Subject: [Ecrit] E911 security issues

From: "Tom-PT Taylor" <[email-masked]>
Date: Thu, 17 Nov 2005 10:10:39 -0500

We talked ourselves to a standstill in the meeting when discussing 
security issues.  The fundamental problem is this:

   -- the system has to accept all calls because they could be real 
emergencies;

   -- even without internet access, the system receives a high volume of 
false alarms.  A newspaper article in the Ottawa Citizen today reflects 
an attempt by local authorities to educate people so they will treat 
their 911 service more seriously.  People will be able to visit the PSAP 
on Nov. 29 to hear the crazy calls that come in.  "Probably five to nine 
percent are legitimate police emergencies, or calls requiring police 
response.  The rest of them are generally requests for information, or 
misdials."

It seems to me we can respond by setting two kinds of requirement for 
the call routing system:

   (1) Ensure that it provides all the information that could possibly 
be useful in automated analysis of incoming calls, so that questionable 
calls can at least be flagged when they are presented to the call taker.

   (2) Build robustness into the call routing system.  For example, 
ensure that components of the routing system can shed load intelligently 
(i.e. perform triage based on call data) when subjected to volumes of 
traffic beyond what they can handle.

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: Nate Wilcox <[email-masked]>
Date: Mon, 21 Nov 2005 13:26:39 -0500

Tom,
 You stated:
 " (1) Ensure that it provides all the information that could possibly be
useful in automated analysis of incoming calls, so that questionable calls
can at least be flagged when they are presented to the call taker."
 Could you elaborate on how this automated analysis "could" work?
 Nate Wilcox
802.748.5503
_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: "Tom-PT Taylor" <[email-masked]>
Date: Mon, 21 Nov 2005 16:41:09 -0500

Obvious criteria are no location in signalling, location in signalling 
not in PSAP jurisdictional area, no authenticated identity.

Getting more sophisticated, it might or might not be worthwhile to 
identify repeated calls from the same caller or address within the last 
24 hours.  Depending on how high the flagging threshold is, repeated 
calls may increase call priority or, past a certain point which should 
be set high enough, be a fairly clear sign of misuse.