As a proud Texan, I love indulging stereotypes about Texans when I meet clients in Europe and Africa. I wear long leather boots and a cowboy hat, though big hats aren’t the easiest thing to pack in a suitcase. Most people know some of the stereotypes about Texans, but not many appreciate that Texan attitudes to friendship are expressed in the name of the state. The Caddo Nation who inhabited this land before the arrival of European settlers have a word — taysha — which means friend or ally. They greeted the Spanish who arrived in their land as friends, with the result that the Spaniards referred to them as tejas. That’s where the name of Texas comes from. So the name of our state reflects a desire for friendship that crosses cultural and national boundaries. Students of Texas history will appreciate people don’t always live in peace with each other, given Mexico’s war for independence from Spain, the Texan war for independence from Mexico, and the forced resettlement of the Caddo people by Anglo-American colonists. But past failures don’t mean we stop trying to do better. That’s what I have been trying to do, working with clients in foreign countries on call verification and tracing calls back to criminals. We begin as allies in the fight against crime. Doing it the right way has allowed me to make friends worldwide, including Eric Priezkalns, the founder of Commsrisk. But when I saw Eric’s mammoth report for Europol on spoofing and traceback, I was shocked. Eric wrote a lot of words about all the methods of tracing international communications that have been proposed and tried in different countries. But you only really need to know the meaning of three words to know the quickest solution to international traceback: SHAKEN, not STIR.
Y’all have probably heard of STIR/SHAKEN. That is why I am writing this article, my first for Commsrisk. If there is any website which has discussed the advantages and disadvantages of STIR/SHAKEN more thoroughly then I’ve not seen it. So I know you’re likely to be familiar with the details of how STIR/SHAKEN works in the USA and the reasons the US Congress is going to pass a new law that will create a task force to encourage other countries to adopt STIR/SHAKEN. The logic is straightforward: global implementation of STIR/SHAKEN would make it easier for American law enforcement agencies to trace international calls to their origin. I can’t argue against the essential idea. My own business provides STIR/SHAKEN. The fact is that STIR/SHAKEN makes tracing so easy that you can’t really call it tracing any more. If you know with absolute certainty that the caller ID of an incoming call is genuine then you can go straight to the phone company which serves the customer using that number and ask them to provide the name and address of their customer. This would obviously speed up police work if American cops could trace calls to foreign scammers. However, Eric’s report points out one big flaw with relying upon STIR/SHAKEN to trace calls. There are many networks which can’t support the STIR part of STIR/SHAKEN. That’s why my business, 1Route, has been working on ways to do the SHAKEN part without STIR. It means the caller ID is authenticated — and hence traceable — even if networks can’t support STIR.
The thing that really shocked me in Eric’s report to Europol was that the reasons why STIR/SHAKEN won’t work in Europe are already known but we still have people talking about STIR/SHAKEN being the solution for tracing international calls from the USA to Europe and then to other parts of the world. To be exact, we will be able to use STIR/SHAKEN to trace calls in future, so long as we’re prepared to wait until the middle of the next decade. As Eric points out on page 85 of the Europol report:
