<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.gmaildefault
{mso-style-name:gmaildefault;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I guess I should clarify that what I intended to communicate by "a few years ago" would be more, like, 5-10 years or even more; heh. And I'd wager that even for as rapidly as SIP has been adopted in the corporate world, even a decade ago there had to be considerably more Fortune 500s out there with a wide installed base of PRI trunks relative even to today. And of course, if anybody were using their TFN as their outbound CID more than 2-3 years ago, not only would S/S not even have been much of a thing yet at that point (to the extent it was implemented at all, my understanding was that it was mostly being bootstrapped with self-signed certs), but apparently there was also no authoritative CNAM database for TFNs prior to March 2020 as was just clarified in this thread. So it makes sense that now that both of those things exist + how many inroads SIP trunking has made into enterprises that the use of TFNs in CID has exploded in just a couple of years' time.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Just as a potentially interesting data point, we have had TFNs parked with various SIP-first providers (who also act as RespOrgs as well), none of which have yet to pass a single S/S PASSporT/Identity header our way on any calls made to any of those numbers...I assume this must be because few-to-no carriers terminating TF calls have direct IP-peering set up with any of these entities (or if they do, they have no idea that any of our TFNs are reachable directly via IP), so they just get pushed to PSTN via TDM.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>By the way, love your test tool service. Thanks for putting it together and maintaining it...what a gift to the community. There are a handful of S/S testing tools out there, but yours is easily the most comprehensive...most just audibly read back to you whether or not your call was attested, and if so at what level. Nothing about who signed it, whether the backing cert and entire chain of trust is valid or not, and so on, as yours does. And since most other tests only provide one call-in number, if the call path between you and that testing tool happens to go through an intermediate carrier that strips out our PASSporT and either replaces it with their own or drops it entirely, tough noogies. Whereas you provide multiple call-in numbers across multiple carriers, which not only provides opportunity to work around such issues, but gives you some idea of call paths that might be breaking transmission of your PASSporT and which ones are okay. Super helpful!<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>-- Nathan<o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></a></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> David Frankel [mailto:dfrankel@zipdx.com] <br><b>Sent:</b> Friday, July 7, 2023 3:21 PM<br><b>To:</b> Nathan Anderson; 'Voice Ops'<br><b>Subject:</b> RE: [VoiceOps] STIR/SHAKEN warning!<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Nathan,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Regarding TFN’s as caller-ID: This became quite popular more than a mere few years ago. Many customer support operations (banks, brokerages, airlines, insurance companies, credit card companies) place outbound calls using their toll-free customer support number as caller-ID. In our RRAPTOR robocall surveillance platform, we have captured many, many thousands of calls with a TFN as the calling number. And the majority of those calls are signed, with varying levels of attestation. Most enterprise calls these days that I’m familiar with are initiated over SIP trunks (not PRI or analog trunks or POTS lines) and include the calling (FROM) number in the SIP INVITE.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Regarding signatures on calls TO TFNs: This also definitely happens. Our SHAKEN identity test tool (at <a href="https://portal.legalcallsonly.org/Info/Identity">https://portal.legalcallsonly.org/Info/Identity</a>) lets users call any of several test numbers, including some TFNs. We see signatures on many calls to those test TFNs. (We don’t save data for calls that do NOT have signatures, so I can’t tell you the fraction.) I do know that there are some toll-free providers that ALWAYS (or usually) have TDM in the call path. Since IDENTITY headers don’t travel over TDM, those calls will not have signatures at the terminating end.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>David<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> VoiceOps <<a href="mailto:voiceops-bounces@voiceops.org">voiceops-bounces@voiceops.org</a>> <b>On Behalf Of </b>Nathan Anderson via VoiceOps<br><b>Sent:</b> Friday, July 7, 2023 3:55 PM<br><b>To:</b> Voice Ops <<a href="mailto:voiceops@voiceops.org">voiceops@voiceops.org</a>><br><b>Subject:</b> Re: [VoiceOps] STIR/SHAKEN warning!<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thanks; I had no idea this was a thing.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>-- Nathan<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Paul Timmins [<a href="mailto:paul@timmins.net">mailto:paul@timmins.net</a>] <br><b>Sent:</b> Friday, July 7, 2023 2:39 PM<br><b>To:</b> Nathan Anderson<br><b>Cc:</b> Voice Ops<br><b>Subject:</b> Re: [VoiceOps] STIR/SHAKEN warning!<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Always worth pointing out that in March 2020, Somos rolled out TFNIdentity. We have it set up on customers who want to source from their TFNs, I haven't seen many carriers actually look it up, but it does exist.<o:p></o:p></p><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On Jul 7, 2023, at 5:34 PM, Nathan Anderson via VoiceOps <<a href="mailto:voiceops@voiceops.org">voiceops@voiceops.org</a>> wrote:<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I suspect things might be different now (& I just haven't kept up), but although it is clearly *possible* to transmit a TFN as the calling number / CID, I seem to remember that even just a mere few years ago, it was HIGHLY discouraged, and if you ever were to receive a call bearing a TFN as its CID, it had a very high likelihood of being fraudulent or spam. This was of course back when the vast, vast majority of TFNs were essentially implemented as a call forward or alias to a number that hung off of a local exchange. So of course outbound calls that many? most? companies with TFNs would make would typically be sourced from their local exchange number(s) and not from the TFN(s) (unless maybe a given company had a PRI and their provider allowed them to source calls from their TFN?). Thus the expectation for a long time (as I understood it) was that TFNs were truly inbound-only and should be treated as such.</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Loosely tangentially related, as a purely anecdotal report, I will note that I have yet to see a S/S signature/PASSporT attached to ANY calls made<span class=apple-converted-space> </span><b><i>*to*</i></b><span class=apple-converted-space> </span>ANY of our TFNs, via any of the 3 SIP wholesalers we have used as both RespOrgs & for actual traffic.</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>-- Nathan</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><div><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span class=apple-converted-space><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> </span></span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>VoiceOps [<a href="mailto:voiceops-bounces@voiceops.org"><span style='color:purple'>mailto:voiceops-bounces@voiceops.org</span></a>]<span class=apple-converted-space> </span><b>On Behalf Of<span class=apple-converted-space> </span></b>David Frankel via VoiceOps<br><b>Sent:</b><span class=apple-converted-space> </span>Friday, July 7, 2023 7:52 AM<br><b>To:</b><span class=apple-converted-space> </span>'Ivan Kovacevic'; 'Voice Ops'<br><b>Subject:</b><span class=apple-converted-space> </span>Re: [VoiceOps] STIR/SHAKEN warning!</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div></div></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Ivan asks: “</span><span style='font-family:"Calibri","sans-serif"'>How are you handling TFN atestations?”</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>When the signer of a call gives A-level attestation, it means that the signer knows that the caller “is authorized to use” the calling number.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>The signer can “know” that in any of a variety of ways. For toll-free numbers, the most sophisticated and secure is probably via Delegate Certificates. SOMOS, the North American Toll-Free Number Administrator, has commented about this in a current FCC proceeding:<span class=apple-converted-space> </span><a href="https://www.fcc.gov/ecfs/document/10605623514445/1"><span style='color:purple'>https://www.fcc.gov/ecfs/document/10605623514445/1</span></a><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>As the signer, there are other ways you could determine that the caller is authorized to use the number. For example, you could solicit some documentation from them (like an invoice from their RespOrg and/or service provider) and you could call the number and verify that your caller answers. The regulations (today) do not specify exactly how you “know” so you (as the signer) need to act in the spirit of the rules.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>This problem is not unique to toll-free numbers. I might have a geographic number that I obtain from provider A (and that’s how I get inbound calls to the number), but I make outbound calls from that number via providers B and C for redundancy and cost reasons.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Bear in mind that providers can set their own rules for what calls they will accept and what attestations they will assign, and those rules can be more restrictive than what might be dictated by regulation. For example, a provider might say “I will only assign A-level attestation to calls that use calling numbers assigned by me.” That’s their prerogative. In fact, a provider might say: “I will only accept calls that use calling numbers assigned by me. Those calls will get A-level attestation. I will reject all other calls.” There are no rules (to my knowledge) that prohibit providers from setting these kinds of rules.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><div><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span></b><span class=apple-converted-space><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> </span></span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>VoiceOps <<a href="mailto:voiceops-bounces@voiceops.org"><span style='color:purple'>voiceops-bounces@voiceops.org</span></a>><span class=apple-converted-space> </span><b>On Behalf Of<span class=apple-converted-space> </span></b>Ivan Kovacevic via VoiceOps<br><b>Sent:</b><span class=apple-converted-space> </span>Friday, July 7, 2023 7:27 AM<br><b>To:</b><span class=apple-converted-space> </span>Voice Ops <<a href="mailto:voiceops@voiceops.org"><span style='color:purple'>voiceops@voiceops.org</span></a>><br><b>Subject:</b><span class=apple-converted-space> </span>Re: [VoiceOps] STIR/SHAKEN warning!<o:p></o:p></span></p></div></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><div><div><div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Hopefully on-topic. How are you handling TFN atestations? </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div></div><div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div></div><div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Although a part of NANP - it's a different technology at the network level in terms of chain of authority and routing.</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div></div><div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div></div><div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>RespOrg manages the number, but can provision and use many carriers to make outbound calls using the TFN Caller ID (and to receive inbound calls via the same TFN)... RespOrgs is not necessarily a carrier - who and how checks that RespOrg has the authority in case of delegated attestation. I may be overcomplicating it in my mind.. but it doesn't feel like the regulation maps 1-to-1 over to TFNs... Just wondering what everyone's experience is. </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div></div><div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div></div></div><div><div><div><div><p class=MsoNormal><span class=gmaildefault><span style='font-family:"Calibri","sans-serif"'>Thanks,</span></span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div></div><div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div></div><div><div><p class=MsoNormal><span class=gmaildefault><span style='font-family:"Calibri","sans-serif"'>Ivan</span></span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><o:p></o:p></span></p></div></div></div></div></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div></div><p class=MsoNormal><span style='font-size:4.5pt;font-family:"Helvetica","sans-serif"'>_______________________________________________<br>VoiceOps mailing list<br></span><a href="mailto:VoiceOps@voiceops.org"><span style='font-size:4.5pt;font-family:"Helvetica","sans-serif";color:purple'>VoiceOps@voiceops.org</span></a><span style='font-size:4.5pt;font-family:"Helvetica","sans-serif"'><br></span><a href="https://puck.nether.net/mailman/listinfo/voiceops"><span style='font-size:4.5pt;font-family:"Helvetica","sans-serif";color:purple'>https://puck.nether.net/mailman/listinfo/voiceops</span></a><o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>nt-family:"Calibri","sans-serif"'><o:p></o:p></p><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:4.5pt;font-family:"Helvetica","sans-serif"'>_______________________________________________<br>VoiceOps mailing list<br></span><a href="mailto:VoiceOps@voiceops.org"><span style='font-size:4.5pt;font-family:"Helvetica","sans-serif";color:purple'>VoiceOps@voiceops.org</span></a><span style='font-size:4.5pt;font-family:"Helvetica","sans-serif"'><br></span><a href="https://puck.nether.net/mailman/listinfo/voiceops"><span style='font-size:4.5pt;font-family:"Helvetica","sans-serif";color:purple'>https://puck.nether.net/mailman/listinfo/voiceops</span></a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>