question: Why cell phone companies don’t implement some kind of public key authentication to track robocalls?
comment: This would require basically rebuilding the world's PBX systems from scratch. Cellphones would require an OS update and without it, you'd be unable to make calls. For Android, cell manufacturers are generally expected to provide OS updates. Are they going to provide an update for EVERY model? What about non-smartphones? People still have landlines. While a lot of this has moved to VOIP (which would require updates but would be pretty easy to happen in the background), not all of it has. They'd be boned and at a minimum, would need new phones. Businesses would need to update their PBX servers and without it, they couldn't place/receive calls Phone companies would need to update all their phone servers, exchanges, and various other hardware This would likely cost many, many, many billions of dollars directly and untold billions more of economic damage from the hiccups and productivity lost.
passages: A major problem for the use of both blacklisting and whitelisting techniques is the practice of caller ID spoofing, which is prevalent as a result of the low barrier to entry in the VoIP services market.
  
  In 2015 the Federal Communications Commission proposed a framework for the telecommunications industry in the United States, which included a validation system at network level for robocalls from SIP sources by 2017. The final authentication task in the framework is the signing of all VoIP calls, which would allow carriers to reliably identify robocalls.
   Despite heavy media publicity of the database, only seven politicians in the United States voluntarily pledged to respect the list during the 2008 general election cycle. Of those seven, only three made it to the general election and only Virginia Foxx (R) was successfully reelected in November 2008.
   Currently, the use of the public switched telephone network is restricted by NIST. In particular, the out-of-band transmission of one-time passwords (OTPs) via recorded voice messages or SMS messages is restricted. Moreover, if an agency chooses to use voice- or SMS-based OTPs, that agency must verify that the OTP is being transmitted to a phone and not an IP address since Voice over IP (VoIP) accounts are not routinely protected with multi-factor authentication.
  
  Section::::Comparison.
   In 2016, both Verizon and Sprint each launched their own service based on Enhanced Caller ID, which is developed by Cequint and incorporates whitelisting, blacklisting and crowdsourcing techniques. For improved accuracy, it is complemented by a technology called Call Guardian developed by TNS, which performs caller behavior analysis on the 25 billion public calls they handle every year in real time.
  
  Starting in mid-2017, and with intended culmination in 2019, the FCC pushed forward Caller ID certification implemented via a methodology of SHAKEN/STIR.
  
  Section::::Enforcement.
   Until these goals are achieved, a more advanced method for blocking robocalls uses real-time business intelligence techniques to address the constantly changing identities of robocalls. With access to a large enough data sample, it is possible to create algorithms which detect call patterns without requiring reporting by users.
   Section::::North America.:United States.:Indiana.
  
  Indiana requires introduction of any prerecorded message by a live operator; the message may only be played if the called party grants permission.
  
  Section::::North America.:United States.:Missouri.
  
  In September 2008, then-Missouri Attorney General Jay Nixon alerted political campaigns in Missouri that his office would aggressively enforce federal rules (Telephone Consumer Protection Act of 1991) requiring calls to include identifying and contact information.
  
  Section::::North America.:United States.:North Carolina.
   BULLET::::- Cordless phones are often even less secure than cell phones; with some models a scanner radio may intercept analogue conversations in progress or a handset of the same/similar model as the target system may be usable to make toll calls through a cordless base station which lacks authentication capability. Obsolete analogue mobile telephones have stopped working in areas where the AMPS service has been shut down, but obsolete cordless phone systems may remain in service indefinitely.
  
  BULLET::::- A recent scam involved Indian call centers targeting American customers demanding "unpaid taxes".
   Solutions are available as both hardware and software products. Mobile apps are especially prevalent as they use techniques which do not require the modification of infrastructure. Many products are limited to use only on a single medium, such as traditional copper landlines, or mobile phone contracts from a specific mobile phone operator.
  
  Section::::Suppressing unwanted and illegal robocalls.:Blacklisting and whitelisting.
  
  In its simplest form, this method offers the ability to prevent further calls from phone numbers, once they are known to be a source of robocalls. Many mobile apps can prevent robocalls with a user generated blacklist.
   A specific instance in which there are issues with the lack of verification necessary to unlock access to the virtual assistants and to give them commands is when an Amazon Alexa is left in a living quarters unattended. Currently, there is only one layer of authentication which is the voice; there is not a layer that requires the owner of the virtual assistant to be present. Thus, with only one barrier to access all of the information virtual assistants have access to, concerns regarding the security of information exchanged are raised. Such privacy concerns have influenced the technology sector to think of ways to add more verification, such as a Virtual Security Button.
   With cellphones, the biggest issue appears to be in the passing of calling line ID information through the network. Cellphone companies must support interconnecting trunks to a significant number of Wireline and PSTN access carriers.
  
  Section::::CLI localisation.
   Starting in mid-2017, and with intended culmination in 2019, the FCC pushed forward Caller ID certification implemented via a methodology of SHAKEN/STIR. SHAKEN/STIR are acronyms for Signature-based Handling of Asserted Information Using toKENs (SHAKEN) and the Secure Telephone Identity Revisited (STIR) standards.
  
  In 2019 at WWDC, Apple introduced a new Siri call-filtering feature to their iOS 13 which gives users the ability to create a whitelist of known contacts and send unknown numbers to voicemail.
   Many robocalls are not wanted, and several methods have been developed to prevent unwanted robocalls. Many countries operate do not call lists, but the lists have been ineffective and legally problematic in some cases. Consequently, a market has developed for products that allow consumers to block robocalls. Most products use methods similar to those used to mitigate SPIT (spam over Internet telephony) and can be broadly categorised by the primary method used. However, due to the complexity of the problem, no single method is sufficiently reliable.
   A more sophisticated model uses crowdsourcing to build a more comprehensive blacklist of robocall numbers. A notable example of this is the app Truecaller, which requires users to provide access to their personal whitelist of genuine contacts in exchange for access to the larger crowdsourced database. In 2013, hackers gained access to Truecaller's database of known genuine numbers, highlighting the danger of centralising this information.
  
  Section::::Suppressing unwanted and illegal robocalls.:CAPTCHA.
  
  Building on the crowdsourcing model, Primus Canada launched a patented product called Telemarketing Guard for landlines in 2007. It improves on previous models by including a CAPTCHA style challenge-response test.
   An important point and a potential drawback of this solution is the need to transfer full SIP account credentials to SIPIS server, as it needs them to be able to register, which is an obvious security risk. One way to avoid it is to install the SIPIS server on the premises of the VoIP service provider, in which case the security risk is eliminated - the provider already knows the passwords anyway.
  
  Section::::Acrobits Softphone.:Features.:Secure Calls.
   Organisations that use recorded phone messages (robocalls) for marketing or sales calls must have prior consent from the subscriber. Unauthorised silent calls and robocalls from an identified caller can be reported to the ICO.
  
  Section::::Unwanted calls not covered by TPS.:Market research.
   A number of physical products have been developed for use with landlines. These are typically installed in homes and employ a hard coded or irregularly updated blacklist. Some models also have the function to create a user-generated whitelist. Newer devices for landlines can use cloud based data to resolve the hard coded blacklist issues and allow you to create your own whitelist/blacklist.
  
  Section::::Suppressing unwanted and illegal robocalls.:Crowdsourcing.
   In addition, the FTC requires a process similar to TPV for many orders and to have reliable documentation of their orders, and other transaction types. Third-Party Verification is now the de facto standard for transactions of all types where a legally binding authentication and confirmation are required, but a signed document is impractical or impossible. It is being applied in hospitals and else where in healthcare for records releases; in schools for parental program approvals; by local governments as notification of impending actions; by attorneys themselves for service authorizations; by service providers for work authorizations. In all cases, based upon Federal Rules and the U.S.Code, phone verifications are authorized and legally binding, assuming that the verification is recorded and available for audit for a minimum of 24 months, and that identity of the authorizing person can reasonably be verified, such as by a social security number, driver's license, date of birth, and/or other unique identifiers.
   In the telecommunications industry, under new rules VoIP carriers who connect with the public telephone network are required to notify their customers of any limitations to their E911 (enhanced 911) service, including where and under what conditions it may not be available, including: in the event of a loss of internet connection, or loss of power. Importantly, VoIP carriers must also obtain "affirmative acknowledgement" from every customer that they have received and understood that information.
  
  Thus phone verification fills the demand for legal authentication of documents, consumer intent, and provides substantial fraud prevention.
  
  Section::::Advantages of using.
   Caller ID spoofing remains legal in Canada, and has recently become so prevalent that the Canadian Anti-Fraud Centre has "add[ed] an automated message about [the practice] to their fraud-reporting hotline". The CRTC estimates that 40% of the complaints they receive regarding unsolicited calls involve spoofing. The agency advises Canadians to file complaints regarding such calls, provides a list of protection options for dealing with them on its website, and, from July through December 2015, held a public consultation to identify "technical solutions" to address the issue. Regulators have set a March 31, 2019 target date for implementation of a CID authentication system.
   BULLET::::- If the displayed number is in the recipient's address book, some handsets will display the name from the local address book in place of the transmitted name. Some VoIP providers use Asterisk (PBX) to provide similar functionality at the server; this may lead to multiple substitutions with priority going to the destination user's own handset as the last link in the CNAM chain.
  
  Section::::Legal considerations.
  
  Section::::Legal considerations.:Canada.
   The properties of the DECT protocol make it hard to intercept a frame, modify it and send it later again, as DECT frames are based on time-division multiplexing and need to be transmitted at a specific point in time. Unfortunately very few DECT devices on the market implemented authentication and encryption procedures – and even when encryption was used by the phone, it was possible to implement a man-in-the-middle attack impersonating a DECT base station and revert to unencrypted mode – which allows calls to be listened to, recorded, and re-routed to a different destination.
   Section::::North America.:United States.:Proposed additional regulations.
   The NSA call database was not approved by the Foreign Intelligence Surveillance Court (FISC) as required by the Foreign Intelligence Surveillance Act (FISA). The FISC was established in 1978 to secretly authorize access to call-identifying information and interception of communications of suspected foreign agents on U.S. soil. Stanford Law School's Chip Pitts provided an overview of the relevant legal concerns in The Washington Spectator.
   A common usage of a CEIR is with stolen mobile devices. Once a user reports to their operator about the theft, the mobile devices's IMEI number should be entered into the CEIR, supposedly making the device unusable in any network (although this does not always work). A key reason this sometimes does not work, is that while many operators from many countries contribute IMEIs to the CEIR, each also having a unique profile that determines which operators' blocks will be included on the CEIR updates received by each operator. The UK networks for example, do not receive those block records originated by non-UK networks. Annual fees are required for access to the CEIR, and access is tightly regulated Contributing operators decide for themselves which handsets they will block from their own networks, and many network operators simply do not participate at all.
   As a result, industry experts continue to seek out alternatives to standard passphrase authentication systems. Opus Senior Analyst Researcher Dan Miller said that “Voice biometrics strikes the right balance between strong authentication and usability.” Opus Research in connection with ValidSoft concluded that “the conditions are ripe for the emergence of voice biometrics as the dominant means of authentication, particularly for financial transactions. The key drivers are the growth of mobile banking and e-finance together with the intrinsic lack of security on mobile devices. A secure means of authenticating mobile devices is an increasing necessity.”
  
  Section::::Vulnerabilities.
  