FCC will require phone carriers to authenticate calls by June 2021 [pdf]

https://www.justice.gov/opa/pr/district-court-orders-injunct...

I've encountered robots in the last 6 months that have started with "Hello?" when I didn't say anthing. It tripped up my Turing Test at first, but eventually hit an ALICEBot-like moment that crashed the whole thing down.

I work with phone systems. It's usually determined by how long they hear a continuous sound at the start of a call. If it's relatively short (and it can be adjusted by settings), it assumes it's a live voice (like someone saying "Hello?" is usually pretty short). If it's continuous for a certain period of time, it assumes it's a voicemail.

For our speech applications we have different behaviors depending on which call disposition is detected (that's the term for this, also determines things like invalid phone numbers).

Sometimes when testing speech applications I'll pick up and scratch the receiver continuously or speak without taking a pause until the voicemail disposition is triggered so I can test a voicemail message without having to check voicemail.

We make these calls on behalf of health insurance companies for health reminders and surveys, so our calls are more legitimate than most, but we do use an autodialer to reduce the load on our live agents.

This is a naive assumption. I've come across robocallers that do exactly this. It is sort of trivial, if you think about it.

The times it has failed me is, actually, right now. I put in a call to have a delivery, maybe the last four digits are 4700- I've plugged that number in. But the guy calling me back calls on 4709 and gets VM. So I have to remember to turn this off if I'm expecting a delivery.

I do the same thing. I moved and my old number is forwarded through google voice. Everytime i get a call from my old area code I know it is a neighbor spam call as no one calls me from that area code anymore.

It's gotten so bad i let my calls go to voicemail now.

Robocalls shove someone else's voice into your ear, without offering you an ear in return. They signal a synchronous communication, and then reneg on that promise with a spammed asynchronous message.

"Political speech" is the same as every other kind of speech. There should be no exemptions for policy just because someone running for office is involved. They have the same duty of courtesy as everyone else, and we have the same right to block our ears from their spam messages as businesses and scams.

No idea if it worked, but it was the least I could do to halt progress in the wrong direction.

I know nearly nothing about telco software but after working at enough big places I suspect one likely answer is "because it's monstrously complex for both technical and human reasons, moreso than it might seem at first".

So now I can't help but answer calls from unknown numbers even though I know 999 out of 1000 of them will be spam. It's abusive and an incredible waste of everyone's time and energy, not to mention in my case I wasted 10 minutes of critical time I should have been with her at the hospital.

See [1]

It basically asks the telecom operators to implement digitally signed certificates.

So it would work, if I understand it conceptually, like your web browser, when it receives https traffic unsigned certificate, or https traffic from a domain that's not part of the certificate chain.

Therefore, this mandate will prevent 'spoofing'. And without spoofing, the spammers would necessarely have to reveal their identity, and there are already bunch of existing legislation to prevent them from doing this type of business.

I missed important business calls when in US. Because they were calling using same area code where my sim card was registered, so I thought it was from the area local to me.

It is horrible, I am sure people actually lost not just business value, but also had negative health impacting incidents, due to this abuse of telecommunications.

[1] https://transnexus.com/whitepapers/understanding-stir-shaken...

All the major carriers are implementing a STIR/SHAKEN strategy that should be in effect by next year. But it is complicated to do and there may still be problems when they do - as others have explained here it's not as simple as it first appears.

I don't have any sympathy for the operators in this. They've profited from this for long enough and ignored the problem. There's a lot of pressure on them to solve it and the impression I have is that there's no appetite for "the dog ate my homework" excuses from regulators so let's see.

So far my guess is ‘the forties’. Or maybe the fifties, with all the ‘atomic’ ridiculousness.

Seems to target spoofing. If they can eliminate spoofing it should make tracking down bad actors easier which should ultimately put many of them out of business.

Pixels also have their own solution to this: If that condition occurs, the Google Assistant will answer the call and auto-decline if it is actually a robocall.

Because of this, you can just blacklist spammers again, and burner numbers for them become harder to come by.

Step 2 is to start to put the fraudsters in jail, now we can figure out who they are.

This also means easier blacklisting for the client.

I get this too. Which is great, my being a New Yorker who hasn’t had a driver’s license for close to a decade.

I don't know if it's actually Marriott or not. I suspect it's just one of those "affiliate marketing" scumbags, but it still makes the brand look bad.

I even hit them with "But YOU called ME with this extremely urgent notification! It's my last chance, you gotta help me!", but sadly I couldn't get her to give me a quote.

Would you decide to set it up to call over 40 different countries in europe? Each with their own way to show phone numbers.. each carrier attempting to block spam calls in different ways.. each country virtually speaking a different language.. most countries having some different banking/credit card systems..

Or would you target the united states which everyone in the country has the same phone prefix, pretty much all speak one language, banking/credit card system is the same, etc.

It just makes sense for scammers to target the US. You can target hundreds of millions of people the exact same way.

It's the price we have to pay for Freedom (TM).

The USA's implementation of caller ID does not require telephone providers to verify that the caller ID provided to them is real (prior to this order).

It also lacks the regulatory structure to "trace" (prosecute/fine) calls through the various interlocking copper, cellular, and internet telephony networks, even when each provider in the chain has data.

It also lacks the legal experience in knowing how (and the political will) to prosecute an individual who dials random phone numbers with an app on a cell phone using a prepaid SIM card and conferences whoever they're calling into a spam line to disguise the spam line's phone number.

Finally, our regulatory system is captive to politicians who depend critically on spam calls for political purposes, and continue to fight to have those calls exempt, making it vastly more difficult to stop all robocalls because some are legal and others aren't.

That and you know.. breaking the law has actual consequences for both spammers and telcos.

Every time this topic comes up on HN, someone asks that same question.

Then there's a bunch of responses that are lots of suppositions.

Then several people from small European countries chime in saying they've never had a spam call.

Then a bunch of Europeans from large countries show up saying they get spam calls, too, and it's not just an American thing.

"Why is this problem unique to the USA?" is pretty much a meme at this point.

Also...

You start with "Why is this problem unique to the USA?" Then follow immediately with, "I'm not saying I never get spam calls" which means it's not unique to the USA. So your first sentence is invalid.

Starting back in 2018 or so there has been a big problem in Australia with scam robocalls claiming to be from the Australian Tax Office. The area code on the phone number said it came from Canberra (Australia's national capital) which made it look more legitimate–even though in reality the call was coming from an overseas call centre. The robocall started out by saying that you owe a tax debt and the government was about to commence legal action against you. I got several, most people would hang up realising that the tax office would never do that. (It is illegal for them to discuss your tax affairs without confirming your identity first, so they would never begin a call by saying you owed them money.) But, some people (many of whom were older/vulnerable people), stayed on the call until the live operator connected. The live operator would then pressure them to go to a store and buy thousands of dollars of gift cards (such as Apple iTunes gift cards) and then read the gift card details out over the phone.

So this definitely is not a problem unique to the US. And other countries have been taking action, see e.g. in Australia – https://www.zdnet.com/article/acma-proposes-three-point-acti...

(Definitely the incidence of these fake calls appears to be falling, in my personal experience, so I think the Australian authorities'/industry's attempts are producing some results.)

I assume it's simply more worthwhile to create a fraudulent scheme aimed at a larger population with more potential marks.

a) it's a large market with a large penetration of internationally chargable credit cards. Several countries in the EU have their own payment systems including a bunch on a push model --- it's hard to scam germans over the phone because it's going to be hard to get them to send you funds without a german bank account; and if you have a german bank account, that's going to get you caught. Everywhere can process US visa and mastercard though.

b) large community that can be addressed with a single language; yes, there's a lot of people who would prefer another language, but they can probably be scammed in English (Although, with a bay area number I do get a good amount of scam calls in Chinese).

c) last, but probably most important; outbound calls to the US are incredibly cheap, as long as the number is not in Alaska. It's easy to find retail voip offers for less than 1 cent per minute to US numbers; and it doesn't matter if it's a landline or a cell phone. Calls to most EU mobile phones are at least 10 cents, but many countries are closer to 30 cents. That adds up quickly.

Until this HN post it never occurred to me that you could spoof phone calls. While landlines used to get lots of spam calls, perhaps I've had just two of these calls to my mobile in my life. Each time I typed the number into google and found reports of that number being spam. And maybe less than 20 spam sms's.

Does this mean that other countries (such as Australia) do not allow spoofing of numbers?

If that were easy we would have solved email spam too, 20 years ago.

The legitimate use case is basically: I am placing this outbound call over VOIP or a different phone line, but I want this ANI to show up on the callee's phone, so when they call back they go to the correct line (dentist's desk, software sales line, whatever)

Google Voice works by acting as a proxy for outbound calls. You dial your friend's number, your phone dials Google, who in turn dials your friend with your Google Voice number displayed. Since Google is the legitimate carrier for your Google Voice number, I can think of no reason why they wouldn't be able to correctly sign the call.

Additionally, Google is listed as one of the companies that the 14 companies that the FCC appears to be working with (see the table towards the bottom of https://www.fcc.gov/call-authentication), so I assume they are planning to use it for Fi and hopefully Voice as well.

Had to hop onto my VPN to view.

Edit: Ok, at least not viewable in the UK!

The Do Not Call list has been around for almost 30 years.

https://en.wikipedia.org/wiki/Do_not_call_list

It will be interesting to see who will be running the CA for these connections.

* http://jdebp.uk./FGA/truths-about-telephones.html#CallerID

These concepts could be applied towards that purpose if the MNOs wanted to rejigger messaging within their networks & for inter-carrier connectivity- but pursuing that solution would likely be more challenging to implement than this solution.