FCC Mandates STIR/SHAKEN Caller ID Authentication under the TRACED Act (RFC 8224/8588)
On 31 March 2020 the FCC adopted its First Caller ID Authentication Report and Order (FCC 20-42), implementing the December 2019 TRACED Act by requiring voice providers to deploy STIR/SHAKEN in the IP portions of their networks by 30 June 2021.
02Deep-Dive Technical Analysis
STIR (IETF RFC 8224, February 2018) adds a signed `Identity` header to SIP `INVITE` requests carrying a PASSporT JSON Web Token (RFC 8225); the SHAKEN PASSporT extension (RFC 8588, May 2019) and ATIS-1000074 add attestation levels A (full), B (partial) and C (gateway). Originating carriers sign with X.509 certificates issued by approved STI-CAs under the STI-GA / STI-PA governance model, and terminating carriers verify the signature chain before presenting a verified status to the subscriber. The FCC order set ATIS-1000074, ATIS-1000080 and ATIS-1000084 as the minimum standards.
03Vulnerability & Exploit Flow
Unauthenticated SIP `From` and `P-Asserted-Identity` header manipulation on IP-PBX interconnects.
04Recommended Defense & Mitigation Protocol
Mandate STIR/SHAKEN certificate signing, automated robocall analytics, and carrier traceback enforcement.
05Security Impact & Geopolitical Consequence
Made cryptographic caller-ID authentication a regulatory obligation for US voice providers, with the largest carriers compliant by the 30 June 2021 deadline and later orders extending duties to small, gateway and non-IP providers. It reduced but did not eliminate illegal robocalls, since attestation proves who signed a call, not the caller's intent.
06Authoritative Standards & External References
- 01RFC Editor — RFC 8224: Authenticated Identity Management in the Session Initiation Protocol (SIP)
- 02RFC Editor — RFC 8588: PASSporT Extension for Signature-based Handling of Asserted information using toKENs (SHAKEN)
- 03FCC — FCC 20-42 Report and Order: Call Authentication Trust Anchor (STIR/SHAKEN mandate, March 2020)
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.