Encryption on SAFE-T?

[kevin.r]

First of all, I am not trying to start a thread on the good and the bad of encryption of public safety radio systems. That has been discussed many many times and I don't want to revisit that now.

My question is how common is encryption on SAFE-T presently? I am asking because I heard two units switch to "secure mode" this evening just before 18:30 local on 47-BFD-OPS1. This was heard on the Bloomington tower.

I was mobile at the time and couldn't take good notes, but it appeared to be a radio tech talking to a law enforcement officer. The radio tech said he would do a ten-count with "secure mode on", and then the TG was silent for a few seconds. Then the LEO said he was able to hear the ten-count (although I did not, since it was encrypted). The radio tech then said (in the clear) that the encryption had worked properly. It appeared to me that during the conversation that the radio tech was sometimes using encryption and sometimes in the clear, but the LEO was always in the clear.

When I first heard them mention the term "secure mode" I was a bit skeptical and didn't really think they were talking about encrypted TG's on SAFE-T, but after them talking about it (in the clear) for a few minutes I have no doubt that's exactly what it was.

This is somewhat surprising to me as I thought the encryption modules (or software options in the case of some radios) were cost prohibitive, plus the added complication of key management.

So, who else is using encryption on SAFE-T other than for testing in Lawrence County?

I imagine there is a way to monitor the control channel with software to see when TG's are being used in encrypted mode, although obviously there's no way to decode the actual traffic on the TG. Does software like UniTrunker do this type of thing? It's been well over a year since I've played with it last.

I'm new to encryption when it deals with radios, so I guess I have a lot of reading to do. I didn't see a whole lot of info in the RR wiki about encryption on Motorola Type II systems other than the ID+8 TG rule. Can someone point me in the right direction for learning more?

Thanks!

Kevin

 

[DiGiTaLD]

Encryption

Does software like UniTrunker do this type of thing? It's been well over a year since I've played with it last.

Yes, Unitrunker should tell whether a call is encrypted. IIRC, the call type will show up as Dg for an encrypted P25 CAI digital voice transmission. There are a few instances where I have heard of encryption being used on SAFE-T. The ISP Government Facilities Unit (capitol police) in Indianapolis reportedly have the option to go secure if needed. Also, a while back, somebody heard some Motorola techs on one of the system wide Motorola talkgroups (either 4D, 5D, or 6D) go encrypted.

Encryption will always be an option for anybody who can afford it, but I don't think it will be widely used because of the cost prohibitiveness and the fact that it reduces interoperability between agencies if used all the time. Where I live, everybody is on SAFE-T and every agency generally monitors the surrounding agencies' traffic. If everybody was encrypted, they'd all have to spend the extra money for encryption-capability, all have to have their keys coordinated, etc., etc. It would be too costly and hard to coordinate.

I think, for right now at least, encrypted talkgroups will probably be done on an agency-by-agency basis, and only for special purposes where high security is required. I don't think we'll see normal, day-to-day operations on SAFE-T go encrypted any time soon.

 

[pickles37]

It will be interesting to see how this pans out. I know in the UK and other countries, encryption (on TETRA) is the norm for all public safety - the expectation is that just like cell phone conversations, radio communications are private. Anyone who needs a radio is then given one. Here we're coming from the opposite perspective, where the expectation is that communications are in some sense public, but once encryption is available (and affordable) I'm sure there will be a big temptation to go "private" especially for police departments

David

 

[jerk]

Some of the Tech radio do have encryption capability... I've heard it first hand.
And I know in my area a local police department says when they do switch to Safe-T they will have encryption ability. I don't know if it will be full time yet.

Lawrence county does not surprise me as they already have the use of inversion encryption. But most encryption is used for "stupid" stuff, like talking about how many times they've been to a location and that person is crazy, etc, etc.

Orange and Washington Counties sheriff's have inversion capabilities also.

AL

 

[usswood]

good thing about inversion is that it is easily decoded

 

[jerk]

good thing about inversion is that it is easily decoded

That it is... but it is still illegal for non-users of the system.

AL

 

[DiGiTaLD]

Is it inversion? I thought it would be DES encryption on top of P25 digital voice.

 

[jerk]

Is it inversion? I thought it would be DES encryption on top of P25 digital voice.

On their regular VHF frequncies,but the thread had reference to encryption on Safe-T, which I said in essence most likely because they already use inversion encryption. (on VHF)

The safe-T version is more robust :0

AL

 

[drunyon]

Hasn't DES encryption been replaced by AES?

 

[DiGiTaLD]

Today, I saw (on Unitrunker) encrypted P25 traffic on ISP-CZ-DES.

 

[drunyon]

Interesting. I'm curious where on the UniTrunker screen does it indicate encryption for the ISP-CZ-DES talkgroup?

 

[SCPD]

It does not it even states that in the instructions under P25 encrypted that it cant decode it or show it. and it looks like he has put in what he wants it to show it has that option of labeling and editing.




The program does not monitor P25 conventional channels. It does not provide the ability to decode digital voice transmissions into audio. You will need a digital P25 (or VSELP or ProVoice or whatever) capable receiver for this. There is no support for LTR, Passport or Multinet at this time. The program does not monitor encrypted control channels. It you wish to capture NAC codes found on P25 conventional channels - look for a program called the "kNACk".

There is a variation of MPT1327 found on 220 Mhz in North America that uses ACSSB modulation inside a 5khz channel. The FFSK parameters also differ from the standard narrow-FM MPT1327 mode. UniTrunker does not support this format.

Here's a summary of the kind of information that can be displayed.

Basic system information - system type, system id, talkgroups, and radio ids.
Basic site information - site or cell number, and list of channels.
Site call activity - who's talking, on what channel, and to whom.
Neighboring Site information - list adjacent cell or sites with control channels.
User roaming - what radios are registed to a particular site.
User affiliation - what talkgroup a user has requested.
Patches - a dispatcher initiated action that joins two or more talkgroups together.
The program also allows a user to define a custom band plan or fleet map.

 

[drunyon]

Guys, keep in mind the DES in the talkgroup called ISP-CZ-DES stands for "Drug Enforcement Section"...not Digital Encryption Standard. DES is the new name for what many of us remember as "Major Drug".

 

[SCPD]

Guys, keep in mind the DES in the talkgroup called ISP-CZ-DES stands for "Drug Enforcement Section"...not Digital Encryption Standard. DES is the new name for what many of us remember as "Major Drug".

Thanks for the info

 

[DiGiTaLD]

Yes, it does show encryption.

It does not it even states that in the instructions under P25 encrypted that it cant decode it or show it. and it looks like he has put in what he wants it to show it has that option of labeling and editing.

Do a little research and you'll find that people have seen Untrunker show "Dig" in the CT column when encrypted P25 digital voice is being used on Motorola systems - and that's exactly what SAFE-T is - a Motorola system. Unitrunker merely shows where the encrypted P25 voice call is, it doesn't decode the encryption. It is taking what it's seeing on the control channel and putting it on the screen, that's it.

Unitrunker does not show Dig on SAFE-T talkgroups using in-the-clear P25. It only shows it when encryption is being used. This is evidenced by the fact that the PRO-2096, even in totally open mode, will not track the ISP-CZ-DES traffic when it shows up on Unitrunker with the Dig in the CT column. That's because the 2096, like many scanners, completely ignores encrypted calls on trunked systems.

See here: http://www.radioreference.com/forums/showpost.php?p=660091&postcount=26

 

[Viper43]

Today, I saw (on Unitrunker) encrypted P25 traffic on ISP-CZ-DES.

What you see is NOT ENCRYPTION, DIG is for DIGITAL MODULATION and ANA is Analog,
Also, the 2096 has no problems following traffic on the above TG or any others on SAFET. Maybe you need a better antenna...
V

 

[Viper43]

Do a little research and you'll find that people have seen Untrunker show "Dig" in the CT column when encrypted P25 digital voice is being used on Motorola systems - and that's exactly what SAFE-T is - a Motorola system. Unitrunker merely shows where the encrypted P25 voice call is, it doesn't decode the encryption. It is taking what it's seeing on the control channel and putting it on the screen, that's it.

Unitrunker does not show Dig on SAFE-T talkgroups using in-the-clear P25. It only shows it when encryption is being used. This is evidenced by the fact that the PRO-2096, even in totally open mode, will not track the ISP-CZ-DES traffic when it shows up on Unitrunker with the Dig in the CT column. That's because the 2096, like many scanners, completely ignores encrypted calls on trunked systems.

See here: http://www.radioreference.com/forums/showpost.php?p=660091&postcount=26

Unitrunker does show ENC for encrypted traffic if it's an analog modulation. Unitrunker shows DIG for ANY Digital Modulation, encrypted or not.
And as I said before, the 2096 has NO problems following any conversations on the ISP-CZ-DES TG, I hear them and follow them daily on a 2096 and when they transmit on that TG it always comes up DIG on Unitrunker and DG on the 2096... meaning DIGITAL MODULATION. Again, try a real antenna, one outside at around 30 to 40 deet should do.
And ISP only has TWO cars with encryption capability in the Central Zone so won't hear too much encryption used.... both are out of Dist 52.

V

 

[Viper43]

Interesting. I'm curious where on the UniTrunker screen does it indicate encryption for the ISP-CZ-DES talkgroup?

It doesn't, all it shows is DIG which simply means Digital Modulation. It will show this for any digital modulation, encrypted or not. Since ISP doesn't have enough radios with encryption you won't be running into encryption much anyway.... except maybe between the two cars in the CZ that do have it....

V

 

[DiGiTaLD]

It doesn't, all it shows is DIG which simply means Digital Modulation. It will show this for any digital modulation, encrypted or not.

Not true, at least on the site I am watching. On SAFE-T, Unitrunker is only showing "Dig" when the traffic is encrypted. I further verified this by programming in the voice channel the traffic was coming across in conventional mode. Sure enough, scrambled P25. Also, for an in-the-clear (unencrypted) P25 voice call, Unitrunker shows a "-" in the CT column. The only time I have seen Unitrunker display "Dig" on any P25 digital voice transmission is when the transmission was also encrypted.

What you see is NOT ENCRYPTION, DIG is for DIGITAL MODULATION and ANA is Analog,
Also, the 2096 has no problems following traffic on the above TG or any others on SAFET. Maybe you need a better antenna...

I am less than three miles from the site I am listening to. I have the GRE 800 MHz 90° angle antenna on the back of my 2096, sitting right next to a window on the side of my house that faces the site. I can track Boone County simulcast using the same setup. I don't think my antenna is the problem. Because of the status bits, the 2096 will IGNORE a talkgroup that shows up as encrypted. Sure, I have no trouble tracking it when in-the-clear, but as soon as it goes encrypted, the scanner ignores it, because the status bit for encryption is there. Again, on SAFE-T, Unitrunker will show a "-" in the call type column for in-the-clear analog AND digital voice. It only shows "Dig" when the traffic is encrypted. Others have seen this too: http://www.radioreference.com/forums/showpost.php?p=660091&postcount=26

 

[SCPD]

Once agian from the Instructions from UniTrunker

What it can't
The program does not monitor P25 conventional channels. It does not provide the ability to decode digital voice transmissions into audio. You will need a digital P25 (or VSELP or ProVoice or whatever) capable receiver for this. There is no support for LTR, Passport or Multinet at this time. The program does not monitor encrypted control channels. It you wish to capture NAC codes found on P25 conventional channels - look for a program called the "kNACk".

There is a variation of MPT1327 found on 220 Mhz in North America that uses ACSSB modulation inside a 5khz channel. The FFSK parameters also differ from the standard narrow-FM MPT1327 mode. UniTrunker does not support this format.

Here's a summary of the kind of information that can be displayed.

Basic system information - system type, system id, talkgroups, and radio ids.
Basic site information - site or cell number, and list of channels.
Site call activity - who's talking, on what channel, and to whom.
Neighboring Site information - list adjacent cell or sites with control channels.
User roaming - what radios are registed to a particular site.
User affiliation - what talkgroup a user has requested.
Patches - a dispatcher initiated action that joins two or more talkgroups together.
The program also allows a user to define a custom band plan or fleet map.