Technology and Legislative Solutions to Maintain Cell Phone Privacy - PowerPoint PPT Presentation

The Robocall Epidemic: Leveraging Technology and Legislative Solutions to Maintain Cell Phone Privacy October 15, 2019 Privacy and Security Forum Divya Gupta Dorsey & Whitney LLP Jeremy Gladstone Capital One 1

Agenda ▪ The “Robocall” Epidemic ▪ How Did We Get Here? ▪ What’s the Big Deal? ▪ Let’s Talk FCC Solutions ▪ Call authentication and call blocking ▪ Reassigned numbers database ▪ Enforcement actions ▪ What about Congress? ▪ TRACED Act ▪ Stopping Bad Robocalls Act 2

The Basics: TCPA and “Robocalls” ▪ The Telephone Consumer Protection Act ▪ Enacted in 1991 to protect Americans’ privacy ▪ Congressional response to telemarketers interrupting family dinners by calling home phones ▪ Dialing technology was immature, and mobile phones were novelties ▪ The TCPA prohibits, among other things, unconsented calls to mobile phones made with an Automated Telephone Dialing System (ATDS) ▪ What is an ATDS? ▪ Whose consent is it, anyway? ▪ What constitutes reasonable revocation? ▪ Statutory penalties: $500-$1500/call or text ▪ The amount of litigation and judgment size has steadily increased ▪ Litigation often targets otherwise lawful actors ▪ What is a “robocall”? ▪ No enacted statute, including the TCPA, defines a “robocall” ▪ Generally used to describe legal and unlawful calls 3

The Public Agrees “Robocalls” Are a Problem ▪ U.S. consumers received nearly 5 billion “robocalls” per month (2,000/second) ▪ Technological advances have made automated dialing cheap and easy ▪ Calling networks have transitioned from analog to internet-based ▪ Caller ID and call spoofing have evolved with changing technology ▪ “Robocalls” are the top complaint to the Federal Communications Commission ▪ Stopping unlawful calls is the FCC’s top customer protection priority ▪ Over 200,000 complaints each year — around 60% of all FCC complaints ▪ Consumers report that they don’t answer unknown phone numbers Last Week Tonight: John Oliver Focused on Robocalling “The vast majority vary from the irritating to the outright illegal and you might be surprised by how many major companies are involved in this. A list of top robocallers includes Capital One, Comcast, and Wells Fargo.” https://youtu.be/FO0iG_P0P6M

The FCC Has Adopted a Multi-Pronged Approach to Stop “Robocalling” ▪ Keep Unwanted Calls Out ▪ SHAKEN/STIR: Call authentication framework being developed and implemented by carriers. ▪ Effort to restore trust in Caller ID ▪ Call Blocking: Default opt-in call- blocking based on “reasonable analytics” designed to identify “unwanted” calls ▪ Reducing Errors ▪ Reassigned Numbers Database should reduce misdirected calls ▪ High profile enforcement actions October 10, 2019 5

SHAKEN/STIR Targets Fraudulent Call Spoofing ▪ SHAKEN/STIR: Signature-based Handling of Asserted information using toKENs and the Secure Telephone Identity Revisited is a call authentication framework. ▪ A call is “signed” by the originating Voice Service Provider (VSP), then validated by intermediate providers during transmission. Unauthenticated calls will be stopped. ▪ A (full attestation): Originating carrier authenticates the caller and its right to use phone number ▪ B (partial attestation): Originating carrier authenticates the caller, but not the right to use phone number ▪ C (gateway attestation): No authentication of caller or right to use phone number ▪ Call originators can register with a third party (e.g., analytics engine) 6

The FCC Is Spearheading Adoption of SHAKEN/STIR ▪ Nationwide wireless providers committed to implement SHAKEN/STIR by end of year ▪ Adoption by smaller carriers will be slower due to technological limitations ▪ Carriers are partnering with analytics engines (e.g., Hiya, First Orion, TNS) to inform consumers about a call (e.g., verified, spam likely) based on information known about the call, a caller, and calling patterns ▪ What will SHAKEN/STIR do? ▪ Verify the calling number was not spoofed or tampered with during transit ▪ Allow traceback for enforcement ▪ May be used for call analytics ▪ What won’t SHAKEN/STIR do ▪ Verify a call is a good calls ▪ Attest to a calling party’s intent October 10, 2019 7

FCC Allows Carrier Default Opt-In Call Blocking ▪ FCC’s issued rule giving VSPs the right to enroll consumers in their call -blocking services by default ▪ Call- blocking program can be based on “any reasonable analytics” designed to identify “unwanted” calls ▪ Paradigm shift from consumers opting in to consumers opting out of blocking ▪ Calls likely will labeled as “suspected spam,” “robocall,” “nuisance likely” or potentially malicious ▪ Effective June 7, 2019, but implementation ongoing 8

FCC Carrier Call Blocking Details ▪ Target: Illegal scam calls ▪ VSPs encouraged to provide a contact for blocked callers and to create a notice and appeal process ▪ VSPs will likely rely on existing call labeling analytics ▪ Currently, about 25% of phone numbers are improperly blocked or labeled ▪ FCC considering “critical calls” lists of numbers that may not be blocked ▪ Likely limited to emergency and government-related communications ▪ 12 large voice service providers and the AGs from every state and DC agreed on eight “anti -robocall principles for voice service providers.” ▪ Communication with state attorneys general ▪ Free to consumers October 10, 2019 9

Call Blocking Raises Significant Questions for Legitimate Callers ▪ “Reasonable analytics” is undefined ▪ Who will do the labeling? ▪ Will the labeling algorithms be sufficiently transparent? ▪ Will there be accountability? ▪ How do callers ensure accurate labeling and blocking? ▪ Vendors are developing solutions for accurate labeling and prevent improper blocking ▪ Challenge process for blocking remains opaque 10

FCC Enforcement Crackdown ▪ FCC's Enforcement Bureau works with industry groups ▪ Industry shares information among carriers and providers to help "traceback" the traffic of illegal calls to the originating provider ▪ High penalty fines against spoofers ▪ Over $240 million against three telemarketers for alleged illegal caller ID spoofing ▪ $16,000 per call/text 11

FCC’s Efforts to Reduce Calls to Reassigned Numbers ▪ Reassigned cell numbers are given up by one user and assigned to another ▪ In some cities, reassignment can happen within a few days ▪ Reassigned cell telephone numbers give rise to “wrong number” TCPA claims because the caller no longer has consent of the “called party” ▪ Reassigned number database was established by FCC order in December 2018 ▪ A single, comprehensive database that will contain reassigned number information from each provider ▪ It will “enable any caller to verify whether a telephone number has been reassigned before calling that number” ▪ New safe harbor for callers ▪ FCC provided a safe harbor from TCPA reassigned number liability for callers that use the database ▪ Requires enrollment process with certification of use 12

When Will the Database be Operational? ▪ No Definitive Timeline Exists ▪ FCC recently extended the deadline for the North American Numbering Council to develop a plan for creating the reassigned numbers database to January 13, 2020 ▪ In late 2018, FCC stated it “expects to issue the solicitation for the new reassigned numbers database administrator in the next twelve months” ▪ Bottom Line: Summer 2020 at the earliest 13

Legislative Solutions to “Robocalls” ▪ Resolving the “robocall” epidemic has become a bipartisan issue ▪ Six to eight bills have been considered, but leading solutions: ▪ TRACED Act (Senate) ▪ Stopping Bad Robocalls Act (House) ▪ Focus includes stopping fraud/scams 14

ROBOCOP – April 2016 Repeated Objectionable Bothering of Consumers on Phones ▪ Requires telecom companies to verify accuracy of caller IDs and provide free tools to block robocalls ▪ Gives consumers private right of action against telecom companies 15

TRACED Act – Passed Senate in May 2019 Telephone Robocall Abuse Criminal Enforcement and Deterrence ▪ Requires CFPB, Department of State, Department of Homeland Security, Department of Commerce and FTC to get in the mix on TCPA enforcement and figure out if any inter- governmental issues “inhibit the prosecution of [TCPA] violations.” ▪ Expanded list of agencies with enforcement power ▪ Hefty civil penalties to prosecute “robocallers” ▪ Amplifies the FCC’s enforcement powers ▪ Requires FCC to implement call authentication framework to prevent spoofing, and implement regulations protecting subscribers from non-authenticated calls 16

Stopping Bad Robocalls Act - Passed House in July 2019 ▪ Requires the FCC to adopt certain consumer protections ▪ Rules to protect consumers from unwanted calls ▪ Ensure consumers can withdraw consent ▪ Requires carriers to implement technology call authentication and call blocking ▪ No additional cost to consumers ▪ Requires creation of reassigned number database with legal safe harbor ▪ Enacts safeguards so companies can’t abuse “robocall” exemptions ▪ Increases criminal penalties for illegal robocalls 17