# The most secured, completely untraceable mobile phones in the world

I'm writing a story about a company similar to Google, i.e. which wants to know everything about everyone and which wants to trace everything that is traceable out there. But which, at the same time, wants to secure their key, top-management workers (CEO, CFO, CTO etc.) from being traceable by all, including own company.

The key requirement: next to being most secured and untraceable, this phone must also be as flexible and operational and possible and thus usage of public infrastructure and solutions is a must. Complete separation from public industry (i.e. own transmission network) is out of discussion due to:

• costs,
• inability or high cost of hiding such network from others and
• lack of flexibility -- inability to cover the entire world (as public GSM network currently covers it).

This requirement could span one of two areas:

1. Make such phone completely untraceable to other 3rd parties.
2. Make it traceable by others but use some special solution to transmit sensitive data and only hide this data from others.

So far I have come with only one idea. Very limited one. And only for the second area above.

Since this company is worldwide and very influential in IT business, being part of steering committees in many projects, technology solutions, protocols etc., it could possibly "include" (technical details not important at this level) some garbage in one of GSM or Internet transmission protocols, convincing others that this garbage is necessary, but easy to be filtered out. Regular phones would actually filter out this garbage while "these" phones would use it to encode and transmit sensitive data hidden in this "noise". Something a bit similar to using steganography for hiding sensitive data in images etc.

Are there any other options that I do have do consider? Can I achieve area one (i.e. making phone completely not traceable while still using the public network) using today's or very-near-future technology?

• What do you define as "tracked" and what sort of caveats are there. A phone that is turned off is very hard to track =) Also, does it count as "tracked" if someone tracked the ID of the phone, but nobody has the information required to determine who that ID is associated with? What sort of Quality of Service do your CEOs need? The more service they need, the harder to do it invisibly. – Cort Ammon Apr 3 '17 at 23:19
• Is a satellite-based system suitable? I suspect it might be harder to track an Iridium (f.ex) phone than a terrestrial phone... – Shalvenay Apr 3 '17 at 23:22
• @CortAmmon This question relies on high-level description of a problem, without going to deep into technical details, because right now I'm looking for just a good idea. At this level I can answer you: "not tracked in the way as Google currently tracks me and my phone, knowing my GPS position, a way too much things about me and my mobile behavior". I would compare this to paying with credit card versus paying with cash. How much can you track nowaday about first person versus how much about second one. I'd like user of this phone to be able to talk, transmit text messages and data. – trejder Apr 4 '17 at 10:18
• @Shalvenay Sounds like a great idea. Care to further investigate it in a form of some answer? – trejder Apr 4 '17 at 10:19
• @trejder -- it is harder to track a user in a satphone system, but not nearly as impossible as I first thought (you can use Doppler techniques similar to LEOSAR or Transit) – Shalvenay Apr 4 '17 at 11:40

Satellite phones are clearly the answer; these days they don't need a huge bulky antenna, and if you handwave technological advancement a bit you could say that these high-level executives have special sat-capable phones that look like normal cell phones in a bulky case.

Then, your company just needs a few satellites in orbit - either they put them up there (which is within the means of large tech companies) or someone sells the service. Add standard encryption security measures and VOIP gateways, and you've got something that works more or less like a regular cell phone except it can't be traced with any real degree of precision.

The best a third party with control of the network can do is figure out which satellite your phone is connected to. However, each satellite can receive from a huge area (think all of Europe), so that's not very helpful.

Of course, if there are people looking for you on the ground (or in the air), they can look for the signal your phone is sending. That's unavoidable if you want to send any kind of signal, though.

• Actually most communication satellites use spot beams, which would allow a network operator to narrow down your position. Not as accurately as a cell in a mobile network, but still much more granular than 'all of Europe'. They could definitely determine which country you were in. – wolfcastle Apr 3 '17 at 17:04
• @wolfcastle -- that's only for geostationary sats -- LEO birds don't spot beam because they are moving too fast to accurately point spot beams – Shalvenay Apr 3 '17 at 23:24
• @shalvenay - true, but for LEOs then you could track based on the gateway that handles the traffic which is probably more accurate than a spot beam location in a GEO network. – wolfcastle Apr 3 '17 at 23:46
• @wolfcastle -- not if the system is doing sat-to-sat links...(which is a tech that's in use with the existing Iridium constellation, which has all of 3 operational gateways documented ATM but at one point had 11 to deal with compliance issues), although I eat my words on LEOs not spot beaming as Iridium birds actually do spot beam on the ground-to-space links... – Shalvenay Apr 3 '17 at 23:55
• If it's your own satellite all one needs to pinpoint a user down to the nearest inch is to triangulate the weird frequency that nobody else seem to be using - plain old analog radio triangulation. If you use a common frequency then it won't work if your system does no cooperate as part of another system which rules out your own satellite. – slebetman Apr 4 '17 at 14:50

First, please read any of the RFC documents. These are open to general public, so you can. For example, 739 seems a good example. Nothing is left unexplained. Most people will not understand it, all right, but technical staff will read documentation and see what's there.

Data = money. If you want to convince other parties to increase data usage, keep in mind you are convincing them to lose money, to make their service work in a poorer, slower way. Overhead introduced must serve a really, really solid purpose, that ultimately leads to increased earnings. Increased overhead decreases earnings.

# Two parts of your question

## Making phone untraceable

This is, by its very nature, impossible. If you can't locate BTS that's closest to the phone, you can't call that phone. So a big no if using regular phone network. This literally have to be done.

Own set of BTS is costly, and still phone needs to broadcast some kind of identification code to pick up base stations in reach, or BTS needs to broadcast - and phone will answer. Even with encryption, and public keys broadcasted, it'll be easy to pinpoint a phone, and a matter of time to identify which one is it. Call your opponent and see increased radio transmissions?

For satellite phones it might be easier, but you would need directional antenna, so it wouldn't be simple "pick up the phone". Someone would need to set up na antenna, target it at satellite with directional transmission. Closest to untraceable, but not good enough. You will need more sensitive receiver to pick up transmission from the side, but then you'll be pretty sure what it's directed at. Dedicated team would be able to do this.

## Untraceable data

It's a tiny bit simpler. Heavily encrypted VPN with pseudo-rendom keep-alive traffic. We have it now. Anyone would be able to see your phone is transmitting, and trace that transmission to company's server1. But it is hard to know what's in this transmission, and obfuscating times of actual data transfer is well within our reach even now.

Of course, no phone calls. Only VoIP,

1 Or any other VPN or routing service. Just remember that exit nodes of Tor can be provided by anyone... including ones that wants to sniff you, as shown by Silk Road case. So don't trust onion routing too much.

• 1 Tor and VPNs are two completely different things, and don't even attempt to solve the same problem. Tor aims to provide anonymity; VPNs aim to provide confidentiality in some threat models. If you want to use Tor while retaining traffic confidentiality, you must encrypt the base traffic, e.g. by using HTTPS; as stated, anyone can provide a Tor exit node and sniff your traffic otherwise, but won't know it's you. A VPN simply shifts the trust point from the ISP to the VPN provider, which can be beneficial if the ISP or the LAN is untrusted (open wireless network at a café, for example). – a CVn Apr 3 '17 at 9:20
• Re: satellite phones -- LEO satellite ground stations can and do use omnidirectional antennae (I believe most Iridium etal phones use an omni antenna, even, as pointing would be impractical for a mobile ground station with sats whizzing over head like crazy) – Shalvenay Apr 3 '17 at 23:23
• Surely VoIP through a popular VPN service that has no logs and aggregates traffic would make it impossible to trace a call, no? Who ever tries will just get stuck at the VPN entry point and has no idea who you're calling... – wleightond Apr 4 '17 at 16:38
• @wleightond - packet sniffer on compromised entry point. – JohnP Apr 5 '17 at 1:29
• @wleightond it's only as secure as the VPN company makes it. So from a point of view of a company, like in this question, it makes sense to provide your own. Of course, security is not about making unauthorized access impossible. It's about making it too expensive. – Mołot Apr 5 '17 at 5:06

As other answers point out, the 1st area is not reachable. Every phone must transmit radio waves, and it must identify itself to the network to receive calls/traffic. If your special phone doesn't do it, it can't function within the network. Cloning the phones of the normal people isn't reliable (they will receive your calls sometimes), and in the end, traceable.

You could get somewhere near the 2nd area, however. With cooperation of the entire industry and government, a side channel can be built into the network that would use onion routing to throw traffic of some select phones randomly across the whole network, hiding the original phone.

It requires cooperation of another parties, however, as otherwise your side channel won't be kept in the system, and you can even be punished for being sneaky. And such cooperation is unlikely:

• Your competitors don't care that much about being traced, but care a lot about making money, and cutting the side channel makes the whole system cheaper.
• The very top brass of the government won't use the cell phone networks, they have dedicated satellite communication instead. And they actually want to trace everyone else, including your company execs.

Also, ordinary people will complain about the side channel consuming their batteries.

This is actually a solved problem. As most of the other answers have pointed out, you can't really make a phone untraceable, as it needs to uniquely identify itself to connect to the network(s) that make it usable. It is possible to spoof or clone the unique identifiers on the phone, but the standard solution to this problem is to make it so that the phone can't be linked to the person using it. For most people, this means "burner phones". Cheap, disposable pay-as-you go phones bought with cash and thrown away after a short period of use.

With the resources available to wealthy CEO, rather than buying cheap flip phones to use as burners, you'd be able to buy smartphones with security-centric OSes, but the principle is the same. You can't make the phone untraceable, so you prevent it being attributed to the person using it, who is really the target of the tracking in the first place.

• Burner phones won't work in a track everything society. They have to be bought, which in a cashless society (which would be my personal first step in creating a trackable society) where everything is monitored ala big brother, burners become nearly impossible to source, and certainly not in the numbers a large corp would need. – JohnP Apr 5 '17 at 1:34

Untraceability is basically impossible

Make such phone completely untraceable to other 3rd parties.

This is playing against you here, because as the top executives of a top company you are on the watch list of all the biggest adversaries; unlike Joe Random.

That is, we are talking about protecting yourself from the CIA, NSA, MI6, the Kremlin, ... every single secret service in the world. You must assume that every single operator you are interacting with is being tapped.

Even using your own access to the network (via satellites) does not protect you from detection; waves can be intercepted and used to locate you. And secret services have the means to.

Hiding in Plain Sight, however, is within reach

Make it traceable by others but use some special solution to transmit sensitive data and only hide this data from others.

This is I think within reach.

• Android,
• Chrome,
• Gmail,
• ...

Every single smart-phone owner sends and receives data from a nearby Google data-center. And these applications use custom protocols to communicate, over encrypted channels.

There's nothing easier than hiding a hidden functionality, tied to your phone, that allows you to use those same channels for increased communication.

Hiding phone/video calls is a bit more complicated: the download patterns are easily hidden in a Youtube connection, but the upload patterns require something new... so people may realize you are uploading data (thus communicating), but you are communicating with only Google (you) knows.

Yes, making a phone like this is possible - with cooperation with other big companies, data that your imaginary Google already collects, and some additional hardware.

There are two main factors that make up "phone identity" - phone IMEI and SIM card data, and both of them form an "identity". For example, if you use different SIMs in one phone, they are linked in your cell provider's database. If anybody at the cell provider is even going to care about your shenanigans, this is the data they would use to try to determine what the hell you are.

Now, with IMSI catching, you can impersonate cell base stations and intercept other phones, and then steal identities. Say, you're a fake base station that 5 other phones have connected to. Now you have 5 "phone identities" to choose from, and whenever the real phone's owner wants to use the services, you simply relay his requests to the real base station.

That is one thing. Once you have a database of identities, feel free to use them almost anywhere! You just need to figure out the ones that have unlimited data plans. Then, you can disguise your phones as "cheap Chinese phones". Why? There are things that modern cell providers already don't care about. Many of cheap Chinese phones have duplicate IMEIs. From what I know from local phone black market, many cell phone providers have learned to just live with this and accept those phones into their networks - customer satisfaction.

Now, this all needs technical know-how and highly educated people. No problem - you're a large company, you can ask another large company to do it for you. If they ask, you can say you need this as part of a contract for a three-letter agency. In fact, you can say it's a private contract, and if they want to dig deeper, make it look like a cleverly hidden three-letter agency contract.

What about the "unknown parts" of GSM chips that you can't take a look inside? Just buy a company which makes GSM chips, then ask their engineers if they could implement a backdoor. They'll either 1) refuse (that means there's none, and those aren't the people you want to work with) 2) start working on it (there's none, and you "lose interest and scrap the backdoor project") 3) they tell you about one (there is one, and you can tell them to scrap it) This is so you don't have to ask directly, but you still get an honest answer).

Disclaimer: I'm working on a phone which, among other features, is designed to be as untraceable as possible while using technology that even hobbyists have available - avoiding data collection by both cell carriers and technology companies, as well as fake base stations and GSM jamming.

• Great answer, but how do you receive calls with your spoofed IMEI and SIM data? – Segfault Apr 3 '17 at 19:31
• @Segfault The solution to that is pagers. You never receive a call on one of these phones, you receive a page. Pagers are already 1-way, so they have to broadcast pages to every tower in your area (pagers are often limited to a small geographic area for this reason). Once you get the call, you boot up your spoofed phone and make the call. If two people need to call each other, one uses a burner SIM to send a page to the other, and then switch to a second SIM. The page would contain the phone number of the second SIM, encrypted. – Cort Ammon Apr 4 '17 at 16:53

Everything is traceable. Something just take longer time to trace. SO your mobile phone (or just call it internet machine) would need to cloud itself into own net before sending data.
Using public services it could establish special net made of nearby wifi, setting everything with memory as a sender of partial data thus making it difficult to trace the source.

Second: why would you need to have no traceable phone? Just use any device that can send data, set a relay and order it to connects in 4 hours. And thanks to Samsung we know it's very easy to set those things to autodestruct.

What you could consider, and it's really good but it sound silly, is to send data with pigeon. Sending a bird with 1TB of data Is totally untraceable.

As other answers have pointed out, one important hurdle you need to scale is that data needs to get to your phone.

Current implementations require your phone to let nearby towers know it's there, so that data can get routed to your phone efficiently.

However, this is not necessary. You can do broadcasting, ie. sending the data to every single phone in the entire world. If the data is properly encrypted, only yours will be able to understand it.

Note that this would only be feasible for a small number of phones, since otherwise you would quickly saturate the entire network, but you did say it was for a few key people.

Note that you really, really need to have rock-solid encryption, because every single hacker in the world will also receive the data.

And finally, note that yes, you will need to get other companies to accept this broadcast traffic. You can probably get away with an excuse along the lines of: "let's implement this in case of global emergency, we keep the keys so no-one can use this without permission".

## Sending - no real solution

So you can receive data, but sending is another problem. Your phone will always be the single source of the transmission.

Now transmissions like these always hop over a number of stations. The best way to go is to ensure you reach a station you control ASAP. Once there you can totally cover your tracks. This means no-one can work their way back to your phone from any station between yours and the final destination. They could find your phone if they start somewhere between your phone and your station, but they'd have to know where to start looking.

• You confused some things. Sending broadcast that's meant to be meaningful for each phone in the world requires one channel all over the globe. That's doable. Sending radio waves of each call all over the globe requires enough channels to give each call it's own channel. Can't do that. Also, amount of power would increase greatly. Now you need enough power to cover what, 20 square kilometers per active call? Earth has 510 100 000 km² of land. Your solution would thus use 25505000 times more power. Ain't gonna happen. At least, it's not that simple. – Mołot Apr 3 '17 at 9:17

You could use a phone that hack other's phones, Then removes all traces after hacking.

This would therefore make actions of these CEOs recorded under the identity of somebody else. and this other identity all the time different.

This shall not be hard to imagine this kind of implementation by a big software/apps company.

We can still Note that even if we would not be able to trace who would be using this feature, and when, it would still be not so hard for a proper hacker to discover a list of phones IDs which are allowed to use this feature...

There cannot be an "untraceable" mobile phone. The carrier network must by necessity know where the phone is at all times, otherwise it won't be possible for the network to route calls to the phone... If the network doesn't know where the phone is, then when somebody tries to call that phone the network will say that the subscriber is out of the coverage area. If you want your phone to ring it means that you have to let the carrier know where you are.

However, if you are willing to relax the requirements a little, you may have better untraceability. The communication device (not a "phone") may be able to use available free Wi-Fi networks to establish encrypted communications with a VPN (virtual private network) server, and use this encrypted channel to connect to other devices; the user may then run some sort of voice-over-IP software, providing much of the functionality of a telephone. Note that while such a solution makes the communication device pretty untraceable, the problem has just been pushed upwards to the VPN/gateway server; if the nefarious adversary breaks that server they will have access to all the communications of the user(s), or at least to the associated metadata.

With our current technology, and not working with military, no, you can be traced as long as your phone is on. There might be a way around this, but I have never heard of it, and will make you a very rich person. Maybe wanted as well...

If we obay this:

as flexible and operational as possible

Transport of the data (calling, browsing, mailing etc), the network provider, will know what phone you have and probably where you are, within 50ish meters. If you use WiFi, you can be located even closer.

The data itself can be encrypted, but you will need professionals to do it right. Luckily you are from such a company, so that could work.

To give an idea how hard it is to get what you want: Unknown parts of every mobile phone. Black Phone. Whatsapp Encryption (one of your competitors). Hunted (TV show).

• you can be traced as long as the battery is in your phone – L.Dutch - Reinstate Monica Apr 3 '17 at 7:49
• Do you have a link on that? I've heard about it, but nothing seen on it. – Flummox - don't be evil SE Apr 3 '17 at 7:53
• i found this, but cannot judge wether or not it is true – Burki Apr 3 '17 at 9:21
• I guess with "your phone is on" you mean something like "your phone can send or receive data" (including calling or receiving calls)? – Paŭlo Ebermann Apr 3 '17 at 23:10
• Somewhat, but the point of when you can send and receive data is before you have unlocked your sim card. With I had found a good article on this tho. – Flummox - don't be evil SE Apr 4 '17 at 7:59

This is already a thing. Either use a crypto phone or encryption here and here.

Crypto phones are mobile telephones that provide security against eavesdropping and electronic surveillance.

The interception of telecommunications has become a major industry. Most of the world's intelligence agencies and many private organisations intercept telephone communications to obtain military, economic and political information. The price of simple mobile phone surveillance devices has become so low that many individuals can afford to use them.1 Advances in technology have made it difficult to determine who is intercepting and recording private communications.

Crypto phones can protect calls from interception by using algorithms to encrypt the signals. The phones have a cryptographic chip that handles encryption and decryption. Two algorithms are programmed into the chip: A key-exchange algorithm for the key agreement protocol and a symmetric-key algorithm for voice encryption.

Basically this is real-world technology. For a high-level IT company implementing the right sort of phone technology and encryption should be child's play.

• A crypto phone only prevents eavesdropping (by encryption). The usage of the phone itself can be detected, and the location of the user can be traced. Moreover, the encrypted traffic can be detected by the eavesdropper, and that will make the cryptophone user stand out in the mass of normal phones. – avek Apr 3 '17 at 7:51

### Possible: Skype over Tor

It depends if you are willing to differentiate 'untraceable' from 'undetectable', because if you are using GSM (or similar) the handset will be detected.

So, if you want to be able to make a call that cannot be traced, and you are happy enough to use mobile internet (eg Skype) as the medium of communications, then you can make your calls untraceable by implementing over Tor.

VOIP won't work with Tor, because VOIP depends upon UDP packets, whereas Tor only supports TCP packets. (UDP tunneling would suffer from latency issues).

Unlike VOIP, Skype has a fallback option when UDP is blocked, and it's very good at handling network/bandwidth issues, which is fortunate because Tor has an inherent latency issue.

So don't try video. But audio Skype over Tor is tried and tested. Using today's technology, that's probably the best option you will get.

The problem with vanilla Skype is that it is probably CALEA compliant. However, your company is 'like Google', so it should be totally plausible for the company to develop a 'stealth' secure non CALEA derivative of 'Skype' (or a less tech. dependent version of Hangouts for that matter).

• yes, afaik it is CALEA compliant. It uses a quasi "end-to-end" encryption only between client-server nodes, not between the actual communication end points. This is the same with Hangouts btw. Perhaps this can be remedied by using a specialized software piece that hooks in between the microphone drivers and the proprietary communication software. Also, to avoid the current suggested risk of using a compromised TOR network, maybe a bot network would do? – Doomed Mind Apr 4 '17 at 15:49
• @DoomedMind Yea, but it's a given that this is some mega-software company, so they can always roll their own for the software - or add a special patch to existing software. I'm not convinced that a botnet would provide better anonymity than Tornet... If the Tornet is a private network using billions of devices, it's going to be pretty secure. – Konchog Apr 4 '17 at 15:54

It's not (currently) within our technological capabilities, but not completely out of the bounds of possibility: how about going quantum? Maybe the company has managed to integrate a mechanism for entangling and modulating the spin on the photons involved in the radio transmission?

The combination of the potential for quantum cryptography, along with the steganographic bonus of nobody even thinking of looking there might make it a good candidate. (Plus, one of the bonuses of using entanglement and spin is that if someone did look, the person sending the signal would know that the transmission had been intercepted!)

Being only a layman i may be completely wrong, but:

In order for your phone to be reachable and to use the network, it needs to call in to the nearest cell. It needs to identify itself, so calls and data can be routed. all this can and will be logged and traced.

One way to work around this would be to have a very large number of different IDs. Think of an RFA token that generates a new key every 60 seconds. You might do the same with your phone ID (basically your phone number). Now you need your service provider to handle these ID switches, which should be possible, maybe creating a little bit of lag.
A caller would dial your regular number, some tech routes the call to the current ID.

I think that would make sure your device just became a lot harder to trace. It would still be possible, if you had access to the algorithm and code for the ID switches.
It will also be partially traceable without these for longer phone calls, so long as the device you are communicating with does not use the same technology, because you "only" need to trace who the caller is connected to.
And of course if the person or agency that wants to know your current position just calls you, they will be able to trace where this call goes.

Not exactly what you are looking for, but it will at least make tracing harder.

Obviously, there is the one thing all of us can do, which is to switch off the device when we don't need it, at the price of not being reachable. Which need not always be a bad thing...

• phone ID = IMEI. Just so you know. – Mołot Apr 3 '17 at 8:09
• @Mołot: also IMSI. – avek Apr 3 '17 at 8:21
• @avek Kinda - IMSI is an ID of a sim card, not a phone. @ anyone interested, here is pretty good entry level article: rfwireless-world.com/Terminology/IMEI-vs-IMSI-vs-TMSI.html – Mołot Apr 3 '17 at 8:24
• @Mołot: the OP asks about tracing people, IMSI surely is as relevant as IMEI here. You can change your phone device, but you need your SIM so other people can reach you at the same number. – avek Apr 3 '17 at 8:41
• @avek I'm not saying it's irrelevant. It is relevant all right. Just wanted to make things precise and clear. – Mołot Apr 3 '17 at 8:53

## The crux is bandwidth availability

Where bandwidth is modestly plentiful, there's no worries anonymizing data, for instance WiFi.

However, where bandwidth is expensive and/or needs to be throttled to protect all users (e.g. the cellular data networks), the usual gating protocol is paying for it, which means your network connection will not have anonymity. If the FBI wants your cell phone, they'll subpoena all the major carriers, one will say "Joe Dissident is our customer, he's at Main and Market right now". That's a big damn problem.

## But then you Tor everything

However, they'd have no earthly idea what Joe Dissident is browsing or doing, because every device on earth would run a Tor-like protocol which would anonymize everything deeply.

## Or maybe not quite everything.

OK, so sites already get revenue by placing ads. What if data providers did too? Suppose websites which place ads are required to give 20% of their ad space to ads by the data provider. The website says "Give this ad to the ISP" e.g. by rewriting an ad space as adprotocol://ad?size=200x600&flash=no&html5=yes. And this is a new protocol that's by design stateless; it doesn't pass Referer and doesn't allow storage of persistent data.

That protocol is intended by the first router (WiFi node etc.) Which answers that ad request. It knows nothing about Joe or what site he's browsing. But it does know where you are physically. It also knows the time. It's 11:30 - bet you're getting hungry! Here is a local restaurant with a \$5 pizza special.

Why this huge digression into even more damn ads? Because the ads would pay for bandwidth. Which means there'd be more WiFi type bandwidth, and it may even pay for cellular data bandwidth, which would allow cell phones to be anonymous. The cell company gives service to any anonymous comer who accepts some ads, and the phone randomizes its ESN whenever it's idle, so nobody can track patterns of use.

All of the requisite pieces for this already exist. What you need:

• End-to-end encryption
• VPN service with aggregation and no logs
• VoIP client using data on the phones

So, the data is carried over the existing network, but can't be read because it's encrypted. When you as the CEO call the CFO, your call goes to the VPN servers, then waits a random number of milliseconds there to mask what data is yours, and pops out through another one of their nodes and connects to the CFO's phone, so if they're trying to trace the call from the CFO's side they get stuck at the VPN, and likewise from your side. While it is true that with sufficient control over infrastructure one could potentially match data from your phone going to his by timing, if you're not nearby it's very hard to do, especially if you're in a different country.

In short, Blackphone + www.privateinternetaccess.com.

Really you should just do your own research. You're getting some good information and some bad information here. Example:

"Satellite phones are clearly the answer; these days they don't need a huge bulky antenna, and if you handwave technological advancement a bit you could say that these high-level executives have special sat-capable phones that look like normal cell phones in a bulky case."

As someone who procured and set up satellite phones in the 1990s for civilian use, I can tell you that "like normal cell phones in a bulky case" is EXACTLY what they looked like, in the 1990s. No handwaving required.

You want untraceable? Forward your call through a denied area like North Korea. Or use TOR to access one of the phone services for the deaf. Problem solved.

If you wanna pick up phone - you can't be completely untraceable by definition. Since network needs to know where incoming call would go.
However if you wanna call - you can "turn on" your phone and it will choose "random" or "new" identity, add to your phone 100 credit. And you can call. Every minute someone buy new phone with new identity so this way it is untraceable.

After you activate your phone, you can go to some "public" but encrypted site, where you store your number and only other CEOs can use that. There you can also "pick up" today numbers for other CEOs.