1 00:00:04,190 --> 00:00:05,770 Hey, everyone. 2 00:00:05,770 --> 00:00:10,330 If you're anything like me, your missed calls list looks a lot like this. 3 00:00:10,930 --> 00:00:12,610 And I know I'm not unique. 4 00:00:12,770 --> 00:00:17,330 You know, the average person gets about 14 unwanted calls every month. 5 00:00:17,330 --> 00:00:22,810 And you might notice that some of these in my call list are flagged as spam, which is somewhat useful. 6 00:00:23,090 --> 00:00:26,330 But what if we could actually start to verify callers? 7 00:00:26,330 --> 00:00:34,410 What if we weren't just flagging things as spam and potentially harmful, but actually doing the opposite and saying, hey, you can trust this call. 8 00:00:34,830 --> 00:00:36,710 We already do this with websites. 9 00:00:36,710 --> 00:00:38,290 We already do this with emails. 10 00:00:38,290 --> 00:00:40,770 Why can't we do this with phone numbers? 11 00:00:42,130 --> 00:00:45,050 The good news is the short answer is that we can. 12 00:00:45,070 --> 00:00:52,390 And I'm going to be telling you about this TLS-like technology that's been developed to solve the call authentication problem. 13 00:00:52,390 --> 00:01:01,570 It's called Shake It and Stir, and we'll be diving into the history of why this is a problem, some definitions and technical details of the spec, how the U.S. 14 00:01:01,570 --> 00:01:03,690 is going to enforce implementation. 15 00:01:03,690 --> 00:01:07,630 Unfortunately, a lot of this is specific to North America right now. 16 00:01:07,690 --> 00:01:16,690 But we'll also be diving into the limitations of what this technology is, one of those obviously being that it's not applicable to the rest of the globe yet. 17 00:01:17,390 --> 00:01:19,070 So my name is Kelly Robinson. 18 00:01:19,070 --> 00:01:21,630 I have been working at Twilio for about three years. 19 00:01:21,630 --> 00:01:25,870 Twilio offers a lot of communication services, including a lot of stuff around telephony. 20 00:01:25,870 --> 00:01:38,890 I actually work on Twilio's account security products for things like phone verification, but this was just something that I got really interested in in terms of what the telephony security of actually authenticating call systems was. 21 00:01:39,030 --> 00:01:54,630 So we have a separate team that I'm not involved with at Twilio that is working on implementing some of this stuff, but this is just some of my own research into what this is, how it works, and hopefully I can share that with you in somewhat of an introduction to what Shake and Stir is. 22 00:01:56,410 --> 00:02:00,350 So let's start with just talking about what telephony security even means. 23 00:02:00,350 --> 00:02:07,750 Security is in quotes there very obviously because basically there wasn't a lot of security when telephony got started. 24 00:02:07,750 --> 00:02:14,430 There was a monopoly of companies, and even as recent as 30 years ago, the network basically looked like this. 25 00:02:14,430 --> 00:02:15,470 It was private. 26 00:02:15,470 --> 00:02:16,670 It was closed. 27 00:02:16,670 --> 00:02:19,250 There was proprietary technology everywhere. 28 00:02:19,250 --> 00:02:22,950 There were just a couple of companies, and they all basically knew how to trust each other. 29 00:02:22,950 --> 00:02:28,210 They all knew who they were dealing with, and they all had direct lines of communication with one another. 30 00:02:28,910 --> 00:02:32,810 And if you compare that to today, there's literally thousands of companies. 31 00:02:32,810 --> 00:02:35,710 It's really easy to access this technology. 32 00:02:35,850 --> 00:02:45,330 There's more standard technology now built on top of IP, so you don't have to have this kind of proprietary technology and a lot of infrastructure to get started. 33 00:02:45,330 --> 00:02:49,070 And there's all these potential paths and routes for a call to take. 34 00:02:49,070 --> 00:02:54,790 And you can think of the difference in accessing the telephony network like you would in deploying a website today. 35 00:02:54,790 --> 00:03:05,710 So this is kind of the difference between having your own on-prem hardware, your own servers that you're running, versus today you can use something like AWS to get up and running very quickly. 36 00:03:07,150 --> 00:03:12,710 And before we dive into this a little bit further, I do want to give a little bit more context on some telephony jargon. 37 00:03:12,710 --> 00:03:20,150 If you aren't familiar with telephony like I wasn't before I started working at a telephony company, I'm starting with the PSTN. 38 00:03:20,150 --> 00:03:27,910 So this is the analog and digital systems like cellular networks, undersea fiber optic cables, and copper telephone lines. 39 00:03:27,910 --> 00:03:31,570 This is what allows people across the globe to complete voice calls. 40 00:03:32,030 --> 00:03:36,170 Something that you might have heard of before is VoIP, and this is the voice over internet protocol. 41 00:03:36,170 --> 00:03:41,170 This is what a lot of mobile infrastructure and businesses are actually using now. 42 00:03:41,290 --> 00:03:43,310 And so this is what people are moving towards. 43 00:03:43,310 --> 00:03:47,650 This is kind of the standard technology that people have more access to now. 44 00:03:47,650 --> 00:03:51,150 But it can also interact with the PSTN. 45 00:03:51,770 --> 00:03:57,230 And then finally SIP is a way to initiate IP phone calls and other communications. 46 00:03:57,230 --> 00:04:00,990 You can kind of think of it like an HTTP request for phone calls. 47 00:04:00,990 --> 00:04:09,290 It contains metadata and instructions about where a call is both coming from, who it's going to, and some other data about what the call should be. 48 00:04:09,390 --> 00:04:16,370 And the important thing to note here is that SHAKEN and STIR will only apply to SIP initiated phone calls. 49 00:04:17,510 --> 00:04:20,010 And so let's kind of talk about what the problem is here. 50 00:04:20,010 --> 00:04:25,190 And I specifically frame this as unwanted robocalls because not all robocalls are bad. 51 00:04:25,190 --> 00:04:33,150 So you can think of things like prescription pickup notifications, food delivery services, things like the school has a snow delay type thing. 52 00:04:33,150 --> 00:04:35,650 There's reasons to automatically dial. 53 00:04:35,650 --> 00:04:40,030 But we do know that most of the robocalls that we get aren't that. 54 00:04:40,030 --> 00:04:41,330 They're spam and that's bad. 55 00:04:41,330 --> 00:04:46,030 And so we wanted to focus on the greater problem of the unwanted robocalls here. 56 00:04:46,030 --> 00:04:51,870 And the reason that this is a problem, it's gotten super common in the last 5 to 10 years for a few main reasons. 57 00:04:51,870 --> 00:04:54,030 First, there's a lot of cheap dialers now. 58 00:04:54,030 --> 00:05:03,650 It's really easy to do this automated dialing in an efficient way that actually makes spam and fraud more both efficient but also profitable. 59 00:05:03,930 --> 00:05:07,130 And second, there's over 4,000 service providers in the U.S. 60 00:05:07,130 --> 00:05:07,530 alone. 61 00:05:07,530 --> 00:05:14,050 And that makes it easier to access and also gives you more options to access the PSTN. 62 00:05:14,050 --> 00:05:19,430 And third, there's no validation or authentication on who is placing a call. 63 00:05:19,630 --> 00:05:22,810 So you can basically set the from number to whatever you want. 64 00:05:23,010 --> 00:05:27,190 So there's an app that I downloaded on iOS that just lets you spoof phone numbers. 65 00:05:27,270 --> 00:05:29,610 And you don't really even have to know how SIP works. 66 00:05:29,610 --> 00:05:34,890 There's a way that you can do this with some SIP knowledge that's even more cheap. 67 00:05:34,890 --> 00:05:43,210 But there's these consumer applications that you can download if you're an iOS or Android user that you don't have to have any technical know-how. 68 00:05:43,210 --> 00:05:44,710 You just have to believe me. 69 00:05:44,710 --> 00:05:48,690 And this is a call I placed to myself from 867-5309. 70 00:05:50,190 --> 00:05:53,650 So you might be asking, like, why isn't this just illegal, right? 71 00:05:53,650 --> 00:05:59,030 And the main reason is that because there are some legitimate use cases for spoofing phone numbers. 72 00:05:59,030 --> 00:06:07,790 So nowadays, the practice for companies like Uber or DoorDash or something like that, they'll proxy phone calls through a third number that connects individuals. 73 00:06:07,790 --> 00:06:15,510 So when you call your Uber driver, when your DoorDash delivery person calls you, you're not getting a phone call from their number. 74 00:06:15,510 --> 00:06:20,370 You're getting a phone call from a third party, a number that's being proxied in between you. 75 00:06:20,370 --> 00:06:24,630 And that has privacy use cases and also some cost-saving measures. 76 00:06:24,630 --> 00:06:26,630 But it wasn't always like that, right? 77 00:06:26,630 --> 00:06:35,350 And so you also had enterprise systems or private branch exchanges that might be placing a call to a customer from an individual agent's line. 78 00:06:35,350 --> 00:06:39,290 But they want to display something like the toll-free callback number. 79 00:06:39,370 --> 00:06:41,270 And historically, those were just spoofed. 80 00:06:41,270 --> 00:06:43,530 You would say, hey, this isn't coming from me, Kelly. 81 00:06:43,530 --> 00:06:46,170 This is coming from my organization. 82 00:06:46,350 --> 00:06:51,050 And I want to make sure that you see this phone number in case you need to call that back. 83 00:06:51,050 --> 00:06:55,250 And these systems still exist, so we can't just outlaw this completely. 84 00:06:56,210 --> 00:07:01,610 In fact, the New York Times actually spoofed their From number until 2011. 85 00:07:01,610 --> 00:07:04,350 And it was one of those things to help protect their sources. 86 00:07:04,350 --> 00:07:10,550 If journalists were calling from their desk phones, they didn't want to necessarily be calling from an individual journalist's phone. 87 00:07:10,550 --> 00:07:14,750 But they now actually will use a 212 number that you can call back. 88 00:07:17,410 --> 00:07:19,790 We did introduce some legislation to address this. 89 00:07:19,790 --> 00:07:22,750 The 2009 Truth in Caller ID Act was what did that. 90 00:07:22,750 --> 00:07:27,010 So, again, this is only about 10 years old that we started to really think about this as a problem. 91 00:07:27,010 --> 00:07:32,690 But we can't completely ban call spoofing because of the legitimate ways that businesses are still using it. 92 00:07:32,690 --> 00:07:38,750 So, legislation specifies that it is illegal to spoof numbers if there's that intent to defraud. 93 00:07:38,770 --> 00:07:42,870 But there's also this enforcement struggle with this because the network hops. 94 00:07:42,870 --> 00:07:47,490 It might take 5 or 10 service providers before you know who actually initiated the call. 95 00:07:47,490 --> 00:07:54,130 And they might or might not be able to tell you about the caller because they're placing calls on behalf of many, many customers. 96 00:07:54,230 --> 00:07:57,970 And so tracking down a spammer takes a lot of time and effort and, therefore, money. 97 00:07:57,970 --> 00:08:00,690 And that makes enforcement of this really hard. 98 00:08:01,290 --> 00:08:03,070 So, that brings us to the solution. 99 00:08:03,070 --> 00:08:05,910 That brings us to SHAKEN and STIR and what we're here to do. 100 00:08:06,250 --> 00:08:09,830 SHAKEN and STIR are the most egregious of acronym crimes. 101 00:08:10,230 --> 00:08:15,770 So, SHAKEN is the signature-based handling of asserted information using tokens. 102 00:08:16,230 --> 00:08:20,190 STIR, again, is Secure Telephony Identity Revisited. 103 00:08:20,250 --> 00:08:21,250 It does get worse. 104 00:08:21,250 --> 00:08:28,310 There's a proposal out there for Lemon Twist, but we're not even going to look at that because I think people are just getting a little too creative. 105 00:08:28,310 --> 00:08:42,710 But, basically, as the FCC describe it, what SHAKEN and STIR does, calls would have their caller ID signed as legitimate by the originating carriers and then validated by the terminating carriers before reaching consumers. 106 00:08:42,850 --> 00:08:47,050 And so this is where it comes into that TLS-like authentication. 107 00:08:47,050 --> 00:08:58,710 You are signing calls as legitimate and then the terminating service provider would then display some information to the end user signifying that calls can be trusted and they were not spoofed. 108 00:08:58,710 --> 00:09:00,750 We're not reinventing the wheel here. 109 00:09:00,750 --> 00:09:02,690 We're borrowing from other web authentication. 110 00:09:02,690 --> 00:09:08,130 Things like public key infrastructure, certificates, JSON web tokens are all being used for this. 111 00:09:08,150 --> 00:09:14,350 And it's very similar to emails DKIM and DMARC, which basically authenticates the from sender in an email. 112 00:09:14,350 --> 00:09:26,950 And so a lot of the work that was done on SHAKEN and STIR was done in conjunction with some of the authors from DKIM and DMARC as a way to kind of set best practices for this type of communication. 113 00:09:28,110 --> 00:09:34,010 And this is a simplified view of the end-to-end system, what happens with the SHAKEN and STIR signed calls. 114 00:09:34,010 --> 00:09:42,530 So the signing service includes some public key infrastructure, key management, and it will be up to the originating service provider to do the key management there. 115 00:09:42,590 --> 00:09:45,010 And so calls are routed in a few ways. 116 00:09:45,010 --> 00:09:54,130 So basically between the originating service provider and the terminating service provider, you might remember from that early slide that there's like all these kind of routes that a call can take. 117 00:09:54,250 --> 00:09:59,510 And the way that that happens is there's something called the LNP or local number portability. 118 00:09:59,510 --> 00:10:11,650 And this is what people are using to both track whether numbers have been ported between carriers, but it also works as kind of a DNS-like lookup to look up phone numbers so that you can then route calls to the right service provider. 119 00:10:11,650 --> 00:10:20,910 And usually the originating service provider, it's up to them to basically do this routing, the onus is on them to decide on the route that a call is going to take. 120 00:10:20,910 --> 00:10:24,010 They're usually using something called least cost routing. 121 00:10:24,430 --> 00:10:27,430 You know, Twilio uses like an inter-exchange carrier. 122 00:10:27,570 --> 00:10:30,470 There's vendors that allow you to do this to route calls. 123 00:10:30,510 --> 00:10:38,130 I don't want to get into that too much, but basically when it is being passed through the other service providers in the middle there, it is just being passed through. 124 00:10:38,130 --> 00:10:40,550 There's not additional validation in the middle there. 125 00:10:40,550 --> 00:10:42,490 They're just passing the call through. 126 00:10:43,250 --> 00:10:50,050 And then on the other side of things, the terminating service providers then has their own verification service. 127 00:10:50,170 --> 00:11:03,250 And the verification service is what contacts the certificate authority and uses the certificate authority's authority there to then verify whether or not the call that came into them is a valid signed call. 128 00:11:03,250 --> 00:11:06,390 And so certificate authorities are being chosen by ADIS. 129 00:11:06,390 --> 00:11:10,350 That's the Alliance for Telecommunications Industry Solutions. 130 00:11:10,370 --> 00:11:13,250 And so this is the standards body that authored Shaken. 131 00:11:13,310 --> 00:11:18,530 So some of the certificate authorities that have been chosen are people like Newstar and Transnexus. 132 00:11:18,530 --> 00:11:21,790 I think there's a few others that haven't been publicly announced yet. 133 00:11:21,790 --> 00:11:27,290 And these are similar to the certificate authorities that administer TLS certificates like Let's Encrypt. 134 00:11:27,290 --> 00:11:31,510 And so then when a call reaches a terminating service provider, it's up to the client. 135 00:11:31,510 --> 00:11:37,610 So this would be somebody like Apple or Google to decide how to display that the calls are trusted. 136 00:11:37,810 --> 00:11:41,710 And so this could be something like, hey, I've got a checkmark next to this call. 137 00:11:41,710 --> 00:11:47,090 We display something like you saw an early slide there that says there's a verified caller here. 138 00:11:47,090 --> 00:11:53,690 You could do something like a lock that we have like in browsers with TLS, HTTPS sites. 139 00:11:53,690 --> 00:11:55,090 So there's different options here. 140 00:11:55,090 --> 00:12:01,230 And that has not been standardized in terms of how to signify this to consumers that these calls are not spoofed. 141 00:12:01,230 --> 00:12:15,910 And so I think that's going to be one of the interesting challenges that we see as this gets rolled out more is how do we build this trust on the consumer end of things and display this to them in a consistent way so that they know what to expect. 142 00:12:17,050 --> 00:12:21,290 So let's get into a little bit of the weeds of how this actually works from the technical perspective. 143 00:12:21,530 --> 00:12:23,930 So this is what a SIP header looks like currently. 144 00:12:24,090 --> 00:12:26,430 You can see the metadata included there. 145 00:12:26,450 --> 00:12:32,630 Just a reminder, SIP is the way to initiate VoIP calls or a way to initiate VoIP calls. 146 00:12:32,630 --> 00:12:34,470 But note the from here. 147 00:12:34,470 --> 00:12:37,970 So the problem here, Ray, is that the from number can be spoofed. 148 00:12:37,970 --> 00:12:44,490 And that happens if either the originating service provider allows it, isn't doing any validation on that. 149 00:12:44,490 --> 00:12:46,770 There might be those legitimate reasons for that. 150 00:12:46,770 --> 00:12:52,430 But they basically want to make sure that... and a lot of legitimate service providers are already doing this validation. 151 00:12:52,430 --> 00:12:55,830 They're not letting you place calls from numbers that you don't have access to. 152 00:12:55,830 --> 00:13:00,070 But there's, like I mentioned, there's over 4,000 service providers in the U.S. 153 00:13:00,070 --> 00:13:00,850 alone. 154 00:13:00,930 --> 00:13:04,570 A lot of the long-tail service providers might not be doing this validation. 155 00:13:05,630 --> 00:13:08,990 So what Shaken does is it introduces a new identity header. 156 00:13:08,990 --> 00:13:12,690 And this is in the form of a Base64 encoded JSON Web Token. 157 00:13:12,850 --> 00:13:17,030 And I'm going to focus on just some of the information that's encoded in the middle section here. 158 00:13:17,030 --> 00:13:23,370 And so the information that's encoded there includes things like the attestation level. 159 00:13:23,370 --> 00:13:24,910 And so this is in the header. 160 00:13:24,910 --> 00:13:28,970 And we'll talk more about what the attestation level is on the next slide. 161 00:13:28,970 --> 00:13:33,090 But this is basically the crux of whether or not we trust this call. 162 00:13:33,090 --> 00:13:42,290 But it also includes some additional metadata like who the call is going to, who placed the call, and then importantly, the origination ID. 163 00:13:42,290 --> 00:13:46,850 This is for the originating service provider's underlying customer. 164 00:13:47,130 --> 00:13:50,070 And so this is set by the originating service provider. 165 00:13:50,070 --> 00:14:00,710 And so the originating service provider, the OSP there, is really putting their reputation on the line saying, hey, this is my customer that is placing this call and I'm giving them this level of attestation. 166 00:14:00,710 --> 00:14:09,830 And this is important because this ID makes it near instant to identify bad actors because you can trace back the call to the underlying customer. 167 00:14:09,830 --> 00:14:14,410 And this is what's going to allow us to enforce the Truth in Caller ID Act. 168 00:14:14,410 --> 00:14:28,950 And so not only does Shaken allow you to build trust in calls that aren't spoofed, but it also allows a lot of the enforcement side of things to make sure that we can track down bad actors more quickly and more efficiently. 169 00:14:29,670 --> 00:14:36,650 And so back to the attestation levels, there are three levels that can be attributed to a caller. 170 00:14:36,650 --> 00:14:42,130 And so the originating service provider is going to decide what the attestation level is here. 171 00:14:42,130 --> 00:14:44,710 So A is the highest level of attestation, of course. 172 00:14:44,710 --> 00:14:50,830 And so this is saying, I know who this customer is, and I know they can use this number that they are calling from. 173 00:14:50,830 --> 00:14:55,710 And so that is what you would assume most of the legitimate business calls being placed are. 174 00:14:56,410 --> 00:15:10,410 Attestation levels B and C have some less level of trust in the call, but this is still likely to be a less fraudulent call if it's signed with any of these attestation levels than if it wasn't signed at all. 175 00:15:10,410 --> 00:15:26,450 And so generally I think what, and this is where we don't have a lot of standardization around this yet, but the clients, so the Googles, the Apples, are going to have to decide in conjunction with the carriers, the Verizons, the T-Mobiles, these types of people, 176 00:15:26,450 --> 00:15:28,150 how to display trust. 177 00:15:28,150 --> 00:15:35,970 And likely what's going to happen is that they're only going to display a checkmark or a verified caller if there is that attestation level A. 178 00:15:38,210 --> 00:15:43,590 So new technology is really great, but we need to make sure that people are actually implementing this. 179 00:15:43,590 --> 00:15:53,810 And so one of the things that is good about this is it puts the onus on businesses to do the implementation and not as much on the consumers to, you know, increase consumer protections. 180 00:15:53,810 --> 00:15:59,810 But the main way that we're going to ensure that businesses implement this is with the TRACED Act. 181 00:15:59,810 --> 00:16:04,110 And so this is the Telephone Robocall Abuse Criminal Enforcement Deterrence Act. 182 00:16:04,170 --> 00:16:10,370 It was passed by the Senate last May, passed by the House and signed into law in December of 2019. 183 00:16:10,370 --> 00:16:14,190 So I think it was like December 30th of 2019 it was signed into law. 184 00:16:14,190 --> 00:16:19,070 And what it did is gave a timeline that started at that point. 185 00:16:19,070 --> 00:16:28,650 So basically you can think of the beginning of this year, it gives telecom companies 18 months to implement, shake it and stir. 186 00:16:28,650 --> 00:16:33,310 And so you can think mid-2021 is kind of when the deadline for this is. 187 00:16:33,310 --> 00:16:43,970 A lot of bigger companies have been working on this for a while, but it's still going to start to enforce the deadline in mid-2021, assuming that everything goes as planned. 188 00:16:44,190 --> 00:16:47,930 So it also allows for a $10,000 fine for offenders. 189 00:16:47,930 --> 00:16:57,290 And so this does also add an additional fine on top of the existing Truth in Color ID Act. 190 00:16:58,090 --> 00:17:02,330 So the authentication requirements for the Trace Act depend on the type of call. 191 00:17:02,330 --> 00:17:07,270 So if it's VoIP, the requirements there is that you have to implement shake it and stir. 192 00:17:07,290 --> 00:17:11,610 But they do acknowledge that there isn't really a good solution for non-VoIP calls yet. 193 00:17:11,610 --> 00:17:15,030 And there are a lot of non-VoIP calls there on the PSTN. 194 00:17:15,030 --> 00:17:19,910 And so NuSTAR has a solution called Stir Out of Ban for non-VoIP authentication. 195 00:17:20,330 --> 00:17:27,490 You know, if you are a company that's placing non-VoIP calls, there's things that you can look into here for you or your customers. 196 00:17:27,650 --> 00:17:34,950 But definitely, I think that's one of the challenges to getting this implemented is not everything is just going to be able to implement shake it and stir. 197 00:17:36,170 --> 00:17:40,970 And that's kind of what I wanted to get into now, which is what are the limitations of this technology? 198 00:17:41,570 --> 00:17:49,870 First being, you know, according to my curmudgeonly coworker, Randy, who's been working in telecom for many, many years, the phone network is kind of an ungodly beast. 199 00:17:49,870 --> 00:17:57,250 And so it's, you know, a collection of wires that has been rapidly expanding for over 100 years. 200 00:17:57,250 --> 00:18:03,270 And so there is this kind of situation that we've run into where there isn't a standard technology that's being used for all the calls. 201 00:18:03,270 --> 00:18:07,990 And so we can't just flip a switch and change everything over to be suddenly authenticated. 202 00:18:07,990 --> 00:18:13,710 And part of that ungodly beast is this thing called time division multiplexing, or TDM. 203 00:18:13,710 --> 00:18:15,630 This is essentially the opposite of VoIP. 204 00:18:15,630 --> 00:18:18,270 It's old school hardware that's been around for 50 years. 205 00:18:18,270 --> 00:18:21,670 It's baked into a lot of enterprise private networks. 206 00:18:21,670 --> 00:18:28,550 And the TRACED Act explicitly acknowledges TDM as a potential burden to implementing shaken and stir. 207 00:18:28,550 --> 00:18:38,290 So they said that the burdens are barriers to the implementation, including for providers of voice service to the extent the networks of such providers use time division multiplexing. 208 00:18:38,290 --> 00:18:41,030 Fancy language in the bill that basically says, we get it. 209 00:18:41,030 --> 00:18:44,010 This might be hard for people that aren't using VoIP. 210 00:18:44,770 --> 00:18:49,330 And then another challenge that we have is that there just is this long tail of service providers. 211 00:18:49,330 --> 00:18:55,830 Like this is something that companies like Twilio and Verizon, Comcast, other large companies have been working on for months. 212 00:18:55,830 --> 00:19:07,370 What happens when you're a smaller scale service provider that's running, you know, limited infrastructure, you might have different access points to the PSTN that aren't going to be VoIP, like I said. 213 00:19:07,370 --> 00:19:16,210 And so, you know, of the 4000 service providers in the US alone, I don't know what percentage of those is going to be compliant by mid 2021. 214 00:19:16,450 --> 00:19:23,810 So the requirements to comply with this law, it does require significant investment. 215 00:19:23,810 --> 00:19:28,770 I don't know if we can reasonably expect that everybody will be able to make that investment in time. 216 00:19:29,790 --> 00:19:31,770 And then there's all these other problems. 217 00:19:31,770 --> 00:19:34,950 You know, the biggest problem like is in the US right now. 218 00:19:34,950 --> 00:19:38,150 But this is also a problem in places like UK and Norway. 219 00:19:38,150 --> 00:19:42,770 And I haven't really heard of any initiatives outside of North America to address this. 220 00:19:42,770 --> 00:19:47,350 There are starting to be, you know, some initiatives to implement this in Canada. 221 00:19:47,530 --> 00:19:53,310 But, you know, maybe this is something that if your country has a solution for this, definitely reach out. 222 00:19:53,310 --> 00:19:56,430 I'd love to hear about what you're doing for enforcement there. 223 00:19:56,430 --> 00:20:07,690 But, you know, there's other things that we have to think about, like what about ported numbers, you know, the international side, like I mentioned, and also like text messages, there's other communication channels that don't have the same type of authentication. 224 00:20:10,330 --> 00:20:18,750 So the FCC's number one complaint right now is robocalls, but the government is obviously a little distracted with other global pandemics right now. 225 00:20:18,790 --> 00:20:26,270 But, you know, I think in terms of that department, this is something that they have a priority and a motivation to fix. 226 00:20:26,270 --> 00:20:36,010 And so, like I said, the timeline for enforcement here is that towards the end of 2020 or into 2021, we'll start to see more people start to implement this. 227 00:20:36,010 --> 00:20:43,350 And you might start to see calls coming through already on your phone that might have a checkmark or might have an indication that they're being signed. 228 00:20:44,150 --> 00:20:49,350 So what can you do in terms of implementing Shake and Stir for your business? 229 00:20:49,350 --> 00:20:52,850 Talk to your service provider, whoever is doing your telephony. 230 00:20:52,910 --> 00:20:57,050 Most businesses probably won't have to do much in terms of implementation. 231 00:20:57,050 --> 00:21:00,030 A lot of the onus is going to be on the service providers themselves. 232 00:21:00,030 --> 00:21:06,670 You might have to go through some additional verifications and like KYC know your customer type stuff with your service provider. 233 00:21:06,770 --> 00:21:16,450 So at Twilio, we'll need you to create a business profile that has some additional details about your account before we would give you and start signing your calls with the highest attestation. 234 00:21:18,890 --> 00:21:23,890 And then there's some precautions that you can take as just application security professionals. 235 00:21:23,890 --> 00:21:27,570 So you can protect your numbers from web scraping bots. 236 00:21:27,570 --> 00:21:30,310 Don't assign sequential numbers to your employees. 237 00:21:30,310 --> 00:21:37,110 That's a way that people can kind of guess which employees might have lines at your company. 238 00:21:37,110 --> 00:21:40,330 And then you can use actual authentication in your call centers. 239 00:21:40,330 --> 00:21:44,490 This is another way that you can protect your business from phishing. 240 00:21:44,710 --> 00:21:54,490 This is something that I could talk about for many, many hours that a lot of companies basically will only ask for a consumer, you know, date of birth and email in order to verify the customer. 241 00:21:54,570 --> 00:21:59,270 And so there's a lot of other things you can do to actually authenticate people on either end of the call. 242 00:21:59,270 --> 00:22:06,730 And then if you know what a PBX is and you have one, you might look into installing the FCC blacklist database on that. 243 00:22:07,070 --> 00:22:10,090 Some controversy around whether or not you want to do that. 244 00:22:10,090 --> 00:22:13,050 It's hard to get off the blacklist database if you're on there. 245 00:22:13,310 --> 00:22:16,590 But this is something that you may or may not have to worry about. 246 00:22:17,350 --> 00:22:19,750 And then there is some ongoing legislation. 247 00:22:19,950 --> 00:22:22,830 But things have been pretty quiet from the FCC this year. 248 00:22:22,830 --> 00:22:31,270 They did recently, somewhat recently, like in the last year, give telcos the authority to block unwanted calls without explicit subscriber permission. 249 00:22:31,270 --> 00:22:40,950 And so, you know, AT&T, Verizon, T-Mobile in the U.S., they can now decide, hey, we're going to send this to basically like a spam folder without ever notifying you that the call came in. 250 00:22:40,950 --> 00:22:43,870 And I don't need you, Kelly, to tell me that that's okay. 251 00:22:44,510 --> 00:22:50,290 And then, like I mentioned, in terms of timeline for the TRACE Act, the enforcement will start to begin at the end of 2020. 252 00:22:50,870 --> 00:22:55,270 The last update from the FCC on this was March 31st. 253 00:22:55,270 --> 00:23:05,310 And this reaffirmed their call to implement shake it and stir, but it did already grant an exception for and an extension for small voice service providers. 254 00:23:05,350 --> 00:23:06,970 And I don't know what that means. 255 00:23:06,970 --> 00:23:16,590 I don't know exactly how they're going to decide who is a small voice service provider, but they are already thinking about, you know, this was three months after the bill was signed into law. 256 00:23:16,830 --> 00:23:20,250 They're already saying, hey, maybe this timeline isn't reasonable. 257 00:23:20,250 --> 00:23:37,870 So while I do think that a lot of larger telecom providers will start to sign calls within the end of this year, I do think that there is going to be an exception for that long tail of service providers and not everything is going to be a signed call before, 258 00:23:37,870 --> 00:23:39,930 you know, the end of 2021. 259 00:23:40,850 --> 00:23:45,410 There are a couple of things you can do as a consumer to protect yourself today. 260 00:23:45,910 --> 00:23:49,370 You can install one of these apps, depending on how much you trust them. 261 00:23:49,370 --> 00:23:52,850 A lot of times you have to give them basically complete control over your phone. 262 00:23:52,850 --> 00:23:54,790 So your mileage may vary there. 263 00:23:54,790 --> 00:24:05,590 But things like Novo Robo, Robo Killer call app, you know, companies like AT&T have a partnership with a company called Haya that does, you know, some protection against spam calls. 264 00:24:05,590 --> 00:24:11,290 Of course, a lot of consumer telecoms are starting to upsell spam detection services. 265 00:24:11,290 --> 00:24:16,450 So Verizon offers their call filter plus for the low, low price of $3 a month. 266 00:24:16,450 --> 00:24:22,890 But you know, these are things that you can look into installing on your phone if this is something that is a huge annoyance to you right now. 267 00:24:23,810 --> 00:24:27,710 So like I said, unfortunately, I don't think this is going to solve all problems right away. 268 00:24:27,710 --> 00:24:42,790 But I think people are really optimistic that shaken and stir will help restore trust and telephony, because not only is it going to help, you know, mitigate spam calls that are coming into your phone, but for those wanted calls for, you know, the calls that you want to see, 269 00:24:42,790 --> 00:24:48,910 that might be from unknown numbers, there's going to be a renewed trust in some of those phone calls. 270 00:24:48,910 --> 00:24:54,530 And so there is that motivation from businesses to restore that type of trust so that people will answer the calls. 271 00:24:55,590 --> 00:25:00,470 Hopefully, this is a good overview in terms of what you can expect from shaken and stir. 272 00:25:00,470 --> 00:25:02,590 If you have any questions, you can find me on Twitter. 273 00:25:02,590 --> 00:25:03,830 I'm also on discord. 274 00:25:03,990 --> 00:25:07,470 Once again, my name is Kelly Robinson, and thank you for listening.