The question asked by spies and agents in countless movies. Given an unsatisfactory answer, the agent does not divulge the sensitive information. With a solid acknowledgement, both parties know that the important contents of the conversation cannot be intercepted. Government agencies are not the only entity privy to private phone conversations, nor are they the only organizations in need of secure communications.
Corporate secrets and sensitive information can be more easily gleaned from eavesdropping on phone systems rather than attack the hardened network, either from the outside or the inside. Secure phone communications is available to any organization. Often, while emails and other electronic communication channels are protected, the phone systems go unnoticed.
Phone systems in office settings are typically not protected. The regular land-line phone system can be vulnerable to tampering. Think of how much vital company information is discussed over that channel. Even, as many companies are doing these days, moving to a VoIP-based system does not guarantee to security. It only changes the underlying technology, the paradigm of transmitting audio data, and can still be compromised. Cell phones as well are a weak link. Analog cell phone calls were extremely easy to intercept, whereas digital cell phone calls are more difficult, it is still a vulnerable point for a targeted organization. Fax systems as well are targets for gathering information.
The U.S. government and approved contractors have long been able to purchase secure telephony systems that integrate together. From the classic STA-III to many newer, slicker models. To purchase such phones requires COMSEC clearance from the Department of Defense. A non-governmental option is the use of a software based telephone that supports VoIP encryption, such as SFLphone for Linux. It offers many levels of security including the ZRTP protocol. While civilian options of secure voice communications may be limited compared to the government’s equipment, open source VoIP solutions and the public Internet allow for strong COMSEC for the rest of us. Confidential voice communication is possible, and allows an enterprise to say, “Yes, the line is secure; go ahead”.