Recently in VoIP Category

The Calgary Herald printed an article today commenting on the events that may have contributed to the death of a Calgary toddler. The article calls for regulators to mandate that VoIP providers have direct connections to 911 services. I agree.

As I have pointed out many times here previously, having 911 calls redirected to call centre has the potential of compromising the efficacy of the response. This is especially true when one considers that the person accepting the call almost certainly does not have the experience and training of a 911 operator.

The article points out that Canadian VoIP service providers opposed regulations that would have forced them to have direct connections to 911 call centres. I’m not convinced that’s entirely correct. If memory serves me (someone please correct me if I’m wrong), 911 centres themselves were opposed to direct connections from VoIP providers that could not guarantee that the provided address of the 911 caller was accurate.

Also, while I agree that VoIP based 911 calls should go directly to a 911 dispatch centre, it may not have made any difference in this case. Direct connection or not, the address in the database was wrong. Perhaps a 911 operator would have handled the situation better, perhaps not.

The fact is that with nomadic VoIP services, there is no fool proof way (that I know of) of ensuring that the location information associated with a 911 call will always be correct. I’ve given this subject a lot of thought over the years because I have always been troubled by the potential consequences. There are ways of addressing the problem, at least partly, but none of them are perfect or for that matter, practical.

What follows are various methods of associating a caller with a location:

Physical Connection

The telephony device is bound to a physical location. That’s the situation with a POTS line; the regular telephone service from your telephone company. The telephone is connected to a pair of wires which the telephone company can accurately associate with an address and the address never changes. In some cases a VoIP provider can use the same method but only if they control the entire infrastructure associated with the service which is the case with most cable companies.

Heartbeat

A VoIP provider can monitor the end device and detect a possible change in location. If the device goes out of service and then comes back into service with a different IP address, then it may indicate that the device has been moved. The key word is “may” since there are many situations where this could occur even if the device had not been moved. Still, the service provider could configure the service so that under this circumstance, the telephony user must confirm their address before the service is restored. There are many problems with this approach including the scenario where a caller connects a previously disconnected device and attempts to make a 911 call. Insisting that the caller first confirm the address before the telephony service is restored is not sensible in this circumstance!

Global Positioning Systems

Imbed GPS receivers in the telephony devices. Besides the fact that other components would be required to associate the GPS coordinates with physical addresses this approach is not practical for at least two reasons. The first is the cost associated with the GPS receivers. One can argue that cost should not be a factor when it comes to public safety but the fact remains that VoIP services will not exist if the economics don’t make sense. The second problem with this approach is that GPS receivers simply don’t work very well indoors. In fact in many situations they will be completely non functional.

Conclusion

The death of this child is tragic. The fact that a shortcoming of VoIP service may have played a role is also very troubling. It’s not the first event of its kind and sadly, it likely won’t be the last. However, the answer is not to shut down VoIP service providers - although I suspect the Telcos would be in favour of that option!

I’m sure a practical solution will eventually emerge. In the meantime if you are VoIP customer ensure that the address information on file with your provider is accurate. Do it now!

Note:

The 911 challenges discussed above relate to nomadic and residential VoIP or Internet Telephony services. When it comes to IP Telephony services for business, all of the E911 concerns can, and are routinely addressed satisfactorily.

Stumble It!

The Calgary Herald is reporting that a toddler has died, and that delays in the response to a 911 call (initially made using a VoIP service) may have been a contributing factor in the child’s death. The Herald is reporting that 40 minutes passed from the time the original call was placed until emergency crews arrived. A 911 call was later placed from a neighbour’s home and emergency crews arrived within six minutes of that call.

My thoughts and condolences go out to the child’s family. What a tragic and sad event!

I will attempt to follow the story as investigators work to discover what may have gone wrong in the process. In the meantime I will not speculate on the circumstances surrounding this tragedy but I would like to make a few comments on residential VoIP based services in general.

What follows in an excerpt from an article I wrote previously on the risks associated with residential VoIP services:

Emergencies

Yes, it’s true that most VoIP providers have E911 capabilities. However, in many instances, unlike your POTS (Plain Old Telephone Service) service, your call does not terminate directly in the E911 PSAP. Instead, it is directed to a call centre first, which in my view, could potentially compromise the efficacy of the response. In addition, as others have pointed out, unless your ATA has, or is plugged into, a backup power supply, your VoIP service will be non-functional in a power outage. Even, with ATA backup power, a power interruption might bring down the network through which your VoIP service is delivered. Sure, most cable companies do have UPS to protect their trunk and distribution amplifiers but the capacity may be very limited which means that an extended and widespread outage will almost certainly result in your VoIP service going down. In addition, the reliability of the backup power is dependent on diligent maintenance, which is a non-trivial and expensive challenge. My Bell Canada phone service, I am confident, would continue to work even if a power outage lasted for weeks.

In addition to the potential risks in the above excerpt, with many Internet Telephony Services, it is essential that the customer completes an address form so that the correct relationship between the assigned telephone number and the customer’s address is on record at the service provider. It should also be pointed out that with many free Internet Telephony services, that there is no mechanism for associating the origin of a 911 call with an address.

Since writing the article on the risks of residential VoIP services, I have discontinued my POTS line. However, I have done so with a full understanding of the risks.

In my view, residential VoIP providers do not provide sufficient information to consumers regarding the risks associated with depending on a VoIP service as a primary line. In fact, many of the VoIP providers promote the service in a way that would lead consumers to believe that when it comes to service reliability and E911, that their services is equivalent to POTS, which they are not.

Whether you are currently a VoIP subscriber or are considering discontinuing your POTS line and replacing it with a VoIP service, I urge you to read my article on the potential risks before you make your decision

If you need help to assess the risks, please leave a comment here and I will do my best to provide you with factual information.

 

Stumble It!

I was recently interviewed by the National Post to provide some comments on VoIP / Wireless security for an article in the Financial Post.

I'm not sure what's behind it, but when it comes to transporting voice over an IP network, there continues to be a fascination and some paranoia about the security aspects. This despite the fact that references to documented security breaches remain elusive. VoIP and SIP do have security vulnerabilities but as I have stated many times, all of the associated risks can be sufficiently mitigated by following documented best-practices.

When it comes to eavesdropping on voice calls, things were much simpler when I was implementing business voice solutions during the early 80s'. Remember the Butt Set? Despite the fact that all one needed to listen to, and record calls, was a pair of alligator clips and easily accessed wire pairs, I rarely heard anyone express concerns about voice security.

Intercepting VoIP calls in a properly secured environment, is slightly more complicated. First one needs to either get physical access or to somehow redirect the VoIP traffic. Once that is accomplished, there are software tools that can capture the VoIP traffic and convert the encoded voice back to analogue. In a secure enterprise environment however, that is much more complicated than the Butt Set method of old. And oh yes, I almost forgot. Someone came up with this silly concept of encryption, which when applied to VoIP media streams and signaling, adds considerably to the challenge of eavesdropping!
Stumble It!

Later today, Bell is scheduled to disconnect my residential phone service. While many from the Millennial Generation might not even give it a second thought, for me, the disconnection is a big deal and I'm still a little apprehensive. After all, the traditional analogue phone service has been with me, in every house I've lived in, for my entire life.

When it comes to service reliability, it's hard to beat Canadian residential phone service. When we pick up the phone receiver we know we will hear dialtone. Even during power outages, most of the time, the phone service works just fine, even if the outage lasts for days. Same can be said for voice quality. So when it comes to service quality and availability the bar is very high.

However, there has been very little in the way of service innovation. I do remember the transition from rotary dial to touch tone. That was an improvement in the user interface but it was done to benefit the telcos, not the consumers. And, if I remember correctly we had to pay more for the privilege. Years later I got rid of my answering machine. Having voicemail service in the cloud was certainly an improvement but once again, I had to fork out a few extra dollars for the service enhancement. Over the years, other features were introduced such as Caller ID, Call Waiting, Call Block, Call Return, and a few others. Each of them involved an additional subscription fee.

Over the course of the past 10 years, IP-based telephony services have enabled significant advances that have led to compelling new features and functionality. As a result business users, and subscribers to Internet Telephony Service Providers, now benefit from services such as Unified Messaging, Simultaneous Ring, Softphones, Visual Voicemail and many others. Meanwhile, meaningful innovation in residential phone services have been non-existent. Sure, Bell recently introduced a few new features such as voicemail to email, but once again, there is an additional subscription fee.

As a consumer, the only effective means available to express my dissatisfaction with the lack of innovation and value, is to discontinue my subscription. So today is the day. Reservations, about service reliability persist, but I am confident that my Internet Telephony Service will provide a much richer user experience at a significantly lower cost. And, with cell phone service as a backup, my service reliability concerns are satisfied.

Canadian telephone companies have already lost more that a million subscribers to their competitors. Without true innovation, the trend will continue.

Stumble It!

I stumbled across a conversation initiated by a post that Om Malik (best of luck with your recovery Om) wrote in his blog more than a year ago entitled PSTN versus VoIP. With respect to residential VoIP service, not much has changed since the original post.

I added the following to the many comments:

Stumble It!

I've been reading with interest, several commentaries on blogs related to the status of the VoIP industry and its prospects going forward.

If you haven't already, I suggest that you read the following posts, which represent a perspective on the industry with some mild debate on the state of VoIP.

Telecosm - Ike Elliott, VoIP is Dead. Long Live VoIP

New Telephony - Kelly M. Teal, Worst of 2007: VoIP

Unified Communications - Ken Camp, A Brief Look at 2007 - The Good, the Bad and the Ugly

Conversationware - Matt Lamber, VoIP is plumbing

Digital Common Sense - Ken Camp, More on VoIP as Plumbing

FierceVoIP - VoIP crusader recants

Saunderslog.com - Alec Saunders, End of standalone IP telephony? Hogwash!

Jeff Pulver Blog - 2008: The Year VoIP is Disruptive (Again)

The postings and ensuing conversations are interesting and varied. Everything from VoIP is dead, to VoIP is just plumbing, to 2008 will be the best year yet for VoIP. Why should there be such a divergence of opinion among industry veterans? In my view, much of the debate and disagreement is related to what has become a pet peeve of mine, which is DEFINITION! We can't even begin to come close to a consensus on the subject unless we know precisely what it is we are discussing.

Many within the IP Communications business, would insist that the definitions for VoIP, IP Telephony and Unified Communications are well understood and clearly defined. However, I am convinced, that the general public, even technical savvy folks, are confused about the technology, its definitions, vendor strategies and how it all comes together to solve business problems. This is not just a matter of opinion. I've had many discussions with customers including those from medium size enterprise, government, large integrators and service providers, and all of them struggle to define the terms, and to understand the technology and its tangible benefits.

While endless debates on exact definitions are not productive, it's time we move past the marketing hype and techno babble and come to some agreement on some common definitions. Until then, how can we possibly hope to quantify market growth or business benefits?

The common use of the term Unified Communications to describe everything under the Sun is responsible for much of the confusion. For example, I've read many growth projections for Unified Communications but in my view, the numbers are meaningless without a precise definition. After all what's included in the projections? Is the integration of communications with business applications such as CRM and ERP included? What about video conferencing, audio conferencing, mobility, or good old IP Telephony?

What follows are the descriptions I use to describe VoIP, IP Telephony and Unified Communications, all of which I consider to be part of IP Communications.

VoIP

In the strictest definition, Voice over Internet Protocol, can be defined as the method by which analogue voice is digitized, transported from a source to a destination over an IP network, and converted back to analogue. Based on this definition, it is a mature and well-proven technology and can be considered a plumbing aspect of IP Telephony and Unified Communications. Other plumbing components could include the network infrastructure, QoS, ISDN circuits and other services responsible for the transport of voice. Based on this definition, VoIP is dead in terms of innovation or any new impact on the IP Communications industry. Therefore the term VoIP, should not even be part of a business conversation with an enterprise customer about the benefits of UC. It is merely an enabler and is irrelevant.

However, we all know that VoIP is used to describe much more than just voice transport. It has become the de facto definition for nearly all IP-based consumer voice services such as Vonage and Skype among many others. Based on this broader definition, VoIP is alive and well and in fact, we are still early in its evolution!

I prefer to use the term IP Telephony to describe voice services which utilize VoIP as the transport mechanisms. However, I always make a point of making a distinction between Consumer IP Telephony and Enterprise-Class IP Telephony. The former is based on best-effort delivery mechanisms while the latter is based on voice transport across a secure infrastructure with QoS enabled delivery.

IP Telephony

I replaced the term VoIP with IP Telephony in my vocabulary approximately 8 years ago when it became apparent to me, that IP-based voice, was not just about point-to-point links designed to provide enterprise with toll bypass services. IP Telephony describes all of the system components (hardware & software) that combine to produce business-class voice services.

The components may include:

- Call signaling and control
- Media services
- Media Gateways (for connection to the PSTN)
- Messaging
- Conferencing
- Advanced features (Like Find-Me / Follow-Me)
- Automatic Call Distribution

An IP Telephony system will typically use VoIP as its transport mechanism but will usually also, utilize traditional TDM or analogue circuits for voice transport.

Unified Communications

The ubiquitous use of this term and all of the associated hype is responsible for much of the current confusion and ambiguity related to IP-based Communications. I don't know the context under which the term "Unified Communications" was originally conceived, but it's virtually impossible to find a concise and precise definition of what it describes today. Part of the confusion stems from the fact that IP Telephony and IP-PBX systems were suddenly renamed to Unified Communication systems. In many instances, the change happened literally overnight even if there was no change whatsoever in functionality.

I recently wrote a post on the subject. While I wait for a better definition that I can share with my customers, I came up with:

Unified Communications is part of the continuing evolution of IP Communications technology which automates and unifies all forms of human and device communications in context and with a common experience.

I realize it is a somewhat simplistic definition, but I believe it does an adequate job of describing UC as a framework or system. VoIP, IP Telephony, Mobility, Communications Enabled Business Processes, Mashups, Contact Centres, Collaboration, Presence, Filtering are all components or attributes which may, or may not be, part of a Unified Communications system.

Conclusion

The industry as a whole will benefit if its influencers move away from the hype and technical jargon, towards consensus on definitions and quantifiable descriptions of the business benefits of IP Communications.

Rick McCharles
IP Communications Consultant
RIC Services

Stumble It!

Statistics Canada is reporting that Canadian cable operators are continuing to lure away residential phone customers away from Bell Canada and Telus. In a publication released yesterday, Canada's national statistics agency reports that as of August 31, 2006, the cable operators, led by Videotron, Rogers, Shaw and Cogeco, had 927,463 telephone customers. That is four times more clients than they had a year earlier.

Many of the incumbents' customers are lured away by attractive bundling options offered by the cable operators. While the rate of growth has slowed, the cable operators continue to chip away at the incumbents' customer base. As the rate of growth slows, I anticipate that the cable operators will enhance their service offering and begin to offer more aggressive pricing.

In my view, Bell and Telus have limited options:

1. They could just ignore the competitive threat if they believe that the bulk of the damage has already been done. I'm confident that this option is not viewed as a viable option by either of the incumbents.

2. With the regulatory handcuffs removed, they can begin to lower prices. While we are likely to see price reductions by all players, playing the pricing game is not in their best interest.

3. Innovate! In my view, increased innovation is the most significant consumer benefit of increased competition; not reduced prices. By offering enhanced telephony offerings and integrating mobility, Internet and television features, Bell and Telus can stem the flow of customers to their competitors without slashing their telephony profit margins.

Rick McCharles
Telecom Consultant, Toronto
RIC Services
 
Stumble It!

I read an interesting post by Ike Elliot on the subject of why consumer VoIP service providers struggle. Ike lists three main factors that challenge the industry:

1. No barriers to entry for competition
2. No sustainable competitive advantage (some would argue there is a competitive disadvantage)
3. Not enough attention to details that matter to customers.

I agree with his assessment but I would suggest that the delivery aspect of the service is the most significant challenge for consumer VoIP service providers.

Ike does discuss the issue of QoS and bandwidth management. However, I believe that that Quality of Experience (QoE), is likely the most important criteria that limits the success of many consumer based VoIP service providers. In my view, the delivery side of the business is the most significant limiting factor to a satisfactory QoE.

I often make this analogy. Imagine your company makes some widget. You have deployed stringent quality control  procedures to ensure consistent quality of your product. When it comes to the delivery of your widgets however, you just boot them out the door and hope that they arrive at your customer in good condition. You have no control of who delivers your widgets. In fact, your product may be delivered to your customers by your competitors who have absolutely no motivation to ensure that your product gets delivered in good condition and without delay.

For many VoIP service providers this analogy applies. Notice I didn't say all providers because cable companies, carriers and wireless providers can, if they chose to do so, control the quality of delivery within their own territories. For most others, the delivery analogy applies because of their inability to implement end-to-end QoS . In addition they have absolutely no control over the quality, reliability and availability of the physical infrastructure responsible for the delivery of the service to their clients.

The result is that network congestion and outages can occur at a multitude of points along the delivery path. Even if  these occurrences are rare, when combined with quality issues that are bound to arise within the service providers' own infrastructure or the infrastructure of their suppliers, the result is an unsatisfactory customer QoE!

In my view, the delivery factor constitutes a fundamental flaw in most consumer VoIP business models and jeopardizes their long term viability.

So, is there a way to control the quality of delivery? Well, as previously mentioned cable companies, wireless service providers and telephone companies do have the ability to control many of the delivery challenges within their own territories.

For other VoIP providers (those who do not own their own infrastructure) their options are limited. One option is to lease infrastructure from a cable company, telephone company or wireless provider where regulatory and other policies allow. However, co-locating equipment adds a very significant initial capital investment for a new entrant. Additionally, leasing infrastructure adds a recurring cost that will likely destroy the economic viability of a VoIP-only service. A service that includes Internet access and a bundle of applications in addition to the voice service could potentially contribute to a viable business model based on leased infrastructure. The barrier to entry is however, significant.

Rick McCharles
Telecom Consultant, Toronto, Ontario, Canada
RIC Services





Stumble It!

Sensational title isn't it?

Pardon the sarcasm, but once again we are being bombarded with sensationalist blog and news headlines about the vulnerability of VoIP. The headlines would have you believe that recording any VoIP call is as simple as installing a utility on your PC. Sorry but, in a secure environment that's just nonsense.

I deem the stories to be counter productive and I question the motives. It's great to raise security awareness, but how about some perspective and some helpful advice? What I don't see in these blog posts and news articles, is any description of the environment or circumstance under which these attacks are possible. Nor do I see any advice on whether protection mechanisms are available.

Several months ago, I bought and read the book Hacking Exposed VoIP since so many security presentations and articles used this book as a reference. It was interesting, and I would recommend it for those who would like to understand VoIP and SIP vulnerabilities. However, what I discovered was that nearly all of the hacks / vulnerabilities described in the book were dependent on the fact that common security best practices had not been implemented or had been compromised.

The latest flurry is related to a monitoring utility named SipTap by Peter Cox at VoIPCode.org.

While it's true that VoIP is vulnerable to a wide variety of attacks, it is also true that nearly all (including this latest one) can be mitigated by sound security practices.

I won't go into a detailed tutorial but I will provide a quick list and some references for you to pursue:

• Secure the IP Phones preventing users from viewing or changing configuration parameters
• Encryption: Signaling, Audio Path and Administrative
• Use Certificates to authenticate humans and components that use the system
  
• Disable root access for telephony administrators
• Deploy AAA systems and procedures (Authentication, Authorization and Accounting)
• Carefully choose who is allowed to transfer calls to an external destination
• Deploy and maintain virus protection
• Disable all unnecessary services on phones and related systems
• Expire passwords
• Disable passwords following a number of failed attempts
• Impose content and length restrictions to passwords
• Impose rate-limiting mechanisms to thwart DoS attackes
• Deploy security monitoring and alarming systems
• Phones and devices should reject unsigned or tampered firmware
• Reject 802.1q traffic destined to, or from the PC switch port of the phone
• Segment voice and data traffic on separate VLANs (PC phones violate this best practice)
• Install properly configured firewalls (duh!)
• Secure all network devices (physically and logically)
• Phones should ignore gratuitous ARPs
• Perform DHCP inspection
  
• Implement VPNs for remote access

Here are some excellent references:

Enhanced Security for Unified Communications (Cisco)
Enterprise VoIP Security Best Practices (Juniper)
VoIP Security for Dummies (Avaya)

I don't deny for a second that SIP and VoIP have vulnerabilities and that they must be addressed. But, there's no going back to TDM. IP communications is here to stay and the vast majority of risks can be adequately mitigated. Many of the security precautions should already be in place if your network and IT environment is secure.

Rick McCharles
VoIP / IP Telephony Consultant, Toronto
RIC Services



Stumble It!

Long Distance, Audio Conferencing and Hosted IP Telephony service providers have been taking advantage of the lower cost and scalability of IP Trunking for years. Many of the current IP Trunking circuits are based on the H.323 protocol. Nearly all new deployments however, employ SIP as the signalling protocol.

While not yet widely adopted, IP Trunking for enterprise PSTN connectivity offers significant advantages to enterprise relative to the common PRI model. I am convinced, that there will be very few, if any, new PRI circuit deployments in Canadian urban locations, within five years.

If you are about to migrate to IP Telephony you should seriously consider, replacing your PRI and in some cases BRI or analogue trunks with IP Trunks.

The following table contrasts PRI vs. IP Trunks and highlights just some of the compelling advantages enabled by IP Trunking.

PRI	IP Trunks
Physical connections:   Each circuit requires physical connection and costly termination hardware.	Connections are virtual:   Number of available  trunks is a function of available bandwidth, not physical termination hardware or circuits.
Scaling up requires the installation of new circuits and additional termination hardware.	Scales up or down easily and quickly (a software configuration change) and can offer automatic and on-demand burst capabilities
Providing sufficient backup circuits to remote sites in an IPT-distributed architecture can negatively impact the ROI.	Automatic IP re-routing capabilities allow practical geographic distribution of PSTN connectivity to sites with limited or no network redundancy
Cost is usually per circuit per month	A variety of pricing models (i.e. usage based) are likely to emerge, including on-demand capacity.  Relative to PRI circuits and the associated supporting hardware, IP Trunking costs are likely to be significantly lower.
Capacity planning & engineering is critical:   Additional capacity must be planned well in advance since considerable lead time may be required for the ordering and installation of new circuits and termination hardware	While capacity planning is still important, adding additional capacity can be as simple as a software change. Additionally, providers are likely to offer burst capabilities.
Only way to accommodate loss of hardware or facility where PRI’s terminate is to build-in excess capacity with associated cost impact.	Can be designed to retain PSTN reachability and capacity in the event of the loss of terminating hardware (or even an entire office location) without the need to build in excess capacity
Including dispersed locations in most current IP Telephony deployments requires the addition of network redundancy or significant local PSTN connectivity (analogue or ISDN trunks) to ensure that individual locations can function autonomously in the event of a failure. These factors can add substantial Opex and Capex.	Dispersed locations can be connected to the PSTN via an IP connection. Should a network failure occur incoming calls can be automatically rerouted to the isolated location.
Diversity across service providers is usually cost prohibitive.	Can accommodate diversity across service providers much like is done today with Internet access via BGP.

 
Even if you no immediate plans to migrate to VoIP, IP Trunks connected via a gateway to your existing PBX can result in cost savings and can allow you to enhance your current system’s functionality and features.

Rick McCharles
Telecom Consultant, Toronto
RIC Services

Stumble It!