FCC fines robocaller record $120M

https://techcrunch.com/2018/05/10/fcc-slaps-robocaller-with-record-120m-fine-but-its-like-emptying-the-ocean-with-a-teaspoon/

by ayanai • 8 years ago

259 172 8 years ago

techcrunch.com

cft• 8 years ago

Adrian Abramovich speaking to Congress: https://www.youtube.com/watch?v=SkeZH_gUl04

lend0002• 8 years ago

The real problem is the lack of security and authentication on telephone networks, which enables number spoofing with virtually no chance of reprisal -- foreign callers (realistically out of the FCC's jurisdiction) use VoIP services to create calls that originate from an IP address from the telephone network's perspective, and the phone network makes no attempt to authenticate the metadata (like the phone number that is calling) before forwarding it on.

The 'neighborhood scam' is one which I am frequently subject to, and there is virtually nothing I can do about it (except block all the numbers with the same prefix as my own, but even this only covers the cases where they restrict their spoofed numbers to that small range).

Domestic callers like the one described in this article seem like a very small part of the problem, since they can be tracked and prosecuted. Foreign callers never pay the penalty with our current system, and I suspect they are more numerous based on the accents of most robocall operators I've gotten on the line.

ikeboy3• 8 years ago

I've suggested in the past that every instance of provable spoofing where they did not control the claimed number should result in a fixed fine. $100 sounds about right.

Every phone network will then quickly begin passing on that cost to anyone they "peer" with and it will be a non-issue soon enough.

Is there a compelling reason to allow such spoofs?

wtallis3• 8 years ago

Is there a compelling reason to allow such spoofs?

It makes telcos money. That's reason enough, since there are no economic downsides to the network operators that enable these crimes. If companies like AT&T and Verizon were also being subject to this $120M fine, we might see them decide to make caller ID trustworthy so that it could be used to block robocalls.

dqv3• 8 years ago

Is there a compelling reason to allow such spoofs?

A few use cases to spoof the number:

* Appointment reminder systems - if I see the caller ID is from my doctor's office, I'm going to pick it up and hear the reminder. When the calls come from some other number, people think it's spam. People still expect reminder calls even if you/HN crowd would prefer an email/text.

* Outbound call centers on behalf of others companies (same reason as above)

* People who work from home but want to make business calls from a personal phone

If no one could spoof, it probably result in a huge uptick of people claiming spam calls since they would be getting tons of calls from numbers they didn't know.

There really needs to be an SPF, DKIM, DMARC for VOIP. I don't think a no spoofing policy would go over well for businesses or consumers.

Rjevski7• 8 years ago

There are legitimate reasons for spoofing to work given how fucked up the PSTN is.

Mobile roaming is one for example - when you roam on another carrier and place a call, that carrier directly originates the call and “spoofs” your caller ID to make it look like the call originated from you.

Some companies may use different carriers for either load balancing or least-cost routing and so both of these carriers are required to “spoof” the company’s caller ID.

This can definitely be fixed with a CA system and “delegation” where the main carrier who owns the number can issue certificates for any other carrier you’d like to use to temporarily allow them to use a particular caller ID, and each call request should be signed with that certificate and the signature should be verified by call intermediate carriers down the chain, and the call dropped if the signature is missing or invalid.

mikekchar• 8 years ago

I'm afraid I didn't read TFA, so apologies if I'm getting the wrong end of the stick. Also it's been 20 years since I worked in PSTN stuff. But at least at that time, the security in the protocol was ridiculously lax. IIRC, with PRI there was literally a bit that you set to say that the originating number was checked and was legitimate. Every other switch on the way through would accept it blindly.

In most areas it was illegal to set that bit unless you were a telco. It was also illegal to sell equipment that set that bit unless you were selling it to a telco. But... it's not that hard to hack.

Someone who's more current can probably give you better information. As to why nobody does anything about it... well.. why should they? They literally don't care. The equipment manufacturers aren't going to change the specs (because it's pretty darn hard to change specs and they are all trying to screw each other over in the specs anyway). The telcos aren't going to demand that the specs are changed because people are making telephone calls -- exactly what they want. It's only if the governments demand the change -- and it will take laws to do that (even then, I imagine that it's cheaper to lobby against the law than to change the equipment -- you have absolutely no idea how crappy those systems are).

lend0002• 8 years ago

The reason I would agree with a fine is not because a caller's identity cannot be unmasked, but because phone numbers are so closely connected with identity that robocallers are essentially engaging in identity theft and slander when they use people's legitimate numbers to spoof their calls.

Shivetya• 8 years ago

Doesn't ANI work? When I worked at a business with a phone system used for time tracking we relied wholly on ANI as caller id is what is spoofed. However I am not sure if the ANI information is a paid for service or is it being spoofed as well? Caller ID data was always malleable and never to be trusted

kj4ips2• 8 years ago

ANI does not typically come with end-user lines, and is (sadly) also spoofable. There are already some systems for fraud analytics, but thye have their own issues.

A user can request a "trace" (usually by dialing a feature code), but not only does this hit the user with a ~$20 fee each time, but the information gathered can only be released to law enforcement, and since local law enforcement would need to make the request, it rarely happens.

bradleyjg2• 8 years ago

What I don’t understand is why no major mobile carrier is offering a solution to this. It’s a pretty competitive market and this could be a big selling point.

When the isp wars were going strong, before broadband put everyone under the thumb of monopolists and also before gmail, spam filtering was a serious competative advantage.

Why can’t phone companies take an RBL like approach? If your VoIP service garners too many complaints because you are selling to robocallers then you don’t get to have calls delivered to e.g. ATT mobile customers anymore?

Are there legal or technical interconnection requirements that would make such a thing impossible?

pboutros• 8 years ago

I think the answer is that it is not a pretty competitive market.

The two biggest carriers have a 1-2% monthly churn rate.

https://www.statista.com/statistics/283511/average-monthly-c...

rayiner7• 8 years ago

Blocking calls from certain VoIP services is almost certainly going to be a violation of common-carrier rules (which still apply to phone service no matter what happens with broadband).

At a technical level, spam filtering relies heavily on analyzing email text. Doing similar analysis on voice calls is way harder. Also, there's UI issues. You can redirect suspected spam emails to a folder the user can inspect for false positives. What do you do with a call that hits the robocall filter?

mikeash3• 8 years ago

AT&T has a Call Protect app which attempts to do this. It misses some, but my spam call volume has dropped quite a bit with it.

nikanj2• 8 years ago

Should be technically possible to have ”these numbers can originate from this operator”. I’ve learned that if a phone looks to be from my area code, it’s actually from China. No idea what the robocaller is saying.

My operator should be able to have a short list of teleoperators in this zip code, and drop other calls.

acdha2• 8 years ago

T-Mobile offers it as a free option with two levels: labeling the call as Scam Likely and blocking it outright. The latter is quite effective - I was getting 5+ calls per day and it’s now 1-2 per week.

JustSomeNobody2• 8 years ago

What I don’t understand is why no major mobile carrier is offering a solution to this.

Carriers have no economic incentive to do this. Most people on AT&T aren't going to jump to Verizon because of the number of robocalls they get on AT&T. It's not worth the hassle of changing.

reaperducer2• 8 years ago

What I don’t understand is why no major mobile carrier is offering a solution to this.

I remember at one of the WWDC keynotes, Tim Cook announced this as a new iPhone feature. But he also noted that it was only available in China. I wonder if whatever the Chinese carriers have done can be imported to the United States.

My wife's iPhone will occasionally get an incoming call with small text below reading "Possible spam." She never uses her phone for voice, so she never answers the phone anyway.

afo6• 8 years ago

We (Nomorobo) protect you from both neighbor spoofing as well as "standard" robocalls. We add over 1,300+ new robocaller numbers every day. It's pretty crazy out there.

bshep2• 8 years ago

I used Nomorobo for 6 months and it was NOT useful, i have a phone number from a area code + prefix that i dont live at, yet I get about 5-10calls/day from similar looking numbers. Nomorobo would mark them as ‘unblockable’ because of the areacode+prefix match, so i would have to manually block each one.

I switched to ATT Call Protect which works much better. Now i get 1-2 calls/week. I would go back to nomorobo if it worked better.

njarboe2• 8 years ago

The telephone system, in the US at least, could charge people extra for calling a number with the extra charge going to the person/company that was called (those famous 900 numbers, now gone, that kids would call and rack up $10000 phone bills.) It seems to me that it would be pretty easy to set up a system where, if a person is not in my contact list, they get charged some amount of money to call me. Setting it at 5 or 10 cents would be enough to kill almost all of these spam calls and not deter a real person from calling you.

Paul-ish• 8 years ago

The FCC at some point considered requiring authentication numbers or attaching names to numbers. They ultimately rejected the idea. There were multiple reasons why they rejected it, but from talking to someone at the FCC one of the reasons they rejected connecting numbers to identities too strongly is that victims of domestic abuse may need to call their abuser (eg about child support), but do so without giving away too much information (like address).

gruez• 8 years ago

payphone? also, can't you call as a blocked number?

nahumba• 8 years ago

This is whataboutism. Choosing one method is not saying 100% of enforcing with only one method. 100 million calls means statisticaly one of 3 usa readers got a call frim him. Thats alot.

walterbell• 8 years ago

a technology designed to prevent robocalls altogether, recommended in a report more than a year ago and currently set to be implemented in Canada in 2019, has no such date here in the States.

What’s the technology?

Edit: https://transnexus.com/solutions/stir-and-shaken/stir-and-sh...

”STIR and SHAKEN use digital certificates, based on common public key cryptography techniques, to ensure the calling number of a telephone call is secure. Each telephone service provider obtains their digital certificate from a certificate authority who is a trusted authority. The certificate technology enables the called party to verify that the calling number is accurate and has not been spoofed.”

flyinghamster4• 8 years ago

Some of the scammers have run shady phone companies like CallerID4U [0] specifically meant as "bulletproof hosting for robocallers". I could see them branching out into the CA business.

CallerID4U seems to have gone (has been put?) out of business, at least. My Asterisk box hasn't received calls from their prefixes (which I blacklisted) since 2015, and their website's main page returns a 403 Forbidden. [1] It took a bit of hunting with the Wayback Machine to find a good shot of their page. [2]

Spot-checking on telcodata.us, it looks like their prefixes/thousands groups have gone to others as well. 253-245-2xxx now belongs to CenturyLink, for instance, and 425-336-8xxx is unassigned.

Much like "unsubscribe" links in spammer emails, they even had a helpful "Click here to register a complaint and put your phone number on the DO NOT CALL (DNC) list" item on their web site.

[0] https://800notes.com/forum/ta-705926565a74ba5/callerid4u-inc...

[1] http://callerid4u.com/

[2] https://web.archive.org/web/20130310040410/http://callerid4u...

afo6• 8 years ago

Agreed. We (Nomorobo) stopped seeing calls from them around the same time.

They were also known as 33 wireless and a few related companies. Here's an old discussion about them [0]

Not sure what happened but their telephone number blocks were all reassigned to other companies

[0] https://800notes.com/forum/ta-705926565a74ba5/callerid4u-inc...

DEFCON28• 8 years ago

One technique I use is my phones have an area code from another state that I never get calls from. (South Dakota). If I get a call from this area code I know it’s spam.

jcl• 8 years ago

One potential flaw of this approach is that there are potentially legitimate services that bridge internet calls to local numbers. IIRC, Skype worked this way, and I assume other things like Google Hangouts and Twilio do, too.

JustSomeNobody2• 8 years ago

I got an angry call from a real person the other day yelling at me for calling them so many times. I tried to explain to them, it wasn't me, but they hung up after they said what they had to say.

Has anyone else had similar happen? For some naive reason I just figured the spoofers were using blocks of unused numbers, not live ones.

flyinghamster4• 8 years ago

They're using live ones, all right. Their latest tactic is to use random numbers in the same prefix as your phone, or use prefixes in nearby rate centers.

6DM• 8 years ago

Yes, this happened to me a few years back. I was waiting on an important phone call, so I had to answer. Turns out some guy was swearing up and down that I called him the day before.

rectang2• 8 years ago

The FCC has dragged their scapegoat into the public square to torture in a big show for the brutalized masses. But how effective has the FCC been at actually curtailing the problem of robocalls?

This FCC won't do anything meaningful because they've been bought off by the telecoms, and the telecoms make money hand over fist on robocalls:

http://www.latimes.com/business/lazarus/la-fi-lazarus-fcc-ro...

"The problem," he said, "is that for the carriers, it's a conflict of interest. All of these robocallers represent billable minutes. From a revenue standpoint, anything they do to crack down represents a reduction of billable traffic on their networks."

Same way this FCC's purported "deregulation" of net neutrality is a sham which rigs the game so that the telecoms can leverage their market dominance in more verticals.

We know what the technical solutions are for the problem of robocalls. Corruption and legalized bribery are preventing the application of those technical solutions.

rayiner7• 8 years ago

Do you have a source that’s not an offhand quote suggesting that carriers make any significant revenue from robo calls? Also, most robo calls are made through VoIP services. Aren’t they the one with the most financial incentive to keep robocalls going, and the ones that could most easily detect them? By the time the robocall gets to a carrier’s network, its already been mixed with tons of legitimate traffic from VoIP users.

Rjevski7• 8 years ago

I work in telecoms.

The billable minutes thing is absolutely true. You might not directly pay for them as a customer, but carriers pay each other for inbound calls, so whatever carrier that is originating the robocalls is paying the next carrier in the chain, and that one pays the next, and so on until it finally reaches your phone. We’re not talking much on a single call (the prices are often around 0,01$ or even less) but when you take all the robocalls originated in a single day that adds up to quite a bit.

lioeters• 8 years ago

Regulatory capture ("corruption and legalized bribery" in other words) is the critical point that should be raised in every discussion regarding FCC. Without addressing this formative power dynamic, there can be no meaningful progress.

kevin_b_er• 8 years ago

This is because Ajit Pai, along with his party, value corporate profit above service to the public.

vertexFarm2• 8 years ago

Damn, good point. I figured this should be an easily solvable problem. Stands to reason that the FCC is just letting it happen because they're hilariously corrupt. Definitely one of the most successfully captured regulatory bodies.

Sniperfish• 8 years ago

For us, the most frequent issue on our land line are out-of-country calls (so out of jurisdiction) trying to sell duct cleaning services. We've gone as far as booking a couple of appointments to identify the local businesses that use these providers, but nothing comes of the reports. Where the origin is foreign, there are still avenues for domestic enforcement but authorities appear uninterested - to me this is an easy way to increase the effective cost of foreign call centers that don't obey local laws.

mnw21cam• 8 years ago

So, if you take any notice of anything on this web site, you will see that even after the page has loaded, it keeps on making loads of network connections to all sorts of servers. For ever. This is now a browser-hostile web site.

codazoda2• 8 years ago

PrivacyBadger blocks all of these but you're right, it does seem hostile. I figure most US companies that run ad's have similar setups. After about 10 blocked calls to geo.yahoo.com it stops making the requests.

With PrivacyBadger disabled the connections keep on coming; especially as you scroll the page up and down.

pwg• 8 years ago

Running NoScript in default deny JS mode results in the page loading, with no further requests occurring while you read the page (because none of the javascript that is making the requests is allowed to run).

pcunite• 8 years ago

The annoyance of this for me could be a simple fix. If the number is not in my iPhone contacts, send them straight to voicemail.

criddell5• 8 years ago

But make it an option! I don't want voicemails either. If you aren't in my contacts list, you get a busy signal.

egonschiele• 8 years ago

I also get robocalls all the time, and hardly got any till about a year ago. What changed?

xigency• 8 years ago

The Equifax breach leaked phone numbers along with all of the other identifying information hence more spam calls from anyone (everyone) affected.

ryanlol• 8 years ago

Do you have anything to back your assertion that the data from the Equifax leak is being actively exploited in this manner?

post_break• 8 years ago

Can we please get phone OEMs to enable a feature to only allow calls from people in our contact list? Baked in. No apps that scrape your phone book to do it. If you're not on my contact list, go to voicemail and I'll decide if you're legit. And have an option like DND where if you call in rapid succession then I'll pick up.

doikor• 8 years ago

In iPhone enable do not disturb 24/7 and only allow calls from contact list. Only bad/good thing is that all notifications get disabled too.

hbosch• 8 years ago

I use this and consider the lack of notifications a positive.

jasonkostempski2• 8 years ago

I'd prefer an open source software solution but, either way, they'd start leaving voicemails, which is still annoying to manage. However, a lot of them already leave a 3 second blank voicemail, so that would at least eliminate the ignore/reject call step and the rude interruption.

murph-almighty• 8 years ago

I stopped using voicemail due to the shitty UI back when I had a dumb phone- I didn't want to spend 5-10 minutes waiting to listen to all my voicemails and sit through a robotic dialog.

Today, I use an iPhone and now use voicemail as a basic call filter. If I get a call from a number I don't recognize I immediately let it go to voicemail. At my leisure later in the day I can check the transcription service to see if it's spam.

I find it bizarre that the feature fell out of use for me, and came back into it because of this recent spate of spam phone calls.

criddell5• 8 years ago

Why do voicemail systems even notify me of a 3 second silent message? Just delete them.

notyourday• 8 years ago

Setup default ring tone to silence. Setup a ringtone for your phone book contacts to something else. Done.

criddell5• 8 years ago

I want callers that aren't in my contacts list to get a busy signal. I don't want voicemails from them.

stronglikedan• 8 years ago

Someone already mention iPhone, and there is a similar method for Android [0], baked in, as you say.

[0]https://www.youtube.com/watch?v=s7MH6hkTieE

vertexFarm2• 8 years ago

That sounds like a great idea. Right now I'm using an app that just blanket-blocks area codes. I got a number in an area code I never go to or know anybody from. Almost all the spam calls are from around there and I block them all. It's not ideal.

I really wish they'd just make some kind of system or authority to keep VOIP from spoofing numbers. It's ridiculous. There's gotta be a way for them to secure that shit. I guess they're just inept.

commoner• 8 years ago

For Android phones without this feature built in, try the Block Calls app by Jachness.

It's not on F-Droid, but the source code is available on GitHub.

Play Store listing: https://play.google.com/store/apps/details?id=com.jachness.b...

GitHub repo: https://github.com/jachness/blockcalls

pweissbrod• 8 years ago

I really really hope this covers the infamous and elusive "Rachel from cardholder services"

wafflesraccoon• 8 years ago

I get "Dave" from the IRS a lot, it was so bad that I was getting one or two calls a day.

criddell5• 8 years ago

That one bugs me a lot. I get a credit card call every day from a different number that's close to my phone number.

I wish credit card issuers would end their affiliate programs.

If they don't want to end the programs, they could at least clean them up. If I answer one of the Rachel calls and take them up on their offer for a different card, the credit card company should be able to track who referred me to them and close their account. But the incentives are all wrong.

bhaavan• 8 years ago

But what if the Robocaller wanted to talk to my Google Duplex assistant? It is a pretty boring life for my Duplex. Getting a few phone calls from fellow beings is the bare minimum she deserves!

codazoda2• 8 years ago

I've permanently turned on Do Not Disturb and configured it to allow calls from people on my contact list. This won't work for everyone but it works really well for me. I no longer get unwanted calls. People I don't have in my contact list are forced to leave a message without my phone ever ringing.

dexterdog• 8 years ago

That's what I do. If I am expecting a call from a non-contact I just disable it for an hour. Everything else gets sent straight to voicemail after a 4-ring wait.

ryandrake• 8 years ago

This is the only realistic practical solution we have so far. The other ideas here cannot be done because incentives are not aligned properly. Fining telcos? With the FCC and most lawmakers in the pockets of telcos, this is not going to happen. Cryptographically secure CallerID? Who would pay for this? Telcos cracking down on robocallers themselves? No chance, since they make money from robocalling.

It's like asking the post office to solve junk mail. Where's the incentive?

fabianwatkins• 8 years ago

Me too. It's a shame its gotten to this point though. But even worse than a spam call is a spam call from someone's legitimate number. For a period, someone was making sales calls from my Mom's number. She ended up getting about twenty angry return calls a day and had to explain to everyone she didn't call them. She wasn't aware of any alternative, so she changed her number. Sad!

ddlatham• 8 years ago

Same here. I'm just thankful that the robocallers rarely leave voicemails to sort through.

greedo3• 8 years ago

I would be ecstatic if the next version of iOS had a whitelist feature for phone calls and SMS/iMessage. I would pay large sums for this...

blang• 8 years ago

You could always turn on do not disturb and allow calls from your contacts.

greedo3• 8 years ago

That disables notifications.

ErikAugust• 8 years ago

A great caller ID app is Hiya. It will show in the Home screen during ring whether a call is suspected spam, spoofing, or fraud.

trumped2• 8 years ago

it's great if you don't mind sharing all your calls' metadata

trumped2• 8 years ago

If only callerID spoofing was not possible... I think that it would solve most spam call problems because it would be easier to make them accountable.

inetknght• 8 years ago

I don't know why you were downvoted so much. I agree that being unable to spoof caller ID would go a long way to allowing enforcement of existing laws to work.

gnarcoregrizz• 8 years ago

i wonder how a proof of work scheme, a la hashcash, would work for call spam. it was originally designed to reduce email spam: https://en.wikipedia.org/wiki/Hashcash

it could be possible to have different PoW requirements for different callers. perhaps you could require a higher PoW for an unknown caller, and no requirement for someone you know.

niyazpk• 8 years ago

I use Google Fi (for 3 years now) and _never_ get Robocalls. Am I just lucky or is Fi doing the spam filtering for me?

willstrafach• 8 years ago

Some marketers perform lookups to remove inactive / non-cellular numbers from their lists in order to save on costs/time. I believe Google Fi and Google Voice are marked as VoIP in these lookups.

vincentmarle• 8 years ago

Curious: will Google Assistant’s new call-out feature also be considered a robocall by the FTC?

It technically is, right? Because it will make automated unsolicited calls at a massive scale.

DannyB2• 8 years ago

The FCC can go after robocalls because the law allows them to.

Back in the day, when there were proposed laws to make SPAM similarly illegal, the Direct Marketing Association (DMA) lobbied hard to get exceptions that would allow SPAM. And the rest is history.

Remember the aptly named "Can SPAM" act?

Can could mean:

1. toss it out, eliminate it

2. enable it

3. a metal cylinder it is packaged in

brianzelip• 8 years ago

Pai talking about being an “active cop on the beat” seems a bit tongue in cheek.

kj4ips2• 8 years ago

There is no way this guy can pay that, so I assume he will either:

* sacrifice an LLC (if he has one)

* declare bankruptcy

* be garnished at the legal maximum rate for the rest of his life? (little bit less than 25% of after-tax)?

I wonder if it is worth an FOIA to ask some of these high-profile agencies how much they are raking in with garnishments from gigantic fines?

nsxwolf• 8 years ago

Please tell me this guy is the one responsible for the daily calls I get from numbers that sort-of look like mine.

degenerate• 8 years ago

There's thousands of scammers doing the same gig. It's not just him :(

lopatin• 8 years ago

Robocallers seem to be getting a bit more savvy too. I just got one today, articulately told it "fuck off", and it actually immediately stopped! I just thought that was cool.

e40• 8 years ago

I always asked to be put on the DNC list, and 99% of the time they hang up on my before I finish my sentence.

Lately, I've taken to wasting their time, and at the end, telling them if you had put me on the DNC list, this wouldn't have happened.

notadoc• 8 years ago

Is there anyone who doesn't get multiple robocalls every day?

RightMillennial• 8 years ago

I get them in short binges. About once a month I'll get a few over a couple day span.

Symbiote• 8 years ago

I don't get any on my Danish or British phone numbers. Perhaps one per year on the British one.

It would be interesting to know what's different about the systems in the USA, as I don't imagine robocalling Britain would be somehow less profitable except by regulation or technical measures.

neeleshs• 8 years ago

I treat phone almost like email, by not picking up any calls that I don't recognize. If its important, caller leaves voicemail, and I call back immediately.

partycoder• 8 years ago

I used to receive a lot of robocalls.

I called my phone company and asked them to block all foreign calls. They did and now I very rarely receive any robocall.

tonyquart• 8 years ago

There should be another fines in the future. Also, there should be asset seizures and long jail time if we want to see these crimes stop their harassment on us. I have just read an article that also talks about robocalls at https://www.lemberglaw.com/what-are-robocalls/. Hope the law enforcement will think seriously about this problem.

camdenreslink• 8 years ago

These robo callers are the bane of my existence. I get at least one call per day with the same area code and first 3 digits of my phone number.

michaelcampbell• 8 years ago

Which will dissolve and re-start within hours.

tracker1• 8 years ago

As soon as the people behind the robocallers start getting introduced to bullets it'll reduce. Until then, don't expect it to stop.

FCC fines robocaller record $120M

Related Stories