Somos wants attestation replaced with proof

Somos filed 50 pages in WC 17-97 and CG 17-59 on August 10, plus an appendix of proposed rule text. It opens on a single proposition: “no call should be placed onto the telephone network unless it has been authenticated and the party placing it is authorized to do so.”

How much an A-level attestation establishes is contested across the industry: it is the signing provider’s own assertion about its customer, and no rule requires that the assertion be tested. The FNPRM at ¶54 defines attestation as “a voice service provider’s assertion about the knowledge it has of its customer and the customer’s right to use a telephone number.” Somos takes that definition at its word: “where an attestation is the signer’s opinion about a call, a delegate certificate is authentication of the fact the opinion depends on.” And: “no amount of specification converts an opinion into proof.”

A delegate certificate, in Somos’s description, “uses the same authentication and verification procedures as STIR/SHAKEN, built on the same certificate machinery, with one decisive difference: rather than carrying a provider’s participation identity, it cryptographically establishes a specific entity’s authority to use a specific telephone number, validated at the entity level and chained back to the authority of the number holder.”

Right-to-use is separated from the two vetting regimes already in the docket: “KYC and KYUP establish identity and accountability throughout the provider chain. RTU establishes something neither reaches.” A responsible entity, Somos notes, “may be well established and still have no legitimate authority over the numbers it presents.”

The rule asks are specific — define “delegate certificate” in 47 CFR § 64.6300, make verified number-specific RTU a required element of A-level attestation under § 64.6301(b)(1)(iii), keep delegate certificates out of the third-party authentication rule because they are first-party authentication, let non-provider enterprises hold them, and require issuance by an STI-GA-authorized CA chaining to the STI-PA root.

The near-term piece needs no new infrastructure. Somos calls it authorization-first Do-Not-Originate: the right-to-use holder declares which originating providers it has authorized, and “a call signed by a provider not on it is unauthorized on its face and can be dropped, whatever attestation level it carries.” An A-level attestation from an unauthorized signer becomes “objective evidence of improper attestation.”

Somos scopes the transition to enterprise-originated calls — “the calls from banks, healthcare providers, and other institutions that consumers most need to trust and that fraudsters most profitably impersonate” — and leaves consumer mobile origination alone, where a carrier serving its own subscriber already meets A-level criteria. It also asks the Commission to prohibit pay-for-attestation and attestation retaliation.