That's wild that you wouldn't see who was connected on a VoIP conference call! That seems like an *extremely* plausible explanation.

In any event, I can only go off of my own experience. I used to work for a world-wide company and often needed to conduct business between offices in different countries by setting up conference calls. Doing so would provide me with an e-mail in the exact same format as the one for the recorded meeting from MD.

Even as the host there was really no indication of who was connected, though you could sometimes tell by small sounds on the line. Muting a phone before connecting to the meeting would dramatically reduce any such indicating noise. I'm not at all well-read on the technology or software packages used in business conference calls, so my situation could have very well been an odd one.

Oh, my bad about the server -- you're right, the "attack" was from Sweden, and the transcript didn't say it was an SSH server.

Thanks for the corrections!

I don't get why people come up with these elaborate ways in which the phone call was recorded and then MD-D got the recording???

The note that was distributed with the phone conversation indicated the MD-D had been monitoring MD's phone systems for the past 9 months. While this doesn't give a clear indication of how, it certainly suggests that MD-D was in control rather than got lucky.

What would make sense, since they had access to the e-mail, would be that MD-D simply dialed into the phone conference and pushed record (probably as well as 'mute'). Keep it simple, stupid.

Anyway, the phone conversation doesn't say that the server was in Sweden, but the IP address that tried to log in was from Sweden. It also doesn't say what type of server it was, where did you get that it's an SSH server?