Saturday, November 9, 2019

Malicious phone calls - November 2019 update

The last time I reported on this subject there was a different man in the White House.  On April 27, 2015 I put up the following post:  http://sigma5.blogspot.com/2015/04/mallicious-phone-calls-good-news.html.  The subject, then and now, was malicious phone calls.  And the title of that post included the phrase "good news".  I would like to report that things have gotten even better since then.  Unfortunately, honesty forbids me from saying that.  To review:

Malicious phone calls consist of spam calls, robo-calls, requests that you answer a survey, unwanted solicitations on behalf of a political candidate or issue, etc.  I got, and unfortunately still get, a lot of them.  It became particularly annoying when I retired.  Most, but far from all, of these kinds of calls come in during the day.  Retirement meant that I was now home so I could be annoyed by all of them, not just a few of them.

At the time I didn't have caller ID.  It used to be an expensive additional feature.  Now it is ubiquitous and usually included "at no additional charge".  Eventually I caved and got it.  Initially I paid a small fortune for it.  But then I changed to a service that included it for free.  Caller ID helped but many calls still got through.

For those I tried all the tactics "experts" recommend.  I didn't answer them.  Or I answered but tried to keep the telemarketer on the line for as long as possible.  Or I hung up immediately.  Or I pressed "1" (or whatever number they specified) to be deleted from their list.  Finally, I tried hurling the most horrible obscenities I could think of at the telemarketer.  None of it worked.

And, across the several thousand malicious calls I have by now received, I never once forked over a single cent to any of them.  You'd think they would mark me down as a lost cause and stop harassing me but they never did.

As I reported in my 2015 post, I eventually signed up for a "blocker" service called "NoMoRobo".   At the time, it was the only service available but it has since been joined by many others.

NoMoRobo is what's called a "black list" service.  They maintain a list of "bad guy" phone numbers.  If one of them calls me they take the call over and answer on my behalf.  This required me to train myself to not answer until the phone had rung at least twice.  That is annoying but a side effect was that it allowed me to keep track of how many blocked calls I was getting.

Unfortunately, scammers and other bad operators have figured out how to at least partially get around black lists and the other tactics the blocker services use.  But, compliments of the Trump Administration, a new white knight has appeared in the form of Ajit Pai, the current FCC Chairman. To hear Pai tell it, he has taken several effective steps to actually fix the problem.  So what's he done?

In 2017 the FCC put in a rule change.  It made it legal for telephone companies to put technology in place that would block calls from "invalid, unallocated, and unused" phone numbers from going through.  The FCC, at least according to a press release they issued, has also made "significant progress toward caller ID authentication".

They did this "through adoption and implementation of STIR/SHAKEN standards by networks [telephone companies]".  They have also "proposed or imposed monetary forfeitures totaling $245,923,500".  In August of this year the FCC also announced new rules to let the FCC crack down on bogus calls and texts originating from overseas.

Sounds impressive, right?  It would be if any of this had resulted in actual progress.  The monetary forfeitures, for instance, would be impressive if that represented actual money actually collected.  But I suspect that "proposed" is the important word here.

The same press release indicated that the FCC had initiated 140 enforcement actions.  But there are far more than 140 bad actors out there.  And how many of these actions have resulted in operations actually being permanently shut down?  I suspect the number is far less than 140.

The STIR/SHAKEN (truly an awesome acronym) technology sounds like a good idea.  Back in the day, figuring out where a phone call came from ("originated") was technologically easy but often practically hard.

Telephone calls were then handled by dedicated custom equipment.  And the "network" was a simple affair.  The current standard for telephone numbers was put in place in the '60s.  Each ten digit "phone number" consisted of a three digit area code, a three digit exchange, and a four digit phone number.

Each exchange consisted of a separate and unique set of equipment.  The last "hop" of a phone call was always from your phone to your exchange.  Exchanges were connected by "trunk" lines.  If a call originated from a number in your area code then your exchange hopped the call over a trunk line directly to the exchange that owned the phone on the other end (or handled it internally, if the call originated from within your exchange).

If the call originated "out of area" then it was hopped over a trunk line to the "long distance" exchange for your area code.  It in turn hopped the call over a trunk line to the exchange handling the originating phone's area code.  From there the call was hopped over a trunk line to the right exchange machine, and finally from there to the originator's phone.  Lucky for us, all this happened almost instantaneously.

Back in the day it took minutes to trace all this out, if you wanted to know where a call originated from.  But, also starting in the '60s, specialized computers called ESSs were put in place in exchanges.  Eventually, all exchanges had one.  That permitted caller ID and the phone number of the originator's phone became instantly available.  And that solved the problem for a while.

Then VoIP made its appearance.  The ESS computerized telephone switches enabled phone signals to be converted from "Analog" (wavy lines) to "Digital" (bits and bytes).  It wasn't many years before all long distance calls used the digital option for the part of the call that covered long distances.

And, if we have access to the call in digital form, why not ship the bits and bytes across the Internet.  VoIP stands for Voice (analog) over Internet Protocol (digital).  Soon it became much cheaper to ship bits and bytes long distances over the Internet than it was to ship them the same long distances over dedicated digital telephone circuits.

The problem is that VoIP is all smoke and mirrors.  If you fake things up well enough it looks just like the real thing.  And faking up the caller ID information to look any way you want it to look quickly became ridiculously easy to do.  You can now do it with a standard smart phone.  And it was definitely to the advantage of the bad guys to fake, which is commonly referred to as "spoof", caller ID information.

But the FCC is now all over this sort of thing like a wet blanket, right?  If only.  I got over twenty blocked calls yesterday and the count for today is rapidly approaching double digits.  And I still see the same bad behavior I have been seeing for years.

The telephone companies are now blocking "invalid, unallocated, and unused" phone numbers, right?  Wrong!  The "number" part of a caller ID is always supposed to be exactly ten digits long.  (When you dial a number the system will often fill the area code in for you.  Phone numbers are always exactly 10 digits long, even if it sometimes doesn't look that way.)

But I have gotten at least one call recently where the "number" part of the caller ID was short by a few digits.  (At the time NoMoRobo didn't have an entry for that number in their black list so I was able to see all the caller ID details.)

There are no valid area codes that start with zero.  If there were then dialing "0" to be connected to the operator wouldn't work right.  Is the "0" a request to be connected to the operator or a request for an area code starting with "0"?  The only way to eliminate ambiguity is to make sure that no valid area codes start with "0".  The same logic applies to exchanges.  None of them can have a number that starts with "0" either.  So the "invalid" part is missing in action.

I also get calls that NoMoRobo is letting through (until I report them and they update their list) where the "name" part is something like "CELLPHONE USER" or "NEW YORK  NY".  These are common defaults for cell phones.  Sometimes the user can change this.  Sometimes (common with pre-paid "burner" phones) the user can't.

But in all cases what these are is numbers assigned to accounts that used to be active aren't any more.  (And apparently it is possible to get lists of these "no longer in use" numbers, if you have the right connections.)  In other words they are "invalid" or "unused".  So that part isn't working either.

The STIR/SHAKEN standard is supposed to deal with VoIP and international call issues.  I am not going to go into the details.  They are complicated but, from what I have read, once it is implemented it should work.  But the fact that it is complicated means that it is hard to implement.  And "hard to implement" inevitably morphs into "slow to be implemented" in the real world.

And it must be implemented at every step along the way before it can work.  So my guess is that implementation has been "unaccountably delayed".  If the FCC pushes hard then it might be implemented extensively enough to do some good by, say, the end of 2020.  If the FCC doesn't push then God knows when it will get implemented.

And that leaves enforcement actions / penalties.  The FCC has routinely announced "successful" enforcement actions periodically going back more than a decade.  I have seen no indication that there has been enough successes in this area to make a noticeable difference.

One piece of good news is that they finally increased the penalties to the point where they are big enough, if assessed and collected, to represent real pain.  The old penalties were so small that they didn't even rise to the level of "business expense" let alone being painful enough to justify a change in behavior.

If anything, the situation since 2015 has gotten worse rather than better.  The tools necessary to bypass attempts to block malicious phone calls have gotten better and cheaper.  This has had the perverse effect of making the decision phone companies made a long time ago turn from a good idea, from a business point of view, to a bad one.

Back in the day they decided to come down on the side of protecting the bad actors, the purveyors of malicious phone calls.  Their calculus was that they would collect more money from the bad actors than they would lose as a result of the abuse their regular customers would suffer.  And for a long time they were right.

But what they have done has driven young people away from voice (spammy) and to text (not so much).  And that has reduced the market for voice services drastically.  And that has hurt their bottom line.  It just took a long time for this trend to become apparent.  Now, there is little they can do to reverse this trend.  Implementing STIR/SHAKEN might help.  Then again. it might not.

I'm an old fart so I prefer voice to text.  As such, I would love to be in a situation where it would be appropriate to heap praise on Mr. Pai and his FCC.  But I can't.  To date, he has been long on press releases and short (as in non-existent) on effective action.  When his efforts show actual results I'll let you know.

No comments:

Post a Comment