On February 1, Ofcom, the UK’s communications regulator, rejected STIR/SHAKEN as a method to reduce scam calls because it is “complex, costly and time-consuming to implement” and they believe “alternative measures may have the potential to reduce number spoofing effectively and more quickly”. However, even this news is not enough to stop the stream of disinformation about the UK’s intentions with respect to STIR/SHAKEN. More mendacity about STIR/SHAKEN has originated from a European contacts solutions provider called Enreach for Service Providers. To make matters worse, they gave the impression that the UK is planning to adopt STIR/SHAKEN in articles published almost two weeks after Ofcom announced a negative outcome for their consultation about STIR/SHAKEN. These latest attempts to mislead are especially egregious because the extent of the disinformation varies depending on which language was used.
Here is what Justin Hamilton-Martin, Enreach’s Director of Product Strategy, had to say in a ‘perspective’ (a.k.a. an advert) that was published on February 12 by Global Security Mag, a French-language publication, and in a verbatim identical article also published on the same day in a second French-language publication, Solutions Numérique; my translation into English is given below.
STIR/SHAKEN a déjà été adoptée aux États-Unis, au Canada et depuis juillet 2023 en France et les discussions autour de cette solution technologique s’intensifient dans d’autres pays. Par exemple, fin 2021, au Royaume-Uni, l’Ofcom et l’ICO ont annoncé un plan pour lutter contre les appels intempestifs et leur communication publique mentionne spécifiquement STIR/SHAKEN.
Les efforts précédents au Royaume-Uni n’ont pas suffi
Une authentification plus stricte de l’identification de l’appelant est essentielle…
STIR/SHAKEN has already been adopted in the United States, Canada and since July 2023 in France, and discussions around this technological solution are intensifying in other countries. For example, in late 2021, in the UK, Ofcom and the ICO announced a plan to tackle nuisance calls and their public communication specifically mentions STIR/SHAKEN.
Previous efforts in the UK were not enough
Stricter caller ID authentication is essential…
Compare Hamilton-Martin’s choice of words in French with what he wrote in English for an article that otherwise covers the same ground. The following quote is taken from an opinion (a.k.a. an advert) published on February 13 by ComputerWeekly.com.
…there is now an industry-standard technology-based solution designed to deal with spoof robocalls: STIR/SHAKEN.
This is potentially good news for telecom providers and the increasing number of channel firms offering IP-based telephony. Already adopted in Canada and the USA, and in France since 2023, conversations are also beginning to take place in other countries. In the UK, the ICO has previously referred to STIR/SHAKEN in relation to addressing nuisance calls.
There have been previous attempts to limit robocalls…
Did you notice the part where Hamilton-Martin stated British efforts to reduce scam calls were ‘not enough’ when writing for a publication that targets a French-speaking audience? Bold letters were used to make this insulting claim, which was omitted from the publication that targets an English-speaking audience. Observe also how the French version of the article includes a very specific assertion about a plan issued jointly by Ofcom and the Information Commissioner’s Office (ICO) in 2021, but the English version only mentions ICO, and only says they ‘previously referred to STIR/SHAKEN’. So what game is being played here?
Some readers will have correctly guessed that Hamilton-Martin is a Brit. His knowledge of what has happened in Britain allowed him to selectively dredge up some old and obscure facts whilst choosing not to present some much more recent and important facts to foreign audiences who are less likely to check his claims. From 2013 to 2021, ICO and Ofcom jointly published annual updates to what they called an ‘action plan’ for nuisance calls. This stretched the meaning of the word ‘plan’ to its limit when describing a document that included many vapid what-ifs and maybes, but listed hardly any demonstrable action. Draw your own conclusions about the value of the joint ICO-Ofcom action plan given that they stopped updating it after 2021 and have not produced another version since.
In the 2021 update, Ofcom wrote something about STIR/SHAKEN they should not have written. We can safely infer it was written by Ofcom because nobody in ICO has the competence to form an opinion on the rate of transition of networks to the SIP signaling that is a technical prerequisite for STIR/SHAKEN. Few will know or care about the reasons why Ofcom failed to perform their duties as they should, but I noticed. It was the essential clue that Ofcom intended to rig the subsequent consultation that would decide whether to impose STIR/SHAKEN on UK telcos. That consultation eventually began in 2023, and it culminated with the decision to reject STIR/SHAKEN that was announced a few weeks ago. The clear evidence of bias within Ofcom years before they compared the cost of STIR/SHAKEN to superior methods of protecting the public helps to explain the scale and significance of the rebellion by UK telcos who forced Ofcom to reverse their position. What Ofcom wrote in the joint action plan in 2021 was as follows:
In the USA, where more calls are carried over VoIP networks, the Federal Communications Commission (FCC) has mandated that phone companies introduce caller authentication by 30 June 2021, using a particular technical standard called STIR/SHAKEN. The implementation of CLI authentication in the UK using this approach will take more time as it is only effective when voice services are migrated to IP, which is due to be completed in the UK by the mid-2020s. [emphasis added]
Note the use of the word ‘will’, which implies a decision about STIR/SHAKEN had already been made, two years before Ofcom had the courage to run the necessary public consultation. I would not be surprised if carelessness like this, in a document that hardly anyone was reading anyway, is the root explanation for why Ofcom and ICO stopped publishing updates for how they would tackle nuisance calls.
No regulator in the UK is permitted to make a decision of the type hinted at by Ofcom in 2021 without first holding a consultation. This is because all of the UK’s regulators are legally obliged to show that the public benefits of their decision will outweigh the costs to the businesses that bear them. The 2021 action plan sees Ofcom making the mistake of writing as if the decision had already been made, even though they were too afraid to instigate a consultation about STIR/SHAKEN at that time. Ofcom would not have been worried about making the benefits to consumers appear larger than the cost of STIR/SHAKEN to telcos. Their concern would have been that arguing for STIR/SHAKEN is difficult to do whilst admitting that alternatives to STIR/SHAKEN can deliver at least the same scam prevention benefits at an earlier date and for far less cost.
Delaying the consultation for two years allowed Ofcom to hope that the US and Canadian implementations of STIR/SHAKEN would deliver stunning successes in the meantime, bolstering the case for its implementation in the UK. That hope was rather spoiled by the US and Canadian implementations of STIR/SHAKEN proving to be abject failures, delivering no demonstrable benefit to consumers. To make matters worse, even the most ardent American boosters of STIR/SHAKEN can offer no better vindication of the results delivered so far than to demand more money be spent on follow-on activities.
The Freudian slip made by Ofcom in their joint document with ICO means Hamilton-Martin was not lying when he stated, in French, that there was an ICO-Ofcom plan involving STIR/SHAKEN. But he omitted the news that the plan was made defunct by a decision announced two weeks ago. So his only example of a supposedly ‘intensifying’ international discussion about whether to adopt STIR/SHAKEN is a poorly-judged aside from an obscure and discontinued instance of British bureaucracy dating back to 2021, which has since been made irrelevant by an actual decision made by the UK comms regulator after they had to listen to a chorus of complaints about STIR/SHAKEN from British telcos.
At first I mistakenly thought debates about STIR/SHAKEN were genuinely about how to protect ordinary people from scam calls. I have since come to realize why the loudest propagandists for STIR/SHAKEN are supported by businesses whose revenues depend on telesales and other kinds of enterprise traffic that consumers loathe almost as much. Just as SIP signaling is a pre-condition for STIR/SHAKEN, it is also the case that STIR/SHAKEN is a pre-condition for the implementation of new services that would enhance the profits of companies that manage communications for the enterprise sector. They are deceitfully attempting to use public pressure to force regulators to spread these costs around consumer-oriented telcos by pretending STIR/SHAKEN is the only way, or the inevitable way to protect ordinary phone users. There are superior methods when the only goal is to protect ordinary phone users from harmful calls. But a selfish segment of the telecoms industry wants to ride roughshod over the public’s best interest because other methods of protecting consumers confer none of the advantages that STIR/SHAKEN gives to enterprises and the companies that serve them.
I greatly admire the approach being taken in Brazil, where the leading telesales companies have been transparent about their desire to eliminate bad practices amongst their peers, and are voluntarily contributing to the cost of implementing a version of STIR/SHAKEN because of that explicit objective. That is why I welcomed the opportunity to interview representatives of the Brazilian comms regulator, Anatel, about the anti-spam collaboration they had encouraged. Brazil stands as a counterexample to a cancerous tendency to lobby comms regulators to manipulate markets by artificially transferring costs from one business to another. Even the goal of consumer protection has been perverted to these ends in the USA, with the support of multinationals who want to gain an advantage in using phones to make sales worldwide. It is a shame there is so much deceit about STIR/SHAKEN disseminated around other countries, and now by deliberately manipulating the presentation of the facts depending on which country is being spoken to.
