Subject: Re: [dispatch] Two new VoIP spam drafts

From: "Samir Srivastava" <[email-masked]>
Date: Fri, 11 Nov 2016 10:32:46 -0500

IMPORTANT: This is open communication from the owner of
trialobama.net
as per the remembered IETF policies by me.

If I recollect there was draft submitted by me and NEC folks for
indicating presence of SPAM. There was IPR filed by me when I was
working at Nortel.

 Is the work is not related to it. Can someone explain this to me.

Thanks
Samir

On Wed, 12 Oct 2016 14:34:24 -0500 "Henning Schulzrinne"
<[email-masked]> wrote:
>There are two scenarios, as you state:
>
>* Pre-call: For example, the Call-Info header in my other draft or
>CNAM ("Cardholder Serv") lead the called party to hit the "spam"
>button before picking up. This yields a 666 response to the
>INVITE.
>
>* Mid-call: The called party picks up, listens for 10 seconds,
>decides they don't need "Microsoft" technical support, and hits
>the same spam button.  Signaled via BYE with Reason 666.
>
>Just like for email spam, the effect is two-fold, as noted:
>
>(1) I don't want this particular caller to reach me again.
>(2) Increment the bad reputation score for the caller.
>
>I don't see this response affecting a whole category of calls. For
>example, I may decide that I really don't like the Police
>Benevolence Association call I just received, but that does not
>necessarily mean that I'd like to block the American Heart
>Association. I think category-based blocking is going to be set up
>via a more sophisticated web mechanism that allows finer grained
>controls ("No charities after 6 pm; only charities with a Charity
>Navigator rating of A"). Same for political calls - I may want to
>receive the town hall calls from the politician I like and never
>again hear from the one I don't.
>
>Spoofing obviously makes call blocking of any sort more
>problematic, but much spoofing is from numbers that would never
>call me. For example, blocking the "IRS" doesn't prevent the real
>IRS from calling me - they don't use the 800# (800-TAX-1040) for
>outbound calls.
>
>For now, many robocallers don't spoof since they want you to call
>back, given that many people let unknown callers go to voicemail.
>
>But we've had versions of this discussion in STIR for several
>years.
>
>Henning
>
>-----Original Message-----
>From: dispatch [mailto:[email-masked]] On Behalf Of
>Paul Kyzivat
>Sent: Wednesday, October 12, 2016 3:18 PM
>To: Asveren, Tolga <[email-masked]>
>Cc: [email-masked]
>Subject: Re: [dispatch] Two new VoIP spam drafts
>
>On 10/12/16 9:59 AM, Asveren, Tolga wrote:
>> Overall, I am in favor of keeping the utility/scope limited to
>"spam". Just to list a few points along those lines:
>>
>> i- "666" would indicate that the user considers the call as
>spam/robocall/annoyance; bottomline being that the user would
>prefer not to receive calls originating from the same identity.
>
>While this seems reasonable, how will it work in practice? IOW,
>when will I know to use it?
>
>If I use it before I answer the call, then on what basis am I
>doing so?
>Is it because I recognize the number? Or is it based on the
>classification assigned by the provider that has been displayed to
>me?
>
>Will I have an option to use it after I have answered the call?
>(As an alternative to normal hangup.) If so, and if I do so then
>based on the content of the call, is the meaning "would prefer not
>to receive calls originating from the same identity"? I suspect it
>is really more "would prefer not to receive calls of this type",
>regardless of the callerid.
>(Especially when spam often comes from forged IDs.)
>
>These are two different semantics. Perhaps they can share the same
>code, since they can be distinguished because they are signaled in
>different ways. But it would be cleaner if they were different
>codes.
>
>> ii- "666" is not intended to be used for the user to blacklist
>his mother-in-law. That -already- could be done by other means.
>> iii- "666" does not automatically blacklists the
>number/originating identity. It is an input for a spam-blocker
>service, which possibly can be provided by a SP. It also would be
>an input for a centralized robocall/spam logic, which possibly is
>used by multiple SPs and maybe administrated by a national
>authority.
>> iv- Actual blacklisting rules/service is something to be
>decided/provided by the SP. This, for example, may include other
>components like a web-interface accessible by users. SP may also
>provide "likely to be spam" (and similar) indicators for calls
>depending on existing analysis.
>
>I agree these seem like wise policies.
>
>> v- Consider the above points, I think a 6xx response is the
>right choice and no 4xx response needs to be added/used.
>
>I'm neutral on this.
>
>> vi- SP/Central Authority may perform further analysis for a
>call, which has been rejected with "666", e.g. based on CDRs,
>logs, existing peering relationships etc...
>
>And statistics.
>
>If the same calling number has been flagged by many users *after*
>they have answered the call, then we can infer that there is a
>consistent behavior of bad behavior from this ID. That is worth
>investigating.
>
>If the same number has been flagged by many users *before* they
>have answered the call, but not corroborated by others flagging it
>after answering, then the situation is unclear. Perhaps this
>number carries a calling name that leads people to reject it? Or
>perhaps it is a number that is special enough to be recognized by
>a lot of people. I think this would need to be investigated
>carefully to understand what is going on.
>
>	Thanks,
>	Paul
>
>
>_______________________________________________
>dispatch mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/dispatch

---

From: "Samir Srivastava" <[email-masked]>
Date: Fri, 11 Nov 2016 11:30:08 -0500

I forgot to put remebered Logo of mine

Vashudhev Kutumbakam Sanskrit Language world

Whole World is our family

---

From: Henning Schulzrinne <[email-masked]>
Date: Sun, 13 Nov 2016 11:21:32 +0000

I will note that treatment of pre-call and mid-call 666 can differ, without going into details what the different might be. Given that pre-call rejection is likely based on recognizing the caller ID (e.g., from a previous call using the same one), I could imagine similar treatment, particularly if there is no personal blacklist. ("The same robocaller again; let me punch the spam button so that it finally gets filtered.")

________________________________
From: DOLLY, MARTIN C <[email-masked]>
Sent: Thursday, October 13, 2016 8:12:17 AM
To: Paul Kyzivat; Henning Schulzrinne; Asveren, Tolga
Cc: [email-masked]
Subject: RE: [dispatch] Two new VoIP spam drafts

I would see the treatment in the network to be slightly different between receiving a pre versus mid call 666 response.

Both would be fed into data analytics.
Pre 666 would be used for the individual profile (possibly adding number to a blacklist), and used in the data analytics for further analysis with other calls to other users.
Post 666 would initiate the reporting and traceback processes.

Regards,

Martin

-----Original Message-----
From: dispatch [mailto:[email-masked]] On Behalf Of Paul Kyzivat
Sent: Wednesday, October 12, 2016 4:01 PM
To: Henning Schulzrinne <[email-masked]>; Asveren, Tolga <[email-masked]>
Cc: [email-masked]
Subject: Re: [dispatch] Two new VoIP spam drafts

Henning,

I mostly agree, with some qualifications, inline.

On 10/12/16 3:34 PM, Henning Schulzrinne wrote:
> * Pre-call: For example, the Call-Info header in my other draft or CNAM ("Cardholder Serv") lead the called party to hit the "spam" button before picking up. This yields a 666 response to the INVITE.
>
> * Mid-call: The called party picks up, listens for 10 seconds, decides they don't need "Microsoft" technical support, and hits the same spam button.  Signaled via BYE with Reason 666.
>

Trying to use the same signal to trigger both of these effects presents some issues. And I think they differ for Pre-call and mid-call?

(1) seems appropriate for pre-call. It is clear that I am making a judgement based on the identity of the caller. Not so clear for mid-call. I definitely don't like the content, but that may or may not correlate to the caller identity. Risky to block the caller based on just this.

(2) This action might be appropriate for both pre-call and mid-call, but the two types should probably be tallied separately and evaluated differently. For mid-call I am objecting to the content and the tally is used to see if the number has a history of bad content. For pre-call we really don't know what the callee is objecting to. Still worth tracking, but not as strong a measure.

Of course we aren't standardizing this behavior, so discussing it is just for context.

My bottom line here is just that it is hard to characterize the meaning of the code in a phrase. So I suggest using something quite vague, like "Objectionable" without qualification as to whether it is the calling id, calling name, content, or whatever that it applies to. The text description can go into more detail. But ultimately the meaning will be determined by others so we should be vague enough to cover whatever they decide to do.

        Thanks,
        Paul

> I don't see this response affecting a whole category of calls. For example, I may decide that I really don't like the Police Benevolence Association call I just received, but that does not necessarily mean that I'd like to block the American Heart Association. I think category-based blocking is going to be set up via a more sophisticated web mechanism that allows finer grained controls ("No charities after 6 pm; only charities with a Charity Navigator rating of A"). Same for political calls - I may want to receive the town hall calls from the politician I like and never again hear from the one I don't.
>
> Spoofing obviously makes call blocking of any sort more problematic, but much spoofing is from numbers that would never call me. For example, blocking the "IRS" doesn't prevent the real IRS from calling me - they don't use the 800# (800-TAX-1040) for outbound calls.
>
> For now, many robocallers don't spoof since they want you to call back, given that many people let unknown callers go to voicemail.
>
> But we've had versions of this discussion in STIR for several years.
>
> Henning
>
> From: dispatch [mailto:[email-masked]] On Behalf Of Paul
> Kyzivat
>> Overall, I am in favor of keeping the utility/scope limited to "spam". Just to list a few points along those lines:
>>
>> i- "666" would indicate that the user considers the call as spam/robocall/annoyance; bottomline being that the user would prefer not to receive calls originating from the same identity.
>
> While this seems reasonable, how will it work in practice? IOW, when will I know to use it?
>
> If I use it before I answer the call, then on what basis am I doing so?
> Is it because I recognize the number? Or is it based on the classification assigned by the provider that has been displayed to me?
>
> Will I have an option to use it after I have answered the call? (As an alternative to normal hangup.) If so, and if I do so then based on the content of the call, is the meaning "would prefer not to receive calls originating from the same identity"? I suspect it is really more "would prefer not to receive calls of this type", regardless of the callerid.
> These are two different semantics. Perhaps they can share the same code, since they can be distinguished because they are signaled in different ways. But it would be cleaner if they were different codes.
>
>> ii- "666" is not intended to be used for the user to blacklist his mother-in-law. That -already- could be done by other means.
>> iii- "666" does not automatically blacklists the number/originating identity. It is an input for a spam-blocker service, which possibly can be provided by a SP. It also would be an input for a centralized robocall/spam logic, which possibly is used by multiple SPs and maybe administrated by a national authority.
>> iv- Actual blacklisting rules/service is something to be decided/provided by the SP. This, for example, may include other components like a web-interface accessible by users. SP may also provide "likely to be spam" (and similar) indicators for calls depending on existing analysis.
>
>> v- Consider the above points, I think a 6xx response is the right choice and no 4xx response needs to be added/used.
>
> I'm neutral on this.
>
>> vi- SP/Central Authority may perform further analysis for a call, which has been rejected with "666", e.g. based on CDRs, logs, existing peering relationships etc...
>
> And statistics.
>
> If the same calling number has been flagged by many users *after* they have answered the call, then we can infer that there is a consistent behavior of bad behavior from this ID. That is worth investigating.
>
> If the same number has been flagged by many users *before* they have answered the call, but not corroborated by others flagging it after answering, then the situation is unclear. Perhaps this number carries a calling name that leads people to reject it? Or perhaps it is a number that is special enough to be recognized by a lot of people. I think this would need to be investigated carefully to understand what is going on.
>
>        Thanks,
>        Paul
>
>
>