There are a number of privacy issues regarding storage of call detail records. Agencies and other organizations should review these issues with their legal advisors. US Government guidance on these issues includes the following:
• the Privacy Act of 1974.
• Office of Management and Budget “Guidance on the Privacy Act Implications of Call Detail Programs to Manage Employees’ Use of the Government’s Telecommunication System” (See FEDERAL REGISTER, 52 FR 12990, April 20, 1987).
• NARA General Records Schedule 12, which requires a 36-month retention of telephone CDR records http://www.archives.gov/records_management/ardor/grs12.html
• 21 CFR 102-172, Federal Management Regulation (FMR), Telecommunications Management Policy. 21 CFR 102-172.
Note that 21 CFR 102-172 replaces 21 CFR 101-35, Federal Property Management Regulation (FPMR), Telecommunications Management Policy, which expired in August 2001.
The construction of a VOIP network is an intricate procedure that should be studied in great detail before being attempted. New risks can be introduced, and vulnerabilities of data packet networks appear in new guises for VOIP (see Appendix A for more detailed discussion of vulnerabilities of VOIP and their relation to data network vulnerabilities). The integration of a VOIP system into an already congested or overburdened network could be catastrophic for an organization’s technology infrastructure. There is no easy “one size fits all” solution to the issues discussed in these chapters. The use of VPNs, vs. ALG-like solutions and the choice of SIP or H.323 are decisions that must be made based on the specific nature of the current network and the VOIP network to be installed.
VOIP can be done securely, but the path is not smooth. It will likely be several years before standards issues are settled and VOIP systems become a mainstream commodity. Until then, organizations must proceed cautiously, and not assume that VOIP components are just more peripherals for the local network. Above all, it is important to keep in mind the unique requirements of VOIP, acquiring the right hardware and software to meet the challenges of VOIP security.
Source: National Institute of Standards and Technology