start	end	text
5020	10480	Hey, everyone. If you're anything like me, your missed calls list looks a lot like this.
10960	17420	And I know I'm not unique. You know, the average person gets about 14 unwanted calls every month.
17420	21760	And you might notice that some of these in my call list are flagged as spam, which is somewhat
21760	27800	useful. But what if we could actually start to verify callers? What if we weren't just flagging
27800	32380	things as spam and potentially harmful, but actually doing the opposite and saying, hey,
32380	38520	you can trust this call? We already do this with websites. We already do this with emails.
38520	45220	Why can't we do this with phone numbers? The good news is the short answer is that we can.
45260	49820	And I'm going to be telling you about this TLS-like technology that's been developed to
49820	55760	solve the call authentication problem. It's called Shake It and Stir, and we'll be diving into the
55760	61660	history of why this is a problem, some definitions and technical details of the spec, how the U.S.
61660	67020	is going to enforce implementation. Unfortunately, a lot of this is specific to North America right
67020	71780	now. But we'll also be diving into the limitations of what this technology is,
71780	76840	one of those obviously being that it's not applicable to the rest of the globe yet.
77500	82640	So my name is Kelly Robinson. I have been working at Twilio for about three years. Twilio offers a
82640	87320	lot of communication services, including a lot of stuff around telephony. I actually work on
87320	91400	Twilio's account security products for things like phone verification. But this was just something
91400	97420	that I got really interested in in terms of what the telephony security of actually authenticating
97420	102540	call systems was. So we have a separate team that I'm not involved with at Twilio that is working
102540	107780	on implementing some of this stuff, but this is just some of my own research into what this is,
107780	113080	how it works, and hopefully I can share that with you in somewhat of an introduction to what
113080	120400	Shake and Stir is. So let's start with just talking about what telephony security even means.
120400	128000	Telephony security is in quotes there very obviously because basically there wasn't a lot of security when telephony got started.
128000	133340	There was a monopoly of companies, and even as recent as 30 years ago, the network basically
133340	139460	looked like this. It was private, it was closed, there was proprietary technology everywhere, there
139460	143400	were just a couple of companies, and they all basically knew how to trust each other. They all
143400	148420	knew who they were dealing with, and they all had direct lines of communication with one another.
148940	153700	And if you compare that to today, there's literally thousands of companies. It's really easy
153700	160080	to access this technology. There's more standard technology now built on top of IP, so you don't
160080	165360	have to have this kind of proprietary technology and a lot of infrastructure to get started,
165360	170220	and there's all these potential paths and routes for a call to take. And you can think of the
170220	175520	difference in accessing the telephony network like you would in deploying a website today. So this is
175520	180380	the difference between having your own on-prem hardware, your own servers that you're running,
180380	185840	versus today you can use something like AWS to get up and running very quickly.
187280	191020	And before we dive into this a little bit further, I do want to give a little bit more
191020	196260	context on some telephony jargon. If you aren't familiar with telephony, I wasn't before I started
196260	202260	working at a telephony company. And starting with the PSTN. So this is the analog and digital
202260	208120	systems like cellular networks, undersea fiber optic cables, and copper telephone lines. And
208120	212900	this is what allows people across the globe to complete voice calls. Something that you might
212900	217020	have heard of before is VoIP, and this is the voice over internet protocol. This is what a lot
217020	222560	of mobile infrastructure and businesses are actually using now. And so this is what people
222560	227780	are moving towards. This is kind of the standard technology that people have more access to now,
227780	235860	but it can also interact with the PSTN. And then finally SIP is a way to initiate IP phone calls
235860	241200	and other communications. You can kind of think of it like an HTTP request for phone calls. It
241200	246640	contains metadata and instructions about where a call is both coming from, who it's going to,
246640	252240	and some other data about what the call should be. And the important thing to note here is that
252240	259220	shaken and stir will only apply to SIP initiated phone calls. And so let's kind of talk about what
259220	264400	the problem is here. And I specifically frame this as unwanted robocalls because not all robocalls
264400	268860	are bad. So you can think of things like prescription pickup notifications, food delivery
268860	274220	services, you know, things like the school has a snow delay type thing. There's reasons to
274220	280520	automatically dial, but we do know that most of the robocalls that we get aren't that. They're
280520	285540	spam and that's bad. And so we wanted to focus on the greater problem of the unwanted robocalls
285540	290600	here. And the reason this is a problem, it's gotten super common in the last five to ten years
290600	295500	for a few main reasons. First, there's a lot of cheap dialers now. It's really easy to do this
295500	302700	automated dialing in an efficient way that actually makes spam and fraud more both efficient but also
302700	308200	profitable. And second, there's over 4,000 service providers in the U.S. alone and that makes it
308200	315040	easier to access and also gives you more access options to access the PSTN. And third,
315040	321040	there's no validation or authentication on who is placing a call. So you can basically set the
321040	325920	from number to whatever you want. And so there's an app that I downloaded at iOS that just lets you
325920	330220	spoof phone numbers. And you don't really even have to know how SIP works. Like there's a way
330220	336260	that you can do this with some SIP knowledge that's even more cheap. But there's like these
336260	341200	consumer applications that you can download if you're an iOS or Android user that, you know,
341200	345040	you don't have to have any technical know-how. And you can just have to believe me that this
345040	352660	is a call I placed to myself from 867-5309. So you might be asking, like, why isn't this
352660	357840	just illegal, right? And the main reason is that because there are some legitimate use cases for
357840	363080	spoofing phone numbers. So nowadays the practice for companies like Uber or DoorDash or something
363080	368220	like that, they'll proxy phone calls through a third number that connects individuals. So like
368220	374340	when you call your Uber driver, when your DoorDash delivery person calls you, you're not getting a
374340	379080	phone call from their number. You're getting a phone call from a third party, a number that's
379080	384400	being proxied in between you. And that, you know, has privacy use cases and also some cost-saving
384400	390260	measures. But it wasn't always like that, right? And so you also had enterprise systems or private
390260	395880	branch exchanges that might be placing a call to a customer from an individual agent's line,
395880	400280	but they want to display something like the toll-free callback number. And historically,
400280	404620	those were just spoofed. You would say, hey, this isn't coming from me, Kelly. This is coming from
404620	410160	my organization. And I want to make sure that you see this phone number in case you need to
410160	415380	call that back. And these systems still exist. So we can't just outlaw this completely.
416280	422720	In fact, the New York Times actually spoofed their from number until 2011, you know, and it was one
422720	426540	of those things to help protect their sources if journalists were calling from their desk phones
426540	431240	that didn't want to necessarily be calling from an individual journalist's phone. But they now
431240	439570	actually will use a 212 number that you can call back. We did introduce some legislation to address
439570	444470	this. The 2009 Truth and Caller ID Act was what did that. So again, this is only about 10 years
444470	449110	old that we started to really think about this as a problem. But we can't completely ban call
449110	453690	spoofing because of the legitimate ways that businesses are still using it. So legislation
453690	459490	specifies that it is illegal to spoof numbers if there's that intent to defraud. But there's also
459490	464310	this enforcement struggle with this. Because the network hops, it might take five or 10 service
464310	469750	providers before you know who actually initiated the call. And they might or might not be able to
469750	474110	tell you about the caller because they're placing calls on behalf of many, many customers.
474590	478810	Tracking down a spammer takes a lot of time and effort and therefore money. And that makes
478810	484230	enforcement of this really hard. So that brings us to the solution. That brings us to Shaken and
484230	489970	Sturr and what we're here to do. Shaken and Sturr are the most egregious of backronym crimes.
490390	495730	So Shaken is the signature-based handling of asserted information using tokens.
496450	501750	Sturr, again, is secure telephony identity revisited. It does get worse. There's a
501750	506370	proposal out there for Lemon Twist, but we're not even going to look at that because I think
506370	512190	people are just getting a little too creative. But basically as the FCC describe it, what Shaken
512190	517590	and Sturr does, calls would have their caller ID signed as legitimate by the originating carriers
517590	523710	and then validated by the terminating carriers before reaching consumers. And so this is where
523710	529530	it comes into that TLS-like authentication. You are signing calls as legitimate and then the
529530	535170	terminating service provider would then display some information to the end user signifying that
535170	540910	calls can be trusted and they were not spoofed. And we're not reinventing the wheel here. We're
540910	545250	borrowing from other web authentication, things like public key infrastructure, certificates,
545250	550930	JSON web tokens are all being used for this. And it's very similar to emails DKIM and DMARC,
550930	557150	which basically authenticates the from sender in an email. And so a lot of the work that was done
557150	562150	on Shaken and Sturr was done in conjunction with some of the authors from DKIM and DMARC
562150	567130	as a way to set best practices for this type of communication.
568190	573330	And this is a simplified view of the end-to-end system, what happens with the Shaken and Sturr
573330	577730	signed calls. So the signing service includes some public key infrastructure key management
577730	582710	and it will be up to the originating service provider to do the key management there.
582710	587110	And so calls are routed in a few ways. So basically between the originating service
587110	591190	provider and the terminating service provider, you might remember from that early slide that
591190	595870	there's like all these kind of routes that a call can take. And the way that that happens
595870	600330	is there's something called the LNP or local number portability. And this is what people
600330	605550	are using to both track whether numbers have been ported between carriers, but it also works as kind
605550	610610	of a DNS like lookup to look up phone numbers so that you can then route calls to the right
610610	615390	service provider. And usually the originating service provider, it's up to them to basically
615390	621170	do this routing. The onus is on them to decide on the route that a call is going to take. They're
621170	627570	usually using something called least cost routing. Twilio uses like an inter-exchange carrier.
627710	632490	There's vendors that allow you to do this to route calls. I don't want to get into that too much,
632490	636830	but basically when it is being passed through the other service providers in the middle there,
636830	640690	it is just being passed through. There's not additional validation in the middle there.
640690	646190	They're just passing the call through. And then on the other side of things, the terminating service
646190	652930	providers then has their own verification service. And the verification service is what contacts the
652930	659210	certificate authority and uses the certificate authority's authority there to then verify
659210	664530	whether or not the call that came into them is a valid signed call. And so certificate authorities
664530	670690	are being chosen by ADIS. That's the Alliance for Telecommunications Industry Solutions. And so
670690	675290	this is a standards body that authored Shaken. So some of the certificate authorities that have
675290	680290	been chosen are people like Newstar and Transnexus. I think there's a few others that haven't been
680290	684930	publicly announced yet. And these are similar to the certificate authorities that administer TLS
684930	690230	certificates like Let's Encrypt. And so then when a call reaches a terminating service provider,
690230	696290	it's up to the client. So this would be somebody like Apple or Google to decide how to display that
696290	700930	the calls are trusted. And so this could be something like, hey, I've got a checkmark next
700930	705890	to this call. We display something like you saw on an early slide there that says there's a verified
705890	713830	caller here. You could do something like a lock that we have in browsers with TLS, HTTPS sites.
713830	718350	So there's different options here. And that has not been standardized in terms of how to signify
718350	722910	this to consumers that these calls are not spoofed. And so I think that's going to be one of
722910	730490	the interesting challenges that we see as this gets rolled out more is how do we build this trust
730490	734710	on the consumer end of things and display this to them in a consistent way so that they know what
734710	740530	to expect. So let's get into a little bit of the weeds of how this actually works from the technical
740530	745830	perspective. So this is what a SIP header looks like currently. You can see the metadata included
745830	752930	there. Just a reminder, SIP is the way to initiate VoIP calls or a way to initiate VoIP calls.
753030	758090	But note the from here. So the problem here, Ray, is that the from number can be spoofed.
758090	762890	And that happens if either the originating service provider allows it, isn't doing any
762890	768070	validation on that. There might be those legitimate reasons for that. But they basically want to make
768070	772570	sure that... and a lot of legitimate service providers are already doing this validation.
772570	776190	They're not letting you place calls from numbers that you don't have access to.
776190	780190	But there's... like I mentioned, there's over 4,000 service providers in the U.S.
780190	784710	alone. A lot of the long-tail service providers might not be doing this validation.
785770	790830	And so what Shaken does is it introduces a new identity header. And this is in the form of a base64
790830	795650	encoded JSON web token. And I'm going to focus on just some of the information that's encoded in
795650	801610	the middle section here. And so the information that's encoded there includes things like the
801610	807090	attestation level. And so this is in the header. And we'll talk more about what the attestation
807090	813110	level is on the next slide. But this is basically the crux of whether or not we trust this call.
813110	816810	But it also includes some additional metadata, like who the call is going to,
816810	824270	who placed the call. And then importantly, the origination ID. This is for the originating
824270	830150	service provider's underlying customer. And so this is set by the originating service provider.
830150	834810	And so the originating service provider, the OSP there, is really putting their reputation on the
834810	839510	line saying, hey, this is my customer that is placing this call and I'm giving them this level
839510	846010	of attestation. And this is important because this ID makes it near instant to identify bad actors
846010	850870	because you can trace back the call to the underlying customer. And this is what's going
850870	857750	to allow us to enforce the Truth in Caller ID Act. And so not only does Shaken allow you to build
857750	864130	trust in calls that aren't spoofed, but it also allows a lot of the enforcement side of things
864130	869090	to make sure that we can track down bad actors more quickly and more efficiently.
869930	876590	And so back to the attestation levels, there are three levels that can be attributed to a caller.
876590	882210	And so the originating service provider is going to decide what the attestation level is here.
882210	886350	So A is the highest level of attestation, of course. And so this is saying, I know who this
886350	892190	customer is and I know they can use this number that they are calling from. And so that is what
892190	897630	you would assume most of the legitimate business calls being placed are. Attestation levels B and
897630	904850	C have some less level of trust in the call, but this is still likely to be a less fraudulent call
904850	911270	if it's signed with any of these attestation levels than if it wasn't signed at all. And so
912170	916550	generally, I think what, and this is where we don't have a lot of standardization around this
916550	923350	yet, but the clients, so the Googles, the Apples, are going to have to decide in conjunction with
923350	928930	the carriers, the Verizons, the T-Mobiles, these types of people, how to display trust. And likely
928930	932950	what's going to happen is that they're only going to display a checkmark or a verified caller
932950	941130	if there is that attestation level A. So new technology is really great, but we need to
941130	946390	make sure that people are actually implementing this. And so one of the things that is good about
946390	951710	this is it puts the onus on businesses to do the implementation and not as much on the consumers to
952390	957150	increase consumer protections. But the main way that we're going to ensure that businesses
957150	961990	implement this is with the TRACED Act. And so this is the Telephone Robocall Abuse Criminal
961990	968210	Enforcement Deterrence Act. It was passed by the Senate last May, passed by the House and signed
968210	973490	into law in December of 2019. So I think it was like December 30th of 2019, it was signed into
973490	980090	law. And what it did is gave a timeline that started at that point. So basically, you can think
980090	988790	of the beginning of this year, it gives telecom companies 18 months to implement shaken and stir.
988790	994610	And so you can think mid-2021 is kind of when the deadline for this is. A lot of bigger companies
994610	1001050	have been working on this for a while, but it's still going to start to enforce the deadline in
1001050	1008110	mid-2021, assuming that everything goes as planned. So it also allows for a $10,000 fine for offenders.
1008110	1017370	And so this does also add an additional fine on top of the existing Truth in Color ID Act.
1018170	1023570	So the authentication requirements for the TRACED Act depend on the type of call. So if it's VOIP,
1023570	1028590	the requirements there is that you have to implement shaken and stir. But they do acknowledge
1028590	1032630	that there isn't really a good solution for non-VOIP calls yet. And there are a lot of
1032630	1038210	non-VOIP calls that are on the PSTN. And so NuSTAR has a solution called Stir Out of Ban
1038210	1043450	for non-VOIP authentication. If you are a company that is placing non-VOIP calls,
1043450	1048990	there's things that you can look into here for you or your customers. But definitely, I think
1049450	1053090	that's one of the challenges to getting this implemented, is not everything is just going to
1053090	1058690	be able to implement shaken and stir. And that's kind of what I wanted to get into now,
1058690	1062990	which is what are the limitations of this technology? First being, you know, according
1062990	1068010	to my curmudgeonly coworker, Randy, who's been working in telecom for many, many years,
1068010	1073150	the phone network is kind of an ungodly beast. And so it's, you know, a collection of wires that
1073150	1079590	has been rapidly expanding for over 100 years. And so there is this kind of situation that we've
1079590	1083690	run into where there isn't a standard technology that's being used for all the calls. And so we
1083690	1088730	can't just flip the switch and change everything over to be suddenly authenticated. And part of
1088730	1094410	that ungodly beast is this thing called time division multiplexing, or TDM. This is essentially
1094410	1099190	the opposite of VOIP. It's old school hardware that's been around for 50 years. It's baked into
1099450	1105510	a lot of enterprise private networks. And the TRACED Act explicitly acknowledges TDM as a
1105510	1110670	potential burden to implementing shake and stir. So they said that the burdens are barriers to the
1110670	1115430	implementation, including for providers of voice service to the extent the networks of such
1115430	1120990	providers use time division multiplexing. Fancy language in the bill that basically says, we get
1120990	1126450	it. This might be hard for people that aren't using VOIP. And then another challenge that we
1126450	1130270	have is that there just is this long tail of service providers. Like this is something that
1130270	1135330	companies like Twilio and Verizon, Comcast, other large companies have been working on for
1135330	1139930	months. What happens when you're a smaller scale service provider that's running limited
1140650	1146550	infrastructure? You might have different access points to the PSTN that aren't going to be VOIP,
1146550	1151630	like I said. And so of the 4,000 service providers in the U.S. alone, I don't know
1151630	1158350	what percentage of those is going to be compliant by mid-2021. So the requirements to
1160550	1165190	comply with this law, it does require significant investment. And I don't know if we can reasonably
1165190	1168890	expect that everybody will be able to make that investment in time.
1169870	1175190	And then there's all these other problems. The biggest problem is in the U.S. right now. But
1175190	1180370	this is also a problem in places like UK and Norway. And I haven't really heard of any initiatives
1180370	1186270	outside of North America to address this. There are starting to be some initiatives to implement
1186270	1192650	this in Canada. But maybe this is something that if your country has a solution for this,
1192650	1196510	reach out. I'd love to hear about what you're doing for enforcement there.
1196510	1200290	But there's other things that we have to think about, like what about ported numbers,
1200290	1204590	the international side, like I mentioned, and also text messages. There's other communication
1204590	1207910	channels that don't have the same type of authentication.
1210570	1215390	So the FCC's number one complaint right now is robocalls, but the government is obviously a
1215390	1221950	little distracted with other global pandemics right now. But I think in terms of that department,
1221950	1226390	this is something that they have a priority and a motivation to fix.
1226430	1232490	And so like I said, the timeline for enforcement here is that towards the end of 2020 or into 2021,
1232490	1237650	we'll start to see more people start to implement this. And you might start to see calls coming
1237650	1242050	through already on your phone that might have a checkmark or might have an indication that
1242050	1249310	they're being signed. So what can you do in terms of implementing shake and stir for your business?
1249310	1254850	Talk to your service provider, whoever is doing your telephony. Most businesses probably won't
1254850	1258950	have to do much in terms of implementation. A lot of the onus is going to be on the service
1258950	1263810	providers themselves. You might have to go through with some additional verifications and like KYC,
1263810	1268670	know your customer type stuff with your service provider. So at Twilio, we'll need you to create
1268810	1272750	a business profile that has some additional details about your account before we would
1272750	1280120	give you and start signing your calls with the highest attestation. And then there's some
1280120	1285500	precautions that you can take as just application security professionals. So you can protect your
1285500	1290620	numbers from web scraping bots. Don't assign sequential numbers to your employees. That's
1290720	1297140	a way that people can kind of guess which employees might have lines at your company.
1297420	1301760	And then you can use actual authentication in your call centers. This is another way that you can
1301760	1308380	protect your business from phishing. This is something that I could talk about for many,
1308380	1313540	basically. We'll only ask for a consumer, you know, date of birth and email in order to verify
1313540	1318060	the customer. And so there's a lot of other things you can do to actually authenticate people on
1318060	1323460	either end of the call. And then if you know what a PBX is and you have one, you might look into
1323940	1329640	installing the FCC blacklist database on that. Some controversy around whether or not you want
1329640	1334480	to do that. It's hard to get off the blacklist database if you're on there. But this is something
1334480	1339880	that you may or may not have to worry about. And then there is some ongoing legislation.
1340060	1345180	But things have been pretty quiet from the FCC this year. They did recently, somewhat recently,
1345180	1350680	like in the last year, give telcos the authority to block unwanted calls without explicit subscriber
1350680	1355920	permission. And so, you know, AT&T, Verizon, T-Mobile in the U.S., they can now decide, hey,
1355920	1360580	we're going to send this to basically like a spam folder without ever notifying you that the call
1360580	1365960	came in and I don't need you, Kelly, to tell me that that's okay. And then like I mentioned,
1365960	1369580	in terms of timeline for the Trace Stack, the enforcement will start to begin at the end of
1369580	1377620	2020. Last update from the FCC on this was March 31st. And this reaffirmed their call to implement
1377620	1384160	Shaken and Stir, but it did already grant an exception for and an extension for small voice
1384160	1388560	service providers. And I don't know what that means. I don't know exactly how they're going
1388560	1393720	to decide who is a small voice service provider, but they are already thinking about, you know,
1393720	1398880	this was three months after the bill was signed into law. They're already saying, hey, maybe this
1398880	1406240	timeline isn't reasonable. So while I do think that a lot of larger telecom providers will start to
1406240	1412760	sign calls within the end of this year, I do think that there is going to be an exception for
1412760	1416880	that long tail of service providers and not everything is going to be a signed call
1416880	1423960	before, you know, the end of 2021. There are a couple of things you can do as a consumer to
1423960	1429520	protect yourself today. You can install one of these apps depending on how much you trust them.
1429520	1433360	A lot of times you have to give them basically complete control over your phone, so your
1433360	1439100	mileage may vary there. But things like NovoRobo, RoboKiller, CallApp, you know, companies like
1439100	1443780	AT&T have a partnership with a company called Haya that does, you know, some protection against
1444440	1451240	spam calls. Of course, a lot of consumer telecoms are starting to upsell spam detection services,
1451240	1457020	so Verizon offers their CallFilter Plus for the low, low price of $3 a month. But, you know,
1457020	1461420	these are things that you can look into installing on your phone if this is something that is a huge
1461420	1466100	annoyance to you right now. So like I said, unfortunately, I don't think this is going to
1466100	1470380	solve all problems right away, but I think people are really optimistic that Shaken and Stare will
1470380	1476840	help restore trust in telephony, because not only is it going to help, you know, mitigate spam calls
1476840	1481620	that are coming into your phone, but for those wanted calls for, you know, the calls that you
1481620	1488120	want to see that might be from unknown numbers, there's going to be a renewed trust in some of
1488120	1492820	those phone calls. And so there is that motivation from businesses to restore that type of trust so
1492820	1498820	that people will answer the calls. Hopefully this is a good overview in terms of what you can expect
1498820	1504060	from Shaken and Stare. If you have any questions, you can find me on Twitter. I'm also on Discord.
1504160	1507780	Once again, my name is Kelly Robinson, and thank you for listening.
1513380	1519180	All right, welcome back everybody. That was What If We Had TLS for Phone Numbers? An Introduction
1519180	1525120	to Shaken and Stare by Kelly Robinson. We actually have Kelly with us here right now.
1525140	1532420	If you have any questions, drop them in our Discord Q&A channel down linked in the description
1532420	1541940	below. We've got some questions here. Hi Kelly, great talk. Thank you. Question, working hard to
1541940	1547200	get Scandinavian governments and telcos to have an opinion on Shaken and Stare. A part of the
1547200	1552140	feedback I've gotten is that unless all carriers all over the world implement this, and they all
1552140	1558020	promise not to allow governments to mess with it for spooking purposes, it really won't work.
1558020	1562140	I don't know it well enough yet to either accept that as an answer or tell them they're wrong,
1562140	1566580	but at least I hope and I think that it will assist in reducing the problem. What's your take
1566580	1571340	on this and do you have any solid arguments I can use in order to speed up their process of
1571340	1579100	considering this? Yeah, so one of the things that we hear a lot from customers, and so like as
1579100	1583180	somebody that like works at an originating service provider, this is something that our customers are
1583180	1588980	actually like interested in us implementing, specifically because of like not the like
1588980	1594960	consumer, like I'm sick of receiving spam calls side of things. I don't know like what the,
1594960	1599220	you know, Scandinavian countries, like how many complaints you're getting about this. The reason
1599220	1604720	like the FCC is motivated to do this is because they just get a lot of complaints about robocalling.
1605200	1609160	But on the flip side of that, from the company side of things, there's a lot of motivation there
1609160	1615040	to be like, hey, I want my customers to actually answer the calls that I'm like sending them.
1615040	1623720	And so if we reduce calls for that are spam calls, then we might be able to get calls to get
1623720	1629640	answered. And so there is that like, in America, capitalist, you know, type of motivation there to
1629640	1633660	say, hey, this might actually be good for businesses. And so there's been like some
1633660	1640020	lobbying on that side of it, too. So if there's like, a big reason for companies that you know,
1640020	1643840	in the countries that you operate to do this, like, there obviously are going to be some of
1643840	1647580	those network effects of like, hey, until everybody does this, it's not going to be a
1647580	1652420	perfect solution. But I agree with you, I think it's going to help. And I think it might help with
1652420	1658340	like, the, you know, we might get to a point where the terminating service providers decide,
1658340	1662920	hey, like, I'm not going to like allow calls through, or maybe we'll have a point where the
1662920	1668200	consumers get to say, hey, I'm only going to let you like ring calls through to my phone.
1668200	1672940	If it has that like a level attestation, we might see this. And this is where like,
1672940	1676500	we don't really know yet, right? Like, we might or couldn't see this get to the point where you
1676500	1681360	have more fine grained control as a consumer, almost like you do on your email inbox of saying,
1681360	1686440	like, maybe I have like a phone spam folder that I need to like, don't like look at unless I
1686440	1691600	specifically go check the missed calls in that like, unsigned folder, like things that aren't
1691600	1699820	signed by shaken. Yeah, very interesting. The next question is along those same lines.
1699820	1706520	Biggest question for me is how do we solve the robocall scam problem globally? Privacy laws and
1706520	1711800	even new tech that's only implemented in one country isn't going to do anything. Do you think
1711800	1718800	maybe calls might be blocked from outside of the country if they're not signed? Yeah, I don't know.
1718800	1723180	I mean, I think that's going to be one of those things. Like, I don't think right now there's
1723180	1728500	going to be a ton of that happening. You know, obviously, my viewpoint on this is pretty US
1728500	1733540	centric, since I, you know, I live in the US and have done the majority of research on this problem
1733540	1738940	in the US. And this is something that I'm just like, not as familiar about, like, in the US,
1738940	1743220	it's something where the majority of the calls that I get, the vast majority of the calls I get
1743220	1747540	are from other US numbers. I know, obviously, that's not as true in other parts of the country
1747540	1751440	where like, or other parts of the globe where there's like more countries that you would be
1751440	1757280	receiving more calls from other like country codes. So yeah, I don't I don't think we're
1757280	1761860	going to get to a point where like, it's just straight up blocking things because they're from another
1761860	1767540	country. But you know, that might be something where things like I said, could flip to say, like
1767540	1773980	the consumer can decide, hey, I want to, you know, allow these types of calls or, you know, maybe
1773980	1778000	this is something that like carriers will come to an agreement with, like, there's already a lot
1778000	1783520	of agreements between carriers as they switch calls between different networks to get them to
1783520	1788760	other countries. Like, you know, that's all part of the PSTN that you have to have that those
1788760	1793140	switches kind of in place to talk to other carriers and other parts of the globe. So
1793140	1797280	yeah, there's just there, it's unfortunate, but there is just a lot that's unknown about how this
1797280	1804440	is going to play out. But good question. Yeah, thank you. And then let's see, we've got another
1804440	1810120	I was curious, who enforces fines under the TRACED Act? Do I need to take the spammer to
1810120	1816480	court myself? Or will the government do that for me? That's a good question. I don't fully know
1816480	1821360	the answer to that. But it might be something that the FCC would be involved in. And that's
1821360	1827420	as much as I will speculate on that until I know more for sure.
1829500	1837400	Cool. Well, there's some more questions here. Yeah, all right. What are potential
1837400	1842920	attack vectors to protect against? Example for TLS and attack vectors getting a bad root
1842920	1848600	certificate or bad root CA certificate in your trust store? Is there a similar problem?
1849980	1855800	This is another one that I haven't thought too much about yet. But I'll definitely take that
1855800	1859920	back to the team that's implementing this at Twilio and see if they have any thoughts about
1859920	1866420	that. And maybe issue a follow up to you. Yeah, that's interesting. So depend on how it's
1866420	1873100	implemented. Yeah, I know there was actually somebody that talked about this last year at the
1873100	1877440	crypto privacy village in terms of like, and they focused on like a lot of the
1878680	1882980	like the actual like the originating service provider has to set up like their own PKI and
1882980	1887500	stuff around it. And they were like, that can be really hard. But that person was also like a PKI
1887500	1893240	vendor of like, I can help you with this. So I'm not sure how hard that part actually is.
1894740	1900380	All right. Well, thank you for joining us today. If anybody has any more questions,
1900380	1903660	direct them to the Discord Q&A channel.
1903900	1907440	And Kelly is there and she might be able to answer some of your questions. Thanks, everyone for
1907440	1911960	joining us. And next up on the screen.