Police departments across the state flooded DOJ with correspondence about police radio encryption

[iMONITOR]

Police departments across the state flooded DOJ with correspondence about police radio encryption

Police departments across the state flooded DOJ with correspondence about police radio encryption - Palo Alto Daily Post

BY ELAINE GOODMAN Daily Post Correspondent In the months before the California Department of Justice issued a bulletin that prompted many police departments in the state to encrypt their radio [...]

padailypost.com

 

[GlobalNorth]

Another writer [I won't refer to Ms. Goodman as a journalist, since I am not seeing original work in that article] writing about a topic she knows little of and implies the worst, when the worst is merely bureaucratic ineptitude.

MDCs more than adequately address many PII concerns. Units that do not have access to MDCs such as Motor units can use an encrypted voice channel or text based gov cell phone return on a license status. Detectives may have access to MDCs when command vans roll out or MDCs are issued for search warrants, records queries, criminal histories, etc.

One problem is that police executives are often clueless or downright stupid when it comes to electronics and decide that encryption is only binary - all in or all off. This is not the case and most traffic can be sent without concern.

The second problem is that police departments are underfunded/unfunded when these mandates come down from State/Federal officials and know next to nothing about the technology of or the employment of the technology. Encryption is not inexpensive and usually offered in only the highest priced electronics on the market - AFOSI can afford them, but a rural area PD with 15 officers or less can't. Motorola, EFJ, and other suppliers need to push encryption down to mid-range radios that don't have 5 digit price tags. Lots of people here think that they can buy a module to decode the traffic and some believe they can crack basic Diffie-Hellman exchanges and get access to everything - even though they have no clue what a Modulo is.

Three, does a PD need national security level encryption? No. They aren't transmitting TS/SCI/codeword level information here - just things like VP, health cautions, criminal histories, search warrants, cautions, etc.

Four, lack of transparency can result in bad behaviours among less mature employees. When my city issued cell phones to on duty troops, a couple of the less mature decided to use text messaging as a moron's workaround for gossip and info. Some employees were badmouthing citizens, employees, supervisors, and city officials in these texts and they never realized that they were retained by the city. Of course, the managers blew up when these were discovered and those responsible were dinged for their antics - including a deputy police chief. Now, a city employee with clearance has to audit all texts and any telephone call of over 5 minutes in length. Will a 24/7 recorder be attached to the encrypted channel/s? Will a dispatcher be monitoring them? Can the agency afford the gear and the personnel?

Five - size matters. LAPD is going to need more encrypted channels than Susanville PD does. It is simply a matter of scale.

Doing a FOIA request for the word "encryption" is going to result in a flood of information, just as"active shooter" would.

 

[RFI-EMI-GUY]

I think it is just a matter of time, perhaps within 5 years that all major cities and counties will encrypt P25 systems. The AES option is just a small percentage of the exorbitant price of an APX series radio.

The other cost is with key management system overlay which for a small county or city is a fairly large investment. I expect some 3rd party vendors will jump in and leverage the standards to make that infrastructure affordable. Until then, a small city can manually load keys.

What will this mean for the hobby? I see ELINT as an offshoot. Picture a network of hobbyist SDR receivers capturing up-link data from public safety handhelds and tracking police activity on a geographic basis.

Picture ADS-B for P25 up-link messages. You may not be able to hear what is being said but you can see where police and fire are in real time.

 

[mmckenna]

Police departments across the state flooded DOJ with correspondence about police radio encryption

Poorly written article.

There was a "flood" of correspondence because agencies were required to submit a statement to the CADOJ laying out their plans for meeting the requirement. I had to write the one for our PD. So, add up the number of law enforcement agencies in the state and there's your flood. There were also a lot of questions submitted asking for clarifications.

The second problem is that police departments are underfunded/unfunded …. Motorola, EFJ, and other suppliers need to push encryption down to mid-range radios that don't have 5 digit price tags.

True, this was an unfunded mandate. That created a lot of confusion for agencies.
But, I think you've been out of the industry for a while. It's been difficult for agencies to purchase radios that were not capable of encryption for some time.
Any radios purchased under federal grants had to be P25 capable, that's been on the books since the early 2000's. While there are 20+ year old radios out there in service, there's not a lot of them. Any public safety agency relying on 20+ year old radios probably needs to upgrade anyway. It's been getting difficult to buy analog only radios in this category for some time.
There are plenty of $500 radios that are capable of having an AES-256 encryption board added. Yeah, it's a $700 option on many of them, but we're way under the "5 digit" price tag and manageable for even small agencies if they plan their finances out properly.

Where the challenge comes in is the repeaters/dispatch consoles. That -is- an expensive issue.

Three, does a PD need national security level encryption? No. They aren't transmitting TS/SCI/codeword level information here - just things like VP, health cautions, criminal histories, search warrants, cautions, etc.

No, but there's no point in encrypting radio traffic if it can easily be decoded.
Also, you need to consider interoperability. Interoperability with the feds requires AES-256, so that was the chosen standard.

Four, lack of transparency can result in bad behaviours among less mature employees. ...Will a 24/7 recorder be attached to the encrypted channel/s? Will a dispatcher be monitoring them? Can the agency afford the gear and the personnel?

Standard practice for agencies to record radio channels. We record all ours, and they get saved in case they are subpoenaed.

 

[900mhz]

What are the Freedom of Information laws in California?

 

[Engine104]

What are the Freedom of Information laws in California?

The FOIA is a federal law ( 5 U.S.C. § 552 ). Therefore, all states need to comply, in theory, anyway...

 

[900mhz]

The FOIA is a federal law ( 5 U.S.C. § 552 ). Therefore, all states need to comply, in theory, anyway...

Theory, but you wonder if that is practice. Gee, it looks like I might have to test that out.

 

[GlobalNorth]

Poorly written article.

There was a "flood" of correspondence because agencies were required to submit a statement to the CADOJ laying out their plans for meeting the requirement. I had to write the one for our PD. So, add up the number of law enforcement agencies in the state and there's your flood. There were also a lot of questions submitted asking for clarifications.



True, this was an unfunded mandate. That created a lot of confusion for agencies.
But, I think you've been out of the industry for a while. It's been difficult for agencies to purchase radios that were not capable of encryption for some time.

Any radios purchased under federal grants had to be P25 capable, that's been on the books since the early 2000's. While there are 20+ year old radios out there in service, there's not a lot of them. Any public safety agency relying on 20+ year old radios probably needs to upgrade anyway. It's been getting difficult to buy analog only radios in this category for some time.
There are plenty of $500 radios that are capable of having an AES-256 encryption board added. Yeah, it's a $700 option on many of them, but we're way under the "5 digit" price tag and manageable for even small agencies if they plan their finances out properly.

Portables and accessories are one thing. Add in base stations and comm support gear and your costs rise quickly. A 15 person PD in a rural county can find it hard to pay for. There are agencies out there that are paying out of budgeted funds and not buying encryption. I know of two in Arizona.

Where the challenge comes in is the repeaters/dispatch consoles. That -is- an expensive issue.

Agreed.

No, but there's no point in encrypting radio traffic if it can easily be decoded.

The MSS and the FSB are not the issue here, it is the casual listener. There are more choices than voice inversion or AES-256.

Standard practice for agencies to record radio channels. We record all ours, and they get saved in case they are subpoenaed.

Good idea. Three of our then- seven frequencies were not recorded. Saving cash was the reason why. We called it being "Mayberry lucky". Nothing bad enough ever happens until it does and police chiefs, city managers, and council persons all expect it to happen to the next executives. No one will enforce it until an Appeals Court judge mandates it.

 

[GlobalNorth]

One also needs to consider the political climate in which these changes may or may not occur. If the Feds offer a million dollars for radio upgrades, that may or may not be welcome cash [believe it or not]. Small towns/cities in conservative areas may be opposed to such funding revenues. The reasons may be political or the government may not know how to write effective grants to apply for funds. They simply pay as they go.

 

[900mhz]

Portables and accessories are one thing. Add in base stations and comm support gear and your costs rise quickly. A 15 person PD in a rural county can find it hard to pay for. There are agencies out there that are paying out of budgeted funds and not buying encryption. I know of two in Arizona.


Agreed.


The MSS and the FSB are not the issue here, it is the casual listener. There are more choices than voice inversion or AES-256.



Good idea. Three of our then- seven frequencies were not recorded. Saving cash was the reason why. We called it being "Mayberry lucky". Nothing bad enough ever happens until it does and police chiefs, city managers, and council persons all expect it to happen to the next executives. No one will enforce it until an Appeals Court judge mandates it.

The true reality is...is all of it really necessary? The old adage...if it ain't broke certainly applies. Just because some federal agency dangles some dough doesn't mean nothing. But politicians, who don't know the difference between a frequency band and a rubber band, screw stuff up on a regular basis.

 

[mmckenna]

Portables and accessories are one thing. Add in base stations and comm support gear and your costs rise quickly. A 15 person PD in a rural county can find it hard to pay for. There are agencies out there that are paying out of budgeted funds and not buying encryption. I know of two in Arizona.

I agree. We're one of those agencies. The letter I had to write to the CaDOJ pretty much said that we currently didn't have the funding to make the change.
Adding appropriate level encryption to the mobiles and portables wasn't the issue, it was the radio consoles. We're on schedule to replace those anyway, so it was essentially "we'll do it as soon as we can" letter with some details added to back it up.

The MSS and the FSB are not the issue here, it is the casual listener. There are more choices than voice inversion or AES-256.

The issue is identity theft, and it doesn't matter who does it.
The solutions are many, but when rolling out encryption and wanting to maintain interoperability, there needs to be common ground. AES256 is supported by just about everyone. It meets the FBI standards, which is the driver behind the California DOJ requirement. It's the same reason they cracked down on Motorola selling P25 radios paid for with federal grand funding, and then putting ADP encryption in them. Don't force agencies to move to encryption, and then leave it open to interpretation about what needs to be used. Some knucklehead will rely on NXDN 15 bit encryption because they don't know better. Anyway, goes back to the FBI requirements.

This isn't just a California thing, it's the FBI, and it's coming to a theater near you, eventually.

 

[900mhz]

I agree. We're one of those agencies. The letter I had to write to the CaDOJ pretty much said that we currently didn't have the funding to make the change.
Adding appropriate level encryption to the mobiles and portables wasn't the issue, it was the radio consoles. We're on schedule to replace those anyway, so it was essentially "we'll do it as soon as we can" letter with some details added to back it up.



The issue is identity theft, and it doesn't matter who does it.
The solutions are many, but when rolling out encryption and wanting to maintain interoperability, there needs to be common ground. AES256 is supported by just about everyone. It meets the FBI standards, which is the driver behind the California DOJ requirement. It's the same reason they cracked down on Motorola selling P25 radios paid for with federal grand funding, and then putting ADP encryption in them. Don't force agencies to move to encryption, and then leave it open to interpretation about what needs to be used. Some knucklehead will rely on NXDN 15 bit encryption because they don't know better. Anyway, goes back to the FBI requirements.

This isn't just a California thing, it's the FBI, and it's coming to a theater near you, eventually.

FBI has lost their "thing" since Comey and the further cast of characters.
A very close friend of mine was an agent, who passed away at a young age from cancer. If he was still alive, he would no doubt be appalled by the polarization of todays agency, and quite frankly, so are very many.

 

[Giddyuptd]

As said in many areas as phase 1 and 2 systems are being more common and there, once a specific region is all on same page you can bet what's going to occur. People can cry and whine all they want with the arguments but to the users in a planned region it is seamless. New Mexico is a prime example of the excitement for phase 2 and 1 occurring, until the time comes which make no mistake while itll take some time when majority is on you can guess what is going to occur. Anyone else out this way saying opposite is either not inclined to know and lied to or selling their dealer gear as there is tons of small radio shops out this way still selling items to small clueless departments and businesses who "want to hear the cops" so they put their channel in and rx only the cool stuff.

It is a dead horse on the matter and inevitably with current world, sales survival by big companies, security concerns, data concerns eventually these arguments will be a old dead deal peoppe in the future will look in archives about.

 

[paulears]

I love the US obsession with rights. Us Brits think it’s almost comical. Your sovereign citizens, and every person seemingly knowing the wording of the Declaration of Independence. Here, most people have never heard of the Magna Carta or King John. Most people don’t even know who was the last King, and now many have never heard of Hitler or Winston Curchill. We have strict data protection rules. A Criminal’s history is secret. The police cannot share it with the public. Reading out personal data on a radio link with unknown people listening is simply not allowed. Knowing where a police car is going with flashing lights is secret. The press and tv cannot get private knowledge of events. Vehicle details and passenger details are secret. Police radios are encrypted and all police wear ear pieces so the public cannot hear the speakers on the radios. If they stop a vehicle the driver is not aware they are fed info about them, like identifying features and history, why they’re talking to them. Thry get warnings of concealed weapons or a dislike of the police.

All the excuses for bring able to listen to the Police are feeble. People just want to listen for fun, or if not for fun/interest, then the ONLY reason is potentially criminal reasons. Nobody needs to listen. The US citizen seems hell bent on rights, and knows them word for word. Sadly, it’s viewed at a distance as some kind of national paranoia - just amazing. Sorry. When our police went encrypted the scanner users moaned for a week, shrugged and moved on.

 

[900mhz]

As said in many areas as phase 1 and 2 systems are being more common and there, once a specific region is all on same page you can bet what's going to occur. People can cry and whine all they want with the arguments but to the users in a planned region it is seamless. New Mexico is a prime example of the excitement for phase 2 and 1 occurring, until the time comes which make no mistake while itll take some time when majority is on you can guess what is going to occur. Anyone else out this way saying opposite is either not inclined to know and lied to or selling their dealer gear as there is tons of small radio shops out this way still selling items to small clueless departments and businesses who "want to hear the cops" so they put their channel in and rx only the cool stuff.

It is a dead horse on the matter and inevitably with current world, sales survival by big companies, security concerns, data concerns eventually these arguments will be a old dead deal peoppe in the future will look in archives about.

Its never a dead horse. Taxpayers deserve to know where their hard earned money goes. The problem is with those taxpayers who exhibit "laissez-faire" attitudes towards such. I pay a lot in taxes in several states, and I don't trust many government officials. I always make them prove it. I put my money where my mouth is paying taxes, I expect the reciprocal.

 

[mmckenna]

FBI has lost their "thing" since Comey and the further cast of characters.
A very close friend of mine was an agent, who passed away at a young age from cancer. If he was still alive, he would no doubt be appalled by the polarization of todays agency, and quite frankly, so are very many.

It has nothing to do with politics. These CJIS encryption policies have been on the books for a very long time, they are just now getting enforced.

 

[mmckenna]

Taxpayers deserve to know where their hard earned money goes.

I agree 100%.

However, none of that extends to having access to any private citizens personal information.
In other words, find another way to figure out where your money is going.

 

[900mhz]

It has nothing to do with politics. These CJIS encryption policies have been on the books for a very long time, they are just now getting enforced.

Perhaps, however most communication does not deal with personal information. Correct me if I m wrong, but don't most units have MDT's to pass sensitive data? Just because "policies" are on the "books" does not necessarily mean that those policies are legal. Again, politics involved. I do feel sorry for those that live in California (my wife is from Riverside County, and yea I fell for a hot blonde). We have had discussions on the drastic political changes in Cali. Unanimously, Cali has gone down the toilet. As liberal as the Northeast is, there seems to be more transparency to the money payers (yeah, us tax payer leeches), though not totally.

 

[mmckenna]

Perhaps, however most communication does not deal with personal information. Correct me if I m wrong, but don't most units have MDT's to pass sensitive data? Just because "policies" are on the "books" does not necessarily mean that those policies are legal. Again, politics involved. I do feel sorry for those that live in California (my wife is from Riverside County). We have had discussions on the drastic political changes in Cali. Unanimously, Cali has gone down the toilet. As liberal as the Northeast is, there seems to be more transparency to the money payers (yeah, us tax payer leeches), though not totally.

You are trying hard to make this political. You seem to do that frequently. This isn't political.

Small agencies don't necessarily have MDT's in their cars. And typing out data or reading that data while in pursuit is dangerous. When chasing someone on foot, no officer is going to stop to type out a text message, or read one.

When these agencies signed on to use the terminal systems to access the databases, they signed documents that said they would abide by the state and federal rules regarding usage of that information. Those rules were that CJIS/PII had to be protected. It had to be protected over the data networks. It had to be protected when printed out. It had to be protected when stored. It had to be protected when sent over any wireless means (including cellular, wifi, LMR radio). Those agencies -all- signed documents saying that they had read the rules and agreed to them in their entirety. In short, they signed a contract.

Now, they are being held to that contract. Boo hoo. Some people hate it when they have to be responsible for their actions.

Don't want to follow the contract? Fine, state DOJ pulls the plug. Said agency no longer has access to the database. Pure and simple. Now officers have no idea what they are getting into. They've lost that intelligence. All because they signed a contract and then decided they no longer wanted to abide to it. In other words, they all want the rights to access data, but don't want to take on any of the responsibility of doing so. Sound familiar?

And again, this has nothing to do with California. Take the political party blinders off. The FBI/USDOJ controls the federal databases. They provide access to the states. The states agree to the rules regarding access to the databases. That's clearly spelled out in the FBI documents, and those documents are available to the public, RIGHT. HERE. Criminal Justice Information Services (CJIS) | Federal Bureau of Investigation The states have their own databases. Those get combined. The states can give counties/cities/agencies access to both databases. Again, there are responsibilities that come with that access.
Again, nothing to do with California. This is coming down from the FBI. The FBI will eventually get to the other states and remind them that they signed agreements to access the databases. That will get passed down to the local agencies with the same requirement: follow the agreement or we pull the plug.

Scanner hobbyists can complain all they want, but having free access to CJI/PII isn't going to continue. It's not something new. It's not something political. It's agreements that your own state/local agencies agreed to a long time ago.

 

[900mhz]

Trust me...there is nothing political about this. Most inquiries can be done by MDT. yea, some times though very rare, portable coverage gets sketchy. Yes, i read your response. Sounds like some agencies need to upgrade their systems. Most here in CT have their own systems , including a few which have their own trunking systems that work both ways...benefiting both state and local users.
I am sure most persons would agree to protect the identity of victims, no doubt. However, if California laws would ever be applied here, I could say with positive certainty that perpetrator protection would be zero. Quite frankly, that is where Cali has dropped the ball.