Marion County going encrypted, but process seems confused

ekmeyer

Member
Joined
Jan 6, 2011
Messages
9
Location
Marion, KS
Marion County law enforcement abruptly shifted to an encrypted talk group Oct. 7, but the rationale doesn't ring true. I'm hoping someone with expertise in P25 / KSICS can explain.

According to published news reports, officials initially said a radio supplier was "working on" the main talkgroup and it became unreliable, forcing use of the encrypted talkgroup. This didn't seem true both the radio supplier denied working on the talkgrounp and because recordings immediately before the switch indicated no problems and some normal traffic was recorded after the switch.

The stated reason then became that the county needed to go 100% encrypted because of an FBI edict to encrypt information coming from one of its databases. We already know that's not true. The FBI requirements could be met by using the encrypted secondary talkgroup already available to all county units. Radios would have to receive upgraded firmware for employ AES-256 encryption, but it does not ring true that all transmissions would have to be encrypted or that the main, unencrypted talkgroup would have to be taken down to make the switch.

The emergency manager stated: "In order to change the channel to encrypted, we had to get off of it. We didn't want to use the channel while they were working on it." According to an email sent by the sheriff, this "work" would take about two weeks, and all police transmissions would have to be moved to the old, secondary encrypted talkgroup during that period. The undersheriff was quoted as saying the original main talkgroup would be encrypted when that work by state operators of KSICS system was completed in two weeks.

None of this rings true to us, but you folks are the experts. It seems to us that what's needed is for AES-256 firmware and encryption keys to be installed in individual radios, and this could be done piecemeal rather than making a sudden shift to an old encrypted talkgroup. We also don't see why tower operations would be involved. A talkgroup sends whatever is transmitted to it, whether it's encrypted or not, right? If encryption happened at the tower level, it would be possible to eavesdrop by intercepting unencrypted transmissions to the tower that the tower would then encrypt.

All of this has special meaning because critics of the sheriff contend he may have timed the shift as a payback of sorts to coincide with the initial court appearance that very day of a former local chief whom the sheriff had recommended for the job but was suspended, then quit, and now faces felony charges after organizing a now-disavowed raid on a newsroom 14 months ago.

Can anyone help us with sorting through the technical part of this so we can see whether there might be any truth to that rumor if there are half-truths or deceptions about other parts of the encryption story?
 

firefive76

Member
Joined
Jun 4, 2008
Messages
447
Location
Kansas
It sounds like they have switched to the secondary talkgroup while they program the encryption into each radio for the primary talkgroup. They may be planning a two-week period to do the necessary updating. The state does not allow a talkgroup to be clear and allow encrypted transmissions. Talkgroups are strapped to either clear or encrypted, thus a radio that has received its encrypted programming can no longer transmit on a clear talkgroup. Once they get all of their programming finalized, the state can then switch the primary talkgroup to encrypted.
 

kayn1n32008

ØÆSØ Say it, say 'ENCRYPTION'
Joined
Sep 20, 2008
Messages
6,806
Location
Sector 001
Marion County law enforcement abruptly shifted to an encrypted talk group Oct. 7, but the rationale doesn't ring true. I'm hoping someone with expertise in P25 / KSICS can explain.

According to published news reports, officials initially said a radio supplier was "working on" the main talkgroup and it became unreliable, forcing use of the encrypted talkgroup. This didn't seem true both the radio supplier denied working on the talkgrounp and because recordings immediately before the switch indicated no problems and some normal traffic was recorded after the switch.

The stated reason then became that the county needed to go 100% encrypted because of an FBI edict to encrypt information coming from one of its databases. We already know that's not true. The FBI requirements could be met by using the encrypted secondary talkgroup already available to all county units. Radios would have to receive upgraded firmware for employ AES-256 encryption, but it does not ring true that all transmissions would have to be encrypted or that the main, unencrypted talkgroup would have to be taken down to make the switch.

The emergency manager stated: "In order to change the channel to encrypted, we had to get off of it. We didn't want to use the channel while they were working on it." According to an email sent by the sheriff, this "work" would take about two weeks, and all police transmissions would have to be moved to the old, secondary encrypted talkgroup during that period. The undersheriff was quoted as saying the original main talkgroup would be encrypted when that work by state operators of KSICS system was completed in two weeks.

None of this rings true to us, but you folks are the experts. It seems to us that what's needed is for AES-256 firmware and encryption keys to be installed in individual radios, and this could be done piecemeal rather than making a sudden shift to an old encrypted talkgroup. We also don't see why tower operations would be involved. A talkgroup sends whatever is transmitted to it, whether it's encrypted or not, right? If encryption happened at the tower level, it would be possible to eavesdrop by intercepting unencrypted transmissions to the tower that the tower would then encrypt.

All of this has special meaning because critics of the sheriff contend he may have timed the shift as a payback of sorts to coincide with the initial court appearance that very day of a former local chief whom the sheriff had recommended for the job but was suspended, then quit, and now faces felony charges after organizing a now-disavowed raid on a newsroom 14 months ago.

Can anyone help us with sorting through the technical part of this so we can see whether there might be any truth to that rumor if there are half-truths or deceptions about other parts of the encryption story?
1 all radios would need to be programmed. This would need to be either by touching each radio, or via OTAP.

2 If a new key is to be used, then it needs to be added to the KMF(if one is used) or loaded Into each radio. If OTAR is used, then each radio needs to be rekeyed over the air.

3 encryption both encrypting and decrypting, is done in the radio and in the consol. The repeater sites, simply pass the comms through, unchanged, except for applying error correction to the incoming signal. The repeaters do not decrypt or encrypt any comms. It is end to end encrypted. Radio to radio or consol to radio or radio to consol.

4 Firmware shouldn't need to be updated, nor does the MACE/UCM if they are already using using encryption.
 

kayn1n32008

ØÆSØ Say it, say 'ENCRYPTION'
Joined
Sep 20, 2008
Messages
6,806
Location
Sector 001
The stated reason then became that the county needed to go 100% encrypted because of an FBI edict to encrypt information coming from one of its databases. We already know that's not true.

Unless the agency uses a dedicated info talkgroup to run names databases, it is just KISS to encrypt full time.

Locally, back in my cities provoice days, when an incident kicked off like a chase, all uninvolved units were moved to a tac channel to leave the main channel clear for those involved in the incident. Much easier for uninvolved units to change channels than getting units in a chase to change.

The FBI requirements could be met by using the encrypted secondary talkgroup already available to all county units. Radios would have to receive upgraded firmware for employ AES-256 encryption, but it does not ring true that all transmissions would have to be encrypted or that the main, unencrypted talkgroup would have to be taken down to make the switch.
Updates probably are not needed if they are already using encryption.

If the main channel is unencrypted, then it would probably need to be taken out of service in order to reprogram consoles to have that talkgroup encrypted.
 
Top