The PSTN gives a call no end-to-end encryption. Its security rests on how each carrier along the path protects its own network, and a caller can't see that. Parts of a call can be encrypted. The IP leg between your phone or app and your provider can use TLS for signaling and SRTP for audio, and an IP link between two carriers can be protected the same way. Each of those protections runs between two devices that share the keys, and it ends at the device that decrypts the call to pass it on. End-to-end encryption needs compatible equipment or software at both ends, and an ordinary call to a phone number doesn't arrange that.
\n","summary":"The PSTN gives a call no end-to-end encryption. Its security rests on how each carrier on the path protects its own network, which a caller can't see. Individual legs can be encrypted, such as the IP leg between a phone or app and its provider, but each protection runs between two devices that share the keys and ends at the device that decrypts the call to pass it on. End-to-end encryption needs compatible equipment or software at both ends.","publishedAt":"2026-07-11T16:01:27.137","verifiedAt":"2026-09-14T00:00:00","editorialStatus":"APPROVED","lastReviewedAt":"2026-10-10T03:02:03.474","nextReviewDueAt":"2026-12-14T00:00:00","templateVersion":"v2","aliases":["Are landline phone calls encrypted?","Can you encrypt a phone call over the PSTN?","How secure is a landline call?","Does the PSTN use encryption?","Are PSTN calls private?","Can someone listen to a landline phone call?"],"confidenceScore":80,"confidenceLabel":"High","canonicalUrl":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"contributorOrganizationProfile":null,"contributorPerson":null,"sections":[{"id":"b59d882e-218a-4630-bc61-4e981be5800d","sectionKey":"what_the_network_protects","sectionType":"markdown_section","heading":"What the telephone network protects","introMarkdown":"The PSTN was built to deliver calls reliably. [ITU-T G.711](https://www.itu.int/rec/T-REC-G.711-198811-I/en), the network's basic voice coding standard, sets a sampling rate of 8,000 samples per second and two encoding laws. It is a codec: it describes how speech becomes numbers, and any encryption has to come from the link that carries those numbers or from the devices at each end. The safeguards that [ITU-T Q.700](https://www.itu.int/rec/T-REC-Q.700-199303-I/en) lists for SS7, the signaling system switches use to set up calls, are aimed at transmission faults and link failures.\n\nKeeping a call confidential is left to how each carrier protects its lines, switches and signaling links, and those protections have been tested. In a [2024 public notice](https://docs.fcc.gov/public/attachments/DA-24-308A1.pdf), the FCC's public safety bureau said SS7 and its successor protocol, Diameter, are used to process and route calls and text messages between networks, and that \"numerous reports have called attention to security vulnerabilities present within SS7 networks.\" The reports it cites are about tracking a subscriber's location, which is a different thing from listening to a call. An FCC advisory council had earlier recommended firewalls, monitoring and filtering on signaling traffic, and it advised the industry to encourage subscribers to use the encryption available to them.\n\nCarrier networks themselves have also been breached. In December 2024, CISA reported that actors affiliated with the Chinese government had targeted commercial telecommunications infrastructure. The agency's [guidance](https://www.cisa.gov/sites/default/files/2024-12/guidance-mobile-communications-best-practices.pdf) says the activity led to the theft of customer call records and to the compromise of private communications for a small number of highly targeted people.\n\nWhether that makes the PSTN secure enough depends on what a call needs protection from. The telephone network gives a caller no way to confirm how the whole path is protected. A conversation that has to stay private from everyone between the two parties needs encryption the callers can account for.","introHtml":"The PSTN was built to deliver calls reliably. ITU-T G.711, the network's basic voice coding standard, sets a sampling rate of 8,000 samples per second and two encoding laws. It is a codec: it describes how speech becomes numbers, and any encryption has to come from the link that carries those numbers or from the devices at each end. The safeguards that ITU-T Q.700 lists for SS7, the signaling system switches use to set up calls, are aimed at transmission faults and link failures.
\nKeeping a call confidential is left to how each carrier protects its lines, switches and signaling links, and those protections have been tested. In a 2024 public notice, the FCC's public safety bureau said SS7 and its successor protocol, Diameter, are used to process and route calls and text messages between networks, and that "numerous reports have called attention to security vulnerabilities present within SS7 networks." The reports it cites are about tracking a subscriber's location, which is a different thing from listening to a call. An FCC advisory council had earlier recommended firewalls, monitoring and filtering on signaling traffic, and it advised the industry to encourage subscribers to use the encryption available to them.
\nCarrier networks themselves have also been breached. In December 2024, CISA reported that actors affiliated with the Chinese government had targeted commercial telecommunications infrastructure. The agency's guidance says the activity led to the theft of customer call records and to the compromise of private communications for a small number of highly targeted people.
\nWhether that makes the PSTN secure enough depends on what a call needs protection from. The telephone network gives a caller no way to confirm how the whole path is protected. A conversation that has to stay private from everyone between the two parties needs encryption the callers can account for.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":10},{"id":"8b0844a8-4062-4f6e-98f7-8b3a53b63ed8","sectionKey":"encryption_covers_one_hop","sectionType":"markdown_section","heading":"Encryption covers one hop at a time","introMarkdown":"A modern call usually crosses several networks, and each leg can have different protection, depending on how it is configured. Signaling and audio also use different protocols.\n\nFor signaling, the SIP standard is plain about the limit. [RFC 3261](https://www.rfc-editor.org/rfc/rfc3261.html#section-26.3.2.1) says \"TLS offers strictly hop-by-hop security,\" and that a device sending a request over TLS to its proxy \"has no assurance that TLS will be used end-to-end.\" For audio, [SRTP](https://datatracker.ietf.org/doc/html/rfc3711) \"can provide confidentiality, message authentication, and replay protection\" to the voice packets. It protects them between the two devices that share its keys, and those two devices are often your phone and your provider's equipment, with the other person's phone outside the session.","introHtml":"A modern call usually crosses several networks, and each leg can have different protection, depending on how it is configured. Signaling and audio also use different protocols.
\nFor signaling, the SIP standard is plain about the limit. RFC 3261 says "TLS offers strictly hop-by-hop security," and that a device sending a request over TLS to its proxy "has no assurance that TLS will be used end-to-end." For audio, SRTP "can provide confidentiality, message authentication, and replay protection" to the voice packets. It protects them between the two devices that share its keys, and those two devices are often your phone and your provider's equipment, with the other person's phone outside the session.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":20},{"id":"860cf6dc-5c91-4ce6-8a38-47764299a929","sectionKey":"legs_of_a_call","sectionType":"table_section","heading":"The legs of a call to a phone number","introMarkdown":null,"introHtml":null,"outroMarkdown":null,"outroHtml":null,"contentJson":{"rows":[{"cells":["Your phone or app to your provider","TLS for signaling and SRTP for audio, where the service is configured for them","You and your provider"]},{"cells":["Inside your provider's platform","The provider's own encryption between its systems","Your provider"]},{"cells":["Carrier to carrier across the PSTN","Varies by link and isn't visible to the caller. IP links can be encrypted","The carriers on the path"]},{"cells":["The other person's line or device","Whatever their service uses","The other person and their provider"]}],"columns":["Leg of the call","What can protect it","Who decides"]},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":30},{"id":"e0999be1-a00e-4576-b089-ae7450d45aa7","sectionKey":"where_provider_encryption_stops","sectionType":"markdown_section","heading":"Where your provider's encryption stops","introMarkdown":"The legs nearest you are the ones with published documentation, and Microsoft's Direct Routing is a clear case. It connects Teams to a telephone carrier through a session border controller, or SBC, that the customer supplies. Microsoft's [planning guide](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan) requires SIP over TLS for signaling and SRTP for audio between that SBC and Teams, along with a trusted certificate on the SBC. The same guide lists \"one or more PSTN trunks connected to the SBC\" as a separate requirement. Microsoft's encryption rules cover the Teams side of the SBC. The trunk on the other side is arranged between you and your carrier.\n\nAtlantech Online, a carrier that sells Teams calling, states the boundary on its own network. Its [Operator Connect page](https://www.atlantech.net/solutions/voice/operatorconnect) says the company encrypts calls inside its network and that \"voice signaling and media remain encrypted until the call exits to the PSTN.\" For its government cloud service, Atlantech's [FAQ on end-to-end encryption](https://www.atlantech.net/faq/gcc-high/is-end-to-end-encryption-available-for-all-calls-in-gcc-high-teams-including-pstn-calls-to-external-numbers) is more specific. Calls to outside numbers are protected by TLS on the signaling path and SRTP on the media path between the Teams client and the SBC. Past that point, the FAQ says, the encryption chain \"breaks at the SBC gateway\" as the call moves to the traditional telephone network.\n\nOn this route, the reason is the SBC's role. It is one end of the encrypted Teams session, so it holds the keys and decrypts the call in order to pass it on. What happens after the SBC depends on the next link. It may be another IP connection, encrypted or not, or it may be a circuit. Knowing how your own leg is protected doesn't tell you how the rest of the path is.\n\nSuppose a manager on Teams calls a client's mobile number. Microsoft says [network communications in Teams](https://learn.microsoft.com/en-us/microsoftteams/teams-security-guide) are encrypted by default with TLS and SRTP, so the leg from the laptop to Microsoft is covered. If Atlantech is the company's Operator Connect carrier, Atlantech says the call stays encrypted inside its network until the PSTN handoff. From there it passes to the client's mobile provider, directly or through other carriers. Each of those hops has its own arrangement, and the manager has no view of any of them.\n\nWe trace the same path, with its signaling, in [how the PSTN works](https://www.answerstack.io/q/how-does-the-pstn-work). The choice between a customer-run SBC and a carrier-run one is covered in [Direct Routing versus Operator Connect](https://www.answerstack.io/q/what-is-the-difference-between-direct-routing-and-operator-connect).","introHtml":"The legs nearest you are the ones with published documentation, and Microsoft's Direct Routing is a clear case. It connects Teams to a telephone carrier through a session border controller, or SBC, that the customer supplies. Microsoft's planning guide requires SIP over TLS for signaling and SRTP for audio between that SBC and Teams, along with a trusted certificate on the SBC. The same guide lists "one or more PSTN trunks connected to the SBC" as a separate requirement. Microsoft's encryption rules cover the Teams side of the SBC. The trunk on the other side is arranged between you and your carrier.
\nAtlantech Online, a carrier that sells Teams calling, states the boundary on its own network. Its Operator Connect page says the company encrypts calls inside its network and that "voice signaling and media remain encrypted until the call exits to the PSTN." For its government cloud service, Atlantech's FAQ on end-to-end encryption is more specific. Calls to outside numbers are protected by TLS on the signaling path and SRTP on the media path between the Teams client and the SBC. Past that point, the FAQ says, the encryption chain "breaks at the SBC gateway" as the call moves to the traditional telephone network.
\nOn this route, the reason is the SBC's role. It is one end of the encrypted Teams session, so it holds the keys and decrypts the call in order to pass it on. What happens after the SBC depends on the next link. It may be another IP connection, encrypted or not, or it may be a circuit. Knowing how your own leg is protected doesn't tell you how the rest of the path is.
\nSuppose a manager on Teams calls a client's mobile number. Microsoft says network communications in Teams are encrypted by default with TLS and SRTP, so the leg from the laptop to Microsoft is covered. If Atlantech is the company's Operator Connect carrier, Atlantech says the call stays encrypted inside its network until the PSTN handoff. From there it passes to the client's mobile provider, directly or through other carriers. Each of those hops has its own arrangement, and the manager has no view of any of them.
\nWe trace the same path, with its signaling, in how the PSTN works. The choice between a customer-run SBC and a carrier-run one is covered in Direct Routing versus Operator Connect.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":40},{"id":"8330612e-e7a1-4731-9bbb-073bdbe0416d","sectionKey":"end_to_end_encryption","sectionType":"markdown_section","heading":"Encrypting a call end to end","introMarkdown":"A call is encrypted end to end when the two endpoints hold the keys and nothing between them does. That takes compatible equipment or software on both sides.\n\nIt has been done over ordinary phone lines before. The STU-III secure telephone was developed by the US National Security Agency in 1987 \"for secure voice communication over non-secure analogue PSTN telephone networks,\" according to the [Crypto Museum](https://www.cryptomuseum.com/crypto/usa/stu3/index.htm). The phone digitized speech with a vocoder and encrypted it before it reached the line, and the network carried the result like any other call. Both parties needed a compatible unit.\n\nToday the common route is an encrypted call between two users of a service that supports it, and that call never touches the PSTN. Teams is one example. Microsoft's [end-to-end encryption documentation](https://learn.microsoft.com/en-us/microsoftteams/teams-end-to-end-encryption) says that with the feature on, \"the service can't decrypt media,\" which is why some features that depend on the service stop working. For one-to-one calls it \"is disabled by default\" in the organization-wide policy, so an administrator has to allow it, and users then turn it on in their own Teams settings. The same page lists \"People dialing by phone (PSTN)\" among the things unavailable in an end-to-end encrypted meeting.\n\nThat last item says something narrow. Teams doesn't extend its end-to-end guarantee to a participant who dials in by phone. It says nothing about how the carrier hops on that participant's call are protected. Atlantech draws the same line for its government cloud customers. Its FAQ says end-to-end encryption is available for Teams-to-Teams calls inside the tenant and recommends those calls, in place of calls to outside phone numbers, for sensitive discussions.\n\nCISA's 2024 guidance gives the same advice to the senior officials it was written for: \"Use only end-to-end encrypted communications.\" For most businesses, the practical version is to sort calls by what they need. An ordinary call to a phone number can be protected on your own leg, where your service is configured for it, and that is the part you can confirm with your provider. A conversation that has to be private from everyone in between belongs on a service where both endpoints support end-to-end encryption.","introHtml":"A call is encrypted end to end when the two endpoints hold the keys and nothing between them does. That takes compatible equipment or software on both sides.
\nIt has been done over ordinary phone lines before. The STU-III secure telephone was developed by the US National Security Agency in 1987 "for secure voice communication over non-secure analogue PSTN telephone networks," according to the Crypto Museum. The phone digitized speech with a vocoder and encrypted it before it reached the line, and the network carried the result like any other call. Both parties needed a compatible unit.
\nToday the common route is an encrypted call between two users of a service that supports it, and that call never touches the PSTN. Teams is one example. Microsoft's end-to-end encryption documentation says that with the feature on, "the service can't decrypt media," which is why some features that depend on the service stop working. For one-to-one calls it "is disabled by default" in the organization-wide policy, so an administrator has to allow it, and users then turn it on in their own Teams settings. The same page lists "People dialing by phone (PSTN)" among the things unavailable in an end-to-end encrypted meeting.
\nThat last item says something narrow. Teams doesn't extend its end-to-end guarantee to a participant who dials in by phone. It says nothing about how the carrier hops on that participant's call are protected. Atlantech draws the same line for its government cloud customers. Its FAQ says end-to-end encryption is available for Teams-to-Teams calls inside the tenant and recommends those calls, in place of calls to outside phone numbers, for sensitive discussions.
\nCISA's 2024 guidance gives the same advice to the senior officials it was written for: "Use only end-to-end encrypted communications." For most businesses, the practical version is to sort calls by what they need. An ordinary call to a phone number can be protected on your own leg, where your service is configured for it, and that is the part you can confirm with your provider. A conversation that has to be private from everyone in between belongs on a service where both endpoints support end-to-end encryption.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":50}],"citations":[{"title":"47 U.S. Code § 1002 - Assistance capability requirements","url":"https://www.law.cornell.edu/uscode/text/47/1002","excerpt":"A telecommunications carrier shall not be responsible for decrypting, or ensuring the government's ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication.","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-14T00:00:00","supportsText":"CALEA section 103 as codified: a telecommunications carrier must make equipment, facilities, and services capable of expeditiously isolating and enabling the government, under a court order or other lawful authorization, to intercept all wire and electronic communications of a subscriber and to acce","domain":"law.cornell.edu","publisherName":"Cornell Law School, Legal Information Institute"},{"title":"Communications Assistance for Law Enforcement Act and Broadband Access and Services, 70 FR 59664 (Oct. 13, 2005)","url":"https://www.govinfo.gov/content/pkg/FR-2005-10-13/pdf/05-20606.pdf","excerpt":"providers of facilities-based broadband Internet access services and providers of interconnected voice over Internet Protocol (VoIP) services... must comply with the Communications Assistance for Law Enforcement Act (CALEA).","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-14T00:00:00","supportsText":"FCC First Report and Order (ET Docket 04-295, FCC 05-153) extending CALEA compliance to facilities-based broadband Internet access providers and interconnected VoIP providers, with interconnected VoIP defined as service allowing a user to receive calls originating from and terminate calls to the PST","domain":"govinfo.gov","publisherName":"U.S. Government Publishing Office (Federal Register)"},{"title":"ITU-T G.711: Pulse code modulation (PCM) of voice frequencies","url":"https://www.itu.int/rec/T-REC-G.711-198811-I/en","excerpt":"The nominal value recommended for the sampling rate is 8000 samples per second... Eight binary digits per sample should be used for international circuits.","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-14T00:00:00","supportsText":"Approved 1988-11-25, status in force. The full nine-page text (freely available PDF, read for this update) specifies a nominal sampling rate of 8,000 samples per second, eight binary digits per sample for international circuits, and the A-law and mu-law encoding tables. The recommendation contains n","domain":"itu.int","publisherName":"International Telecommunication Union (ITU-T)"},{"title":"ITU-T Recommendation Q.700: Introduction to CCITT Signalling System No. 7","url":"https://www.itu.int/rec/T-REC-Q.700-199303-I/en","excerpt":"Common channel signalling is a signalling method in which a single channel conveys, by means of labelled messages, signalling information relating to, for example, a multiplicity of circuits, or other information such as that used for network management.","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-14T00:00:00","supportsText":"Approved 1993-03-12, status in force; PDF read for this update. Defines SS7 as a common channel signalling system carrying labelled messages about a multiplicity of circuits over separate signalling links between signalling points (exchanges, signal transfer points, service control points, operation","domain":"itu.int","publisherName":"International Telecommunication Union (ITU-T)"},{"title":"RFC 3711: The Secure Real-time Transport Protocol (SRTP)","url":"https://datatracker.ietf.org/doc/html/rfc3711","excerpt":"SRTP provides a framework for encryption and message authentication of RTP and RTCP streams... With appropriate key management (Sections 7 and 8), SRTP is secure.","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-14T00:00:00","supportsText":"SRTP provides a framework for encryption and message authentication of RTP and RTCP streams and is secure with appropriate key management. Section 8 places key management outside SRTP itself, pointing to separate standards (MIKEY, KINK, session description methods) for establishing the cryptographic","domain":"datatracker.ietf.org","publisherName":"Internet Engineering Task Force (IETF)"},{"title":"ITU-T Recommendation H.248.1: Gateway control protocol, Version 3","url":"https://www.itu.int/rec/T-REC-H.248.1/en","excerpt":"media gateway (MG): The media gateway converts media provided in one type of network to the format required in another type of network. For example, an MG could terminate bearer channels from a switched circuit network (e.g., DS0s) and media streams from a packet network (e.g., RTP streams in an IP network).","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-14T00:00:00","supportsText":"H.248.1 (03/13), status in force; PDF read for this update. Definition 3.2.3 establishes what a media gateway does: convert media from one type of network to the format required in another, terminating bearer channels from a switched circuit network and media streams from a packet network. Supports ","domain":"itu.int","publisherName":"International Telecommunication Union (ITU-T)"},{"title":"47 CFR Part 64, Subpart HH: Caller ID Authentication","url":"https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-HH","excerpt":"a voice service provider shall fully implement the STIR/SHAKEN authentication framework in its internet Protocol networks.","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-14T00:00:00","supportsText":"Section 64.6301 requires a voice service provider to fully implement the STIR/SHAKEN authentication framework in its internet Protocol networks and to authenticate and verify caller identification information for SIP calls. Section 64.6303 gives providers with non-IP networks the alternative of upgr","domain":"ecfr.gov","publisherName":"Electronic Code of Federal Regulations (National Archives)"},{"title":"Mobile Communications Best Practice Guidance (TLP:CLEAR, December 18, 2024)","url":"https://www.cisa.gov/sites/default/files/2024-12/guidance-mobile-communications-best-practices.pdf","excerpt":"SMS messages are not encrypted - a threat actor with access to a telecommunication provider's network who intercepts these messages can read them.","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-14T00:00:00","supportsText":"CISA identified PRC government-affiliated cyber espionage against commercial telecommunications infrastructure that enabled theft of customer call records and compromise of private communications for highly targeted individuals; the first general recommendation is to use only end-to-end encrypted co","domain":"cisa.gov","publisherName":"Cybersecurity and Infrastructure Security Agency (CISA)"},{"title":"EFF to FCC: SS7 is Vulnerable, and Telecoms Must Acknowledge That","url":"https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable-and-telecoms-must-acknowledge","excerpt":"the tracking of a person in the United States using Provide Subscriber Information (PSI) exploitation","quoteText":null,"sourceRole":"SUPPORTING","verifiedAt":"2026-09-14T00:00:00","supportsText":"Advocacy post (Cooper Quintin and Babette Ngene, July 15, 2024) summarizing CISA official Kevin Briggs's 2024 FCC filing: tracking of a person in the United States in March 2022 via Provide Subscriber Information exploitation, tracking of three subscribers in April 2022 via Send Routing Information ","domain":"eff.org","publisherName":"Electronic Frontier Foundation"},{"title":"Manage end-to-end encryption for Microsoft Teams meetings and one-to-one calls","url":"https://learn.microsoft.com/en-us/microsoftteams/teams-end-to-end-encryption","excerpt":"Because the service can't decrypt media, some features that depend on service-side access aren't available... People dialing by phone (PSTN): not available.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-09-14T00:00:00","supportsText":"Vendor product documentation (updated August 28, 2026) for the end-to-end encrypted app row: because the service cannot decrypt media, recording, live captions and transcription, call transfer, and adding a participant become unavailable; people dialing by phone (PSTN) is listed as unavailable in en","domain":"learn.microsoft.com","publisherName":"Microsoft Learn"},{"title":"Telephone tapping","url":"https://en.wikipedia.org/wiki/Telephone_tapping","excerpt":"If the tap is implemented at a digital switch, the switching computer simply copies the digitized bits that represent the phone conversation to a second line and it is impossible to tell whether a line is being tapped.","quoteText":null,"sourceRole":"SUPPORTING","verifiedAt":"2026-09-14T00:00:00","supportsText":"Encyclopedia summary used for the two oldest interception points: the wiretap took its name from an electrical tap on an analog telephone or telegraph line, and at a digital switch the switching computer copies the digitized bits of the conversation to a second line with no way to tell the line is t","domain":"en.wikipedia.org","publisherName":"Wikipedia"},{"title":"STU-III","url":"https://en.wikipedia.org/wiki/STU-III","excerpt":"When the CIK is removed from the STU-III telephone neither unit is considered classified. Only when the CIK is inserted into the STU-III on which it was created can classified information be received and sent.","quoteText":null,"sourceRole":"SUPPORTING","verifiedAt":"2026-09-14T00:00:00","supportsText":"Encyclopedia summary used for STU-III key handling and fallback: NSA-shipped seed key converted to an operational key by calling a toll-free NSA number, with a compromised-key list downloaded at the same time; the operational key split so one component becomes the crypto ignition key; classified tra","domain":"en.wikipedia.org","publisherName":"Wikipedia"},{"title":"Secure Terminal Equipment","url":"https://en.wikipedia.org/wiki/Secure_Terminal_Equipment","excerpt":"STE sets look like ordinary high-end office desk telephones and can place unsecured calls to anywhere on the public switched telephone network (PSTN)... All cryptographic algorithms are in the crypto card.","quoteText":null,"sourceRole":"SUPPORTING","verifiedAt":"2026-09-14T00:00:00","supportsText":"Encyclopedia summary used for the STE row: STE is the US government's encrypted telephone system for landline communications, designed for ISDN lines, with a PC Card slot taking a Fortezza Plus (KOV-14) or KSV-21 Enhanced Crypto Card, all cryptographic algorithms held in the card, secure calls possi","domain":"en.wikipedia.org","publisherName":"Wikipedia"},{"title":"Scrambler","url":"https://en.wikipedia.org/wiki/Scrambler","excerpt":"Voice inversion with a fixed frequency offers no security at all and software is available to restore the original voice, which is why it is no longer used to protect conversations today.","quoteText":null,"sourceRole":"SUPPORTING","verifiedAt":"2026-09-14T00:00:00","supportsText":"Encyclopedia summary used for the analog scrambler row: voice inversion with a fixed frequency offers no security at all because software is available to restore the original voice, and devices sold today under the same name usually digitize the voice and apply real encryption, which places them in ","domain":"en.wikipedia.org","publisherName":"Wikipedia"},{"title":"STU-III: Third generation secure telephone unit","url":"https://www.cryptomuseum.com/crypto/usa/stu3/index.htm","excerpt":"When used as CIK, the key contains a random number (generated internally by the phone when the keys are loaded) that is used for encryption of the actual cryptographic keys that are stored inside the phone.","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-14T00:00:00","supportsText":"Independent reference collection, no commercial stake in the equipment, used for the mechanism of secure telephony over an analogue PSTN line: the STU-III was developed by NSA for secure voice over non-secure analogue telephone networks; speech is digitized by a vocoder (LPC-10e and CELP, which all ","domain":"cryptomuseum.com","publisherName":"Crypto Museum"}],"revisions":[{"revisedAt":"2026-07-20T16:01:27.137+00:00","versionLabel":"Originally published","note":"","reviewedBy":null}],"relatedAnswers":[{"id":"64a64f8a-a710-4a70-b21b-292c1eb247b6","slug":"what-is-the-pstn-public-switched-telephone-network","question":"What is the PSTN (Public Switched Telephone Network)?","publishedAt":"2026-09-23T15:17:01.345","confidenceScore":93,"confidenceLabel":"High","industry":{"id":"ff619d7c-d7d7-485e-a05a-53fba07f33ed","slug":"telecommunications","label":"Telecommunications","description":"Business voice, fiber, UCaaS, and network services"},"topic":{"slug":"pstn","label":"PSTN","description":"The public switched telephone network: how it works, POTS retirement, and the move to VoIP.","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"The PSTN is the combined telephone networks of the world's carriers, connected so that a number on one can be dialed from another. No single company owns it. Landline and mobile carriers both belong to it, and a shared numbering system holds it together. It began with copper lines and circuit switches, and parts of it now run on IP.","url":"/q/what-is-the-pstn-public-switched-telephone-network"},{"id":"ef14e83f-e61d-4263-80d2-b759e8ba8101","slug":"what-is-the-difference-between-pstn-and-pbx","question":"What is the difference between PSTN and PBX?","publishedAt":"2026-09-19T15:32:04.773","confidenceScore":93,"confidenceLabel":"High","industry":{"id":"ff619d7c-d7d7-485e-a05a-53fba07f33ed","slug":"telecommunications","label":"Telecommunications","description":"Business voice, fiber, UCaaS, and network services"},"topic":{"slug":"pstn","label":"PSTN","description":"The public switched telephone network: how it works, POTS retirement, and the move to VoIP.","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"The PSTN is the public telephone network that connects phone numbers across carriers. A PBX is one organization's own phone system, which gives users extensions and controls how calls are routed. A business normally uses both: the PBX handles calls inside the organization, and a PSTN connection carries calls to and from outside phone numbers.","url":"/q/what-is-the-difference-between-pstn-and-pbx"},{"id":"895bda56-c48a-429f-8f13-53dc29c09b67","slug":"which-legacy-devices-are-still-at-risk-when-pstn-pots-lines-are-retired-or","question":"Which legacy devices are still at risk when PSTN/POTS lines are retired or moved to VoIP?","publishedAt":"2026-08-29T16:01:24.898","confidenceScore":90,"confidenceLabel":"High","industry":{"id":"ff619d7c-d7d7-485e-a05a-53fba07f33ed","slug":"telecommunications","label":"Telecommunications","description":"Business voice, fiber, UCaaS, and network services"},"topic":{"slug":"pstn","label":"PSTN","description":"The public switched telephone network: how it works, POTS retirement, and the move to VoIP.","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"Analog devices that use a copper phone line as their call path are at risk: alarm dialers, elevator phones, telecare and medical alert base stations, fax machines, dial-up card terminals, entry intercoms and building monitoring modems. A device whose line is retired or moved to VoIP needs a path that carries its signals and has backup power, checked by a test arranged with the device's vendor or monitoring company.","url":"/q/which-legacy-devices-are-still-at-risk-when-pstn-pots-lines-are-retired-or"},{"id":"69048737-9759-4922-93ff-0af08871c2af","slug":"how-does-the-pstn-work","question":"How does the PSTN work?","publishedAt":"2026-07-18T15:31:57.455","confidenceScore":92,"confidenceLabel":"High","industry":{"id":"ff619d7c-d7d7-485e-a05a-53fba07f33ed","slug":"telecommunications","label":"Telecommunications","description":"Business voice, fiber, UCaaS, and network services"},"topic":{"slug":"pstn","label":"PSTN","description":"The public switched telephone network: how it works, POTS retirement, and the move to VoIP.","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"The PSTN connects a call in two layers. Signaling messages pass between switches to find the dialed number and ring it, and a voice path stays open until someone hangs up. On older parts of the network that path is a reserved 64 kbit/s circuit. On newer parts it is IP packets, and gateways convert between the two where a call passes from one kind of network to the other.","url":"/q/how-does-the-pstn-work"}],"contributorStats":{"verifiedAnswers":149,"openDisputes":0},"schemaJson":{"@context":"https://schema.org","@type":"Question","name":"Is PSTN secure, and can PSTN calls be encrypted?","text":"Is PSTN secure, and can PSTN calls be encrypted?","url":"https://www.answerstack.io/q/is-pstn-secure-and-can-pstn-calls-be-encrypted","answerCount":1,"datePublished":"2026-07-11T16:01:27.137","about":[{"@type":"Thing","name":"PSTN"},{"@type":"Thing","name":"Telecommunications"}],"acceptedAnswer":{"@type":"Answer","text":"The PSTN gives a call no end-to-end encryption. Its security rests on how each carrier along the path protects its own network, and a caller can't see that. Parts of a call can be encrypted. The IP leg between your phone or app and your provider can use TLS for signaling and SRTP for audio, and an IP link between two carriers can be protected the same way. Each of those protections runs between two devices that share the keys, and it ends at the device that decrypts the call to pass it on. End-to-end encryption needs compatible equipment or software at both ends, and an ordinary call to a phone number doesn't arrange that.","url":"https://www.answerstack.io/q/is-pstn-secure-and-can-pstn-calls-be-encrypted","upvoteCount":0,"datePublished":"2026-07-11T16:01:27.137","dateModified":"2026-09-14T00:00:00","citation":[{"@type":"CreativeWork","name":"47 U.S. Code § 1002 - Assistance capability requirements","url":"https://www.law.cornell.edu/uscode/text/47/1002"},{"@type":"CreativeWork","name":"Communications Assistance for Law Enforcement Act and Broadband Access and Services, 70 FR 59664 (Oct. 13, 2005)","url":"https://www.govinfo.gov/content/pkg/FR-2005-10-13/pdf/05-20606.pdf"},{"@type":"CreativeWork","name":"ITU-T G.711: Pulse code modulation (PCM) of voice frequencies","url":"https://www.itu.int/rec/T-REC-G.711-198811-I/en"},{"@type":"CreativeWork","name":"ITU-T Recommendation Q.700: Introduction to CCITT Signalling System No. 7","url":"https://www.itu.int/rec/T-REC-Q.700-199303-I/en"},{"@type":"CreativeWork","name":"RFC 3711: The Secure Real-time Transport Protocol (SRTP)","url":"https://datatracker.ietf.org/doc/html/rfc3711"},{"@type":"CreativeWork","name":"ITU-T Recommendation H.248.1: Gateway control protocol, Version 3","url":"https://www.itu.int/rec/T-REC-H.248.1/en"},{"@type":"CreativeWork","name":"47 CFR Part 64, Subpart HH: Caller ID Authentication","url":"https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-HH"},{"@type":"CreativeWork","name":"Mobile Communications Best Practice Guidance (TLP:CLEAR, December 18, 2024)","url":"https://www.cisa.gov/sites/default/files/2024-12/guidance-mobile-communications-best-practices.pdf"},{"@type":"CreativeWork","name":"EFF to FCC: SS7 is Vulnerable, and Telecoms Must Acknowledge That","url":"https://www.eff.org/deeplinks/2024/07/eff-fcc-ss7-vulnerable-and-telecoms-must-acknowledge"},{"@type":"CreativeWork","name":"Manage end-to-end encryption for Microsoft Teams meetings and one-to-one calls","url":"https://learn.microsoft.com/en-us/microsoftteams/teams-end-to-end-encryption"},{"@type":"CreativeWork","name":"Telephone tapping","url":"https://en.wikipedia.org/wiki/Telephone_tapping"},{"@type":"CreativeWork","name":"STU-III","url":"https://en.wikipedia.org/wiki/STU-III"},{"@type":"CreativeWork","name":"Secure Terminal Equipment","url":"https://en.wikipedia.org/wiki/Secure_Terminal_Equipment"},{"@type":"CreativeWork","name":"Scrambler","url":"https://en.wikipedia.org/wiki/Scrambler"},{"@type":"CreativeWork","name":"STU-III: Third generation secure telephone unit","url":"https://www.cryptomuseum.com/crypto/usa/stu3/index.htm"}]}}}