White Paper: Source Mitigation Of Illegal Robocalls
8 May 2019
We need solutions to the illegal robocall problem that will scale commensurate with the scourge. The plague affects hundreds of millions of telephone subscribers in the United States. But the bulk of the calls originate, on any given day, from just a few hundred sources. This paper explains how the robocaller places his calls and the various avenues for stopping him.
The diagram below shows, generally, the path taken by MOST illegal robocalls.
The robocaller, whether located in the United States or outside the country, buys “call termination” service from a US-based provider. This service, typically using VoIP (Voice-Over-Internet-Protocol) allows the robocaller to initiate his calls and send his digital audio signals to the provider via the internet.
The diagram shows these at Levels 3 and 4. Arrangements may be “wholesale” or “retail” and the distinction is imprecise. Buyers of wholesale service often pay lower prices in exchange for higher volumes and are expected to resell the service to others. But the services are often indistinguishable.
The Level 3 or 4 provider that accepts the calls from the robocaller is designated the Originating Provider. That provider typically buys (via a wholesale arrangement) terminating service from yet another provider, and ultimately the calls are sent to a national transit provider (Level 2) who passes the calls to the providers directly serving the called consumers. These final providers, at Level 1, are Terminating Providers.
Generally, as we move down each level, the aggregate volumes increase and the per-minute prices go down. Each provider earns a small margin on the traffic.
The best place to stop the illegal traffic is where it first enters the network. This is where it is most concentrated and its source can be identified. As the illegal calls move through the network they disperse and are comingled with other calls, making detection more difficult. Further, if a call is erroneously rejected at the point of entry, the caller is instantly made aware of that and can resolve the issue with their provider. If a call is blocked later, the cause of the block is not readily apparent to the caller and becomes more difficult to resolve.
With present technology, when a call arrives at the terminating (Level 1) provider, there is nothing identifying the Originating Provider. Over the next several years, that will change as a protocol enhancement called STIR/SHAKEN is phased in. In the meantime, a semi-automated process called Traceback allows the telecom industry to identify the source of an illegal robocall by searching call records starting with the Level 1 provider and going up-level until the Originating Provider is reached.
By tracing back selected call examples from illegal robocall campaigns, the Originating Provider(s) can be identified and notified and can take steps to stop the calls. Traceback (unlike STIR/SHAKEN) learns the entire call path, so if the Originating Provider fails to act, the next provider downstream can be engaged to intervene.
ECONOMICS OF ROBOCALLING
The Originating Service Provider might charge a robocaller US $0.005 (half-a-cent) per minute, counted from the time the call is answered (by a human or voice-mail) to the time one end or the other hangs up.
There is typically no charge for unanswered calls. Billing is in six-second increments, so an answered call that disconnects after 3 seconds costs $0.0005.
Suppose a robocaller makes 500,000 calls a day. 10,000 go unanswered. Most people answer and quickly hang up (average 18 seconds); 10,000 press 1 and average three minutes; 100 last fifteen minutes. All those calls cost about $10,800 per month (5 days/week).
If the three- and fifteen-minute calls involve talking to a human call-center agent, that will account for his biggest expense. He’ll need 10,500 hours of agent time (65 agents), which could cost $31,500 overseas or $105,000 in the USA.
Suppose his agents can extract $500 of value from 25% of the people they talk to for fifteen minutes (one out of every 20,000 people called). Each month, he’ll scam 500 people; take in $250K; clear a profit of roughly $130K to $200K; and annoy 9,999,500 people with illegal calls they didn’t want.
Rejection by the Originating Provider: When an Originating Provider learns that their platform is being used as a conduit for illegal robocalls, they identify the offending customer from the call examples, and examine all the traffic from that customer. That will inform a strategy for engaging with the customer to eliminate the illegal calls. The provider may also impose network-level constraints, which can include: throttling the rate at which the customer can initiate calls, restricting the number of concurrent calls; and limiting the caller-ID value(s) available for the customer’s use. (These same constraints can and should be applied to all new customers as well.) The provider may decide that discontinuance of service is appropriate, especially if violations are on-going. New and existing overseas customers warrant additional scrutiny. Identities of on-going offenders are published; other providers may elect to do extra appropriate screening of their calls.
Intervention by the Next Level Provider: If the Originating Provider fails to mitigate the illegal calls, downstream providers (which are receiving the calls from the Originating Provider) will be wary of continuing to accept that provider’s traffic. A downstream provider will notify an offending Originating Provider of terms-of-service and/or acceptable-use-policy violations (which generally prohibit the sending of illegal calls, and often have even more rigorous restrictions). If the traffic continues, the downstream provider will act according to the terms of its contract with the Originating Provider, which can include network constraints like those mentioned above, as well as financial penalties and, in cases where the violations are on-going, termination of service. Worth noting: increasingly, providers at Levels 1, 2 and 3 are revising their contracts to insist that their upstream partners cooperate in the fight against illegal robocalls, and are prioritizing those revisions to those behaving most problematically. Publication of those provider names gives downstream providers the opportunity to do additional monitorings.
Government Enforcement Against the Robocaller: Both the Federal Communications Commission and the Federal Trade Commission can bring civil enforcement actions against a party placing illegal calls, sometimes leading to additional criminal court review and action. Since the statues generally specify monetary forfeitures calculated on a per-call basis, penalties assessed on a single caller can (and have) grown to more than $100 million. In addition to the FCC and the FTC, some State regulators and all Attorneys General also have enforcement authority. Call records obtained from the Originating Provider buttress these actions.
WHAT MAKES A CALL ILLEGAL?
Under various statutes and regulations certain types of calls are illegal. While some of the rules are subject to interpretation, the focus here is on calls that are blatantly violating one or more rules (primarily 47 CFR § 64.1200).
Here are some objective attributes that make calls illegal without express permission from the recipient:
- Calls to mobile telephones using a pre-recorded or artificial voice.
- Pre-recorded or artificial voice calls that do not include the identification of the calling party at the beginning of the announcement.
- Pre-recorded or artificial voice calls that do not include in the announcement the telephone number or address of the caller.
- Calls with incorrect calling line identification (when the calling number is not assigned to a party affiliated with the caller, as in the case of “neighbor spoofing”).
- Sales calls to numbers on the Do-Not-Call list.
- Telemarketing calls that do not include an automated do-not-call option.
- Telemarketing messages left in voice-mail that do not include a toll-free call-back number that connects directly to an automated opt-out mechanism.
- Calls impersonating government officials.
Note that when call examples include the audio content of a call (such as would be left in voice-mail) the violations will be obvious.
Private Recovery from the Robocaller: Certain types of violations also carry a right of private action, allowing private citizens to seek per-call monetary damages. Some filed suits have been class actions covering large numbers of calls.
Enforcement Against Originating Provider: While enforcers typically target the robocaller (end-user) initiating the illegal calls, the Originating Provider also faces legal exposure. Providers designated as Carriers enjoy certain protections from the actions of their customers, but also bear additional responsibilities with associated consequences. Under 47 U.S.C. § 201(b), the FCC can penalize Carriers whose practices it determines to be unjust or unreasonable. Failure to take mitigating steps to stop illegal calls fits that definition, and the scope of the violation grows as a function of the call volume and grows further once the Carrier has been explicitly notified that they are a conduit for specific illegal traffic. And Providers NOT designated as Carriers can find themselves treated as end-users. In addition to the FCC, State Attorneys General have various authorities; many Providers have state-specific registrations and licenses at risk. In addition to telecommunications-specific statutes, Attorneys General may also pursue other types of violations including wire fraud and conspiracy.
Much effort has been placed on blocking or labeling calls as they are delivered to the recipient. Those solutions typically require that the subscriber enable and/or configure the service, and some require decision-making by the subscriber on a call-by-call basis. Most of these terminating-end solutions are technology-dependent and not available to all subscribers; some carry a fee.
Rejecting illegal calls at the source benefits ALL potential call recipients. It requires engagement and diligence on the part of all US service providers – a tall order, but a much more manageable universe (thousands, with far fewer than that actually facilitating illegal calls) compared to all telephone subscribers (hundreds of millions, virtually all of whom are illegal robocall recipients to varying degrees).