If the car warranty company that keeps calling me is in the US, aren't they liable for contracting for an illegal service? If they're out of the US, can't we impose some block on all payments from the US to them?
Back in the day, I wanted to nix a SS7 link to a shady vendor that was spamming cell phones. I got in trouble for that. "They are paying their bills, leave them alone and keep your nose out of it". That is another aspect of the problem. Even if a telco wanted to stop abuse on their own network, it would not be permitted unless they are legally obligated to do so. Even then, telco's have more lobbyists than all the silicon valley big tech combined, no exaggeration. That is just based on my very dated experience. I have long since left telco and very happy I did.
[1] - https://transnexus.com/whitepapers/stir-and-shaken-overview/
Detection seems like it is doable - either technically (detect spoofing which implies something impossible like a home phone in Nigeria) or consumer feedback (e.g. a short number to call which marks previously received call as a robocall). And some detection can be done with existing equipment and fails gracefully (it doesn’t need to be 100% reliable) unlike changes to core protocols/equipment.
That seems an odd characterization.. they both were being developed at nearly the same time. SS7 developed faster and was put into use much more broadly than IP due to corporate need and support, but they're both about the same age.
Why does the problem have to be tackled from the direction of extending the wire protocol? It seems like it would be straightforward to tackle it from the business end first: a major phone company declares that it will block spoofing on calls originating in its network, and will only accept calls coming into its network from partners who make the same commitment to not allow spoofed calls onto their networks. This doesn't require any changes to the technology used to connect phone networks, just changes to the business arrangements (a threat of blacklisting).
(If you don't want to take quite such a hardline approach, then require that all calls either originate from a network that is trusted to have valid caller ID data, or the caller ID data is stripped from the call. And then give all end users the option of blocking calls with blank caller ID.)
all calls either originate from a network that is trusted
That is also tricky. What does trusted mean? Does it mean that if someone on that network is abusing SS7, that they become untrusted? If so, every network would be untrusted within 10 minutes. Maybe a cost penalty to self regulate? You have to block your own reported abusers or lose peering? I like the idea, but I think that would put us back into that realm of legal and political quandaries. This would require a fairly significant addition in full time employees to police the abuse reports and entirely new reporting systems to log all the SS7 data, learn and report abuse patterns.
Does roaming involve my cell phone having the same kind of unrestricted SS7 access on the telco's network that enables spoofed robocalls? If so, what the hell are SIM cards for?
> What does trusted mean? Does it mean that if someone on that network is abusing SS7, that they become untrusted?
Trusted here would mean the network enforces ingress filtering on caller ID data; that calls being placed by end users on that network have accurate caller ID attached by the carrier, and calls coming in from another network either have trusted caller ID data or blank caller ID data.
I don't know enough about how SS7 works to know how what degree of access to SS7 is used by various methods of placing calls, but it seems pretty likely that ordinary landline and cellular phones are not viable ingress vectors for spoofed robocalls, and filtering is only needed with more advanced services such as connecting your PBX to the carrier's network.
SIM cards are for binding IMSI/MSISDN/IMEI, to authenticate you to the mobile network and update the HLR with your location. This data also traverses the SS7 network but does contain some authentication data specific to the wireless provider. The landline telcos have no knowledge of what this data means beyond the ability to route it. The mobile switches will route your MSISDN to the other SS7 networks.
accurate caller ID attached by the carrier
This goes back to the suggested shaken/stir method of authentication. There is really no other way to determine what is valid and what is not. The carrier can attach nearly any number and that number can be entirely valid.
On some level, a SIM card must authenticate you to the local tower operator as authorized to place calls, and identify what other carrier gets billed for that if you're roaming. They also identify (in an authenticated manner) what the phone number is for your cell phone, so that the local tower operator can start routing calls to that number to your handset. This seems sufficient for the local tower operator to ensure that you aren't using your smartphone to place tons of robocalls with spoofed numbers, using only infrastructure that is already universally implemented.
I don't see where a landline telco on the receiving end of calls originating from your smartphone needs to know anything about any of that process; the mobile network operator that's connecting the first hop of your call can be and should be the one responsible for preventing you from abusing the network. I want my phone company to hold the mobile network to that standard before letting calls from that network make my phone ring.
> This goes back to the suggested shaken/stir method of authentication. There is really no other way to determine what is valid and what is not. The carrier can attach nearly any number and that number can be entirely valid.
This sounds again like you're deciding ahead of time that the problem can only be addressed by a technical solution that turns out to be basically intractable. You're saying that solving the spoofed robocall problem requires every telco to be able to fully validate in realtime who owns what number and is roaming where. I'm pointing out a relatively non-technical solution where each network is only responsible for restricting the bullshit the let into their network, at the boundaries where it seems practical to enforce without overhauling the entire protocol stack for the whole industry. And lax enforcement would get a carrier blacklisted, or at least make all calls originating from their network readily identifiable as suspicious and trivially blockable.
I'm not asking for any new data to be shared from mobile networks to landline telcos. You haven't explained why you think that is required in order for mobile networks to perform sanity checking (or sanitization) on the data they're already sending to other telcos during call setup.
Very interesting, and certainly not the first time I've heard that. I wonder if and when Facebook is going to encroach on telco turf.
I guess what you're really saying is that most phone systems are nowhere near that sophisticated?
Actually, you could argue they're around the same age. ARPANET switched from NCP to TCP on 1 January 1983 [1] and the initial SS7 standard was released by the ITU in 1988.
It's possible I'm clueless, but that's where I feel enforcement should be focused: on the money side.
Problem is, almost all of the advertising and lead generation in the world happens through networks like that. Some of it is legit, some is not.
So I do think it's correct to go after robocalling and make it stop.
Now one thing I don't agree on is the WAY in which we're doing it via tracing or whatever. Instead if I was the FCC I would simply require, starting today, that all calls made in the US must be signed to be completed. I would rather have no phone calls in the US for a month than let this shit go on indefinitely.
Something like that would force all carriers to immediately figure out a way to get every phone call signed. Then once we have calls signed, the spammers would lose their right to call pretty much after a few calls are made and reported.
I think the current strategy is pretty hand-wavy and doesn't have any end in sight.
At the risk of being draconian, okay, fine, you don't know who "ultimately" signed Fred up for your service, but HEY, Fred was signed up illegally, so it's still your fault.
I'd like to think that suddenly, companies would get a LOT more careful about who they let sign up to be partners, if they're now at risk.
Don't we already do this kind of things with banks, in other words KYC ("Know Your Customer")? A long term business relationship is worth a bit of hassle.
I would expect them to lobby against KYC since it internalizes the costs. No business wants to take on costs that could otherwise be passed on to others. That is the core of why regulations are needed.
If you meaningfully punish the company who paid for it, then robocallers can blackmail any customer-centric company that they want. They start robocalling on behalf of the company then tell the company that they will have to pay to stop. As long as the payment is enough below the legal penalty for continuing, the company will pay the blackmail and the robocaller moves on to their next target.
Meanwhile back in reality, a big company may have tens of thousands of affiliates or more. The affiliates all maintain that they are on the up and up, but any of them could be scammers. The company gets leads and doesn't know how they were generated.
To see how easy it is, you can create a blog, register yourself as an affiliate for Amazon, and put a link on your blog. Boom. Now have your friend click on your link, and go buy something. Guess what? Amazon will pay you money!
Now suppose that you do that and I do that. You put up your blog, I put up a blog as well. But I also put out a browser extension that rewrites all amazon links to come to my site, record that, and then redirect. How is Amazon supposed to find out that your traffic is real and mine is from a scam? Our sites look the same. We're both sending real customers who will pay real money.
In this scenario if Amazon could catch me, they would. I'd be straight up cheating them, making them pay for traffic that I didn't generate.
How about: affiliate links are constructed to incorporate the affiliate tag so that they can't be rewritten. Yes, each link on your blog is different than the links on my blog for the same items, not just slapping a tag in a URL field.
Of course, this would have engineering and hardware overhead on Amazon's side, but without something like this they're just retreading telco history in giving the world untraceable Caller ID, as you aptly illustrate.
And I can rewrite all Amazon links that were not owned by another affiliate if I don't mind just sending them to the Amazon home page. Which will probably be the behavior if an affiliate messes up the link (which they will do fairly reliably).
The result is not a significant improvement over the current state, except that it becomes somewhat harder to be an affiliate.
Why would Amazon honor a broken affiliate link? They don't now.
I have no idea what you are talking about with magic. If the advertiser has no idea which affiliate generates a sale, then how does it know how much to pay each one?
The advertiser has no idea what techniques the affiliate used to generate that sale. That's the whole problem.
Yes, they will have to be careful where they get leads from. So what?
So how is a company supposed to be careful? Throw away ALL organic leads?
Except that you automate it. But still the request looks a lot like it comes from a real person. And if you've got access to a botnet, the request will likely be coming from a real home computer as well.
What's worse are the scammers who call from the "social security administration" trying to get you to wire them thousands and thousands of $$. They are quite insidious, sophisticated, and can sniff out even the slightest misstep you make when you try to string them along. I have heard stories, second-hand, of senior citizens who were scammed out of tens of thousands of dollars through schemes like this. It's abhorrent.
Source: I sued a home security company who made the above argument re: using a third-party lead generation company in person with me at the local courthouse during settlement talks. I did manage to get him to settle for several thousand $$ anyway, plus he had to travel several hundred miles to make an 8am Monday court appointment, so I figure that's a win.
I can't say that I know the technical or legal process, but from a layman's view it seems that going after the entity committing the crime is faster and cheaper than going after the company behind the shell company behind the lead generator behind another shell company behind another company behind another shell company, all of which may be in different countries.
In this case, the direct approach seems to be a good place to start.
In the end, there’s a US business somewhere in that chain that exists to take the money of US customers, and to pay taxes on that revenue; and that company is the one you’re put in contact with when you phone the number specified in the robocall.
It doesn’t matter who owns a controlling interest in that company. The only thing that matters is the point at which it’s interfacing with the US phone network and banking system.
Just send the company some money (like they want you to do!), find out where it goes (in the US; it doesn’t matter what happens after that) and find out who owns that bank account. Then arrest that guy, and/or freeze those accounts. And maybe prosecute the bank or payment-processor that was willing to take their business, in order to disincentivize such service providers from offering them accounts in the future. Do that over and over.
Let's not be disingenuous - they're not stupid enough to believe that Robocaller Company A, who is charging them a quarter of what other telemarketing companies are, is all above board. Hiding behind plausible deniability of shell companies and third parties to me isn't demonstrating "they aren't doing anything wrong and swear to god, we had no idea what the company we did business with intended".