[VoiceOps] STIR/SHAKEN Discussion: Will it help?

[Peter Beckman]

On Tue, 17 Dec 2019, mike at astrocompanies.com wrote:

> Good question.  First, if you're using Hooli, you'll have to migrate to
> Pipernet sooner or later.  Their middle-out compression provides much better
> call quality so it's worth the effort to migrate.

  Doh! What's their Weissman score?

> But to the issue you raised, the purpose of STIR/SHAKEN is not to block
> robocalls per se, it is to provide an authentication chain so that you can
> determine and contact the originating carrier regardless of the route the
> call took to reach the terminating side.

AFAIK, it is only the first originating carrier that gets a SIP Invite that
contains no STIR/SHAKEN header. Each carrier does not also add their own
header. I may be incorrect.

> So, now we can see that the call was attested by Hooli, and if Hooli does
> not cooperate with our fraud/nuisance investigations we are now authorized
> to block traffic signed by Hooli.  That does fix the problem to a large
> degree.

  Sure, but have you ever tried to contact a carrier for which you do not
  have a business relationship and get them to do something, and you are
  smaller and less consequential than they are?

  We can block Hooli, but now OUR customers are livid, and Hooli doesn't
  really care.

> However, it's also worthy of note that this is not the main problem that
> needs to be solved.  The main problem that needs to be solved is the case
> where you are sending the call to Hooli originating from a number that is
> assigned to our CLEC, which you don't have permission to use.  This does
> solve that problem, because Hooli is only going to issue partial attestation
> for that call since it's not their number.  So we can still contact Hooli
> about it because they attested it and from that I can find them, but we or
> our subscriber can also block calls with partial attestations if we/they
> choose to.

  But if I DO have a number assigned to me BY as CLEC that is not the
  terminating carrier (e.g. Acme gives me a DID, which I am authorized to
  use, then try to terminate using that DID as CallerID through Hooli, Hooli
  does not know (and cannot know for certain) that I, the Hooli customer, is
  authorized to use that DID as CallerID, even though I am. This results in
  a Hooli Partial Attestation, even though the call is fully compliant with
  all the rules.

---------------------------------------------------------------------------
Peter Beckman                                                  Internet Guy
beckman at angryox.com                                 http://www.angryox.com/
---------------------------------------------------------------------------