MOTOTRBO / DMR: Privacy from competitors listening?

[Stringer619]

I've tried to do some more searching here and through Google throughout the night/morning and am coming up short on better understanding HOW someone can bypass Enhanced Privacy.

It seems to me that the person would have to record some raw data with a MOTOTRBO radio with a discriminator tap, then take the data file and decode it somehow using some hush-hush software. If this doesn't happen in real time, then it's not as big of a concern for me. My concern is I'll dispatch an employee to a story, and the competition will jump on it if they can monitor in real-time. In the news business, seconds matter, and any way to get a tip sooner is worth it's weight in gold, and thus competition would monitor if they could. I know I would.

Can anyone explain in detail how the process of bypassing Enhanced Privacy works?

 

[mikewazowski]

There are certain programs out there that will decode basic and enhanced encryption in real-time.

Keep in mind that they are not well known and because of the legalities in using them, they are not distributed publicly. The likelihood of your competition having such capabilities is slim to none.

However, if that is not good enough for you, you will need to invest big-time money to build a truly secure system.

If you don't want to do that and cell phones aren't an option, than you might want to look at satellite phones. They should work almost anywhere and they'll be secure.

 

[jhooten]

It's not quite that simple, as DMR portables and mobiles generally cannot be captured on Close Call since they only transmit half the time. But, you can be seen on a spectrum analyzer using one of the cheap ($15) SDR dongles. It is possible with a strong enough signal that Close Call might be able to snag a frequency, but it's not easy (I've tested this myself using DMR radios and a Close Call scanner). Generally, Close Call will not work on simplex or when portables or mobiles are transmitting. It will work on a repeater, so if you have a DMR repeater that can be captured via Close Call.

Or I could simply look up your license on the FCC website.

 

[KE5MC]

It might be worth the effort to get involved with Fisher on a limited commitment. Tell them what your expectations are and can they meet them. Rent the time and equipment and see if it works out. I think it will be clear if the competition is monitoring.

snip...

My concern is I'll dispatch an employee to a story, and the competition will jump on it if they can monitor in real-time. In the news business, seconds matter, and any way to get a tip sooner is worth it's weight in gold, and thus competition would monitor if they could.

snip...

 

[JRayfield]

I believe that Fisher Wireless has a MOTOTRBO Connect Plus trunking system. While it's based on DMR (the over-the-air signal uses the DMR protocol), the trunking system itself is proprietary to Motorola. So, while it's possible to listen to transmissions on the individual repeaters, there is no way, without using a Motorola XPR-series radio that is properly programmed, to 'automatically follow' a specific user on a Connect Plus system. This means that it would be very difficult to 'monitor' a user on the Fisher Wireless system.

As to "getting around" the Enhanced Privacy that MOTOTRBO offers, there have been 'claims' by some people that this encryption is 'simple' and has been 'broken', but such ones have never provided 'proof' (actual evidence) of these claims being true. Doing a Google search, I've been unable to find any evidence that the MOTOTRBO Enhanced Privacy has been 'broken'. The fact is, while it only uses a 40 bit 'key', part of the information involved in the encryption/decryption process changes in every voice packet that is sent over the air. So, it's not really 'that simple' to break MOTOTRBO Enhanced Encryption, and until someone shows evidence that it's been done, my opinion is that it has not been 'broken'.

As to any other way to 'encrypt' a MOTOTRBO transmission, no there is no other way, at this point in time.

John Rayfield, Jr. W0PM
Rayfield Communications

Quite a few replies, I'll try to respond to them all. I am loving the feedback/ideas!

We are considering Fisher Wireless's TeamTalk service, which offers MOTOTRBO/DMR airtime for about $30 a month per radio and covers California, Nevada and Arizona (all we need is San Diego county). I'm unsure what else they offer, but am still looking in to that.

We currently use the Zello app, which works "ok" but sometimes goes down, but a real radio on your hip is much more convenient, louder, has more accessories, more rugged, works with our other Motorola radio chargers/programming equipment (scan only mode). My number one complaint with using Zello is volume control and cellphone battery life. We go from noisy to dead-silent environments, and those quiet environments often mean WE need to be dead silent too, so as to not interfere with law enforcement, whom we work basically shoulder-to-shoulder with. We just don't have the time to go in to the menu and play around with volume controls.

We also do not want to rely on the cellular infrastructure. We are sometimes in remote areas where cellular may not work, but radio might. Also when the big statewide power outage happened, many cell towers went down.

Upon hearing back from Fisher Wireless to know what technologies they support, I will look in to the P25 w/ AES256 and the Hytera w/ AES256, although I would strongly prefer to stick with Motorola.

It seems to me that going DMR / MOTOTRBO and renting the air time through Fisher Wireless TeamTalk is the solution glaring me in the face, but as Voyager pointed out, competition could just monitor the DMR system and find us.

So I guess my real question at this point is: How do I go encrypted on MOTOTRBO, beyond "Enhanced Security", which some have said is possible to get around. Are there optional add-on boards or something? It sounds like I can't "hide", but rather I can scramble/encrypt?

 

[mmckenna]

Satellite phone might be easier/cheaper. Either that, or find some unique coding that you use internally to your company. Think "Navajo Code Talkers".

Secure Technology is a fleeting thing. Publicly available encryption will eventually fall. You might be able to stay ahead of the curve, but it won't always be cheap/easy.

Consider using multiple cell phones on different carriers, hop around from one to another. Combine voice with text messages, never provide all the information over any one source.
Consider using a voice mail system with text message notification. Dispatches can be left as voice mail messages and the field guys can just call in to retrieve. Heck, use pay phones if you can find them.

Just figure out a way to make it financially unreasonable for competitors to follow your traffic. Technology isn't always the answer.

 

[Forts]

Enhanced privacy would certainly be secure enough. While there may or may not be programs out there that can decode privacy in real time, that's only if the key is known. 40 bit privacy is over 1 trillion key combinations, and that certainly isn't being discovered in real time. You can program up to 16 keys I believe into the radio for EP, so you could potentially program your radios say... quarterly... with a batch of keys and simply program the same channel with different keys into the radio. Every so often switch to the next channel, which now has a different key. Kind of a poor mans way of re-keying the radios without bringing them in or doing it over the air.

 

[rapidcharger]

You can get AES / DES 256 bit modules for the Kenwood nexedge radios and I'm sure you can get on SMR trunking system. It's not going to be cheap but technically it will be more secure.

If you run into him, say hi to J.C. Playford for me.

 

[TampaTyron]

As a system operator, I would be interested in knowing whether Fisher will allow Enhanced Privacy on their network. Enhanced Privacy makes the audio less good for ALL users on the system and I could foresee some resistance on Fisher's part of allowing it. All of that being said, you could always use the radio side for Tactical traffic while relying on text/cellular for details.... IE you push a specific event with details and location over text, then all radio voice traffic refers to that event ID. In this day and age, you have to ASSUME that you are being monitored...........TT

 

[TampaTyron]

To add further info, I have aeromedical helicopters in my area listening to each others conventional/trunked radio communications trying to "pirate" each others patients. This seems ludicrous to me, but with the average Medivac type flight costing $100,000+ I can see the pressure to generate revenue. What a great time to be alive! TT

 

[Voyager]

Or I could simply look up your license on the FCC website.

Provided it's licensed to you, yes. There are a number of ways around that, including using a repeater licensed to a third party.

 

[PACNWDude]

I have worked in industries that needed encryption and secure comms, and every system could be monitored with the right: equipment, time and talent. As for news crews, the fact that you are even contemplating DMR equipment puts you ahead of the game. Add in encryption beyond the normal default included in the XPR series, and you are more obscure. Sure SDR dongles and software can crack it, but by the time someone does, you have already scooped the story. Just change the key often. This is why the military changes it every day in some cases. You are probably fine with XPR radios and enhanced encryption.

In a similar situation I had, the end users only needed short range comms, less than one mile, and wanted Motorola. I proposed ISR radios, at that time DTR410's. Then I set the code for something besides default. This gave them very good security on their comms. Anything encrypted will beat anything not encrypted, most of the time. I have had situations where analog and un-encrypted actually flew below the monitors in the area. Know your audience and what they are looking for.

Text messaging might be an answer as well. Text messaging on cell or satellite phones too.

 

[AZScanner]

Ah yes, this thread brings back some not-so-sweet memories. Competition is fierce among stringers and there is certainly "no honor among thieves" when it comes to many of them. I've lost probably thousands of dollars in sales over the years to other stringers who continually showed up late and then lied their a$$ off to the stations about who was actually there first and/or found out what I was charging and undercut me by almost half. As today's "cell phone video" stories prove, the stations don't care much about who shoots well and who doesn't. These days, stringers often lose out to Joe Citizen cellphone users who freely give away their shaky, choppy video not knowing that if they shot it right on real gear it'd be worth actual money. It's a wonder stringers can still make a living anymore, really. Here in Phoenix it's not even worth starting up the car most nights. I went back to a "real job" years ago - but boy do I miss the thrill of a good breaking news story. Maybe someday I'll go "pro" and work at a station somewhere.

As for your competitors listening in, DMR is a good start, but as others have said, it's not completely secure. The nice thing is, if you do encrypt and then catch someone listening in, you can have them prosecuted for it under federal law. That'll stop 'em REAL quick.

-AZ

 

[Stringer619]

Seeing as how the Motorola XPR6550 has 160 channels, could I just program the same channel a 160 times with different (something, not sure what the word would be) and every few nights just tell my employees "use channel 41 tonight", and then the next night "use channel 17 tonight", etc, or would the jumping around be trivial if the main parameters are always the same? I'm so new to understanding DMR that I'm not sure what (frequency, time slot, color code, group code) can be changed on-the-fly.

I'd imagine changing the frequency that the carrier would give me is not possible since thats set in the repeater(s), and I also would assume the "group code" is like saying "talk group ID" on a trunking radio system and would be unique to my account with the carrier, and thus also not changeable on-the-fly.

What parameters would I want to change multiple times to have a variety (that is, unless it's pointless)?

 

[Voyager]

Well, there are 16 Color Codes, 2 timeslots, about a zillion TGIDs (seriously about 16776415)

All these are instantly seen with DSD+ or DMRDecoder.

What you would want to set differently is the encryption key is you are going to use DMR (MotoTRBO). Not basic Privacy, as there are only 255 codes, but Enhanced Privacy (codes range from 1 to FFFFFFFE hex). Your audio quality will suffer, but it is the only real way to try to stay hidden.

Oh, and none of these are easily changed "on the fly" by any portable currently made, but that may change in the next month or two.

If you REALLY want to stay hidden, and don't need wide coverage, look into a frequency hopping (Spread Spectrum) portable.

 

[krokus]

Stringer, you have to figure out how much effort and money your agency is willing to invest in keeping your competitors from listening to your dispatches. As you have read, there are a lot of options, and a wide variety of associated costs.

Sent via Tapatalk

 

[MTS2000des]

Due to the nature of my company, I can not have competition listening in on our communications.

Now, I take it from the name "Stringer619" that you are a stringer, and you profit by...wait for it...listening to other people's radio traffic (specifically police/fire/EMS) to get to the scene first, and you are concerned about other people listening to your radio traffic. Sorry but I can't help but note the irony.

Maybe now you know how the cops feel? Could be why the future radio systems in your area call for AES-256? Guess your job will be more challenging when your scanners soon fall silent.

It's my understanding that police scanners can not monitor these systems,

Most of the consumer stuff can't. There is a pro-grade scanner coming to the market that can decode DMR (MotoTRBO) as well as a plethora of other digital voice formats including NXDN, P25, D-Star, System Fusion..etc.

https://hamgear.wordpress.com/2014/10/04/aor-ar-dv1-a-new-breed-of-receiver/

Others have said, with a simple SDR dongle and freeware, DMR is not off limits without a costly radio. Encryption available on DMR includes basic and enhanced privacy, enhanced privacy has a 40 bit key. Enough to keep most people out. But not very strong.

Authorized users can get AES-128 on DMR. But Motorola won't sell it to business users in the USA. Only "three letter" agencies and "select" customers.

Privacy is my number one concern.

Then do what the cops in your area will soon be doing: go spend big bucks for P25 with AES-256.
Otherwise, use a cellphone.

 

[rapidcharger]

I'd imagine that the movie Nightcrawler that just was recently in the theaters a couple of months ago would have a whole lot of new people trying to strike it rich chasing down the money shot.
If it bleeds, it leads.
Anyway it looks exciting but if enough people start racing to crime scenes and citing California penal code 409.5 to get right up in the business of first responders, I really can see why they'd lock it down like they did in Orange county.

 

[mlmummert]

Hey if your competitors are really listening, you could always send them on a few wild goose chases.

 

[SCPD]

Day Wireless

....We are considering Fisher Wireless's TeamTalk service, which offers MOTOTRBO/DMR airtime for about $30 a month per radio and covers California, Nevada and Arizona (all we need is San Diego county). I'm unsure what else they offer, but am still looking in to that ....

Before you commit to Fisher Wireless (I've never heard of them, they may be great) take a look at Day Wireless. They have a Trbo system that covers from California to Washington State. They have been doing trbo since it came out. I've never have bought from them, but do get tech help from them from time to time.