<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Arial Black";
panose-1:2 11 10 4 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>So far this trail of emails is correct. All calls have to be traceable back to the origination provider (via PA registered certificates) for legal enforcement purposes. So each SP will need to authenticate (guarantee validity of) their own calls. You just don’t necessarily need access to your own phone numbers if you lease. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I would add that not only will a network likely be blocked for monkey business, it will be prosecuted too. And with the recent passing of the Traced Act and all the hype at the FCC lately they’re likely to impose big penalties on bad-actors. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Dave<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> VoiceOps <voiceops-bounces@voiceops.org> <b>On Behalf Of </b>Mark Lindsey<br><b>Sent:</b> Wednesday, September 2, 2020 2:01 PM<br><b>To:</b> Alex Balashov <abalashov@evaristesys.com><br><b>Cc:</b> VoiceOps <voiceops@voiceops.org><br><b>Subject:</b> Re: [VoiceOps] Outsourcing STIR/SHAKEN Setup<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>SHAKEN doesn't record the chain (like you'd see with Via headers, for example) of Intermediate Providers who handle the call. There's only one Identity header and it is to be passed unchanged from the origin point to the terminating Voice Service Provider.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>When the Identity header with PASSporT arrives at the final Voice Service Provider, that recipient can determine who created the PASSporT and then make judgments. For example, there has been a lot of discussion in FCC filings about "reputation" of service providers. Perhaps you could subscribe to a Reputation database to determine what to do with the calls.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>For example, "This call got an A level attestation from XYZTelecom, but XYZTelecom has a 5% score in the reputation database, so I'm going to treat it as if this call is likely a nuisance call."<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><div><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><div><div><div><div><div><div><div><p class=MsoNormal><b><span style='font-size:7.0pt;font-family:"Arial Black",sans-serif;color:#004479'>Mark R Lindsey, SMTS</span></b><span style='font-size:10.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span><span style='font-size:12.0pt;font-family:"Arial Black",sans-serif;color:#794800'>|</span><span style='font-size:10.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span><span style='font-size:7.0pt;font-family:"Arial Black",sans-serif;color:#004479'>+1-229-316-0013</span><span style='font-size:10.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span><span style='font-size:12.0pt;font-family:"Arial Black",sans-serif;color:#794800'>|</span><span style='font-size:10.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span><span style='font-size:7.0pt;font-family:"Arial Black",sans-serif;color:#004479'><a href="mailto:mark@ecg.co">mark@ecg.co</a></span><span style='font-size:10.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span><span style='font-size:12.0pt;font-family:"Arial Black",sans-serif;color:#794800'>|</span><b><span style='font-size:7.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span></b><b><span style='font-size:7.0pt;font-family:"Arial Black",sans-serif;color:#004479'><a href="https://ecg.co/lindsey/"><span style='color:#004479'>https://ecg.co/lindsey/</span></a></span></b><span style='color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p></div></div></div></div></div></div></div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p></div><div><p class=MsoNormal><br><br><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal>On Sep 2, 2020, at 2:52 PM, Alex Balashov <<a href="mailto:abalashov@evaristesys.com">abalashov@evaristesys.com</a>> wrote:<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>Thank you, that’s very clear and sums it all up! <o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>One lingering question: even without providing a fully attestable chain of custody, if the call took a route A -> B -> C, are signatures cumulative such that I could block calls attested by B coming through C? Or am I constrained to blocking a certain level of attestation only through the last/proximate peering hop (C) that directly touches me?<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>I suppose success is going to come down to the on-the-ground realities, political viability, etc of taking that “block attested calls from carrier X” step.<o:p></o:p></p><div><p class=MsoNormal>—<o:p></o:p></p><div><p class=MsoNormal>Sent from mobile, with due apologies for brevity and errors.<o:p></o:p></p></div></div><div><p class=MsoNormal><br><br><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal style='margin-bottom:12.0pt'>On Sep 2, 2020, at 2:47 PM, Paul Timmins <<a href="mailto:ptimmins@clearrate.com">ptimmins@clearrate.com</a>> wrote:<o:p></o:p></p></blockquote></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal> <o:p></o:p></p><div id=divtagdefaultwrapper><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:12.0pt'>The solution is that you sign your calls with your certificate. Carriers aren't doing LNP dips to verify the number is really yours, they're trusting your attestation (A: yes, the caller id is verified, B: it comes from our customer, but not verified, C: "this touched our switches, good luck with it"). If you attest total nonsense as A, or send tons of nonsense in general, people start blocking calls you sign.<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:12.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:12.0pt'>It really verifies who is sending the call, and what that company says the call is verified, not a full chain of custody of the number back to the NANPA/PA. Could you attest A a call from "0" or "911", or "999-999-9999"? Yes, you could. It'd work for a while, til someone said "Wow, Alex's SPID is signing tons of bullshit. Let's block attested calls from his SPID"<o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:12.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:12.0pt'>-Paul<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:12.0pt'><o:p> </o:p></span></p><div><div class=MsoNormal align=center style='text-align:center'><span style='font-size:12.0pt'><hr size=2 width="98%" align=center></span></div><div id=divRplyFwdMsg><p class=MsoNormal><b>From:</b> VoiceOps <<a href="mailto:voiceops-bounces@voiceops.org">voiceops-bounces@voiceops.org</a>> on behalf of Alex Balashov <<a href="mailto:abalashov@evaristesys.com">abalashov@evaristesys.com</a>><br><b>Sent:</b> Wednesday, September 2, 2020 2:42 PM<br><b>To:</b> VoiceOps<br><b>Subject:</b> Re: [VoiceOps] Outsourcing STIR/SHAKEN Setup<span style='font-size:12.0pt'> <o:p></o:p></span></p><div><p class=MsoNormal><span style='font-size:12.0pt'> <o:p></o:p></span></p></div></div><div><p class=MsoNormal><span style='font-size:12.0pt'>LCR or no LCR, using a termination vendor that is different to one’s origination vendor for a given CID is more normal than not in VoIP. I would guess it’s the default wholesale use-case. Origination and termination are very different business models with radically different economics. <o:p></o:p></span></p><div><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:12.0pt'>I’m not clear on what the official STIR/SHAKEN solution to this is. I assume it’s delegated certificates as Jared suggested.<o:p></o:p></span></p><div><p class=MsoNormal><span style='font-size:12.0pt'>— <o:p></o:p></span></p><div><p class=MsoNormal><span style='font-size:12.0pt'>Sent from mobile, with due apologies for brevity and errors.<o:p></o:p></span></p></div></div><div><p class=MsoNormal><span style='font-size:12.0pt'><br><br><o:p></o:p></span></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:12.0pt'>On Sep 2, 2020, at 2:39 PM, Carlos Alvarez <<a href="mailto:caalvarez@gmail.com">caalvarez@gmail.com</a>> wrote:<o:p></o:p></span></p></blockquote></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal><span style='font-size:12.0pt'> <o:p></o:p></span></p><div><p class=MsoNormal><span style='font-size:12.0pt'>If I understand correctly, no as long as your providers are all supporting this. What I think you mean is that you get origination/DIDs from say Bandwidth, and you use LCR to route calls to whoever is cheapest? There are ways to work with that challenge as long as your carriers are ready to do so.<o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p><div><div><p class=MsoNormal><span style='font-size:12.0pt'>On Wed, Sep 2, 2020 at 11:28 AM Jared Geiger <<a href="mailto:jared@compuwizz.net">jared@compuwizz.net</a>> wrote:<o:p></o:p></span></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><p class=MsoNormal><span style='font-size:12.0pt'>If we purchase our numbers through wholesalers, would we need delegated certificates if we are sending an outbound call through a vendor that is not the wholesaler we got the number from?<o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p><div><div><p class=MsoNormal><span style='font-size:12.0pt'>On Wed, Sep 2, 2020 at 7:22 AM Dave Frigen <<a href="mailto:dfrigen@wabash.net" target="_blank">dfrigen@wabash.net</a>> wrote:<o:p></o:p></span></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal><span style='font-size:12.0pt'>There is a STIR-SHAKEN process of registering and testing with the Policy<br>Administrator (PA) as a certified Service Provider (SP) before you can<br>purchase SHAKEN token certificates from a Certificate Authority (CA) and<br>begin to engage in using the technology. This is not a walk in the park.<br>Transnexus is one of two public CA's in the U.S. today. They are experts on<br>the subject and can help you through both processes. In order to get the<br>best call attestation you must prove to the PA and CA that you are a bono<br>fide service provider and not a bad-acting enterprise on a network that<br>deserves lesser attestation levels. <br><br>One of the registration requirements is a SP 's access to valid national<br>phone number pools. This has been very confusing for some resale providers<br>that purchase and use numbers from wholesalers only. If your organization<br>does not have it's own numbering resources, you can register using your<br>wholesale provider's numbering pool data. Don't assume you have to register<br>with the FCC and possess your own pool of numbers to become a registered<br>SHAKEN SP.<br><br>SHAKEN ROBO call mitigation is a new frontier, and obtaining the best<br>attestation level possible for a SP is essential to the SP and the SHAKEN<br>ecosystem. Register and test for the best attestation level possible.<br>Transnexus is a seasoned expert on the subject and a U.S. registered CA with<br>the PA. <br><br>Dave<br><br><br>-----Original Message-----<br>From: VoiceOps <<a href="mailto:voiceops-bounces@voiceops.org" target="_blank">voiceops-bounces@voiceops.org</a>> On Behalf Of Mary Lou Carey<br>Sent: Tuesday, September 1, 2020 5:36 PM<br>To: Dovid Bender <<a href="mailto:dovid@telecurve.com" target="_blank">dovid@telecurve.com</a>><br>Cc: <a href="http://Voiceops.org">Voiceops.org</a> <<a href="mailto:voiceops@voiceops.org" target="_blank">voiceops@voiceops.org</a>><br>Subject: Re: [VoiceOps] Outsourcing STIR/SHAKEN Setup<br><br>I'm a Carrier Consultant who's been helping CLEC, IXC, Paging, Wireless and<br>VOIP carriers install and maintain their PSTN networks for the the last 20<br>years. I can help clients get their FCC Certification to become a<br>STIR/SHAKEN carrier as well as Numbering Resources, NPAC / LSR training, etc<br>(if you need those pieces). Once my clients get their certification, I refer<br>them to TransNexus. Jim and his team can help you with the process of<br>turning your STIR/SHAKEN services up.<br><br>MARY LOU CAREY<br>BackUP Telecom Consulting<br>Office: 615-791-9969<br>Cell: 615-796-1111<br><br>On 2020-08-31 05:37 AM, Dovid Bender wrote:<br>> Hi,<br>> <br>> Does anyone have a recommendation for a company that get us everything <br>> needed for STIR/SHAKEN setup? By setup I mean helping us file to get a <br>> cert etc. From the small research I have done there is a lot of <br>> fragmented information out there and it would be easier for us to pay <br>> someone else to do this then invest our own time to take care of this.<br>> <br>> TIA.<br>> <br>> Regards,<br>> <br>> Dovid<br>> _______________________________________________<br>> VoiceOps mailing list<br>> <a href="mailto:VoiceOps@voiceops.org" target="_blank">VoiceOps@voiceops.org</a><br>> <a href="https://puck.nether.net/mailman/listinfo/voiceops" target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a><br>_______________________________________________<br>VoiceOps mailing list<br><a href="mailto:VoiceOps@voiceops.org" target="_blank">VoiceOps@voiceops.org</a><br><a href="https://puck.nether.net/mailman/listinfo/voiceops" target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a><br><br>_______________________________________________<br>VoiceOps mailing list<br><a href="mailto:VoiceOps@voiceops.org" target="_blank">VoiceOps@voiceops.org</a><br><a href="https://puck.nether.net/mailman/listinfo/voiceops" target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a><o:p></o:p></span></p></blockquote></div><p class=MsoNormal><span style='font-size:12.0pt'>_______________________________________________<br>VoiceOps mailing list<br><a href="mailto:VoiceOps@voiceops.org" target="_blank">VoiceOps@voiceops.org</a><br><a href="https://puck.nether.net/mailman/listinfo/voiceops" target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a><o:p></o:p></span></p></blockquote></div><p class=MsoNormal><span style='font-size:12.0pt'>_______________________________________________<br>VoiceOps mailing list<br><a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a><br><a href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a><o:p></o:p></span></p></div></blockquote></div></div></div></div></div></blockquote></div></div></div><p class=MsoNormal>_______________________________________________<br>VoiceOps mailing list<br><a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a><br><a href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a><o:p></o:p></p></div></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div><div><div><p class=MsoNormal><b><span style='font-size:7.0pt;font-family:"Arial Black",sans-serif;color:#004479'>Mark R Lindsey, SMTS</span></b><span style='font-size:10.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span><span style='font-size:12.0pt;font-family:"Arial Black",sans-serif;color:#794800'>|</span><span style='font-size:10.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span><span style='font-size:7.0pt;font-family:"Arial Black",sans-serif;color:#004479'>+1-229-316-0013</span><span style='font-size:10.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span><span style='font-size:12.0pt;font-family:"Arial Black",sans-serif;color:#794800'>|</span><span style='font-size:10.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span><span style='font-size:7.0pt;font-family:"Arial Black",sans-serif;color:#004479'><a href="mailto:mark@ecg.co">mark@ecg.co</a></span><span style='font-size:10.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span><span style='font-size:12.0pt;font-family:"Arial Black",sans-serif;color:#794800'>|</span><b><span style='font-size:7.0pt;font-family:"Arial Black",sans-serif;color:#794800'> </span></b><b><span style='font-size:7.0pt;font-family:"Arial Black",sans-serif;color:#004479'><a href="https://ecg.co/lindsey/"><span style='color:#004479'>https://ecg.co/lindsey/</span></a></span></b><span style='color:black'><o:p></o:p></span></p></div></div><div><p class=MsoNormal><o:p> </o:p></p></div></div></div></div></body></html>