Back in 2020 when we went live with STIR/SHAKEN signing in the US, we published a matrix of the various levels of attestation we’d apply to calls. This now needs to change as the FCC has refined the guidance and is sweeping up those who should sign but don’t – the Third Party Authentication Order. These changes will be live on the Simwood network this week, where not already. We know other networks are taking longer, an extension has been granted to some, and we expect it’ll be a while before enforcement catches up with policy, but don’t rely on that.
Customers should assume these changes are already effective however, because some operators will already be applying them – we mostly already were but have an imminent update to apply the last changes. We believe these changes will disrupt your traffic in some cases and decisions will need to be made about how to mitigate that – we describe these scenarios below.
We’re sorry we’re letting you know later in the day than we’d like – the devil is in the detail and aspects of this have required legal interpretation. As you’ll see in most cases we were already doing more than was required and now need to do less, forcing it on you. There are solutions and a path forwards though, you just need to choose the appropriate one for your business and use case.
Changes
The key changes are:
Calls with non-US ANI
I think fairly uniquely, Simwood signed international calls we were gatewaying into the US (i.e. a call to a US number from a non-US number). This is now a requirement, but with a twist. We used to apply the same attestation logic as we would for domestic calls, e.g. a UK on-platform number would get an A, but the FCC has said these should only be a C. Regardless of our level of knowledge about the calling number, we will now only attest with a C. In summary: International calls = C, signed by the party gatewaying them into the country.
Calls with US ANI
We have hitherto signed calls according to the aforementioned matrix. The FCC order now specifically prohibits us from doing so where we are not the originator of the traffic, i.e. the end-user is not using the number on our end-user platform.
This practically means we will only be signing calls originating on the Sipcentric platform (with an A or a B as appropriate, usually B as this is a white-label indirect platform where we don’t have the contractual relationship with the end-user).
For wholesale/Carrier Services traffic, previously we would have signed calls with a ‘C’ where they weren’t already signed but are now prohibited from doing so. This even includes where the traffic is being originated from a number suballocated by us – because we have no idea how many more layers it is being suballocated through or who the end-user is.
This is where we expect a problem to be caused – essentially all US originated traffic must now be signed, but we’re prohibited from signing for you unless you are on our end-user platform.
Calls which enter our network unsigned will be blocked. While other networks may be slower at implementing the changes, they are flirting with fines in the millions of dollars by not blocking them – so do not rely on it continuing.
Solutions
There are a number of solutions for customers passing traffic to the USA, in increasing order of change complexity and cost:
- If you already sign calls yourself, we will simply validate the signature and pass them along unaltered.
- Non-US originated calls should use non-US CLI (NN/ANI and presentation number). We will appropriately sign and attest those calls as the gateway to the US and you need to make no changes.
- Customers with genuine end-users needing to originate calls from the US can port US numbers into us (if not already on Simwood) and use them through Simwood Hosted. There are a number of commercial models here to enable this. We will sign calls from the platform as described above.
- If you would like to continue originating calls with US ANI at the Carrier Services level, and are not already doing so, you will need to sign and attest calls in your own name. There are a number of steps to register in the US and ultimately obtain your own certificate – we have excellent consultants who we can introduce you to. It will incur you both additional admin and ongoing cost but it puts you in full control and makes you liable for the regulatory consequences of your calls. Having got a certificate, there are two options:
- You give us your certificate, securely through our API, and we will host both the public key for validation purposes and sign your calls using your private key. Any given trunk can have a single certificate, and all numbers under that trunk will be signed with that certificate at a level of attestation confirmed on the trunk. This means we can also sign your customer’s calls with their certificates if you like – you just configure a trunk. We call this the Simwood Certificate Hosting Service.
- You install your certificate on your equipment and pass calls to Simwood signed, with the appropriate level of attestation for the number concerned. See 1.
Unfortunately, these choices apply regardless of the quantity of US numbers on your account. For customers with thousands, this is likely already moot, but for those with one or two, to solve particular customer needs, we recognise any option may be undesirable and you may prefer to use the number inbound-only or cancel it. For those for whom option 4 is relevant, there is a waiver you can sign which will allow us to continue signing/attesting on your account for up to 90 days – we will only do this of course if you are committing to obtaining your own certificates as a solution, not deferring a decision / buying time.
The future?
We expect enforcement to lag policy as most of the industry is still catching up, but this will finally mean that pretty much all calls should be STIR/SHAKEN signed as while scenarios exist where operators cannot / will not sign, their calls will now be blocked by the first compliant operator. This is good in one sense but will, by definition, lead to disrupted call flows where they involve an operator who should sign but does not. These changes should dramatically reduce the foreign originated spam calls entering the US, not least because they will dramatically reduce the overall volume of calls entering the US!
International operators calling into the US ‘from’ their own country code will not see disruption directly as a result of changes here. However, we or other operators will be signing calls with a C which may be a lower attestation than we gave before. Some end-users or mobile networks may be filtering out ‘C’ calls as a matter of policy already – dirty foreigners and all that!
With STIR/SHAKEN it is trivial for a terminating operator to see which other operator has gatewayed international calls into the US, or indeed who the originating operator is within the US, as they will now be the only ones who can sign the call. This is already driving behaviours such as the profiling of signing entities and the blocking of their calls just based on reputation, something I spoke about in the context of Nuisance Calls earlier and have mixed opinions on. It is also enabling large terminating networks to see exactly where traffic originates and cut out the entire supply chain by offering the ultimate customer attractive terms – blatantly anti-competitive and like most changes we see in the US it will probably lead to a flow of money towards those with incumbency and employed lobbyists.
Surprisingly, there is a silver lining here. Whether we’re signing your calls, you’re signing them, or we’re signing them with your certificate, our position on filtering does not change. We have industry leading nuisance call filtering already but apply additional strict and defined rules on calls to US numbers which means traffic exiting Simwood is cleaner than most other networks. We have zero ITG tracebacks in the last year and an excellent reputation amongst peers. Putting your traffic behind Simwood will ensure it is similarly clean and with your own reputation on the line as a result of STIR/SHAKEN, you will similarly benefit through call deliverability.
So there we go. If you can’t call the US or lose your customer to the oligopoly, you now know why. Please don’t shoot the messenger, but please do act if you are affected.
