How STIR/SHAKEN Is Evolving to Restore Caller Trust

Compliance Insights

Caller identity is getting lost in transit

Did you know that more than half of telephone calls lose their identity authentication data somewhere in transit?

Trust is now so low that most of us won't answer an unknown number, and several efforts are underway to improve on the current STIR/SHAKEN standard.

There are two separate problems at play. 

• The first is delivery: the identification info does not survive the trip.

• The second is substance: even when it arrives, it says very little.

STIR/SHAKEN answers one question, which is whether an originating service provider with a certificate vouched for the number. It does not tell you who is calling or whether they had permission to dial.

Regulators and industry are building the next layer

The FCC is addressing the problem from the regulatory front.

The "Know Your Customer" proceeding increases the vetting that phone service providers must do of their customers. The "Know Your Upstream Provider" proceeding improves what carriers know about the traffic coming to them, including codifying the STIR/SHAKEN attestation framework.

Industry is working on the same problems from the technical side.

ATIS writes the standards carriers deploy, including SHAKEN. Next-generation tokens require signing by the party that vetted the customer and can carry a vetted name, logo, and call reason inside the signature.

The IETF, which writes the standards for the global Internet and VoIP, has two efforts worth watching.

VESPER would make customer vetting portable, storing it in a public transparency log any party can check rather than a file only one party can see.

vCon standardizes consent at the conversation level, turning the basis for contact into a portable record.

Better identity data only works if the network carries it

None of that great information reaches the handset if the network drops it.

This enhanced information is included in the IP-based signal, which is stripped as calls transit old legacy (TDM) phone equipment. This is a large part of why the Commission has focused on the IP transition, and why IP modernization goes hand in hand with reducing illegal robocalls.

The push by regulators and industry is also going global

In July, the governance authority that controls U.S. STIR/SHAKEN access selected Numeracle to build the framework for vetting foreign governance authorities seeking interoperability with U.S. systems.

The bottom line

Industry is not waiting for the FCC to solve this alone.

The right to use a number, caller identity, and consent are all being standardized.

The gap between how providers operate today and what these standards envision is large, but given the FCC’s focus on these issues, it's a matter of when, not if.

DISCLAIMER: The information on this page and related links is provided for general education purposes only and is not legal advice. Convoso does not guarantee the accuracy or appropriateness of this information to your situation. You are solely responsible for using Convoso’s services in a legally compliant way and should consult your legal counsel for compliance advice. Any quotes are solely the views of the quoted person and do not necessarily reflect the views or opinions of Convoso.