Disruptive Telephony

Is Craigslist really blocking phone numbers from VoIP service providers or pre-paid cell phones as an anti-spam measure?

Last night over on the VoIPinsider blog, Cory Andrews wrote that Craigslist is apparently blocking VoIP or prepaid cellular numbers as part of their anti-spam measures. Now I'm a huge fan of Craigslist and we've sold lots of items (including, now, our house) via Craigslist. But we've also seen the spam out there and personally been contacted in response to one of our ads by a sleazy individual who was trying to scam us out of money. Techdirt, in fact, says that the battle has been lost and that the spammers are taking over Craigslist. While it wasn't that dreadful in the Vermont Craigslist area, there certainly was some spam and you can understand the folks there wanting to do all they can to block spammers.

But to block VoIP service providers? Just as increasingly large numbers of users move over to VoIP services?

THE APPARENT ACTIONS

It seems a rather draconian - and misguided - measure. As the VoIP Insider article states:

A few months back, Craiglist instituted a telephone verification process that places an automated outbound call to a user placing a classified ad in certain categories. The call delivers a unique code using text to speech, which is then used by the poster to authenticate the ad they are placing.

This is an effective measure for dealing with spam, and a great thing for legitimizing the Craigslist user experience….but not so great if you are a Craigslist user and you also happen to be a VoIP or prepaid cellular user.

The problem is that Craigslist is categorically blocking legitimate VoIP and Pre-paid cellular users from authenticating themselves.

While I've not encountered the phone verification process in any posting I've done to Craigslist (but have seen CAPTCHA images all the time), I can see how the process would be useful in combatting spammers. The article goes on:

Craig’s uses a 3rd party service, ReduceFraud.com to screen out VoIP and Pre-paid cellular numbers, and will not deliver an automated verification call to a number that is determined to be such. (Since only SPAMMERS use VoIP and Pre-Paid Cellular!!!) What sophisticated algorithm does ReduceFraud.com use to identify VoIP numbers, you ask? They check the DID number to see who owns the NPA NXX X number block, and if the DID number is owned by Level 3 Communications, they classify it as VoIP of course. Whizbang!

Oops.

My immediate question was whether this is for all VoIP service providers. This BroadbandReports.com forum thread would seem to indicate that "fixed lines", even fixed VoIP lines, would come up as okay. So phone numbers from VoIP services from telephone carriers or cable providers would probably be okay. So it may just be the phone numbers of VoIP service providers who are not tied to a fixed infrastructure (and who provide connectivity to so many of the innovative services out there today!).

THE PROBLEM

There are, though, some fairly obvious problems with this approach to blocking phone calls:

1. LOCAL NUMBER PORTABILITY - Here in North America, phone numbers are "portable" (to a degree) via "Local Number Portability" (LNP) between carriers. So a phone number that may come up as "fixed" may in fact go to a VoIP service (and possibly to a spammer) due to LNP. Now perhaps the third-party service used by Craigslist is doing LNP database lookups.

2. FORWARDING SERVICES - There are plenty of services (including one identified in the VoIP Insider article) that will forward calls to another phone number. I could even do this easily with something like Asterisk running on my (fixed) home phone number that then forwarded the call out via SIP.

It seems to me that it would be relatively trivial for any serious spammer to obtain a "fixed" phone number that would defeat this blocking mechanism. Certainly this would block some of the less savvy spammers who are just trying to use disposable phone numbers... but in the meantime it may well block legitimate posters who happen to use telephone numbers from VoIP service providers.

THE ANSWERS?

So is Craigslist really blocking VoIP phone numbers? Garrett Smith (from VoIP Insider) indicated in an email that someone there was in touch with Craig and Craig indicated he was not personally aware of the blocking. Obviously, someone within the Craigslist organization has engaged this external company, ReduceFraud.com, in their ongoing efforts to fight spam. The blocking seems to lie in there. What needs to happen now is some conversation with those folks to understand what exactly it is they are doing.

We'll have some conversation, in any event, about this issue on today's Squawk Box at 11am US Eastern Time. Feel free to join us if you would like (you need to login via Facebook).

It's an interesting question - in the era when people can obtain cheap (even free) "disposable" phone numbers, how do you balance providing access to legitimate users while blocking using those numbers as a way to spam or perform other malicious actions?

Technorati Tags: craigslist, voip, spam, fraud

Dean Elwood over at VoIPUser.org put up a post yesterday entitled "How to Build a VoIP Network" in which he goes into precisely what is needed to set yourself up as a VoIP Service Provider (or "Internet Telephony Service Provider" (ISTP)).  Given that Dean's been involved with this through VoIPuser.org, he's definitely got some credibility.  As he says, he wrote the piece because:

We see a lot of threads on VoIP User from people who want to be the next Niklas Zennstrom (and fair enough, we hope you succeed) asking what is required to build a VoIP network.

Often these questions are from users who have a basic technical understanding of how it all works, but no real experience of building networks, or telcoms experience with the good old PSTN.

He goes on to offer these seven rules:

1. if you're a marketing genius, you have a greater chance of success with your new VoIP company than if you are a technical genius.

2. Using the internet to route calls does not mean that everything in the VoIP world runs on Intel *nix.

3. It is going to break at some point. Ensure you have redundancy.

4. The transition from voice 1.0 to voice 2.0 will be managed at the cloud edge.

5. Network considerations made at design stage must include Quality of Service, audio path length and NAT traversal

6. Choose your hosting according to needs of each individual server, not the entire network. A Layer 5 network, such as a SIP network, can be distributed geographically.

7. Don't bet the house on it.

You really need to read the full article to understand Dean's rules and also enjoy his wit.  For those seriously interested, he goes into what the costs would be to get set up.  (I'd tell you, but it's best to read Dean's article for the context.)

Now, there are certainly other costs, as Dean indicates, but the net of it is that it really isn't all that much for someone to get into business.   The ease and low cost is bringing a whole host of new entrants... most of whom, on a side note, are not thinking about security as they rush to market (leading to my repeated prediction over on Blue Box that it is only a matter of time until one of them gets hacked).

Anyway, it's good info and definitely worth a read.