Making it possible for law enforcement to tap VoIP calls will open Internet security holes that could endanger corporate voice and data traffic, according to a report by a group of respected Internet figures.

With the federal wiretapping law scheduled to apply to providers of VoIP next May 14, now is the time for businesses to evaluate whether to take steps to counter the risks it represents, the experts say.

The report, "Security Implications of Applying the Communications Assistance to Law Enforcement Act to Voice over IP," calls CALEA wiretapping "an architected security breach" that could be exploited by unauthorized parties.

Given the difficulty of isolating voice packets among data packets mixed in a stream, even legitimate use of wiretaps will inevitably result in capturing more than just the phone calls authorized by CALEA court orders, says David Endler, a director of the Voice Over IP Security Alliance, an industry association focused on developing VoIP security standards. "How would you limit it to voice? This apparatus would have to capture everything," he says.

With businesses embracing converged networks that carry voice and data, this puts more than phone calls at risk - instant messaging, e-mail and any corporate transactions made over the Internet could be captured, the report says.