Hey, everyone. If you're anything like me, your missed calls list looks a lot like this.
And I know I'm not unique. You know, the average person gets about 14 unwanted calls every month.
And you might notice that some of these in my call list are flagged as spam, which is somewhat
useful. But what if we could actually start to verify callers? What if we weren't just flagging
things as spam and potentially harmful, but actually doing the opposite and saying, hey,
you can trust this call? We already do this with websites. We already do this with emails.
Why can't we do this with phone numbers? The good news is the short answer is that we can.
And I'm going to be telling you about this TLS-like technology that's been developed to
solve the call authentication problem. It's called Shake It and Stir, and we'll be diving into the
history of why this is a problem, some definitions and technical details of the spec, how the U.S.
is going to enforce implementation. Unfortunately, a lot of this is specific to North America right
now. But we'll also be diving into the limitations of what this technology is,
one of those obviously being that it's not applicable to the rest of the globe yet.
So my name is Kelly Robinson. I have been working at Twilio for about three years. Twilio offers a
lot of communication services, including a lot of stuff around telephony. I actually work on
Twilio's account security products for things like phone verification. But this was just something
that I got really interested in in terms of what the telephony security of actually authenticating
call systems was. So we have a separate team that I'm not involved with at Twilio that is working
on implementing some of this stuff, but this is just some of my own research into what this is,
how it works, and hopefully I can share that with you in somewhat of an introduction to what
Shake and Stir is. So let's start with just talking about what telephony security even means.
Telephony security is in quotes there very obviously because basically there wasn't a lot of security when telephony got started.
There was a monopoly of companies, and even as recent as 30 years ago, the network basically
looked like this. It was private, it was closed, there was proprietary technology everywhere, there
were just a couple of companies, and they all basically knew how to trust each other. They all
knew who they were dealing with, and they all had direct lines of communication with one another.
And if you compare that to today, there's literally thousands of companies. It's really easy
to access this technology. There's more standard technology now built on top of IP, so you don't
have to have this kind of proprietary technology and a lot of infrastructure to get started,
and there's all these potential paths and routes for a call to take. And you can think of the
difference in accessing the telephony network like you would in deploying a website today. So this is
the difference between having your own on-prem hardware, your own servers that you're running,
versus today you can use something like AWS to get up and running very quickly.
And before we dive into this a little bit further, I do want to give a little bit more
context on some telephony jargon. If you aren't familiar with telephony, I wasn't before I started
working at a telephony company. And starting with the PSTN. So this is the analog and digital
systems like cellular networks, undersea fiber optic cables, and copper telephone lines. And
this is what allows people across the globe to complete voice calls. Something that you might
have heard of before is VoIP, and this is the voice over internet protocol. This is what a lot
of mobile infrastructure and businesses are actually using now. And so this is what people
are moving towards. This is kind of the standard technology that people have more access to now,
but it can also interact with the PSTN. And then finally SIP is a way to initiate IP phone calls
and other communications. You can kind of think of it like an HTTP request for phone calls. It
contains metadata and instructions about where a call is both coming from, who it's going to,
and some other data about what the call should be. And the important thing to note here is that
shaken and stir will only apply to SIP initiated phone calls. And so let's kind of talk about what
the problem is here. And I specifically frame this as unwanted robocalls because not all robocalls
are bad. So you can think of things like prescription pickup notifications, food delivery
services, you know, things like the school has a snow delay type thing. There's reasons to
automatically dial, but we do know that most of the robocalls that we get aren't that. They're
spam and that's bad. And so we wanted to focus on the greater problem of the unwanted robocalls
here. And the reason this is a problem, it's gotten super common in the last five to ten years
for a few main reasons. First, there's a lot of cheap dialers now. It's really easy to do this
automated dialing in an efficient way that actually makes spam and fraud more both efficient but also
profitable. And second, there's over 4,000 service providers in the U.S. alone and that makes it
easier to access and also gives you more access options to access the PSTN. And third,
there's no validation or authentication on who is placing a call. So you can basically set the
from number to whatever you want. And so there's an app that I downloaded at iOS that just lets you
spoof phone numbers. And you don't really even have to know how SIP works. Like there's a way
that you can do this with some SIP knowledge that's even more cheap. But there's like these
consumer applications that you can download if you're an iOS or Android user that, you know,
you don't have to have any technical know-how. And you can just have to believe me that this
is a call I placed to myself from 867-5309. So you might be asking, like, why isn't this
just illegal, right? And the main reason is that because there are some legitimate use cases for
spoofing phone numbers. So nowadays the practice for companies like Uber or DoorDash or something
like that, they'll proxy phone calls through a third number that connects individuals. So like
when you call your Uber driver, when your DoorDash delivery person calls you, you're not getting a
phone call from their number. You're getting a phone call from a third party, a number that's
being proxied in between you. And that, you know, has privacy use cases and also some cost-saving
measures. But it wasn't always like that, right? And so you also had enterprise systems or private
branch exchanges that might be placing a call to a customer from an individual agent's line,
but they want to display something like the toll-free callback number. And historically,
those were just spoofed. You would say, hey, this isn't coming from me, Kelly. This is coming from
my organization. And I want to make sure that you see this phone number in case you need to
call that back. And these systems still exist. So we can't just outlaw this completely.
In fact, the New York Times actually spoofed their from number until 2011, you know, and it was one
of those things to help protect their sources if journalists were calling from their desk phones
that didn't want to necessarily be calling from an individual journalist's phone. But they now
actually will use a 212 number that you can call back. We did introduce some legislation to address
this. The 2009 Truth and Caller ID Act was what did that. So again, this is only about 10 years
old that we started to really think about this as a problem. But we can't completely ban call
spoofing because of the legitimate ways that businesses are still using it. So legislation
specifies that it is illegal to spoof numbers if there's that intent to defraud. But there's also
this enforcement struggle with this. Because the network hops, it might take five or 10 service
providers before you know who actually initiated the call. And they might or might not be able to
tell you about the caller because they're placing calls on behalf of many, many customers.
Tracking down a spammer takes a lot of time and effort and therefore money. And that makes
enforcement of this really hard. So that brings us to the solution. That brings us to Shaken and
Sturr and what we're here to do. Shaken and Sturr are the most egregious of backronym crimes.
So Shaken is the signature-based handling of asserted information using tokens.
Sturr, again, is secure telephony identity revisited. It does get worse. There's a
proposal out there for Lemon Twist, but we're not even going to look at that because I think
people are just getting a little too creative. But basically as the FCC describe it, what Shaken
and Sturr does, calls would have their caller ID signed as legitimate by the originating carriers
and then validated by the terminating carriers before reaching consumers. And so this is where
it comes into that TLS-like authentication. You are signing calls as legitimate and then the
terminating service provider would then display some information to the end user signifying that
calls can be trusted and they were not spoofed. And we're not reinventing the wheel here. We're
borrowing from other web authentication, things like public key infrastructure, certificates,
JSON web tokens are all being used for this. And it's very similar to emails DKIM and DMARC,
which basically authenticates the from sender in an email. And so a lot of the work that was done
on Shaken and Sturr was done in conjunction with some of the authors from DKIM and DMARC
as a way to set best practices for this type of communication.
And this is a simplified view of the end-to-end system, what happens with the Shaken and Sturr
signed calls. So the signing service includes some public key infrastructure key management
and it will be up to the originating service provider to do the key management there.
And so calls are routed in a few ways. So basically between the originating service
provider and the terminating service provider, you might remember from that early slide that
there's like all these kind of routes that a call can take. And the way that that happens
is there's something called the LNP or local number portability. And this is what people
are using to both track whether numbers have been ported between carriers, but it also works as kind
of a DNS like lookup to look up phone numbers so that you can then route calls to the right
service provider. And usually the originating service provider, it's up to them to basically
do this routing. The onus is on them to decide on the route that a call is going to take. They're
usually using something called least cost routing. Twilio uses like an inter-exchange carrier.
There's vendors that allow you to do this to route calls. I don't want to get into that too much,
but basically when it is being passed through the other service providers in the middle there,
it is just being passed through. There's not additional validation in the middle there.
They're just passing the call through. And then on the other side of things, the terminating service
providers then has their own verification service. And the verification service is what contacts the
certificate authority and uses the certificate authority's authority there to then verify
whether or not the call that came into them is a valid signed call. And so certificate authorities
are being chosen by ADIS. That's the Alliance for Telecommunications Industry Solutions. And so
this is a standards body that authored Shaken. So some of the certificate authorities that have
been chosen are people like Newstar and Transnexus. I think there's a few others that haven't been
publicly announced yet. And these are similar to the certificate authorities that administer TLS
certificates like Let's Encrypt. And so then when a call reaches a terminating service provider,
it's up to the client. So this would be somebody like Apple or Google to decide how to display that
the calls are trusted. And so this could be something like, hey, I've got a checkmark next
to this call. We display something like you saw on an early slide there that says there's a verified
caller here. You could do something like a lock that we have in browsers with TLS, HTTPS sites.
So there's different options here. And that has not been standardized in terms of how to signify
this to consumers that these calls are not spoofed. And so I think that's going to be one of
the interesting challenges that we see as this gets rolled out more is how do we build this trust
on the consumer end of things and display this to them in a consistent way so that they know what
to expect. So let's get into a little bit of the weeds of how this actually works from the technical
perspective. So this is what a SIP header looks like currently. You can see the metadata included
there. Just a reminder, SIP is the way to initiate VoIP calls or a way to initiate VoIP calls.
But note the from here. So the problem here, Ray, is that the from number can be spoofed.
And that happens if either the originating service provider allows it, isn't doing any
validation on that. There might be those legitimate reasons for that. But they basically want to make
sure that... and a lot of legitimate service providers are already doing this validation.
They're not letting you place calls from numbers that you don't have access to.
But there's... like I mentioned, there's over 4,000 service providers in the U.S.
alone. A lot of the long-tail service providers might not be doing this validation.
And so what Shaken does is it introduces a new identity header. And this is in the form of a base64
encoded JSON web token. And I'm going to focus on just some of the information that's encoded in
the middle section here. And so the information that's encoded there includes things like the
attestation level. And so this is in the header. And we'll talk more about what the attestation
level is on the next slide. But this is basically the crux of whether or not we trust this call.
But it also includes some additional metadata, like who the call is going to,
who placed the call. And then importantly, the origination ID. This is for the originating
service provider's underlying customer. And so this is set by the originating service provider.
And so the originating service provider, the OSP there, is really putting their reputation on the
line saying, hey, this is my customer that is placing this call and I'm giving them this level
of attestation. And this is important because this ID makes it near instant to identify bad actors
because you can trace back the call to the underlying customer. And this is what's going
to allow us to enforce the Truth in Caller ID Act. And so not only does Shaken allow you to build
trust in calls that aren't spoofed, but it also allows a lot of the enforcement side of things
to make sure that we can track down bad actors more quickly and more efficiently.
And so back to the attestation levels, there are three levels that can be attributed to a caller.
And so the originating service provider is going to decide what the attestation level is here.
So A is the highest level of attestation, of course. And so this is saying, I know who this
customer is and I know they can use this number that they are calling from. And so that is what
you would assume most of the legitimate business calls being placed are. Attestation levels B and
C have some less level of trust in the call, but this is still likely to be a less fraudulent call
if it's signed with any of these attestation levels than if it wasn't signed at all. And so
generally, I think what, and this is where we don't have a lot of standardization around this
yet, but the clients, so the Googles, the Apples, are going to have to decide in conjunction with
the carriers, the Verizons, the T-Mobiles, these types of people, how to display trust. And likely
what's going to happen is that they're only going to display a checkmark or a verified caller
if there is that attestation level A. So new technology is really great, but we need to
make sure that people are actually implementing this. And so one of the things that is good about
this is it puts the onus on businesses to do the implementation and not as much on the consumers to
increase consumer protections. But the main way that we're going to ensure that businesses
implement this is with the TRACED Act. And so this is the Telephone Robocall Abuse Criminal
Enforcement Deterrence Act. It was passed by the Senate last May, passed by the House and signed
into law in December of 2019. So I think it was like December 30th of 2019, it was signed into
law. And what it did is gave a timeline that started at that point. So basically, you can think
of the beginning of this year, it gives telecom companies 18 months to implement shaken and stir.
And so you can think mid-2021 is kind of when the deadline for this is. A lot of bigger companies
have been working on this for a while, but it's still going to start to enforce the deadline in
mid-2021, assuming that everything goes as planned. So it also allows for a $10,000 fine for offenders.
And so this does also add an additional fine on top of the existing Truth in Color ID Act.
So the authentication requirements for the TRACED Act depend on the type of call. So if it's VOIP,
the requirements there is that you have to implement shaken and stir. But they do acknowledge
that there isn't really a good solution for non-VOIP calls yet. And there are a lot of
non-VOIP calls that are on the PSTN. And so NuSTAR has a solution called Stir Out of Ban
for non-VOIP authentication. If you are a company that is placing non-VOIP calls,
there's things that you can look into here for you or your customers. But definitely, I think
that's one of the challenges to getting this implemented, is not everything is just going to
be able to implement shaken and stir. And that's kind of what I wanted to get into now,
which is what are the limitations of this technology? First being, you know, according
to my curmudgeonly coworker, Randy, who's been working in telecom for many, many years,
the phone network is kind of an ungodly beast. And so it's, you know, a collection of wires that
has been rapidly expanding for over 100 years. And so there is this kind of situation that we've
run into where there isn't a standard technology that's being used for all the calls. And so we
can't just flip the switch and change everything over to be suddenly authenticated. And part of
that ungodly beast is this thing called time division multiplexing, or TDM. This is essentially
the opposite of VOIP. It's old school hardware that's been around for 50 years. It's baked into
a lot of enterprise private networks. And the TRACED Act explicitly acknowledges TDM as a
potential burden to implementing shake and stir. So they said that the burdens are barriers to the
implementation, including for providers of voice service to the extent the networks of such
providers use time division multiplexing. Fancy language in the bill that basically says, we get
it. This might be hard for people that aren't using VOIP. And then another challenge that we
have is that there just is this long tail of service providers. Like this is something that
companies like Twilio and Verizon, Comcast, other large companies have been working on for
months. What happens when you're a smaller scale service provider that's running limited
infrastructure? You might have different access points to the PSTN that aren't going to be VOIP,
like I said. And so of the 4,000 service providers in the U.S. alone, I don't know
what percentage of those is going to be compliant by mid-2021. So the requirements to
comply with this law, it does require significant investment. And I don't know if we can reasonably
expect that everybody will be able to make that investment in time.
And then there's all these other problems. The biggest problem is in the U.S. right now. But
this is also a problem in places like UK and Norway. And I haven't really heard of any initiatives
outside of North America to address this. There are starting to be some initiatives to implement
this in Canada. But maybe this is something that if your country has a solution for this,
reach out. I'd love to hear about what you're doing for enforcement there.
But there's other things that we have to think about, like what about ported numbers,
the international side, like I mentioned, and also text messages. There's other communication
channels that don't have the same type of authentication.
So the FCC's number one complaint right now is robocalls, but the government is obviously a
little distracted with other global pandemics right now. But I think in terms of that department,
this is something that they have a priority and a motivation to fix.
And so like I said, the timeline for enforcement here is that towards the end of 2020 or into 2021,
we'll start to see more people start to implement this. And you might start to see calls coming
through already on your phone that might have a checkmark or might have an indication that
they're being signed. So what can you do in terms of implementing shake and stir for your business?
Talk to your service provider, whoever is doing your telephony. Most businesses probably won't
have to do much in terms of implementation. A lot of the onus is going to be on the service
providers themselves. You might have to go through with some additional verifications and like KYC,
know your customer type stuff with your service provider. So at Twilio, we'll need you to create
a business profile that has some additional details about your account before we would
give you and start signing your calls with the highest attestation. And then there's some
precautions that you can take as just application security professionals. So you can protect your
numbers from web scraping bots. Don't assign sequential numbers to your employees. That's
a way that people can kind of guess which employees might have lines at your company.
And then you can use actual authentication in your call centers. This is another way that you can
protect your business from phishing. This is something that I could talk about for many,
basically. We'll only ask for a consumer, you know, date of birth and email in order to verify
the customer. And so there's a lot of other things you can do to actually authenticate people on
either end of the call. And then if you know what a PBX is and you have one, you might look into
installing the FCC blacklist database on that. Some controversy around whether or not you want
to do that. It's hard to get off the blacklist database if you're on there. But this is something
that you may or may not have to worry about. And then there is some ongoing legislation.
But things have been pretty quiet from the FCC this year. They did recently, somewhat recently,
like in the last year, give telcos the authority to block unwanted calls without explicit subscriber
permission. And so, you know, AT&T, Verizon, T-Mobile in the U.S., they can now decide, hey,
we're going to send this to basically like a spam folder without ever notifying you that the call
came in and I don't need you, Kelly, to tell me that that's okay. And then like I mentioned,
in terms of timeline for the Trace Stack, the enforcement will start to begin at the end of
2020. Last update from the FCC on this was March 31st. And this reaffirmed their call to implement
Shaken and Stir, but it did already grant an exception for and an extension for small voice
service providers. And I don't know what that means. I don't know exactly how they're going
to decide who is a small voice service provider, but they are already thinking about, you know,
this was three months after the bill was signed into law. They're already saying, hey, maybe this
timeline isn't reasonable. So while I do think that a lot of larger telecom providers will start to
sign calls within the end of this year, I do think that there is going to be an exception for
that long tail of service providers and not everything is going to be a signed call
before, you know, the end of 2021. There are a couple of things you can do as a consumer to
protect yourself today. You can install one of these apps depending on how much you trust them.
A lot of times you have to give them basically complete control over your phone, so your
mileage may vary there. But things like NovoRobo, RoboKiller, CallApp, you know, companies like
AT&T have a partnership with a company called Haya that does, you know, some protection against
spam calls. Of course, a lot of consumer telecoms are starting to upsell spam detection services,
so Verizon offers their CallFilter Plus for the low, low price of $3 a month. But, you know,
these are things that you can look into installing on your phone if this is something that is a huge
annoyance to you right now. So like I said, unfortunately, I don't think this is going to
solve all problems right away, but I think people are really optimistic that Shaken and Stare will
help restore trust in telephony, because not only is it going to help, you know, mitigate spam calls
that are coming into your phone, but for those wanted calls for, you know, the calls that you
want to see that might be from unknown numbers, there's going to be a renewed trust in some of
those phone calls. And so there is that motivation from businesses to restore that type of trust so
that people will answer the calls. Hopefully this is a good overview in terms of what you can expect
from Shaken and Stare. If you have any questions, you can find me on Twitter. I'm also on Discord.
Once again, my name is Kelly Robinson, and thank you for listening.
All right, welcome back everybody. That was What If We Had TLS for Phone Numbers? An Introduction
to Shaken and Stare by Kelly Robinson. We actually have Kelly with us here right now.
If you have any questions, drop them in our Discord Q&A channel down linked in the description
below. We've got some questions here. Hi Kelly, great talk. Thank you. Question, working hard to
get Scandinavian governments and telcos to have an opinion on Shaken and Stare. A part of the
feedback I've gotten is that unless all carriers all over the world implement this, and they all
promise not to allow governments to mess with it for spooking purposes, it really won't work.
I don't know it well enough yet to either accept that as an answer or tell them they're wrong,
but at least I hope and I think that it will assist in reducing the problem. What's your take
on this and do you have any solid arguments I can use in order to speed up their process of
considering this? Yeah, so one of the things that we hear a lot from customers, and so like as
somebody that like works at an originating service provider, this is something that our customers are
actually like interested in us implementing, specifically because of like not the like
consumer, like I'm sick of receiving spam calls side of things. I don't know like what the,
you know, Scandinavian countries, like how many complaints you're getting about this. The reason
like the FCC is motivated to do this is because they just get a lot of complaints about robocalling.
But on the flip side of that, from the company side of things, there's a lot of motivation there
to be like, hey, I want my customers to actually answer the calls that I'm like sending them.
And so if we reduce calls for that are spam calls, then we might be able to get calls to get
answered. And so there is that like, in America, capitalist, you know, type of motivation there to
say, hey, this might actually be good for businesses. And so there's been like some
lobbying on that side of it, too. So if there's like, a big reason for companies that you know,
in the countries that you operate to do this, like, there obviously are going to be some of
those network effects of like, hey, until everybody does this, it's not going to be a
perfect solution. But I agree with you, I think it's going to help. And I think it might help with
like, the, you know, we might get to a point where the terminating service providers decide,
hey, like, I'm not going to like allow calls through, or maybe we'll have a point where the
consumers get to say, hey, I'm only going to let you like ring calls through to my phone.
If it has that like a level attestation, we might see this. And this is where like,
we don't really know yet, right? Like, we might or couldn't see this get to the point where you
have more fine grained control as a consumer, almost like you do on your email inbox of saying,
like, maybe I have like a phone spam folder that I need to like, don't like look at unless I
specifically go check the missed calls in that like, unsigned folder, like things that aren't
signed by shaken. Yeah, very interesting. The next question is along those same lines.
Biggest question for me is how do we solve the robocall scam problem globally? Privacy laws and
even new tech that's only implemented in one country isn't going to do anything. Do you think
maybe calls might be blocked from outside of the country if they're not signed? Yeah, I don't know.
I mean, I think that's going to be one of those things. Like, I don't think right now there's
going to be a ton of that happening. You know, obviously, my viewpoint on this is pretty US
centric, since I, you know, I live in the US and have done the majority of research on this problem
in the US. And this is something that I'm just like, not as familiar about, like, in the US,
it's something where the majority of the calls that I get, the vast majority of the calls I get
are from other US numbers. I know, obviously, that's not as true in other parts of the country
where like, or other parts of the globe where there's like more countries that you would be
receiving more calls from other like country codes. So yeah, I don't I don't think we're
going to get to a point where like, it's just straight up blocking things because they're from another
country. But you know, that might be something where things like I said, could flip to say, like
the consumer can decide, hey, I want to, you know, allow these types of calls or, you know, maybe
this is something that like carriers will come to an agreement with, like, there's already a lot
of agreements between carriers as they switch calls between different networks to get them to
other countries. Like, you know, that's all part of the PSTN that you have to have that those
switches kind of in place to talk to other carriers and other parts of the globe. So
yeah, there's just there, it's unfortunate, but there is just a lot that's unknown about how this
is going to play out. But good question. Yeah, thank you. And then let's see, we've got another
I was curious, who enforces fines under the TRACED Act? Do I need to take the spammer to
court myself? Or will the government do that for me? That's a good question. I don't fully know
the answer to that. But it might be something that the FCC would be involved in. And that's
as much as I will speculate on that until I know more for sure.
Cool. Well, there's some more questions here. Yeah, all right. What are potential
attack vectors to protect against? Example for TLS and attack vectors getting a bad root
certificate or bad root CA certificate in your trust store? Is there a similar problem?
This is another one that I haven't thought too much about yet. But I'll definitely take that
back to the team that's implementing this at Twilio and see if they have any thoughts about
that. And maybe issue a follow up to you. Yeah, that's interesting. So depend on how it's
implemented. Yeah, I know there was actually somebody that talked about this last year at the
crypto privacy village in terms of like, and they focused on like a lot of the
like the actual like the originating service provider has to set up like their own PKI and
stuff around it. And they were like, that can be really hard. But that person was also like a PKI
vendor of like, I can help you with this. So I'm not sure how hard that part actually is.
All right. Well, thank you for joining us today. If anybody has any more questions,
direct them to the Discord Q&A channel.
And Kelly is there and she might be able to answer some of your questions. Thanks, everyone for
joining us. And next up on the screen.