4 ms·

The #1 issue is the completely insecure, trust nature of the phone system. It should be trivial for a local police department to verify, with a very high degree

The #1 issue is the completely insecure, trust nature of the phone system. It should be trivial for a local police department to verify, with a very high degree of trust, that the number calling them is legitimate. That this doesn't exist is absurd, and is twenty years behind where it should be.

drucken 14y ago
You can be swatted by anyone, not just phone system hackers... At the end of the day, it is the emergency services' responsibility to behave with such considerations in mind.
koenigdavidmj 14y ago
Then I get a prepaid phone at Wal-mart, make the call, then pull the battery and destroy the SIM.
- corresation 14y ago
  Okay then that is a completely different scenario. In this case 9/11 is treating the calls as critical because they are shown to them as coming from the subject's house. If they instead popped up as a pay-as-you-go phone from an unknown person (recall also that all cell providers have to provide credible geolocation of calls, which if you're going through a Western cell tower you cannot spoof) that is ten states away, yeah they might not send the SWAT team.
  - koenigdavidmj 14y ago
    It's still plausible if you want to SWAT somebody locally. Just be in the general area of the same city and report shots fired. I have no clue about the level of precision in cell tower geolocation, so I'm not sure how close you would need to be (which obviously ties to how likely it is to get caught).
MichaelGG 14y ago
It's the same as IP traffic, really. Calls can go through any number of providers. You can spoof phone traffic just as easily as IP traffic. The "caller ID" number is totally unrelated to any incoming line. The number could also be from another country, or corrupted. The Internet seems to work fine with IP, despite it being trivially spoofable. I think your expectations are incorrect. Edit to add: It's not even desirable, what you're asking. Imagine, for instance, Twilio. If each call had to be immediately traceable, what would that mean? Would Twilio need to require proof of identification before allowing any outbound calls? I think what your suggesting would be extremely detrimental.
- corresation 14y ago
  It's the same as IP traffic, really. Calls can go through any number of providers. You can spoof phone traffic just as easily as IP traffic. While this seems to get stated a lot, it isn't actually true at all: spoofed IP packets get no response (I should also add that most providers flag and drop packets that have no business originating from where they did, so spoofing IP is usually a completely non-starter to begin with), or rather the response goes to an entirely different place (as if you spoofed someone's number to call 9/11 but only the original number can actually hear what the operator is saying). There are a couple of examples of very large providers misusing BGP (usually accidentally), but it is immediately identifiable, completely tracked, and rejectable. It's not even desirable, what you're asking. What am I "asking", given that you've gone to such lengths to declare it? If someone has a phone on AT&T or Verizon or even Skype the provider should be able to essentially sign the call initiation. Much like TCP, the world phone system has a routable infrastructure (otherwise it would be impossible to call a number because where does it go?), and such a mechanism is hardly far flung when we're talking about emergency services. Yeah, there are some services that can't abide by that, and they should properly be flagged as "completely anonymous, untraceable call" and get the credibility such deserves.
  - MichaelGG 14y ago
    Spoofed telephone calls can't be called back either, exactly like IP. You are asking that the originator of a call be identifiable somehow. That's not possible, given the number of resellers and levels. That would require even more trust, getting every provider to have a transitive trust relationship and show ID. A single call might go through 3, 4, even more resellers before ending up at the destination.

drucken 14y ago

You can be swatted by anyone, not just phone system hackers... At the end of the day, it is the emergency services' responsibility to behave with such considerations in mind.

koenigdavidmj 14y ago

Then I get a prepaid phone at Wal-mart, make the call, then pull the battery and destroy the SIM.

corresation 14y ago
Okay then that is a completely different scenario. In this case 9/11 is treating the calls as critical because they are shown to them as coming from the subject's house. If they instead popped up as a pay-as-you-go phone from an unknown person (recall also that all cell providers have to provide credible geolocation of calls, which if you're going through a Western cell tower you cannot spoof) that is ten states away, yeah they might not send the SWAT team.
- koenigdavidmj 14y ago
  It's still plausible if you want to SWAT somebody locally. Just be in the general area of the same city and report shots fired. I have no clue about the level of precision in cell tower geolocation, so I'm not sure how close you would need to be (which obviously ties to how likely it is to get caught).

MichaelGG 14y ago

It's the same as IP traffic, really. Calls can go through any number of providers. You can spoof phone traffic just as easily as IP traffic. The "caller ID" number is totally unrelated to any incoming line. The number could also be from another country, or corrupted. The Internet seems to work fine with IP, despite it being trivially spoofable. I think your expectations are incorrect. Edit to add: It's not even desirable, what you're asking. Imagine, for instance, Twilio. If each call had to be immediately traceable, what would that mean? Would Twilio need to require proof of identification before allowing any outbound calls? I think what your suggesting would be extremely detrimental.

corresation 14y ago
It's the same as IP traffic, really. Calls can go through any number of providers. You can spoof phone traffic just as easily as IP traffic. While this seems to get stated a lot, it isn't actually true at all: spoofed IP packets get no response (I should also add that most providers flag and drop packets that have no business originating from where they did, so spoofing IP is usually a completely non-starter to begin with), or rather the response goes to an entirely different place (as if you spoofed someone's number to call 9/11 but only the original number can actually hear what the operator is saying). There are a couple of examples of very large providers misusing BGP (usually accidentally), but it is immediately identifiable, completely tracked, and rejectable. It's not even desirable, what you're asking. What am I "asking", given that you've gone to such lengths to declare it? If someone has a phone on AT&T or Verizon or even Skype the provider should be able to essentially sign the call initiation. Much like TCP, the world phone system has a routable infrastructure (otherwise it would be impossible to call a number because where does it go?), and such a mechanism is hardly far flung when we're talking about emergency services. Yeah, there are some services that can't abide by that, and they should properly be flagged as "completely anonymous, untraceable call" and get the credibility such deserves.
- MichaelGG 14y ago
  Spoofed telephone calls can't be called back either, exactly like IP. You are asking that the originator of a call be identifiable somehow. That's not possible, given the number of resellers and levels. That would require even more trust, getting every provider to have a transitive trust relationship and show ID. A single call might go through 3, 4, even more resellers before ending up at the destination.