opt out from advertising calls (in contrast to Germany's Robinson-Liste) is very annoying.

There is a do not call list (i don't know how it compares to Robinson). It's called Bloctel. But it's not really effective.

Americans are not uniformly harassed, and I am sure people in your country aren't either, so your sneering conclusion is baseless.

#robocall complaints (USA, 2018): 3.8 million

#robocall complaints (Germany, 2018): 13375

https://www.ftc.gov/policy/reports/policy-reports/commission...

https://www.bundesnetzagentur.de/SharedDocs/Downloads/DE/All...

The word "uniformly" is key here, and why many generalizations fail, as well as being unfair and offensive.

I'd also doubt assumptions such as people are equally likely to report, it's equally easy to report, counting is done the same way, etc., so I don't think your response is sufficient to characterize the average.

I'm in the UK. I get about 2-3 a week on the landline, 1-2 a week on the mobile. 30% "This is Microsoft/your ISP, your computer is hacked", 30% "You were involved in an accident that wasn't your fault", 10% oven cleaning services. I suspect that English speaking scammer call centres are a reason for this.

To do that they’d have to turn the open system into a walled garden. They’d simply stop taking incoming calls from networks they didn’t trust. This would be exactly the same as saying ‘email providers can easily solve the spam problem, they should just adopt the Facebook Messenger model’.

Architecturally there's no binding between phone number and subscriber identity except at the very edge of the network, for the very smallest retail customers. There is a design to federate this binding throughout the ecosystem using a PKI called STIR/SHAKEN [0], but it's absolutely a hard technical problem to get that rolled out 100% without breaking things.

[0] https://transnexus.com/whitepapers/shaken-as/

> because there's no good reason that these robocalls can't be treated like a DoS attack

The problem here is that the origin can be spoofed.

You are imagining a system where a telco like T-Mobile connects the caller directly to you. That's not how it works. The connection chain could look like this.

bad caller 111-1111 -> A -> B -> C -> T-Mobile -> you 999-9999

All T-Mobile knows is that 111-1111 is calling 999-9999 and that the call was routed from C, it does not know about A, B, or the true identity of the bad caller.

That's also why spoofed attacks are also a problem on the Internet. These systems were not made with spoofing in mind, and it will cost a lot of money to get these companies to switch over to a new system seamlessly that can detect spoofing.

How much is "a lot", though? We already have $billions sloshing around in telecom.

I don't know but I would imagine it would be as annoying as getting everyone to switch from ipv4 to ipv6 in 1 or 2 years.

So then T-Mob calls the NOC at C. Tells them to get this stopped and they have 24 hours, or they'll depeer.

6 hour later, C's NOC calls B's NOC, saying to knock it off, and they have 18 hours or they're getting booted.

6 hours later, B's NOC calls A's NOC, saying to knock it off, and they have 12 hours to figure it out or they're getting booted.

In under 12 more hours, A cuts off 111-1111.

If peeringDB is to be believed, big providers all require their peers to have a 24/7 NOC number to call.

I agree completely. I work for a small ISP and we sometimes do the same thing for significant bad actors abusing our network. A phone call to the NOC of the ISP hosting the abuser or the NOC of their upstream transit providers usually gets the ball rolling pretty quickly.

That approach is obviously not very effective in a DDoS scenario, but as I understand it these robocalls typically originate from a handful of different VoIP termination services -- as opposed to tens of thousands of hosts in a DDoS scenario.

Exactly. Creating a proactive system might be difficult, but the apparatus is all there for being reactive.

Yet this has been going on for years, so I suspect shenanigans by providers too happy to continue charging their Tier7 peers for access.

I think this a great challenge to propose to the HN crowd. Who wouldn’t pay for a system that truly eliminates the annoyance of spam calls? What about a private network that people could subscribe to that uses a decentralized social credit system? Or one that uses a monitoring gateway to track the number of calls originating from a number (either internal or external to the subscriber group), and treats mass callers with extreme prejudice. A blacklist of known spammers could be applied first as a default (rather than as an add-on app). If you wanted to get really creative, you could give subscribers the tools to add numbers to their own black list far more easily than they now can, and maybe even block whole geographic regions.

> Who wouldn’t pay for a system that truly eliminates the annoyance of spam calls?

Anyone in a region with sensible legislation.

How does T-Mobile know there's a problem worth calling the C NOC about? One way is to see the frequency and duration of calls. Lots of very short calls indicate spammy behavior. So if you are B, you offer SIP trunking at below cost to legitimate customers, so that you can mix their call flow with the much more lucrative, 100% robocall traffic from A, and thereby stay on favorable terms with C.

I worked in this business briefly, the economics are fascinating. Your average mom and pop restaurant is very likely buying its VoIP transit from an entity like "B" in this story.

> How does T-Mobile know there's a problem worth calling the C NOC about? One way is to see the frequency and duration of calls.

Or make it easier for consumers to report spam calls. For example, dial *666 after hanging up on the spammer and it reports the last call as spam. Enough abuse reports originating from a particular carrier and T-Mobile knows there's a problem. That's basically how it works for email spam and other forms of Internet abuse.

Android seems to make it convenient to report and supposedly block spam calls these days - so where do those reports go?

AT&T Also has a dedicated app for reporting the callers.

I would pay to have a "AT&T Certified" icon on incoming phone calls. Maybe the carriers can set up peering agreements and both AT&T and Verizon work. The vast majority of people I care about are on those carriers and I can forget about the rest.

It's very hard to reform the whole system, but you have to start somewhere and this could be how.

That is a really great idea. Every time this comes up it boils down to "phones are old and complicated, and there are a billion unique telcos". Great. But if I only do legit business over 3 of them, why not indicate if I am leaving the "trusted zone"?

> I would pay to have a "AT&T Certified" icon on incoming phone calls.

Call verification is already here and rolling out progressively. System is called STIR/SHAKEN. iOS supports it as of 13.something. The UX is terrible though, all you see is a checkmark after the caller in the call log. Android might have a better situation on some phones, this system is carrier dependent. More about it here: https://www.fcc.gov/call-authentication

There are scenarios where it doesn't work. Calls routed through Google Voice to my T-Mobile line will never show this checkmark. Also, not showing it onscreen for unknown incoming calls defeats the purpose, really not sure what Apple was thinking.

I wonder if Twilio will support that. I route my GV to Twilio and then to T-Mobile to run custom logic on incoming phone calls (like filtering out all incoming calls that match the first 6 numbers of my number). Would be nice to passthrough verification.

How do you determine what 111-1111 is? CID? ANI? Some other means?

If T-Mobile doesn't know who is really the originator, how the cost of call gets attributed? Wouldn't this mean I can just use their network without paying them as no one know how to identify me?

I'd be happy with at least providing the actual source name and number, in addition to the CNAM. CNAM must still be associated with the same source account (and ideally enforced, somehow).

Best of both worlds.

What do you mean the actual number? The number is set by the caller as part of the SIP INVITE

The phone company has a source number for calls coming from outside their system for billing purposes. I want that number.

Edit: At a minimum, an out of system call should display what system / exchange it originates from. That at least helps solve neighbor spoofing.

Yeah it's bonkers they allow this still. No good actor ISP is going to knowingly let improperly sourced traffic transit networks...

Oh how I wish that was actually true.

I mean, yes there are bad actor ISP's that allow it, but his statement is accurate due to the caveat.

The middle (ntt, gtt, tata, etc) of the internet doesn't know what is or isn't spoofed. The folks at the edge own that responsibility and most colo/hosting shops allow their customers to spoof. Their upstreams are powerless against them since they'll take their money elsewhere.

Lol, that’s not the definition of “powerless”. There are many ISPs more than willing to reject peering with dumpsters.

Not talking about peering. Talking about transit-customer relationships. Think large hosting shops who say they can't afford to do uRPF on their customers because they've got so many multihomed users and the IP address space is fluid. Or smaller regional networks selling low cost transit. Some folks just have arbitrary limits (you must have x asns behind you for us to remove urpf)

Yeah, one would think that a national phone carrier would only send through properly sourced data. But I can tell you from experience that no, they let through garbage. I regularly see "phone numbers" like "11111111111111" or "0000000000" or even "01120155512121234". They act like they're the phone company and don't have to care ...

I don't know how Google Voice did it, but I rarely if ever got a robocall when I had Google Voice. After leaving Sprint (and losing Google Voice after years of having it) I get them all the time. T-Mobile catches a few here and there, but I get so many damn spam calls. I just have my phone on mute.

GV's block of phone numbers is probably considered low-value targets. Scammers get more value by talking to customers from big telcos. It's the whole "you don't have to outrun the bear, just your friend" kind of thing.

I'd say I get an equal number of robo-calls to my cell phone number, and my Google Voice number which forwards to it. Might have something to do with the area code.

That's changed- I get calls all the time on my GV number. I think the initial "success" might have been due to the number blocks being previously flagged as unused. Especially when the minimum block size was still 10,000.

This is exactly correct. The phone companies could charge $9/minute to any call originator who wasn't showing the actual number on the call, and this activity would stop. Conversely, the FCC could make any telco that carries a robo call 50% liable for any fines associated with that robo call. That too would stop this crap in its tracks.

They could charge 0.01 per call and it would stop.

"The phone companies could charge $9/minute to any call originator who wasn't showing the actual number on the call"

How could this work in the current environment, given that:

- termination rates (the rates paid to the recipient's phone company for delivering the call) are regulated, and can't be set arbitrarily high

- phone companies have no way to check whether the outbound caller ID I present is also a valid inbound number for me

- even if they did, it's cheap to get a number in every area code (maybe $1/month/number) and cheap (1 cent per minute) to have calls to that number to delivered to me via VoIP (so I can rightly claim that the outbound caller ID matches my 'actual number')

If you could enforce that the outbound caller ID matched a valid inbound number, that would solve a lot of problems. (1) if a number is used for spam a lot it’s gonna get blocked; rotating through a bunch of numbers per area code does get somewhat more expensive over time (and they could probably enforce a fee for connecting/transferring a number). (2) it solves the problem where regular people get accused of spamming because they were spoofed, (3) it solves the problem of fake law enforcement or government agencies “calling” you from legit LE phone numbers.

Sure, spammers could still get tons of numbers, but straight up spoofing would vanish, and that’s a big enough win.

Hiding the originating number/account is the entire profit center for the LECs. My impression is that they're not going to give it up without legislation.

The short version is the ani/ALI is totally traceable, they don't want to be on the hook for it, and the FTC/FCC don't try very hard at all to deal with the problem.

It’s possible, but telcos won’t do anything without a regulation, and because a few politically influential companies in tiny states make a lot of money, that won’t happen.

Isn't modern phone infrastructure all over IP for the backbone, anyway? I was under the impression that it was only the line to the house that was analog.

Digital, yes. IP, unlikely. Given that most of these companies are traditional phone carriers, it is more likely to be ATM (https://en.m.wikipedia.org/wiki/Asynchronous_transfer_mode)

No, not all. You can still get copper-wire POTS lines.

Telecoms can't block calls. They are not legally allowed to do it.

We can and do block calls under certain circumstances, i.e from Invalid or Unallocated ANIs.

This doesn't appear to be universal then, because I've been told by Telcos in the UK and France that they will not block calls even when the presented number is impossible.

It was made clear that any call that was made to one of my numbers would be delivered irrespective of any faulty components visible to me in the SIP header.

Well this is certainly jurisdiction-dependent.

e.g. the CRTC has policy 2018-484, Implementation of universal network-level blocking of calls with blatantly illegitimate caller identification: https://crtc.gc.ca/eng/archive/2018/2018-484.htm

CRTC gave telcos twelve months to implement, and it seems to have largely been implemented within that time frame.

If I need a phone number (and a phone), I go to T-Mobile, sign up with my credit card and get a phone number. Whoever is giving me this phone number, I think, should be held responsible if I'm doing stupid calls.

The companies issuing the ability to robo-callers to do their work are enabling robo-callers to do their work (scams).

Last time I tried to trace down a call, I stopped at a company called OnVoy and got distracted with other issues...

Not a good idea. I get where you’re coming from, but we don’t hold ISPs accountable for people using the internet badly. That would be a change for the worse.

Imagine if Comcast had to terminate your service due to something someone posted while using your wifi.

I think corporations should not be treated as people. No carrier should be able to block me if I’m being an asshole, but they definitely should if I’m a corporation and harassing their customers for a living.

That already happens:

"AT&T Threatens Persistent Pirates With Account Termination"

https://torrentfreak.com/att-threatens-persistent-pirates-wi...

The question isn't "can this be done?" It is: can this be done, fairly, effectively, reasonably, and with appropriate safeguards?

The fundamental principle of regulation is that it applies methods and actions which can be harmful if misused. The key is to ensure they're not misused. Not to ban the concept of regulation entirely.

My phone can, but spoofing obviously circumvents that.

It's better this way. Slippery slope and all. Before you think I'm being alarmist, google drag queen storytime.

Edit: if you're downvoting, look it up, there are convicted child sex offenders doing this.

Convicted child sex offenders doing what? I googled "drag queen story hour" and I have no idea how it connects to call blocking and telecoms.

Example of slippery slope.

I'm still not following. What do you consider "drag queen storytime" a slippery slope to/from? For that matter, which end of the slope is it?

Are you aware that the "slippery slope argument" is a logical fallacy? https://en.wikipedia.org/wiki/Slippery_slope

So you just saying that telecoms has to kill hen that laid a golden egg

What a nonsense

What's wrong with relying on your terminal device to decide whether to ring the call? That's the definition of a smartphone. In fact, Android has native spam blocking: https://www.forbes.com/sites/brookecrothers/2018/12/30/in-20... but it's quite reasonable for you to install whatever filtering app you choose.

If you don't feel safe installing software on your phone, that's a problem with your phone OS.

I use Android's built-in spam blocking and have received 7 spam calls since Nov 1. It only blocked 1 of these.

What's wrong is I shouldn't have to, the fact that incoming crap-calls with spoofed IDs get through at all is a problem with the network.

Now pretend that you're providing solutions for devices that aren't cellphones.

Reply on news.ycombinator.com