As a proud Texan, I love indulging stereotypes about Texans when I meet clients in Europe and Africa. I wear long leather boots and a cowboy hat, though big hats aren’t the easiest thing to pack in a suitcase. Most people know some of the stereotypes about Texans, but not many appreciate that Texan attitudes to friendship are expressed in the name of the state. The Caddo Nation who inhabited this land before the arrival of European settlers have a word — taysha — which means friend or ally. They greeted the Spanish who arrived in their land as friends, with the result that the Spaniards referred to them as tejas. That’s where the name of Texas comes from. So the name of our state reflects a desire for friendship that crosses cultural and national boundaries. Students of Texas history will appreciate people don’t always live in peace with each other, given Mexico’s war for independence from Spain, the Texan war for independence from Mexico, and the forced resettlement of the Caddo people by Anglo-American colonists. But past failures don’t mean we stop trying to do better. That’s what I have been trying to do, working with clients in foreign countries on call verification and tracing calls back to criminals. We begin as allies in the fight against crime. Doing it the right way has allowed me to make friends worldwide, including Eric Priezkalns, the founder of Commsrisk. But when I saw Eric’s mammoth report for Europol on spoofing and traceback, I was shocked. Eric wrote a lot of words about all the methods of tracing international communications that have been proposed and tried in different countries. But you only really need to know the meaning of three words to know the quickest solution to international traceback: SHAKEN, not STIR.
Y’all have probably heard of STIR/SHAKEN. That is why I am writing this article, my first for Commsrisk. If there is any website which has discussed the advantages and disadvantages of STIR/SHAKEN more thoroughly then I’ve not seen it. So I know you’re likely to be familiar with the details of how STIR/SHAKEN works in the USA and the reasons the US Congress is going to pass a new law that will create a task force to encourage other countries to adopt STIR/SHAKEN. The logic is straightforward: global implementation of STIR/SHAKEN would make it easier for American law enforcement agencies to trace international calls to their origin. I can’t argue against the essential idea. My own business provides STIR/SHAKEN. The fact is that STIR/SHAKEN makes tracing so easy that you can’t really call it tracing any more. If you know with absolute certainty that the caller ID of an incoming call is genuine then you can go straight to the phone company which serves the customer using that number and ask them to provide the name and address of their customer. This would obviously speed up police work if American cops could trace calls to foreign scammers. However, Eric’s report points out one big flaw with relying upon STIR/SHAKEN to trace calls. There are many networks which can’t support the STIR part of STIR/SHAKEN. That’s why my business, 1Route, has been working on ways to do the SHAKEN part without STIR. It means the caller ID is authenticated — and hence traceable — even if networks can’t support STIR.
The thing that really shocked me in Eric’s report to Europol was that the reasons why STIR/SHAKEN won’t work in Europe are already known but we still have people talking about STIR/SHAKEN being the solution for tracing international calls from the USA to Europe and then to other parts of the world. To be exact, we will be able to use STIR/SHAKEN to trace calls in future, so long as we’re prepared to wait until the middle of the next decade. As Eric points out on page 85 of the Europol report:
Predictions for how soon countries will transition to exclusively using IP networks have tended to be overly optimistic… Germany and Switzerland are unlikely to complete their transitions to all-IP networks before 2035.
STIR relies on SIP. SIP only works on internet protocol (IP) networks. So we know there will still be European countries making calls which can’t be traced using STIR/SHAKEN for at least the next 9 years. That’s a long time to wait if we’re serious about tackling the crimes that occur today. I used to work in banking before I moved into the telecoms arena, so it seems to me that excluding Germany and Switzerland from an international framework for tracing calls is especially problematic. Germany is Europe’s largest economy. Switzerland is one of the world’s great banking centers. The idea that we can make significant progress towards tackling international crime while excluding these countries seems pretty silly. And that comes before the realization that nobody can force foreign countries to upgrade to all-IP networks. Heck, we’ll have to wait until the end of 2028 before the USA ends its own mandates that force American telcos to maintain non-IP networks. So we know there will be plenty of crime committed over non-IP networks for many years yet.
Like I said, I’m in favor of STIR/SHAKEN. We run a STIR/SHAKEN certification authority (CA) in the USA. But you can’t just walk into other countries and demand they change their ways without expecting resistance. That’s not a friendly approach. That’s not the right way to make allies in the fight against international crime. I expect countries will use STIR when all their networks are ready, but they won’t be rushed into doing it any sooner than they already plan to. The cool part about the latest internet technology is that there is no need to upgrade phone networks to IP just to trace a voice call using SHAKEN. 1Route has run trials in collaboration with a German firm, Oculeus, which shows the SHAKEN signature for a call can be transmitted separately. Instead of routing the data through SIP headers carried along the same route as the call, the data is sent through a separate internet route. The telcos at either end just use a straightforward API to exchange the data with each other. It works. It is simple. We have demonstrated its use with international calls in practice. As an approved certification authority, we have shown how a telco in a different country could make a call that terminates in the USA that has a SHAKEN signature which matches US expectations. This would solve the problem of how to trace international calls, without requiring any networks to be overhauled first. The technology exists today. We only need telcos in multiple countries to cooperate in using it.
Texas is the Lone Star state and Texans sometimes joke about regaining their independence from the USA. Most of us don’t take that too seriously because we know we are better off if we remain good friends with our neighbors. But it can be difficult to remain friends with somebody who does not treat you with respect. The USA hasn’t had the friendliest relations with some other countries recently. There are very good reasons why American lawmakers would like to trace scam calls that terminate in the USA to where they originated overseas. But I don’t think they will get very far by trying to dictate how those calls will be traced. At 1Route, we are making SHAKEN-not-STIR a service that can be provided to any telco, anywhere. We already know some telcos which want a more efficient way to attach SHAKEN signatures to the traffic they send to the USA. Regulators and police forces in other countries might want to consider SHAKEN-not-STIR as the way they will cooperate on international traceback with their neighbors. It’s one of the options that Eric examines in his Europol report, though he notes that the obstacle to its adoption has more to do with the ways governments and businesses reach agreement than how the technology works. We can demonstrate that the technology works today. How different countries reach agreement on the process for tracing international calls is a different matter.
How did you like my first article for Commsrisk? Perhaps I’ll return with some videos showing call verification in practice, if that interests you. And maybe I will then make some jokes about the famous British spy, James Bond, and his preference for vodka martinis that are shaken, not stirred. That’s not the kind of drink you see many Texans order, but the secret to being a good friend and ally is to respect our differences. Whatever protocols are adopted for international traceback, 1Route is ready to support them all.
