In November, the FCC adopted an Eighth Report and Order in its series on Caller ID Authentication. The new rules aim to bring some clarity and direction to the slippery subject of third-party STIR/SHAKEN signing, in an effort to crack down on the number of robocalls getting B-level attestations and to aid the Industry Traceback Group and others in their investigations into unwanted and illegal call activity. The good news is that these arrangements are now officially endorsed, but with some important caveats. Read on for details.
Who is considered the first party?
When it comes to authentication, the Commission places the STIR/SHAKEN implementation obligation on the first service provider involved in the transmission of a call through the PSTN that has sufficient control over the network infrastructure necessary to implement STIR/SHAKEN. They establish three categories for such entities:
- Providers that originate calls
- Providers that relay calls from domestic sources
- Providers that relay calls from international sources.
As far as our discussion here, these are the first parties. Significantly, they would typically include wholesale providers that originate calls on behalf of resellers, as it is the wholesaler with control over the necessary network infrastructure.
What is third-party authentication?
The Commission leans on the North American Numbering Council’s 2021 Small Providers Report for its categorization of third-party authentication solutions. It defines three such categories:
- Hosted SHAKEN, where authentication takes place in a third-party cloud, over HTTP or SIP
- Carrier SHAKEN, where authentication takes place at a downstream peer
- SHAKEN Software, where authentication takes place within the originating provider’s network, using commercially licensed third-party software.
As such, the third party may be a partner, another provider, or a vendor.
What are the new rules?
All three third-party solutions are now officially approved, provided the first party:
- Makes all attestation level decisions
- Uses its own STIR/SHAKEN certificate in the signing process
- Keeps written records of all third-party authentication agreements until at least two years after those agreements have terminated (though these records do not need to be submitted to the FCC unless requested).
The current deadline for implementing any required changes is June 20, 2025.
How can we help?
If you are using either the Hosted SHAKEN (e.g. ClearIP or Call Guardian Authentication Hub) or SHAKEN Software (e.g. Metaswitch QCall) solutions for your STIR/SHAKEN signing, it is likely that you already comply with all the new rules, but you should check. In particular, make sure that you have sufficiently detailed records of the arrangement, and that you aren’t inadvertently bypassing it for some of your outbound traffic. If you aren’t sure, or you do need to make changes, we’d be happy to advise you.
If you are using the Carrier SHAKEN solution, it is likely that you do not comply with the new rules. Refer to any records you have and check. If in doubt, we recommend that you discuss the issue with the provider(s) signing your calls, asking them for details on how attestation levels are determined and which certificate they use to sign, and then make sure you keep records. You should also check that you aren’t inadvertently bypassing these arrangements for some of your outbound traffic. If you aren’t sure, or you do need to make changes, we’re here to help. We can advise on network changes, or even assist you in migrating over to a Hosted SHAKEN solution, whichever makes the most sense for you.
Let us know if you have any questions!
