VeriSign Australia s. Australian Communications Authority s

Transcription

1 VeriSign Australia s comments on the Australian Communications Authority s Discussion Paper dated October 2004 titled Regulatory Issues Associated with Provision of Voice Services Using Internet Protocol in Australia 31 December 2004 Comments on this paper should be directed in first instance to Gregg Rowley. Co-authors Gregg Rowley Managing Director VeriSign Australia Pty Ltd Level 5, 6-10 O Connell St, Sydney, NSW 2000 tel: mailto:growley@verisign.com.au Thomas Kershaw Vice President, VoIP Services Ridgetop Circle Dulles VA , USA tel: mailto:trutkowski@verisign.com Anthony M. Rutkowski Vice President for Regulatory Affairs VeriSign Communications Services Div Ridgetop Circle Dulles VA , USA tel: mailto:trutkowski@verisign.com Raj Puri Vice President, NetDiscovery Service 487 East Middlefield Road Mountain View , USA tel: mailto:rpuri@verisign.com

2 VeriSign Australia Page 2 of Introduction These comments are responsive to the invitation in the Authority s Discussion Paper of October 2004 on Regulatory Issues Associated with Provision of Voice Services Using Internet Protocol in Australia. As the ACA notes, this topic is timely worldwide, and VeriSign has been privileged to participate in similar proceedings during the past year in multiple countries and regions. The ACA s proceeding is among the most comprehensive and thorough, and VeriSign welcomes the opportunity to participate in this stage of the policy development process, as well as subsequent consultations. We have based our comments on our experience locally but have also drawn on our considerable internationally experience with these issues and our involvement in standard setting processes worldwide particularly the ITU. 2. VeriSign For more than a decade, VeriSign has provided an array of large-scale, ultra-high availability, trusted infrastructures that enable signaling, security, identity management, directory, financial transaction, and fraud management capabilities for just about any kind of network based business and consumer services whether it be traditional voice telephony, wireless, Internet, Web, VoIP, multimedia, next generation networks, or sales transactions. VeriSign operates through multiple divisions that have offices and staff in Australia, the Asia-Pacific region, and worldwide. These capabilities are largely provided through service bureau offerings that support operational needs and regulatory requirements which telecom, wireless, Internet, and Next Generation Network service providers find easier and more cost-effective to outsource. VeriSign is a pioneer in the development and implementation of ultra-high availability, open standards signalling, directory, OA&M (operations, administration, and maintenance) and security solutions for IP-based Next Generation Networks including integrated gateway capabilities with legacy SS7 intelligent network services. In addition, VeriSign offers a suite of NetDiscovery services that provide service bureau solutions to supporting the needs of law enforcement with respect to producing real time (lawful interception) and stored traffic data and content by communication service providers pursuant to regulation or judicial process. 2.1 Issues VeriSign s responses in this proceeding reflect the nature of its products and services, as well as its experience in meeting VoIP-related operational and security related requirements arising both among service providers and government. These products and services are best characterised as intelligent infrastructure, and spa n both traditional PSTN/Wireless and IP - Enabled Services/VoIP platforms. This backplane infrastructure of signalling, directory, OA&M, and security systems is often overlooked in public policy proceedings because it is not ordinarily seen by the end-user, although it is critical for maintaining services and effecting almost every supplementary feature employed by users or required by operators and Government. The consultative document indirectly touches on these capabilities in the context of identifying CCS#7 interworking capabilities. Figures 1 through 5, if adjusted to identify this backplane

3 VeriSign Australia Page 3 of 10 infrastructure, would appear something like the following. The diagram is explained in detail in the appended document. Next Generation Networks Legacy Telecom & Wireless Services IP-Enabled Services Access Telephony SMS/MMS Transport Gateways Transport VoIP and Multimedia Services Access Signalling & Directory Services Signalling & Directory Services IN Gateways DNS SIP H.323 DA CNAM LIDB IRIS IRIS IRIS IRIS.. The VoIP Next Generation Network environment contemplated in the proceeding consists of: 1) diverse ubiquitous means of access, 2) highly distributed and autonomous service providers, and 3) nomadic users, objects, and terminal devices. These additional characteristics as recognised in the consultative document present new challenges to operators and the Australian Communications Authority. No longer do end users have just a limited bandwidth connection to fixed, dedicated telephony services, and isolation from the signalling system. They have a comparatively powerful pipeline capability to a vast network infrastructure that includes VoIP-based telephony-like features. As a result, intelligent architecture services become especially critical for meeting the kinds of operational, governmental, and intergovernmental requirements that are necessary to the continued viability of the infrastructure and protection of users. In the subsequent responses to the questions posed by the ACA in the proceeding, VeriSign underscores the importance of NGN intelligent architecture capabilities in dealing with the issues raised. VeriSign s recent contribution related to this subject to the ITU-T Study Group 13 meeting on Next Generation Networks is also appended to this response. New standards and products based on Federated Identity for VoIP services will also be critical for maintaining necessary authentication of providers and users. See figure below. Authentication Service Local CA Registrar /LS Local Proxy Authenticated Session Invitations Local Proxy Local CA Registrar /LS Register/Auth Invite Domain A.com Domain B.com

4 VeriSign Australia Page 4 of VoIP service characteristics What are the issues for different VoIP providers sharing information on the availability of their end-users to accept calls using IP networking? (Question 4.17) Are there privacy issues if VoIP providers share information on the availability of their end -users to accept calls using IP networking? What are the privacy implications if users may test for the presence on the network of other users or for their availability to accept calls? (Question 4.18) VeriSign takes no position on the availability of presence information and its location in the integrated IP-Enabled Next Generation Network infrastructure. There are several potential platforms for offering these presence services, and VeriSign supports most of them. What is important for any offering of this nature, however, is the use of authentication and a secure directory framework for verifying the identity of the multiple parties involved users and providers, both for the purposes of maintaining the presence information, as well as effecting queries. This information may also be relevant to meeting other ACA and operational requirements such as assistance to public safety or law enforcement, and access rights, and settlement of accounts. The authentication requirements should also encompass the use of objects. It is increasingly likely that object systems such as GPS receivers, RFID savant readers, WiFi access points, or radio-based cell sites may be part of the presence value chain. The identity authentication and authenticated permissions of these background presence systems will become increasingly important in pervasive presence ecosystems and this is a major focus area for VeriSign. How important are VoIP numbering arrangements for the move towards personalisation of telecommunications services? (Question 4.19) VoIP allows for a diverse array of different account identifiers and associated signalling platforms. These platforms include DNS-based ENUM, SIP, H.323, as well as proprietary offerings that may be associated with instant messaging services. Any kind of personalisation is certain to include a number of identifier personas, as well as gateway communication with legacy SS7 based PSTN services. No one platform is likely to be critical or dominant. However, what are especially important are the associated authentication and directory capabilities underlying each of these platforms, as the availability of a common global means for discovering and querying the directories as described in detail in the appendix to this submission. 2.3 Migration between VoIP service processes How should VoIP services that can easily change in key features, such as the inclusion of access to end-users based on E.164 numbers, be treated by the ACA from a regulatory perspective? For example, should their treatment depend on how they are used on a call-by-call basis or according to their multiple potential uses? (Question 4.20) What other issues arise in respect of services that can be easily reconfigured? (Question 4.21) VoIP and other services that are easily reconfigured give rise to a need for a secure, authentication and directory framework that includes both the users and service providers. Without such a framework, it becomes essentially impossible to know who has the right to

5 VeriSign Australia Page 5 of 10 use or modify the use of any identifiers or their associated services. Third parties whether people, companies, or sales merchants have no way of ascertaining who they are dealing with. Reconfiguration also has significant implications with respect to meeting requirements for assisting law enforcement. In the USA, for example, law enforcement has insisted that when a target is subject to an intercept order, that reconfiguration information be handed over by the associated provider. 2.4 VoIP call set-up and management processes What are the factors that might influence the decision to base VoIP operations and equipment, for example, billing and call or customer management systems, outside Australia as part of a long-term service solution? (Question 4.22) What specific regulatory issues for the ACA will need to be managed if operations and facilities supplying VoIP services in Australia are located outside Australia? (Question 4.23) What specific regulatory issues for the ACA, if any, would need to be managed if operations and facilities used to provide VoIP services to endusers outside Australia are located in Australia? (Question 4.25) Will the potential requirement to seek assistance from overseas regulators have implications for any regulations applicable to Australian VoIP services for which critical equipment or systems are located overseas? (Question 4.26) Transborder provisioning of VoIP related services pose potentially complex issues of jurisdiction, discovery, notice, authorisation, cooperation, and conflict of law. Failure to deal with these issues and develop an appropriate legal and regulatory regime will only exacerbate the problems. In general, Australia will want to apply its own law and regulations to the extent possible. However, where foreign jurisdictions are involved, bilateral or multilateral agreements will be necessary. The Council of Europe, the International Telecommunication Union, the World Trade Organisation, and APEC are beginning to serve as forums for devising necessary arrangements. In the particularly difficult area of meeting requirements for law enforcement assistance, Trusted Third Party service bureaus may be particularly useful means of acting as an intermediary among multiple jurisdictions and their requirements. 2.5 Implications of the global supply market What VoIP-specific overseas trends or practices are relevant to the exercising of the ACA s existing regulatory powers in relation to VoIP services? (Question 4.30) As noted above, Council of Europe, the International Telecommunication Union, the World Trade Organisation, and APEC have all instituted activities directed toward the adoption of multilateral practices in the exercise of regulatory powers over VoIP services. In addition, nearly every major country, including the European Commission, currently has at least one VoIP related policy making proceeding underway. Most of these proceedings deal with the same kinds of regulatory requirements that include: public safety emergency assistance needs, law enforcement support, disability assistance, fraud prevention, reliability and reporting obligations, restoration after failures, call prioritisation during emergencies, privacy and data protection, consumer protection against unwanted intrusions, universal service and other contributory obligations, competition promotion (number portability, unbundling, open

6 VeriSign Australia Page 6 of 10 interfaces, etc), nondiscriminatory regulatory treatment, intercarrier compensation. Following and harmonising ACA s VoIP requirements to conform with generally adopted approaches overseas will assist in fostering a global supply market. 2.6 Implementation of allocating existing geographic numbers for VoIP services Should the ACA allow all VoIP services, including nomadic services, to be provided on geographic numbers? (Question 5.15) The response to this question seems tied in part to the ACA s treatment of directory services and presence information. Geographic numbers have in the past been important because the only geographic information available was that implicit in the number itself. If, however, other means such as a direct lookup of the user location information were available, the importance of geographic numbers would be diminished. 2.7 Network interconnection What industry processes are required to optimise the extent to which VoIP calls remain on IP networks and minimise IP to/from circuit-switched interfacing? (Question 7.4) VeriSign has faced this need in the context of its Network Routing & Directory services provided to both private and public network operators. For the most part, the marketplace encourages such a result. In addition, in the USA, the recent recommendations of the Intercarrier Compensation Forum (ICF) establish specific gateway and compensation mechanisms for VoIP. A similar solution may be appropriate Access to the emergency call service What are the implications of requiring all VoIP services to meet emergency call services calling obligations? What are the limitations? (Question 8.1) What are the implications of requiring VoIP services to provide location information to the emergency call person? (Question 8.3) What is the future outlook for the provision of location information for emergency access calls? (Question 8.4) What are the implications of requiring that VoIP services provide CLI to the emergency call person? (Question 8.6) What other issues arise in the presentation of VoIP calling line information to the emergency call person, to other end-users and to other network operators? (Question 8.7) The need for access to emergency call service is common with other regulatory requirements typically imposed on public voice telephony providers, and being treated by regulatory authorities worldwide in current proceedings. VeriSign takes no position regarding the imposition of the requirement, but notes that its existence in large measure is facilitated by a secure, authenticated directory framework that is made available to public safety emergency service support centres. The implementation of presence services is also highly relevant. 1 See ICF, Intercarrier Compensation and Universal Service Reform Plan, 5 Oct 2004, filed in Developing a Unified Intercarrier Compensatiobn Regime, FCC CC Docket No

7 VeriSign Australia Page 7 of Interception and Law Enforcement Support Are there any significant new issues re lated to the obligations for interception of communications using VoIP services? (Question 9.1) Are there other interception issues raised by VoIP services? (Question 9.2) It is important to note that there are three relevant VoIP related parts of the Telecommunications Act 1997 that give rise to law enforcement assistance obligations. Part 13 of the Act allows criminal law enforcement, public revenue and civil penalty enforcement agencies (defined in subsection 282(10) of the Act) to make certified and uncertified requests for the disclosure of customer information. Part 14 of the Act requires carriage service providers to give officers and authorities of the Commonwealth, States and Territories such help (which includes providing information about Internet users and their use of the Internet) as is "reasonably necessary" for the enforcement of the criminal law, or the enforcement of laws imposing pecuniary penalties or the protection of the public revenue. Part 15 requires service providers (including ISPs) to ensure that their network is able to intercept a communication passing over it in accordance with a warrant issued under Act. The disaggregation of IP broadband access from VoIP managed/mediated signalling significantly complicates the three fundamental requisites for law enforcement support: 1) production of real-time call data and content, 2) production of stored call data and content, and 3) production of basic user and provider identifying and contact information. The ACA in this consultative proceeding should consider the critical role played by a secure, authenticated directory framework in meeting all three of the above requirements, as well as a standardised interface for accessing stored or identifying information. Appendix A describes an open, global standard for achieving the latter. The former is a matter under development in OASIS, and now before the ETSI Lawful Interception technical committee. The ACA may wish to reference extensive treatment of lawful access for VoIP provided by VeriSign in the U.S. Federal Communication Commission proceeding devoted to this topic Privacy and customer service obligations Are VoIP providers able to comply with the requirements relating to the privacy of customer information? If not, why not? What regulatory compliance issues if any, including undue costs, arise in this area? (Question 10.2) Are VoIP providers able to comply with the requirements relating to the privacy of communications? If not, why not? What regulatory compliance issues, including undue costs, arise in this area? (Question 10.4) Please outline any other call privacy related issues that the introduction of VoIP services could raise for consumers, the telecommunications industry generally and regulators? (Question 10.5) To what extent are VoIP services and VoIP providers able to comply with these customer service requirements? Are there any regulatory compliance issues for VOIP providers, including undue compliance costs? (Question 10.6) What complaint handling arrangements are appropriate for VOIP services/providers, particularly given the potential for multiple providers to be involved in service delivery and the scope for operations to be located outside of Australia? (Question 10.7) 2 See VeriSign, Comments and Reply Comments in the Matter of Communications Assistance for Law Enforcement Act and Broadband Access and Services, ET Docket No

8 VeriSign Australia Page 8 of 10 Does the provision of VoIP services to residential end-users require the introduction of new customer protection processes? (Question 10.10) What other issues arise in relation to the current customer service and consumer protection obligations that are impacted by the provision of VoIP services to residential and small business customers? (Question 10.11) The privacy needs are generally of two types: protection of consumer information from unwanted access and use, and protection of consumer from unwanted intrusions via their subscribed communication capa bilities. The former is generally treated with a combination of regulatory requirements and the use of authentication and secure directory frameworks discussed above. Where offshore providers are involved, the need is even more significant. The latter is typically treated through the use of Do Not Call and other unwanted solicitation prevention and anti-spam measures. The latter is also facilitated through the use of Content Mediation Platforms and other forms of smart routing, directory, and gateway services. It s not clear who should bear the costs for these capabilities. In addition to consumer privacy effects, these measures also have a significant critical infrastructure protection dimension especially when there are PSTN gateways involved. Many nations are experiencing significant wireless messaging SPAM attacks via Internet gateways, and it is decidedly in the national interest to mitigate against the same problems being visited upon the PSTN via signalling gateways Call charging accuracy What is the level of charging and billing accuracy for VoIP services? How does this compare with the Call Charging and Billing Accuracy Code requirements? What systems do VoIP providers have in place to ensure high levels of accuracy? (Question 11.1) Are there specific billing issues that VoIP services raise for consumers, for the Australian telecommunications industry generally or for regulators? (Question 11.3) Are there other call charging issues for VoIP services? (Question 11.6) As with many other operational and regulatory requirements, call charging accuracy is dependent an effective authentication and secure directory framework for both users and providers. Without such capabilities, call charging requirements become, at best, difficult to implement Pre-selection How difficult is it for VoIP providers to comply with pre-selection requirements? What issues arise for service providers? (Question 12.1) End-users with PCs may wish to simultaneously support VoIP services from a number of suppliers so that they can choose which VoIP provider to use on a session-by-session basis. Is such an arrangement technically feasible? Are there any processes that could preclude such arrangements? (Question 12.4) What other issues arise in implementing a pre -selection choice or a call-bycall over-ride choice for VoIP services?) (Question 12.5) As with many other operational and regulatory requirements, call charging accuracy is dependent on effective authentication and secure directory framework for both users and

9 VeriSign Australia Page 9 of 10 providers. Without such capabilities, pre-selection requirements become difficult to implement at best Access for non-voice users What regulatory compliance issues arise for VoIP providers in the area of access for people with disabilities? (Question 13.1) What access issues other than those noted above do VoIP services raise for people with disabilities? (Question 13.2) Will there be any issues in TTY users using the NRS to call VoIP users and VoIP users using the NRS being able to call TTY users? (Question 13.3) The need for access to disability support services is common with other regulatory requirements typically imposed on public voice telephony providers, and being treated by regulatory authorities worldwide in current proceedings. VeriSign takes no position regarding the imposition of the requirement, but notes that its existence in large measure is facilitated by a secure, authenticated directory framework that is made available to disability service support centres Number portability Are the number portability exemption arrangements capable of meeting any specific requirements of VoIP services? (Question 14.1) What is the relevance of individual number portability for end -users and providers of VoIP services? (Question 14.2) To what extent does the present regulatory inhibition on nomadic roaming using geographic numbers prevent portability and restrict the development of VoIP generally? If this is a substantial issue, what are the most promising solutions? (Question 14.3) Number portability is one of several regulatory requirements imposed on providers in many countries to foster increased competition. It seems to be an effective tool for this purpose in most jurisdictions, and likely to be emulated in the VoIP environment. VeriSign takes no position on its imposition in Australia, but notes as with most other requirements that the technology platform to accomplish this although somewhat easier and less costly to effect do require an effective authentication and directory services framework Future outlook What new ways might customers access VoIP services? (Question 15.1) What new consumer relationships and value-chains may emerge from the provision of VoIP services? (Question 15.2) How important will scale and reach be for providers of VoIP services? (Question 15.3) Are there VoIP-related issues created by the more extensive use of WiFi or similar techniques? (Question 15.5) Are there specific impacts that VoIP services can have outside the larger population centres? (Question 15.6) The answers to the future outlook questions posed by ACA will predominantly be found in the marketplace, and through entrepreneurial experimentation. WiFi and similar wireless access technologies are rapidly proliferating through consumer electronics channels.

10 VeriSign Australia Page 10 of 10 Effectively authenticating and managing the access and VoIP service relationships will become increasingly important to a broad range of operational and governmental regulatory requirements Regulatory options What overall factors, for example, consumer benefit, competitive neutrality, cost, administrative simplicity, need to be considered in deciding whether or not to exercise the ACA s exemption and other regulatory powers? (Question 16.3) What if any other regulatory issues arise from the introduction of VoIP services? (Question 16.4) VeriSign notes that these same questions are being asked by an array of governmental authorities worldwide responsible for different aspects of the national communications infrastructure and security. Other areas not treate d in the Discussion Paper include : 1) national security concerns such as critical infrastructure protection, emergency preparedness, priority access, restoration after failures, reliability and reporting obligations; 2) other consumer protection considerations such as fraud prevention; 3) other competition promotion mechanisms such as open interfaces and unbundling; and 4) juridical norms such as nondiscriminatory regulatory treatment and intercarrier compensation. The ACA may wish to look to proceedings in other national and regional jurisdictions to consider what applicability, if any, these matters have to the provisioning of public VoIP services in Australia.