[VOIPSEC] Truths on "Truth in Caller ID Act"

[Richard Clayton]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In message <402F25FC1EB2BD44831F8A4A4F6DF9426D0033 at MAIL02.cedarpointcom.
com>, Geoff Devine <gdevine at cedarpointcom.com> writes

>Why would a "truth in Caller ID" law be bad?  If you placed the burden
>on telephony service providers to prevent spoofed CallerID and made it a
>crime for an individual to spoof CallerID, I'd classify it as sound
>public policy.  

Remember that it is usual to "get rid of the hard part in the title". [a
quote from the "Yes Minister!" comedy series (or was it a documentary?),
which I heartily recommend to anyone who's never seen it]

This is a very general rule -- and if you assume that the legislation
doesn't actually do what the title says it does then you will almost
always be more than half way to comprehending what it actually does!

So "Truth in Caller ID" isn't what's going on here.

It's merely a law to ensuring that using fake Caller ID to attempt a
deception will be punishable per se.  It doesn't directly require that
providers do anything -- though I note that s2(4) does require a report
on whether that should be done in the future.

   http://www.govtrack.us/data/us/bills.text/109/s/s2630.pdf

>If it doesn't happen, my telephone is going to start
>ringing at 3 AM with spoofed calls from Nigeria claiming to be my
>employer or a family member.  

If this worked (viz: it made the bad guys money) then this would already
happen a great deal.  Since you're unlikely to buy stocks from a boiler-
room operation in the small hours (the main use, in my experience, for
voice-based scams) I think you can sleep soundly :)

- -- 
richard                                                   Richard Clayton

Those who would give up essential Liberty, to purchase a little temporary 
Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBRSUPAJoAxkTY1oPiEQJK4gCfStH+eKLXL8kIIe2y96ae5m4/d+QAoK9Q
B/cm6s8zYVUJiKZO5hgxRgL2
=6293
-----END PGP SIGNATURE-----