In a decision issued in April of this year, the Canadian Radio-television and Telecommunications Commission ("CRTC") required all telecommunications service providers ("TSPs") in Canada to implement STIR/SHAKEN to authentic and validate IP-based calls effective 30 November 2021.
STIR/SHAKEN is a set of protocols and procedures that are intended to reduce caller identification ("ID") spoofing. Caller ID spoofing occurs when callers deliberately falsify (or spoof) their caller ID. This conduct undermines the ability of call recipients to screen out nuisance calls.
The CRTC initially announced in 2018 an expectation that TSPs would implement measures to authenticate and verify caller ID for all IP-based calls based on STIR/SHAKEN by the end of March, 2019. This deadline was subsequently extended to 30 September 2020, with the ability of TSPs that were unable to meet the deadline to file a submission providing an explanation and supporting evidence. In September 2020, the CRTC's date for expected implementation of STIR/SHAKEN was extended a further nine months. In announcing this extension, the CRTC noted that the new implementation date would align with the FCC date for implementation of STIR/SHAKEN of 30 June 2021.
In Compliance and Enforcement Decision CRTC 2021-123, the CRTC made its expectation a requirement, and directed all TSPs to implement STIR/SHAKEN for all calls that travel over a TSP's IP-based network by the further extended deadline of 30 November 2021. Significantly, the CRTC declined to establish any exemptions from this obligation, including for smaller TSPs. In contrast, the U.S. Federal Communications Commission ("FCC") granted a 2-year extension to its June 2021 STIR/SHAKEN implementation deadline for voice service providers with 100,000 or fewer subscribers (although the FCC is currently considering a one-year reduction of that extension for voice service providers that originate an exceptional number of voice calls).
All TSPs have also been directed to submit a STIR/SHAKEN implementation readiness report to the CRTC by 31 August 2021.
At present, only local exchange carriers and facilities-based wireless service providers can obtain certificates from the Canadian Secure Governance Authority attesting to the authenticity of calls. The CRTC is considering an application requesting broader access to these certificates. The FCC exempted service providers that cannot obtain a certificate from its STIR/SHAKEN implementation requirement until they are able to obtain a certificate, provided the service provider submits information to a Robocall Mitigation Database, including the steps taken to mitigate illegal calls made by autodialers (referred to as "robocalls" or "ADAD calls"). Canada has not implemented a similar database or reporting requirement.
As a result of the CRTC's decisions, all TSPs should be assessing their STIR/SHAKEN implementation readiness to meet the reporting deadline of 31 August 2021 and the implementation deadline of 30 November 2021.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
