Appearance before the Standing Committee on Industry and Technology

1. What is STIR/SHAKEN?
   • STIR/SHAKEN uses digital certificates to ensure the calling number of an Internet Protocol-based call is secure.
   • Each carrier obtains their digital certificate from a trusted certificate authority.
   • The certificate technology will enable Canadians to verify that the calling number is accurate and has not been spoofed.
2. What does STIR/SHAKEN stand for?
   • STIR stands for “Secure Telephone Identity Revisited” and it is a set of technical standards developed by the Internet Engineering Task Force to certify the identity of originating calls.
   • SHAKEN stands for “Signature-based Handling of Asserted information using toKENS” and is a framework developed by the Alliance for Telecommunications Industry Solutions and focuses on how STIR can be implemented within carriers’ networks.
3. How does STIR/SHAKEN work?
   • The STIR/SHAKEN framework digitally validates the handoff of IP-based voice calls passing through the complex web of networks.
   • This allows the phone company of the consumer receiving the call to verify that a call is from a legitimate source.
   • The called party can then make an informed decision as to whether to respond to an unverified call.
4. Will STIR/SHAKEN eliminate all spoofed calls?
   • The STIR/SHAKEN framework will not eliminate all spoofed calls but it will help in combatting spoofed calls that Canadians receive.
   • The implementation of the STIR/SHAKEN framework will ensure that Canadians benefit from an additional level of protection against nuisance calls.
   • This measure is part of an array of actions that the CRTC is taking to reduce the number of nuisance calls.
   • The CRTC continues to work with its domestic and international partners to address unsolicited and illegitimate telemarketing calls.
5. Why does the industry need time to implement STIR/SHAKEN?
   • Telecommunications service providers require time to make the necessary changes to their networks in order to deploy the STIR/SHAKEN framework within Canada.
6. How will caller ID authentication help Canadian consumers?
   • STIR/SHAKEN authenticates and verifies caller ID information for Internet Protocol-based voice calls.
   • Once implemented, STIR/SHAKEN will provide Canadian consumers with information to help them determine which calls are authenticated.
   • This new framework will reduce bad actors’ ability to illegally spoof a caller ID, which trick Canadians into answering the phone.
   • By implementing this system, consumers and law enforcement will be better equipped to identify the source of illegal robocalls and reduce their frequency and impact on Canadian consumers.
7. Are all phones (wireline and wireless) able to use STIR/SHAKEN?
   • STIR-SHAKEN will only work on a network that has been upgraded from traditional telephone service (i.e. legacy networks) to Internet Protocol technology.
   • Telecommunications service providers using this technology will be able to authenticate and verify the caller ID information and inform their subscribers, regardless of whether the call is received on a telephone or cellphone.
   • While the STIR/SHAKEN framework will not be effective on some legacy, non-IP networks, all telephone networks are evolving to become IP-based.
8. Will providers charge subscribers for STIR/SHAKEN?
   • It will be up to the telecommunications service providers to decide if they charge for STIR/SHAKEN to recover any costs associated with providing this service.
   • STIR/SHAKEN provides an additional level of protection from nuisance calls. It will empower Canadians to know, before they answer the phone, whether a call is legitimate or whether it should be treated with suspicion.
9. What is the Canadian Secure Token Governance Authority?
   • The Canadian Secure Token Governance Authority (CSTGA) is the Governance Authority (GA) as part of the deployment of the STIR /SHAKEN framework in Canada. The GA will ensure the integrity of the issuance, management, security, and use of the certificates.
   • More information on the CSTGA can be found on its website: https://cstga.ca/.
10. What is a Policy Administrator?
    • A Policy Administrator (PA) is selected by the GA and is responsible for applying the rules defined by the GA, including ensuring that the Certificate Authority (CA) implements appropriate certificate management practices and that certificates are issued only to authorized telecommunications service providers.
    • The PA is the administrator and primary trust anchor of the system.
11. What is the Certificate Authority?
    • The Certificate Authority (CA) issues certificates to validated telecommunications service providers.
12. Is STIR/SHAKEN being implemented in other countries?
    • STIR-SHAKEN was created in the United States and is being adopted by carriers and telecommunications service providers in Canada.
    • STIR/SHAKEN is expected to be implemented in the United States by the end of 2019.
    • Other countries and jurisdictions, such as the UK, have also expressed interest in implementing STIR/SHAKEN.
13. What other measures are being implemented to combat spoofing?
    • STIR/SHAKEN is the latest step in the CRTC’s broader efforts to combat nuisance and unsolicited calls.
    • The CRTC has encouraged service providers to offer their customers call-filtering services that provide advanced call-management features. Providers that do not offer these services must implement a system to block certain types of calls within their networks by December 19, 2019.
    • The CRTC is also working with the industry to develop a process to trace nuisance calls back to their points of origin.

Questions tailored for call with FCC

14. Why is Canada behind the United States in the implementation of STIR/SHAKEN?
    • Telecommunications service providers require time to make the necessary changes to their networks in order to deploy the STIR/SHAKEN framework within Canada.
    • The CRTC took the necessary time to gather information and determine an appropriate implementation date for Canadian telecommunications service providers.
    • The FCC, the telecommunications regulatory body of the United States, has mandated its providers to implement STIR/SHAKEN by the end of 2019. This decision was made at the sole discretion of the FCC and is completely independent from the CRTC.
    • Canadian service providers will be able to draw upon the experience of their American counterparts in implementing STIR/SHAKEN.
15. Why was TELUS selected to perform the call on the Canadian side?
    • TELUS volunteered to participate in this test given its experience and expertise in this field. TELUS developed the required tools in order to make this call a reality.
    • We would like to acknowledge the work being done by other service providers to better protect Canadians from nuisance calls.
16. What is the difference between STIR/SHAKEN and SHAKEN/STIR?
    • There is no difference between the two designations. They are the same framework.
    • Some countries have opted to use different ways of naming the framework.

New questions for standing committee on Industry, Science and Technology

17. What is the current list of TSPs that have elected to implement an opt-in call-filtering system?
    • Cooptel
      • “Cooptel Call Manager” (effective January 2020)
      • Proposed subscription of $2/month (tariff application in-house)
    • TELUS
      • “Call Control” is currently available to legacy wireline customers in Alberta and British Columbia
      • Basic control is free and offers 25 entries into the respective lists and the ability to view a 10 call call-log
      • Premium call control available for $3/month and allows 100 numbers in the black and whitelists along with a 100 call call-log
      • Per TELUS, customer feedback has been positive
    • Other TSPs offering call filtering:
      • Xplornet
      • Primus
      • City West Cable & Telephone Corp
      • Hay Communications Co-operative Limited
18. What is the current status of STIR/SHAKEN in the US?
    • US Telecom industry implemented STIR/SHAKEN in late 2019 following an expectation set by the FCC.
    • Final testing is currently underway.
19. What does the new regulation require from service providers in the US?
    • The Telephone Robocall Abuse Criminal Enforcement and Deterrence Act, also known as the TRACED Act, came into force in 2019 and requires major voice service providers to implement STIR/SHAKEN by July 2021, should they have failed to meet the voluntary deadline of December 2019 set by the FCC.
20. What is the TRACED Act?
    • The main purpose of the TRACED Act is to strengthen the Federal Communications Commission’s (FCC) powers to deter and combat robocalls. Thus, robocallers based in the U.S. will face tighter scrutiny and penalties.
    • The TRACED Act:
      • increases the penalty for intentional robocallers that violate the law (e.g. telemarketers who call users even if they have not given their consent);
      • requires voice service providers to develop call authentication technologies at no extra charge for users;
      • started the countdown for a list of actions and regulatory activities that the FCC is required to take during 2020 and beyond; and
      • mandated the attorney general and the FCC Chairman to convene an interagency working group to study enforcement.
21. Why does the CRTC need additional flexibility to share information with its partners?
    • As I discussed in my opening remarks, the issue of fraudulent calls requires a coordinated response.
    • In some cases, our legislative framework doesn’t allow us to disclose information (including complaints data, trends and specifics about campaigns).
    • Amendments to the Telecommunications Act to ensure flexibility would assist us in sharing information with the RCMP, the Competition Bureau and other agencies working to protect Canadians.