Subject: Re: [sipcore] [stir] The Canadian Regulator has issued a Notice of Consultation on robocalls spoofing STIR/SHAKEN

From: Tony Rutkowski <[email-masked]>
Date: Fri, 3 Feb 2017 14:07:47 -0500

Hi Rich,

CRTC's notice is disappointingly poorly
researched.

So inquiring minds would ask:
1) why CRTC didn't reference any of the other
industry group solutions out there, and

2) why not use something more contemporary
with less overhead like blockchain?

See, e.g.,
http://www.nojitter.com/post/240171529/blockchain-coming-to-your-telecom-future

just curious.

-t

On 2017-01-09 5:05 PM, Richard Shockey wrote:
> Here is the link to the CRTC NOC issued this morning.

---

From: Dave Crocker <[email-masked]>
Date: Fri, 3 Feb 2017 11:23:40 -0800

> with less overhead like blockchain?

Tony,

Blockchain is a foundational, component technology.

Where is the standardized system specification that incorporates it for 
use in SIP-based phone calls?

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 3 Feb 2017 14:30:22 -0500

So why not do that rather than use 30 year
old legacy technology that is unlikely to scale and
is onerous to implement?   I'm sure you could
do it.  Seems like a better road than doing PR
for FCC and CRTC regulatory mandates?  Indeed,
how likely is it anymore under the brave new
world of Trump?  The FCC will be lucky to hold
on to spectrum management.

-t

On 2017-02-03 2:23 PM, Dave Crocker wrote:
> Where is the standardized system specification that incorporates it 
> for use in SIP-based phone calls?

---

From: Dave Crocker <[email-masked]>
Date: Fri, 3 Feb 2017 11:39:46 -0800

On 2/3/2017 11:30 AM, Tony Rutkowski wrote:
> is onerous to implement?

Given how many years STIR/Shaken have taken -- and that's for 
well-understood technology with lots of field experience -- you are 
suggesting the process start over?

What are the incremental benefits that will accrue from waiting another 
5-8 years to deploy this alternative mechanism?

d/
-- 

   Dave Crocker

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 3 Feb 2017 15:00:01 -0500

It may be well understood at some level,
albeit not widely used.  Scaling its use globally
has a chance of between zero and none.
Mr. Google can point you to all the other
solutions proffered out there by other bodies
and national administrations.

So prior to 7 Nov 2016, it had some marginal chance
of having US uptake with a FCC forcing function.
Or at least it sounded good for FCC PR purposes.
Today, in the brave new world in Washington,
it seems just a matter of time it gets formally
flushed along with NetNeutrality, Title II jurisdiction,
etc.  It just doesn't fit the new political paradigm.

Blockchain solutions for dealing with authentication
requirements such as call spoofing are fast ascending
and in the long term far more attractive.  So since
there is now more time to play with, why not shift
to an alternative mechanism that's more contemporary
and with better technical, operational, and political
attributes.   As Bobby Dylan reminded us, you don't
need a weatherman here.

tony

On 2017-02-03 2:39 PM, Dave Crocker wrote:
> What are the incremental benefits that will accrue from waiting 
> another 5-8 years to deploy this alternative mechanism?
>
> d/

---

From: Richard Shockey <[email-masked]>
Date: Fri, 03 Feb 2017 17:56:42 -0500

+1 to Dave here.. 

What does blockchain technology have to do with anything?

As for the FCC .. its there is not going anywhere. 

From: stir <[email-masked]> on behalf of Tony Rutkowski <[email-masked]>
Organization: Yaana Ltd
Reply-To: <[email-masked]>
Date: Friday, February 3, 2017 at 2:30 PM
To: <[email-masked]>, "[email-masked]" <[email-masked]>, <[email-masked]>
Subject: Re: [stir] The Canadian Regulator has issued a Notice of Consultation on robocalls spoofing STIR/SHAKEN

-t

Where is the standardized system specification that incorporates it for use in SIP-based phone calls? 

_______________________________________________ stir mailing list [email-masked] https://www.ietf.org/mailman/listinfo/stir

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 3 Feb 2017 18:15:24 -0500

Better alternative Rich.  Do the research.
It'll probably be on the agenda of the ITU-T
blockchain workshop.  There is already
ongoing ETSI work.

As to the FCC, the reality is different.
We're not in not alt-truth mode on this.

http://thehill.com/policy/technology/317854-fcc-suspends-probes-of-telecommunications-firms

The new FCC chair was an outspoken critic
of the Commission's TCPA activism.  The
era of consumer protection expansion is
dead in Washington.  The major carriers
are not going to rush into the FCC and
say "regulate me" and be forced to
incur costs in implementing STIR, when
those calls produce revenue, and many
business users want to avail themselves
of anonymous robo-calling.

If consumers want to stop robo-calls,
they need to set up their own call blocking.

Times are a'changing....

--tony

---

From: Richard Shockey <[email-masked]>
Date: Fri, 03 Feb 2017 18:21:55 -0500

Wow Tony … that’s some Kool-Aid you are sipping or smoking … share the Joy.  

 

From: sipcore <[email-masked]> on behalf of Tony Rutkowski <[email-masked]>
Organization: Yaana Ltd
Reply-To: <[email-masked]>
Date: Friday, February 3, 2017 at 3:00 PM
To: <[email-masked]>, "[email-masked]" <[email-masked]>, <[email-masked]>
Subject: Re: [sipcore] [stir] The Canadian Regulator has issued a Notice of Consultation on robocalls spoofing STIR/SHAKEN

tony

Given how many years STIR/Shaken have taken -- and that's for well-understood technology with lots of field experience -- you are suggesting the process start over? 

What are the incremental benefits that will accrue from waiting another 5-8 years to deploy this alternative mechanism? 

d/ 

_______________________________________________ sipcore mailing list [email-masked] https://www.ietf.org/mailman/listinfo/sipcore

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 3 Feb 2017 18:32:53 -0500

Rich,

This isn't about being funny.

There was an election in the U.S.   A fundamentally
different Administration is in town.  The world has
changed whether we like it or not.  Read the news.
Adapt.

--tony

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 3 Feb 2017 18:51:29 -0500

On the technology and business side of the
equation, click on the following:

https://www.google.com/search?hl=en&as_q=blockchain+telecommunication+services

Then ask yourself why any telecommunication
provider would go to their national regulator
and say "regulate me and force me to provide
SHAKEN-STIR services against the interests of
many of my business customers."

Then go to the Trump Administration think
tanks and new appointees and ask them for
your support.

--tony

---

From: Dave Crocker <[email-masked]>
Date: Fri, 3 Feb 2017 15:58:32 -0800

> and national administrations.

Citations to standardized (ie, multilaterally-supported) detailed 
specifications of an integrated service, please.  You are making the 
claim, so you can do the google and proffer the satisfying results.

> and in the long term far more attractive.

If there is a problem with the uptake of STIR/Shaken, what will make the 
uptake of a blockchain-based service -- whatever that might be -- any 
better?

d/
-- 

   Dave Crocker

---

From: Dave Crocker <[email-masked]>
Date: Fri, 3 Feb 2017 17:03:12 -0800

> equation, click on the following:

Sorry I wasn't clear.  I meant /specifications/.  Theory is always a 
nice starting point, but it's a terrible ending point.  Remember that 
5-8 years I mentioned before?

> many of my business customers."

Your premise seems to be that SITR/Shaken can't be used without 
regulatory mandate.  I don't understand that.

And to the extent is has validity, what makes a blockchain-based 
approach any more-easily adopted?

d/
-- 

   Dave Crocker

---

From: Richard Shockey <[email-masked]>
Date: Fri, 03 Feb 2017 20:29:47 -0500

My last note to you Tony on this subject. We’ve known each other for many years. 

You don’t fundamentally understand the relationship between the regulated and regulator. 

I’m pretty much on record as supporting FCC Chairman Pai and his agenda.  You have not watched his statement at the robocall Strike Force meeting last Dec at the FCC. He was even more aggressive on enforcement that the D’s. 

The Chairman has stated his position clearly a couple of days ago  “ I support Net Neutrality, I oppose reclassification under Title II”  End of Story.  

Take your case to Thune R-SD The Chairman of the Senate Commerce Comm he in the driver’s seat these days. 

 If you had a clue you would realize that in our United States Constitutional system, the legislature has a role and actually, if occasionally flawed, exercises it.  

Film at 11. 

From: Tony Rutkowski <[email-masked]>
Organization: Yaana Ltd
Reply-To: <[email-masked]>
Date: Friday, February 3, 2017 at 6:51 PM
To: Richard Shockey <[email-masked]>, <[email-masked]>, "[email-masked]" <[email-masked]>, <[email-masked]>
Subject: Re: [stir] [sipcore] The Canadian Regulator has issued a Notice of Consultation on robocalls spoofing STIR/SHAKEN

--tony

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 03 Feb 2017 21:35:18 -0500

Go for it Rich.  Just positing impediments and  alternatives in a venue of true believers.

On Feb 3, 2017 8:29 PM, Richard Shockey <[email-masked]> wrote:

Film at 11.

--tony

---

From: Alex Bobotek <[email-masked]>
Date: Fri, 3 Feb 2017 18:38:09 -0800

To the extent that the overhead of authorizing legitimate delegation of authority might impede wider use of STIR/SHAKEN, blockchain-based  technology _might_ be utilized as an alternative authority delegation mechanism in a way that reduces overhead.  

I'm not certain if that's what Tony is referring to, and the "_might_" is not me taking any position at this time wrt the relative pros and cons of blockchain vs STIR's delegation technologies.  

Tony, I'm apparently not the only one who doesn't understand how you believe blockchain might help, but am always ready to listen to an explanation.  

On the original point of CRTC's ask for information that got this thread going, a number of CRTC personnel will be attending and/or speaking on panels at M3AAWG VTASIG on the 23rd in San Francisco.  I'm not sure what CRTC's rules are on informal discussion of issues that are part of their formal regulatory process, but at the very least I expect them to present it and have open ears.  

Regards,

Alex 

> -----Original Message-----
> From: stir [mailto:[email-masked]] On Behalf Of Dave Crocker
> Sent: Friday, February 3, 2017 3:59 PM
> To: [email-masked]; [email-masked]; [email-masked]
> > Mr. Google can point you to all the other solutions proffered out
> > there by other bodies and national administrations.
> 
> Citations to standardized (ie, multilaterally-supported) detailed specifications
> of an integrated service, please.  You are making the claim, so you can do the
> google and proffer the satisfying results.
> 
> 
> > Blockchain solutions for dealing with authentication requirements such
> > as call spoofing are fast ascending and in the long term far more
> > attractive.
> 
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 4 Feb 2017 08:50:02 -0500

Alex,

Thanks for the reflective note.  My remarks were directed at the CRTC 
Call for comments which was circulated on this list.  I had four points 
to make: 1) the incorporation into law of technical specifications such 
as the STIR/SHAKEN by designated standards bodies is ill advised, 2) the 
FCC's recent activism in this regard seem likely to change, 3) there are 
alternative platforms emerging that seem more promising, and 4) the 
adoption of STIR/SHAKEN is unlikely to be useful in dealing with what is 
basically a traffic management issue among carriers and customers.

Having been in an out of local, national, and international regulatory 
bodies over the past 50 years, there is one maxim that served those 
bodies well - avoid incorporating specific technical "fixes" proffered 
by standards bodies into regulations.  Anointing those bodies gives them 
de facto regulatory authority and they tend to become more closed, 
ossified, and manipulated over time, and innovation gets stifled as a 
result.

Regarding the FCC, one has only to turn on the news or visit its site to 
realize that its role and activities are significantly changing, heading 
in the other direction of regulatory intervention into the industry 
management of its own affairs.  The telecom industry would be now 
foolish to paradoxically argue against own interests to "regulate me."

New innovative platforms can in part or whole serve as more efficient 
and more flexible alternatives to STIR/SHAKEN. These include not only 
blockchain, but also AI techniques pioneered by GeorgiaTech and spun out 
as Pindrop and apparently now nine other competitors.  CRTC should not 
stifle the innovation that has emerged in this sector.

Even if STIR/SHAKEN were able to be imposed at the national level by 
regulatory fiat, it is unlikely to be a global solution, nor one that 
even addresses and adapts to the changing network management demands 
faced by carriers among their diverse customer sets. They are entirely 
capable of devising and implementing their own solutions and 
coordinating them through global industry bodies such as the GSMA.  To 
the extent some kind of local national support centre is needed, the UK 
NICC model might be useful.

best,
tony

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 4 Feb 2017 10:50:01 -0500

Alex,

For looking at the problem set here globally, you
may also find the attached ETSI document useful.
As it was done last September, and blockchain
developments have been progressing very rapidly,
that topic is not included in this document, although
some of the innovative fingerprinting techniques
are treated.

Why anyone - especially a regulatory authority -
would want to lock themselves into a specific
solution here, is unfathomable.

--tony

---

From: "Gorman, Pierce A [CTO]" <[email-masked]>
Date: Sat, 4 Feb 2017 16:12:54 +0000

Tony,

Can you take part of a day (more than 5 minutes please) and offer a thoughtful outline of the architectural functions and the material benefits to national regulators and carriers to require use of BITCOIN "innovative fingerprinting techniques" to authenticate originating carrier identity and attest to the authenticity of the calling number in SIP?

Pierce

Sent from my iPad

> On Feb 4, 2017, at 9:50 AM, Tony Rutkowski <[email-masked]> wrote:
>
> Alex,
>
> <CYBER(16)008006_Overview_of_spoofed_call_developments.docx>

________________________________

This e-mail may contain Sprint proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message.

---

From: Richard Shockey <[email-masked]>
Date: Sat, 04 Feb 2017 16:59:48 -0500

<sigh>  I guess I need to chime in here again since I posted the original message. 

From: stir <[email-masked]> on behalf of Tony Rutkowski <[email-masked]>
Organization: Yaana Ltd
Reply-To: <[email-masked]>
Date: Saturday, February 4, 2017 at 8:50 AM
To: Alex Bobotek <[email-masked]>, Dave Crocker <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [stir] The Canadian Regulator has issued a Notice of Consultation on robocalls spoofing STIR/SHAKEN

Alex,

Thanks for the reflective note.  My remarks were directed at the CRTC Call for comments which was circulated on this list.  I had four points to make: 1) the incorporation into law of technical specifications such as the STIR/SHAKEN by designated standards bodies is ill advised, 2) the FCC's recent activism in this regard seem likely to change, 3) there are alternative platforms emerging that seem more promising, and 4) the adoption of STIR/SHAKEN is unlikely to be useful in dealing with what is basically a traffic management issue among carriers and customers.

RS>  Fair point but NRA’s incorporate highly specific technical specifications into regulation all the time. And in the US this is clearly Title II related so Authority to Act is not in question. I do not suggest STIR/SHAKEN is perfect but it is a clear improvement over nothing.  

Having been in an out of local, national, and international regulatory bodies over the past 50 years, there is one maxim that served those bodies well - avoid incorporating specific technical "fixes" proffered by standards bodies into regulations.  Anointing those bodies gives them de facto regulatory authority and they tend to become more closed, ossified, and manipulated over time, and innovation gets stifled as a result. 

RS> Next thing you are going to suggest is phone numbers are stupid. <sigh> J  

Regarding the FCC, one has only to turn on the news or visit its site to realize that its role and activities are significantly changing, heading in the other direction of regulatory intervention into the industry management of its own affairs.  The telecom industry would be now foolish to paradoxically argue against own interests to "regulate me."

RS>  The level of frustration among the NRA’s is at a boiling point. The CRTC consultation is only one of many underway or may be underway.  Film at 11.  

As for Chairman Pai he has made it abundantly clear what constitutes a reason for regulatory intervention.

A.  Clear evidence of Market Failure  

B.  Clear Public Safety interest. 

C.  Compelling Consumer Protection interest.

Check Check Check  I think we have met those tests.

You should go back and play the FCC strike force and listen to Pai’s remarks.  He came to the mtg late. Don’t presume the way some Conservatives might behave. 

https://www.fcc.gov/news-events/events/2016/10/second-meeting-industry-led-robocall-strike-force

New innovative platforms can in part or whole serve as more efficient and more flexible alternatives to STIR/SHAKEN. These include not only blockchain, but also AI techniques pioneered by GeorgiaTech and spun out as Pindrop and apparently now nine other competitors.  CRTC should not stifle the innovation that has emerged in this sector.

RS> Well that may be true but this position could have been useful 2 years ago but not now. 

Even if STIR/SHAKEN were able to be imposed at the national level by regulatory fiat, it is unlikely to be a global solution, nor one that even addresses and adapts to the changing network management demands faced by carriers among their diverse customer sets. They are entirely capable of devising and implementing their own solutions and coordinating them through global industry bodies such as the GSMA.  To the extent some kind of local national support centre is needed, the UK NICC model might be useful.

RS> GSMA you have to be kidding. After they screwed up VoLTE?   God help us.  If we were to wait for a global solution or what you propose we all be six feet under.  I sort of know what NICC and OFCOM is generally thinking.  Beyond my personal presentation in London take a careful look at what Huw Saunders of OFCOM presented before me.  

http://www.niccstandards.org.uk/meetings/forum-2016.cfm

In any event, I want the IETF to wrap up the STIR documents now …and that means you Mr. Peterson. Get busy …

Jon if you want to proceed with out of band STIR solutions, be my guest. Have at it. Have a ball. Good luck with that. Two thumbs up.   I just don’t think it will be relevant to North America. 

best,
tony

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 4 Feb 2017 18:39:30 -0500

Hi Richard,

The idea is for you and others to file their comments
in the consultative proceeding rather than use mine
as a template.  :-) <please take a sigh or two>

Two things are remarkable here.

One is that the E.164 identifier system and infrastructure
exists pursuant to ITU-T standards, and that organization
has not found it necessary to adopt STIR/SHAKEN for
the PSTN infrastructure as an applicable specification.
Nor apparently has any industry operators organization
or national regulatory authority anywhere in the world
even in the face of this matter being a global problem.

The matter was, of course, raised at the 2 June 2014
workshop held at the ITU-T, and further study has been
planned for the upcoming Study Period.  See attached.
The STIR work does get included in the gap analysis
along with other competing group approaches.  It is not
clear at this point which solutions will be favoured, but
it seems very premature for any regulatory authority to be
proceeding before some stability or consensus emerges
as to appropriate solutions globally.

Two, there is nothing to prevent any provider or group of
providers today from moving ahead with STIR/SHAKEN
or anything else they choose.  Providers don't need to run
to the FCC or CRTC and get them to bless your favorite
platform that you and your colleagues have produced and
make it part of the Code of Federal Regulations or otherwise
designated as the solution in a FCC Order.

--tony

ps. Given this problem has gone on for the past two decades
a couple years more to innovate and devise better solutions
doesn't seem like a stretch - especially when it's not clear
that your favorite platform will make any significant improvement.