Not everybody gets what they deserve. We work in an industry where thousands of dollars are spent on awards for businesses that chase millions and billions of dollars in revenue. A single person may seem inconsequential when framed within this landscape, but each of us can strive to make a better world. My work introduces me to people who impress, amaze and humble me with the contributions they make to our community, and to society more generally. I regret that my meager resources mean I cannot give them the rewards that their efforts merit, but I can thank them. These were my unsung heroes of 2023.
For Dedication to a Cause: Tom Walker
It is not too cynical to observe that people who are paid to tackle fraud are mostly tackling fraud because they receive payment for doing so. This may encourage some to concentrate more on pleasing their paymasters than protecting the rest of us from crime, although we all use phones and have all been put at risk by a barrage of increasingly ingenious and despicable scams. Tom Walker spent two decades fighting fraud on behalf of T-Mobile US and AT&T, so when he left the employ of the latter this year it would have been natural for him to concentrate on monetizing his experience by obtaining some lucrative consulting gigs. Instead of chasing contracts, he ploughed his time into creating a new nonprofit organization dedicated to serving the interests of the everyday victims of fraud. Tom has been leveraging his black book of industry contacts to obtain meetings with influential people in political and business circles whilst assembling a team of expert volunteers who will join him in pursuing justice. His efforts would not be needed in a perfect world. In this world, the victims of fraud need Tom and his team of supporters more than ever before.
For Just Doing It: Bea Hindebars
At first glance, it is unlikely you would see much in common between Tom Walker and my next unsung hero. Tom resides on the West coast of the USA; Bea lives in Northern England. Tom is known to industry insiders because of his years of work in fraud investigation and mitigation. Bea’s contribution to fraud prevention is most likely to be acknowledged by the outsiders who refer to themselves as ‘scambaiters’. When she started telling me about all the times she reported phone numbers used by fraudsters I thought she was exaggerating. Then she started sharing some of her long, long lists of examples, whilst also expressing her frustration with telcos that did not act upon them. Bea is a person who has incorporated the work involved in identifying and reporting fraudulent misuse of communications services into her daily routine. She comes at this challenge from a different direction to those of us who work for comms providers, giving her a fresh perspective on which businesses are doing a good job of inhibiting crime and which are neglecting their responsibilities. And she does it all without expecting recompense or praise. That means the industry is not helping itself if it treats Bea like any other member of the public just casually reporting the odd fraud that they encounter. She has attained semi-pro status as a fraud fighter. Our industry needs to explore ways of working with independent researchers like Bea just like security and software engineering teams have leveraged the contribution of outsiders through vulnerability disclosure policies and bug bounties. In the meantime, I applaud Bea for seeing the need for more active prevention of fraud and just deciding to do something about it.
For Giving a Gift That Will Keep Giving: Sarah Delphey
The biggest mistake that the US Federal Communications Commission (FCC) made when deciding how to reduce unwanted robocalls was to concentrate on technological ways of discriminating between good and bad traffic without first demanding that comms providers implement rigorous know your customer (KYC) checks. If bad calls are associated with the bad actors who created them then the goal is to eject those bad actors from the ecosystem after the bad calls have been identified. But if you only look at calls without really knowing anything about the people who placed them then the bad actors remain free to keep coming back, endlessly seeking new opportunities to spam and scam ordinary people. The FCC may have dodged the task of setting standards for KYC because any standard they would have proposed would likely prompt a lot of argument, especially from businesses who want weak KYC because they profit from bad traffic. To my mind, that is exactly why such standards are needed. The next problem is that writing a standard for KYC is not an opportunity for a private sector business to generate revenue. Procedural standards do not gain traction if there are barriers to adopting them. This contrasts with technological solutions, which will always be pushed hard by the businesses which sell them.
So with neither the regulator nor the private sector motivated to set a standard for KYC, who would take responsibility for writing one? The answer is Sarah Delphey, formerly Director of Abuse and Risk Operations at Bandwidth and currently Vice President of Trust Solutions at Numeracle. Sarah stepped up and delivered the first KYC model standards for US comms providers, with support from her colleagues at Numeracle. This work has been given away for free, without any strings attached. Because of that, I expect it will succeed in exercising growing influence over the ways that businesses behave although few will subsequently remember who deserves the credit. Sometimes making the world better involves a thankless task. That is why we should thank Sarah for giving both the comms industry and its customers a gift that will keep benefitting them for many years to come.
For Protecting Consumers the Right Way: ACMA, Anatel and ComReg
National comms regulators get a lot of criticism in the articles I write for Commsrisk. At the same time, I must acknowledge the impossible demands that are sometimes placed upon them. Various countries have suffered an epidemic in unwanted calls and messages. That inevitably leads to a great deal of unhappiness amongst the general population. But just tasking regulators to stop bad traffic is no easy matter. Their historical role has been to prevent anti-competitive behavior by ensuring comms always reached their intended destination. And when regulators need help with identifying who are the bad actors within the comms ecosystem they are likely to be confronted by businesses that point fingers at each other without showing much evidence to substantiate their claims, or which choose to say nothing because that is the safest legal option given historic accusations of obstructing competition. That is why I have been greatly impressed by the way some regulators have tackled the problem of spam and scam comms.
Three national regulators stand out for their pragmatism. They have devised effective strategies whilst transparently explaining their decisions to the public without succumbing to the temptation to overpromise. The Australian Communications and Media Authority (ACMA) has been the most proactive regulator whilst always focused on cost-effective common sense techniques that yield positive improvements immediately. They have been rewarded by a dramatic drop in complaints from Australians. Brazil’s Agência Nacional de Telecomunicações (Anatel) was faced with an especially severe problem with unwanted telemarketing calls that originated within the country, but they resisted the risk-averse urge to copy techniques marketed to them. They have instead shepherded the key players and helped them to reach consensus on how to meet the country’s specific needs whilst motivating businesses to voluntarily find and adopt solutions that actually work. Ireland’s Commission for Communications Regulation (ComReg) performed a survey of anti-scam methods used by other countries that was hugely impressive because of how comprehensive it was. This became a menu where they selected all the techniques that suited Ireland’s needs whilst also giving them the freedom to explain why they rejected methods that would have been less effective. ComReg’s consequent plan of action is a template that all national regulators should review before they decide how to protect consumers.
For Doing the Dirty Work Needed to Shut Down Scam Compounds: The United Wa State Army
I do not have a lot of sympathy for the politics of the United Wa State Party, the single-party rulers of Myanmar’s Wa province since 1989. The motives for the battles fought in the neighboring province of Shan by their military, the United Wa State Army, may not be entirely noble. But they have resulted in the closure of scam call centers that congregated in Shan because their existence was welcomed by rival dictators. The proliferation of scam compounds in border regions of Myanmar has encouraged unprecedented levels of abduction, trafficking and modern-day enslavement of ‘workers’ who speak foreign languages and which risk punishment or even torture if they refuse to scam on behalf of the gangsters that hold them captive. Volker Türk, the UN High Commissioner for Human Rights, explains:
People who are coerced into working in these scamming operations endure inhumane treatment while being forced to carry out crimes. They are victims. They are not criminals.
The victories of the United Wa State Army have resulted in the release of more than a thousand of these victims from scam compounds during 2023. In that respect, it can be argued the army has done more this year to alleviate human suffering caused by organized scam gangs than has been accomplished using billions of dollars of advanced data-oriented tech implemented in rich countries. But liberating a thousand people forced to work as scammers is still a modest achievement if measured against the daunting scale of the problem. Chinese authorities state that 31,000 people engaged in telecoms fraud have been liberated from scam compounds in Myanmar since a crackdown began in September. Sometimes solutions need to be forceful to get results on a timely basis. Given a choice between those who use violence against the victims forced to work in scam centers, and the people who use violence to close those scam centers down, it is clear who is delivering a positive change.
For Finding Solutions on a Shoestring: James Greenley
You are most likely to have heard the name of James Greenley at the end of each episode of The Communications Show, when I acknowledge his role in producing the program. That is an accurate description of his part in an outstanding team effort, but still understates the scale of what James routinely delivers. He has found ways to pipe our livestream to entirely new channels like Twitter and Rumble, he has devised a means to convert audio recordings of every show into written transcripts, he has downloaded entire regulatory databases for automated analysis of their contents, and he has developed a completely new website for Commsrisk, which will be unveiled in January. All of this has been accomplished for less than the average telco spends on procuring Microsoft Office software for a single employee. James’ ingenuity and application has helped to lift the efforts of the rest of the team to a level that would otherwise be unattainable. And he does it all with minimal fuss. If I had one hundred James Greenleys working for me then I could take over the world. Bad actors had better hope I never discover a way to clone James.
