FTC Announces $50k In Prizes For Robocaller Trap Software

crazyhorse44 that the Federal Trade Commission announced this week that it is launching two new robocall contests challenging the public to develop a crowd-source honeypot and better analyze data from an existing honeypot. A honeypot is an information system that may be used by government, private and academic partners to lure and analyze robocalls. The challenges are part of the FTC's long-term multi-pronged effort to combat illegal robocallers and contestants of one of the challenges will compete for $25,000 in a top prize. As part of Robocalls: Humanity Strikes Back, the FTC is asking contestants to create a technical solution for consumers that will identify unwanted robocalls received on landlines or mobile phones, and block and forward those calls to a honeypot. A qualifying phase [launched Wednesday] and runs through June 15, 2015 at 10:00 p.m. ET; and a second and final phase concludes at DEF CON 23 on Aug. 9, 2015.

Comments

Dial *666

[Macdude]

Have the phone companies implement a *666 system. After receiving a robocall the recipient hangs, then picks up and dials *666. The phone company keeps a count and reports numbers with some large number of *666 reports to drone death-squads.

That last bit might be a tad extreme...

Re:Dial *666

[germansausage]

"That last bit might be a tad extreme..."- Saturation kinetic bombardment from orbit, followed by mop-up squads with flamethrowers and nerve gas. It might cost a little more, but it sends a message.

Re:Dial *666

[wiredlogic]

It would also help to have mandatory, accurate caller ID that can't be spoofed or monkeyed with.

Re:Dial *666

[rhizome]

End-user billing information should be accessible to the called party. If someone wants to front for someone else, they can assume the liability too.

simple solutions are always the least popular.

[nimbius]

The FTC's best solution is to investigate these robocalls with their own system of honeypots. order a product from the caller, set up a sting, and sentence a CEO and a few managers to some hard time in prison. but thats punishing success and in americas land of the fee and home of the paid, we're all about the invisible hand of the market.

my solution

[slashmydots]

Way ahead of you there. My spam call trap is called me. When I answer, suddenly I go from Wisconsin suburban turbo-white computer repair to solomente hablamos en espanol. Then when they apologize and transfer me to their spanish department, suddenly, I only speak english.

Re:my solution

[Checkered Daemon]

My solution is also me. I answer all robocalls (even the pre-recorded ones) with "Hello. This call is being recorded". I've quickly gone from around 3 or 4 a day to almost zero. Guess they're scared of the fines, and it looks like they share information on who's after them.

Re:my solution

[houghi]

The anti-call script script

Fix Caller ID and monitor exchanges

[buckfeta2014]

First off, fix Caller ID so people can't spoof their phone numbers. Even if people use the private number feature, the phone company knows who made the call. Secondly, monitor exchanges for both high outgoing volume and high incoming volume (and especially sequential dialing) to find potential robocallers and telemarketers. Problem solved.

Re:Fix Caller ID and monitor exchanges

[zippthorne]

There already is a feature for that, ANI, where the information is sent by the phone company rather than by the caller themselves over the "voice" portion of the call. It costs more than caller ID, and I'm not sure you can even get the phone company to offer it to you as an individual, but many business use this feature. Probably the spam callers themselves are using it to avoid receiving unwanted calls...

Not a good idea.

[Frosty Piss]

Robo-calls come from ever-changing numbers that eventually make it back into the pool. The result of a system like this will be that, like SPAM IP addresses, large swaths of numbers will forever be blacklisted even long after the robo-caller has moved on, forever useless to any other user.

Blacklisting in this way has been shown not to have any effect at all on SPAM / robo-callers, and only inconveniences everyone else.

Re:Not a good idea.

[houghi]

At one point these numbers are owned by some company. That company is owned by somebody. It has assets that can be taken away.
So unless they hack peoples phonelines (like they do with IP adresses) there is somebody to go after.

Now if you are completely unable to go after the people, hold the phone companies responsible and ask them (ok, force them) to pay the fine. I assure you that within a week they suddenly will be able to identify these robotcallers and it will stop.

Obviously this wil only work as long as they use US numbers. The moment they start using VoIP, they could just block the VoIP company alltogether. Those will then see that things will stop.

Now if there is no reason for the phone company to change anything, why should they?

Re:Not a good idea.

[Applehu Akbar]

The policy on Belize was modeled on Nigerian law, which requires membership in a royal family to get email addresses.

Re:Not a good idea.

[tlhIngan]

Phone numbers are passed around like pocket change. Who has control today is not who has control tommorow.

But beyond that, if I buy a MagickJack today and send out 1,000,000 spams and 100,000 robo dials tomorow, how can the "owner" of that number be held responsible? Of course common sense says they cam't.

Phone numbers move far less than you think - when you port your phone number, it takes several hours for the change to happen. In the meantime, a call can ring one phone, the other phone, both, or none as the switching tables are updated. But in the meantime, the phone number is still owned by someone at that time. All you need to do is log when and who.

As for your magicjack? Well, at some point they have to interconnect to the phone system. If you can't trace beyond the phone system, then the interconnection is liable, to whom they'd probably be more than happy to send the bill to MagicJack to pay.

Basically, to make a phone call, you have the originating number. The thing is, your phone company providing you service actually knows the originating phone number that's not spoofed or anything - the originating phone number is sent as data to the called party's phone company. And logged. So your phone company knows who made the call and who's responsible.

If it goes through a third party call forwarding service, well, guess who holds liability now?

POTS is not like the Internet. POTS actually has verifiable sources - you cannot spoof the call as everyone exchanges connection information. Sure VoIP may make the real caller hard to find, but at some point the call had to enter the POTS network, and the gateway provider can be held responsible. And I'm sure for billing purposes they know who used that outgoing line - maybe not the subscriber, but the company that they contract POTS interconnection for.

Perhaps an auto-attendant might be an interesting way to solve the problem using grey listing - the autoattendant looks for familiar numbers, and if it's on the list, passes it through. If not, it answers the phone and walks through a script, asking the caller for their name, company and other details. It then asks the caller to hold, and rings the inside line, who passes the information onwards and you can decide if you want to take the call, black l ist, tar pit, or reject. Rejected calls get a simple "the party does not wish to speak with you, do you want to l eave a message?" while tarpitted calls get the "please wait" response every 30 seconds.

Re:Not a good idea.

[jafiwam]

If a large number of robocall reports were being made in real time, wouldn't that help identify the physical source?

First, phone numbers can and are often "spoffed".

Second, just like with Intertube Spam, I can bust out 100,000's of robo-calls in one day from a disposable phone number (MagicJack and the like), and than move on untraced.

The phone companies know where the call is coming from. They just don't know it's a "bad call" when it is actually happening. You are very very confused if you think what the phone companies and guys running the switches can see is the caller ID number that shows up on the phone. (Caller ID can be spoofed.)

On the other hand, a system of rapid reporting can make those numbers useless after an hour of robo calling, rather than a day.

Who the hell picks up the phone now days anyway? I just let it ring or silence it. It's incredibly megalomaniac to think the call is actually important on any account. They can leave a voice mail, they can email, text, or find me on Facebook. If I don't know them, they are trying to sell / scam something and they can fuck off.

Solution: $5 wrench and the phone company's CEO

[Theaetetus]

As per the XKCD comic, the solution is a social one, not a technical one. Spam callers spoof their numbers, which is why they're so difficult to block, but caller ID spoofing is explicitly allowed by the phone companies, who let the spammers specify a "calling from" number to be included in the caller ID data. However, the phone company knows exactly where the real call is coming from and who is making it - that's how they bill the company for the 20,000 phone calls they make every month.

And why does the phone company do this? Because the spammers pay them decent money, and most people don't realize that the phone company's involved, so they get mad at the spammers and not AT&T or Verizon.

So, the solution is to send a burly man with a wrench to the CEO's office and ask him politely to stop letting companies specify different caller ID numbers, if he would like his kneecaps to remain intact.

Re:Private Caller is the biggest issue

[Jack Griffin]

Why do you even answer your phone? It beats me why people feel the compelling need to answer a ringing phone. I'll be in the middle of a conversation and the phone rings and I ignore it (mute it). The other person says "aren't you going to answer that"? Why? What culture have we been brought up when it seems impolite to not answer a ringing phone?
I only ever answer if it's a known number, and only if I feel like talking. The phone has no power over you, take back control of that relationship.