Consumer Reports had filed comments in the Federal Communications Commission’s rule making to ensure that voice providers are taking appropriate steps to ensure that scam and spam callers are not able to access their networks, and to close loopholes that have allowed unwanted callers to plague Americans. Consumer Reports strongly supports the FCC’s efforts to strengthen the Know Your Upstream Provider (KYUP) requirements and believes the agency should close loopholes in the STIR/SHAKEN framework.
Our comments cover several aspects of the KYUP program. We agree with the agency’s shift from focusing on preventing high volumes of illegal traffic to preventing illegal phone calls. We also call for the FCC to make the KYUP rules requirements as opposed to a set of best practices that have been proven to let millions of scam calls through the existing framework. We agree with the information collection requirements and compliance requirements the FCC has proposed, including requiring a check on the upstream provider’s traceback history.
We also believe the STIR/SHAKEN framework needs buttressing as well. The agency’s plan to give the Governance Authority more power and rules while also building trust in the attestations associated with calls is essential. The FCC should require that the Governance Authority include all of the KYUP information collection, compliance, and verification rules proposed by this order. When the Governance Authority cannot access that information or believes that the upstream provider will not comply with the STIR/SHAKEN rules then it should deny issuing a Service Provider Code (SPC) token. And any provider unable to comply with the KYUP requirements should never become a Certificate Authority capable of issuing tokens.
The FCC also asked two important questions about Certificate Authorities; should they issue certificates that expire within a set period of time and if self-certification should be allowed. On the first, CR would like certificates to expire within two weeks. On the question of a voice provider acting as both a Certificate Authority and the recipient of a certificate from its own CA, Consumer Reports does not believe it should be allowed. There is an inherent conflict of interest, and the stakes are too high if a CA acts with impropriety issuing a certificate to a bad actor.
Consumer Reports is grateful that the FCC recognized that the work it did in 2020 was not sufficient to stop the scourge of scam calls. We support the agency’s efforts to improve the STIR/SHAKEN framework, propose more stringent requirements on voice providers to know their upstream providers, and require those providers to act as a cop on the beat ensuring the quality of the traffic that goes through their networks.