The voice privacy of IS-95 CDMA cellular systemis analyzed in this paper. By exploiting information redundancy on the downlink
traffic channel, it is shown that an eavesdropper can recover the voice privacy mask after eavesdropping the transmission
on the downlink traffic channel for about one second. Thus, IS-95 CDMA voice privacy is vulnerable under ciphertext-only attacks.