The Trouble with Spoofing
Photo Rick Roach
Editor’s note: The following article outlines why public safety comm center personnel should understand spoofing and the dangers it poses to emergency services. It discusses the Truth in Caller ID Act of 2007, which has been updated with Truth in Caller ID Act of 2009. Click here to read about the FCC’s current Notice for Proposed Rulemaking for the 2009 act.
The term spoofing refers to the ability of a caller to modify caller identification (ID), including the name, number and/or voice appearance of an incoming call or text. Spoofing is becoming more prevalent, and as a result, communications centers may experience an increase in prank calls, creating the potential to tie up valuable emergency resources.
The Problem
In a recent court case, the defendants used phone number caller ID modification to spoof a police department. A spoofed phone call was made to the non-emergency services number of the Alvarado (Texas) Police Department using a voice over Internet protocol (VoIP) phone and a spoofed card to conceal the caller’s identity and make the call appear as though it actually came from an innocent family’s residence.
The male caller identified himself as a family member who had shot and killed other members of the family. He claimed he was holding hostages, had been using hallucinogenic drugs and that he was armed with an AK-47. He then demanded $50,000 and transportation across the U.S. border into Mexico, and threatened to kill the remaining hostages if the demands were not met. The defendant in this case received a five-year prison sentence for crimes related to this fake 9-1-1 call.
In another case, a Washington teenager is facing 18 years in prison on charges that he used his personal computer to access the Orange County (Calif.) 9-1-1 emergency response system and convinced the sheriff’s department to storm a local couple’s home with a heavily armed SWAT team.
These spoofers didn’t just report false emergencies. They provided the physical address of an actual location in the PSAP’s service area. The challenge for 9-1-1 telecommunicators and emergency responders is determining the legitimacy of the calls it receives.
The Process
Typically, the call is received on a 10-digit emergency or non-emergency line. 9-1-1 CAMA (centralized automatic message accounting) trunks can’t be spoofed unless the spoofer obtains the10-digit pilot numbers associated with the trunks. Additionally, spoofers cannot use three-digit dialing to engage in such spoofing activities. There is also a great concern from local exchange carriers (LECs) because this circumvents their ability to bill the proper subscriber.
A spoofing card is not actually a card. A spoofer purchases minutes from a spoofing service vendor and is given toll-free and personal identification numbers. After calling the toll-free number and entering their PIN, the caller is prompted to enter the destination number followed by the phone number that will appear on caller ID. The call is then initiated through the spoofing service vendor.
Any 10-digit telephone number can be displayed as the calling party, along with the telephone subscriber’s information. This makes the spoof all that more believable and realistic for the receiving party or PSAP.
According to a well-known spoofing card vendor, spoofing is “harmless fun.” Because 9-1-1 cannot be spoofed directly, these vendors argue that they’re already doing their due diligence in protecting the public safety environment.
Text message spoofing is accomplished through short message service (SMS) spoofing vendors/services. Through a registration process, you can text someone anonymously and potentially cause great havoc, because messages may appear as if they were sent from a familiar number when in fact the text is a hoax.
In a twist of marketing, additional features are available when spoofing, such as voice change (male or female), the ability to send pre-recorded messages at a later time and date and the protection of the spoofer’s records—ultimately protecting their identity. Additionally, some spoofing features also allow voice recordings to be made of the caller without their knowledge.
Amazingly, spoofing is legal in the U.S. Some states, however, have passed laws that make only certain acts of spoofing illegal. Example: You cannot spoof if it is meant to “mislead, defraud or deceive the recipient of the call.” Spoof card companies caution their customers to read and understand the laws in the state in which they perform spoofing activities to avoid criminal prosecution.
Regardless of the spoofing community’s view and the fact the spoofing is legal, there’s an element of risk whenever public safety personnel respond to a perceived emergency. This risk jeopardizes the emergency responders, the general public and the intended spoofing victims. It’s therefore important that such use of the public switched telephone network or VoIP network be discouraged whenever possible.
Such legislation as the Truth in Caller ID Act of 2007 should be recommended for eventual passage by Congress as soon as possible. This act would have amended the Communications Act of 1934 and made it unlawful for any person in the U.S. in connection with any telecommunication service or VoIP service to cause any caller ID service to transmit misleading or inaccurate caller identification information (spoofing) with the intent to defraud or cause harm. 9-1-1 administrators and staff are encouraged to lobby their congressional representatives to enact legislation to prohibit this type of activity. (Click here for an update on legislation in 2011.)
About the Author
The APCO 9-1-1/Emerging Technologies Committee is a standing committee of APCO International chaired by Terry Whitham, E9-1-1 administrator for the Delaware State Police. Learn more on APCO’s website at www.apcointl.org.
Author’s note: Special thanks to Daphne Dee-Miller and James M. Coleman for their help with this article.
Originally published in Public Safety Communications magazine, Vol. 75(5):42-43, May 2009.
Related Link
