OTTAWA – Fraudulent calls continue to be an issue for Canadians despite the recent implementation of measures to try to combat them.
In April of this year, the CRTC directed telecommunications service providers (TSPs) to implement STIR/SHAKEN (Secure Telephony Identity Revisited/Signature-based Handling of Asserted information using toKENs), which is intended to combat caller ID spoofing, by Nov. 30 as a condition of providing telecommunication services.
As of Nov. 30, TSPs are expected to “certify whether a caller’s identity can be trusted by verifying the caller ID information for Internet Protocol-based voice calls,” a CRTC press release explains. The call status is conveyed on the receiving phone’s screen.
While the CRTC press release announced “many” Canadians would, from that point on, benefit from STIR/SHAKEN, there are limitations and new decisions around the use of the technology are still being made.
It was only as of last week, for example, that international calls between the U.S. and Canada could be authenticated by STIR/SHAKEN.
Neustar Inc. announced last Monday “that all communication service provider customers using Neustar-hosted Certified Caller for STIR/SHAKEN call authentication can now originate and verify international calls between the U.S. and Canada,” a press release says.
Previously, calls authenticated in one of the two countries could not be verified in the other “because the approved Certificate Authority (STI-CA) issuing the STIR/SHAKEN certificate in one country was not recognized in the other,” says the release.
“However, as of October 22, 2021, Policy Administrators (PAs) in the U.S. and Canada made their approved STIR/SHAKEN STI-CA (Secure Telephone Identity Certification Authority) lists available to the public. Neustar then updated its solution to enable secure cross-border capabilities with no development or integration efforts required from customers.”
There are other limitations that continue to mean not all Canadians benefit from STIR/SHAKEN, even for domestic calls.
Several TSPs have indicated that while they implemented STIR/SHAKEN by the deadline, not all their customers benefit.
“Videotron has successfully implemented STIR/SHAKEN in its network,” a company spokesperson told Cartt.ca in an email.
“It must nevertheless be recognized that the implementation of this technology is part of an evolving and multi-dimensional effort to address the problem of illicit and fraudulent calls. How quickly the benefits of STIR/SHAKEN become apparent to individual subscribers will depend on a series of factors including the nature of the underlying network, the nature of the interconnections between competing networks, the type of terminal equipment used by the subscriber and ongoing standards development,” the spokesperson said.
A SaskTel spokesperson also indicated in an email to Cartt.ca that whether a customer benefits from STIR/SHAKEN is dependent on several things.
“SaskTel implemented STIR/SHAKEN solutions on November 18, 2021,” the spokesperson said.
“However, it will not be fully implemented until manufacturers have included the feature in their operating systems. The solution also only works on VoLTE and VoIP calls which affects only a small portion of SaskTel’s customers. Therefore, this visual verification may not appear for customers unless using a specific device with a certain operating system over the VoLTE network when there is an incoming VoIP call.”
After confirming Telus has implemented STIR/SHAKEN and noting, like other TSPs, it is available to “customers with a device that supports the technology in its factory setup and can receive Telus VoLTE service,” a Telus spokesperson pointed out in an email to Cartt.ca the company also launched Telus Call Control in 2020 to help address the problem of fraudulent calls.
Telus Call Control “is a free feature available to all wireless customers that blocks the majority of autodialed calls,” the spokesperson said.
“The feature requires unknown callers to listen to a brief message and manually respond with a one-digit code. The majority of nuisance calls, including scams, are generated by computer-dialers that enable spammers to dial many numbers at once and are normally unable to respond to the Call Control message.”
Rogers has also implemented STIR/SHAKEN but is looking at addressing unwanted calls in other ways as well.
“We know receiving unwanted calls is frustrating for our customers and we have been working closely with the CRTC and industry partners to combat them, including implementing this new feature to let our customers know if the caller can be trusted,” a Rogers spokesperson said to Cartt.ca via email.
“This new technology is one way we are addressing unwanted calls and we continue to work on an array of solutions.”
A Bell spokesperson simply told Cartt.ca via email the company has “implemented STIR/SHAKEN across our mobile network. Any calls to or from a mobile user over our network are blocked if we have confirmed the call to be fraudulent or scam according to our system.”
(Shaw did not return a request for comment for this story.)
Bell, not long after the STIR/SHAKEN implementation deadline, received CRTC approval to make permanent its artificial intelligence-based system for blocking fraudulent and scam phone calls.
The call-blocking mechanism was originally approved by the CRTC on a trial basis in June 2020.
“The call-blocking system leverages artificial intelligence (AI) to analyze telecommunications traffic to flag anomalies that suggest possible fraudulent activity,” the CRTC decision to end the trial and make it permanent reads.
“These anomalies are then subject to review and if fraudulent activity is verified, Bell Canada et al. (Bell and its affiliates) would block subsequent related calls associated with the anomalous activity at the network level. The call-blocking system comprises safeguards to reduce the risk of legitimate numbers being blocked (false positives).
“Given that the call-blocking system is implemented at a network-wide level, every call originating on, terminating on, or transiting through Bell Canada et al.’s networks are subject to analysis and potential blocking. Only voice calls are subject to this system; text messages and other telecommunications are not affected.”
There were concerns raised by intervenors about the CRTC allowing the call-blocking mechanism to be permanent, including concerns regarding legitimate calls being blocked.
In its decision, the CRTC said it “considers that the significant benefits of Bell Canada et al.’s call-blocking system in protecting Canadians from the harm associated with fraudulent calls, as well as protecting the telecommunications network in general, overwhelmingly outweighs the concerns raised, including in particular the low to non-existent risk of having legitimate calls blocked.”
The decision also gives Bell the ability to make incidental adjustments to the system (but not changes to its fundamental structure) over time to help make it more efficient and to adapt to changing behaviours by bad actors.
In a more recent decision, the CRTC today approved the CRTC Interconnection Steering Committee’s (CISC) request to defer the application of STIR/SHAKEN to 9-1-1 emergency and callback calls.
In an application filed on Oct. 28 of this year, the Emergency Services Working Group and the Network Working Group of CISC asked the CRTC to defer the implementation of STIR/SHAKEN for legacy E9-1-1 network providers indefinitely and for NG9-1-1 network providers until specific milestones are met.
“The working groups submitted that a deferral is required because of the lack of standards regarding the integration of STIR/SHAKEN to 9-1-1 calls,” the CRTC’s decision says.
“They are concerned about the risk of 9-1-1 calls being misidentified as spoofed calls or being dropped if STIR/SHAKEN is applied to emergency calls before the appropriate standards are developed and implemented.”
Bell, SaskTel and Telus, which are “the NG9-1-1 network providers, responsible for the deployment of the NG9-1-1- network infrastructure,” supported the application, the decision says.
The Commission also directed CISC today to “monitor the standards work related to the application of STIR/SHAKEN to NG9-1-1 calls and callbacks and file a report with the Commission every six months starting 31 May 2022,” the CRTC’s decision reads.
