The Australian Government to Require SMS/MMS Sender ID Registraion (opens in new tab)

I used to work at two (UK) telcos. There's a historic reason and a modern reason.

The historic reason was, just like the Internet, the international phone network was built on gentlemen agreements by engineers who largely trusted each other.

A big national telco is unlikely to attack its peers, so there was little need for safety measures. As smaller telcos came in to the mix via deregulation, that understanding changed - but it was hard to retroactively fit controls.

The more modern reason is outsourced call centres. You want outbound calls from your Philippines based staff to show as if they were calling from a local number. When large and reputable entities were doing this it was fine. Just like showing a different reply-to address on an email.

If you were designing a modern network, it wouldn't be like this. But international telephony is over a hundred years old and has a huge amount of legacy technology and legal agreements.

That's why in 2020 the FCC belatedly mandated SHAKEN/STIR to authenticate Caller ID in the US using public-key cryptography. Deployment is still work in progress, and it does not cover SMS/MMS, however.

A bigger problem is Russia or Saudi Arabia using the SS7 signalling network to track their dissidents in the US because those legacy telco protocols have basically no authentication whatsoever, and won't blink if a Saudi Telco sends Verizon a MAP message saying "what is the cell location of Jamal Khashoggi's phone?"

> I've yet to read a good explanation of why the telcos permit CLID faking and reinjection of apparently local CLID by overseas inputs.

Actually, there are several legitimate use cases:

• Call divert: Local number calls a number abroad and that one is diverted back a another local number. It's probably rare, but it's a totally legit use case.

• 2G/3G roaming: I'm not an expert on this one, but as far as I understood it, roaming calls placed on 2G/3G networks are initiated in the visiting country, and use the local number of the caller.

• Getting better rates using VoIP. Whether this is legit or not might be subject to discussion, however I was using a foreign VoIP provider (because they had better rates for local calls than any local providers, for my low call volume) sending out my own local number (had to be validated by them by callback, although that's their own security measure, not the network's one). Now in several EU countries and Switzerland this doesn't work any more, as calls bearing national IDs coming from abroad must be displayed as anonymous. And it's quite annoying that there isn't a way to "authentify" those numbers so the owner can use them as they wish.

> I've yet to read a good explanation of why the telcos permit ...

They (the telcos) are paid for every message they deliver. So absent regulation forcing them to do otherwise, it is in their best interest (additional profit) to pass through every message with no filtering of any form.

And, if the regulators had any technical knowledge at all, they would recognize that the billing system is the key to stopping the robo texts. Every text can be traced back to its origin through the billing system (because that's how the telco's collect their fees, so of course they know who to collect from for which messages they forwarded). So the regulators just need to force open the billing systems and trace the money back to the illicit senders, and then they know who to cut off (or to fine out of existence).

Telco networks are sprawling and accurately defining the boundary might be harder than it sounds.

Traditionally they have a bias towards "working"/delivering traffic. It's easier to issue a refund than answer a urgent support request.

I can also imagine the biggest customers have all sorts of multi-vendor failover plans that may be affected.

> Even just flagging it would help.

That's what's mandated by ARCEP (the French regulator) since the beginning of this year, and now all faked numbers are marked as “hidden caller”, and indeed it helps a lot.

Cost. Cost to spam and scam tends to 0 at industrial scale. Meanwhile amount of time and resources telco want to spend on fighting it is Bounded by how much regulators are going to allow them to pass on to customers.

I rely on the ability to set the outbound caller ID but I would happily register it if required.

The 'Ask Reason for Calling' iPhone feature has completely eliminated scam calls for me. Real callers not in contacts leave a short message and I pick it up. Best iOS feature from the last few years IMO.

Have you added yourself to the Do Not Call register?

https://www.donotcall.gov.au

I don’t think this will cut down on spam so much as fraud. All spam calls I get don’t have registered IDs

Alpha codes don't allow replies. As such if you need to reply it has to be from a number

No it costs the same, the reason they do it is that it’s slightly more difficult to spoof a real number sender ID because most gateways will verify ownership by sending you a text on that number before letting you send outbound from it, where as they have no way of doing the same for an alphanumeric sender ID

That will likely change after this goes into effect, otherwise all that legitimate spam will never make it.

And as we can see from Australia, this doesn’t need a blockchain.

As an Australian who moved to India a couple of years ago: I’ve found India’s Do Not Call Register significantly less effective than Australia’s, because telco, ISP, TRAI and other government offices keep on sending spam, a lot of it stuff that will train people to be phished, and if you report them as DND violations, they declare them service-related. And for telco/ISP, they commingle with actual service-related and important transactional messages, so you can’t just block the shortcodes.

In Australia, I don’t remember ever really getting spam SMSes. Emails from the bank, yes, but that’s easier to filter if desired. When you get the same old spam messages time after time, you can filter them in email, but text message apps are often not up to that sort of thing.

The really stupid thing is that more than half of the spam is about blocking spam. At least once a month, AD-TRAIND-G sends:

> స్పామర్లపై చర్య కోసం స్పామ్ను రిపోర్ట్ చెయ్యండి. అయితే, ఫోన్ కాలింగ్ యాప్లో స్పామర్ను బ్లాక్ చేయడం వల్ల స్పామర్పై చర్య తీసుకోబడదు. స్పామ్ను TRAI DND యాప్ లేదా సర్వీస్ ప్రొవైడర్ యాప్ లేదా 1909 లో రిపోర్ట్ చెయ్యండి. TRAI DND యాప్లో రిపోర్ట్ చేయడం సులభం మరియు వేగవంతం, ఈరోజే ఇన్స్టాల్ చేసుకోండి.

And AD-AIRDOT-S just sends a random message from a pool of half a dozen or so, mostly English but one or two Telugu, sometimes every few days, sometimes every few weeks. Such as:

> Alert: On receiving unwanted SMS , please complain by calling 1909 or send SMS to 1909 in format 'SMS Content, Sender No, dd/mm/yy' or visit bit.ly/2qBK0vp to report through Airtel Thanks App.

(Huh, that link is now broken. Used to work. Makes it even more dumb.)

I should automate reporting all of this stuff, deliberately to waste their time, and maybe, just maybe, make someone think, “maybe we should stop sending this stuff”.

There was also RCS… I turned that off after a bit, because it was being used purely for spam and undesirable stuff, and you couldn’t complain in the same channels. RCS is dead like this.

The Australian one will label them as Unverified.

Personally, I'd prefer them to be blocked. If it's important and legitimate, they'll register.

It's not. Together with ongoing global tightening of regulations for permissible caller IDs on phone calls, it's all about fighting fraud. (I work in the telecom industry and am in the middle of all the waves this is causing for legitimate business cases.)

They do, but that's irrelevant to this. Most normal people also don't want phone calls to be completely anonymous or spoofed, and the phone network has never been meant to be anonymous.