March 10, 2020 FACT SHEET* Mandating STIR/SHAKEN and Proposing Additional Measures to Combat Illegal Spoofing Report and Order and Further Notice of Proposed Rulemaking – WC Docket Nos. 17-97, 20-67 Background: Each day, Americans receive millions of unwanted phone calls, including calls that “spoof” or falsify caller ID information with a malicious intent. These spoofed calls are not simply an annoyance—they result in billions of dollars lost to fraud, degrade consumer confidence in the voice network, and harm public safety. This Report and Order and Further Notice of Proposed Rulemaking would take a critical step in the Commission’s multi-pronged approach to ending illegal caller ID spoofing by requiring voice service providers to implement caller ID authentication technology. Known as STIR/SHAKEN, this technology enables voice service providers to verify that the caller ID information transmitted with a particular call matches the caller’s number—and provides valuable information to detect illegally spoofed calls. Widespread implementation of STIR/SHAKEN will reduce the effectiveness of illegal spoofing, allow law enforcement to identify bad actors more easily, and help voice service providers identify calls with illegally spoofed caller ID information before those calls reach their subscribers. Most importantly, it will help restore Americans’ trust in the voice network, which has been eroded by the prevalence of illegal caller ID spoofing. What the Order Would Do: • Require originating and terminating voice service providers to implement the STIR/SHAKEN caller ID authentication framework in the Internet Protocol (IP) portions of their networks by June 30, 2021, a deadline that is consistent with the TRACED Act, which was recently passed by Congress. What the Further Notice Would Do: • Propose to extend the STIR/SHAKEN implementation mandate to intermediate providers. • Propose to implement caller ID authentication and other provisions of the TRACED Act, including through proposals to: o Grant an extension for compliance with the STIR/SHAKEN implementation mandate for small voice service providers so long as those providers implement a robocall mitigation program. o Require voice service providers using non-IP technology to either (i) upgrade their networks to IP to enable STIR/SHAKEN implementation, or (ii) work to develop non-IP caller ID authentication technology and implement a robocall mitigation program in the interim. o Establish a process by which a voice service provider may be exempt from the STIR/SHAKEN implementation mandate if the provider has achieved certain implementation benchmarks. o Prohibit voice service providers from imposing additional line item charges on consumers and small businesses for caller ID authentication. * This document is being released as part of a “permit-but-disclose” proceeding. Any presentations or views on the subject expressed to the Commission or its staff, including by email, must be filed in WC Docket Nos. 17-97 and 20-67, which may be accessed via the Electronic Comment Filing System (http://www.fcc.gov/ecfs/). Before filing, participants should familiarize themselves with the Commission’s ex parte rules, including the general prohibition on presentations (written and oral) on matters listed on the Sunshine Agenda, which is typically released a week prior to the Commission’s Meeting. See 47 CFR § 1.1200 et seq. Federal Communications Commission FCC-CIRC2003-01 Before the Federal Communications Commission Washington, D.C. 20554 In the Matter of ) ) Call Authentication Trust Anchor ) WC Docket No. 17-97 ) Implementation of TRACED Act Section 6(a) — ) WC Docket No. 20-67 Knowledge of Customers by Entities with Access ) to Numbering Resources ) ) ) REPORT AND ORDER AND FURTHER NOTICE OF PROPOSED RULEMAKING∗ Adopted: [] Released: [] Comment Date: May 15, 2020 Reply Comment Date: May 29, 2020 By the Commission: TABLE OF CONTENTS I. INTRODUCTION .................................................................................................................................. 1 II. BACKGROUND .................................................................................................................................... 4 III. REPORT AND ORDER ...................................................................................................................... 24 A. Mandating the STIR/SHAKEN Framework .................................................................................. 25 1. STIR/SHAKEN Implementation Requirements ...................................................................... 32 2. Legal Authority ....................................................................................................................... 42 B. Summary of Costs and Benefits ..................................................................................................... 45 1. Expected Benefits .................................................................................................................... 46 2. Expected Costs ........................................................................................................................ 53 C. Other Issues .................................................................................................................................... 54 IV. FURTHER NOTICE OF PROPOSED RULEMAKING ..................................................................... 57 A. Caller ID Authentication Requirements Definitions and Scope .................................................... 58 B. Extending the STIR/SHAKEN Implementation Mandate to Intermediate Providers .................... 61 C. Assessment of Burdens or Barriers to Implementation ................................................................. 72 D. Extension of Implementation Deadline.......................................................................................... 75 ∗ This document has been circulated for tentative consideration by the Commission at its March 2020 open meeting. The issues referenced in this document and the Commission’s ultimate resolution of those issues remain under consideration and subject to change. This document does not constitute any official action by the Commission. However, the Chairman has determined that, in the interest of promoting the public’s ability to understand the nature and scope of issues under consideration, the public interest would be served by making this document publicly available. The FCC’s ex parte rules apply and presentations are subject to “permit-but-disclose” ex parte rules. See, e.g., 47 C.F.R. §§ 1.1206, 1.1200(a). Participants in this proceeding should familiarize themselves with the Commission’s ex parte rules, including the general prohibition on presentations (written and oral) on matters listed on the Sunshine Agenda, which is typically released a week prior to the Commission’s meeting. See 47 CFR §§ 1.1200(a), 1.1203. Federal Communications Commission FCC-CIRC2003-01 E. Caller ID Authentication in Non-IP Networks .............................................................................. 95 F. Voluntary STIR/SHAKEN Implementation Exemption .............................................................. 101 G. Prohibiting Line Item Charges for Caller ID Authentication....................................................... 118 H. Benefits and Costs ....................................................................................................................... 120 I. Access to Numbering Resources ................................................................................................. 121 V. PROCEDURAL MATTERS .............................................................................................................. 129 VI. ORDERING CLAUSES ..................................................................................................................... 137 APPENDIX A – Final Rules APPENDIX B – Draft Proposed Rules APPENDIX C – Final Regulatory Flexibility Analysis APPENDIX D – Initial Regulatory Flexibility Analysis I. INTRODUCTION 1. Each day, Americans receive millions of unwanted phone calls.1 These include “spoofed” calls whereby the caller falsifies caller ID information that appears on a recipient’s phone to deceive them into thinking the call is from someone they know or can trust.2 And these spoofed calls are not simply an annoyance—they result in billions of dollars lost to fraud,3 degrade consumer confidence in the voice network, and harm our public safety.4 2. The Commission, Congress, and state attorneys general all agree on the need to protect consumers and put an end to illegal caller ID spoofing.5 Over the past three years, the Commission has taken a multi-pronged approach to this problem—issuing hundreds of millions of dollars in fines for violations of our Truth in Caller ID rules;6 expanding those rules to reach foreign calls and text messages;7 enabling voice service providers to block certain clearly unlawful calls before they reach 1 One source indicates that Americans received over 58 billion such calls in 2019 alone. YouMail, Historical Robocalls by Time, https://www.robocallindex.com/history/time (last visited Jan. 17, 2020). 2 Spoofing has legal and illegal uses. For example, medical professionals calling patients from their mobile phones often legally spoof the outgoing phone number to be the office phone number for privacy reasons, and businesses often display a toll-free call-back number. Illegal spoofing, on the other hand, occurs when a caller transmits