One way or another, most phone calls these days involve the internet. Cybersecurity experts say that makes us vulnerable in ways we might not realize.

Transcript

AUDIE CORNISH, HOST:

So your smartphone - that thing you can't live without that does just about everything - well, it's vulnerable in ways that might surprise you. NPR's cybersecurity correspondent Jenna McLaughlin has more.

(SOUNDBITE OF PHONE RINGING)

JENNA MCLAUGHLIN, BYLINE: In the early 1900s, the Bell Telephone Company advertised the landline telephone as the sentinel that's always on duty.

MATTHEW PRINCE: The phone system was really built with an incredible amount of reliability and robustness. The Bell System really prided itself in making sure that you would always be able to get a dial tone.

MCLAUGHLIN: Matthew Prince is the CEO of Cloudflare, a website security company. Prince says most phone calls these days don't actually take place purely over a landline.

PRINCE: Today, many of the phone calls that you make, especially if you're using a mobile device, your voice is actually being transmitted across the same connection, the same wires, that you'd also use to run a Google search or, you know, find your funny cat photos.

MCLAUGHLIN: While it's now easy and cheap to connect phone lines over the internet, it's not exactly the most secure. Prince says criminals have recently been launching a wave of denial-of-service attacks against digital phone providers. Think of a tsunami of digital traffic, and because of all that extra garbage, normal calls can't get through. To make it stop, the bad guys demand payment.

Prince shared one ransom note. We will completely destroy your reputation, it read. Your services will remain offline until you pay.

FRED POSNER: My name is Fred Posner. I grew up loving phones. And I was born in New York City, and my parents tell stories of having to cross the street to avoid me trying to play with a payphone.

MCLAUGHLIN: When it comes to the inner workings of digital voice technology, Fred Posner knows more than just about anyone.

POSNER: So Voice over IP is a way of taking your regular phone conversation that you would normally have through a handset or even, you know, today's cell phones and then instead of using a wire that you would back in the day, we take that voice and we turn it into ones and zeros, and then on the other end is some device that changes that back into voice.

MCLAUGHLIN: Posner says audio was never meant to travel in real time over the internet. As a result, experts created special tools to make it work. It's all a bit of a trapeze act.

POSNER: Because we're digitizing voice and because of the way that voice needs to transmit over the internet, we have to do many, many tiny little packets.

MCLAUGHLIN: Packets are little bits of digitized audio. Lots of them travel together in an orderly line so you hear the other person's voice in real time without skips or breaks. Posner said that digital phone lines are vulnerable because the audio has to sound seamless. It doesn't take a lot of extra traffic to disrupt a call. These attacks, Posner adds, are a big deal in his community.

POSNER: Yes. In layman's terms, people are freaking out (laughter).

CHESTER WISNIEWSKI: Well, yeah. I mean, I'm actually calling you on the VoIP provider that's been up and down like a yo-yo for, gosh, well over a month now.

MCLAUGHLIN: Chet Wisniewski is a researcher at the security firm Sophos. He's been making phone calls over the internet for years now, ever since he moved from the U.S. to Vancouver. Wisniewski says he's been having trouble calling friends and family, even buzzing in the Amazon deliveryman to his apartment building. Small things, but it could get a lot more serious.

WISNIEWSKI: When that reliability is intentionally threatened, like we're seeing with these Voice over IP situations, I would hope it would be getting an equal amount of serious attention that we are seeing with ransomware and other types of cyberthreats because this is potentially able to disrupt people's ability to call 911 emergency lines. Literally, people can die from this.

MCLAUGHLIN: The good news is that the cybersecurity experts I spoke with said the fight to protect the phone lines is going pretty well. But they say it's smart to plan for a worst-case scenario. Companies and individuals should think about what they'd do if their phone lines go dead.

Jenna McLaughlin, NPR News, Washington.

(SOUNDBITE OF RODRIGO Y GABRIELA'S "THE RUSSIAN MESSENGER") Transcript provided by NPR, Copyright NPR.