From: jsm@mvulo.att.com
Date: 15 Feb 95 00:06:00 -0500
Subject: Re: Cellular Fraud: How Much of it is Real Money?
Organization: AT&T


Pat:

My $.02 worth in three parts, carrier perception now, what is wrong
with that perception IMHO, and potential ramifications for future
wireless offerings (purely prognostication on my part).  This is
merely intended to share my experiences in a related subject.  I hope
no one takes offense at anything I've said.  No finger pointing
intended, only opinions based upon customer feedback.

Addressing fraud is an amazingly complex issue that requires numerous
companies to work together jointly when in fact they are competing
against one another in the very same businesses and constantly seeking
leverage against one another.  It is a credit to the standards bodies
that standards addressing these issues have been agreed upon by such
diverse companies.  Implementing same, is another story.  No one
company can implement the existing fraud and security standards alone.
At that point, the only option is proprietary, which is what is being
done now.  All in all, it was a thoroughly frustrating two years in an
unbelievably dynamic environment, and by far the most enjoyable job I
have held with my company.

BACKGROUND:

I spent the better part of the past two years traveling to various
cellular providers to attempt to get them to distribute our cellular
privacy/security products.  I had the unique opportunity to meet with
carriers and their customers.  Although you may wonder what this has
to do with fraud, there are in fact many similarities between the two.

For instance, addressing both requires something on both the subscriber 
and switch ends, whether it be a user pressing a PIN sequence and the
switch understanding the sequence or a phone with privacy/encryption
built in and complementary adjunct at the switch or on a desk. Additionally, 
one could argue that what C1 did in NYC just pushes the fraud out a
level to the user (i.e. the calling card number you just gave the
operator is now being used to someone elses benefit at your expense)
which then enters the realm of privacy.  There was and is an interested 
user base but the carriers are not interested.  Why? (NOTE - that
these are not my opinions but those expressed to me by carrier
personnel from engineering, marketing, product management, sales,etc.
from regional VPs to engineers and sales execs):

THE CURRENT VISION:

1) Cellular is still profitable despite fraud/security implications.
Carriers sign up record numbers of users each year.  If you were reporting 
positive financials up your management line, would you change and open
up a potentially huge can of worms that could undermine your financials 
given enough press?  There is little financial incentive to do anything 
about fraud if the bottom line looks good already.

2)  Digital will take over and have fraud protection (and higher security) 
built in.  Within two years, analog will no longer be an issue and security 
and fraud problems will disappear.

3) I know some of my customers need it but I have to make a business case and 
I don't think enough people care.

4)  Our sales forces only know how to sell phones.  They have lost the ability
to sell services.

5)  We can't admit to our customers that our services are insecure!

6)  Costs too much money -- the user will never pay for it.

7)  If it were in a Motorola flip phone, we'd buy it in a minute. 

8)  Most importantly, customers (including myself) continue to pay their 
monthly cellular bills, which cover the operating expenses for the carrier 
(including losses from fraud) and provide a tidy profit as well.

WHAT'S WRONG WITH THIS VISION:

1) Analog subscriber growth continues at a record pace.  What is not
taking off is airtime for potential high usage business users.  So,
carriers are now looking for new services to offer (voice messaging,
data, etc.) to attract same.  None of these services (or for that
matter the basic cellular service) offer enhanced security (that meet
the standards of many corporate security instructions) or built in
fraud protection that is an inherent part of the switch and phone and
yes for many reasons, digital is just as insecure as analog (we can
debate this in another forum if you like).  

I read a recent report (WSJ I think) that fraud in the NYC area cost
the local carriers $60M alone last year.  But if I had to guess, I'll
venture that the financial picture for the NYC carriers show positive
Economic Value Added as the numbers get passed up the corporate
financial hierarchy.  Fundamentally, I believe there are two reasons
why business customers limit air time -- cost and security.  Cost could
be driven down if fraud could be controlled.  Security could increase
call-minutes (and therefore carrier revenue), and like fraud an
optimal solution involves both your subscriber piece and the switch.
There are implications here for PCS (see prognostications below).  
I have heard many stories how employees have been given cellular
phones as perks and been told not to use them for business.  

2) Two years ago, digital was going to replace analog by 1998.  Thanks
to multiple digital standards, analog now has a rosy future.  In a
recent quote in Mobile Phone News 12/12/94, Motorola says "Digital
accounts for less than 5% of cellular growth in the U.S. As of
October 1, there were 21.5 million analog users in the country,
compared with 250,000 subscribers using TDMA..."  I have been told by
Motorola, Nokia and NEC personnel that the bread and butter for the
subscriber equipment portion of their business will continue to be
analog for the forseeable future.  Actually, I would think that the
thought of replacing 21.5 million analog phones would be an incentive
for manufacturers to use any excuse to create a new analog version of
existing phones with fraud and security built in.  

As an aside, when the Bar Associations in NY, MA, NH and other states
rule it is unethical for an attorney to discuss client matters over a
cellular phone, they are not differentiating between analog and
digital.  From this I could draw one of two conclusions; either the
carriers have done a poor job of positioning the advantages of digital
to the user or maybe there are none. Anyone offering odds that CDMA
(with whatever security/fraud standards are decided upon) will be
rolled out in a diluted version first sans some portion of those
standards?  

3) Financial responsibility is extremely fragmented in cellular.  A
good general rule is any addition to the MTSO needs to be cost
justified for that MTSO.  This affects fraud/security in two ways.
First, it dilutes the business case by forcing the regional managers
to look at each expense (not unreasonable).  The net result is that
corporate tends not to look at the problem as something it needs to be
involved in because it is regional in nature.  McCaw San Francisco
certainly has more fraud potential compared to McCaw Oklahoma, so let
San Fran fix their problem.  

Second, it removes the corporate clout required to implement a
solution within subscriber equipment.  Since corporate usually
negotiates subscriber equipment purchases, regional managers have zero
chance of independently approaching a major manufacturer such as
Motorola, Nokia, etc.  If they are allowed such independence, their
numbers and therefore bargaining power are still reduced.  

4) Just an excuse for asking your sales people to sell high priced
basic service and higher priced enhanced services to a varied customer
base.  If my salary depended upon attaining a sales quota, you know
I'd be concentrating on selling basic service and a Motorola phone to
the "average" customer.  It's the easiest sell.  

5) I would assert that the press is doing an adequate job of this on
the house.  Also, isn't C1-DC's denial of roaming in NYC a tacit
admission that they have no control over the fraud problem in NYC?
Ditto for the Nynex, Bell Atlantic, C1-NY PIN deal.  And you know your
in trouble when publications such as {Woman's Day} (7/20/93) say things
like "So, if you'd rather keep your personal conversations private,
make and take them on an old-fashioned, wired telephone".  Still,
fraud and security are an extremely tough sell.  There are Fortune 100
companies whose security departments routinely monitor executives
cellular calls and provide them with transcripts.  I have given
equipment to CEO's of some of these companies, only to have it
politely returned with a note indicating that they didn't see the
need.  Very likely, these same executives have appeared before
Congress in the last couple of years to complain about their losses
from foreign intercepts by the French, et. al. and they probably
haven't addressed that problem yet either.  Losses due to
communications fraud and lack of security are too intangible to
measure by the average user that has to date been left in peace (or at
least is unaware of events to the contrary), let alone the carriers
(the press seems to be doing OK with this though).  

Now if your carrier sent you a letter saying that effective immediately 
they were doubling your monthly rate and call charges to cover losses
from fraud or told you that you would have to exchange your existing
phone at your cost, would that get your attention?  Not to worry, they
wouldn't risk losing the profitable business that they have by being
so rash.  

6) Maybe true.  Its amazing the excuses that people give for not
buying products to protect them against fraud or intercept.  It's too
big, heavy, costly, don't like the voice quality, wanted blue instead
of black, doesn't say Motorola on it, and on and on.  However, the
biggest excuse is that human beings tend not to take responsibility
for the problems that occur, especially when their insurance does not
cover the loss.  When a user is "hit" (and they often don't know that
they have been), they believe it is the responsibility of the "telephone 
company" to protect them or cover their losses (Ma still lives on in
spirit).  You need only look at the reaction to PBX fraud as evidence.
To their everlasting credit (and the good of their financial picture)
telcos/carriers are perpetuating this "feel good" spirit by continuing
to cover the losses.  The extra price of security and fraud control
equipment is tangible, one can look at a purchase order and see the
difference.  The losses due to fraud or lack of security can disappear
at many finance levels with creative accounting.  

If users were truly concerned, then there would be many more than
250,000 TDMA subscribers now.  For all its shortcomings, TDMA does
have better authentication, although initially this may not have been
the case.  By the way, this is only a guess but I'd bet that the PIN
arrangement is required for both dual mode and analog phones.  Can
anyone confirm this?  

7) It is very difficult if not impossible to get major phone manufacturers 
to make changes to cookie cutter subscriber equipment to add anti-fraud or 
enhanced security, even if it adheres to TIA standards.  These pieces
are produced in lots of hundreds of thousands at a clip.  Carriers
have painted themselves into a corner on subscriber equipment -- they
have given it away at a loss for so long to get customers to sign up
that customers have grown used to getting the equipment for free or
minimal cost.  Carriers are loathe to change this successful equation.
My Motorla digital flip user guide clearly stated that enhanced
privacy was only available for digital calls.  Typical of the industry
last year was the decision to move forward with digital and refrain
from adding features such as enhanced privacy or authentication to the
soon to be replaced analog system.  I never did find an area where the
switch supported the enhanced privacy feature that the phone had.
Maybe the industry has changed its mind by now.  But that still leaves
a minimum of 21.5 million pieces of analog subscriber equipment that
do not support any potential improvements to the switch, and those
numbers increase by thousands every day.  Sounds a bit overwhelming to
me, but I am still of the opinion (eternal optimist that I am) that it
could be done by any of the carriers if managed properly.  

8) Well, I guess that says it all.  I still pay my monthly bill but I
don't turn the phone on much any more.  I used to be able to take care
of business while driving between Phoenix and Tucson.  It made me much
more efficient.  My cellular bills used to range between $300 and $600
a month (and I didn't violate Corporate Security Instructions because
I had an attached encryption device that I used faithfully).  Then I
made that one clear phone call (sheer convenience) to make my travel
arrangements to show my equipment to BellSouth in Atlanta.  Amazing
how on a direct flight from MHT to ATL my luggage was broken open and
five cellular phones, a scanner, and an ESN reader were left untouched,
only the encryption/privacy equipment was destroyed.  

Since I changed jobs and gave my encryption devices back, I no longer
travel and have a need to stay in touch and be more efficient in my
new job (at least my new management probably isn't interested in
paying that much for more efficiency). Now I try not to turn the phone
on near Boston to let the ESN readers and scanners pick up someone
else.  I don't even like to call home and find out my kids are home
alone much less let the world know it.  I use the phone for directory
assistance and calling stores.  Makes me a much more efficient
shopper. Still its hard to pass up a $.10 pay phone (still have it
here in NH) for three minutes knowing it will cost me $1.50 on the
cellular.  Come to think of it, why do I need cellular service?  It's
not as useful as it used to be.

PROGNOSTICATIONS (my favorite):

1) Carriers need to get analog right.  If you attend a regional C1
wireless expo, you will hear that PCS is already here today, and the
speaker will hold up a dual-mode phone and describe all of the nice
services available, meant to make your deskphone expendable.  In
reality, that analogy is based upon the ubiquity of analog service.
The concept of communications any time, anywhere is only available now
because of analog infrastructure.  To date, carriers have shown no
propensity to strengthen the notion that the wireless "deskphone" as
it exists today is as secure and fraud resistant as the wired one
(which is already on my desk and costs a lot less to operate).  They
have already entrenched in customers minds the standards for PCS;
expect more of the same.  They have made PCS sales much more difficult.  
PCS sales people will have to overcome the weaknesses of analog, something 
digital has not been able to do to date.

2) Note several disturbing trends in the carrier responses to fraud.
First, every carrier that attempts to deal with fraud is implementing
its preferred method and they are dissimilar.  I have to wonder if the
Nynex and C1-NY PIN strategies are compatible.

Second, anti-fraud efforts are concentrating on local territories.
Your Nynex PIN is probably worthless on the West Coast where you
probably stand at least an equal chance of being cloned.  

Third, all the "fixes" are user impacting and represent a step
backward from direct dial capabilities.  In an age where cell phones
are now being sold with dial tone (ostensibly to get users to
transition more easily from the deskset), we are now faced with the
probability that we either have to enter a PIN or talk to an operator
(none of which I have to do from my deskset).  These are interim steps
for an analog system that will continue to be much more than an
interim system.  This interim analog system is the test market for
enhanced PCS services and the response will not be "knock the door
down, let me get this thing" if the price of these services are lack
of security and increased exposure to fraud.  There is at least one
district director whose carrier employer is committed to enhanced
services that recognizes the risk he takes every time he powers his
current generation PCS vehicle (aka cellular phone) up, places or
receives a call.  

3) The entire concept of the Wireless PBX is doomed unless security
and fraud are addressed and solved both in the Campus environment and
with the particpating carrier.  Too many corporate security instructions 
exist which preclude discussion of proprietary business over cellular 
phones.  Keep in mind also that with the winding down of the cold war,
many ex-government security folks are now being hired by major corporations
to address the security weaknesses of these companies, and they do
know the score.


John S. Maddaus    jmaddaus@attmail.com


[TELECOM Digest Editor's Note: Thank you very much for such an interesting
inside view on the cellular fraud problem. Your article was one of the
best on the topic I've printed since this thread began.   PAT]