11 Apr Number authentication – Key success factors
in the USA, Canada, France and the UK. – 20240408
Four years ago, I published a post arguing that the US approach to number authentication was more likely to succeed than the French approach, because the US law was much more precise than the French law, its application was better monitored by the legislator and it gave the telecoms regulator much greater powers to take precise measures to implement this technology.
Two years ago, I published a second post highlighting the stagnation of STIR/Shaken adoption in the US and expressing doubts about France’s ability to implement call barring for unauthenticated calls.
On the one hand, today, there has been little change in the US situation regarding number authentication, despite the extension of the obligation to publish a plan against illegal robocalls to small operators. On the other hand, a year late, the Fédération Française des Télécoms has published a firm timetable for the implementation of call signing by 1er June 2024 and for the drop of unauthenticated calls by 1er October 2024. But what proportion of calls will actually be affected by the introduction of authentication mechanisms?
Meanwhile, the Canadian regulator is launching a public consultation to strengthen obligations for operators to screen unwanted calls, and the UK is turning its back on number authentication, preferring measures to screen calls from abroad displaying UK numbers, as France has done since 2019.
Assuming that the commitments made by French operators are honoured, will France have achieved a more complete rollout of authentication on fixed networks by 1er October 2024 than the United States or Canada, which started the race earlier? A number of factors clearly point in this direction:
- A more ambitious law (no exemption from the obligation to authenticate for old technologies, obligation to interrupt unauthenticated calls),
- The virtual disappearance of TDM interconnection for fixed networks, which has no longer been the reference technology for fixed interconnection in France since 2011,
- French operators are used to working together to develop and implement technological solutions to regulatory requirements (portability, value-added services, emergency call location, etc.).
However, when it comes to mobile telephony, the United States is in a better position than France to implement STIR/Shaken. Two of the three major US mobile networks (Verizon Wireless and T-Mobile) have announced full implementation of STIR/Shaken, while the third, AT&T Mobility, has announced partial implementation. On the other hand, at interconnection, the four French mobile networks are all still mired in SIP-I technology, an emulation of TDM signalling in a SIP frame. Unlike SIP, SIP-I does not support STIR/Shaken technology for number authentication.
Finally, Ofcom’s decision not to impose number authentication in the UK is explained by the fact that most of the key success factors for authentication are not met in the UK.
Table 1 – Key success factors for deploying number authentication
| USA | Canada | UK | France | |
| Common database of ported numbers | Yes | Yes | No | Yes |
| Adoption of VoIP on the user side | Strong | Strong | Low | Strong |
| Adoption of SIP on the fixed interconnection side | Low | Low | Low | Strong |
| Adoption of SIP on the mobile interconnection side | Average | Low | Low | Low |
| The legislator’s ambition | Average | Average | Low | Strong |
| Involvement and ambition of the regulator | Strong | Strong | Low | Average |
1 The ambition of the law
The US law requires all operators to implement STIR/Shaken, provided their networks support the technology. If not, operators must “have (i) taken reasonable steps to implement an effective call authentication framework; and (ii) [be] capable of fully implementing an effective call authentication framework strategy by no later than [1er July 2022].” On the other hand, the US law does not impose any obligation on the incoming operator to terminate calls that are not authenticated.
In France, the law lays down a general obligation to authenticate outgoing calls and, on arrival, to terminate calls that have not been validly signed, regardless of the technology used. French law is therefore stricter. Implementation will begin in 2024, one year after the prescribed date of 25 July 2023.
In Canada, it was the CRTC, the telecoms regulator, that decided to require operators to implement STIR/Shaken, on a basis comparable to that required of them in the United States. This obligation comes into force in stages, on 30 November 2021 for standard calls, and on 31 May 2022 for emergency calls.
In the UK too, it was the regulator, Ofcom, which proposed adopting STIR/Shaken in a public consultation in 2023, but abandoned this ambition in early 2024.
2 Adoption of Voice over IP on the user side
Number authentication was designed for the SIP voice over IP standard. Although there are standards for so-called out-of-band authentication, outside SIP signalling, no significant deployment has been announced. To perform end-to-end STIR/Shaken authentication, telephone subscribers must be served by SIP technology. What is the situation in this respect in the various countries in our sample?
In the United States, 100% of subscribers to the three major mobile networks use a technology (4G or 5G) compatible with STIR/Shaken. The 2G and 3G networks have been discontinued.
Table 2 – Shutdown dates for 2G and 3G in the United States
| Country | Operator | 2G shutdown | 3G shutdown |
| United States | AT&T Mobility | 01/01/2017 | 22/02/2022 |
| United States | T-Mobile USA, Inc | 02/04/2024 | 01/07/2022 |
| United States | Verizon Wireless | 31/12/2020 | 31/12/2022 |
On the fixed-line side, 29% of US subscribers are still served by TDM technology, which is incompatible with STIR/Shaken. However, given the preponderance of mobile subscribers, 85% of subscribers (fixed and mobile) use a technology that makes end-to-end STIR/Shaken authentication possible.
Figure 1 – Technology for serving telephone subscribers in the United States
In France, on the other hand, 2G will only stop at the end of 2025 and 3G at the end of 2028 (for Orange and SFR). For Bouygues Telecom, 2G will stop at the end of 2026 and 3G at the end of 2029. Iliad/Free, which entered the market at the same time as 4G, will not be affected. As a result, 46% of mobile subscribers (2G/3G subscribers) and 12% of fixed subscribers (PSTN or ISDN subscribers) can only use TDM voice, which is not compatible with STIR/Shaken authentication. Given the dominance of mobile telephony in terms of subscriber numbers, the number of subscribers served by a technology that allows a priori end-to-end STIR/Shaken authentication is only 60% in France.
Figure 2 – Technology used to serve telephone subscribers in France
In Canada, while 2G (CDMA) was discontinued several years ago, 3G still has several years to go. Only one of the three major operators has announced that it will start phasing out 3G in March 2025. This does not augur well for rapid end-to-end deployment of STIR/Shaken on Canadian mobile networks.
Table 3 – Shutdown dates for 2G and 3G in Canada
| Country | Operator | 2G shutdown | 3G shutdown |
| Canada | Bell Mobility Inc. | 30/04/2019 | |
| Canada | Rogers | 31/12/2020 | 31/03/2025 (start) |
| Canada | Telus | 31/05/2017 |
Finally, in the UK, two operators are stopping 3G first, then 2G (EE, Vodafone), another is planning to stop 3G, but not 2G (02) and the last (Hutchison), which stopped 2G very early on, will soon stop 3G. Nor is this situation conducive to the deployment of end-to-end STIR/Shaken on UK mobile networks.
Table 4 – Shutdown dates for 2G and 3G in the UK
| Country | Operator | 2G shutdown | 3G shutdown |
| United Kingdom | EE Limited | 31/12/2025 | 31/12/2024 |
| United Kingdom | Hutchison 3G UK Limited | 01/01/2015 | 31/12/2024 |
| United Kingdom | O2 | 31/12/2025 | |
| United Kingdom | Vodafone Ltd | 31/12/2025 | 31/03/2024 |
On the fixed side, according to Frontier Economics, in 2022 the UK still had 19.5 million subscribers served by TDM technology. BT plans to have migrated all its TDM customers to IP by the end of 2025, but there are doubts as to whether this ambitious target will be met.
Table 5 – Subsistence of PSTN in 2022 in the UK (number of fixed lines)
| BT | Virgin Media | Kcom | Total | |
| Total | 15,000,000 | 4,380,000 | 165,000 | 19,545,000 |
| Business | 4,000,000 | n/a | 18,305 | |
| Residential | 11,000,000 | n/a | 146,695 |
It is therefore easy to understand why Ofcom has not made the deployment of STIR/Shaken a priority for 2024.
Note: the fact that a telephone subscriber is served by a technology other than SIP does not mean that calls from this subscriber cannot be authenticated according to STIR/Shaken, but that such authentication presupposes the presence of equipment for conversion to SIP, the usefulness of which will disappear with the technology used to serve this subscriber. Are operators prepared to spend so much on a technology that is reaching the end of its life? Is the regulator prepared to demand this in the name of the law?
3 Subsistence or disappearance of fixed TDM interconnection
On the one hand, in the United States, interconnection charges traditionally include the cost of the local loop on which the call is made. And this cost can be increased when the local loop operator in question serves a rural area. As the migration of telephone networks from TDM to IP took speed in 2015, the FCC began by issuing a symmetry rule that allowed an over-the-top VoIP provider, i.e. a provider without a local loop, to charge the same termination fee as a local TDM operator. AT&T successfully challenged this rule and in 2019 the FCC had to restrict its VoIP symmetry rule to cases where the VoIP provider is associated with the local loop operator to whose customer the call is delivered. Although this controversy has not evolved since 2019, it has significantly slowed down the migration of fixed interconnections from TDM to IP in the US.
On the other hand, since the opening up of telecommunications to competition in Europe, through a directive adopted in 1997, the European regulatory framework has excluded the cost of the local loop from interconnection charges. In Europe, any compensation between operators for their local loop costs is part of the universal service and must not affect interconnection. In 2011, when the transition to IP for telephone networks began, the French regulator, ARCEP, went further and declared that the reference technology for an efficient telephony operator was IP, which meant that the costs of IP/TDM conversion at interconnection were to be borne by the TDM operator, whether it was the offerer or the requester. As a result of these rules, the transition of fixed interconnections to IP in France is almost complete. Moreover, this transition has been made with SIP technology, which allows STIR/Shaken authentication.
4 Subsistence of non-SIP mobile interconnection
In the United States, Verizon Wireless and T-Mobile report full deployment of STIR/Shaken, while AT&T Mobility reports only partial deployment, presumably because TDM interconnections must remain. According to the FCC’s Robocall Mitigation Database, smaller mobile operators are less advanced: among the 154 US operators whose name includes “Mobil” or “Wireless”, only 42% report full implementation of STIR/Shaken, 15% partial implementation, 38% no implementation and 7% did not answer the question.
In France, the survival of older technologies (2G and 3G) has led French mobile operators to retain SIP-I technology for interconnection for the time being. This encapsulation of TDM signalling in a SIP frame does not allow STIR/Shaken authentication to be deployed.
5 Operators are used to implementing systems together
In three of the four countries in our sample (United States, Canada and France), operators are accustomed to implementing common IT systems to meet certain regulatory obligations, starting with a national database of ported numbers. However, this is not the case in the UK, where in 2008 certain operators successfully challenged Ofcom’s decision to require them to implement such a database. Signalling is used to authenticate numbers for each call, but verifying the signature of a call requires real-time consultation of a system that is difficult to imagine being totally decentralised. Ofcom made no mistake in its public consultation of 2023: Ofcom proposed a “common numbering database“, but abandoned it in early 2024.
6 Involvement of legislators, regulators and law enforcement agencies
In the United States and France, legislators have taken up the issue of authentication, giving the regulator broad powers of implementation in the US and none ex ante in France.
However, it has to be said that, despite these ex ante regulatory powers, the implementation of STIR/Shaken in the United States is lagging behind. This is borne out by statistics published by Transnexus, a supplier of number authentication equipment and systems in the United States. These statistics are collected by systems fitted to more than one hundred operators, who receive calls from 962 other operators.
Figure 3 – Proportion of calls with a STIR/Shaken signature received by Transnexus
In terms of authentication, ARCEP’s only formal power is to impose penalties (ex post) for operators’ failure to comply with the law. As the French law comes into force on 25 July 2023, ARCEP is granting operators a grace period for the time being.
7 Open questions
How long will this state of affairs last? When will mobile operators switch their SIP-I interconnections to SIP? French operators are working to complete the Number Authentication Mechanism for call scenarios that have not yet been fully processed: number display delegation, then emergency calls, call forwarding and call transfers. Which of these delays will be deemed tolerable by the regulator because of the state of the art? And for how long?
The purpose of authentication is to identify illegal callers more quickly. The usefulness of authentication will therefore depend on the use made of it by law enforcement agencies.
Will trespassers move away from displaying fixed numbers to displaying mobile numbers ? The recent appearance of calls using spoofed mobile numbers suggests that this is the case.
Number authentication is still a long way off, and the introduction of the Number Authentication Mechanism in France in 2024 will be just one step in the process.
_________________