There has been an increase in spoof calls in recent times.
What is Caller ID Spoofing?
- About: Caller ID spoofing is a technique with which the phone number that a call appears to originate from can be falsified.
- On a technical level, caller ID spoofing is not difficult to perform. Spoofing techniques have been honed by enthusiasts, telemarketers, and fraudsters alike, over the years.
- Reason for Caller ID Spoofing:
- Shielding Identity: Malicious individuals use caller ID spoofing primarily to shield their identity when engaging in illicit activity.
- Social Engineering: At times, caller ID spoofing is used by these individuals to carry out social engineering attacks, where the spoofed caller ID is abused for the implicit trust that the receiving party associates with it.
- Circumventing Call Blocking: Caller ID spoofing can also be used to circumvent standard call blocking systems
- Exploiting IVR Systems: It can be used to exploit vulnerabilities in insecure Interactive Voice Response systems.
- Legal Status: Caller ID spoofing in itself is perfectly legal in many jurisdictions
- As a result of this several companies offering caller ID spoofing services to customers around the world have popped up over the years, with the first commercial caller ID spoofing service launching in 2004.
- Concern: Telecommunication carrier providers lose revenue, customers which might be defrauded because of a scam call abusing a spoofed caller ID lose money, and regulation enforcement has a harder time investigating crimes wherein spoofed caller IDs are used.
Enroll now for UPSC Online Course
Impact Of Fixing The Problem
- Fixing the technical and implementation problem of caller ID spoofing will have an outweighed impact for all stakeholders.
- For consumers: Fixing caller ID spoofing will reduce spam and fraud calls, and will completely eliminate fraud that relies on false representation of one’s identity via phone number.
- For telecommunications providers: It will save revenue that would otherwise be lost
- For the Government and therefore the public: It would result in revenue that would contribute to the Indian economy.
PKI (Public Key Infrastructure) authentication
- It operates by using a certificate to verify data transferred between two points.
- Individuals possess a public and private key – in PKI Certificate-Based Authentication (CBA), the public key is distributed and employed to confirm the sender’s identity and to decode the data
|
Measures to Tackle Spoof Calls
- International Telecommunications Union (ITU) Report: In 2021, the ITU published a technical report on countering caller ID spoofing.
- PKI based authentication: While this report does not have any mandatory provisions, it does provide a reference using Public Key Infrastructure (PKI) based authentication which could be implemented by Indian telecom operators to fix caller ID spoofing for good.
Check Out UPSC CSE Books From PW Store
About International Telecommunications Union (ITU)
- International Telecommunications Union (ITU) is a special UN agency focused on improving and standardising global information and communication technologies.
- Founded in: It was originally established as the International Telegraph Union in 1865, much before the UN existed
- Area of Work:
-
- Provide International connectivity in communication networks,
- Allocate global radio spectrum and satellite orbits,
- Develop the technical standard,
- Improve access to digital technologies
- Members: 193 Member States and more than 1000 companies, universities and international and regional organizations.
- India has been a member since 1869 onward.
- Headquarters: Geneva, Switzerland
- Report: Global Cybersecurity Index
|
- Telecom Regulatory Authority of India (TRAI) Recommendations: It had earlier recommended to telecom operators to integrate a system known as Calling Name Presentation (CNAP) to display caller names based on KYC documents.
- Department of Telecommunications (DoT): It is reportedly in the process of launching a pilot of the CNAP project.
- CNAP: It aims to show the caller’s name when receiving a call, similar to services like Truecaller.
- Unlike crowd-sourced services, CNAP will rely on verified information from Customer Application Forms (CAFs) filled by subscribers
- TRAI Full Form: Telecom Regulatory Authority of India
- Mandate: The Telecom Regulatory Authority of India (TRAI) has the main role of regulating the telecommunication sector in India.
- It seeks to create and nurture conditions for growth of telecommunications in the country.
- Setting Up: The Telecom Regulatory Authority of India was established in 1997 by an Act of Parliament to regulate telecom services and tariffs in India. Previously, regulation of telecom services and tariffs was carried out by the Central Government.
- The setting up of TRAI was intended to act as a harbinger for the growth of telecommunications in India and to make India have a leading role in the emerging global information society.
- Objective: TRAI aims to provide a fair and transparent environment that promotes a level playing field and facilitates fair competition in the market.
|
Challenges
- Lack of Clarity: According to news reports from May 2024, the DoT has devised a system to “identify and block” international calls with a manipulated Calling Line Identity (CLI) and has issued directions to telecom operators to prevent such calls from reaching subscribers.
- However, considering that the problem has still not been fixed, it is unclear whether the system (technical details of which have not been furnished) is effective, or if it has even been implemented.
- CNAP: Though it is not known whether CNAP will (or should) be implemented, it can be said that introducing such a system without first implementing a technical fix for caller ID spoofing will be a mistake.
- TRAI 2022 consultation paper on the project: It makes only a few mentions of caller ID spoofing, and does not provide a plan or technical measures for tackling the issue.
- It merely acknowledges in one sentence that caller ID spoofing is a problem that exists.
- Government inaction – The Telecommunications Act, 2023: It was partially notified on June 26 of this year allows the Union Government to take over control and operation of any telecommunication service or network during times of “emergency.”
- Section 20 of the Act: It empowers the Government to take “temporary possession of any telecommunication service or telecommunication network from an authorised entity” for “any public emergency, including disaster management, or in the interest of public safety.”
- The Act has received criticism for being invasive and potentially increasing surveillance powers.
- Fixing caller ID spoofing would be “in the interest of public safety” but still then the Government has not taken any action.
Enroll now for UPSC Online Classes
Way Forward
Addressing call spoofing challenges in India requires a multi-pronged approach to address the gaps in current measures and ensure a robust and effective solution.
- Enhanced Clarity and Transparency
- Technical Details Disclosure: The Department of Telecommunications (DoT) should provide detailed information about the system designed to identify and block manipulated Calling Line Identity (CLI) calls.
- This transparency will help assess the system’s effectiveness and areas for improvement.
- Regular Updates and Audits: Implement a system for regular updates and independent audits of the call blocking technology to ensure it is functioning as intended and evolving to address new spoofing techniques.
- Implementation of CNAP (Caller Name Presentation): Conduct a feasibility study and pilot projects to evaluate the potential benefits and challenges of implementing CNAP in India.
- CNAP should be introduced only after resolving the technical issues related to caller ID spoofing.
- Legislative Action and Government Involvement
- Clarify the Telecommunications Act, 2023: Address the concerns regarding surveillance and privacy by clearly defining the scope and limitations of government powers under the Telecommunications Act.
- Emergency Measures for Call Spoofing: If deemed necessary, use the emergency powers under Section 20 of the Act to address severe cases of call spoofing.
- This should be done transparently and with clear guidelines to ensure public trust and compliance.
- Public Awareness and Education: Launch national awareness campaigns to educate the public about the risks of call spoofing and how to recognize and report such incidents.
- Collaboration: Foster collaboration between telecom operators, technology developers, and regulatory bodies to share knowledge, tools, and best practices for combating call spoofing.
- International Cooperation: Engage with international bodies and other countries to share insights and strategies for dealing with call spoofing.
July 31, 2024
