A Call to Action: Stop the FCC's KYC Regime(blog.lopp.net) |
A Call to Action: Stop the FCC's KYC Regime(blog.lopp.net) |
don't see the harm in this? isn't this already the case for 99.9% of phoneline havers already?
I can think of a half dozen ways that can get abused. Remember that in the states policing is decentralized. There is always some department somewhere willing to abuse their power. Look at how flock has been used to stalk partners, or how geofencing was used to sweep up everyone in the area of a protest, or how stingray is used to listen to all calls in an area. This is opening up avenues of abuse for almost no benefit.
More concretely, famous for supplying bulk data to the surveillance industry for a nominal fee. That is ostensibly the goals behind this development - all of these companies demanding phone numbers for "verification" and snake oil "2FA" want to reliably dox 100% of their users rather than just 80%.
Back in the days of rotary phones, not only did the phone providers have your name, they even listed it, your home address, and your phone number in the white pages of the phone book, and everyone in town had a copy of it. Before the rise of microcomputers which enabled data tracking and robocalls, which in turn gave rise to demand for privacy from spam, having that information out in public wasn't a problem except for edge cases like domestic abuse victims or people in a witness protection program. The 99.9%, though, are still getting tracked no matter what, and I sometimes wonder if we've sacrificed the convenience and confidence of the phone-book age for an illusion of privacy that relies on anxiety.
The US seems so backwards at times.
Neither of these are true anymore.
Also, the tone is set from the top.
Do you think the current admin cares about actually tackling fraud and abuse?
Most major telcos worldwide outside the US have strict KYC rules, this is not a battle you are going to win, because there are very few legitimate reasons in support.
You can still allow people to hide it, but then by default every non-business phone should block calls with hidden numbers.
> SHAKEN system, short for Signature-based Handling of Asserted information using toKENs [...]
> The name was inspired by Ian Fleming's character James Bond, who famously prefers his martinis "shaken, not stirred". STIR having existed already, the creators of SHAKEN "tortured the English language until [they] came up with an acronym."
https://en.wikipedia.org/wiki/STIR/SHAKEN
(Unrelatedly, seeing a slash used casually within the URL slug feels so wrong)
If the FCC implements this, I expect a lot litigation because of the burden and legal liability this would place on telecom and VOIP companies. There are other less burdensome approaches to preventing spam that the FCC has not tried.
- Providers that can't afford it implement it - Non-IP networks - Small voice service providers that originate calls via satellite using U.S. NANP - Providers that lack control over the network infrastructure necessary to implement
Nothing is going to change as long as those holes exist.
It would certainly hurt a consumption-based economy, for starters.
If your carrier accepts a spoofed call they're already violating FCC recommendations.
I find that abusive on its own but let’s not forget about the fact that now you have victims of domestic violence being forced to answer hidden numbers in case it’s welfare, or the cops, or their abusive spouse.
I would be willing to bet money that any "better call addressing system" would be a design by committee where this just gets litigated there. And we'd end up with either a system that requires KYC per-call, or has compromises similar to what we're complaining about now.
That's already an issue with most cell phones. Making this apply to prepaid phones is even worse.
Is there really not a way to submit an express FCC comment that avoids all my personal info being publicly published to the web? Yeesh.
And if you think your name and address are private, then I have some bad news for you.
Publication is probably a bit much as a default and chills speech a bit, but it’s also important that the federal register can remain public with all public comment on the web. These are official comments on the record.
Phone numbers were designed with the idea that they need to be easily memorizable in your head but I don't think that's really needed today.
At any moment I should be able to discard my contact and redistribute it on my own.
The idea that old numbers get recycled is completely ridiculous as well.
The problem is, with a phone number anyone can. Phone numbers need to operate more like a shared secret.
I was getting an oil change the other day and the guy asked me for my phone number...
I said why? Do you need to call me?
He said, no we just need it to put in the system and it won't let me proceed without one.
I said ok well here is a fake number since you don't need to contact me.
He was visibily frustrated with me, yet inputed the fake number and it allowed him to proceed.
My point with sharing this story is it seems like we have forgotten as a society what the purpose of the phone number is. Your supposed share it when you want to be able to communicate that's it.
It's turned into a required chokepoint to do anything.
Seems that we can’t both get what we want.
A potential solution is that you get your anonymous phone line but my phone provider simply refuses to let you call me with it.
Of course then we need to extend the same principle to data and to IP traffic originating from your device. If you don’t want to be traceable it seems reasonable that services should have the right to refuse to handle IP traffic you generate.
Would such a half-baked level of network access suit your needs?
Why can't you? They don't want to provide info for a credit check, you want human accountability. All that requires is for them to use a debit card for whatever service (prepaid or postpaid). Law enforcement can trace that if needed. No need for credit checks or really any other information directly in the hands of the telco.
I don't think it's necessary to go this far. The provider could indicate something like "CANNOT VERIFY NUMBER". I imagine most people would block such calls.
I would like anonymous political posts to be untraceable by the government.
I can't even get all of what I want.
My guess is that there's some requirement that if it's a working number, it must be able to dial emergency services and that's the loophole that's being exploited. So the FCC's answer is if all numbers must work, push the check directly on the subscriber.
To your point about emergency services—while it's true that any unactivated phone must be allowed to dial 911, that rule only opens a one-way path to emergency dispatch. It doesn't give a device the ability to place outbound calls to everyday citizens. The real loophole isn't a public safety mandate; it's the wholesale VoIP market.
https://www.federalregister.gov/documents/2026/05/26/2026-10...
I think that gets you most of the way to a link that somebody on HN dropped a few days ago:
https://www.fcc.gov/ecfs/filings/express
It requires the docket-id to complete:
Docket No: 17-59
You can double check that Docket Number here: https://www.fcc.gov/document/fcc-seeks-comment-enhanced-know...
Our democracy in action.
Sure, not much money to be had by fighting that fight but basically any PAC should have the means to do this and by claiming money is at stake and not people's actual safety you do have a better chance at this not being dismissed because of how your justice system /is/.
One could argue that it's a failure of law enforcement or telcos or regulators to do enough to prevent fraud and maaaaybe bring a class action or something, but that's a massive stretch.
Suggest phone scams are a $26 B per year industry.
For example, why isn't it the default that when a telemarketer calls me it's not a video call? And why can't I preview their video stream prior to answering?
I get its "impossible" to make everyone change, but i do think we should push forwards...
Patrick: Yes, so "Know Your Customer" (KYC) and "Anti-Money Laundering" (AML)
are mandatory elements of the international compliance regime that have been
in place in the United States since the early 1980s. Over time, this regime
spread globally, largely fueled by the U.S. leveraging the dollar as a tool
of foreign policy—a point where I find myself agreeing with critiques from
the crypto community. Their complaints about this are largely accurate. You
can see this clearly in the documents as these laws were passed and as
supranational bodies increasingly tightened regulations on banking secrecy
havens.
https://www.bitsaboutmoney.com/archive/kyc-and-aml-beyond-th...
https://www.bitsaboutmoney.com/archive/nonprofit-indicted-ba...
https://www.complexsystemspodcast.com/episodes/splc-financia...
https://www.complexsystemspodcast.com/episodes/defendant-cen...
Instead of the government actually trying to catch money laundering, they just make 3rd parties like banks and payment processors judge, jury, executioner. Effectively giving them the power to decide who can do business. And if they decide you can’t, you have no recourse. If the government didn’t give this power to private companies, they would have to prove in court that you are doing something unsavory. And to people saying KYC/AML works, sure. HSBC was laundering billions and these guys know how to get around KYC. You’re just screwing over common people at this point and giving banks and financial institutions power to skirt due process.
Ever since 2020, I've seen more stores that won't take cash, and refuse to go there on principle even if I was going to pay with card anyway.
This seems so clear to me; KYC is an end run around the constitution.
But how do we stop it? If we legislate "no KYC" then what is my recourse when an imposter empties my accounts? You'd want it to be at least allowed.
But if we allow industry to require KYC "we will only deposit your pay to a verified bank account" then you may end up with de facto KYC if not de jure. But if you tell businesses they may not require it, it enables other kinds of fraud.
Legislation does not constrain people who will to do evil.
Use Monero as much as possible. If enough people adopted it, there's absolutely nothing they could do to stop it short of turning off the internet entirely. Even China, with the strictest internet controls in the world, hasn't managed to stop people paying for banned goods and services in crypto there.
This means the parents of adult scammers too. Every scammer has a mother and father who are failing them. If they were doing their jobs, this wouldn't be happening.
In the era of Target specialized AI that can mimic voices, writing styles, communication is now fundamentally compromised without some sort of actual reform
We're making our law enforcement's job marginally easier, by making the criminals' job infinitely easier by creating millions of juicy PII honeypots.
No, you don't need my phone #, real name, captcha.. if you think you do, realign your incentives, and rethink what else can be used for your real need instead.
- It is kind of expensive,
- You are forced to provide it to many official institutions,
- It is the default or mandatory insecure 2FA for many institutions,
- It always get leaked somewhere and is one of the most common/reliable identifier.
We still have them around governments and telcos love it and old people and scammers are its last users.
>AI slop art right at the start
Instant close
Like that is Carr's FCC in a nutshell - he wants to control speech by controlling the airwaves. That is a raw fact in his behavior. But when the news stations say the thing they want them to say, what happens next other than slightly extending the definitions of public good to the internet and then restricting speech?
What they'll do, what they always do, what you can see them actively doing (albeit on other policy axis) even at the local government level, is simply scrutinize these people for other laws they've broken or rules they've run afoul of and then enforce the shit out of those.
We have a real problem with people in government buying into the idea that it's basically a private company set up for the benefit of one man in particular.
https://www.pcmag.com/news/apple-expands-this-location-focus...
Considering most of those same telcos are donors and employers of large numbers of people across many constituencies of almost every nation, usually no politician has or is willing to spend political capital to shoot themselves in the foot like that. And no nation with a national telco company runs it well enough to ever even dream of spending money for something like IP addresses, they typically barely keep the lights on.
They probably do keep records, but something doesn't have to be perfect in order to be better.
I alwys imagined that there are certain shady providers ("grey-market Twilio" sort of idea) that just let you run single outbound call/text requests through a giant pool of numbers shared with other customers of the service. Perhaps specifically a bank of residential numbers plugged into banks of regular cell phones, like a residential IP proxy service provider.
Not every unjust, stupid, or evil thing is illegal.
Even when something is illegal, that doesn't mean you have standing to challenge it in court, or that a given court has jurisdiction to do anything about it.
Courts (theoretically) follow rules. They can't just randomly set things aside without some basis in those rules. Lawsuits are not a magic universal remedy.
You could definitely argue that courts don't always follow rules, and that the Trump administration is doing everything it can to make that worse, but the changes they're making aren't going to work in your favor, because those changes are in the nature of "we can do whatever we want, and fuck the courts if they don't like it".
Easy fix. It should be opt-in to accept a call that is routed through one of these. I know they allow it so some grandma in rural France that still uses a dial phone on a copper line that hasn't been touched since 1962 can call her son in New York, but for the rest of us who are not in that situation, we can just blacklist all those calls and lose nothing. This would even fix spam for the people who opt-in, because so few people have grandmas in rural France that it's not worth it for the spammers to bother anymore.
Easier (and correct) fix: Telecoms operators should not be permitted to provide transit to a call that's routed through one of these.
> I know they allow it so some grandma in rural France that still uses a dial phone on a copper line that hasn't been touched since 1962...
This doesn't make sense. Even my inexpensive Mikrotik switches can augment packets with the ID of the port that they originated from. I do not believe for even a second that Telecoms Grade switching equipment is unable to do the same. The fact that that grandma can send and receive calls tells you that both that that equipment exists and that it knows what port her phone is connected to.
Mikrotik is a young spring chick compared to the dinosaurs in telecom.
The example should rather have been some telecom carrier in Africa or India. Telco equipment is expensive, the technology is ridiculously complex and getting companies especially in less well-off regions to replace aging stuff and updating it to modern standards is next to impossible. Think about it, the globally connected phone system includes countries where you get 10 GBit/s symmetric fiber in your home and it includes countries where people don't even have running water because they're so poor.
The fact that we in Western countries can have a realtime conversation with someone in the Saharan desert or in an Indian village that requires days worth of travel [1] is nothing short of a miracle.
[1] https://www.aljazeera.com/gallery/2024/5/8/an-election-booth...
Citation required.
More widely, however, there do seem to be differences that I don't know the details of. VOIP seems quite different (I use it for my old phones): DID numbers in the US seem extremely cheap and available instantly, with little information, while European ones seem to have an actual verification process and prices that would make large-scale spamming difficult.
Italy has mandatory KYC for all mobile numbers, and scam/spam calls are a common problem. So no, it doesn't fix the problem at all.
Spam calls frequently don't have a source in the same country as their target victim.
It's very unlikely anybody is placing spam/scam calls with regular cell phones when VoIP numbers are easy and cheap to get, and when VoIP systems are far easier to manage.
Almost every spam call has that I get, is spoofed.
Someone here explained it, once.
I think the spoofed calls use a legacy transport tech that can’t be forced to validate.
Not my job to "verify," in the technical sense.
When a call for an Indian crypto pump comes in as "SMITH, ROBERT", and a local exchange, I call that "spoofed."
Unfortunately there isn’t an easy way to report abuse to the telcos (and regulators).