Thought: it would be possible to make the phone reasonably secure by having one of the SS agents (who are always around him) carry a secured WiFi access point,

Thought: it would be possible to make the phone reasonably secure by having one of the SS agents (who are always around him) carry a secured WiFi access point, which the phone connects to (and it doesn't connect to anything else). Then the access point is VPN-ed and firewalled back to an endpoint that is secured, from which phone calls are then connected directly to e.g. Verizon / ATT / Level3 for termination to the dialed number. i.e. network topology is TrumpPhone <--> WifiAP <--> VPN to <--> Secured endpoint <--> telco/bandwidth . More security could be added by e.g. configuring a virtual phone number which lives "on the switch" then forwards to a securitized softphone. This would mean that the phone number attached to a physical phone would never be used; and multiple phones configured identically could be set up ahead of time, audited, upgraded, etc.