Search

Compliance and Enforcement and Telecom Decision CRTC 2021-123

PDF version

Reference: Telecom Notice of Consultation 2019-404

Ottawa, 6 April 2021

Public record: 1011-NOC2019-0404

STIR/SHAKEN implementation for Internet Protocol-based voice calls

The Commission directs telecommunications service providers (TSPs) to implement STIR/SHAKEN to authenticate and verify caller identification (ID) information for Internet Protocol (IP)-based voice calls as a condition of offering and providing telecommunications services, effective 30 November 2021. In addition, the Commission directs TSPs to file STIR/SHAKEN implementation readiness assessment reports by 31 August 2021 and to add certain details to those reports.

Background

  1. In Compliance and Enforcement and Telecom Notice of Consultation 2019-404 (the Notice), the Commission issued a call for comments on its proposal to require Canadian carriers and other telecommunications service providers that provide voice telecommunications services in Canada (collectively, TSPs) to implement STIR/SHAKENFootnote 1 to authenticate and verify caller identification (ID) information for Internet Protocol (IP)-based voice calls as a condition of offering and providing telecommunications services pursuant to sections 24 and 24.1 of the Telecommunications Act (the Act), effective 30 September 2020.
  2. The Commission had previously determined in Compliance and Enforcement and Telecom Decision 2018-32 that TSPs should implement measures to authenticate and verify caller ID information for IP-based voice calls. The deadline, which the Commission has extended twice, is now 30 June 2021, as set out in Compliance and Enforcement and Telecom Decision 2019-402-2.
  3. In Compliance and Enforcement and Telecom Decision 2019-403, the Commission approved the Canadian telecommunications industry’s proposal to establish the Canadian Secure Token Governance Authority (CSTGA) as the Governance Authority as part of the deployment of STIR/SHAKEN. The CSTGA is tasked, among other things, with the selection of the Policy Administrator (PA) and Certificate Authority (CA), which are necessary for the implementation of STIR/SHAKEN.
  4. The Commission received interventions in response to the Notice from Mr. Marc Nanni; Bell Canada; Bragg Communications Incorporated, carrying on business as Eastlink (Eastlink); the Canadian Communication Systems Alliance (CCSA); Competitive Network Operators of Canada (CNOC); the Canadian Voice Peering Project; Cogeco Communications inc. (Cogeco); the Independent Telecommunications Providers Association (ITPA); the Internet Society Canada Chapter (ISCC); Quebecor Media Inc., on behalf of Videotron Ltd. (Videotron); Rogers Communications Canada Inc. (RCCI); Saskatchewan Telecommunications (SaskTel); Shaw Communications Inc. (Shaw); TELUS Communications Inc. (TCI); and Xplornet Communications Inc.Footnote 2

Issues

  1. The Commission has identified the following issues to be addressed in this decision:
    • Should the implementation of STIR/SHAKEN be imposed on TSPs as a condition of offering and providing telecommunications services?
    • If the implementation of STIR/SHAKEN is imposed on TSPs as a condition of offering and providing telecommunications services, when should the requirement to implement STIR/SHAKEN become effective?
    • Other matters

Should the implementation of STIR/SHAKEN be imposed as a condition of offering and providing telecommunications services?

Positions of parties

  1. Bell Canada, CNOC, Cogeco, RCCI, SaskTel, Shaw, TCI, and Videotron, did not object to mandating that TSPs implement STIR/SHAKEN as a condition of offering and providing telecommunications services (hereafter, condition of service).
  2. Bell Canada added that the condition of service should apply symmetrically to all TSPs, with the exception of TSPs that do not issue their own telephone numbers, which should be exempt. Bell Canada submitted, however, that there should be a process for TSPs to petition the CSTGA or another relevant authority to request an exemption from the condition of service for reasons and criteria determined by relevant authorities and/or the Commission. Conversely, Cogeco, RCCI, and Shaw argued that STIR/SHAKEN must be deployed by all TSPs in Canada, no matter their size. In RCCI’s view, widespread adoption is critical, and if some carriers are not required to implement STIR/SHAKEN, it will greatly erode the benefits sought.
  3. Although they agreed that STIR/SHAKEN will have value in addressing caller ID spoofing, the CCSA and the ITPA disagreed with the idea of making STIR/SHAKEN implementation a condition of service. The ITPA expressed concern that STIR/SHAKEN implementation would be overly burdensome for smaller TSPs as a result of (i) the number of resources required and the cost of implementation, especially considering that there will be no corresponding retail revenue streams; (ii) the lack of control that smaller TSPs have over hardware and software availability; and (iii) the requirements for establishing IP interconnections with bigger TSPs. Given that its members are still mostly connected through time-division multiplexing interconnection with bigger TSPs, the ITPA pointed out that only a very small portion of ITPA members’ voice traffic would be able to carry STIR/SHAKEN authentication.
  4. Therefore, the ITPA concluded that expending scarce capital resources on a service that will, at present, apply only to extremely low traffic volumes and few interconnecting circuits would be a heavy-handed approach. The ITPA added that given the potentially severe consequences, such an approach would not be a proportionate regulatory measure and would violate subparagraph 1(a)(ii) of the 2006 Policy Direction,Footnote 3 which states that the Commission should, when relying on regulation, use measures that are efficient and proportionate to their purpose and that interfere with the operation of competitive market forces to the minimum extent necessary to meet the policy objectives. The CCSA and Eastlink raised similar concerns, and the CCSA specifically supported the ITPA’s position. The ITPA submitted, in the alternative, that if the Commission decides to reiterate its expectation that the industry should implement STIR/SHAKEN, then the Commission should only require that small TSPs do so when the majority of their traffic is IP-based and routed over IP interconnecting trunks.
  5. Shaw submitted that the Commission should adopt a phased approach by, for example, first placing a requirement on TSPs to integrate with and test against the PA. Then, in a subsequent decision, the Commission could require TSPs to activate STIR/SHAKEN on their Session Initiated Protocol (SIP) links with other TSPs. Similarly, SaskTel submitted that the Commission should supervise the development and implementation of STIR/SHAKEN by issuing various decisions rather than imposing a general requirement by condition of service. SaskTel argued that this will allow the Commission to render decisions on specific issues as they arise. The ITPA supported SaskTel’s position.

Commission’s analysis and determinations

  1. The intervener TSPs, even those that rejected the proposal described in paragraph 1, supported the implementation of STIR/SHAKEN per se. The concerns raised are related to the mechanism for requiring TSPs to implement STIR/SHAKEN and the scope and extent of such a requirement.
  2. Regarding whether an obligation to implement STIR/SHAKEN should apply to the same extent to all TSPs, for STIR/SHAKEN to work effectively and achieve its purpose, it must be implemented across all IP-based networks. Excluding some TSPs from the obligation to implement STIR/SHAKEN, or delaying their obligation to implement it, would undermine the effectiveness of the system. Further, delaying the implementation of STIR/SHAKEN until a TSP’s entire network is IP-based, or until the networks of all TSPs are IP-based, could have the unacceptable result of precluding Canadians from having the tools to verify the authenticity of calls for years, if not decades. Implementing the framework on whatever IP portions of the network exist at least provides some level of protection with respect to calls that travel over those portions of a TSP’s network. Furthermore, the Commission notes that the burden on a TSP is not necessarily related to the size of a TSP. The resources required to purchase and install the software and equipment in order to implement STIR/SHAKEN will, in large part, depend on the extent to which a TSP’s network is IP-based.
  3. The Commission therefore concludes that the burden imposed on all TSPs, and in particular smaller TSPs, of upgrading the IP portion of their networks to enable them to implement STIR/SHAKEN is outweighed by the important and ever more urgent objective of ensuring an effective authentication and verification caller ID system in order to reduce the harm caused by nuisance calls.
  4. In light of the above, the Commission determines that all TSPs must be able to authenticate and verify caller ID information using the STIR/SHAKEN framework for IP-based calls in order to provide the necessary protection to called parties. Further, the Commission determines that it is appropriate to invoke its powers pursuant to sections 24 and 24.1 of the Act as the mechanism for imposing the requirement on TSPs to implement STIR/SHAKEN as a condition of offering and providing telecommunications services.

If the implementation of STIR/SHAKEN is imposed as a condition of offering and providing telecommunications services, when should the requirement to implement STIR/SHAKEN become effective?

Positions of parties

  1. Bell Canada, CCSA, CNOC, Cogeco, Eastlink, RCCI, SaskTel, Shaw, TCI, and Videotron objected to the 30 September 2020 implementation date, which the Commission has since extended, on the basis that this date was not achievable. These interveners argued that the condition of service should not take effect until the STIR/SHAKEN framework is developed, implemented, and operationalized in TSPs’ networks. Further, they submitted that STIR/SHAKEN is an extremely complex project that requires an extensive core network build and individual TSP-to-TSP testing. They also submitted that the STIR/SHAKEN technical and operational framework is still being developed, and that a number of issues must still be resolved, including the development of interface standards with the CSTGA, PA, and CA; handset display standards; and attestation rules. Without handsets that can display the authentication, STIR/SHAKEN cannot fulfill its purpose. RCCI and SaskTel suggested that the Commission use the CRTC Interconnection Steering Committee (CISC) in the development of technical or procedural solutions. Videotron submitted that a national campaign would be required to educate telecommunications service end-users about the authentication system and how it works.
  2. Bell Canada also proposed, if no other arrangement is made, a coming into force date of 1 July 2022 for STIR/SHAKEN, arguing that the condition of service should not come into force until the following conditions are met:
    • TSPs have received, lab and field tested, and operationalized the software upgrades necessary to enable IP switching and routing equipment to transmit STIR/SHAKEN tokens.
    • Stakeholders have had a reasonable amount of time to attempt to negotiate and agree upon common and universally applicable Canadian attestation best practices and token display rules.
    • The Commission-approved governance ecosystem (i.e. the CSTGA, the PA, and the CA) has been fully put in place and is operational and issuing certificates. TSPs have then had at least three months to fully integrate their networks, with CAs facilitating the seamless issuance of tokens from CAs to certified TSPs.
  3. CNOC and the ISCC suggested that the Commission should refrain at this point in time from imposing a firm date for the deployment of STIR/SHAKEN. Eastlink proposed a staged implementation, beginning with only the largest telephone companies in the country. As stated above, the ITPA adopted a similar position, indicating that smaller TSPs should only be required to implement STIR/SHAKEN when the majority of their traffic is IP-based and interconnected with bigger TSPs through IP-based interconnections.

Commission’s analysis and determinations

  1. Since the close of this proceeding, many of the issues raised by the interveners have either been resolved, or significant progress toward resolving them has been made. In addition to the Commission’s latest approval of a nine-month extension of the implementation deadline to 30 June 2021, key developments include the following:
    • The establishment of the CSTGA and selection of the CA, and the resulting functioning of the CSTGA since 30 September 2020.
    • The testing of equipment and software by some TSPs.
    • The use by some TSPs of STIR/SHAKEN to authenticate calls within their IP voice networks.
    • Progress in negotiations regarding the development of standards and best practices, and the imminent filing of an interim report from the CISC Network Working Group.
    • Increased availability of vendor equipment, software, and compatible phones.
  2. However, some technical and policy issues have yet to be resolved, which will likely preclude a complete deployment of the STIR/SHAKEN framework by 30 June 2021.
  3. Further, pursuant to Compliance and Enforcement and Telecom Decisions 2019-402 and 2019-402-1, TSPs are required to submit a report providing a short overview of STIR/SHAKEN implementation (referred to hereafter as the implementation readiness assessment report), within two months of the implementation date. Given the approved extension of the implementation date to 30 June 2021, this report is now due by 31 August 2021.
  4. The Commission considers that TSPs should have a reasonable amount of time following the filing of the implementation readiness assessment report before the requirement imposed under sections 24 and 24.1 of the Act becomes effective, to allow for the resolution of technical and policy-related issues, including those that may be identified in the report, and to finalize the integration of STIR/SHAKEN capability. To that end, the Commission considers that a 90-day period following the deadline for submitting the implementation readiness assessment report would be appropriate. 
  5. In light of all of the above, pursuant to sections 24 and 24.1 of the Act, the Commission directs that, as a condition of offering and providing telecommunications services, TSPs must implement STIR/SHAKEN in order to authenticate and validate IP-based voice calls, effective 30 November 2021.
  6. In addition, the Commission directs TSPs to submit an implementation readiness assessment report, including the information set out in Appendix 1 of this decision, by 31 August 2021. The Commission also directs TSPs to provide to the Commission, every six months, starting 31 May 2022 and continuing until the Commission decides otherwise, a status report containing the information set out in Appendix 2 to this decision.

Other matters

Clarification regarding the condition of service

Positions of parties

  1. The ITPA submitted that a condition of service should apply on a carrier-by-carrier basis and only for those aspects of a carrier’s operations that are solely under the control of that carrier. Further, a condition of service should only apply to IP-based voice calls. The ITPA thus proposed to define “IP-based voice call” as a call that is SIP-based from the end-point of origination (i.e. the handset) all the way to the end-point of termination (i.e. the handset), including any networks used to transit between origination and termination.
  2. Bell Canada also submitted that the condition of service should be clarified to specify that STIR/SHAKEN applies only to (i) IP voice calls that are SIP-based end-to-end, and (ii) voice calls made to devices, or other customer equipment, that are able to receive and transmit STIR/SHAKEN attributes, as defined and approved by applicable authorities.
Commission’s analysis and determinations
  1. The Commission’s determinations to date have clearly provided that the obligation on TSPs to implement STIR/SHAKEN applies only to IP-based voice calls. That is to say, it applies to calls that travel over a TSP’s IP-based network, including any portion of its network that is able to initiate, transit, or terminate IP-based calls. The Commission did not limit this obligation to IP-based end-to-end calls made to handsets or other devices that are able to receive and transmit STIR/SHAKEN attributes.
  2. The specific authentication and verification information that TSPs must transmit under various circumstances is still being clarified as the STIR/SHAKEN guidelines continue to be developed. Once these guidelines are finalized, the Commission can provide further guidance as required.

Access to the STIR/SHAKEN framework to authenticate calls

Positions of parties

  1. Cogeco and the ISCC submitted that, should the CSTGA allow only TSPs that have numbering resources to obtain a certificate, other types of TSPs, such as resellers, would be at a commercial disadvantage given that the underlying service provider will have to provide a low level of attestation to calls originating from non-participant TSPs.

Commission’s analysis and determinations

  1. The Commission notes that since the filing of these comments the CSTGA has published the eligibility conditions on its website. These conditions establish that a TSP must have access to numbering resources in order to receive a certificate, with the result that some of the TSPs that are required to implement STIR/SHAKEN cannot have access to certificates.
  2. In response to the establishment of these conditions, a Part 1 application was filed on 21 December 2020 requesting that the Commission instruct the CSTGA to allow all TSPs to be able to implement STIR/SHAKEN by receiving certificates directly from the CA. Accordingly, the Commission will address the issue of access by TSPs to certificates in the context of its determinations in the aforementioned application.

Policy Directions

  1. The 2006 Policy Direction and the 2019 Policy DirectionFootnote 4 (collectively the Policy Directions) state that the Commission, in exercising its powers and performing its duties under the Act, shall implement the policy objectives set out in section 7 of the Act in accordance with the considerations set out therein, and should specify how its decisions can, as applicable, promote competition, affordability, consumer interests, and innovation.
  2. The Commission’s decision to require TSPs to authenticate and verify IP-based voice calls using the STIR/SHAKEN framework serves to protect Canadians from the harms of nuisance calls and advances the policy objectives set out in paragraphs 7(a), (b), (f), (g), (h), and (i) of the Act. The implementation of STIR/SHAKEN will be an efficient and effective means to providing consumers with a tool to identify the level of trustworthiness of a call. This tool will empower consumers to take the appropriate actions in responding to incoming calls. Furthermore, the measures imposed in this decision are symmetrical and competitively neutral given that they apply equally to all TSPs.
  3. Accordingly, the Commission considers that its decision is consistent with the Policy Directions.

Secretary General

Related documents

Appendix 1 to Compliance and Enforcement and Telecom Decision 2021-123

TSPs must submit an implementation readiness assessment report to the Commission no later than 31 August 2021, describing the state of implementation of STIR/SHAKEN as of 30 June 2021.

The implementation readiness assessment report must include the following information:

Appendix 2 to Compliance and Enforcement and Telecom Decision 2021-123

TSPs must also provide to the Commission, every six months, starting 31 May 2022 and continuing until the Commission decides otherwise, a status report on their continuing efforts to deploy STIR/SHAKEN. These reports are due to the Commission on the last days of May and November, covering the period from the first day of September to the last day of February (for the May report) and from the first day of March to the last day of August (for the November report). 

Those status reports must provide details on any changes in network capability in relation to the information that was provided in the implementation readiness assessment report and described in Appendix 1.

Date modified: