General question on encryption

[soberbyker]

I have a general question on encryption. Does it cost more to encrypt? I'm just wondering why, other than secrecy, some do and and some don't. I live in Delaware County, PA (Delco) and they currently are in the clear and still on 500 band. They supposedly have a plan to move now, although they've been talking about it for a long time.
They've never encrypted anything. Back in the low band days they would "go to red" which was some kind of temporary scrambling, But since they went to 500 band I never heard that again, so when they move why would they want to? Delco is all about cost so if it costs a lot more to do so, maybe they won't, which is my hope.

​

 

[n3obl]

With todays technology its very easy to implement encryption. Basically its to prevent the listening and streaming of their radio traffic.

 

[DeoVindice]

The answer is: it depends. ARC4 is usually a free option in subscriber radios and ARC4 keys can be loaded without the use of an external keyloader. With that said, certain grants require AES (or no encryption whatsoever, or AES plus other algorithms - long story involving Motorola sales tactics from some time ago) for the radio to be eligible for grant funding, and this may require purchase of an external keyloader. Exact cost structure depends on the manufacturer and equipment in question. The most recent Harris price sheets I've seen list single-key AES as a $0.01 option, whereas it's about $170 from EFJ.

 

[Skypilot007]

The steaming, that's what killed us in Burlington, Camden and Gloucester counties. Thanks Broadcastify!

 

[stevecast2024]

Delaware County will remain in the clear when the move to the P25 system is complete for normal Fire/EMS talkgroups as well as standard police talkgroups (Sector channels in today's world). Mutual or "M" channels will be secure (encrypted) in the new system. This will keep normal patrol traffic in the clear but still give law enforcement a secure option if needed. Tactical/Swat talkgroups will of course be secure.

Any encryption on the system will be AES256 and it was purchased for all subscriber radios on the system. In our case the cost is not system related. It is radio related. You pay to enable the encryption algorithm in the subscriber radios. Again... your normal everyday communications will remain in the clear but each Law sector will have a secure/encrypted talkgroup for use if needed.

 

[soberbyker]

Delaware County will remain in the clear when the move to the P25 system is complete for normal Fire/EMS talkgroups as well as standard police talkgroups (Sector channels in today's world). Mutual or "M" channels will be secure (encrypted) in the new system. This will keep normal patrol traffic in the clear but still give law enforcement a secure option if needed. Tactical/Swat talkgroups will of course be secure.

Any encryption on the system will be AES256 and it was purchased for all subscriber radios on the system. In our case the cost is not system related. It is radio related. You pay to enable the encryption algorithm in the subscriber radios. Again... your normal everyday communications will remain in the clear but each Law sector will have a secure/encrypted talkgroup for use if needed.

Thanks for the info, will the M channels be full time encryption? For instance when they give the air to a particular call and tell everyone else to operate on the M channel for dispatched calls will it be encrypted.

 

[stevecast2024]

Thanks for the info, will the M channels be full time encryption? For instance when they give the air to a particular call and tell everyone else to operate on the M channel for dispatched calls will it be encrypted.

At this point yes that is the plan. Selectable encryption is nice but it becomes cumbersome and you wind up having half your units encrypted and the other half in the clear. Running strapped encryption on specific talkgroups just makes it cleaner.

There is the potential that we run both the sector and the M talkgroups in the clear and just simply build a separate secure talkgroup for special ops in each sector.

 

[RaleighGuy]

I have a general question on encryption. Does it cost more to encrypt?

Yes, back in 2018 one of the cities in my county purchased ten radios and the contract (which is online) shows it was about $735 per radio to add encryption, that was six years ago so it is probably more in 2024.



Full contract is available HERE

 

[rgchristy]

Thank you Steve for your honest and logical approach to encryption.

Even though the Baofeng's won't be able to receive the new system, it must suck for LEOs to get a call for Act 64 sales at X and X location, only to show up with no one around because the participants heard the call. Not to mention the lovely musical playlist that we get to hear on Sector 3.

On the flip side, coming from a background of FF/EMT, I know that our responses relied upon the police being first on location with an initial report, such as, "there's no entrapment" or "house fully involved, subject hanging out a 2nd story window" or even "not a cardiac arrest". Not the response itself, but the criticality of the response. Also, the preparation enroute; are you laying in, packing up or which boxes/packs are you grabbing first. The difference between hearing it on your scanner on the way to the station or scene and getting the info relayed from PD to PD dispatcher to Fire/EMS dispatcher to MDT/radio can be five minutes. For those in PSP territory, it can take longer.

Just my $ .02.

 

[stevecast2024]

Thank you Steve for your honest and logical approach to encryption.

Even though the Baofeng's won't be able to receive the new system, it must suck for LEOs to get a call for Act 64 sales at X and X location, only to show up with no one around because the participants heard the call. Not to mention the lovely musical playlist that we get to hear on Sector 3.

On the flip side, coming from a background of FF/EMT, I know that our responses relied upon the police being first on location with an initial report, such as, "there's no entrapment" or "house fully involved, subject hanging out a 2nd story window" or even "not a cardiac arrest". Not the response itself, but the criticality of the response. Also, the preparation enroute; are you laying in, packing up or which boxes/packs are you grabbing first. The difference between hearing it on your scanner on the way to the station or scene and getting the info relayed from PD to PD dispatcher to Fire/EMS dispatcher to MDT/radio can be five minutes. For those in PSP territory, it can take longer.

Just my $ .02.

Understood. Keeping the standard sector talkgroups in the clear will allow the normal day to day operation to go on and allow fire/ems to still monitor in real time if they choose to do so. Having an encrypted option for times where a secure talkgroup is needed gives the best of both worlds. Nowadays, you have probably heard several departments have started to switch to PD A, B or C during certain events to try to limit the scanners. Nothing is encrypted there but most of the Baofengs on the street are not running DMR. The baofeng days are coming to an end.

 

[policefreak]

How far along are you in the process of transitioning to the new system? I see a slew of licenses for 700 mhz frequencies and tower sites. I am hearing reports that the new towers are being built out. Then I guess the radios need to be purchased. Is it possible for system testing to start by the end of the year?

 

[stevecast2024]

How far along are you in the process of transitioning to the new system? I see a slew of licenses for 700 mhz frequencies and tower sites. I am hearing reports that the new towers are being built out. Then I guess the radios need to be purchased. Is it possible for system testing to start by the end of the year?

Kenwood Viking VP8000 portable radios are all purchased. All but 3 of the tower leases have been completed and signed. Work is ongoing just about every day now. Antennas are hung at Upper Darby, Marple, Lima, and Prison sites. They are adding a new waveguide ladder to Lima this week. Bartram Ave has the concrete pad completed for a new shelter that will be dropped shortly. Factory acceptance testing at the EFJ warehouse in Irving TX will be completed in July and the racks and base stations will ship after that. We anticipate the majority of the sites will be on the air by December. Coverage testing will begin next spring once the leaves are on the trees. I have been updating this thread as the project moves forward Delaware County Pa New System
Plenty of pictures.

 

[RFI-EMI-GUY]

If an large County or State agency desires extensive encryption, and considerable interoperability is required , there must be a Key Management Facility to perform OTAR and there is a substantial cost to add that.

 

[kd8ati]

The agency im in is part of the Michigan MPSCS. While there have been no official memos about having to go encrypted, there was a conference held recently discussing the FBI CJIS policy about P.I.I. going out on encrypted talkgroups only. The larger departments and countywide dispatch centers have implemented "LEIN-NCIC" talkgroups an officer can switch to in order to run a plate or a drivers license number. This allows them to keep main dispatch in the clear. For the smaller departments, like the one I am in, that is not practical. So while we really dont want to go encrypted, we wont really have a choice further in the future. So for us it would have nothing to do with trying to be secret or anything.

 

[stevecast2024]

The agency im in is part of the Michigan MPSCS. While there have been no official memos about having to go encrypted, there was a conference held recently discussing the FBI CJIS policy about P.I.I. going out on encrypted talkgroups only. The larger departments and countywide dispatch centers have implemented "LEIN-NCIC" talkgroups an officer can switch to in order to run a plate or a drivers license number. This allows them to keep main dispatch in the clear. For the smaller departments, like the one I am in, that is not practical. So while we really dont want to go encrypted, we wont really have a choice further in the future. So for us it would have nothing to do with trying to be secret or anything.

We will be doing the same thing here. We will have a talkgroup for the officers to run their queries on to the scope operator. This will be ENC but standard patrol TGs will be in the clear.

 

[chrishoerner]

@stevecast2024 A tad off topic but do you guys plan on adding Delaware to your radios, or allow Delaware radios on your new system? Or any other jurisdictions? I've just been curious as most jurisdictions seem to have great difficulties with this for one reason or another. You all seem to really be doing a great job from what i've been following on here setting this up!

 

[stevecast2024]

@stevecast2024 A tad off topic but do you guys plan on adding Delaware to your radios, or allow Delaware radios on your new system? Or any other jurisdictions? I've just been curious as most jurisdictions seem to have great difficulties with this for one reason or another. You all seem to really be doing a great job from what i've been following on here setting this up!

Yes. Surrounding counties will be allowed on the system. The only caveat is that we will have to fully test whatever model radio they intend to bring over. Once a model is approved it will be placed on a list and any agencies looking to bring that model radio over will be allowed to do so by must follow our fleet map.

Often times counties run in to issues because of the flavor of encryption they use if they use encryption and proprietary vendor specific features. Everything we are doing is going to pure to the P25 standard. While the system is an EFJ/Kenwood system any P25 compliant radio will work on the system.

Other vendors actually charge the system owner per radio ID added to the system. That is not how EFJ/Kenwood does business so number of users will also not be a limiting factor in our case.

We will be Phase 2 TDMA across the board and will not allow Phase 1 only radios on the system.

 

[chrishoerner]

That's Great news! I don't like seeing patches go up because the end users don't understand they might not have in building coverage.

I know for sure some DE fire company's radios they purchased on their own are not flashed for phase 2 but i think that will get sorted one way or another. The newer state issued one should be flashed right.

Delaware is using proprietary encryption at the moment but again that should be fixed when the DE finished its upgrade.

Wow I knew that was common practice in the commercial world to charge per ID but didn't dream that would happen in the public world since they own the system.

I help a local Kenwood dealer with sales when I get the opportunity to, we are very excited to see this system go up! We appreciate the Updates on here. You will have a very secure system there is no way at least not a published way to get a kenwood/efj on a trunking system without authorization.

 

[magiclightman]

That's Great news! I don't like seeing patches go up because the end users don't understand they might not have in building coverage.

I know for sure some DE fire company's radios they purchased on their own are not flashed for phase 2 but i think that will get sorted one way or another. The newer state issued one should be flashed right.

Delaware is using proprietary encryption at the moment but again that should be fixed when the DE finished its upgrade.

Wow I knew that was common practice in the commercial world to charge per ID but didn't dream that would happen in the public world since they own the system.

I help a local Kenwood dealer with sales when I get the opportunity to, we are very excited to see this system go up! We appreciate the Updates on here. You will have a very secure system there is no way at least not a published way to get a kenwood/efj on a trunking system without authorization.

With the planned upgrades for the new SOD radio system, they have not been allowing any new radios onto the system without TDMA in the flashcode and they have been going through and upgrading the entire fleet to have TDMA options enabled so @stevecast2024 shouldn't have any issues with that as SOD is running APX 6000 units. Similar case for Chester Co being TDMA 700/800 harris models.