[Senate Hearing 110-1139]
[From the U.S. Government Publishing Office]
S. Hrg. 110-1139
CALLER ID SPOOFING
=======================================================================
HEARING
before the
COMMITTEE ON COMMERCE,
SCIENCE, AND TRANSPORTATION
UNITED STATES SENATE
ONE HUNDRED TENTH CONGRESS
FIRST SESSION
__________
JUNE 21, 2007
__________
Printed for the use of the Committee on Commerce, Science, and
Transportation
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
ONE HUNDRED TENTH CONGRESS
FIRST SESSION
DANIEL K. INOUYE, Hawaii, Chairman
JOHN D. ROCKEFELLER IV, West TED STEVENS, Alaska, Vice Chairman
Virginia JOHN McCAIN, Arizona
JOHN F. KERRY, Massachusetts TRENT LOTT, Mississippi
BYRON L. DORGAN, North Dakota KAY BAILEY HUTCHISON, Texas
BARBARA BOXER, California OLYMPIA J. SNOWE, Maine
BILL NELSON, Florida GORDON H. SMITH, Oregon
MARIA CANTWELL, Washington JOHN ENSIGN, Nevada
FRANK R. LAUTENBERG, New Jersey JOHN E. SUNUNU, New Hampshire
MARK PRYOR, Arkansas JIM DeMINT, South Carolina
THOMAS R. CARPER, Delaware DAVID VITTER, Louisiana
CLAIRE McCASKILL, Missouri JOHN THUNE, South Dakota
AMY KLOBUCHAR, Minnesota
Margaret L. Cummisky, Democratic Staff Director and Chief Counsel
Lila Harper Helms, Democratic Deputy Staff Director and Policy Director
Christine D. Kurth, Republican Staff Director and General Counsel
Kenneth R. Nahigian, Republican Deputy Staff Director and Chief Counsel
C O N T E N T S
----------
Page
Hearing held on June 21, 2007.................................... 1
Statement of Senator Klobuchar................................... 19
Statement of Senator Nelson...................................... 1
Statement of Senator Stevens..................................... 2
Statement of Senator Sununu...................................... 22
Witnesses
Cerasale, Jerry, Senior Vice President, Government Affairs,
Direct Marketing Association, Inc.............................. 6
Prepared statement........................................... 8
Jones, Hon. Ron, Commissioner, Tennessee Regulatory Authority;
Chairman, Consumer Affairs Committee, National Association of
Regulatory Utility Commissioners............................... 16
Prepared statement........................................... 17
Knight, Allison, Staff Counsel and Director, Privacy and Human
Rights Project, Electronic Privacy Information Center (EPIC)... 12
Prepared statement........................................... 13
Monteith, Kris Anne, Chief, Enforcement Bureau, FCC.............. 3
Prepared statement........................................... 5
Appendix
Inouye, Hon. Daniel K., U.S. Senator from Hawaii, prepared
statement...................................................... 27
CALLER ID SPOOFING
----------
THURSDAY, JUNE 21, 2007
U.S. Senate,
Committee on Commerce, Science, and Transportation,
Washington, DC.
The Committee met, pursuant to notice, at 11:03 a.m., in
room SR-253, Russell Senate Office Building, Hon. Bill Nelson,
presiding.
OPENING STATEMENT OF HON. BILL NELSON,
U.S. SENATOR FROM FLORIDA
Senator Nelson. Good morning. Over the past few years,
consumers have been hit with a number of new scams that seek to
use our Nation's telecommunications network for fraudulent
purposes, from pretexting to spyware. Fraudsters are always
looking for new ways to invade our privacy and personal and
financial information and one of the newest scams is called
Caller ID Spoofing.
It's a technique that allows a telephone caller to alter
the telephone number and other information that appears on the
recipient's Caller ID system. It's an easy scam to pull. All an
individual needs to do is go to one of a number of Internet
sites with names like Tricktell.com and SpoofTell.com, to gain
access to spoofing services and on these sites, an identify
thief can pay money to order a spoofed telephone, tell the
website what telephone number they wish to reach and then place
a spoofed telephone call through a toll-free line. A number of
recent news stories have highlighted the serious harm that is
caused by this practice.
One recent example--fraudsters used Caller ID spoofing to
pose as court officers calling to say that the individual had
missed jury duty. The caller then says that a warrant will be
issued for their arrest unless they pay a fine with a credit or
bank card during the call and you know what the result is going
to be.
In another case, identity thieves and criminals have used
Caller ID spoofing to hack into a bank account and into
voicemail accounts to steal sensitive personal information.
Now while these examples are serious enough, just think
what could happen if a stalker used Caller ID spoofing to trick
someone into answering their phone and providing information on
where they are and the results could be tragic. So it's time to
put an end to Caller ID spoofing.
The bipartisan Truth in Caller ID Act of 2007 will plug the
hole in the current law and make it clear that spoofing is a
scam and is not legal. So it is my privilege to chair this
hearing on behalf of Senator Inouye and the Vice Chairman of
the Committee, I would turn to him, Senator Stevens.
STATEMENT OF HON. TED STEVENS,
U.S. SENATOR FROM ALASKA
Senator Stevens. Thank you very much, Senator. I'm grateful
to Senator Inouye for calling this hearing. These ID services
provide us all with information that we need. Really, I'm
delighted to have the information. When I see who is calling
me, I can tell whether to pick it up right away or ask my staff
to deal with it if it is something that I don't have the time
for.
This idea that some people can alter that ID information
bothers me considerably because it means that a loss of privacy
means identity theft possibilities and really as Senator Nelson
has mentioned, can compromise personal safety. We need to
understand those concerns and to try to make a record and
that's what we're going to do today with your help so that
others will review what this panel gives us to determine what
holes are in our laws and if they can be filled to address and
prevent this spoofing practice.
I'm particularly worried about the fraudulent aspects that
Senator Nelson has mentioned, particularly where it could lead
to obtaining money under totally false pretenses. It ought to
be against the law already but I want to find out if there is
any way and anyone in law enforcement working to deal with that
directly at this time. Senator Nelson, Senator Snowe and
Senator McCaskill have introduced this bill. It's going to come
before the Committee next week and this will be the only
hearing, the only opportunity we have to get a record for other
members to learn about this. So I'm particularly concerned
about the law enforcement actions that have been taken. I
congratulate the sponsors but will it provide the tools that
law enforcement needs to really improve enforcement activities
and will it provide the information that is necessary?
I'd like to see something developed and invented so that if
I see something on my Caller ID that I want to preserve then I
could transfer it. We lose that immediately--once we hang up,
we've lost that ID. What the telephone records might show would
be one thing but what has shown on ID is another thing, is my
understanding. Though somehow or another, we've got to be able
to find a way to preserve that information to show the
fraudulent activities involved. And we get a great many calls
from around the country and when we get a Caller ID that
indicates to us it's a governor or it's someone from major
organization and we're working on that legislation, we ought to
be able to rely on that ID.
This fraudulent ID concept goes to really, I think contact
violating the Constitutional concept that people have the right
to contact Congress to redress wrongs, but if they are
contacting us under false pretences, we've got to have a way to
know it. So I think this is a very important piece of
legislation. I do hope the record will help us convince the
other members of the Committee of that fact.
I look forward to the hearing. Unfortunately, I have to go
somewhere at half past, so I'll wrap up.
Senator Nelson. Well, Senator Stevens, thank you for your
encouraging and supportive comments. And here's another
example. A couple of years ago, a sharp-shooting SWAT team shut
down a neighborhood in New Brunswick, New Jersey, after they
received what they thought was a distress call coming from an
apartment in the neighborhood and it turned out it was a spoof
call and it put a lot of lives at risk, time after time.
Well, we've got a distinguished panel. Ms. Kris Monteith,
Chief of the Enforcement Bureau of the FCC, Mr. Jerry Cerasale,
Senior Vice President of Government Affairs of the Direct
Marketing Association, Ms. Allison Knight, Staff Counsel and
Director of Privacy and Human Rights Project, Electronic
Privacy Information Center and Mr. Ron Jones, Director of the
Tennessee Regulatory Authority and Chairman of the Consumer
Affairs Committee of the National Association of Regulatory
Utility Commissioners. So welcome, all.
Your written statements are entered into the record and
because of the constraints of time, I would appreciate it if
you could talk directly to us. We'll go right in the order in
which I introduced you, without you reading your testimony to
us because we're going to have it as part of the record, if you
would give us your thoughts. So let's start with you, Ms.
Monteith.
STATEMENT OF KRIS ANNE MONTEITH, CHIEF, ENFORCEMENT BUREAU, FCC
Ms. Monteith. Good morning. Thank you very much, Vice
Chairman Stevens, Senator Nelson and members of the Committee.
Thank you for the opportunity to speak with you today about the
problem of caller identification spoofing. As you've stated,
Caller ID services lets customers identify who's calling them
before they pick up the phone, such as by a telephone number, a
name or business number displayed on the customer's equipment.
Caller ID spoofing refers to the practice in which the Caller
ID information is manipulated in a manner that misleads the
call recipient about the identity of the caller.
The Commission is deeply concerned about reports that
Caller ID information is being manipulated for fraudulent or
deceptive purposes and the impact of those practices on the
public trust and confidence in the telecommunications industry.
We are particularly concerned about how this practice may
affect consumers as well as public safety and law enforcement
communities. I think you're aware of some of the technical
means by which caller identification travels with the phone
call so I won't go into detail and I think that information is
in my written testimony.
The Commission also has addressed caller identification on
the public switched telephone network in rules that were
adopted in 1995 and generally, those rules require all carriers
using Signaling System 7--SS7--to transmit the calling party
number associated with an interstate call to interconnecting
carriers. This same Commission rule also requires telemarketers
to transmit accurate Caller ID information.
With the development of the Internet and IP technologies,
Caller ID spoofing has apparently been made easier--even easier
than it used to be. Now entities using IP technology can
generate false calling information and pass it to the PSTN via
SS7.
The Commission's Enforcement Bureau has been investigating
this practice since it came to our attention in the summer of
2005, having come to our attention in the context of junk fax
spoofing. To date, we have initiated investigations on 13
companies engaged in the marketing and selling of Caller ID
spoofing services to customers. One investigation has resulted
in a citation against a telemarketer called Intelligent
Alternatives for rule violations including violations of the
Caller ID rules under Section 64.1601 of our rules.
We've sent formal Letters of Inquiry to these entities and,
at the same time, served subpoenas on them to compel them to
respond to our inquiries. In some cases, we followed up with
subsequent Letters of Inquiry to uncover additional evidence of
possible violations.
Importantly, our investigations have revealed that the
companies that are engaged in these practices are of varying
degrees of sophistication that employ disparate methods and
technologies to provide service to different types of
customers. Some of the companies, for example, claim that they
are involved in legitimate activities, providing spoofing
services only to customers such as law enforcement officials,
private investigators, or to others that are engaged in the
furtherance of debt collection or other similar types of
activities.
The companies allow customers to customize, so to speak,
the services that they select. For example, in some cases, the
spoofing companies claim that they do not allow the customer to
decide the particular false number to be displayed on the
called parties' ID while others do provide that functionality.
This functionality is very important because it implicates
whether or not a spoofer would permit the customer to use 911
as a spoofed number or whether the customer could, for example,
choose another telephone number that might be a government
number--and as you suggest, Senator Nelson--or the number of
other emergency services providers.
The Enforcement Bureau is continuing to gather and analyze
information about the companies' practices, their network,
businesses, and customers, and other relevant matters that will
assist us in fully understanding the issues and whether
violations of the Communications Act have, in fact, occurred.
In addition to our enforcement efforts, the Commission has
taken steps to prevent those engaged in Caller ID spoofing for
deceptive reason from successfully accessing the personal
information of telecommunications customers. In a recent order
tightening the Commission's Customer Proprietary Network
Information rules, we determined that a carrier providing call
history information over the phone to a customer must first
call that customer back at the telephone number of record to
ensure that the individual calling is, in fact, the customer
rather than relying on the Caller ID as an authentication
method, thereby eliminating one of the major tools of
pretexters.
As we've testified previously, the Commission may not have
sufficient authority to fully address this issue of spoofing.
Some of the entities under investigation, do not appear to be
directly regulated by the Commission and, in fact, they've made
this assertion in response to our investigations. Thus,
legislation that clarifies the Commission's authority in this
area would be helpful.
In conclusion, just to reiterate that the intentional
manipulation of Caller ID information is an issue of importance
to the Commission, particularly where it is used for fraudulent
or deceptive reasons. We look forward to working with members
of the Committee and other Members of Congress to ensure that
the public maintains its confidence in the telecommunications
industry. Thank you.
[The prepared statement of Ms. Monteith follows:]
Prepared Statement of Kris Anne Monteith, Chief,
Enforcement Bureau, FCC
Good morning Chairman Inouye, Vice Chairman Stevens and members of
the Committee. Thank you for the opportunity to speak about the problem
of caller identification (Caller ID) spoofing.
As you know, Caller ID services let customers identify who is
calling them before they answer a call by displaying the caller's
telephone number or other information--such as a name or business
name--on the customer's equipment before the customer picks up the
phone. ``Caller ID spoofing'' refers to a practice in which the Caller
ID information transmitted with a telephone call is manipulated in a
manner that misleads the call recipient about the identity of the
caller. The use of Internet technology to make phone calls has
apparently made Caller ID spoofing even easier. The Commission is
deeply concerned about reports that Caller ID information is being
manipulated for fraudulent or other deceptive purposes and the impact
of those practices on the public trust and confidence in the
telecommunications industry. We are particularly concerned about how
this practice may affect consumers as well as public safety and law
enforcement communities.
In my testimony, I will first provide a brief technical background
on Caller ID spoofing. Then, I will describe the Commission's rules
addressing Caller ID services and the steps the Commission is taking to
make sure that providers are fully meeting their obligations under the
Communications Act and the Commission's rules and orders.
As a technical matter, Caller ID spoofing happens by manipulating
the data elements that travel with a phone call. Phone calls on the
public switched telephone network, or PSTN, are routed to their
destinations by means of a specialized protocol called the Signaling
System 7, or SS7. SS7 conveys information associated with a call such
as the telephone number of the caller. The SS7 information for a call
is provided by the carrier that the caller uses to place the call.
Caller ID then displays that caller's number to the called party.
Caller ID spoofing is accomplished by manipulating the SS7 information
associated with the call.
The Commission addressed Caller ID on the PSTN in 1995 with rule
64.1601, which generally requires all carriers using SS7 to transmit
the calling party number associated with an interstate call to
interconnecting carriers. The same Commission rule also requires
telemarketers to transmit accurate Caller ID information.
The development of Internet and IP technologies has made Caller ID
spoofing easier than it used to be. Now, entities using IP technology
can generate false calling party information and pass it into the PSTN
via SS7. Caller ID spoofing can potentially threaten our public safety.
For example, spoofers can fabricate emergency calls and cause local law
enforcement and public safety agencies to deploy their resources
needlessly. Caller ID spoofing can potentially threaten consumers. For
example, spoofing can be used by the unscrupulous to defraud consumers
by making calls appear as if they are from legitimate businesses or
government offices.
The Commission's Enforcement Bureau (Bureau) has been investigating
the issue of Caller ID spoofing since the summer of 2005 when
information regarding junk fax spoofing came to our attention. To date,
the Bureau has initiated investigations of thirteen companies engaged
in the marketing and selling of Caller ID spoofing services to
customers. One investigation resulted in a citation against a
telemarketer, Intelligent Alternatives, for rule violations, including
violations of the Caller ID rules under section 64.1601. We have sent
formal Letters of Inquiry and, at the same time, served subpoenas to
compel responses to our inquiries. In some cases, we have issued
subsequent Letters of Inquiry to uncover additional evidence of
possible violations of the Communications Act.
Our investigations have revealed that the companies engaged in this
practice are of varying degrees of sophistication that employ disparate
methods and technologies to provide service to different types of
customers. Some of the companies, for example, claim they are providing
spoofing services only to customers such as law enforcement officials
or private investigators, or to others engaged in the furtherance of
debt collection and other similar objectives. The companies also allow
customers varying amounts of flexibility over the spoofing: some
companies claim they do not allow customers the ability to customize
the false number to be displayed on the called party's Caller ID while
others do provide that functionality. This last characteristic is
particularly important when determining whether spoofers permit their
customers to use ``9-1-1'' as a spoofed number or whether the customers
can spoof the numbers of first responders and other emergency services
providers. We are continuing to seek relevant information to assist us
in fully understanding these issues and whether violations of the
Communications Act or our rules have occurred.
We also have held meetings with numerous industry representatives,
including wireline, wireless, and Voice over Internet Protocol (VoIP)-
based companies, to determine the impact of Caller ID spoofing on their
consumers and networks. And, we have coordinated with state agencies,
the Federal Trade Commission and other interested organizations, such
as the National Emergency Number Association, regarding their efforts
to address and identify solutions to this problem. The Enforcement
Bureau is committed to continuing to gather and analyze information
about these companies' practices, their networks, their businesses,
their customers, and other germane information.
In addition to our enforcement efforts, the Commission has taken
affirmative steps to prevent those engaged in Caller ID spoofing for
deceptive reasons from successfully accessing the personal information
of telecommunications customers. In a recent Order tightening the
Commission's Customer Proprietary Network Information or CPNI rules,
the Commission determined that a carrier providing call history
information over the phone to a customer must call the customer at the
account's telephone number of record to provide such information rather
than rely on Caller ID as an authentication method, thereby eliminating
one of the major tools of pretexters.
As the Commission indicated in its testimony before the House of
Representatives Energy and Commerce Subcommittee on Telecommunications
and the Internet last year, the Commission may not have sufficient
authority to fully address this issue; some of these entities do not
appear to be directly regulated by the Commission, an assertion made by
some targets of our investigations. Thus, legislation that clarifies
the Commission's authority in this area would be helpful.
In conclusion, the intentional manipulation of Caller ID
information, especially for the purpose of fraud or deception, is a
troubling development in the telecommunications industry. The
Commission looks forward to working with this Committee, and other
Members of Congress, to ensure the public maintains its confidence in
the telecommunications industry. Thank you for the opportunity to speak
with you today.
Senator Nelson. Thank you, Ms. Monteith. At any time,
Senator Stevens, since you have to leave early, that you want
to go ahead and ask questions, feel free.
Mr. Cerasale?
STATEMENT OF JERRY CERASALE,
SENIOR VICE PRESIDENT, GOVERNMENT AFFAIRS,
DIRECT MARKETING ASSOCIATION, INC.
Mr. Cerasale. Thank you very much, Senator Nelson, Senator
Stevens, Senator Klobuchar. It's a privilege to be here today.
The Direct Marking Association is a trade organization
representing multi-channel and interactive marketers who use
the mail, the phone, the Internet, e-mail, direct response TV,
and radio to reach consumers and businesses.
Spoofing of Caller ID harms the consumer. At a minimum, it
deceives the consumer. More so, it can defraud them or even put
them in harm's way. Spoofing of ID also harms the company. It's
actually stealing the company's identification. Stealing the ID
of the company, it ruins the reputation, those actions taken by
the spoofer are believed by the recipient of the phone call to
be the marketer itself calling and so it harms both the
consumer and the business if it's done.
We believe it also undermines the integrity and trust in
this communication channel, which also is harmful to the
economy, to government and so forth as we look at
communications within the United States. The DMA issued
guidance about spoofing a long time ago. It's attached to my
written testimony.
Caller ID, properly used, helps the consumer. It let's them
know who is calling, what it is and you can channel your phone
calls yourself and have control over your telephone inbox. So
long ago, the DMA required its members to present Caller ID,
including the name of the company and send not fraudulent,
truthful--sending out that information.
But to be fully useful, Caller ID has to--marketers have to
be able to change Caller ID information. If I'm calling you as
a telemarketer, Senator Nelson and there's the number and you
want to try and get back to me, that phone number will be
consistently busy because it's an outgoing telephone number.
So the idea is, we have to put in a consumer customer
service number where there are people ready to respond to the
call, respond to the request from the consumer, including even
putting them on the company's specific Do Not Call list.
So there has to be an ability for the direct marketer to
alter the Caller ID, but not for fraudulent purposes but to
actually assist the consumer. Also, another problem is the duty
of the marketer should be to transmit to the carrier the proper
Caller ID information. We've found many times in instances that
in presenting it to the consumer's phone, the information
sometimes gets garbled and the marketer should not--if they
have transmitted the information correctly, that should be the
duty of the marketer. Now, it's no doubt when it has happened,
there have been times when the number is altered when it's
received by the consumer so that the local area code is placed
in front of the number. And of course, the poor individual who
then has that number that gets all the calls, gets angry at the
marketer and eventually we find out and try and work it out
quickly and communications carriers are helpful in trying to
fix that and so forth; but we want to make sure that the
liability on the marketer is to transmit to the carrier the
proper information. That is the duty of the marketer.
Looking at S. 704, we support S. 704. We think if you added
an intent to defraud or cause harm standard, you would protect
the marketer, those situations that I just mentioned in the
sense of changing to a customer service number, transmitting
the proper number to the carrier. It also would cover, we
think, some of the instances that you mentioned, Senator
Nelson, concerning the police trying to protect police numbers,
not showing them, centers, shelters for homeless women,
battered women that calling out, you don't want to show the
number of that. Put some other number in there, a social
service number or something so that you can try and protect
people.
Those are things, I think, that we need to try and protect
in S. 704, those kinds of changes. We want to go after the
spoofers, give the FCC all the authority it needs to shut these
people down and we just need the ability to make Caller ID a
valuable service as long as we're not using it to defraud or
deceive. Thank you very much.
[The prepared statement of Mr. Cerasale follows:]
Prepared Statement of Jerry Cerasale, Senior Vice President,
Government Affairs, Direct Marketing Association, Inc.
I. Introduction & Summary
Good morning Mr. Chairman and Members of the Committee. I am Jerry
Cerasale, Senior Vice President for Government Affairs of the Direct
Marketing Association, and I thank you for the opportunity to appear
before the Committee as it examines S. 704 and the Caller ID spoofing
issue in general.
The Direct Marketing Association, Inc. (``DMA,'' www.the-dma.org)
is the leading global trade association of businesses and nonprofit
organizations using and supporting multichannel direct marketing tools
and techniques. DMA advocates industry standards for responsible
marketing, promotes relevance as the key to reaching consumers with
desirable offers, and provides cutting-edge research, education, and
networking opportunities to improve results throughout the end-to-end
direct marketing process. Founded in 1917, DMA today represents more
than 3,600 companies from dozens of vertical industries in the U.S. and
50 other nations, including a majority of the Fortune 100 companies, as
well as nonprofit organizations. Included are catalogers, financial
services, book and magazine publishers, retail stores, industrial
manufacturers, Internet-based businesses, and a host of other segments,
as well as the service industries that support them.
DMA and our members appreciate the Committee's continued outreach
to the business community on important issues such as Caller ID
spoofing. DMA fully supports the efforts of Senators Nelson, McCaskill,
and Snowe, and the Committee, to enact legislation prohibiting Caller
ID spoofing. Spoofing is a malicious practice that undermines Caller ID
as a useful verification device, and can cause harm to both consumers
and business. DMA has long recognized Caller ID as an important
enhancer to two-way communication between people making and receiving
calls, especially in the context of business and customer relations.
Caller ID provides consumers with choice and control over their
telephones. It alerts a consumer as to the identity of a caller and
allows the consumer to choose whether to answer a call from a marketer
offering a product or service of interest.
Caller ID, when used for illegitimate purposes, can have a harmful
effect on consumers and legitimate marketers and other businesses. Bad
actors use Caller ID spoofing to damage a competitor's reputation, to
gain unauthorized access to a consumer's personal information, and to
commit illicit practices such as phishing and pretexting. The
cumulative effect is consumer confusion, possible identity theft, and
the transfer of ill will to legitimate businesses and marketers. We
believe that spoofing, and, in general, the manipulation of Caller ID
for illegitimate purposes, should be prohibited.
Understanding the importance of standards and best practices in
fostering consumer choice, DMA several years ago, working with our
members, developed and adopted Caller-ID Requirements as part of our
Guidelines for Ethical Business Practice (``Guidelines''), to
specifically discourage illegitimate telemarketing practices that
threaten to undermine consumer confidence and relations with legitimate
marketers.\1\ In 2004, in response to a rise in Caller ID spoofing, DMA
issued an advisory detailing marketers' rights and responsibilities
when using Caller ID technology.\2\ DMA requires its members, including
nonprofits and other groups, to transmit Caller ID information.
Specifically, when DMA members make marketing calls, they are required
to transmit the name of the seller and the telephone number by which a
called party can call back during normal business hours to ask
questions or request not to receive future calls. Under our Guidelines,
DMA members must not transmit a false name or telephone number.
---------------------------------------------------------------------------
\1\ Caller-ID/Automatic Number Identification Requirements, Article
#46, DMA Guidelines for Ethical Business Practice, at 23 (attached)
(available at http://www.the-dma.org/guidelines/
EthicsGuidelines.shtml).
\2\ DMA Statement Caller-ID Falsification, September 2004
(attached) (available at http://www.thedma.org/guidelines/callerid/
shtml).
---------------------------------------------------------------------------
DMA also supports the importance of accurately disclosing identity
and contact information in other forms of marketing communications. For
example, in the e-mail context, our Guidelines detail responsible
practices for marketers to disclose accurate identifying information.
The problems caused by inaccurate e-mail headers are similar to those
in the Caller ID spoofing context. In 2002, in response to illegitimate
actors manipulating e-mail message headers, we developed and adopted
Commercial Solicitations Online requirements as part of our
Guidelines.\3\ Our members are required to clearly disclose the
marketer's identity and street address in e-mail solicitations. The
identity of the sender of the message must be provided clearly,
honestly, and not in a misleading manner. The subject lines must
accurately convey the content of the message, and the header
information must be accurate. These requirements are also part of the
CAN-SPAM Act that emerged through this Committee.
---------------------------------------------------------------------------
\3\ Commercial Solicitations Online, Article #38, DMA Guidelines
for Ethical Business Practice, at 20 (attached) (available at http://
www.the-dma.org/guidelines/EthicsGuidelines.shtml).
---------------------------------------------------------------------------
II. Legislation Should Include an ``Intent To Defraud or Cause Harm''
Requirement
As stated at the outset, DMA supports the purpose of S. 704, to
prevent the manipulation of Caller ID for fraudulent, spoofing
purposes. While the practice of spoofing to defraud or cause harm to a
person is unacceptable, there are legitimate reasons for transmitting
Caller ID information that is different from the calling party's
information that the Committee should ensure are not restricted.
Blocking or modifying Caller ID information is necessary in several
contexts such as safety, protecting privileged communications, and in
business and customer relations. Businesses rely on the practice of
modifying Caller ID for such purposes as to facilitate a consumer's
request to be placed on a business's do-not-call list and to properly
disclose the identity of the entity on whose behalf a third-party
marketer is calling. In order to ensure that non-spoofing activities
that may involve display of Caller ID information that is different
from that of the entity making the call are not unintentionally covered
by the legislation, we suggest that the scope of conduct covered by the
legislation should be narrowed to restrict only such acts committed
with ``intent to defraud or cause harm.''
Inclusion of such an ``intent to defraud or cause harm'' standard
will serve the purpose of explicitly recognizing that the widely
adopted business practice of transmitting a customer service telephone
number in place of the calling party's telephone number is not
restricted. Without such an intent standard, telemarketers that
substitute a customer service telephone number for call back purposes
could be covered by the bill. This practice is, in fact, currently
required under existing law whereby marketers are required to transmit
a telephone number through a caller identification service by which a
called party may place a return call to make inquiries or request that
their telephone number be added to the calling party's do-not-call
list. Often businesses provide the telephone number of their customer
service department to facilitate such requests rather than the number
of the calling party's line. Businesses that employ such practices are
not seeking to defraud or mislead customers, but rather transmitting
the most relevant information and creating processes to efficiently
respond to customer requests.
In addition, we are aware of scenarios where the Caller ID
information transmitted from the telemarketer to a telecommunications
carrier is not the same as the information provided by the carrier to
the call recipient. With a strict liability standard, and with no
intent standard, telemarketers could be liable for an act of the
carrier over which the telemarketer has no control. Thus, the addition
of an ``intent to defraud or cause harm'' standard also will ensure
that a telemarketer is only responsible for accurately providing Caller
ID information to the carrier and not for incorrect transmission by the
carrier.
Requiring that a calling party provide its exact name and telephone
number could jeopardize legitimate practices and restrain consumer
preferences. Requiring ``intent to defraud or cause harm'' will ensure
that bad actors with ill intent are targeted by the legislation rather
than legitimate practices, customer preferences, and the underlying
technology used. We believe that tying the act of transmitting
misleading Caller ID information with an intent standard appropriately
identifies the offending act while ensuring that businesses are not
liable for simple mistakes or other instances where changing the Caller
ID information is appropriate. We note that this is the approach that
is in the Caller ID spoofing bills that recently passed the House of
Representatives.
* * * * * * *
Thank you for your time and the opportunity to speak before your
Committee. I look forward to your questions and working with the
Committee on this legislation.
Excerpts from the DMA Guidelines for Ethical Business Practice
Commercial Solicitations Online
Article #38
Marketers may send commercial solicitations online under the
following circumstances:
The solicitations are sent to the marketers' own customers,
or
Individuals have given their affirmative consent to the
marketer to receive solicitations online, or
Individuals did not opt out after the marketer has given
notice of the opportunity to opt out from solicitations online,
or
The marketer has received assurance from the third party
list provider that the individuals whose e-mail addresses
appear on that list:
have already provided affirmative consent to receive
solicitations online, or
have already received notice of the opportunity to have
their e-mail addresses removed and have not opted out, and
The individual is not on the marketer's in-house suppression
list
Within each e-mail solicitation, marketers should furnish
individuals with a notice and an Internet-based mechanism they can use
to:
Request that the marketer not send them future e-mail
solicitations and
Request that the marketer not rent, sell, or exchange their
e-mail addresses for online solicitation purposes
If individuals request that their names be removed from the
marketer's in-house online suppression list, then the marketer may not
rent, sell, or exchange their e-mail addresses with third parties for
solicitation purposes.
The above requests should be honored within 10 business days, and
the marketer's opt-out mechanism should be active for at least 30 days
from the date of the e-mail solicitation.
Only those marketers that rent, sell, or exchange information need
to provide notice of a mechanism to opt out of information transfer to
third-party marketers.
Marketers should process commercial e-mail lists obtained from
third parties using DMA's E-Mail Preference Service suppression file.
E-MPS need not be used on one's own customer lists, or when individuals
have given affirmative consent to the marketer directly.
Solicitations sent via e-mail should disclose the marketer's
identity and street address. The subject and ``from'' lines should be
clear, honest, and not misleading, and the subject line should reflect
the actual content of the message so that recipients understand that
the e-mail is an advertisement. The header information should be
accurate. A marketer should also provide specific contact information
at which the individual can obtain service or information.
* * * * * * *
Caller-ID/Automatic Number Identification Requirements
Article #46
Wherever the technology is available marketers should:
Transmit a telephone number such as the telephone number of
the seller, service bureau, or customer service department that
the consumer can call back during normal business hours to ask
questions and/or to request not to receive future calls and
Transmit the name of the seller or service bureau
Marketers should not block transmission of caller identification or
transmit a false name or telephone number.
Telephone marketers using automatic number identification (ANI)
should not rent, sell, transfer, or exchange, without customer consent,
telephone numbers gained from ANI, except where a prior business
relationship exists for the sale of directly related goods or services.
______
DMA Statement Caller-ID Falsification
Falsely altering Caller-ID information for marketing purposes is not
only unethical, it is illegal!
In response to recent news reports about a new Caller ID service
that would allow subscribers to transmit false Caller-ID information,
The DMA has issued this statement to remind marketers about their
rights and responsibilities when using Caller-ID technology.
When calling customers or prospects, it is deceptive and unlawful
for a marketer to knowingly substitute and transmit a false, or
`dummy,' telephone number. Rather, wherever the technology is
available, a marketer must:
transmit the name of the seller or service bureau; and
transmit an accurate and valid telephone number for the
seller, the service bureau, or respective customer service
department. A consumer should be able to call back this
telephone number during normal business hours to ask questions
and/or to request not to receive future calls.
Please note that a marketer MAY transmit a Caller-ID telephone
number that is DIFFERENT from the number from which the call is coming
AS LONG AS the number transmitted correctly identifies the name of the
seller or service bureau and is a valid number that the consumer may
call back during normal business hours to ask questions and/or to
request not to receive future calls. For example, sometimes it may be
necessary to transmit a Caller-ID number for the customer service
department, instead of the number of the representative who is calling
(since the representative's number will likely be busy). In this
instance, substituting the customer service department number provides
the consumer with a number he/she can call back for more information
and/or to request to be put on the company's do-not-call list.
A marketer who intentionally creates and transmits inaccurate or
false Caller-ID information is violating Federal law--for starters, the
Federal Trade Commission Act (which outlaws unfair and deceptive trade
practices), the Federal Trade Commission's Telemarketing Sales Rule,
and the Federal Communications Commission's Telephone Consumer
Protection Act.
Moreover, transmitting false Caller-ID information violates the
Direct Marketing Association's Guidelines for Ethical Business
Practices (Article #44 and Article #51). Specifically, Article #44
(Caller-ID/Automatic Number Identification Requirements) advises:
``Marketers should not block transmission of caller identification or
transmit a false name or telephone number . . .'' Article #51 (Laws,
Codes, and Regulations) calls for marketers to abide by state, Federal
and local laws governing marketing practices and business transactions.
Senator Stevens. Senator, I'm going to have to leave. Could
I just ask if you'd do two things. First, there is a House
bill, H.R. 251 that has been passed and has been sent to the
Senate. Senator Kyl has a bill, S. 1654, which has been sent to
Judiciary. I think there is a criminal side of this and there
is also a communications side of it. I'd appreciate it very
much if you could give us, give to our staff, any suggestions
you have about modifications of the bill with regard to the
communications aspect so that we could have that information
before the mark up next week.
I do believe we will mark up the bill and get it out next
week, but I'd hope that we'd be able to make any changes that
would be necessary to get it to the floor in a manner that
would not be controversial. I think if you have amendments that
we can consider next week, it would be very helpful. Thank you
very much. I hope you'll make me a co-sponsor, Mr. Chairman.
Senator Nelson. Without objection.
Senator Stevens. Thank you.
Senator Nelson. Thank you, Senator.
Senator Stevens. I also have questions I'll file for the
record.
Senator Nelson. OK. Thank you, Mr. Cerasale. Ms. Knight?
STATEMENT OF ALLISON KNIGHT, STAFF COUNSEL AND
DIRECTOR, PRIVACY AND HUMAN RIGHTS PROJECT,
ELECTRONIC PRIVACY INFORMATION CENTER (EPIC)
Ms. Knight. Good morning. Senator Nelson, Members of the
Committee, thank you for the opportunity to testify today on
Caller ID spoofing and the Truth in Caller ID Act of 2007, S.
704. My name is Allison Knight and I'm Staff Counsel and
Director of the Privacy and Human Rights Project at the
Electronic Privacy Information Center.
I'd like to discuss two separate and important privacy
interests related to the issue of Caller ID spoofing and the
first is the right for call recipients to be free from
pretexting and other fraud that can lead to the loss of their
privacy and the threats of stalking, identity theft and
harassment and we've heard from the other panelists on this
issue.
The second is the rights of callers to limit the disclosure
of their phone numbers in order to protect their privacy and in
some cases, their safety. The Truth in Caller ID Act of 2007,
S. 704, as currently drafted, does not adequately protect both
of these interests. EPIC recommends that any ban on Caller ID
spoofing include an intent requirement so that spoofing is only
prohibited where it is clear that the person who does not
provide identifying information intends to defraud or to cause
harm.
EPIC recommended the inclusion of an intent requirement in
testimony on a similar bill introduced in the House last year
and this intent requirement was incorporated into the version
of the bill that recently passed in the House that was just
referred to, H.R. 251. As Mark Rotenburg, Executive Director of
EPIC stated, ``an intent requirement preserves the privacy
rights of callers and permits legitimate uses of spoofing while
outlawing fraud and harassment assisted by the technology.''
We also have concerns about the provision in the Senate
bill that permits law enforcement agencies to possibly
misrepresent their identities in the context of
telecommunications services.
Before Caller ID services were offered, telephone customers
generally had the ability to control the circumstances under
which their phone numbers were disclosed to other people. Many
individuals have legitimate reasons to report a different
number than the one presented on Caller ID. For example, a
person may wish to keep his or her direct line private when
making calls from within an organization. Similarly, an
individual with multiple communications devices, such as a
landline and a cell phone and a wireless handheld device, may
want to route all returned calls to one device or a number.
Now, in some circumstances, disclosure of a person's phone
number may also put his or safety at risk. Domestic violence
survivors, shelters and other safe homes need to preserve the
confidentiality of their phone numbers. They may need to
contact abusers without exposing their location in order to
arrange custody or other legitimate matters. They may also need
to contact other third parties, such as businesses that have
permissive privacy policies and may share collected phone
numbers with lists or data brokers. In all of these situations,
preserving anonymity is necessary for the caller's safety.
Caller ID blocking may seem like a viable means for
allowing callers to protect their anonymity while not
misleading recipients, however Caller ID blocking is not a
complete solution because a caller can be identified through
other means, first of all, such as the Automatic Number
Identification System, which was developed for emergency
services. Also, some recipients prevent blocked ID calls and
indications are that the number of individuals doing this is
growing. So in the case of a domestic violence survivor,
attempting to safely reach a required phone number, an
individual would have to use spoofing for the innocent purpose
of preserving the confidentiality of his or her number.
We can't ignore the privacy interests of those who decline
to accept calls from unknown numbers. If an individual has been
habitually harassed by phone calls from a Caller ID-blocked
number, we should not permit the harasser to use spoofing as a
means to circumvent the individual's screening and I believe
this is the purpose, the reason that this bill was introduced.
Caller ID spoofing can create privacy risks. Last year,
EPIC brought to Congress's attention, the problem of pretexting
consumers' phone records. Pretexting is a technique by which a
bad actor can obtain an individual's personal information by
impersonating a trusted entity. For these reasons, the practice
of spoofing for the purpose of fraud or for harm should be
curtailed. Preventing spoofing for harmful reasons would hold
illegitimate spoofers accountable.
Spoofing Caller ID numbers can create a real risk to
individuals who might be defrauded or harmed by illegitimate
uses of the technology, at the same time, it's important not to
punish those who may have a legitimate reason to conceal their
actual phone numbers. The inclusion of an intent requirement in
the Senate bill would focus the punishment on harmful and
fraudulent uses of Caller ID spoofing while preserving
legitimate uses of the technique.
In addition, an intent requirement would render specific
exemptions, such as for law enforcement unnecessary as a
legitimate law enforcement activity that employs spoofing would
be protected by the requirement to show an intent to defraud or
cause harm.
I'd be happy to answer any questions you have. Thank you.
[The prepared statement of Ms. Knight follows:]
Prepared Statement of Allison Knight, Staff Counsel and Director,
Privacy and Human Rights Project, Electronic Privacy Information Center
(EPIC)
Chairman Inouye, Vice Chairman Stevens, and members of the
Committee, thank you for the opportunity to testify today on Caller ID
spoofing and the Truth in Caller ID Act of 2007, S. 704. My name is
Allison Knight and I am Staff Counsel and Director of the Privacy and
Human Rights Project at the Electronic Privacy Information Center. EPIC
is a non-partisan research organization based in Washington, D.C. that
seeks to focus public attention on emerging civil liberties issues and
to protect privacy, the First Amendment, and Constitutional values.
Two separate and important privacy interests meet in the issue of
Caller ID spoofing. First, there is the right of callers to limit the
disclosure of their phone numbers in order to protect their privacy,
and in some cases, their safety. Second, there is the right for call
recipients to be free from pretexting and other fraud that can lead to
the loss of their privacy, and the threats of stalking, identity theft,
and harassment.
The Truth in Caller ID Act of 2007, S. 704, as currently drafted
does not adequately protect both interests. EPIC recommends that any
ban on Caller ID spoofing include an intent requirement, so that
spoofing is only prohibited where it is clear that the person who does
not provide identifying information ``intends to defraud or cause
harm.'' EPIC recommended the inclusion of an intent requirement in
testimony on a similar bill introduced in the House last year,\1\ and
this intent requirement was incorporated into the version of bill that
recently passed in the House.\2\ As Marc Rotenberg, Executive Director
of EPIC stated, ``an intent requirement preserves the privacy rights of
callers and permits legitimate uses of spoofing, while outlawing fraud
and harassment assisted by the technology.'' \3\ We also have concerns
about the provision in the Senate bill that permits law enforcement
agencies to possibly misrepresent their identities in the context of
telecommunications services.
---------------------------------------------------------------------------
\1\ The Truth in Caller ID Act of 2006, H.R. 5126.
\2\ The intent requirement was also included in the Truth in Caller
ID Act of 2007, H.R. 251. EPIC testified on this House bill on February
28, 2007, in support of the intent requirement. The Truth in Caller ID
Act of 2007, H.R. 251 passed the House on June 12, 2007, and was
received into the Senate and referred to the Committee on Commerce,
Science, and Transportation on June 13, 2007.
\3\ H.R. 5126, the Truth in Caller ID Act of 2006: Before the
Subcomm. on Telecommunications and the Internet of the H. Comm. on
Energy and Commerce, 109th Cong. (2006) (statement of Marc Rotenberg,
President and Executive Director, Electronic Privacy Information
Center). See also, H.R. 251, the Truth in Caller ID Act of 2007: Before
the Subcomm. on Telecommunications and the Internet of the H. Comm. on
Energy and Commerce, 110th Cong. (2007) (statement of Allison Knight,
Director, Privacy and Human Rights Project, Electronic Privacy
Information Center).
---------------------------------------------------------------------------
Telephone Customers Have Legitimate Reasons to Withhold Their Phone
Numbers
The introduction of Caller ID services and the associated Automatic
Number Identification (ANI) created new risks to privacy. Before these
services were offered, telephone customers generally had the ability to
control the circumstances under which their phone numbers were
disclosed to others. In many cases, there was little need for a
telephone customer to disclose a personal phone number if, for example,
a person was calling a business to inquire about the cost or
availability of a product or wanted information from a government
agency. In other cases, there was a genuine concern that a person's
safety might be at risk. For example, women at shelters who were trying
to reach their children were very concerned that an abusive spouse not
be able to find their location.\4\
---------------------------------------------------------------------------
\4\ Letter from National Network to End Domestic Violence to the
House Committee on Energy and Commerce (May 16, 2006).
---------------------------------------------------------------------------
In the context of the Internet and the offering of voice services
over Internet Protocol (VoIP), there are additional concerns about the
circumstances under which a person may be required to disclose their
identity. The Supreme Court has repeatedly made clear that the right to
be anonymous is protected by the First Amendment and also that the
Internet is entitled to a high level of First Amendment protection.\5\
---------------------------------------------------------------------------
\5\ Watchtower Bible & Tract Society v. Village of Stratton, 536
U.S. 150 (2002), McIntyre v. Ohio Elections Commission, 514 U.S. 334
(1995), and Talley v. California, 362 U.S. 60 (1960); ACLU v. Reno, 521
U.S. 844 (1997).
---------------------------------------------------------------------------
Many individuals have legitimate reasons to report a different
number than the one presented on Caller ID. For example, a person may
wish to keep her direct line private when making calls from within an
organization. Such an arrangement legitimately gives call recipients a
number to which they can return a call, but prevents an individual
person's phone from being inundated with calls that should be routed
elsewhere.
In addition to threatening a person's rights to privacy and to
freedom of speech, in some circumstances disclosure of a person's phone
number may also put his or her safety at risk. For example, domestic
violence survivors, shelters, and other safe homes need to preserve the
confidentiality of their phone numbers. They may need to contact
abusers without exposing their location, in order to arrange custody or
other legitimate matters. They may need to contact businesses the
abuser is acquainted with, and that may share survivor information with
the abuser. They may also need to contact other third parties, such as
businesses that have permissive privacy policies, and thus share
collected telephone numbers with list or data brokers. In all of these
situations, preserving anonymity is necessary for safety.\6\
---------------------------------------------------------------------------
\6\ Domestic Violence and Privacy, Electronic Privacy Information
Center http://www.epic.org/privacy/dv/.
---------------------------------------------------------------------------
Caller ID Blocking Does Not Adequately Protect Privacy Interests
Caller ID blocking may seem like a viable means for allowing
callers to protect their anonymity while not misleading recipients.
However, Caller ID blocking is not a complete solution. One reason for
this is that Caller ID is not the only way that a caller can be
identified. Another system, known as Automatic Number Identification,
or ANI, will still disclose a caller's identity in many situations,
regardless of whether or not the caller used call blocking. This means
that many businesses, emergency service providers, and anyone with a
toll-free number can reliably gain the phone number of a caller, even
if Caller ID is blocked. Spoofing services can protect the anonymity of
a caller's ANI data when calling toll-free numbers and those entities
that use ANI identification.
Some recipients prevent blocked ID calls, and indications are that
the number of individuals doing this is growing. In the case of a
domestic violence survivor attempting to safely reach a required phone
number, an individual would have to use spoofing for the innocent
purpose of preserving the confidentiality of his or her number.
We also cannot ignore the privacy interests of those who decline to
accept calls from unknown numbers. If an individual has been habitually
harassed by calls from a caller-blocked number, we should not permit
the harasser to use spoofing as a means to circumvent the individual's
screening. At the same time, it is clear that there could be
prosecution for harassment whether or not additional prohibition on
spoofing were enacted.\7\
---------------------------------------------------------------------------
\7\ See 47 U.S.C. 223; 47 U.S.C. 227.
---------------------------------------------------------------------------
Spoofing Can Create Privacy Risks
This is not to say that Caller ID spoofing is an unqualified good--
far from it. Last year, EPIC brought to Congress's attention the
problem of pretexting consumers' phone records.\8\ Pretexting is a
technique by which a bad actor can obtain an individual's personal
information by impersonating a trusted entity. Pretexters have spoofed
the telephone numbers of courthouses, in order to harass people for
supposedly missing jury duty, threatening fines or arrest unless they
turn over Social Security Numbers or other personal information.\9\ Rob
Douglas of PrivacyToday.com, with whom EPIC has worked on the
pretexting issue, noted how fraudsters would use spoofing services in
order to fool customers into thinking that fraudulent calls were coming
from trusted sources.\10\
---------------------------------------------------------------------------
\8\ Protecting Consumers' Phone Records: Before the Subcomm. on
Consumer Affairs, Product Safety, and Insurance of the S. Comm. on
Commerce, Science, and Transportation, 109th Cong. (2006) (statement of
Marc Rotenberg, President and Executive Director, Electronic Privacy
Information Center). http://www.epic.org/privacy/iei/
sencomtest2806.html; Phone Records for Sale: Why Aren't Phone Records
Safe From Pretexting?: Before the H. Comm. on Energy and Commerce,
109th Cong. (2006) (statement of Marc Rotenberg, President and
Executive Director, Electronic Privacy Information Center) http://
www.epic.org/privacy/iei/pretext_testimony.pdf.
\9\ Sid Kirchmeyer, Scam Alert: Courthouse Con, AARPBulletin, May
2006, http://www.aarp.org/bulletin/consumer/courthouse_con.html.
\10\ Phone Records for Sale: Why Aren't Phone Records Safe From
Pretexting?: Before the H. Comm. on Energy and Commerce, 109th Cong.
(2006) (statement of Robert Douglas, CEO, PrivacyToday.com), http://
www.privacytoday.com/HC020106.htm.
---------------------------------------------------------------------------
For these reasons, illegitimate spoofing activities should be
curtailed. Law enforcement and telephone companies can retrace these
calls to the originating service.\11\ A spoofed number is not
completely anonymous and without accountability. Preventing spoofing
for harmful reasons will hold illegitimate spoofers accountable.
---------------------------------------------------------------------------
\11\ Peter Svenson, Caller ID Spoofing Becomes All Too Easy, USA
Today, Mar. 1, 2006, http://www.usatoday.com/tech/news/2006-03-01-
caller-id_x.htm.
---------------------------------------------------------------------------
Intent Requirement
The inclusion of an intent requirement in the Senate bill would
focus the punishment on harmful and fraudulent uses of Caller ID
spoofing while preserving legitimate uses of the technique. In
addition, an intent requirement would render specific exemptions for
law enforcement unnecessary, as legitimate law enforcement activity
that employs spoofing would be protected by the requirement to show
intent to defraud or cause harm.
Significance of NSA Surveillance Program for Privacy of Call Records
Mr. Chairman, I would also like to bring to the Committee's
attention our concern that the National Security Agency may have
constructed a massive database of telephone toll records of American
consumers. Last year, EPIC filed a complaint with the Federal
Communications Commission in which we alleged that Section 222 of the
Communications Act, which protects the privacy of customer record
information, might have been violated.\12\ We urged the Commission to
undertake an investigation of this issue. In light of the ongoing
controversy about the possibility that Federal privacy laws were
violated, the need to pursue this investigation is clear.
---------------------------------------------------------------------------
\12\ EPIC Complaint to the Federal Communications Commission (May
16, 2006).
---------------------------------------------------------------------------
We respectfully ask Members of this Committee to support EPIC's
recommendation that the FCC undertake an investigation of the possibly
improper disclosure of telephone toll records by the telephone
companies that are subject to the privacy obligations contained in the
Communications Act. If the Communications Act was violated, that should
be of great concern to the Committee.
Conclusion
Spoofing Caller ID numbers can create a real risk to individuals
who might be defrauded or harmed by illegitimate uses of this
technology. At the same time, it is important not to punish those who
may have a legitimate reason to conceal their actual telephone numbers.
The inclusion of an intent requirement in the Truth in Caller ID Act of
2007 would significantly improve the bill by distinguishing between
appropriate and inappropriate Caller ID spoofing.
I will be happy to answer any questions you might have at this
time.
Senator Nelson. Thank you, Ms. Knight. Mr. Jones?
STATEMENT OF HON. RON JONES, COMMISSIONER,
TENNESSEE REGULATORY AUTHORITY; CHAIRMAN,
CONSUMER AFFAIRS COMMITTEE, NATIONAL ASSOCIATION OF REGULATORY
UTILITY COMMISSIONERS
Mr. Jones. Thank you, Senator Nelson and members of the
Committee. NARUC represents the state public utility
commissions, the PUCs in all 50 states, the District of
Columbia and U.S. territories with jurisdiction over
telecommunications, electricity, natural gas, water and other
utilities and in this capacity, the PUCs are on the frontline
of consumer protection in these areas and are often the first
to learn of emerging consumer concerns.
NARUC is pleased to be here in support of the enactment of
Caller ID spoofing legislation. In fact, NARUC considered and
passed a resolution that was adopted at our summer meeting in
2006. As has been mentioned here, Caller ID spoofing harms
consumers in the areas of identity theft, credit card fraud,
public safety, endangerment, law enforcement interference and
other areas.
But more specifically of concern to NARUC, NARUC believes
that government at all levels must be able to identify and
address new and novel threats in a timely fashion to ensure the
safety of consumers. Allowing the practice of Caller ID
spoofing to continue may reduce consumer trust in many of the
public, commercial, financial and political institutions that
are relied upon by American consumers.
NARUC is pleased with the inclusion of language in S. 704,
acknowledging the key role state officials play in protecting
consumers through enforcement of state laws that are consistent
with Federal rules. NARUC's one suggestion for change in the
bill would be to strike the section limiting state action while
a Federal enforcement action or proceeding is pending. Federal
and state agencies can mutually benefit from revelations
gleaned from concurrent investigation of violations of their
respective laws and we see a great benefit in not taking cops
off the beat, so to speak.
Consumer protection is and has been for a long time, a core
competency of state commissions. States should not be
encumbered from investigation and enforcement of violations of
state law.
Caller ID spoofing is a key tool in identity theft efforts
by criminals. The Federal Trade Commission reports that 10
million individuals are victims of identity theft each year and
identity theft is the number one consumer complaint. Passage of
the Truth in Caller ID Act of 2007 will be a huge step forward
in reducing the problem of identity theft. NARUC believes it
will remove a major weapon that is Caller ID spoofing from the
arsenal of criminals.
Senator Nelson and members of the Committee, NARUC and its
members are committed to working with you to protect consumers
and we urge your swift passage of S. 704 to end the practice of
Caller ID spoofing and we certainly thank you for inviting
NARUC to testify before the Committee and I'd be happy to
answer any questions.
[The prepared statement of Mr. Jones follows:]
Prepared Statement of Hon. Ron Jones, Commissioner, Tennessee
Regulatory Authority; Chairman, Consumer Affairs Committee, National
Association of Regulatory Utility Commissioners
Mr. Chairman, Vice Chairman Stevens, and Members of the Committee,
thank you for the opportunity to testify today on S. 704, the ``Truth
in Caller ID Act of 2007.''
I am Ron Jones, Commissioner with the Tennessee Regulatory
Authority and a member of the National Association of Regulatory
Utility Commissioners (NARUC). I serve as Chairman of NARUC's Committee
on Consumer Affairs. NARUC represents State public utility commissions
(PUCs) in all 50 States, the District of Columbia and U.S. territories
with jurisdiction over telecommunications, electricity, natural gas,
water and other utilities. In this capacity, PUCs are on the frontline
of consumer protection in these areas and are often the first to learn
of emerging consumer concerns.
We commend you, Co-Chairman Stevens, the sponsors of this
legislation Senators Nelson and Snowe, your staffs and other committee
members, for addressing the issue of Caller ID fraud, otherwise known
as Caller ID spoofing. Caller ID spoofing is an issue of growing
concern and one of the many tools criminals can use to perpetrate fraud
and steal the identities of hard-working, law-abiding Americans.
I am pleased to be here today to present NARUC's support for
enactment of Caller ID spoofing legislation that would prohibit the
intentional falsification of the name or number that appears on a
customer's caller identification (ID) display. A resolution to this end
was adopted at the NARUC Summer Meeting in 2006, which I have submitted
for the record with my testimony. The resolution was adopted in
response to growing consumer complaints concerning the practice of
Caller ID spoofing and notes the important role state PUCs play in
policing such activities.
The telecommunications industry has experienced a decade of
unprecedented technological innovation bringing consumers an array of
new communications devices and services. Unfortunately, with new
technology often come new risks and increased opportunities criminals
can exploit for their own nefarious purposes.
Previously, special equipment and knowledge was necessary to fake
Caller ID information. However, the rise of new multifunctional, user
friendly, Internet technologies and Voice over Internet Protocol (VoIP)
has put spoofing within easy reach of scammers. All one has to do is go
to a website, pay a small fee--often as low as $10--type in the number
you'd like to call then input the name and number that you would like
to be displayed on the call recipients Caller ID. It is as easy as
that.
How is Caller ID spoofing being used and how is it harming
consumers? There are several areas in which this technology is being
used to harm consumers, including but certainly not limited to:
Identity theft: Caller ID fraud is a key tool in pretexting
which is the practice of obtaining personal information under
false pretenses
Criminals can falsify the home number of consumers to
activate or make purchases on stolen credit cards
Emergency calls to 911 call centers can be fabricated
diverting public safety resources away from real emergencies
Terrorists could use it to mask their true location
hampering law enforcement
An ex-spouse could use it to harass a former wife or husband
who has blocked calls from their phone
Each of these examples is alone a legitimate reason to prohibit the
practice of Caller ID spoofing. Taken together they provide
overwhelming evidence of the need for this legislation. In our
increasingly technological age, government at all levels must be able
to identify and address new and novel threats in a timely fashion to
ensure the safety of consumers. Allowing the practice of Caller ID
spoofing to continue may reduce consumer trust in many of the public,
commercial, financial and political institutions that are relied upon
by American consumers.
The full extent of Caller ID spoofing is difficult to ascertain. By
its very nature the goal is to disguise the true identity of the
perpetrator and their motives. In many cases a consumer may not even
know they were a victim of Caller ID spoofing. States, like the Federal
Government, are becoming more aware of this problem and are looking to
prohibit the practice.
In my home State of Tennessee, our Senate approved Caller ID
spoofing legislation but it failed to pass the House. Although my state
does not have a specific Caller ID spoofing law, we are collecting
information and learning the extent of such fraud through our oversight
of the State Do Not Call (DNC) Registry.
When a complaint regarding a DNC Registry violation is received
from a consumer, the Authority initiates an investigation. If it is
subsequently determined that the Caller ID information utilized in the
violation was falsified, it is noted in the record. A review of 2007 Do
Not Call violations found forty-two complaints that the Regulatory
Authority was not able to fully investigate because the originator of
the call could not be determined or contacted. This happened because
the number provided to us by the Do Not Call complainant was a spoofed
number and could not be traced back to the caller despite agency
subpoenas for phone records of the complainant in an effort to
determine the identity of the caller.
The forty-two complaints represent about 14 percent of the total Do
Not Call complaints received by the Tennessee Regulatory Authority
since the first of this year. While this may not sound like a large
percentage, it is my belief that this number is not representative of
the true scope of this problem. Regardless, each of these identified
forty-two instances of Caller ID fraud is a potential crime and
therefore should not be condoned.
To elaborate on the breadth of this problem, let me share with you
an example of Caller ID fraud investigated by my colleagues in
Nebraska. The Nebraska Public Service Commission investigated a slew of
pre-recorded, automatically dialed calls on the eve of the November
2006 election. The Commission received several complaints about the
politically motivated calls in the days before the election. Upon
investigation, the Commission learned the numbers that appeared on the
Caller ID were fraudulent and in most cases they were phone numbers
that were unassigned. Even with the help of the phone companies they
were unable to determine the actual source of the calls.
NARUC is pleased with the inclusion of language in S. 704
acknowledging the key role State officials play in protecting consumers
through enforcement of State laws that are consistent with Federal
rules. NARUC's one suggestion for change in the bill would be to strike
the section limiting State action while a Federal enforcement action or
proceeding is pending. Federal and State agencies can mutually benefit
from revelations gleaned from concurrent investigation of violations of
their respective laws. Consumer protection is a core-competency of
State commissions; States should not be encumbered from investigation
and enforcement of violations of State law.
As I previously stated, Caller ID spoofing is a key tool in
identity theft efforts by criminals. The Federal Trade Commission
reports that 10 million individuals are victims of identity theft each
year and identity theft is the number one consumer complaint. Passage
of the Truth in Caller ID Act of 2007 will be a big step forward in
reducing the problem of identity theft. It will remove a major weapon,
Caller ID spoofing, from the arsenal of criminals.
Mr. Chairman, members of the Committee, NARUC and its members are
committed to working with you to protect consumers. We urge your swift
passage of S. 704 to end this practice. Thank you for inviting me to
testify before you and I would be happy to answer any questions.
Resolution* Supporting Federal Legislation To Combat Caller
Identification Spoofing
---------------------------------------------------------------------------
\*\Sponsored by the Committees on Telecommunications and Consumer
Affairs. Adopted by the NARUC Board of Directors August 2, 2006
---------------------------------------------------------------------------
Whereas, Congress is considering legislation to prohibit the
intentional falsification of the name or number that appears on a
consumer's caller identification (ID) display, commonly referred to as
``Caller ID spoofing''; and
Whereas, The Truth in Caller ID Act of 2006, H.R. 5126, would make
it unlawful for a person, in connection with any telecommunications
service or VoIP service, to cause any caller identification service to
transmit misleading or inaccurate caller identification information
with the intent to defraud or cause harm; and
Whereas, The use of Internet technology to make telephone calls has
made Caller ID spoofing easier; and
Whereas, Caller ID spoofing may be used for fraudulent or deceptive
purposes which could harm consumers and lessen consumers' trust in the
telecommunications industry; and
Whereas, Caller ID spoofing may also threaten public safety by
fabricating emergency calls and thereby diverting public safety
resources away from real emergencies; and
Whereas, The Federal Communications Commission (FCC) is attempting
to address this problem through enforcement actions and coordination
with the Federal Trade Commission (FTC); and
Whereas, The National Association of Regulatory Commissioners
(NARUC) and its member states have consistently supported and
encouraged consumer protection and safety issues; now therefore be it
Resolved, That the Board of Directors of the National Association
of Regulatory Commissioners (NARUC), convened in its 2006 Summer
Meetings in San Francisco, California, expresses its support for
Federal legislation that would make it unlawful for a person to
transmit misleading or inaccurate caller identification information
with the intent to defraud or cause harm; and be it further
Resolved, That NARUC is committed to working with Congress, the
FCC, the FTC, and the industry on a comprehensive approach to this
issue in order to educate and protect consumers from Caller ID
spoofing.
Senator Nelson. Thank all of you very much. Senator
Klobuchar?
STATEMENT OF HON. AMY KLOBUCHAR,
U.S. SENATOR FROM MINNESOTA
Senator Klobuchar. Thank you, Mr. Chairman. Thank you. I'm
sorry I missed the opening statements. I had another meeting
and I'm the new Senator from Minnesota and I have a background
that is interesting for what we're talking about today because
I practiced in the telecommunications area for 13 years and
worked with NARUC rather extensively, Mr. Jones, and then also
was a prosecutor for 8 years and so I dealt with these issues.
In fact, my claim to fame is that I got a law passed in
Minnesota banning Internet phishing but I still got elected
somehow.
Anyway, my focus here is on trying to solve this in a way
that works. I've encountered these things before where if you
do things too broadly, you can make mistakes but at the same
time, I've seen the consequences of these kinds of fraud and
crime, especially in the criminal areas where perpetrators
might try to pretend they are someone else when they're
calling. And at the same time, I was very interested in what
you were saying, Ms. Knight, because when I was a prosecutor,
we obviously had blocked phones and I know exactly what you
mean, that more and more people don't accept blocked phone
calls so when you have victims of domestic abuse or people at
shelters, there must be a way to get around this. So I'm very
interested and I was talking to Senator Nelson and his staff
about some kind of slight change to this so that we make sure
that those things wouldn't be banned or get someone in trouble
for doing that for what is really a good reason.
So my questions are, well first of all, of you, Mr. Jones
about the idea of striking the section that talks about
allowing state action to continue. Are there state actions that
are ongoing in this area or do you have examples from around
the country where people are looking into this?
Mr. Jones. Well, Senator, I'm not aware of current state
actions. I know in the State of Tennessee, when we have
violations of the Do Not Call Registry and we seek to determine
the manner of that violation, often times that we determine
that that number is a spoof call. But more importantly, what we
seek to try to preserve is the ability for states, when they do
take action or decide to take action, to pursue Caller ID
spoofing and as such, consider legislation that they are able
to do so and they are not encumbered by a prohibition in
Federal law from moving forward.
Senator Klobuchar. Then, Ms. Monteith, did I say your name
correctly? It's easier than mine. But this is based on your
prepared testimony about how the FCC has met with some of the
companies, wireless and wireline and Voice over Internet
Protocol companies, about the Caller ID spoofing issue. Could
you talk a little bit about what they said in terms of any work
that is being done to try to address the issue coming from the
private sector?
Ms. Monteith. Our meetings with service providers were
aimed at both understanding potentially how this works within
the telecommunications network and also discussing with them
whether or not they were getting complaints from their
customers about spoofing activities. We did learn how this
happens in the network, and as I mentioned, there are a variety
of different ways in which a number can be spoofed.
In terms of complaints, we get complaints and I think some
of the telecom carriers have gotten complaints, and they try to
redress them in a variety of ways. Sometimes, as I think the
Committee is aware, we've found it is difficult to determine
where the spoofing is coming from. Sometimes it is couched as
telemarketing. Sometimes it is harassment types of complaints
and it is often times difficult to identify who is at the
bottom of it.
I'm not sure I've addressed your question. I'm sorry,
Senator.
Senator Klobuchar. No, and I can talk to some of them, too.
You know, sometimes there can be technological answers to these
things because it is often like looking for a needle in a
haystack, as you mentioned, to try to find the perpetrator and
beyond that, I remember we dealt with this with the phishing
issue. Often times people are victims and they don't know it.
You didn't hear a complaint because there is some marketer and
maybe they didn't respond positively so we never knew it
happened. But I just wondered if you have seen that happening,
if you think there is a lot more of this going on than we know
of.
Ms. Monteith. That may be the case. In just looking at the
complaint numbers that the Commission has received, we really
have not seen what we would characterize as a large number of
consumer complaints. For example, in 2005, we received two
dozen complaints. In 2006, roughly double that, about 60
complaints, and so far this year, around 30 complaints. Those
are not large numbers of complaints when you're talking about
consumers nationwide having the ability to file complaints with
the FCC.
Senator Klobuchar. Although some people might complain to
the Attorney General's Offices in their state.
Ms. Monteith. Correct.
Senator Klobuchar. I mean, I just remember with the
phishing issue, it was clearly going on. The banks were really
upset about it. Their names were being used fraudulently on
these e-mails and it was going on everywhere and when someone
was a victim, it was bad because they would maybe lose hundreds
of thousands of dollars. But there were many victims that
didn't know they were victims and I'm wondering if that's a
little bit of what's going on here. I don't think I'd remember
if I see some marketing firm on a Caller ID. I might not answer
the phone and never even know it happened. So do you think it's
possible that there is more of it going on that isn't reflected
in the complaints?
Ms. Monteith. Yes, I do think that that's possible.
Senator Klobuchar. All right, good. I just wondered, Ms.
Knight, if you could just talk a little bit more about the
victim angle here and the privacy angle in terms of making sure
as we look at how we could couch some language on the intent
and make it narrow enough that it doesn't preclude prosecution
of these crimes. Sometimes it's hard to prove intent but if you
have someone who is stealing money or something, it makes it a
lot easier. But could you give me your thoughts on that?
Ms. Knight. Sure. The language that EPIC has recommended
would be including an intent to defraud or to cause harm.
Another reason that we chose those two terms was that first of
all, fraud would generally deal with commercial violations and
would imply monetary damages and then second, harm would
appropriately widen the intent requirement beyond strictly
fraudulent activity to capture threats to physical safety
associated with activities such stalking and domestic violence
that I spoke about earlier.
Senator Klobuchar. OK, thank you. Mr. Cerasale, you're the
only one I didn't ask a question of, so I guess my last
question will be for you. I'd asked Ms. Monteith about any
efforts in the private sector of looking at this issue and I
wondered if you knew of any from a technological standpoint?
Mr. Cerasale. Well, from a technological standpoint, our
members--as we said, most of them do, if they are
telemarketers, alter the Caller ID number that is transmitted
to a customer service number where someone will answer. They
keep a record of watching what kind of problems they find,
problems in the final transmission of the Caller ID information
to the recipient. Sometimes that can be garbled and they work
with the carriers to try and fix that. They have not, at this
point--there has not been, from a straight marketer's point of
view, a great clamor to the DMA that this is a major problem.
We are starting to hear it some from banks and so forth,
similar to phishing. I think you have to look at this as
telephone phishing and it starts with the banks. ``Please give
me your number. We have a problem with our computer system and
I need this.''
So those kinds of things are what we're starting to see and
they tend to be a spoofing of someone with whom you have a
true, strong customer relationship. With so many phone numbers
on a National Do Not Call Registry, there are many consumers
who do not, if they are on the registry and someone is
spoofing, they don't care about that. They're just going to
call. Many of those consumers don't answer the phone. So then
that spoofing may occur, as you spoke about and it's not
reported, because I don't respond, because I'm not supposed to
be receiving telemarketing phone calls, because I'm on the
list. But if I receive something from my bank or something
where I have a really close relationship, those are the ones
that will be answered and we're starting to hear some noise
from banks on that. And it looks like it may be that banks and
similar types of financial institutions are going to do the
same thing they've done with phishing--we will never call you
and ask you directly for your account numbers, just like we'll
never send you an e-mail asking for your account numbers. And I
think that's the way that we see beginning, from a marketers'
standpoint, of trying to combat the spoofing of a financial
institution to try and defraud.
Senator Klobuchar. Well, thank you. Now, I would point out,
when we embarked on this phishing adventure a few years ago in
our state, I just noticed yesterday--I was reading the Star and
Tribune in Minneapolis and they had just convicted someone or
charged someone. So I think that I wanted to thank Senator
Nelson for being out front on this with Senator Snowe.
I think just because we've seen a creeping number of
complaints going up is all the more reason that you want to get
at least some tools in place that law enforcement can use,
knowing we don't really know what direction this will go. But
at the same time, making sure that we protect the privacy
interests and I believe, some of the state interests, as the
witnesses pointed out. Thank you very much.
Senator Nelson. Senator Klobuchar will be added as a co-
sponsor.
Senator Klobuchar. Thank you.
Senator Nelson. Senator Sununu?
STATEMENT OF HON. JOHN E. SUNUNU,
U.S. SENATOR FROM NEW HAMPSHIRE
Senator Sununu. Thank you, Mr. Chairman. I just have a
couple of questions. First let me begin with some basic
questions that Senator Stevens had and that is just viewing
these things from the consumers' perspective. I guess for each
of our panel members, maybe we can start with Ms. Monteith, if
a consumer has concerns or is a victim of domestic abuse, or
they have a complaint or concern about these kind of fraudulent
activities, is there anything they can do to verify the
accuracy of Caller ID information that is being presented to
them through their phone system?
Ms. Monteith. I do not know the answer to that question,
other than the information, obviously, is displayed on their
customer equipment and calling back the telephone number that's
displayed to attempt to verify whether or not, in fact, it's
the entity that it purports to be, or checking with their
telecommunications carriers and looking at their call records
to determine where calls came from.
But let me look into that question and I'd be happy to get
back with you.
Senator Sununu. Thank you. Second and more broadly, there
certainly was an increase in the number of complaints from 2005
to 2006 regarding spoofing. The number went from 24 complaints
to 60 complaints. This year, we're about halfway through the
year. We've had 30 complaints. It certainly doesn't represent a
dramatic increase and I think overall, it's a relatively modest
number. So I have two basic questions. First, is that level of
activity necessary to do a new piece of legislation and the
second is whether or not the FTC already has the authority to
deal with a good deal of the fraudulent activity.
As you know, the FCC has a responsibility and oversight for
a lot of the IP and broadband voice services. So one, given the
level of complaints and problems and two, given that the FCC
already has some authority in this area, is there is a pressing
need for new legislation and if you think that there is, what
specific enforcement tools are missing that aren't available
already?
Ms. Monteith. I can't comment on the need for legislation.
I would need to let the Commissioners and the Chairman speak
for themselves on that matter. I would say that the FCC would
investigate any consumer complaint, regardless of the number of
consumer complaints that come to us. So in fact, we're looking
at the consumer complaints that have been filed with us and
have taken the initiative to open investigations on this issue
when it came to our attention.
Senator Sununu. But there's nothing restricting you from
opening investigations? There's nothing restricting you from
enacting penalties where fraudulent activity is found?
Ms. Monteith. With respect to penalties, two things, I
think. One, we've already testified that it's not clear that we
have the authority in this area over entities that are not
directly regulated by the Commission and, in fact, that issue
has been raised in response to our Letters of Inquiry by some
of the targets of our investigations. And second----
Senator Sununu. Specifically what entities are you talking
about? As a legislator, I would hope that you don't have any
authority over entities that aren't--you don't specifically
have jurisdiction over. In other words, we set up
jurisdictional boundaries for the clear purpose of not having
overlapping regulations of administration and oversight. So if
there are specific entities that you believe you ought to have
oversight over, you need to be specific about that, about where
those gray areas might exist.
But let me--my understanding is you have oversight of
telecom carriers, which has a long legal history of definition.
Go ahead.
Ms. Monteith. That's correct. I'm talking about entities
that are not directly regulated by the Commission, and not
commenting on whether we ought to have jurisdiction, merely
pointing out that there is a question mark that has been raised
in our investigations as to whether we do have jurisdiction,
since these entities are not directly regulated by the
Commission and do not appear to be common carriers.
Senator Sununu. But with regard to those that you do have
jurisdiction over, you have the ability to open cases, to carry
through enforcement and to levy penalties, correct?
Ms. Monteith. That is correct.
Senator Sununu. Would the other panel members like to
comment?
[No response.]
Senator Sununu. OK. Is there any specific enforcement tool,
putting aside the issue of coverage or jurisdiction, any
enforcement tool that any of the panel members want to
highlight as being unavailable right now or lacking right now
in current legislation?
[No response.]
Senator Sununu. OK, thank you, Mr.--I'm sorry, who is--it
is a Chairman today? Mr. Chairman. Thank you, Mr. Chairman. I
don't want any trouble there. Senator Klobuchar's chair is much
larger than yours so I was entirely confused. I apologize.
[Laughter.]
Senator Klobuchar. We need a visual for that to understand.
Thank you.
Senator Nelson. As a matter of fact, I'm surprised that
Senator Inouye and Senator Stevens allow Senator Rockefeller to
have that big chair here. But because of his back, he has to
have it.
Senator Klobuchar. And it makes me look too small. Please
continue.
Senator Nelson. I want to ask you with the fact that Voice
over Internet Protocol is increasingly becoming a reality and
we estimate some nine million customers today are using
telephone calls through VoIP. And the fact that the FCC has
jurisdiction directly over traditional telephone calls and that
VoIP service providers are not clearly subject to the same FCC
Caller ID regulations. So I wanted to ask any of you, do you
think that this legislation plugs the hole with regard to new
technologies like VoIP?
Ms. Monteith. Yes, it appears to do so. The only issue we
might bring to your attention, Senator Nelson, is that the
definition of VoIP that is crafted in the legislation does not
include a provision for VoIP service that might be provided
without a fee.
Senator Nelson. Without what?
Ms. Monteith. Without a fee. In other words, some VoIP
services may be provided free of charge.
Senator Nelson. And would that not be within the
jurisdiction of the FCC?
Ms. Monteith. Certainly not currently and in reading the
legislation, I believe the legislation defines VoIP as two-way
communications provided for a fee, directly to the public for a
fee. There may be some services that are provided----
Senator Nelson. So if we're trying to get our hands around
spoofing and we want you to have the regulatory authority,
we've got to make that exception.
Ms. Monteith. I believe that it might be appropriate to
include that language and we'd be happy to work with your
staff.
Senator Nelson. OK, thank you for that recommendation.
Commissioner Jones, you have stated in your testimony that some
telemarketers are using spoofing to avoid the Do Not Call list
enforcement. Do you think that this legislation will fix that
problem? And will it make the Do Not Call lists' enforcement
easier for you?
Mr. Jones. Yes, sir. The legislation goes a long way in
addressing that and certainly enforcement will be easier based
on the penalties that are being proposed in there. But of
course, that would only be honored by those who are not bad
actors. But certainly, we believe that goes a long way and as I
stated earlier, what we believe is that what would make it even
stronger is to not prohibit the states from engaging in a
concurrent investigation to the extent that state laws allow
them to do so.
Senator Nelson. And you think the legislation as it is
written, would prohibit the states?
Mr. Jones. From engaging in concurrent investigations, yes,
sir.
Senator Nelson. OK. Are there any other tools that you see
that we need on the Federal level to stop all of this practice?
Mr. Jones. Well, Senator, if I could think about that a
little bit and get something back to you, I would appreciate
that.
Senator Nelson. Well, while you're thinking about it, go
beyond spoofing.
Mr. Jones. OK.
Senator Nelson. And are there any other telecommunications
related scams that we need to examine?
Mr. Jones. Well, beyond spoofing, I think the major one,
which is not strictly telecommunications but the convergence of
technology with the phishing example that was given earlier,
which is a form of web-based spoofing and the URL redirection
that accompanies that, and that's the part of that particular
effort that renders the victim unable to know that he or she
has been spoofed because of the URL redirection. I think, to
the extent that that technology gap is also considered to be
closed, then that certainly will go a long way in stopping the
spoofing in all of its forms, whether it is telecommunications
through Caller ID or whether it is web-based, along with the
URL redirection that accompanies that.
Senator Nelson. You all have suggested that we add the
intent to defraud or cause harm. Does anybody disagree with
that on the panel, if that is needed to be added to the bill?
Ms. Monteith. Senator Nelson, I don't know that the
Commission has taken a position on that and again, I would be
happy to get back to your staff on that issue, after speaking
with the Chairman's Office and the Commissioner's.
Senator Nelson. Well, are there any other tools that you
think that we need to consider in cracking down on this
practice?
Ms. Monteith. No. I do not.
Senator Nelson. OK. Senator Klobuchar?
Senator Klobuchar. You've been very helpful. Thank you to
all four of you.
Senator Nelson. Well, thank you all. It was a very
enlightening hearing and we will proceed with your suggestions
as we mark up the bill next week. Thank you and the hearing is
adjourned.
[Whereupon, at 11:03 a.m., the hearing was adjourned.]
A P P E N D I X
Prepared Statement of Hon. Daniel K. Inouye, U.S. Senator from Hawaii
Millions of Americans use caller identification services to check
the name or number of a calling party before they answer the phone.
Historically, this information has been highly reliable, as attempts to
provide false Caller ID information required specialized equipment and
knowledge. However, with the growth of Internet-based calling
technologies, the ability to send false Caller ID information has
become significantly easier.
As a result, criminals have seized this opportunity. They rely on
sending fraudulent Caller ID information, a practice known as spoofing,
to cloak their identities. These con artists gain their victims trust
by posing as financial institutions or government agencies and use that
trust to deceptively obtain personal information that enables identify
theft or other forms of fraud.
To combat this spoofing problem, Senators Nelson, Snowe, and
McCaskill have introduced legislation S. 704, that would amend the
Communications Act to explicitly prohibit the transmission of
misleading or inaccurate Caller identification in connection with
traditional phone as well as Voice over Internet Protocol services.
I support them in these efforts and look forward to the testimony
from today's witnesses.