Requires providers of voice service to implement the STIR/SHAKEN authentication framework in the internet protocol networks of voice service providers.
NEW YORK STATE ASSEMBLY MEMORANDUM IN SUPPORT OF LEGISLATION submitted in accordance with Assembly Rule III, Sec 1(f)
BILL NUMBER: A585A
SPONSOR: Paulin TITLE OF BILL:
An act to amend the general business law, in relation to requiring
STIR/SHAKEN authentication framework
PURPOSE OR GENERAL IDEA OF BILL:
Requires providers of voice service to implement the STIR/SHAKEN authen-
tication framework in the Internet protocol networks of voice service
providers.
SUMMARY OF SPECIFIC PROVISIONS:
Section one of the bill adds a new Section 399-z-1 to the general busi-
ness law to require providers of voice service to implement the
STIR/SHAKEN authentication framework in their internet protocol networks
and sets forth penalty and enforcement provisions for non-compliance.
Section two provides the effective date.
JUSTIFICATION:
Unwanted robocalls are the top consumer complaint received by the Feder-
al Communications Commission (FCC), representing over sixty percent of
all complaints received.* It is estimated that Americans received about
16.3 billion robocalls in the first five months of 2018 alone. ** In the
month of September 2018, roughly 4.4 billion robocalls were reported.***
These numbers continue to rise and the predictions for the expected
number of robocalls in the coming year are staggering. In 2017, only
about 3.7% of all calls to cell phones were considered to be robo-
calls.**** In 2018, that number rose to about 29% and by 2019, it is
expected that at least 45% of-all calls to cell phones will be robo-
calls.*****
Many of these calls are coming from numbers that actually do not or
cannot make outgoing calls.******* These types of numbers are indicative
of "spoofing" schemes wherein the true caller identity is masked behind
a fake, invalid number. There is also a common practice of consumers
receiving calls from such invalid numbers which show up as a local call
on their caller ID, prompting many to pick up only to realize it is a
robocall.
The STIR/SHAKEN authentication protocol uses cryptography to validate
that a call is really from the number it displays, preventing bad actors
from illegally "spoofing" phone numbers. STIR/SHAKEN also makes it much
easier to trace illegal calls back to their source, since each call will
. have-an identification assigned to it. Once the source is identified,
enforcement actions can be taken against the perpetrators.
The Federal Communications Commission, pursuant to the federal TRACED
Act, issued a rule on March 30, 2020, to require providers to implement
STIR/SHAKEN by June 30, 2021. This bill will give the New York Attorney
General and Public Service Commission the ability to enforce and police
the implementation of the system against telecom providers in this
state.******
In addition, all voice providers must implement STIR/SHAKEN in order for
it to be effective, otherwise there will be holes in the telecommuni-
cations system that bad actors can exploit to continue to "spoof"
numbers and avoid detection. Despite federal requirements, many small
providers have not adopted STIR/SHAKEN and scammers have begun to origi-
nate calls on those providers' networks to avoid authentication and
detection. By mandating implementation of STIR/SHAKEN by all voice
providers in New York, we can prevent this.
PRIOR LEGISLATIVE HISTORY:
2020: A.7759C, passed Assembly / S.5926B, amended and recommitted to
energy and telecommunications.
2019: A.7759C, amended and recommitted to corporations, authorities and
commissions / S.5926B, referred to energy and telecommunications.
FISCAL IMPLICATION:
None.
EFFECTIVE DATE:
This act shall take effect immediately. * See FCC press release- FCC
Adopts Rules to Allow Phone Companies toProactively Block Illegal Robo-
calls. November 16, 2017. See also "The FCC's Push to Combat Robocalls &
Spoofing." https://www.fcc.gov/aboutfcc/fcc-initiatives/ fccs-push-com-
batrobocalls-spoofing ** See https://www.cnbc.com/2018/06/06/ ameri-
cans-got-l6-billion-robo-calls- this-year-heres-how-to-stopthem.html ***
See https://www.consumerreports.org/ robocalls/bestwaystofightrobocalls/
**** See https://www.washingtonpost.
com/technology/2018/09/19/nearlyhalf-cellphone-calls- will-bescams-byre-
port-says /?utm term=. 6dcOeb2b0198 ***** Id. ******See
https://www.fcc.gov/document/fcc-mandates-stirshaken-combatspoofed-roboc
alls
STATE OF NEW YORK
________________________________________________________________________
585--A
Cal. No. 36
2021-2022 Regular Sessions
IN ASSEMBLY(Prefiled)
January 6, 2021
___________
Introduced by M. of A. PAULIN, OTIS, FAHY, GRIFFIN, WALLACE, VANEL --
read once and referred to the Committee on Corporations, Authorities
and Commissions -- reported and referred to the Committee on Codes --
reported from committee, advanced to a third reading, amended and
ordered reprinted, retaining its place on the order of third reading
AN ACT to amend the general business law, in relation to requiring
STIR/SHAKEN authentication framework
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The general business law is amended by adding a new section
2 399-z-1 to read as follows:
3 § 399-z-1. STIR/SHAKEN authentication framework. 1. As used in this
4 section, the following terms shall have the following meanings:
5 (a) "STIR/SHAKEN authentication framework" means the secure telephone
6 identity revisited and signature-based handling of asserted information
7 using tokens standards proposed by the information and communications
8 technology industry.
9 (b) "Voice service" means any service that is interconnected with the
10 public switched telephone network and that furnishes voice communi-
11 cations to an end user using resources from the North American Numbering
12 Plan or any successor to the North American Numbering Plan adopted by
13 the public service commission under section 251(e)(1) of the Communi-
14 cations Act of 1934 (47 U.S.C. 251(e)(1)); and includes:
15 i. transmissions from a telephone facsimile machine, computer, or
16 other device to a telephone facsimile machine; and
17 ii. without limitation, any service that enables real-time, two-way
18 voice communications, including any service that requires internet
19 protocol-compatible customer premises equipment (commonly known as
20 "CPE") and permits out-bound calling, whether or not the service is
21 one-way or two-way voice over internet protocol.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD01131-02-1
A. 585--A 2
1 2. Not later than twelve months after the effective date of this
2 section, the public service commission shall require a provider of voice
3 service to implement the STIR/SHAKEN authentication framework or alter-
4 native technology that provides comparable or superior capability to
5 verify and authenticate caller identification in the internet protocol
6 networks of voice service providers.
7 3. (a) Any voice service provider that knowingly fails or neglects to
8 comply with this section, or a rule or regulation adopted thereunder,
9 shall forfeit to the people of the state of New York a sum not less than
10 ten thousand dollars and no more than one hundred thousand dollars
11 constituting a civil penalty for each and every offense and, in the case
12 of a continuing violation, each day shall be deemed a separate and
13 distinct offense.
14 (b) Notwithstanding any other provision of law, rule, or regulation, a
15 voice service provider shall be considered to be in compliance with this
16 section and any rule or regulation adopted thereunder if that provider
17 has filed a certification with the Federal Communications Commission
18 that the provider's traffic is either signed with STIR/SHAKEN or subject
19 to a compliant robocall mitigation program. A copy of such certification
20 shall be made available to the attorney general or the public service
21 commission, upon request.
22 4. Whenever there shall be a violation of this section, an application
23 may be made by either (a) the attorney general in the name of the
24 people of the state of New York, or (b) in the case of a voice service
25 provider subject to the jurisdiction of the public service commission,
26 to a court or justice having jurisdiction, to issue an injunction, and
27 upon notice to the defendant of not less than five days, to enjoin and
28 restrain the continuance of such violations, and for the enforcement of
29 the penalties provided in this section.
30 5. When the department of public service has reason to believe a
31 person or voice service provider has violated any provision of this
32 section, the department may request in writing the production of rele-
33 vant documents and records. If the person upon whom such request was
34 made fails to produce the documents or records within fourteen days
35 after the date of the request, the department may issue and serve
36 subpoenas to compel the production of such documents and records. If any
37 person shall refuse to comply with a subpoena issued under this section,
38 the department may petition a court of competent jurisdiction to enforce
39 the subpoena and, notwithstanding any other provision of law, to request
40 a civil penalty not to exceed one thousand dollars per day, actual
41 damages sustained by reason of the failure to comply, and such sanctions
42 as the court may direct.
43 6. The public service commission and the department of public service
44 may promulgate rules and regulations to implement and enforce the
45 provisions of this section.
46 § 2. This act shall take effect immediately.
