United StatesCaller ID Authentication Rules (STIR/SHAKEN)
In force since .
A telephone contact rule binding private bodies.
- Enforcement body
- Federal Communications Commission
- Obligation class
- Security, Reporting
As of .
What it requires
- This subpart reaches your organization only if it is a provider of voice service, a service interconnected with the public switched telephone network that furnishes voice communications to an end user using North American Numbering Plan resources, or an intermediate provider that carries or processes that traffic; declare the telecom services role only if you are one, and read this instrument by hand if you offer outbound calling to others.
- Obtain an SPC token from the Secure Telephone Identity Policy Administrator, use it to obtain a Secure Telephone Identity certificate from a Secure Telephone Identity Certificate Authority, and use that certificate to authenticate caller identification information for all SIP calls you originate and will exchange with another provider and to verify it for the SIP calls you terminate that arrive authenticated, unless an extension or exemption in the subpart applies to you.
- If you are an intermediate provider, pass unaltered to the next provider in the call path any authenticated caller identification information you receive, removing it only where necessary for technical reasons to complete the call or where you reasonably believe it presents an imminent threat to your network security.
- If you are a gateway provider, authenticate caller identification information for every call you receive that uses North American Numbering Plan resources that pertain to the United States in the caller ID field and has not been authenticated, unless an applicable extension covers you.
- Implement an appropriate robocall mitigation program with reasonable steps to avoid originating illegal robocall traffic and a commitment to respond within 24 hours to all traceback requests from the Commission, law enforcement and the industry traceback consortium, and file an officer-signed certification of it in the Robocall Mitigation Database, updating the filing within 10 business days of any change.
- Do not add a line item charge to a consumer or small business customer's bill for the call authentication technology the subpart requires.
These lines are LexLint's reading of the law's text, as of .
What this law does
Subpart HH of 47 CFR part 64 required a voice service provider, not later than , to fully implement the STIR/SHAKEN authentication framework in its internet Protocol networks, subject to the extensions and exemptions the subpart gives. The provider must authenticate caller identification information for all SIP calls it originates and will exchange with another provider.
It must verify caller identification information for the SIP calls it receives from another provider and will terminate, when that information has been authenticated. Each intermediate provider must also fully implement the STIR/SHAKEN authentication framework in its internet Protocol networks.
A gateway provider must authenticate caller identification information for the calls it receives that use North American Numbering Plan resources that pertain to the United States in the caller ID field and have not been authenticated. Each voice service provider must implement an appropriate robocall mitigation program that includes a commitment to respond within 24 hours to all traceback requests from the Commission, law enforcement, and the industry traceback consortium.
A voice service provider must certify in the Robocall Mitigation Database that all of the calls it originates are subject to a robocall mitigation program. Providers of voice service are prohibited from adding any additional line item charges to consumer or small business customer subscribers for the call authentication technology.
Voice service is any service that is interconnected with the public switched telephone network and furnishes voice communications to an end user using resources from the North American Numbering Plan.
When LexLint raises it
When your app profile says your app provides telecom services.