Cell Phone Encryption/Security in The USA

From: clem (clem_at_numeral.com)
Date: 05/29/03 

Date: Thu, 29 May 2003 00:36:37 -0700

Cell phone security: Non-existent or pretty good?

This is a basic question that has me baffled after doing some googling
around the net... yeah and its probably OT, too...

I know there are dedicated expensive units from vendors like Motorola
that are designed from the onset with crypto in mind, but these are
really cost-prohibitive.

The units from Blackberry might fit the bill here too, but the
Blackberry solution is a bit proprietary... and cost prohibitive,
too. Besides, I know the e-mail is encrypted but not sure the voice
is, too.

Are there any "standard" systems (from Verizon, MCI, Cingular etc)
that offer enough encryption to thwart eavesdropping by standard
off-the-shelf equipment?

(I'm not talking about law enforcement monitoring using phone company
provided hooks on a legit wiretap. Or Govt spooks looking for
terrorist activity and using spooky techniques. No problem there.)

To be very specific, I'm mainly concerned with industrial espionage
whereby the attacker positions themselves near buildings or machine
shop locations where prototypes or other confidential items are being
developed to have a good chance of passively monitoring vendor reps
calling their people back home from cell phones with explicit
(highly-confidential) design issues/problems being discussed.

In these situations in a lab or shop area, unless they are
specifically prohibited from using cellular, and forced to use land
lines, it is customary visitors will use their own cellular devices
(that they are comfortable with, have numbers programmed into, can
walk out of hearing range of the clients, etc). And this scenario
plays into the hands of would-be attackers. Easy pickings.

As well, the static location, and the ability for the attacker to be
well within a single cell area, close to his target(s), is worrisome.

It seems like the phone security technology to thwart this is rather
trivial and is already built-in (or supposedly built-in) to different
large systems, but is it actually being implemented???

Am I worried about something that is already reasonably secure, or is
it wide open with virtually no security?

Any comments would be cool and probably enlightening.