Disclosed herein is a method and apparatus for detecting surveillance devices on a telephone line and deployment of countermeasures therefor. The apparatus comprises a line monitoring circuit for evaluating whether the phone is off hook or ringing. A test generation circuit produces a test signal to be injected into a line and issues test commands. A signal response analysis circuit compares a test signal response to a baseline signal response and reports an anomaly when the difference between a test signal response and a baseline signal response exceeds a threshold. Additionally, an anomaly may be reported when an unusual signal is detected, such as a clock. A detection management circuit issues countermeasures to the anomaly based on programmed responses.