Is PSTN secure, and can PSTN calls be encrypted?

The PSTN carries a phone call as an open, unencrypted signal, which is the root reason it is considered insecure, because nothing in the network scrambles the audio and anyone who can reach the call can listen to it.[1][12] When the network digitizes voice for its core it uses pulse code modulation as defined in ITU-T Recommendation G.711, and that standard describes only how to sample and encode speech, not how to protect it, so a digital PSTN call is a stream of numbers that anyone with access can play back as sound.[2] Security was never a design goal for the telephone network. It grew up as a system run by trusted carriers whose staff needed to reach lines to maintain and connect them, and lawful interception was later built directly into the switches rather than added on afterward.[1][6]

Three consequences follow. The confidentiality of a normal call depends entirely on physical and operational trust in the carrier, because the signal gives nothing away for free. The places where a call can be reached, the subscriber line, the exchange, and the signaling network, sit outside a caller's control, so an ordinary user cannot inspect or harden them. Adding real confidentiality means changing the endpoints, since the network in the middle forwards whatever it is handed without adding or expecting encryption.[9]

This is different from how internet traffic has come to work, where encryption increasingly travels with the data by default. On the PSTN the data and the protection are separate concerns, and the network supplies only the transport. That design made the telephone system open and easy to interconnect across operators and countries, and those same properties are why a call is straightforward to intercept for anyone positioned on its path.[1]

The oldest and most direct attack is a physical tap on the line that runs to a phone, because that copper pair carries the conversation as an open signal all the way to the exchange.[1] The word wiretap comes from exactly this method, an electrical connection onto an analog telephone line that carried the audio off to a recorder.[1] The vulnerable stretch is the local loop, the wiring from a building back to the telephone exchange, and it can be reached at the premises, at a junction box, or out at a street cabinet. Because the signal is not encrypted, no code has to be broken once the wires are reached, and the tap simply listens.[1] For most of the network's history this was the practical limit on eavesdropping, since it required someone to be physically present on the line, which is also why it left behind the effort and evidence that later switch-based methods removed.

Once telephone exchanges became computerized, tapping a line stopped requiring any physical presence on the wire, because the switch itself can copy a call.[1] At a digital exchange the switching computer duplicates the digitized bits that represent a conversation and sends the copy to a second line, and there is no way for the subscriber to tell that it is happening.[1] Interception can be set up remotely by the carrier rather than by a technician standing at a distribution frame, which makes it faster, cleaner, and undetectable from the subscriber's side.[1] This is the point where the network's lack of encryption matters most, because the call is being handled as plain, readable data at the exact moment the switch is best positioned to copy it. Whatever protection the call has now rests on the carrier's controls over who can activate that copy and under what authority.

In the United States and many other countries, the ability to intercept a call is a required feature of the network rather than a weakness someone has to find. The Communications Assistance for Law Enforcement Act, signed into law in 1994, requires telecommunications carriers to design their equipment and facilities so that law enforcement can carry out authorized wiretaps.[6] A carrier served with a lawful order has to be able to isolate a target's communications and hand them to the agency named in the order, and in 2005 the same obligation was extended to broadband internet access and interconnected VoIP services.[6] The practical meaning for confidentiality is that every compliant switch already contains a working interception function that can be turned on for a given line.[6] Whether that capability is used only under proper authorization depends on legal and operational controls rather than on anything technical in the call, since the call offers no encryption to stand in the way.[1]

Signaling System No. 7 is the control network that sets up, routes, and tears down calls between operators, and it carries little authentication of its own because it was built on the assumption that every network connected to it could be trusted.[3] That trust is the vulnerability. A party who gains access to the SS7 network, whether a small carrier, a leased connection, or an intruder, can send signaling messages that redirect calls and texts or ask the network where a subscriber's phone is.[4] Security researchers demonstrated location tracking through SS7 as early as 2008, and by 2014 the same techniques could follow a phone almost anywhere with a high success rate, while a 2017 case saw attackers reroute two-factor authentication texts to drain bank accounts.[4] These weaknesses are not just theoretical for US networks. A senior official at the Cybersecurity and Infrastructure Security Agency told the Federal Communications Commission in 2024 that attackers had exploited SS7 and the related Diameter protocol to track people in the United States and to intercept their calls and messages.[5] Because SS7 sits underneath the call, these attacks work without any access to the subscriber's line or handset.

Yes, but the encryption has to be added at the two endpoints, because the PSTN itself will not encrypt a call and does not expect one to be encrypted.[9][12] The network's job is to carry whatever audio it is handed from one end to the other, so any confidentiality has to be created before the signal enters the network and undone only after it leaves.[9] In practice that means both parties need matching equipment that turns speech into an encrypted signal the line can carry, then converts it back at the far end.[9] A single secured phone is of no use on its own, since a normal handset on the other end has no way to decrypt anything, which is why secure telephones fall back to ordinary, unprotected calls whenever the far side cannot go secure.[7] The methods that achieve this range from dedicated government terminals and commercial scrambling devices to carrying the call over an encrypted internet path instead of the circuit-switched network.

The most established way to hold a protected conversation over ordinary phone lines is a matched pair of secure telephones, and the reference example is the STU-III family the NSA introduced in 1987 for the US government, its contractors, and its allies.[7] An STU-III works like a normal phone for regular calls, but when both ends have a compatible unit the users press a button and, after a short setup delay, the call switches into an encrypted mode able to protect conversations up to Top Secret.[7] The encryption depends on a removable crypto ignition key, so a unit without its key cannot send or receive classified audio.[7] The STU-III has since been retired in favor of Secure Terminal Equipment, a digital successor that runs over ISDN lines and takes a removable crypto card such as the Fortezza Plus or KSV-21, with newer sets interoperating through the Secure Communications Interoperability Protocol.[8] The common thread is that the protection is a property of the terminals at each end, not of the line between them, which is exactly why the same handsets keep working as ordinary phones when a secure link is not available.[7]

Analog scramblers alter the sound of a voice on the line so a casual listener hears noise instead of speech, and they were the earliest attempt at telephone privacy, but the simple ones provide very little real protection.[10] The most basic method, frequency inversion with a fixed setting, offers no meaningful security at all, because software is readily available that reverses it and restores the original voice.[10] Scramblers were used for voice traffic during the Second World War and were often intercepted and decoded, a track record that reflects the weakness of rearranging an analog signal rather than encrypting it.[9] What is sold today under the same name is usually different in kind, a device that digitizes the voice and applies real encryption, often with public-key methods, which is far stronger than the analog inverters it replaced.[10] For anyone weighing a scrambler, the distinction that matters is whether the box performs genuine digital encryption or merely shuffles the audio, since only the former resists a determined listener.

The modern answer to securing a call is to stop sending it as open audio over the circuit-switched network and instead carry it as encrypted data over an IP connection.[11][12] On an IP path the media can be protected by the Secure Real-time Transport Protocol, SRTP, which adds confidentiality, message authentication, and replay protection to the voice stream, while the call setup is protected separately by Transport Layer Security.[11] A call that never leaves an encrypted IP service can be private from end to end, whereas the moment it crosses a gateway onto the traditional PSTN it becomes ordinary unencrypted voice again.[12] The practical implication is that a mixed call is only as protected as its weakest leg: an app-to-app or Teams-to-Teams call may be encrypted throughout, but as soon as one party is on a normal phone number reached over the PSTN, that portion of the path is in the clear.[12] As carriers retire the circuit-switched network and move voice onto IP, encryption becomes possible on segments that never had it, though it still has to be switched on and supported at both ends rather than assumed.[11]

The PSTN's openness is inseparable from the qualities that made it useful, and naming the trade-offs explains why it stayed in service and how to think about protecting calls on it.

Interoperability came at the cost of confidentiality

The telephone network connects equipment from countless operators and countries precisely because it makes no assumptions about encryption, so any two phones can complete a call.[1] That universality is also why a call is readable at so many points, and there is no setting a subscriber can change to close the gap from their end alone.[9]

Endpoint encryption adds friction

Because protection has to live in matched endpoints, both parties need compatible equipment, which historically limited strong secure voice to organizations that could issue the same terminals to everyone who needed them.[7][9] A secured device offers nothing when the other end cannot match it, and it quietly reverts to an ordinary call in that case.[7]

Migration to IP changes the picture but not automatically

Carrying voice over IP makes encryption technically available, yet it is not on by default across every path, and a call that touches a PSTN number for even one leg is unprotected on that leg.[12] The safe working assumption is that a call is unencrypted unless you know that both ends and every segment support it and have it enabled.[11]

A few common assumptions about telephone privacy do not hold, and separating them prevents a false sense of security.

A private line is not an encrypted line

A dedicated or leased line keeps a call off shared switching, but it does not encrypt the audio, so anyone who reaches the physical circuit can still listen.[1] Privacy of routing is not the same as confidentiality of content.

The digital core does not mean the call is protected

Most of the PSTN core has been digital for decades, and people sometimes read digital as secure, but the digitization defined in G.711 is only an encoding of the sound, with no encryption attached.[2] A digital call is a stream of numbers that reconstructs the voice for anyone who captures it.

Caller ID is not authentication

The number shown on an incoming call is signaling information, not proof of who is calling, and the same signaling layer that carries it has been abused to spoof numbers and redirect calls.[4] Trusting a call because of the number it displays is a separate risk from eavesdropping.

Retiring the PSTN does not by itself add encryption

Moving to IP makes encryption possible, but it does not guarantee it, and a modern IP call still travels unprotected whenever it crosses onto a traditional phone number or a segment where encryption was never enabled.[12]