Telecom companies appear to miss deadline to ID spam callers

It’s a common occurrence for most; the familiar ring tone of an incoming call paired with an unknown number. There might be a slight pause as the owner contemplates answering.

There’s an instant pang of regret when answered. It’s some sort of spam, an unknown voice telling you something horrible has happened.

The Canadian Radio-television and Telecommunications Commission (CRTC) promised to make a change. It ordered carriers to implement the use of STIR/SHAKEN technology to help reduce the number of spam calls answered.

But questions remain. Does this new technology work, can it be used by all, and is it really helpful?

The details

STIR/SHAKEN is a two-part system that authenticates callers with the goal of making it more clear to people when a call is legitimate.

Secure Telephony Information Revisited (STIR) allows providers to validate an incoming call. When an originating carrier makes a call, a digital signature containing information about who they are is created. This contains a digital certificate that authenticates the caller. The telecom provider of the person receiving the call is able to verify this signature.

Signature-based Handling of Asserted information using TOKENs (SHAKEN) is the larger framework used by network providers to handle calls with incorrect or missing STIR information.

After several delays, the CRTC set November 30th, 2021 as the day the change would come into effect.

But not all calls can currently be verified as some carriers still have work to complete.

A CRTC spokesperson told MobileSyrup that “device and network compatibility requirements, including calls that are not entirely performed over an IP-voice network,” are among the roadblocks.

Delays are ‘betrayals,’ customer says

Sean Fordyce uses Telus as his cellphone provider and waited patiently for the November 30th deadline. He believed the technology would be available on all devices, but when he continued to get spam calls, he gave his provider a call.

After speaking with customer service and tech support, and realizing neither of them knew what he was talking about, an employee found an internal memo that said the change only applied to the Google Pixel.

“STIR/SHAKEN offered a real solution to businesses, people getting calls for work from unknown numbers, and the unemployed. This is a betrayal from the telecom [companies],” Fordyce said.

In response to several questions, Telus told MobileSyrup the new technology is available for next-generation home phones and for “customers with a device that supports the technology in its factory setup and can receive Telus VoLTE service.” All agents were also made aware of STIR/SHAKEN and provided with resources they could use to help customers.

Questions asking Telus to explain which devices would be included did not lead to a response ahead of publication. MobileSyrup was told the technology applies to the “network core [and] the expectation is that all customers will receive some benefits from the addition of STIR/SHAKEN technology.”

On its website, Rogers shares that both the Google Pixel 6 and Pixel 6 Pro have the software to support the new technology and that the carrier is working with manufacturers to ensure other phones support it. At first, it sounded like there was some confusion between Google’s Pixel-exclusive Call Screen feature and STIR/SHAKEN, but a Rogers spokesperson confirmed that the features are different. A Google spokesperson also confirmed Call Screen isn’t connected to STIR/SHAKEN. Instead, Call Screen works on-device to let users answer phone calls using Google Assistant — you can learn more about it here.

Bell told MobileSyrup STIR/SHAKEN was implemented “across our mobile network.” Their website states the LG Velvet 5G and devices part of the Samsung Galaxy S20 series are compatible. MobileSyrup asked the carrier for confirmation on compatible devices but didn’t receive a response ahead of publication.

A spokesperson for Shaw shared that the company began rolling out the changes in November, but there could be delays because of “challenges associated with technical testing.” On its website, the company says the rollout will happen on a “launch date that is yet to be determined.” Questions about which specific devices are compatible were not answered.

It’s also worth noting that Google added STIR/SHAKEN support in Android 11, but it’s up to manufacturers to implement it in the default dialer app available on their phones.

Apple added support for STIR/SHAKEN to iPhones with the iOS 13 update, although the company’s implementation has been criticized for only showing whether a call is verified after it takes place.

Certification of verification

According to the Canadian Secure Token Governance Authority’s (CSTGA) website, STIR/SHAKEN can only be implemented when a digital certificate is issued to a service provider. The certification helps verify if the number is real or developed by the spoofer.

These certificates are granted by a Certificate Authority (CA).

In 2019, the CRTC approved a request from Canadian telecom companies to establish the CSTGA, which overlooks the certificate process.

“Bell Canada, Rogers Communications, SaskTel, Shaw Communications, Telus and Vidéotron are among the Founding members of the CSTGA,” the website notes.

It’s not clear if the CSTGA received applications from service providers to help secure STIR/SHAKEN technology.

Implementation

The technology has already been mandated in the U.S by the Federal Communications Commission. A letter announcing the implementation notes service providers are using the technology “in their IP networks.” There’s no mention of the success of the technology being tied to a specific phone.

The CRTC told MobileSyrup the new technology is “a condition of service” for providers. It’s currently monitoring the implementation of this network.

Updated 10/12/2021 4:01 pm ET: The text was updated to reflect the source of confusion between Google’s Pixel-exclusive Call Screen feature and STIR/SHAKEN technology.