Big US Telcos Ignored STIR/SHAKEN Deadline; No Punishment Yet

When is a deadline not a deadline? When it is the date set by the Federal Communication Commission (FCC) for the implementation of STIR/SHAKEN, the hugely expensive anti-spoofing technology that the US is trying to force on the rest of the world in the vague hope that universal adoption might lead to a slight fall in the number of nuisance robocalls received by US consumers. The FCC deadline had already been repeatedly pushed back because of technical problems but Bandwidth and Vonage, two of the biggest telcos in the USA, both failed to meet the requirement to implement STIR/SHAKEN across the whole of their IP networks by 30 June 2021. Incredibly, the FCC allowed seven months to pass before making this public, and are only now referring the matter to their enforcement division to decide if either telco should be punished.

A press release quoted FCC Chairwoman Jessica Rosenworcel as saying:

We will not turn a blind eye to providers that have not done enough to protect consumers from spoofed robocalls. The FCC is keeping close watch as phone companies implement STIR/SHAKEN… we will hold companies accountable if they fail to meet their commitments…

I struggle to see how anybody keeping a ‘close eye’ on regulatory compliance can let seven months pass before noticing that a basic deadline was missed. In fact, the failure by Vonage and Bandwidth to comply with the STIR/SHAKEN rules was only reported to the FCC through verification statements filed in October 2021, three months after the implementation deadline. This is explained in the detail of an FCC order dated 17 February 2022.

The Wireline Competition Bureau directed voice service providers to file implementation verification certifications by October 4, 2021… After reviewing the filed verification statements, we find that Bandwidth and Vonage did not achieve full implementation of the STIR/SHAKEN authentication framework by the June 30, 2021, deadline…

Bandwidth was still not in full compliance with the STIR/SHAKEN requirements three months after the deadline had passed.

Bandwidth, by its own admission, “has not yet completed all necessary network upgrades to support [STIR/SHAKEN] throughout its entire [IP] network”. It explains that, as of October 21, 2021, it “still operate[s] some legacy IP equipment that supports a de minim[i]s amount of traffic that cannot support the STIR/SHAKEN standards at this time.”

Vonage was only able to check half of the relevant calls received from other telcos by the implementation deadline. Their filing…

…explains that only “50% of inbound SIP calls [are] being validated as of today”

Bandwidth generated revenues of approximately USD500mn in 2021 and has put plenty of resources into glossy promotional materials describing their ability to deliver STIR/SHAKEN on behalf of their enterprise customers. The following transcript is taken from one of their adverts.

So if you’re not sure if you need to deploy STIR/SHAKEN in your network or you want to prevent bad traffic from reaching your network in the first place, Bandwidth can help. Every day we’re working to keep villains and bad actors out of the ecosystem, while helping to make sure your valid traffic gets through. To find out more, contact your Account Manager.

Bandwidth were so keen to turn STIR/SHAKEN into a money-making opportunity that 54 of their employees registered for a 2020 series of SIP Forum webinars about the subject, far more than any other business. This information was made available because the SIP Forum’s woeful disregard of privacy meant the email address of everyone who registered for these webinars was visible to every other registrant.

Bandwidth’s website sings the praises of STIR/SHAKEN, claiming they “deployed STIR/SHAKEN throughout the vast majority of our network in December 2019, well ahead of the June 2021 deadline”. They also say:

Bandwidth is actively engaged in efforts to implement the most robust call authentication framework possible, whilst also working diligently to stop the transmission of illegal robocalling on our network holistically. We continue to lead industry efforts and best practices…

Vonage revenues tend to range around USD1bn to USD1.2bn. A webpage for Vonage’s residential customers published on 15 June 2021 explained the STIR/SHAKEN obligations for originating and terminating providers, though Vonage failed to implement those protections for many of the calls received by its users. Vonage is currently in the process of being acquired by Ericsson for USD6.2bn, though the deal has received a lukewarm response from Ericsson shareholders.

The news surrounding the US rollout of STIR/SHAKEN just keeps getting worse and worse and worse. It beggars belief that a branch of the US government is trying to burden telcos in other countries with this hugely expensive but fundamentally flawed technological solution whilst being lackadaisical about enforcing its use within US borders.

Eric Priezkalns
Eric Priezkalns
Eric is the Editor of Commsrisk. Look here for more about the history of Commsrisk and the role played by Eric.

Eric is also the Chief Executive of the Risk & Assurance Group (RAG), a global association of professionals working in risk management and business assurance for communications providers.

Previously Eric was Director of Risk Management for Qatar Telecom and he has worked with Cable & Wireless, T‑Mobile, Sky, Worldcom and other telcos. He was lead author of Revenue Assurance: Expert Opinions for Communications Providers, published by CRC Press. He is a qualified chartered accountant, with degrees in information systems, and in mathematics and philosophy.