A Question of Trust

A subtle but nonetheless very important issue arises where an access-provider service-provider decoupling exists. That is the question of the trustability of the location information that is provided to the application layer.

Recalling that the location information conveyance is started by the IP device itself, there could be a tacit assumption that information is correct. The correctness of the location information is clearly of importance to the VoIP service provider since they will need it to correctly route the call, and it is of critical importance to the PSAP and the rest of the emergency service because the location information will be used as the destination to which to dispatch valuable resources such as police cars, ambulances, fire crews, and so on.

An assumption of trust with respect to the information provided by the device may be well and good in conjunction with an assumption that the user's intention is honest and the information has been determined to be in good faith and is a best-effort. However, what if the user is not honest? The emergency service is, by its nature, relatively anonymous. A phone number does not necessarily identify the actual user of the device should the subscriber possibly be somebody different. In addition, the PSAP has no basis for understanding the character or degree of answerability of any arbitrary individual subscriber at the given instant that their subscription is being used to make an emergency call. In a poll conducted amongst PSAP operators during the formulation of the i2 architecture, an overwhelming preference was expressed that some information about the source of origin of the location information be available. The reason is fairly obvious and it's that the ability to appear to be making a call from a specific location while actually being in any other arbitrary location in the world exposes the emergency network to acts of mischief or worse that could unnecessarily tie up valuable resources and deny their use in situations of genuine need. This has implications for personal safety and, also, for national security given that the emergency network is regarded as critical security infrastructure in most national jurisdictions.

Figure 1.12: Spoofing a location in an emergency call.

In the cellular case, the location information is determined by the cellular network operator themselves. The emergency network operators, then, base their trust of the veracity of the location information on the recognizable identity of the provider of the location information-that is, the cellular operator. Further, if the location information is determined to be erroneous, the cellular operator is an entity that can be held answerable for this and steps can be taken to cooperatively ensure that the error does not reoccur.

So what can be done in the case of VoIP where the access-provider service-provider decoupling exists? The answer can be found in the functionality of the LIS, which is seen in Figure 1.11 as the network element at the end of the V3 interface and which is the entity that the IP device obtains the initial location information from over the interface labeled V0.