Re: [stir] The Canadian Regulator has issued a Notice of Consultation on robocalls spoofing STIR/SHAKEN

Tony Rutkowski <tony@yaanatech.co.uk> Sat, 04 February 2017 13:50 UTC

Return-Path: <tony@yaanatech.co.uk>
X-Original-To: stir@ietfa.amsl.com
Delivered-To: stir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39F56129AA6; Sat, 4 Feb 2017 05:50:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level:
X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h2XrOFJylcdO; Sat, 4 Feb 2017 05:50:06 -0800 (PST)
Received: from uk-www1.yaanatech.uk (uk-www1.yaanatech.uk [46.20.116.155]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD21A129650; Sat, 4 Feb 2017 05:50:05 -0800 (PST)
Received: from [192.168.1.51] (pool-70-106-242-209.clppva.fios.verizon.net [70.106.242.209]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by uk-www1.yaanatech.uk (Postfix) with ESMTPSA id 3513B54059C; Sat, 4 Feb 2017 13:50:03 +0000 (GMT)
References: <7F3DCD21-1085-4961-82D7-CE12DB308305@shockey.us> <a9417cde-33d4-3da2-ad2a-5b83bd81701f@yaanatech.co.uk> <74394dc8-5a61-cb8f-eb9d-98b499256326@dcrocker.net> <5fbc40d2-51f5-7073-f99a-488cd53f8fce@yaanatech.co.uk> <974c2333-aef5-1c93-744c-58dbaaa20ca9@dcrocker.net> <286e60eb-baa3-c4ec-6c32-43e217713310@yaanatech.co.uk> <3d4c18f8-f08c-8ce9-6e37-5498069ae5df@bbiw.net> <4B1956260CD29F4A9622F00322FE0531012CFB5151B1@BOBO1A.bobotek.net>
To: Alex Bobotek <alex@bobotek.net>, Dave Crocker <dcrocker@bbiw.net>, "stir@ietf.org" <stir@ietf.org>, "sipcore@ietf.org" <sipcore@ietf.org>
From: Tony Rutkowski <tony@yaanatech.co.uk>
Organization: Yaana Ltd
Message-ID: <bee03501-accf-8bb4-b9d9-06f4cb494045@yaanatech.co.uk>
Date: Sat, 04 Feb 2017 08:50:02 -0500
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0
MIME-Version: 1.0
In-Reply-To: <4B1956260CD29F4A9622F00322FE0531012CFB5151B1@BOBO1A.bobotek.net>
Content-Type: multipart/alternative; boundary="------------D78843DFB546B282D6ADAE9D"
Archived-At: <https://mailarchive.ietf.org/arch/msg/stir/uzbxRudgnzgc04bSMFsbjML3mr8>
Subject: Re: [stir] The Canadian Regulator has issued a Notice of Consultation on robocalls spoofing STIR/SHAKEN
X-BeenThere: stir@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
Reply-To: tony@yaanatech.co.uk
List-Id: Secure Telephone Identity Revisited <stir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/stir>, <mailto:stir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/stir/>
List-Post: <mailto:stir@ietf.org>
List-Help: <mailto:stir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/stir>, <mailto:stir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 04 Feb 2017 13:50:07 -0000

Alex,

Thanks for the reflective note.  My remarks were directed at the CRTC 
Call for comments which was circulated on this list.  I had four points 
to make: 1) the incorporation into law of technical specifications such 
as the STIR/SHAKEN by designated standards bodies is ill advised, 2) the 
FCC's recent activism in this regard seem likely to change, 3) there are 
alternative platforms emerging that seem more promising, and 4) the 
adoption of STIR/SHAKEN is unlikely to be useful in dealing with what is 
basically a traffic management issue among carriers and customers.

Having been in an out of local, national, and international regulatory 
bodies over the past 50 years, there is one maxim that served those 
bodies well - avoid incorporating specific technical "fixes" proffered 
by standards bodies into regulations.  Anointing those bodies gives them 
de facto regulatory authority and they tend to become more closed, 
ossified, and manipulated over time, and innovation gets stifled as a 
result.

Regarding the FCC, one has only to turn on the news or visit its site to 
realize that its role and activities are significantly changing, heading 
in the other direction of regulatory intervention into the industry 
management of its own affairs.  The telecom industry would be now 
foolish to paradoxically argue against own interests to "regulate me."

New innovative platforms can in part or whole serve as more efficient 
and more flexible alternatives to STIR/SHAKEN. These include not only 
blockchain, but also AI techniques pioneered by GeorgiaTech and spun out 
as Pindrop and apparently now nine other competitors.  CRTC should not 
stifle the innovation that has emerged in this sector.

Even if STIR/SHAKEN were able to be imposed at the national level by 
regulatory fiat, it is unlikely to be a global solution, nor one that 
even addresses and adapts to the changing network management demands 
faced by carriers among their diverse customer sets. They are entirely 
capable of devising and implementing their own solutions and 
coordinating them through global industry bodies such as the GSMA.  To 
the extent some kind of local national support centre is needed, the UK 
NICC model might be useful.

best,
tony