Technology and Legislative Solutions to Maintain Cell Phone Privacy - - PowerPoint PPT Presentation

The Robocall Epidemic: Leveraging Technology and Legislative Solutions to Maintain Cell Phone Privacy

Privacy and Security Forum Divya Gupta Dorsey & Whitney LLP Jeremy Gladstone Capital One October 15, 2019

1

Agenda

▪ The “Robocall” Epidemic ▪ How Did We Get Here? ▪ What’s the Big Deal? ▪ Let’s Talk FCC Solutions ▪ Call authentication and call blocking ▪ Reassigned numbers database ▪ Enforcement actions ▪ What about Congress? ▪ TRACED Act ▪ Stopping Bad Robocalls Act

2

The Basics: TCPA and “Robocalls”

▪ The Telephone Consumer Protection Act ▪ Enacted in 1991 to protect Americans’ privacy ▪ Congressional response to telemarketers interrupting family dinners by calling home phones ▪ Dialing technology was immature, and mobile phones were novelties ▪ The TCPA prohibits, among other things, unconsented calls to mobile phones made with an Automated Telephone Dialing System (ATDS) ▪ What is an ATDS? ▪ Whose consent is it, anyway? ▪ What constitutes reasonable revocation? ▪ Statutory penalties: $500-$1500/call or text ▪ The amount of litigation and judgment size has steadily increased ▪ Litigation often targets otherwise lawful actors ▪ What is a “robocall”? ▪ No enacted statute, including the TCPA, defines a “robocall” ▪ Generally used to describe legal and unlawful calls

3

The Public Agrees “Robocalls” Are a Problem

▪ U.S. consumers received nearly 5 billion “robocalls” per month (2,000/second) ▪ Technological advances have made automated dialing cheap and easy ▪ Calling networks have transitioned from analog to internet-based ▪ Caller ID and call spoofing have evolved with changing technology ▪ “Robocalls” are the top complaint to the Federal Communications Commission ▪ Stopping unlawful calls is the FCC’s top customer protection priority ▪ Over 200,000 complaints each year—around 60% of all FCC complaints ▪ Consumers report that they don’t answer unknown phone numbers

Last Week Tonight: John Oliver Focused on Robocalling “The vast majority vary from the irritating to the outright illegal and you might be surprised by how many major companies are involved in this. A list of top robocallers includes Capital One, Comcast, and Wells Fargo.” https://youtu.be/FO0iG_P0P6M

The FCC Has Adopted a Multi-Pronged Approach to Stop “Robocalling”

▪ Keep Unwanted Calls Out ▪ SHAKEN/STIR: Call authentication framework being developed and implemented by carriers. ▪ Effort to restore trust in Caller ID ▪ Call Blocking: Default opt-in call-blocking based on “reasonable analytics” designed to identify “unwanted” calls ▪ Reducing Errors ▪ Reassigned Numbers Database should reduce misdirected calls ▪ High profile enforcement actions

October 10, 2019 5

SHAKEN/STIR Targets Fraudulent Call Spoofing

▪ SHAKEN/STIR: Signature-based Handling of Asserted information using toKENs and the Secure Telephone Identity Revisited is a call authentication framework. ▪ A call is “signed” by the originating Voice Service Provider (VSP), then validated by intermediate providers during transmission. Unauthenticated calls will be stopped. ▪ A (full attestation): Originating carrier authenticates the caller and its right to use phone number ▪ B (partial attestation): Originating carrier authenticates the caller, but not the right to use phone number ▪ C (gateway attestation): No authentication of caller or right to use phone number ▪ Call originators can register with a third party (e.g., analytics engine)

6

▪ Nationwide wireless providers committed to implement SHAKEN/STIR by end of year ▪ Adoption by smaller carriers will be slower due to technological limitations ▪ Carriers are partnering with analytics engines (e.g., Hiya, First Orion, TNS) to inform consumers about a call (e.g., verified, spam likely) based on information known about the call, a caller, and calling patterns ▪ What will SHAKEN/STIR do? ▪ Verify the calling number was not spoofed or tampered with during transit ▪ Allow traceback for enforcement ▪ May be used for call analytics ▪ What won’t SHAKEN/STIR do ▪ Verify a call is a good calls ▪ Attest to a calling party’s intent

The FCC Is Spearheading Adoption of SHAKEN/STIR

7 October 10, 2019

FCC Allows Carrier Default Opt-In Call Blocking

▪ FCC’s issued rule giving VSPs the right to enroll consumers in their call-blocking services by default ▪ Call-blocking program can be based on “any reasonable analytics” designed to identify “unwanted” calls ▪ Paradigm shift from consumers opting in to consumers opting out of blocking ▪ Calls likely will labeled as “suspected spam,” “robocall,” “nuisance likely” or potentially malicious ▪ Effective June 7, 2019, but implementation ongoing

8

FCC Carrier Call Blocking Details

▪ Target: Illegal scam calls ▪ VSPs encouraged to provide a contact for blocked callers and to create a notice and appeal process ▪ VSPs will likely rely on existing call labeling analytics ▪ Currently, about 25% of phone numbers are improperly blocked or labeled ▪ FCC considering “critical calls” lists of numbers that may not be blocked ▪ Likely limited to emergency and government-related communications ▪ 12 large voice service providers and the AGs from every state and DC agreed on eight “anti-robocall principles for voice service providers.” ▪ Communication with state attorneys general ▪ Free to consumers

October 10, 2019 9

Call Blocking Raises Significant Questions for Legitimate Callers

▪ “Reasonable analytics” is undefined ▪ Who will do the labeling? ▪ Will the labeling algorithms be sufficiently transparent? ▪ Will there be accountability? ▪ How do callers ensure accurate labeling and blocking? ▪ Vendors are developing solutions for accurate labeling and prevent improper blocking ▪ Challenge process for blocking remains opaque

10

FCC Enforcement Crackdown

▪ FCC's Enforcement Bureau works with industry groups ▪ Industry shares information among carriers and providers to help "traceback" the traffic

• f illegal calls to the originating provider

▪ High penalty fines against spoofers ▪ Over $240 million against three telemarketers for alleged illegal caller ID spoofing ▪ $16,000 per call/text

11

FCC’s Efforts to Reduce Calls to Reassigned Numbers

▪ Reassigned cell numbers are given up by one user and assigned to another ▪ In some cities, reassignment can happen within a few days ▪ Reassigned cell telephone numbers give rise to “wrong number” TCPA claims because the caller no longer has consent of the “called party” ▪ Reassigned number database was established by FCC order in December 2018 ▪ A single, comprehensive database that will contain reassigned number information from each provider ▪ It will “enable any caller to verify whether a telephone number has been reassigned before calling that number” ▪ New safe harbor for callers ▪ FCC provided a safe harbor from TCPA reassigned number liability for callers that use the database ▪ Requires enrollment process with certification of use

12

When Will the Database be Operational?

▪ No Definitive Timeline Exists ▪ FCC recently extended the deadline for the North American Numbering Council to develop a plan for creating the reassigned numbers database to January 13, 2020 ▪ In late 2018, FCC stated it “expects to issue the solicitation for the new reassigned numbers database administrator in the next twelve months” ▪ Bottom Line: Summer 2020 at the earliest

13

Legislative Solutions to “Robocalls”

▪ Resolving the “robocall” epidemic has become a bipartisan issue ▪ Six to eight bills have been considered, but leading solutions: ▪ TRACED Act (Senate) ▪ Stopping Bad Robocalls Act (House) ▪ Focus includes stopping fraud/scams

14

ROBOCOP – April 2016

Repeated Objectionable Bothering of Consumers on Phones

▪ Requires telecom companies to verify accuracy of caller IDs and provide free tools to block robocalls ▪ Gives consumers private right of action against telecom companies

15

TRACED Act – Passed Senate in May 2019

Telephone Robocall Abuse Criminal Enforcement and Deterrence

▪ Requires CFPB, Department of State, Department of Homeland Security, Department of Commerce and FTC to get in the mix on TCPA enforcement and figure out if any inter- governmental issues “inhibit the prosecution of [TCPA] violations.” ▪ Expanded list of agencies with enforcement power ▪ Hefty civil penalties to prosecute “robocallers” ▪ Amplifies the FCC’s enforcement powers ▪ Requires FCC to implement call authentication framework to prevent spoofing, and implement regulations protecting subscribers from non-authenticated calls

16

Stopping Bad Robocalls Act - Passed House in July 2019

17

▪ Requires the FCC to adopt certain consumer protections ▪ Rules to protect consumers from unwanted calls ▪ Ensure consumers can withdraw consent ▪ Requires carriers to implement technology call authentication and call blocking ▪ No additional cost to consumers ▪ Requires creation of reassigned number database with legal safe harbor ▪ Enacts safeguards so companies can’t abuse “robocall” exemptions ▪ Increases criminal penalties for illegal robocalls

Where is Legislation Headed?

▪ Key differences between Senate and House bills ▪ Requires the FCC to issue a rule on TCPA Public Notice within six months ▪ Changes the definition of “called party” for consent to mean “subscriber or customary user” ▪ Consensus bill by year end?

TCPA Issues On the Horizon Post-ACA International v. FCC, 885 F.3d 687 (D.C. Cir. 2018)

▪ Consent

• Provided by subscriber or customary user

▪ Revocation

• Called party may “revoke consent at any time and through any reasonable

means….”

• Caller may not limit manner in which revocation may occur,” nor

“designate the exclusive means by which consumers must revoke consent.” ▪ ATDS Definition

• Capacity – random or sequential number generator
• Human Intervention

▪ Impact to Privacy Remains to be Seen

19

QUESTIONS?

20

21

Divya Gupta is a financial services partner in Dorsey & Whitney’s Financial Services Practice. Focusing her practice on litigation and compliance she and her Consumer Financial Services team has delivered consistently successful outcomes to businesses in the financial services industry and other industries, whether in

• ne-off cases, class action cases, or cohesive

national litigation strategies.

Your Speakers

Key service areas include:

• Litigation
• TCPA Defense and Compliance
• FCRA Defense and Compliance
• California Consumer Privacy Act Compliance

Divya Gupta Partner

gupta.divya@dorsey.com

714.800.1493

Jeremy Gladstone is a Director, Assistant General Counsel, Enterprise Regulatory Advisory in the Capital One Legal

• Department. Among other things, Jeremy

serves as Capital One’s subject matter expert on the Telephone Consumer Protection Act, the Telemarketing Sales Rule, CAN-SPAM and other privacy-related laws and regulations. He advises Capital One on interpreting and complying with these and other requirements.

Jeremy Gladstone Director, Assistant General Counsel jeremy.gladstone@capitalone.com