STIR/SHAKEN Display Implementation and Evolution October 19, 2018 Chia Li, Comcast

Let’s Work Together to Advance Consumer Awareness and Acceptance Follow ATIS Display Framework Guidelines and take a step forward to nail down implementation “in an effort to accelerate the reach of Verified Caller ID across analog devices in IP networks, service providers can evaluate the use of conventional CNAM as a vehicle for relaying verification status to the consumer. “ While there are devices like OTT apps that can present more information, such as red cross or green check marks, a majority of land-line phone users still rely on the 15-character display for caller identity. The invitation: Let’s join force for unified customer experiences to promote awareness and adaptation Agree on a common 15-character display Agree on icons(minimum) and text strings for smart device display Share customer feedback from trial/deployment Review the feedback and agree on revision if necessary Work with FCC/FTC for consumer awareness/promotion Take into considerations of different stages of STIR/SHAKEN adaptation Initially during the adaptation phase Do not disturb end-user experience initially for calls with failed or no Identity headers Provide positive indication of authentic callers to help restore customer trust Eventually reaching the mature phase Reflect identity check results, positive, negative, or no verification, in a well-defined and easy-to-understand way Reject calls without valid Identity headers upon FCC rulings Analytics continue to play a key role in categorizing and scoring of the purpose/intention of calls. Privacy should be preserved with calling number authenticity indication.

X V ? [V]John Doe [X]John Doe [Q]John Doe Consistency of STI status indicators between icons and characters X V ? [V]John Doe [X]John Doe [Q]John Doe

STI Display Proposal – A Character-based Approach Call ID Status Legacy Phone 15-char LED Display Smartphone/OTT Client STI present; Failed verification John Doe STI not present Successful verification [V]John Doe Identity Verified Scam/Spam per analytics <SPAM>John Doe Spam Likely Anonymous w/STI failed or no STI Anonymous Anonymous w/STI verified [V]Anonymous <X,Q,V> in square brackets to signify STI status 12 characters left for CNAM Stronger visual effect and easier explanation Allow readable STI status and address the vision-impaired needs STIR/SHAKEN Adaptation Phase <SPAM>: A spam warning text string per SP’s choice

STI Display Proposal – A Character-based Approach Call ID Status Legacy Phone 15-char LED Display Smartphone/OTT Client STI present; Verification failed (Not scam per analytics) [X]John Doe (or phone #) Identity Invalid STI not present; No verification [Q]John Doe Identity Unverified STI present; Verification succeeded [V]John Doe Identity Verified Scam/Spam per analytics <SPAM>John Doe Spam Likely Anonymous; STI failed [X]Anonymous Anonymous; no STI [Q]Anonymous Anonymous; STI passed [V]Anonymous STIR/SHAKEN Mature Phase <SPAM>: A spam warning text string per SP’s choice

Additional Considerations LIDB sanitization process Make sure STIR/SHAKEN indicators are not included Extra attention to get down to 12 CNAM? Multiple layers of defense against spoofing STIR/SHAKEN indicators SP subscriber provisioning process SBC screening LIDB screening STI-VS screening End user device enhancement for talking call ID

Example Displays with STIR/SHAKEN Verified

The Necessity of Presenting Verification Results to End Users “verstat” by design is already signaled to the end users of smart devices. ATIS already agreed to provide positive indication for anonymous calls when they pass verification. There are specific use cases, e.g., a victim calling shelters. Consumer phone experience is already at ground zero. People do not answer their phones and do not trust calling numbers. Positive indication would be a confidence builder to begin restoration of the trust. Power of analytics has been weakened significantly by the prevalence of neighborhood spoofing. A positive indicator can help end users tell them apart. If we withhold authenticity indication from the end users, what’s the use of STIR/SHAKEN?