Speaker 1: Welcome to Tech Stuff, a production from I Heart Radio.
Speaker 1: Hey there, and welcome to tech Stuff. I'm your host,
Speaker 1: Jonathan Strickland. I'm an executive producer with I Heart Radio
Speaker 1: and a love of all things tech. I say that
Speaker 1: a lot, but then I always have to qualify it,
Speaker 1: and this is gonna be another one of those episodes.
Speaker 1: So today I thought I would talk a bit about
Speaker 1: color I D, spoofing and robo calls. Mostly color I
Speaker 1: D and spoofing robot calls, I think I'm gonna have
Speaker 1: to say for another episode. But here in the United States,
Speaker 1: the major telecommunications companies, those being Verizon, T Mobile, and
Speaker 1: A T and T now have to work together to
Speaker 1: fight spam calls due to a mandate from the Federal
Speaker 1: Communications Commission or f c C. Now, the too long
Speaker 1: Didn't Listen message behind this, as opposed to too long
Speaker 1: Didn't Read is the goal is to eliminate spam robocalls
Speaker 1: going to your phone, so that you don't act like
Speaker 1: your phone is a bomb about to go off every
Speaker 1: time it rings. But to understand why this is necessary
Speaker 1: and how it all works, we have to go much deeper.
Speaker 1: So if you, dear listener, are of a certain age,
Speaker 1: you might remember a time when we didn't all carry
Speaker 1: smartphones around with us all the time. You might even
Speaker 1: remember a time before we even carried simple cell phones
Speaker 1: with us. In fact, some of you might remember being
Speaker 1: on a telephone handset that was tethered to a phone
Speaker 1: that was mounted to the wall, or sitting on top
Speaker 1: of an end table or something. And back in those days,
Speaker 1: dear friends, if someone called you, you really had no
Speaker 1: way of knowing who that someone was. I know, it's terrifying,
Speaker 1: right the phone rings, and there's no way to know
Speaker 1: who or what is on the other side. Could it
Speaker 1: be Grandpa Joe and he's found a golden ticket. Could
Speaker 1: it be the local food bank calling to see if
Speaker 1: you'll volunteer this year. Could it be a wrong number?
Speaker 1: The only way to find out was to answer the phone,
Speaker 1: or if you were a fancy person, you might let
Speaker 1: the call go to an answering machine. Side note. The
Speaker 1: answering machine traces its history all the way back to
Speaker 1: the nineteen thirties, but when I was growing up in
Speaker 1: the seventies and eighties, they were still relatively uncommon from
Speaker 1: most of the people I knew. But by the mid
Speaker 1: eighties that that had totally changed, and we started seeing
Speaker 1: commercials for like novelty answering machine outgoing messages I used
Speaker 1: to be a thing. There was this incredible pressure to
Speaker 1: create the perfect outgoing message to convey to those calling
Speaker 1: that you had a personality. But I digress, let's get
Speaker 1: back on track. Many answering machines would play incoming messages
Speaker 1: out loud on a loudspeaker as someone was making the message,
Speaker 1: which meant that you could use an answering machine to
Speaker 1: screen your calls, and a lot of people did so.
Speaker 1: If you had anxiety about answering the phone, you could
Speaker 1: just wait for the answering machine to activate and then
Speaker 1: see if the other person on the other end of
Speaker 1: the call was going to wait around long enough to
Speaker 1: actually leave a message after hearing You're hilarious and yet
Speaker 1: incredibly effective outgoing message. Then, upon recognizing the voice, you
Speaker 1: could choose to either interrupt the machine by picking up
Speaker 1: the phone and having the call initiate, or just letting
Speaker 1: it go. Simpler times really not that color I D
Speaker 1: wasn't a thing back then. The foundation of color i
Speaker 1: D technology has a history that dates back to the
Speaker 1: late nineteen sixties and to really understand all this, we
Speaker 1: should take get another step back and just talk about
Speaker 1: phone calls in general, and we'll build from there. So
Speaker 1: when Alexander Graham Bell made his first call, arguably not
Speaker 1: the first call, but that's a story for another time,
Speaker 1: it was a direct line from his station to that
Speaker 1: of his assistant, Thomas Watts, and there was no need
Speaker 1: to route that call anywhere. It was a straight road,
Speaker 1: if you will, from one point to another. Now, let's
Speaker 1: say we've got a group of four people and we
Speaker 1: want to connect these four people with phone lines so
Speaker 1: they can talk to each other on the phone. We
Speaker 1: could do this directly as well. Right, A simple way
Speaker 1: to draw this out would be just draw four points
Speaker 1: as corners of a square. Uh. Those corners represent our
Speaker 1: four phone friends, and we draw straight lines from each
Speaker 1: point to each other point. So what you end up
Speaker 1: with is a square with a couple of diagonal lines
Speaker 1: crossing through the center, and boom, you've got your four
Speaker 1: person network. Each person has a direct line to each
Speaker 1: other person in the network. But as we try to
Speaker 1: add more people to a system like this, we quickly
Speaker 1: see the limitations that we face. Each new connection means
Speaker 1: we have to establish cables between that person and every
Speaker 1: other person on the network. This gets expensive and complicated
Speaker 1: and messy and unsustainable. A phone network in which every
Speaker 1: single person with a phone has a direct line with
Speaker 1: every single other person with the phone is just impossible.
Speaker 1: You wouldn't even be able to move around because of
Speaker 1: all the cables everywhere, and so an important development in
Speaker 1: the history of the telephone system was the creation of
Speaker 1: the local exchange. The local exchange is a centralized point
Speaker 1: that you dial into, and then the exchange could switch
Speaker 1: on a connection between your line and the line of
Speaker 1: whomever it was who wanted to call. So in the
Speaker 1: early days of telephones, this was done with actual human
Speaker 1: beings sitting at a switchboard and manually plugging cables into
Speaker 1: complete calls from one person to another. So now rather
Speaker 1: than having direct connections with every other phone in existence,
Speaker 1: you really just needed a direct connection from your phone
Speaker 1: to an exchange. This cuts way back on the amount
Speaker 1: of cables that you needed in order to create a network. Now,
Speaker 1: this works fine for local calls, like you know, within
Speaker 1: a city, everyone can connect to that one local exchange,
Speaker 1: But the word local gives us a hint that there
Speaker 1: isn't one single exchange for every phone line out there. Now,
Speaker 1: local exchanges will cover a specific region, but beyond that
Speaker 1: you have other local exchanges. And to connect these exchanges together,
Speaker 1: phone companies laid out what we're called trunk lines. These
Speaker 1: are cables capable of carrying multiple phone signals simultaneously, which
Speaker 1: is a good thing too. Otherwise a single long distance
Speaker 1: call would prevent anyone else from making a similar sort
Speaker 1: of call between you know, those two specific exchanges. The
Speaker 1: networks grew organically, connecting to one another and forming what
Speaker 1: we call the public switched Telephone network or p st N.
Speaker 1: You could look at it as a sort of hierarchy
Speaker 1: as more of the world built out phone systems. At
Speaker 1: the very body him of this hierarchy, you had your
Speaker 1: individual landline phones the stuff, and homes and offices and
Speaker 1: phone booths and stuff like that. We used to have
Speaker 1: these things called phone booths, Superman, which change in them
Speaker 1: doesn't matter. One level up from this level, and you
Speaker 1: have your local exchanges, right, These are the ones that
Speaker 1: connect local calls to each other. And as I said,
Speaker 1: in the old days, this was done with human operators
Speaker 1: moving physical plugs into physical outlets to complete circuits and
Speaker 1: switch on a phone call, but didn't take long before
Speaker 1: the complexity of phone systems necessitated innovation to create automated
Speaker 1: ways of handling this. One level up from local exchanges
Speaker 1: are your trunk exchanges. The trunk exchange is to local exchanges,
Speaker 1: as local exchanges are two individual land lines. The trunk
Speaker 1: exchanges allow the various local exchanges within a country to
Speaker 1: connect to one another. A level above the trunk exchanges,
Speaker 1: you have international gateways, which interconnect the phone system of
Speaker 1: one kind tree with other countries. Often you end up
Speaker 1: having super long cables connecting these, including cables that run
Speaker 1: under the ocean. You know, there's cables under the Atlantic
Speaker 1: that connect Europe to North America, for example. All right,
Speaker 1: so now let's get a bit more complicated by throwing
Speaker 1: cellular phones into the mix. Cell phones communicate to sell towers,
Speaker 1: which you can think of as being kind of similar
Speaker 1: to the local exchange I was talking about earlier. So
Speaker 1: cell towers are essentially antenna, and the cell phones communicate
Speaker 1: with cell towers through electromagnetic radiation, specifically radiation that falls
Speaker 1: into the microwave frequency range. But they're not the same
Speaker 1: microwaves that we use to zap our popcorn and microwave ovens.
Speaker 1: It's not that level of frequency. It's also a very
Speaker 1: low wattage that we use for cell phones now. The
Speaker 1: microwave acts as a carrier wave, and I've talked a
Speaker 1: bit about carrier waves in the past with stuff like
Speaker 1: radio signals. Each phone is using a slightly different frequency,
Speaker 1: otherwise you would run into issues with phones interfering with
Speaker 1: one another. All right, So cell phone towers are at
Speaker 1: the heart of the cells that make up a service area.
Speaker 1: One really clever thing about this approach is the handshake
Speaker 1: that happens as you move across a region. So you
Speaker 1: can be on a phone call and you can be
Speaker 1: let's say, in a car, and you pass out of
Speaker 1: the range of one cell phone or cell tower rather
Speaker 1: and you enter into the range of another, and your
Speaker 1: call continues on as if you had a solid connection
Speaker 1: on a single cell tower the entire time. I'm gonna
Speaker 1: leave it at that, because getting into the tech of
Speaker 1: all that would really get us off course. This episode
Speaker 1: would end up being like three hours long. But maybe
Speaker 1: I'll do a full episode about how cell towers work.
Speaker 1: It is really fascinating because they have to be very
Speaker 1: careful with the frequencies they use in order to both
Speaker 1: service everyone who's within range of a specific cell tower
Speaker 1: and not interfere with anyone who's at a neighboring cell tower. Anyway,
Speaker 1: Connecting the towers is the Mobile Telephone Switching Office or
Speaker 1: mt s O. Each service provider has its own mpt
Speaker 1: s O in regions, So if the person you're talking
Speaker 1: with is in the same region, such as like in
Speaker 1: the same city as you, and they happen to be
Speaker 1: on the same carrier, one mt s O pretty much
Speaker 1: handles everything. The call signals go through the cell towers
Speaker 1: to one another through the m t s O, but
Speaker 1: the calls are not made directly phone to phone. It's
Speaker 1: not like your phone is acting like a radio directly
Speaker 1: with the other phone. Now, if you're calling someone who's
Speaker 1: on the other side of the country, it's a little
Speaker 1: bit different. Typically, your call would go from your phone
Speaker 1: to a cell tower, and from the cell tower to
Speaker 1: the local mt s O of your carrier, then from
Speaker 1: there to the p s t N that big public
Speaker 1: switching telephone network, and that would then route your call
Speaker 1: to the mt s O relevant to whomever it was
Speaker 1: your calling on the other end. So even cell calls
Speaker 1: can rely upon the old phone system. Getting back to
Speaker 1: color I D. Back in the nineteen sixties, there was
Speaker 1: an engineer named Theodore Paris Cavacos it still is, I mean,
Speaker 1: he's still alive today. He developed a way to send
Speaker 1: electronic data over telephone lines. In v he filed and
Speaker 1: received a patent for a quote decoding and display apparatus
Speaker 1: for groups of pulse trains end quote. This would become
Speaker 1: the basis of color I D, in which the telephone
Speaker 1: of the person making the call will send data relating
Speaker 1: to the phone number of that originating call along with
Speaker 1: the call itself, and a device on the other end
Speaker 1: on the receiving end could get this information, decode it
Speaker 1: and display the incoming phone number and thus identify the
Speaker 1: incoming call. Other engineers around the same time period began
Speaker 1: to develop similar technologies and approaches, and so the early
Speaker 1: days of color I D are a bit muddled, as
Speaker 1: there are numerous patents assigned to different inventors, some of
Speaker 1: which acknowledged the existence of other inventions as prior art.
Speaker 1: One of those inventors was Katsuo Hashimoto for a quote
Speaker 1: Telephone Information displaying device end quote. The abstract of that
Speaker 1: patent essentially lays out what we think of as color
Speaker 1: I D. So I'm going to read to you the
Speaker 1: abstract of this patent. Here he goes a calling parties
Speaker 1: telephone number displaying device, in which, while the telephone set
Speaker 1: of a subscriber is ringing in response to calling signals
Speaker 1: from a telephone exchange office, the telephone number of a
Speaker 1: calling party and information are displayed on digital display units
Speaker 1: at high speed before lifting the handset. Accordingly, the subscriber
Speaker 1: can determine whether or not he should answer the call
Speaker 1: before picking up the handset. Thus his privacy can be
Speaker 1: protected from a variety of telephone troubles such as wrong
Speaker 1: number and nuisance calls. The display is maintained as it
Speaker 1: is even if the handset is put back after the talk,
Speaker 1: but it will be cleared automatically upon reception of the
Speaker 1: next call to display the telephone number of the next
Speaker 1: calling party. When the subscriber picks up the handset to
Speaker 1: make a call, the internal circuit is automatically changed to
Speaker 1: display a telephone number dialed by him. That's it. So
Speaker 1: that patent pretty much explains that the invention would allow
Speaker 1: telephones to send and receive signals between successive ringing signals.
Speaker 1: So in other words, when the phone company isn't sending
Speaker 1: the signal to make the receiving phone ring, it could
Speaker 1: send the signal containing information about the origin of that call.
Speaker 1: And that's why if you're using a landline and you
Speaker 1: get a phone call with a system that had caller
Speaker 1: I D, you would only see the I D stuff
Speaker 1: pop up after the first ring happened. The method for
Speaker 1: sending the information was a type of frequency modulation that's
Speaker 1: changing the frequency of a signal in order to encode
Speaker 1: information on it, called frequency shift keying or f s K.
Speaker 1: Applying f s K to a carrier signal alters that
Speaker 1: carrier signal in a way that can be interpreted on
Speaker 1: the other side in some manner. So in the case
Speaker 1: of color I D, that some manner is that the
Speaker 1: transmitting side can encode the phone number in that carrier wave,
Speaker 1: and the receiving side can decode that carrier wave and
Speaker 1: get back at that number. FSK is used in lots
Speaker 1: of applications, not just Color I D. But for our purposes,
Speaker 1: it's just important that we know that this is the
Speaker 1: methodology that the phone company is used to transmit the
Speaker 1: info of Hey, this is the phone number that just
Speaker 1: dialed you. But this wasn't going to be a service
Speaker 1: that phone companies were going to throw in for free. No,
Speaker 1: this would be something that companies would charge for on
Speaker 1: top of the normal phone bill. Now, the story goes
Speaker 1: that the phone companies at first planned to offer this
Speaker 1: service as an audio one. So, in other words, you
Speaker 1: could opt into this service and you would get a
Speaker 1: verbal alert when you picked up the phone telling you
Speaker 1: the phone number that the call originated from. UH. And
Speaker 1: the phone companies were hoping to charge on a per
Speaker 1: use basis, so every time you did this you get
Speaker 1: charged a little amount. That's not how things eventually turned out.
Speaker 1: We'll get into color I D a little bit more
Speaker 1: after the break, and then we'll talk about the systems
Speaker 1: that enable spoofing. But first let's take that quick break. So,
Speaker 1: phone companies were licensing technologies to enable color I D
Speaker 1: in the nineteen seventies, but it wasn't until the mid
Speaker 1: nineteen eighties that we saw the first pilot program of
Speaker 1: color I D here in the United States. That took
Speaker 1: place in Orlando, Florida, where you know, the characters from
Speaker 1: Book of Mormon really wanted to go, and that happened.
Speaker 1: Back in four Bell South offered a service call touch Star,
Speaker 1: and Color i D was one of the features that
Speaker 1: you could opt into with Touch Star. It was called
Speaker 1: Custom Local Area Signaling Service, but it would become known
Speaker 1: as Color i D. Now, if you weren't around in
Speaker 1: the nineteen eighties, you might be surprised to hear that
Speaker 1: the emergence of color i D was viewed with suspicion
Speaker 1: from multiple fronts. In the US. Politicians were asking if
Speaker 1: perhaps Color i D would violate wire tapping laws, and
Speaker 1: others were likening it to tracing a phone call, kind
Speaker 1: of like what you see in movies, where you know,
Speaker 1: the police are trying to track a specific criminal as
Speaker 1: they talk on the phone. But in fact, it was
Speaker 1: such a controversial subject that it took more than a
Speaker 1: decade for all fifty states in the US to actually
Speaker 1: adopt the technology. California held out the longest. California only
Speaker 1: incorporated color i D in nineteen nine, six twelve years
Speaker 1: after Orlando, Florida got in on it. And by the
Speaker 1: mid nineties, there was another big con learned to think about,
Speaker 1: and that was privacy. We weren't quite at the same
Speaker 1: level that we are now, not by a long shot,
Speaker 1: where the average medicine has generated tons of information about
Speaker 1: themselves that can link back to them. But we were
Speaker 1: entering into an era in which certain companies were building
Speaker 1: out comprehensive databases about consumers, and so you started to
Speaker 1: see companies building out profiles or even dossiers on people. Now,
Speaker 1: if you want to be charitable, you could argue this
Speaker 1: helped those companies serve their customers more effectively. But if
Speaker 1: you want to be cynical, you could say that this
Speaker 1: gave companies more information to leverage while trying to sell
Speaker 1: goods or services to a potential customer. The truth is
Speaker 1: probably somewhere in the middle. But what concerned privacy advocates
Speaker 1: is that a business could theoretically rely on caller I D.
Speaker 1: So if someone were to call in, let's say that
Speaker 1: someone needs to talk to a customer service rep, then
Speaker 1: that rep could do a reverse phone number, look up
Speaker 1: on that call, and pull up a full profile of
Speaker 1: the person calling. And there were a lot of privacy
Speaker 1: implications that were concerning actually kind of seems quaint in
Speaker 1: comparison to what we deal with today. At least if
Speaker 1: you look into how private information gets handled these days.
Speaker 1: For that reason, Telephone Company is introduced an option to
Speaker 1: allow customers to opt into color I D blocking. Now,
Speaker 1: if you did this, it meant that your number would
Speaker 1: not be displayed when you called someone else. You were
Speaker 1: effectively blacklisted for color I D. And so you know,
Speaker 1: if I opted into this and I called you, you
Speaker 1: would probably see some sort of message like color unknown
Speaker 1: or something similar to that, which probably means you wouldn't
Speaker 1: likely pick up my call. To be fair, you probably
Speaker 1: wouldn't anyway, I'm kind of a drag to speak to
Speaker 1: on the phone. It took time for attitudes around color
Speaker 1: I D to change, but we did on viously see
Speaker 1: that happen today For many people, including myself, we don't
Speaker 1: pick up the phone if we don't recognize the number
Speaker 1: that's displayed on our phone screen, and that means that
Speaker 1: if the call comes up is unknown or something along
Speaker 1: those lines, we're not likely to answer it. We'll probably
Speaker 1: let it go to voicemail. In fact, these days, I
Speaker 1: feel a sense of anxiety even if I do recognize
Speaker 1: the number, which is weird because I was one of
Speaker 1: those folks who back in the eighties and nineties. I
Speaker 1: love to talk on the phone. Now it seems kind
Speaker 1: of odd. I have a small group of friends and
Speaker 1: family with whom I'll chat with on the phone, but
Speaker 1: they are truly the exception and not the rule. Anyway,
Speaker 1: Color I D made the transition from being viewed as
Speaker 1: being invasive or creepy as to being necessary in order
Speaker 1: to function as a human being in the modern technical age.
Speaker 1: And there's a related thing I should talk about quickly
Speaker 1: for folks in the United States, and that's the calling
Speaker 1: name President Haitian. That's c NAP or Color Name Delivery,
Speaker 1: that's c NAM systems. These are systems that can provide
Speaker 1: a name to go with a phone number. So with
Speaker 1: these systems, you don't just get a telephone number. You
Speaker 1: get a person or business name that is associated with
Speaker 1: that phone number. So here's how it works. In the
Speaker 1: United States. I'd say we've got two people. We've got
Speaker 1: Max and Chris. And Max is in New York and
Speaker 1: Chris is in California. What's more, Max is a T
Speaker 1: mobile customer and Chriss carrier is a T and T.
Speaker 1: And both Max and Chris are using smartphones, so they're
Speaker 1: on cellular networks. So Max calls Chris. Max's smartphone is
Speaker 1: connected to a nearby cell tower, nearby T Mobile cell tower,
Speaker 1: and that routes the call through T Mobiles MT s
Speaker 1: O in that particular region, and the empty s O
Speaker 1: then routes the call through the psd N, the Public
Speaker 1: swim Ching Telephone network, and that then routes the call
Speaker 1: to the A T and T M T s O
Speaker 1: all the way out in California. That connects to a
Speaker 1: cell tower that's in Chris's area, and it sends the
Speaker 1: call to Chris's smartphone. Now it's at this stage, the
Speaker 1: A T and T stage, where we see the system
Speaker 1: call up the name. So, in other words, the name
Speaker 1: look up is on the receiver's end. It doesn't originate
Speaker 1: from the phone that's making the call. It's all down
Speaker 1: to whichever carrier is in operation on the receiving end,
Speaker 1: and A T and T sees that Max's phone number
Speaker 1: is coming in, so it recognizes the number. But to
Speaker 1: associate that number with Max as a person that requires
Speaker 1: a database look up. And because Max is a T
Speaker 1: Mobile customer not an a T and T customer, a
Speaker 1: T and T technically has to pay a very small
Speaker 1: fee called a dip fee to look up the information
Speaker 1: and then to send that on to Chris. Then Chris
Speaker 1: sees that Max is calling and picks up, or Chris
Speaker 1: ghosts Max. I don't know what their friendship looks like,
Speaker 1: to be honest, my point being that the name associated
Speaker 1: with a phone number isn't magically connected to that number. Rather,
Speaker 1: there are these massive databases of phone customers out there,
Speaker 1: typically at the local level, and these databases match numbers
Speaker 1: two names. There's no universal database out there that has
Speaker 1: every name and every number, So phone companies have these
Speaker 1: ongoing agreements to charge these small dip fees to dip
Speaker 1: into the databases and retrieve relevant information. All right, So
Speaker 1: that's Color I D and I think it's pretty easy
Speaker 1: to understand from a high level how it works. But
Speaker 1: then what about spoofing. Well, spoofing is a practice in
Speaker 1: which the number that pops up on a color I
Speaker 1: D system is not the same as the actual number
Speaker 1: making the call, And there are legitimate reasons to do
Speaker 1: this that have nothing to do with scams or crimes.
Speaker 1: So spoofing as it stands is not illegal on its own.
Speaker 1: It's only illegal if you're using spoofing to purposefully mislead
Speaker 1: or scam people, then you can face a pretty big
Speaker 1: fine in the United States. But spoofing is just a thing,
Speaker 1: not illegal. So let me give you a scenario where
Speaker 1: it's it's allowed. Let's say that you work at an
Speaker 1: accounting firm and you're in charge of making some follow
Speaker 1: up calls relating to a specific account. Now, you have
Speaker 1: your own phone at your desk. But and your own
Speaker 1: phone actually has its own extension, You can make calls
Speaker 1: within your department, you know two, directly to your coworkers,
Speaker 1: no problem. But chances are you would rather have your
Speaker 1: outgoing calls, the ones you make outside of your company,
Speaker 1: map not to your desks phone number, but to the
Speaker 1: number for the accounting firm as a whole. That way,
Speaker 1: anyone on the receiving end would see that it's a
Speaker 1: call coming from this big accounting company, not some unknown
Speaker 1: desk phone. You would need a way to replace your
Speaker 1: desk phone's number with the overall company's phone number. This
Speaker 1: happens all the time with big companies and doctor's offices
Speaker 1: and stuff like that, So you can probably think of
Speaker 1: lots of legitimate uses where the call going out seems
Speaker 1: to be coming from a very large known entity rather
Speaker 1: than an individual phone located within that entity. But to
Speaker 1: make this happen, you have to have some sort of
Speaker 1: technology that does the old switcherou with the phone numbers. Now,
Speaker 1: as I mentioned earlier, color I D in the old
Speaker 1: phone system involves using f s K or frequency shift keying,
Speaker 1: to alter a carrier signal in a specific way to
Speaker 1: transmit information about a phone number in between the signals
Speaker 1: that cause the receiving phone to ring. And it turned
Speaker 1: out that if you could figure out the f s
Speaker 1: K process and build the right technology, you could build
Speaker 1: out a system that would use FSK to transmit false information,
Speaker 1: allowing you to mask the true originating number of a
Speaker 1: call and substitute in something else will let you spoof
Speaker 1: a phone number in other words, And this again was
Speaker 1: was made on purpose eventually, like when once we got
Speaker 1: to the point where we had big companies with these
Speaker 1: kind of phone systems, it was sort of a necessity.
Speaker 1: So it's not like this was an oversight or or
Speaker 1: rather it wasn't a vulnerability. It ended up being an opportunity.
Speaker 1: But if you wanted to take advantage of it, it
Speaker 1: wasn't really easy to do. Back in the early two thousands,
Speaker 1: for example, it was actually pretty challenging. With the right
Speaker 1: hardware and software, and with a digital phone line, you
Speaker 1: could manage it, but it was beyond most people. Some
Speaker 1: big businesses used it for the purposes I mentioned earlier,
Speaker 1: but that was kind of the extent of it. Now,
Speaker 1: part of what makes this possible is a system called
Speaker 1: a private branch exchange or p b X, So this
Speaker 1: doesn't fit neatly into that hierarchy I mentioned earlier. A
Speaker 1: p b X is a telephone system that's typically within
Speaker 1: a really big organization, like a big business, And essentially
Speaker 1: what it does is it allows for an internal telephone system,
Speaker 1: that is, one that connects all the internal phones with
Speaker 1: each other, but it keeps a limited number of external
Speaker 1: phone lines that connect outward to the general you know,
Speaker 1: public switching telephone network or PSTN. So let's say we're
Speaker 1: looking at a corporation with like five thousand employees. Rather
Speaker 1: than making sure every single employee has a direct phone
Speaker 1: line to the outside world, the business chooses to set
Speaker 1: up a p b X while there's a phone at
Speaker 1: every employee's desk, and these phones can make direct calls
Speaker 1: to one another within the businesses local network. To make
Speaker 1: a call to the outside world, first, you might have
Speaker 1: to do something like dial A nine and that actually
Speaker 1: opens up one of the business is limited external phone lines.
Speaker 1: So let's say that this particular business has one hundred
Speaker 1: dedicated external phone lines, which sounds like a lot, but
Speaker 1: it's way fewer than the five thousand you would need
Speaker 1: for every single employee to have their own personal external line.
Speaker 1: As long as fewer than one hundred employees are making
Speaker 1: calls to the outside world at any given time, there's
Speaker 1: not really a problem here. There are different flavors of
Speaker 1: p b X, and they date back even to when
Speaker 1: the phone system was purely running on analog signals and
Speaker 1: there were no digital signal phone lines. Today, p b
Speaker 1: X has include technologies like voice over Internet Protocol or
Speaker 1: void an I p p b X or Internet Protocol.
Speaker 1: Private branch exchange can sometimes include the ability to spoof
Speaker 1: a phone number. It can be built into the system.
Speaker 1: Sometimes it's got a very easy way to access and
Speaker 1: make these changes. You'll just have like a little online
Speaker 1: form and you can go in and you can select
Speaker 1: what you want the outgoing call number to look like.
Speaker 1: But you know, it's really handy if you want everything
Speaker 1: to look like it's coming from a major office phone number.
Speaker 1: But it's also opened up the opportunity to start a
Speaker 1: new kind of fraudulent business. One early company that tried
Speaker 1: to create a business out of spoofing was founded by
Speaker 1: a dude named Jason Jepson, who launched a service called
Speaker 1: Star thirty eight dot com. With Star thirty eight customers,
Speaker 1: who from the beginning, we're supposed to be limited to
Speaker 1: people like licensed private investigators, law enforcement and debt collectors,
Speaker 1: would be allowed to pay a fee, and that would
Speaker 1: let them make phone calls while disguising the phone number
Speaker 1: that they were using as you know, something else. Now
Speaker 1: that the thinking was that the average person isn't keen
Speaker 1: to pick up the phone own if they happen to
Speaker 1: know that there's a private investigator on the line or
Speaker 1: a debt collection agency, you know, they would rather ghost
Speaker 1: that call. So the thinking was, it sure would be
Speaker 1: useful to be able to hide that information and convince
Speaker 1: the person on the other end of that that line
Speaker 1: to actually pick up the phone. So the best way
Speaker 1: to do that is to hide who you are. Start
Speaker 1: three eight dot Com didn't have a long and illustrious
Speaker 1: history in its original form. Three days after he launched
Speaker 1: the service, Jepson announced he was looking to sell the business.
Speaker 1: He had received numerous threats and harassing calls and felt
Speaker 1: it was just, you know, not the right line of
Speaker 1: work for him. Other services like one called Camo Phone.
Speaker 1: You know, like camouflage, but Camo Phone, those kind of surfaced,
Speaker 1: and Star thirty eight actually did come back as a
Speaker 1: service marketed as being exclusive to law enforcement agencies, and
Speaker 1: that was really the beginning of spoofing. But when we
Speaker 1: come back, we'll talk about how spoofing really proliferated as
Speaker 1: VOIPE systems grew in popularity, and how the FCC is
Speaker 1: responding to the issue today. But first let's take another
Speaker 1: quick break. The emergence of voice over Internet protocol was
Speaker 1: one of those truly disruptive technologies. In this case, it
Speaker 1: was disrupting the telecommunications business that got you know, totally
Speaker 1: turned on its head. Because of this, voice would allow
Speaker 1: people to make phone calls using the Internet as the
Speaker 1: transmission system, essentially bypassing the phone companies in the process
Speaker 1: at least and on one end of the call, possibly
Speaker 1: both voice phones can connect to one another. Over the
Speaker 1: Internet and not even touch the phone system, at least
Speaker 1: not the way that normal telephone calls do. But what
Speaker 1: if someone were to use a voice of them to
Speaker 1: call someone in a with a phone that's connected to
Speaker 1: the old public Switching Telephone network or ps t N. Well,
Speaker 1: any void call connecting to the ps t N has
Speaker 1: to go through what's called a void gateway, which serves
Speaker 1: as a bridge between the two systems. See voice traffic
Speaker 1: over the Internet protocol. Uh. That that's using packet switching protocols.
Speaker 1: That's what the Internet at large uses in order to
Speaker 1: send data. It divides up files into packets of information
Speaker 1: and then sends them across the network to be essentially
Speaker 1: reassembled on the other side. But this is incompatible with
Speaker 1: how phone calls are transmitted across the ps t N.
Speaker 1: It's two totally different systems. So the gateway has to
Speaker 1: decompress the digital packets from the voice call and turn
Speaker 1: it into a digital signal that then can be converted
Speaker 1: into an analog signal to cross the ps t N,
Speaker 1: which is pretty wild, right. Eight ways also come in
Speaker 1: different flavors. There are standalone gateways, uh, then there are
Speaker 1: gateway functions that can be built into specific types of routers. Uh.
Speaker 1: There's also the I p p b X that I
Speaker 1: mentioned earlier. Those can act as gateways. The important part
Speaker 1: for our discussion is that many of these voice services
Speaker 1: allow users to take advantage of p b X features
Speaker 1: that traditionally only big companies could use, including spoofing the
Speaker 1: phone number. So as voice technology proliferated and as more
Speaker 1: providers began to offer up spoofing services, including ones that
Speaker 1: just they allow you to start up an account and
Speaker 1: you pay a certain amount and then from that point
Speaker 1: forward you get just have your account deducted whenever you're
Speaker 1: making calls using spoofing. This kind of of technology really
Speaker 1: allowed bad actors to see potential for spoofing numbers for
Speaker 1: malicious purposes. The goal is always to convinced someone to
Speaker 1: pick up the ding dang phone, and one of the
Speaker 1: popular approaches centered around spoofing is to create a number
Speaker 1: that is similar to the target number you're calling, so
Speaker 1: in other words, trying to get something within the same
Speaker 1: area code, maybe even the same phone prefix. I get
Speaker 1: this all the time with with spoofed numbers. So the
Speaker 1: idea is that if you see a number pop up
Speaker 1: on caller I D. And it appears to be a
Speaker 1: local number, You're more likely to pick up the phone
Speaker 1: because you're more likely to feel that the person on
Speaker 1: the other end of that call is someone you know,
Speaker 1: or at least it's something relevant to you. Ask how
Speaker 1: they get you, Well, it's one way. Another way is
Speaker 1: to use databases of personal information to create spear phishing attempts,
Speaker 1: though not every scammer goes to that kind of trouble,
Speaker 1: but they could attempt to spoof specific numbers that you
Speaker 1: might know, so you might think, oh, it's my auntie calling.
Speaker 1: I wonder what's up, and you answer and you find
Speaker 1: out it's not your auntie, it's a scammer. Uh. A
Speaker 1: lot of these hackers and scammers just sort of cast
Speaker 1: a very wide net to see if they catch anything.
Speaker 1: If you pick up a phone that is a catch.
Speaker 1: At that point, you might be prompted to say press
Speaker 1: a number in response to a specific direction, you know,
Speaker 1: like press two to speak with a representative. Don't do it,
Speaker 1: it's a bad idea. A lot of these are actually
Speaker 1: worked into systems where if you do a button press,
Speaker 1: it gets interpreted as an authorization for a charge, and
Speaker 1: the scammers are making money off of this, and you're
Speaker 1: getting charged through your phone company and you get these,
Speaker 1: you know, fraudulent charges on your account, So don't fall
Speaker 1: for that. Um Uh, this is essentially illegal. I mean,
Speaker 1: it is illegal, but it doesn't stop people from doing
Speaker 1: it because it's kind of hard to catch them. Uh.
Speaker 1: You might also get someone who's on the other end
Speaker 1: of the call and they're looking to get valuable information
Speaker 1: from you, like a bank account number or something. Obviously,
Speaker 1: is a bad idea to engage in this sort of stuff.
Speaker 1: In fact, it's bad enough that some phone companies and
Speaker 1: the f c C have argued that if you don't
Speaker 1: recognize a number, don't answer it. Think about that for
Speaker 1: a moment. This you have companies like phone companies, their
Speaker 1: business is charging customers for this inner connectivity, this ability
Speaker 1: to have communication channels open. And then they're saying, by
Speaker 1: the way, if you don't recognize the number, don't use
Speaker 1: our services, which we are charging you for. It's kind
Speaker 1: of wild, right, because you would think, if this is
Speaker 1: that big of a problem, surely there has to be
Speaker 1: some measure you can take to kind of curtail this problem.
Speaker 1: Because what you're telling me, right, now is that your
Speaker 1: service isn't good enough for me to rely upon all
Speaker 1: the time because there are people who are leveraging it
Speaker 1: to try and take advantage of me. That's not a
Speaker 1: great marketing message right now. The use of numbers that
Speaker 1: are similar to your own typically gets called neighbor spoofing
Speaker 1: or neighborhood spoofing, and it's a pretty irritating tactic. Uh.
Speaker 1: It's also possible that someone could spoof your phone number
Speaker 1: while they are calling someone else. So for them, it's
Speaker 1: going to come up on color I D that you're
Speaker 1: the person making the call. Right, it's gonna be your
Speaker 1: phone number, even though you're not the one doing it.
Speaker 1: It's because it's been spoofed. So the question is what
Speaker 1: do you do if that happens to you. You are
Speaker 1: not going to like the answer, because there's not much
Speaker 1: you can do other than try to explain to anyone
Speaker 1: who's calling you up angry that you're making these calls
Speaker 1: that you're not the one making the calls that are
Speaker 1: upsetting them. That's kind of difficult to get across because
Speaker 1: people are looking at their color I D and saying, no,
Speaker 1: I see on my I D that you are the
Speaker 1: one calling me. I'm telling you to stop and your
Speaker 1: might Meanwhile you're trying to say no, no, I promise
Speaker 1: it's not me. Someone is spoofing my phone number. Depending
Speaker 1: upon the person on the other end of the line,
Speaker 1: they might not have any idea of what that means
Speaker 1: or even know that that's possible. Now, I've had this
Speaker 1: happened to me in the past, however, not on my
Speaker 1: personal phone. So many years ago, I was working at
Speaker 1: a consulting firm and I was getting calls from a
Speaker 1: woman who was angry that I was calling her and
Speaker 1: I was making these crazy machine noises into her phone.
Speaker 1: Now I figured out that what was happening was that
Speaker 1: some fax machine was calling her landline as if it
Speaker 1: were another fax machine, and since her phone is not
Speaker 1: a fax machine, she was just getting that garbled electronic
Speaker 1: mass of sounds whenever she picked up the receiver. And
Speaker 1: she said that the number that was associated on color
Speaker 1: I D belonged to the company I worked for. So
Speaker 1: I had her read me the number, and sure enough,
Speaker 1: it was our offices main phone number, but it wasn't
Speaker 1: our facts number. It wasn't the number for the fax
Speaker 1: machine we had. And I even went over to our
Speaker 1: fax machine, and I used a report to generate a
Speaker 1: report that told me about all the outgoing calls that
Speaker 1: had been made, every single facts that had been sent.
Speaker 1: And this was in a day where we still facts
Speaker 1: occasionally anyway, And I checked it against this woman's number,
Speaker 1: and I saw there was no call from our fax
Speaker 1: machine going out to her number. There was nothing coming
Speaker 1: out from our office that was going to her. But
Speaker 1: it appeared as though someone had been spoofing our offices
Speaker 1: phone number for facts no less, and was sending out
Speaker 1: stuff to people like this woman. And there wasn't anything
Speaker 1: I could do about it, because we had nothing to
Speaker 1: do with the situation in the first place. We were
Speaker 1: victims just as she was. Someone else had picked our
Speaker 1: number to use a mask for some reason, and because
Speaker 1: the voice system they were using allowed for this kind
Speaker 1: of thing, there was really no way for us to
Speaker 1: even know who was doing it, much less stop them.
Speaker 1: It was frustrating for the woman, and it was not
Speaker 1: super great for me either, because I genuinely wanted to
Speaker 1: help her. I don't want anyone to be, you know,
Speaker 1: aggravated and harassed in this way, and that really stinks, right,
Speaker 1: I mean, if someone makes use of your number and
Speaker 1: then harasses another person. You could be left holding the
Speaker 1: bag and your defenses it wasn't me. Someone spoofed my
Speaker 1: phone number. That is pretty hard to prove to someone
Speaker 1: unless you can actually show them that your phone did
Speaker 1: not make those outgoing calls by just showing them a
Speaker 1: record of every call you've made over you know, whatever
Speaker 1: length of time. But more frequently we find ourselves on
Speaker 1: the receiving end of these calls, which I guess we
Speaker 1: should be thankful for because it's irritating, but not as
Speaker 1: irritating as being blamed for them. And the frequency of
Speaker 1: these calls have picked up the pace over the years.
Speaker 1: Now twenty twenty was actually a bit of an outlier.
Speaker 1: We saw a dip and spoofed robo calls in but
Speaker 1: in June there were more than four billion robo calls.
Speaker 1: So it's not like that's a problem that's gonna go away.
Speaker 1: I mean, that's nearly a hundred fifty million robo calls
Speaker 1: per day. That being said, the FCC and major phone
Speaker 1: carriers are trying to fight back a bit. The f
Speaker 1: c C passed a mandate, actually Congress passed the law
Speaker 1: that requires all the major carriers in the US, those
Speaker 1: being A, T and T, Verizon Anti Mobile, to comply
Speaker 1: with the rule that requires them to incorporate a technology
Speaker 1: called stir slash shaken, which is very James Bondish, you know. Now.
Speaker 1: The idea behind this is that stir slash shaken is
Speaker 1: supposed to verify that a number that pops up on
Speaker 1: Color I D is in fact the number that belongs
Speaker 1: to the line that's making that phone call in the
Speaker 1: first place. In other words, it's supposed to help detect spoofing.
Speaker 1: It would mean that phone company as could filter calls
Speaker 1: and potentially block some of them, or at least label
Speaker 1: them as spam before they get to your your phone. Now,
Speaker 1: those three carriers have said that they have all enabled
Speaker 1: this technology on their own networks, which is good because
Speaker 1: the deadline for doing so was this past June. To
Speaker 1: be precise, Smaller regional carriers in the United States currently
Speaker 1: have a deadline of June three to implement this technology,
Speaker 1: though that could change. The FCC might step up that deadline.
Speaker 1: So what's going on with this technology? Well, first let's
Speaker 1: talk about what these names stand for. Though I suspect
Speaker 1: there's some backronym shenanigans going on here. That is that
Speaker 1: you know, they came up with the names and then
Speaker 1: tried to figure out what they stood for, as opposed
Speaker 1: to the other way around. Anyway, STIR stands for Secure
Speaker 1: Telephony Identity revisited and SHAKEN stands for secure handling of
Speaker 1: a sorted information using tokens. So the Ken part of
Speaker 1: SHAKEN comes from tokens. And you cannot convince me that
Speaker 1: this wasn't some crazy backronym thing. Anyway, these two technologies
Speaker 1: work in tandem. SHAKEN is honestly just sort of a
Speaker 1: broader thing. We'll get to it. So STIR comes out
Speaker 1: of a working group of the organization i e. T
Speaker 1: F that stands for Internet Engineering Task Force. The group
Speaker 1: figured out a way to append digital signatures on a
Speaker 1: call as a means of authenticating that a call comes
Speaker 1: from a specific phone number for real zes. SHAKEN refers
Speaker 1: to the standards that service providers are supposed to follow
Speaker 1: while they're deploying STIR in their networks. So SHAKEN really is,
Speaker 1: here's how you use this technology that is STIR. The
Speaker 1: protocols give three levels of attestation that carriers can assign
Speaker 1: to a call or serve providers, I think is how
Speaker 1: they were. The service providers can assign to a call,
Speaker 1: so full attestation means that the service provider has a
Speaker 1: call originating out of their service and they say that
Speaker 1: that call is in fact coming from a number that
Speaker 1: this particular customer is authorized to use, so in other words,
Speaker 1: it's legit. Then you have partial atestation, and that means
Speaker 1: that the carrier has authenticated the customer making the call.
Speaker 1: They're saying, we know who is making the call. However,
Speaker 1: we cannot verify that this customer is actually authorized to
Speaker 1: use the number in question. Then there's gateway at a
Speaker 1: station means that the service provider can authenticate where it
Speaker 1: received a call, but can't authenticate the source, can't say
Speaker 1: who for certain sent it. The information is meant to
Speaker 1: be shared between carriers, so that one carrier can essentially
Speaker 1: say to another, hey, here's this call that needs to
Speaker 1: go over your network to get to your customer, But
Speaker 1: I totes can't verify that the call is legit, so
Speaker 1: it maybe suss just a heads up, and then your
Speaker 1: carrier might block the call or appenda label, alerting you
Speaker 1: the d customer that the call could be spam. The
Speaker 1: way this works in practice is you've got someone making
Speaker 1: a call. Let's say it's Scuzzy scumbag who's posing as
Speaker 1: a member of the Internal Revenue Service, but Scuzzy really
Speaker 1: just wants to phish personal information out of you. Scuzzy
Speaker 1: picks up the phone or more likely uses an automated
Speaker 1: robo dialer and calls your number and spoofs their own
Speaker 1: number in the process to make it seem as if
Speaker 1: it's the I r S calling you. The call goes
Speaker 1: out over scuzzies service provider, whomever that may be. The
Speaker 1: service provider takes a look at the originating number and
Speaker 1: the source of the call to determine what level of
Speaker 1: attestation to assign to that call. Then it makes use
Speaker 1: of an authentication service to create a digital certificate that
Speaker 1: holds onto this information, then passes both the call and
Speaker 1: the certificate on so that it ultimately ends at the
Speaker 1: terminating service provider. This would be whatever service provider you use.
Speaker 1: So let's say it's like a T and T, So
Speaker 1: now it gets sent to a T and T. So
Speaker 1: a T and T. Your service provider, upon receiving this
Speaker 1: signal and digital certificate, sends the certificate to a verification
Speaker 1: service which attempts to verify if the originating source of
Speaker 1: the call is authorized to make calls from that number
Speaker 1: it claims to be calling from. Then it returns this
Speaker 1: information to a T and T and then a T
Speaker 1: and T can either block the call or label it
Speaker 1: or pass it on to you. So this approach is
Speaker 1: not like a catch all for all robo calls and
Speaker 1: spam or even for spoofing. It's not going to put
Speaker 1: an end to it, but it is meant to help
Speaker 1: cut back on those practices. There are other companies trying
Speaker 1: to address this issue in other ways. There are companies
Speaker 1: that have blocking services that you can use, there's the
Speaker 1: Do Not Call registry that you can be part of,
Speaker 1: and then companies like Verizon are trying something different. Like
Speaker 1: Verizon has introduced an updated call filter app that will
Speaker 1: send suspected spam calls that appear to have phone numbers
Speaker 1: from your area straight to voicemail. So, in other words,
Speaker 1: those neighborhoods spoofing calls would never even make your phone ring,
Speaker 1: it would go straight to your voicemail. Of course, this
Speaker 1: means that if there is someone from your region who
Speaker 1: is actually trying to call you, for real z s,
Speaker 1: they might end up going straight to voicemail too. Now
Speaker 1: you can go into the apps filter settings and turn
Speaker 1: those off for specific numbers, so it's not like, you know,
Speaker 1: it's an all or nothing, but it does mean that
Speaker 1: at least in some cases, there might be more hands
Speaker 1: on work for the consumer to get everything to work
Speaker 1: out properly. Now, I think we will continue to see
Speaker 1: companies and governments really try to crack down on this
Speaker 1: practice because it's so irritating. Like the people in charge
Speaker 1: don't like it either, right, Politicians do not like robo
Speaker 1: calls and spam because it affects them too, and so
Speaker 1: we're likely to see more strides taken to try and
Speaker 1: combat it. At the same time, we'll see the people
Speaker 1: who are making use of it try and find ways
Speaker 1: around the system. So it's going to be a c
Speaker 1: saw kind of approach, and it's certainly an irritating one.
Speaker 1: So if like me, you treat your phone like it's
Speaker 1: a way to send email and text and that's it,
Speaker 1: or maybe occasionally, you know, look at pictures of cats,
Speaker 1: then you're in good company. Because this approach of robo
Speaker 1: calls and spoofing has really created a an environment of
Speaker 1: distrust with our communication devices, so much so that the
Speaker 1: companies in charge of providing those services are saying, yeah,
Speaker 1: kind of stinks, dotting it and saying like, yeah, you
Speaker 1: should probably not pick up the phone. And again, they're
Speaker 1: the ones providing the service to allow you to get
Speaker 1: calls in the first place. It's not great, but that's
Speaker 1: kind of you know how technology can be, right, It's
Speaker 1: we can create these amazing tools that open up incredible
Speaker 1: potential possibilities. But it also means that people who are
Speaker 1: looking at the system from a different perspective may find
Speaker 1: ways to twist it to benefit themselves at the expense
Speaker 1: of the rest of us, which again kind of stinks.
Speaker 1: So yeah, this is one of those topics where while
Speaker 1: I say I love all things tech, I don't love spoofing.
Speaker 1: I think it's uh. At best, it's misleading, and at
Speaker 1: worst it is it is a predating upon vulnerable populations,
Speaker 1: which I don't think is cool at all. But that
Speaker 1: wraps up this episode. If you have suggestions for topics
Speaker 1: I should cover in future episodes of tech Stuff, reach
Speaker 1: out to me. The best way to do that is
Speaker 1: over on Twitter. The handle for the show is text Stuff,
Speaker 1: H s W and I'll talk to you again really soon.
Speaker 1: Y tex Stuff is an I Heart Radio production. For
Speaker 1: more podcasts from my Heart Radio, visit the i heart
Speaker 1: Radio app, Apple Podcasts, or wherever you listen to your
Speaker 1: favorite shows.