3. Communications are encrypted from end to end.

BlackBerry and Sidekick users may have heard that their communications are encrypted "end to end," but e-mail and other communications are encrypted only from the phone to the phone company or service provider's servers. Beyond that point, e-mail, instant messages, and file transfers may be transmitted unencrypted over the public Internet by default.

This is less of a concern for closed organizations where everyone involved uses the same services, but vendors, partners, consultants, and others outside the organization often use their own e-mail addresses and smart phones on other carriers. There's no guarantee of message encryption in these cases, and the risk is no better or worse than any other Internet e-mail.

4. The connection's secure unless I use Wi-Fi in a cafe.

Some might be concerned about the cellular connection itself. The GPRS and EDGE data protocols used by T-Mobile and Cingular are based on GSM, and GSM authentication algorithms such as A5 have been broken in ways that allow a motivated eavesdropper to reconstruct voice and data conversations with only a few thousand dollars of equipment. CDMA and associated algorithms are mildly more secure (PDF format ), but many carriers choose not to implement all of the security controls available because of performance and handset compatibility.

Using a VPN can mitigate this problem for sensitive data, and make sure essential services are encrypted at the application level using SSL or similar protocols. While it might seem redundant, using a voice over IP client through a smart phone's VPN data connection is one way to ensure that voice calls are private. Direct SIP-compliant VoIP clients are best for this; closed-protocol solutions such as Skype Mobile may try to route across a public connection even if a VPN is available. It also may relay connections between NAT 'ed endpoints through random clients on the Internet, so it's not a good candidate in this scenario.

It's also worth noting that "VoIP with AEC," one of the features of Windows Mobile 5, is not encryption. AEC refers to "Acoustic Echo Canceling," not the NIST Advanced Encryption Standard ("AES ") described in FIPS 197.