A kafkaesque nightmare - The history of STIR/SHAKEN and small carriers in Canada

Earlier today I had the honour of presenting a talk at Risk and Assurance Group (RAG) conference in New Orleans on the history of STIR/SHAKEN in Canada from the perspective of smaller providers.  RAG doesn't webcast its conferences, so instead I'm posting the text of talk below.  For people who've been following my blog none of this will be new, but I think it's a nice overview of the events of the past five years.  The conference itself has been great and I'm very thankful to the people at RAG to be able to share the Canadian SHAKEN/STIR experience with them.

Good afternoon RAG participants.

My name is Matthew Gamble, and I am technology consultant by day and vice-chair of the Internet Society Canada Chapter by night. I’d like to thank the organizers for inviting me here today to provide some insight into the Canadian experience with STIR/SHAKEN.

Without spoiling too much, the experience over the past 5 years has been extremely frustrating and challenging for smaller Canadian carriers.  It is a story of failures on multiple levels but mainly a failure of the regulator and the incumbent carriers to realize the value that smaller carriers bring to the Canadian telecommunications ecosystem.

But before I dive into the details, a word about who we are. The Internet Society, Canada Chapter,  is a volunteer organization dedicated to advocating for affordable, open, and secure internet access for all Canadians. Our focus is to bridge the digital divide by ensuring all Canadians reap the socio-economic benefits that the internet provides.  So you might be asking yourself, what does the Internet Society have to do with in-the-weeds telephony standards like STIR/SHAKEN?  Much like the other issues we get involved in, our board saw great parallels between the regulatory challenges faced by smaller internet providers and those faced by smaller telecommunications providers.   And since there isn’t much distinction between a modern IP voice network and the internet at large, we decided this was an issue worth fighting for.

For those not familiar with the history of Canadian telecommunications, the move from monopoly to competition came to the Canadian market in the late 1990s.  Since that time there has been significant innovation in the telecommunications space driven by service providers that are not traditional incumbents.

With this deregulation came the commoditization of basic voice services, which in turn drove down wholesale prices, and with that the value proposition for a service provider to become a CLEC waned.  Becoming a LEC in Canada today has more downsides than upsides, unless you really, really love building physical TDM networks.

For example, when I joined EGATE Networks in 2016, they were in the early stages of becoming a CLEC.  When I did the cost/benefit analysis it didn’t make any sense for an organization with no experience operating a TDM network to build one – it was a more effective use of capital to not build their own TDM network, but rather to make strategic deals with existing CLECs and get services over IP.  By focusing on what they did well, which was building IP networks, instead of building out physical TDM networks, EGATE was able to quickly bring a wide portfolio of voice services to a nationwide market.

Recently I have been working with a startup voice service provider in Canada who doesn’t even have a single piece of physical equipment – everything is cloud based.  This lack of facilities doesn’t make these non-LECs lesser or inferior telecommunications providers.  It absolutely makes sense for a business to focus on where it can add value rather than overbuilding traditional physical services.  These providers are examples of companies that are the leading edge, driving innovation and new service delivery models – and to bring this full circle – have been left out in the cold since 2017 when it comes to SHAKEN/STIR.

The CRTC, the Canadian telecommunications regulator, was led in 2017 by a very pro-consumer chair, Jean-Pierre Blais.  The Globe and Mail called him "the regulator who speaks truth to power."  Maclean’s Magazine said he was "perhaps a surprisingly consumer-friendly regulator." The Toronto Star described a man who "really wants to hear what the public has to say."

During his 5 year tenure, he focused on trying to find ways to deal with the concerns raised by Canadians. Robocalls, duct cleaning calls, and other nuisance calls were always on the top of the list of consumer complaints.   In this light, SHAKEN/STIR must have appeared like a preverbal silver bullet  –  just flip a magic switch, the unwanted calls will stop, and consumers will sing your praises from the rooftops.

Telecom service providers of all sizes knew that it wasn’t so simple – even if they wished it were – and they raised numerous concerns related to readiness, access, and adoption. One warning – which I have to admit was on the money – I raised on behalf of the VoicePeering project. This was the concern that the ATIS forum and FTC Robocall Strike Force had limited SHAKEN/STIR only to carriers with operating carrier numbers.  If Canada adopted a similar model, we warned, it could leave smaller players out of the framework.  Taken to the logical conclusion, leaving smaller telcos out of the process would lead to a two tiered world – those who can sign and those who cannot. If this came to pass, the result would be dire - businesses and consumers would eventually be forced to migrate away from smaller providers and years of gains and innovation from competitive service providers would be lost.

In the same submission we also strongly suggested that the Commission investigate the creation of a Canadian taskforce, that would be open to participation by all relevant stakeholders in Canada to work on refining the specifications for the Canadian market, including working with parties such as ATIS/SIP Forum and IETF as appropriate.

Outside of our submissions, virtually all telecom service providers agreed that the technology was promising, but it was far too early for mainstream adoption. Canada’s major carriers noted that “the STIR/SHAKEN solutions suite has yet to be fully ratified, and there are no products commercially available for evaluation and testing”  In other words, SHAKEN/STIR may be a promising technology, but wasn’t ready for prime time.

All of these comments fell on deaf ears.  In a 2018 decision, the CRTC ignored the concerns and issues raised by everyone and instead set an implementation date of March 2019.  Industry be damned they said, we’re going to give consumers what they want.

After that decision, the implementation of SHAKEN/STIR was referred to the CRTC Interconnection Steering Committee (CISC) for implementation planning - where the technical is intertwined with regulatory and any decision moves at the speed of snail.  With a pending implementation date, we again raised the point about access to certificates for smaller carriers and we were told that was a policy decision and out of scope for a technical body.  For the technical implementation the larger carriers were sticking by the ATIS/FCC guidance that only carriers with OCNs could participate.  Not our problem they said, this is what the ATIS standard calls for. Our fears of a two tiered world were starting to become real.
The next blow to smaller carriers came in a 2019 CRTC decision where the CST-GA was given the authority to be the Governance Authority for Canada.   The CST-GA is an organization formed by incumbent Canadian carriers based off the existing number portability association, the CLNPC, an organization open only to those who participate in number portability.   In other words, people with access to phone numbers.

There was no public process on who should run the governance authority for Canada, or what its operating model should look like.  The CRTC just handed the role over to an incumbent-built organization without any public consultation. From its inception, the CST-GA ignored the original CRTC directive that SHAKEN/STIR "should be implemented by Canadian telecommunications service providers (TSPs)".  and instead insisted that only carriers with access to numbering resources should be allowed to participate.  Now the smaller carriers were really in a kafkaesque situation – they had a regulatory obligation to implement STIR/SHAKEN but were now being told by the governance authority they could not participate.

From 2019 onwards the ISCC and others continued to re-iterate our point about access at every opportunity, including raising it with the CRTC in 2019, and again in March 2020 in front of the Canadian Parliament’s Standing Committee on Industry and Technology.  Once again nothing was done, as the CRTC push to implement SHAKEN/STIR kept blindly moving forward.  I felt like Don Keyotee tilting at windmills.

Hope came in December 2020, when Mitel filed an appeal to the CRTC through a part one application in which it requested the Commission instruct the CST-GA to follow the original CRTC directive and allow all TSPs be able to receive certificates.  And we waited with bated breath – the CRTC is a notoriously slow organization.  We often call it regulation at sloth speed.

A decision in the Mitel application came in Aug 2021 and finally smaller players were allowed to obtain certificates.  TSPs were finally out of their Kafkaesque situation around obtaining certificates, but were now faced with the high capital costs of having to upgrade network equipment in a very short time frame to comply with the SHAKEN/STIR deadline of November as well as the costs of joining the CST-GA. While the true costs are shrouded in NDAs, Industry sources indicate the yearly fee for CST-GA membership starts in the $15k range for non-carriers, regardless o the size of the organization.  For a smaller TSP this fee could be a significant portion of revenues in a year. Contrast this with the United States, where the GA fees are based on revenues, with the smallest providers paying only $825 USD per year. Why the discrepancy? The costs with managing signed certificates is a solved problem from a technology perspective with one of the largest signing systems being given away for free. How does managing the administration of an organization in a country 1/9th the size cost such a magnitude higher?

So where are we today?  Almost no non-LECs have been onboarded to the SHAKEN/STIR ecosystem.  There are hundreds of registered telecommunications resellers, but only 5 have obtained a certificate from the CST-GA despite it being a condition of service.

So how did we get here?  Smaller carriers, who are generally 100% IP based, were in the best position to implement SHAKEN/STIR first, yet the industry and regulator failed to allow smaller carriers to do what they do best – innovate.  When an organization was needed to run the GA function, the federal regulator ignored offers from existing players in the internet space to manage the GA and instead let the incumbents build it themselves for their benefit.  And for five years the regulator ignored feedback from the industry that smaller carriers were being left out of the process.

For this implementation to be successful the CRTC should have actively engaged all stakeholders to ensure they are represented.  And when smaller carriers and organizations did participate, the regulator should have listened to and addressed their concerns rather than saying nothing.  The fact that someone had to file an appeal to clear up the obvious ambiguities about who can get certificates is inexcusable.

Over the next few months we hope to see an uptake in adoption by smaller carriers but I'm not holding my breath - until we find a way to bring smaller carriers to the table as equal partners in the solution the adoption rates will continue to languish.  This isn’t a story of a technology failure, but rather a failure of a regulatory body obsessed with getting a perceived “win” for consumers without taking the time to address stakeholder concerns.

Or maybe the situation is worse. Maybe the regulator fails to see that smaller players – who function without large scale facilities - are legitimate stakeholders at all. That might be the more ominous explanation for its telecom decisions of late.

Thank you for your time and I’ll be happy to answer any questions you may have.