Hacker News Reader

> Auto-dial systems will route the call to a person when they get a "live" response. I don't know the criteria but I'm pretty sure it's them detecting noise on the call (which could be voicemail).

I work with phone systems. It's usually determined by how long they hear a continuous sound at the start of a call. If it's relatively short (and it can be adjusted by settings), it assumes it's a live voice (like someone saying "Hello?" is usually pretty short). If it's continuous for a certain period of time, it assumes it's a voicemail.

For our speech applications we have different behaviors depending on which call disposition is detected (that's the term for this, also determines things like invalid phone numbers).

Sometimes when testing speech applications I'll pick up and scratch the receiver continuously or speak without taking a pause until the voicemail disposition is triggered so I can test a voicemail message without having to check voicemail.

We make these calls on behalf of health insurance companies for health reminders and surveys, so our calls are more legitimate than most, but we do use an autodialer to reduce the load on our live agents.

Neat job.

Question you might know the answer to: I've noticed it's a pretty common practice to get appointment reminders with caller ID from the doctor's office. I like that feature. I'd imagine there are plenty of other legitimate use cases for caller ID spoofing as well. Do you have any idea how that's going to work with STIR/SHAKEN?

I'd guess it's going to be some kind of oauth for your phone number, where you own it and can grant spoofing access to other entities?

Google seems to be supporting it: https://ecfsapi.fcc.gov/file/1119583115056/2018-11-19%20Goog... (via https://www.fcc.gov/call-authentication)

It's going to be a problem for some systems for sure, but as the STIR framework is used to attest the number, the caller itself doesn't need to do anything. The originating carrier then attests with a level certainty A, B or C who the caller is, and adds a crypto signature to the signaling. The key here is the attestation. If the calling carrier (usually the provider of the DID in retail but in commercial, not necessarily the same carrier) can attest by the caller, then the call will go through regardless. So tele-center company can agree with the calling carrier that, basically, tele-center company really owns the number (A) or it's more or less certain of it (B) and the call will be sent attested.

The case you are citing is not the one I would be most concerned about -- it is the spoofed numbers that should have been top priority. I get calls for different numbers (almost like they have been selected randomly) every single day selling cruises.

If you call the missed call back, you realize the person picking up didnt make the call.

Be careful calling the numbers back. There's another scam where they use the equivalent of a 900 number to do billing to anyone who calls. The scammers use country codes with 3 digits to try and trick you into thinking it's a US number and hope that you attempt to return the call.

It took this long because the fcc is run by people who simply do not believe in using government to enforce oversight.

This has been going on for a long long time - while the FCC was trying to expand it's mandate to net neutrality instead of actually doing it's job.

Well, actually...

That kinda/sorta was the mandate, until we put a telecom shill in charge.

https://en.wikipedia.org/wiki/FCC_Open_Internet_Order_2010

Where did congress grant the FCC the authorities for that order?

Ahem.

"An independent U.S. government agency overseen by Congress, the commission is the United States' primary authority for communications law, regulation and technological innovation."

Source: https://www.fcc.gov/about-fcc/what-we-do

You can have arguments until forever about what they should or shouldn't do, but their raison d'être is to set policy according to these overarching objectives.

Oh, and just to be clear, the lack of an Oxford comma in that quote is inexcusable :)

Ahem, the authority comes from Title 2 passed in 1934.

In 2005, the FCC decided that ISPs should be regulated by them. From 2005 - 2012, Congress failed to pass new bills granting the FCC this authority. It was denied by congress. In 2015, the FCC decided that they didn't congress to grant that authority.

So yeah, the FCC website claiming they have an authority is not an impartial source. Two years later, the FCC reverted back to the Title I classification.

So for 2 years, the FCC claimed a power that they were not authorized to claim.

If Congress wants the FCC to have this power they can easily pass a bill granting them that authority, they have repeatedly failed to do so.

https://en.wikipedia.org/wiki/Net_neutrality_in_the_United_S...

The very first sentence of the communications act of 1934 says the FCC exists to regulate communication by wire, congress need not pass a law granting it[1]. And what wording could the new law possibly use that is more explicit than the existing "for the purpose of regulating interstate and foreign commerce in communication by wire"

It's inexplicable that the same party that claims the act establishing the FCC is more limited than the wording states while the federal arbitration act is continuously expanded to cover cases that neither the authors nor previous courts ever tolerated.

[1]https://transition.fcc.gov/Reports/1934new.pdf

Seriously, read this - you'll learn something.

https://www.rpc.senate.gov/policy-papers/why-title-ii-is-not...

The GOP lays out an obviously slanted view about why they are opposed to the "utility-style" regulation that Title II entails.

However, this assumes that the market is functional when it's been clear since the '96 Telecom Act that it has been anything but. The idea that the FCC can't claim this authority without Congress acting first is FUBAR.

From pricing (generally higher for lower speed) to barriers to entry (the upfront cost for infrastructure is enormous), time has shown that carriers and ISPs will refuse to behave unless they are forced to.

Legislation is needed, but Republican arguments that a light touch will "preserve innovation" or some other nonsense doesn't work. 1993 was a long time ago and almost anyone who cares about this issue will tell you that Internet access is a utility (essential service, widely available, for reasonable cost) but the incumbent providers don't act like one.

(Save for maybe Google/WebPass, Sonic, and any number of municipal broadband initiatives)

Bit off topic wrt robocalls, but on topic wrt FCC mandates.

What do you think about the 'Free Press' group asking FCC to sensor Trump's corona virus updates?

Does FCC have authority to do that?

https://thefederalist.com/2020/04/02/far-left-media-group-as...

It was granted in the Telecommunications Act of 1934.

https://en.wikipedia.org/wiki/Communications_Act_of_1934

We shouldn't interfere in the free market. Those robocalls are just good old American ingenuity.

People like to razz on it for being a free market, but it's really a gov. backed oligopy.

There is alot of people that do not have a proper understanding of what free market is, and misdirect the failing of the current markets from their proper blame point (government) to what they have associated with "free markets", failing to understand the influence that existing regulations have had on those markets including elimination of competition in the market.

Telco has not been a free market, ever.

? Telecom is one of most regulated industries in the United States. Not sure why this pattern ("look how bad the free market is" @ highly regulated market) is so common here and on reddit.

I'm pretty sure they were being sarcastic.

He is criticizing the sarcasm.

Because apparently every discussion on every message board needs to be hijacked to talk about one of the internet's four favorite political narratives, if there is any marginal relationship whatsoever.

Someday we'll have A.I. to screen calls for us, and hopefully it can also screen this highly-upvoted-but-worthless tripe from message boards for us.

> here and on reddit

If you pay upvotes and karma, you get unsubstantiated politicised arguments. The feedback mechanism rewards those comments.

Indeed. I'm from the Netherlands and never, ever in my life received a robocall, and also do not know anyone else who received one.

The deep level of suffering is very obvious in your post. Everything will be okay, but you really don't know the joys of relentless robocall spam that you're missing out on.

I live in Belgium. I receive such a call on average twice a (week) day. Sometimes it's just blank call (nobody answers) sometimes they're offering gifts if I go to shop X, they ask if I want to compare my phone/energy bill.

The funniest one is when my fixed line provider (let's call it P) calls me on my mobile phone (which is another provider) and ask me if I'm one oh their (P) customer :-) (the explanation is that the mobile/fixed businesses are separated to avoid monopoly and, since they can't share customer data ('cos of data protection rules), they have to ask them again :-))

Seconded for the P. They call me every 3 months. Every single one promises they'll note in their CRM how I wont be contacted again. None can answer why they didn't read the note from all their previous calls.

Australia speaking. We get a buttload of spam calls from China (in Chinese, no less).

Parliament should get on that

I'm from the Netherlands (born and raised) and have received several robocalls, until I registered my phone number on the bel-me-niet.nl web site.

Since then, I only get such calls from companies that got my details in exchange for some freebie. I tell them I'm not interested, and would they please stop calling me, and they do.

The only calls I got recently were in English with a heavy Indian accent, "Ilse Smid" or another stereotypically Dutch name, claiming to be from Microsoft Windows, and that my computer had alerted them that it had a virus... These scam calls all came from nonexistent Dutch phone numbers.

Such a disingenuous argument. The government quite frankly ties the free-market with weird regulations that essentially prevent competition. And then we get snarky comments such as this that say "oh wow, look how badly the free-market failed". For an example of free market trying to solve this, albeit not in a great way, have a look at TrueCaller and similar software.

The regulations are not "weird". Before telcos were required to route all calls without discrimination, they didn't. And as soon as telcos are no longer required to route their competitors' calls, they stop. A recent example is the new area code for VOIP calls introduced in Germany in 2009. Major telcos just didn't route them, citing "technical reasons" despite being able to route local area numbers with the same mechanism without problem.

Competition is only a solution for problems where the telcos' interest and the consumers' interest align. And that's very rare.

I agree. Free the telcos to strictly requiring authenticated calls, so i can freely choose to ignore some calls.

extraordinary claims require extraordinary evidence.

Otherwise, every hyperbole will have to be considered as irrefutable truth.

Or, is the 'who comes up with wittiest hyperbole' is the type of 'thought exchange' framework you would like to engage in?

Good thing we replaced career lobbyist Tom Wheeler with someone who would actually do something, right? Are we so looking at the FCC through our worldview that we can't even acknowledge positive action?

Wheeler was born on April 5, 1946 in Redlands, California. He attended Ohio State University.[7] From 1969 to 1976, Wheeler led the trade group Grocery Manufacturers of America.[8] He then went on to work at the National Cable & Telecommunications Association from 1976 to 1984, becoming president of the trade group in 1979. For a year until its closure, Wheeler was president of NABU Network, before spending a number of years creating or running several different technology startups. In 1992, he became the CEO of the Cellular Telecommunications & Internet Association, a post he held until 2004.

Nobody claimed Wheeler was any better.

Not US citizen so I only looked at it through the spectrum of some Ars Technica article, but I had the impression that this Wheeler guy had a pretty great record while leading FCC: https://arstechnica.com/information-technology/2016/03/how-a...

My strategy has been to do the exact opposite. I've claimed to have had the accident, spoken to the real person, asked them to hold the line whilst I finish something off some "urgent" work, received the follow up call after they hang up and asked them to call me back in a couple hours, again kept them waiting a few minutes. It really wastes their time and turns me in to an expensive call for them. Yes, it's wasted my time, but if we all did this they'd quickly run out of money.

A friend of mine used to actively enjoy doing this. Most of the calls he got were of the "we hear you've had an accident" variety, and he would start with a generic story about something like a car accident. The story would slowly get more and more bizarre until he's eventually telling them a story like how he hit a lorry full of miniature circus animals, with loads of tiny tigers and giraffes bouncing off his windscreen. He'd see how deep he could get them into the story before they realise they'd been had.

You can find lots of similar stories here:

https://www.419eater.com/

If it was actually a real person calling me about the accident, I'd love to respond with a furious "no it's YOUR fault' and try to convince them I'd literally just had an accident answering the phone whilst driving.

The time I told the robocall bot that this was very worrying because I was on my way to a driving test was actually true though. :D

I did something similar to this a while ago, but the scam was happening via text messages.

I spent a full weekend texting back and forth with the scammer.

Although I never went as far as your lorry of circus animals, I did give _many_ hints to him that he was being played with.

Now, the more interesting part is that I was particularly fed with scammers and wanted to see if I could out scam one, which I did.

On the Monday after that weekend, I managed to get my scammers to provide me with his bank account username and password.

Once I got this information, I checked that they were correct credentials and stopped all and every contact. I also did nothing with it as I didn't want to myself be on the wrong side of the law, nor did I want to mess too much with a scammer and get myself in trouble.

There is actually a dude who streams this https://www.twitch.tv/kitboga

I don't see how people can sit there and watch this live with him trying but normally the clipped/edited videos are pretty funny how much he can waste their time

I was livestreaming about a month ago and kept getting spam calls, so I decided to try to see what I could find out.

A website they pointed me to had a multidomain SSL certificate gave me a list of other scammy domains, and one that appeared to sell robocalling software. On that site I found a phone number to call to get started. I called the number and somebody immediately answered! I pretended to be an interested customer for a while, and he claimed to be the author of the software. I wasted his time for about 10 minutes asking questions about how it worked, and where i could get lists, etc. Then told him I wanted him to add a patch to prevent my number from being called again, and that I'd be calling him again if i got anymore calls.

It was very fun!

I employ one of two strategies. Either I answer with “911. What’s the location of your emergency?” or similar. If it’s a live person calling it usually gets them nice and confused. I then get to yell at them for calling an emergency line. My favorite was the guy I talked to when I pretended to be “Shepard Sharp, deputy director of the NSA”. “How did you get this unlisted number? Where are you located, we are dispatching a team to your location now.” This person seemed to believe me.

The second and more common is to simply ask for their company name, their name and employee number, and their boss’s name. By the time I get to the third question they hang up and often don’t call back again. In my state you can sue for unwanted cell phone calls and the max you can get is something like $1200/call, which I am happy to inform them of. No clue how to actually do this but if someone automates the process of filing a suit, I will split the profits :)

https://donotpay.com is an automated service that will collect the information you obtain from illegal robocallers and allow you to craft a demand letter.

Source: I've sent demand letters to vehicle extended-warranty robocallers using DoNotPay

Have the demand letters worked out so far?

Is also like to know if this has worked.

Yes when I'm getting a spoofed caller ID I like to ask where they're calling from, or just innocently, "who am I speaking to? what is your company name?"

I've never gotten enough information to file a complaint

I mute the mic and mash the keypad until the other end disconnects, no matter how long that takes. I find I get far fewer such calls than I did when I started, and the occasional hopelessly snarled-up IVR system is a nice bonus.

It took a while for the carriers to bring themselves into compliance with the technical requirements to make it work.

Yup - good call. I thought this was a nice post by the Twilio CEO last year: https://www.twilio.com/blog/your-phone-your-call-eliminating...

Basically, he walks through the history of the phone system and how it never really considered bad actors, and then what they are working on now and what it'll take to deploy it.

A lot like the early Internet. Hopefully we've learned that systems must be designed security-first to scale.

The DOJ obtained injunctions against those bad actors a few days ago.

https://www.justice.gov/opa/pr/district-court-orders-injunct...

I'd noticed that initial silence thing as well, but mostly because I answer and speak immediately. The spammers generally have a lag on their software and connect shortly after my greeting. Then while I'm waiting in silence, they've missed that sign of life and sit there doing nothing.

So again, I don't really have a provable basis for this, but I don't want to give positive proof that they've reached a live human. I feel like that's a recipe for getting continually called.

> My response to picking up a number is to answer the call and say nothing. Auto-dial systems will route the call to a person when they get a "live" response. I don't know the criteria but I'm pretty sure it's them detecting noise on the call (which could be voicemail).

I do the same thing. I moved and my old number is forwarded through google voice. Everytime i get a call from my old area code I know it is a neighbor spam call as no one calls me from that area code anymore.

It's gotten so bad i let my calls go to voicemail now.

The iPhone has a setting that has you route unknown callers to VM ("silence unknown callers"). I used to do the silent-answer trick, but this is so much better. If it's important,I get a vm and I'll call right back.

The times it has failed me is, actually, right now. I put in a call to have a delivery, maybe the last four digits are 4700- I've plugged that number in. But the guy calling me back calls on 4709 and gets VM. So I have to remember to turn this off if I'm expecting a delivery.

>> A human calling will wonder what is happening and fill the silence by saying something. A machine will not.

I've encountered robots in the last 6 months that have started with "Hello?" when I didn't say anthing. It tripped up my Turing Test at first, but eventually hit an ALICEBot-like moment that crashed the whole thing down.

Telephone numbers are a synchronous interactive channel. If someone calls you to have a chat, they pay for your attention with their own. They can say something to you, and you can in turn say something back to them.

Robocalls shove someone else's voice into your ear, without offering you an ear in return. They signal a synchronous communication, and then reneg on that promise with a spammed asynchronous message.

"Political speech" is the same as every other kind of speech. There should be no exemptions for policy just because someone running for office is involved. They have the same duty of courtesy as everyone else, and we have the same right to block our ears from their spam messages as businesses and scams.

um... cuz they get paid per call. So, just like ISP guys or Google or anyone else who is happy to irritate the fuck out of you for $.0001 per whatever useless crap that yields one in a million sales of some crap people don't need.

While I haven't taken the time to research further, I figured I'd try to brick the algorithm by speaking absolute gibberish. I also tell everyone else I know. Since machine learning is still "dumb", I figured that enough people babbling incoherently would require the spammers to hand-scrub the data or make more training rules, both requiring more work.

No idea if it worked, but it was the least I could do to halt progress in the wrong direction.

Regarding robocalls from political campaigns: I removed my phone number from my voter registration, because honestly I don't want any calls or texts from campaigns. I left my email address in case they want to spam that. I recommend doing the same (although at least with Gmail I find that several of the political emails end up in the spam folder...)

> Good. But really, why did this take this long?

I know nearly nothing about telco software but after working at enough big places I suspect one likely answer is "because it's monstrously complex for both technical and human reasons, moreso than it might seem at first".

> A human calling will wonder what is happening and fill the silence by saying something. A machine will not.

This is a naive assumption. I've come across robocallers that do exactly this. It is sort of trivial, if you think about it.