PPSTN - Provincial Public Safety Telecommunications Network - System Updates

[Mobby1-Kenobby]

What's this member been seeing.

October 15, 2023.
Unitrunker 2 decoding PPSTN P25 voice channel ISP messages reveals the RCMP F-Division AES Key ID is 0039.

11:42:27.188 047 A ESW MI D2D4D6 A0B150 286500 AES KID 0039 ok.(A260 Indian Head on TG 18).
11:42:27.357 047 5 LC 00 00 44 00 00 12 21 C0 8B Group Voice Channel User I 21C08B G 0012 (4 priority, packet protected) ok.
11:42:30.863 047 A ESW MI 9824B7 F9C23A B45100 AES KID 0039 ok.(Regina DOC on TG 18).
11:42:31.061 047 5 LC 00 00 44 00 00 12 21 DB FE Group Voice Channel User I 21DBFE G 0012 (4 priority, packet protected) ok.
11:42:31.227 047 A ESW MI EFACDF 411730 AE9B00 AES KID 0039 ok.
11:42:31.427 047 5 LC 00 00 44 00 00 12 21 DB FE Group Voice Channel User I 21DBFE G 0012 (4 priority, packet protected) ok.
11:42:33.764 047 A ESW MI EBF438 2C643F CDA700 AES KID 0039 ok.
11:42:33.931 047 5 LC 00 00 44 00 00 12 21 DB FE Group Voice Channel User I 21DBFE G 0012 (4 priority, packet protected) ok.
11:42:34.101 047 A ESW MI 09B210 D1499A 9CAC00 AES KID 0039 ok.
11:42:34.298 047 5 LC 00 00 44 00 00 12 21 DB FE Group Voice Channel User I 21DBFE G 0012 (4 priority, packet protected) ok.
11:42:34.467 047 A ESW MI 2312CC 2D57CF 035300 AES KID 0039 ok.
11:42:34.667 047 5 LC 00 00 44 00 00 12 21 DB FE Group Voice Channel User I 21DBFE G 0012 (4 priority, packet protected) ok.

October 22,
These DELTA member RIDs were on site # 70 Qu'Appelle.
Logins:
08:55:41","Affiliate",162,"RCMP GIS/MCU #2, RID 2211377 Major Crimes Unit-South
08:57:12","Affiliate",162,"RCMP GIS/MCU #2, RID 2213313
08:59:10","Affiliate",162,"RCMP GIS/MCU #2 RID 2216137
08:59:17","Affiliate",162,"RCMP GIS/MCU #2 RID 2211376 Major Crimes Unit-South
Channel Grants:
08:56:55","Group (Enc) TG 162","RCMP GIS #2","2216137
08:59:33","Deny Response: SU: 2211376 (Group Voice Grant): the requesting unit is not valid"
08:59:33","Unit Registration Command -> 2211376"
08:59:33","Unit Registration - SysID: 00A Source ID: 2211376 Working ID: 2211376 Status: Accept"
08:59:34","Group (Enc) TG 162","RCMP GIS #2","2211377
08:59:38","Group (Enc) TG 162","RCMP GIS #2","2211376
08:59:38","Queued TG 162","RCMP GIS #2","2216137
08:59:38","Queued Response - Service Type: Group Voice Grant - Call Options: 0x44 - Group:162 - Target Radio: 2216137 - Reason: : the target group is currently active.
08:59:46","Group (Enc) TG 162","RCMP GIS #2","2216137
08:59:49","Group (Enc) TG 162","RCMP GIS #2","2211376
09:00:09","Group (Enc) TG 162","RCMP GIS #2","2211377
09:02:15","Group (Enc) TG 162","RCMP GIS #2","2216137
09:02:32","Group (Enc) TG 162","RCMP GIS #2","2211377
09:02:36","Group (Enc) TG 162","RCMP GIS #2","2216137
09:02:46","Group (Enc) TG 162","RCMP GIS #2","2211377
09:02:53","Group (Enc) TG 162","RCMP GIS #2","2216137
09:03:31","Group (Enc) TG 162","RCMP GIS #2","2211377
09:03:42","Group (Enc) TG 162","RCMP GIS #2","2216137
09:03:55","Group (Enc) TG 162","RCMP GIS #2","2211377
09:04:11","Group (Enc) TG 162","RCMP GIS #2","2213313
09:04:24","Group (Enc) TG 162","RCMP GIS #2","2211377
09:04:30","Group (Enc) TG 162","RCMP GIS #2","2211376
09:04:38","Group (Enc) TG 162","RCMP GIS #2","2216137
09:04:43","Group (Enc) TG 162","RCMP GIS #2","2211377
09:05:04","Group (Enc) TG 162","RCMP GIS #2","2211376
09:05:09","Group (Enc) TG 162","RCMP GIS #2","2216137
09:05:13","Group (Enc) TG 162","RCMP GIS #2","2211376
09:05:16","Group (Enc) TG 162","RCMP GIS #2","2211376
09:05:20","Group (Enc) TG 162","RCMP GIS #2","2211376
09:05:22","Group (Enc) TG 162","RCMP GIS #2","2211376
09:05:36","Group (Enc) TG 162","RCMP GIS #2","2211376
09:07:11","Group (Enc) TG 162","RCMP GIS #2","2216137
09:07:17","Group (Enc) TG 162","RCMP GIS #2","2211376
10:09:53","Unit Registration - SysID: 00A Source ID: 2211376 Working ID: 2211376 Status: Accept.

October 23,
Unitrunker 2 decoding voice channel P25 ISP messages reveals Saskatchewan Environment CO# 420 Motorola Radio encryption type is AES and the Key ID is 0001.

18:00:11.118 047 A ESW MI B408DD 246319 D8F000 AES KID 0001 ok
18:00:11.315 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:11.484 047 A ESW MI 53EDFB 60C68E A26E00 AES KID 0001 ok
18:00:11.654 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:11.850 047 A ESW MI E7CAB4 197FF4 E2E900 AES KID 0001 ok
18:00:12.019 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:12.217 047 A ESW MI F635F9 719804 784700 AES KID 0001 ok
18:00:12.384 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:12.552 047 A ESW MI FD449F 31900F B81B00 AES KID 0001 ok
18:00:12.750 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:12.920 047 A ESW MI C31018 710DB3 011200 AES KID 0001 ok
18:00:13.118 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:13.287 047 A ESW MI DEE71C E8917D 5D5E00 AES KID 0001 ok
18:00:13.456 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User I 228226 G 1770 (4 priority, packet protected) ok
18:00:14.020 047 A ESW MI CCE0AA 9F4C02 AF8000 AES KID 0001 ok
18:00:14.190 047 5 LC 00 00 44 00 17 70 22 82 26 Group Voice Channel User 228226 = RID 2261542, 1770 = TG 6000 (4 priority, packet protected) ok.
See the zip file for a more detailed look at the voice channel ISP messages from this RID.

It will be interesting to see all of the key IDs that are in use.
The shared common Key ID utilized by the province and the feds?
The SPOOK's Key ID?
This information maybe the "key" to revealing the identity of the unknown users.

October 26,
1:30 pm RID 2261401 = CO280 login on TG 6000.
1:35 pm RID 2261373 = CO373 login on TG 6000.
1:36 pm RID 2261651 = CO154/204/214 Mobile JR/HR47 Shaunavon login TG 6000.
1:38 pm RID 2261619 = CO0441/375/326/518/064 Mobile HR47 Shaunavon login TG 6000.

Cheers.

 

[Mobby1-Kenobby]

Hi, to all.
What this RR member has been seeing and hearing.

October 30,
Most of the new Motorola portable radios are still sending their GPS data to nowhere.
09:13:35 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 81 D7)=TX RID 2261463, 2A 42=CRC.
09:36:19 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 5F 51)=TX RID 2252625, ED 24=CRC.
14:15:23 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 5F 50)=TX RID 2252624, FD 05=CRC.

October 30, these 2 were seen in P25 ISP messages, so CO#0329 was very close to my location.
RID 2261628 CO# 0329 Melville Mobile login on site 71 at 3:50 pm.
RID 2263651 CO# 0329 Melville portable login 3:55 pm.

October 30,
RID 2211223 ERT unit is now a white F250 "camper-special" login on TAC 3 at 4:21 pm.
RID 2214763 (NBCRU) North Battleford Crime Reduction Unit coms on TAC 3.
RID 2212716 CIRT coms on TAC 3.
RID 2212720 CIRT coms on TAC 3.
RID 2211215 ERT commander coms on TAC 3, Black Suburban.
All coms end at 4:28 pm, as the "camper-special" had gone north to the "campsite".
Yes, that ERT unit looks like a truck-camper unit.

November 2,
RID 2263651 CO0329 Melville portable login on site 71 at 3:28 pm.
RID 2261576 CO0337 Melville mobile login 3:33 pm.
RID 2261392 CO0337 Melville portable login 3:33 pm.

November 3,
RID 2261568 CO0432 Hudson Bay mobile login 10:48 am on site 71.
RID 2263651 CO0329 Melville portable login 4:32 pm.
TG 912 RCMP Announce Group at 6:39 pm.

Recently RR member Wolffe asked a question about channel plans, as Unitrunker 2 was showing many incorrect frequencies for P25 sites. I referred to these as ghost-channels as I believed they did not really exist. I have not seen this phenomenon, but what Wolffe’s post did was to encouraged me to share with all of you what I have encountered over the past 5 years.

Some useful information for those utilizing Unitrunker 1 or 2.
P25 packets can arrive with some octets out of their correct sequence and then are decoded by the program to display incorrect RID information.
Examples:
November 3, 2023 at 6:44 pm.
RID 14417953 is HEX = DC 00 21, but was in fact the HEX 21 DC 00 = DEC 2219008 is an RCMP F-Division DOC RID.

May 22, 2018 at 6:48 pm.
RID 2210000 is HEX 21 B8 D0, but was in fact the HEX 21 D0 B8 = DEC 2216120 is an RCMP F-Division GIS DELTA member RID.

November 15, 2022 at 7:57 pm.
RID 2210001 is HEX = 21 B8 D1, but was in fact the HEX 21 D1 B8 = DEC 2216376.
The true RCMP RID start is 2211001 = A591 Regina.

Some other false RID information that may be displayed by the Unitrunker programs are:
RID 222 is the HEX DE, only the last octet of the packet was seen and then decoded on 04/29/2023.
RID 50 is the HEX 32, talk-group is displayed as an RID on 04/10/2018.
RID 10 is the HEX 0A, is the system ID and was displayed as an RID on 02/04/2019.
RID 18 is the HEX 12 is a talk-group displayed as an RID on 09/22/2022.
RID 62 is the HEX 3E and is another talk-group seen as an RID by the program.
RID 80 is the HEX 50 and is yet another talk-group seen as an RID by the program.
RID 65536×256 = 16777216 is an FNE address. The program failed at the mathematics.
RID 65537×256 = 16777472 is another FNE address that the data messages are sent to.

There are other examples, but they are not so easily explained as these were.
Converting the DEC to Hex has helped to decode the mystery RIDs and the number 256 is of very great importance for understanding P25 messaging. The HEX 01 00 = 256 DEC and 256×256×256=16777216. Most of the time Unitrunker will see an error in the packet and then discard the message so that you will not see it.

I hope this has been of some help with understanding the origin of some of those mystery RIDs.

November 6,
RID 2261576 CO0337 Melville Mobile login 10:14 am on site 71.
RID 2213250 is Yorkton portable 18 in unit B466 on TG 50, confirmed by voice 4:19 pm to 4:22 pm. I have been wondering for quite some time, about this group of new RIDs that I had been seeing on the Yorkton talk-group. These were the new Harris portables. They are Yorkton rural and are not Yorkton city.

RID 2213233 Yorkton Portable 01
RID 2213234 Yorkton Portable 02
RID 2213235 Yorkton Portable 03
RID 2213236 Yorkton Portable 04
RID 2213237 Yorkton Portable 05
RID 2213238 Yorkton Portable 06
RID 2213239 Yorkton Portable 07
RID 2213240 Yorkton Portable 08
RID 2213241 Yorkton Portable 09
RID 2213242 Yorkton Portable 10
RID 2213243 Yorkton Portable 11
RID 2213244 Yorkton Portable 12
RID 2213245 Yorkton Portable 13
RID 2213246 Yorkton Portable 14
RID 2213247 Yorkton Portable 15
RID 2213248 Yorkton Portable 16
RID 2213249 Yorkton Portable 17
RID 2213250 Yorkton Portable 18 Regina DOC called, “Yorkton 18”.
RID 2213251 Yorkton Portable 19
RID 2213252 Yorkton Portable 20

November 9,
From 2:01 pm to 2:34 pm lots of coms on TAC 5 from these RIDs, but they were not around my location. NBCRU?
RID 2214359 seen on TG 45 for the EQINOP on September 21, 2023.
RID 2214781
RID 2214783
RID 2214829
RID 2214831
RID 2214832
RID 2214833

Until the next time, Cheers!

 

[Mobby1-Kenobby]

What this RR member has been hearing and seeing recently.

November 15, 2023
RID 2212230 is E300/E335/C9410/C9239 Radio Techs login at 12:09 pm on talk-group 37, Hits 1.
RID 2212231 on talk-group 202, some unencrypted testing seen bellow in a P25 ISP voice message.
There were many voice messages with this being the final one, followed by 4 Call Terminations and
then 31 never seen before, Reserved for Harris messages to the FNE, followed by 4 Call Terminations.
(0A=10=System ID, A4=164=Harris, 00, FF FF FC=16777212=FNE ID, 21 C1 87=2212231=RID)

12:14:12.791 047 A ESW MI 000000 000000 000000 Unencrypted KID 0000 OK
12:14:12.824 047 5 Cell Fix 1: 197 0 61B 0 472 0 267 0 03F 0 2B5 0 29C 0 15 e 0
12:14:12.859 047 5 Cell Fix 2: 627 0 327 0 3E3 0 5F6 0 7C0 0 469 0 2F2 0 34 e 0
12:14:12.859 047 5 Cell Fix 3: 66F 0 177 0 68F 0 CDE 0 7C6 0 060 0 5FB 0 10 e 0
12:14:12.892 047 5 Cell Fix 4: 627 0 375 0 2A6 0 CA8 0 7C4 0 696 0 276 0 0C e 0
12:14:12.892 047 5 Cell Fix 5: 5AE 0 D52 0 156 0 1D5 0 7CC 0 301 0 45A 0 0E e 0
12:14:12.925 047 5 Cell Fix 6: 52E 0 4F5 0 506 0 E63 0 780 0 085 0 212 0 17 e 0
12:14:12.925 047 5 Cell Fix 7: 4EC 0 5F5 0 BA1 0 2CB 0 780 0 6AA 0 268 0 0B e 0
12:14:12.959 047 5 Cell Fix 8: 4E5 0 E36 0 E8A 0 96A 0 783 0 07A 0 2E6 0 11 e 0
12:14:12.990 047 5 Cell Fix 9: 4DC 0 EBC 0 64F 0 024 0 783 0 7EF 0 23B 0 38 e 0 LSD 00
12:14:12.990 047 5 LC 00 00 04 00 00 CA 21 C1 87 Group Voice Channel User I 21C187 G 00CA (4 priority, packet) OK
12:14:13.004 047 A Cell Fix 10: 4DB 0 F66 0 9C9 0 C49 0 682 0 414 0 2E1 0 30 e 0
12:14:13.026 047 A Cell Fix 11: 4DA 0 DBB 0 2C0 0 6A2 0 400 0 120 0 17E 0 21 e 0
12:14:13.059 047 A Cell Fix 12: 190 0 87F 0 668 0 71B 0 031 0 24E 0 563 0 0D e 0
12:14:13.059 047 A Cell Fix 13: 193 0 A1B 0 321 0 3A1 0 035 0 4A6 0 550 0 39 e 0
12:14:13.092 047 A Cell Fix 14: 196 0 623 0 634 0 C7A 0 03B 0 348 0 3A6 0 21 e 0
12:14:13.092 047 A Cell Fix 15: 190 0 877 0 DC2 0 B7C 0 03C 0 4F9 0 67F 0 19 e 0
12:14:13.126 047 A Cell Fix 16: 197 0 20B 0 1A3 0 0AD 0 034 0 0D7 0 44A 0 19 e 0
12:14:13.126 047 A Cell Fix 17: 192 0 83F 0 76C 0 EFA 0 02A 0 7A9 0 1B8 0 01 e 0
12:14:13.159 047 A Cell Fix 18: 191 0 A5B 0 B98 0 27B 0 027 0 5A7 0 242 0 31 e 0 LSD 00
12:14:13.159 047 A ESW MI 000000 000000 000000 Unencrypted KID 0000 OK
12:14:13.192 047 5 Cell Fix 1: 194 0 06F 0 CF6 0 087 0 027 0 35F 0 3EE 0 21 e 0
12:14:13.192 047 5 Cell Fix 2: 192 0 83F 0 7F4 0 E02 0 01B 0 6A8 0 0FD 0 25 e 0
12:14:13.225 047 5 Cell Fix 3: 195 0 04F 0 85A 0 7CF 0 011 0 712 0 745 0 3D e 0
12:14:13.258 047 5 Cell Fix 4: 192 0 A3B 0 709 0 7E9 0 013 0 536 0 0C2 0 21 e 0
12:14:13.258 047 5 Cell Fix 5: 194 0 0EE 0 6EC 0 413 0 013 0 5EE 0 29A 0 21 e 0
12:14:13.291 047 5 Cell Fix 6: 197 0 20B 0 0A2 0 467 0 013 0 4FE 0 26F 0 31 e 0
12:14:13.294 047 5 Cell Fix 7: 191 0 85F 0 B74 0 BD2 0 01D 0 439 0 5B0 0 19 e 0
12:14:13.326 047 5 Cell Fix 8: 040 0 CFD 0 7BF 0 B7D 0 793 0 6CF 0 33C 0 22 e 0
12:14:13.326 047 5 Cell Fix 9: 040 0 CFD 0 7BF 0 B7D 0 793 0 6CF 0 33C 0 22 e 0 LSD 00
12:14:13.326 047 5 LC 00 00 04 00 00 CA 21 C1 87 Group Voice Channel User I 21C187 G 00CA (4 priority, packet) OK
12:14:13.392 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:13.425 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:13.459 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:13.527 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:21.405 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.469 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.505 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.670 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.706 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.769 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.805 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.839 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.903 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.939 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:21.973 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.038 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.073 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.106 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.173 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.206 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.242 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.306 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.340 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.373 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.439 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.474 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.539 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.574 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.606 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.674 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.706 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.739 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.806 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.838 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.874 047 F LC 0A A4 00 FF FF FC 21 C1 87 Reserved (ok)
12:14:22.974 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:23.006 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:23.074 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK
12:14:23.106 047 F LC 4F 00 00 00 00 00 21 C1 87 Call Termination / Cancellation I 21C187 OK

November 16,
RID 2211146 login site 72 at 6:51 am and then onto site 71 an hour later on PA TG 70.
This RID was on site 71 TG 70 until 5:13 pm and then logs onto site 72 at 5:33 pm.
There was a trailer on the east side, that burnt to the ground in the night.
This RID must be the Forensic ID service arson investigator from Yorkton.
The upcoming police report should confirm this.

November 16, from 8:54 am to 10:52 am.
These 9 RIDs were confirmed by voice, many times.
RID 2212110 is C813 FQ TS.
RID 2211979 is A260 IH.
RID 2212099 is A276 FQ is a Chevy Silverado.
RID 2213147 is E390 Yorkton Provo van.
RID 2211984 is A318 IH.
RID 2212118 is FQ5 portable.
RID 2212109 is C812 FQ TS.
RID 2212835 is C704 TS Yorkton.
RID 2211063 is M455 RPS CTS and has only the # 55 on this unit.

November 18,
RID 2244449 Preeceville FD on site 71/72 from 10:44 am to 11 :00 am.
Melville COs utilizing talk-group 6007 TAC 2 for a decoy operation. They were on and then off site 72 in the am.
The same group of RIDs listed before were utilizing TAC 5 again today.

Cheers

 

[wolffe]

Hi, to all.
What this RR member has been seeing and hearing.

October 30,
Most of the new Motorola portable radios are still sending their GPS data to nowhere.
09:13:35 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 81 D7)=TX RID 2261463, 2A 42=CRC.
09:36:19 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 5F 51)=TX RID 2252625, ED 24=CRC.
14:15:23 am P25 ISP opcode=92 00, (00 00 00 00)=RX address is blank, 00, (22 5F 50)=TX RID 2252624, FD 05=CRC.

October 30, these 2 were seen in P25 ISP messages, so CO#0329 was very close to my location.
RID 2261628 CO# 0329 Melville Mobile login on site 71 at 3:50 pm.
RID 2263651 CO# 0329 Melville portable login 3:55 pm.

October 30,
RID 2211223 ERT unit is now a white F250 "camper-special" login on TAC 3 at 4:21 pm.
RID 2214763 (NBCRU) North Battleford Crime Reduction Unit coms on TAC 3.
RID 2212716 CIRT coms on TAC 3.
RID 2212720 CIRT coms on TAC 3.
RID 2211215 ERT commander coms on TAC 3, Black Suburban.
All coms end at 4:28 pm, as the "camper-special" had gone north to the "campsite".
Yes, that ERT unit looks like a truck-camper unit.

November 2,
RID 2263651 CO0329 Melville portable login on site 71 at 3:28 pm.
RID 2261576 CO0337 Melville mobile login 3:33 pm.
RID 2261392 CO0337 Melville portable login 3:33 pm.

November 3,
RID 2261568 CO0432 Hudson Bay mobile login 10:48 am on site 71.
RID 2263651 CO0329 Melville portable login 4:32 pm.
TG 912 RCMP Announce Group at 6:39 pm.

Recently RR member Wolffe asked a question about channel plans, as Unitrunker 2 was showing many incorrect frequencies for P25 sites. I referred to these as ghost-channels as I believed they did not really exist. I have not seen this phenomenon, but what Wolffe’s post did was to encouraged me to share with all of you what I have encountered over the past 5 years.

Some useful information for those utilizing Unitrunker 1 or 2.
P25 packets can arrive with some octets out of their correct sequence and then are decoded by the program to display incorrect RID information.
Examples:
November 3, 2023 at 6:44 pm.
RID 14417953 is HEX = DC 00 21, but was in fact the HEX 21 DC 00 = DEC 2219008 is an RCMP F-Division DOC RID.

May 22, 2018 at 6:48 pm.
RID 2210000 is HEX 21 B8 D0, but was in fact the HEX 21 D0 B8 = DEC 2216120 is an RCMP F-Division GIS DELTA member RID.

November 15, 2022 at 7:57 pm.
RID 2210001 is HEX = 21 B8 D1, but was in fact the HEX 21 D1 B8 = DEC 2216376.
The true RCMP RID start is 2211001 = A591 Regina.

Some other false RID information that may be displayed by the Unitrunker programs are:
RID 222 is the HEX DE, only the last octet of the packet was seen and then decoded on 04/29/2023.
RID 50 is the HEX 32, talk-group is displayed as an RID on 04/10/2018.
RID 10 is the HEX 0A, is the system ID and was displayed as an RID on 02/04/2019.
RID 18 is the HEX 12 is a talk-group displayed as an RID on 09/22/2022.
RID 62 is the HEX 3E and is another talk-group seen as an RID by the program.
RID 80 is the HEX 50 and is yet another talk-group seen as an RID by the program.
RID 65536×256 = 16777216 is an FNE address. The program failed at the mathematics.
RID 65537×256 = 16777472 is another FNE address that the data messages are sent to.

There are other examples, but they are not so easily explained as these were.
Converting the DEC to Hex has helped to decode the mystery RIDs and the number 256 is of very great importance for understanding P25 messaging. The HEX 01 00 = 256 DEC and 256×256×256=16777216. Most of the time Unitrunker will see an error in the packet and then discard the message so that you will not see it.

I hope this has been of some help with understanding the origin of some of those mystery RIDs.

November 6,
RID 2261576 CO0337 Melville Mobile login 10:14 am on site 71.
RID 2213250 is Yorkton portable 18 in unit B466 on TG 50, confirmed by voice 4:19 pm to 4:22 pm. I have been wondering for quite some time, about this group of new RIDs that I had been seeing on the Yorkton talk-group. These were the new Harris portables. They are Yorkton rural and are not Yorkton city.

RID 2213233 Yorkton Portable 01
RID 2213234 Yorkton Portable 02
RID 2213235 Yorkton Portable 03
RID 2213236 Yorkton Portable 04
RID 2213237 Yorkton Portable 05
RID 2213238 Yorkton Portable 06
RID 2213239 Yorkton Portable 07
RID 2213240 Yorkton Portable 08
RID 2213241 Yorkton Portable 09
RID 2213242 Yorkton Portable 10
RID 2213243 Yorkton Portable 11
RID 2213244 Yorkton Portable 12
RID 2213245 Yorkton Portable 13
RID 2213246 Yorkton Portable 14
RID 2213247 Yorkton Portable 15
RID 2213248 Yorkton Portable 16
RID 2213249 Yorkton Portable 17
RID 2213250 Yorkton Portable 18 Regina DOC called, “Yorkton 18”.
RID 2213251 Yorkton Portable 19
RID 2213252 Yorkton Portable 20

November 9,
From 2:01 pm to 2:34 pm lots of coms on TAC 5 from these RIDs, but they were not around my location. NBCRU?
RID 2214359 seen on TG 45 for the EQINOP on September 21, 2023.
RID 2214781
RID 2214783
RID 2214829
RID 2214831
RID 2214832
RID 2214833

Until the next time, Cheers!

Great information, thanks Mobby 1

 

[ve5wil]

Morning all - at 8:47 this morning , tg 384 (assume Tower radio) popped on with the id 2213484. there were 5 consecutive transmissions of what sounded like a lower end digital alarm. ( 5 or so tones stepping up up then down).

 

[Mobby1-Kenobby]

November 20,


The first thing that I must do is thank RR member Wolffe for sharing that Unitrunker 2 xml file.
Thank you so much for sharing that file with me, Wolffe!
Lots of great RID location information in there.
I'm finding even more valuable data every time I take a look at it.
Thanks again!

Wil, that's a radio tech utilizing that site radio along with his testing equipment on that talk-group.
I hear those same sounds at my location, thanks for the update.

November 23,
RID 2216462 is a member of the (STRT) located in Swift Current.
Talk-group 180 is (STRT) Saskatchewan Trafficking Response Team.
There is a (CRT) Crime Reduction Team located in Moose Jaw and we require RID and TG information for this team.
We are looking to our well known and trusty RR Wil, in MJ for help with this.

November 25 pm,
The Decoy Operation
Saskatchewan Environment conservation officers from Melville, Weyburn and Fort Qu'Appelle were all on TG 6006 SE TAC1 at 3:14 pm.
RID 2261463 CO0415 portable FQ
RID 2261606 C00415 mobile FQ
RID 2261649 CO0275 mobile Weyburn
RID 2261593 CO0339 mobile Melville
RID 2261499 CO0339 portable Melville
The operation did not take place within the footprint of site 71 or site 72 and was over at 6:00 pm.
At 1:30 pm I was traveling north on the #35 highway and just to the south of Lipton I met a south bound
SE white unmarked Ford F250SD. I thought that this was CO0415, but after looking at the Unitrunker data,
logins, joins and logouts, it could have only been CO0275.

 

[Mobby1-Kenobby]

Hi to all of you.

I will start by asking a couple of questions. Can a P25 system get a virus? What would that look like?

I have recently discovered a very unusual control channel OSP message being broadcast from both PPSTN sites 71 (47) and 72 (48).

Unitrunker 2 sees the unusual message (UM) and then discards it. I do understand why the program is discarding this UM. The UM is labelled as Harris but the MFID A4 is not seen in the message. This UM is seen at regular intervals and appears to be an "extension" of the (SSB) system service broadcast message.

If this is a new (Extended) system service broadcast (SSB-E) message, that explains why it is being broadcast by all of the PPSTN sites. I have been trying to understand what this new “addition” (UM) is all about. Bellow you can see the UM as it occurs just after the SSB, but then there are 33 SSB messages without the UM following them and then the 34th SSB message is again followed by the UM. Then there are 33 SSB messages without the UM following them.

Message as seen on PPSTN site 71 = 47. Unedited version.
18:03:49.287 047 C 37 FD 00 47 30 0A 81 3A 00 00 00 A6 RFSS Status Broadcast (Extended) Sys 00A Sub 47 Site 47 TX 0-105(139.30500) RX 0-2F1(141.76500)(data,voice,registration)
18:03:49.287 047 C -47 47 01 05 02 F1 70 00 B9 13 3A D4
18:03:49.352 047 C 37 FD 00 47 00 0A 81 3B 00 00 18 1A Network Status Broadcast (Extended) WACN 0000A Sys 00A TX 0-105(139.30500) RX 0-2F1(141.76500)(data,voice,registration)
18:03:49.352 047 C -00 00 A0 01 05 02 F1 70 19 C7 61 1E
18:03:49.387 047 7 -B4 00 05 00 00 28 01 A5 24 80 22 30 Identifier Update 0 Base 138000000 Spacing 5000 Tx Offset 0
18:03:49.420 047 7 -B8 00 04 0F 2C 08 0F 2C 08 01 FB 98 System Service Broadcast Set Normal Available 0F2C08 Supported 0F2C08 WID 12.0 hours Priority 1
18:03:49.520 047 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded <<----------------UM Unusual Message.
18:03:49.556 047 7 -A9 00 47 47 00 DB 00 00 01 04 5A 00 Secondary Control Channel Broadcast Explicit Sub 47 Site 47 TX 0-0DB(139.09500) RX 0-001(138.00500) (backup control channel only)

See timing of the UM. Edited version.
18:03:54.562 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:03:59.570 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:04.576 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:09.585 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:14.624 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:19.632 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:24.676 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:29.714 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:34.757 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:04:44.772 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:09.845 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:14.853 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:19.859 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:24.898 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:29.907 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:34.915 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:39.990 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:44.999 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B
18:05:50.041 -D5 D6 54 5A D5 59 57 5A 47 7A 47 6B

Timing of the UM as seen on site 72 = 48. Unedited version.
16:42:20.165 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:24.743 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:27.313 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:32.321 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:34.923 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:42.402 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:46.442 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:47.412 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:51.750 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:52.952 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:54.122 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:42:57.462 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:43:02.470 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:43:05.307 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:43:07.075 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:43:52.750 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:43:57.759 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded
16:44:02.767 048 7 E-D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded

Update: Unitrunker is now showing the UM as: Standard Discarded. Harris is no longer seen after the message.

This may be nothing more than a P25 system messaging failure, but if it is, why have they done nothing about it? When change occurs, this is how it first appears.

Now on to other things.

December 6, SHP was heard, unencrypted, then on the 11th, heard coms from SE Dispatch, and then on the 18th open P25 coms heard from DOC on TG 18.

December 20, at 6:50 am RID 2214836 ERT/CIRT black F250 SD (no camper cap) is seen on TAC 3 site 72 and then on site 71 at 7:14 am, followed by a logout at 7:23 am.

December 22, at 5:30 pm RIDs 2215420 and 2212458 the link RID to Flin Flon are on TG 116. At 6:30 pm RIDs 2242283 and 2242284 are on DELTA 1, site 72.
I suspect that these and some of the other 22422## RIDs are utilized by the Firefighter Training Facility at Melville.

December 23, the unusual message is still being sent on those sites.

Cheers.

 

[Mobby1-Kenobby]

Hi, it's me again. I believe it's time for sharing.

I have been utilizing Unitrunker 2 to decode PPSTN site control channel OSP messages along with the ISP messages being sent by the SUs on the system.

Unitrunker 2 was designed to decode control channel OSP messages, but not the ISP messages.
Most of the ISP messages are not labelled or are labelled as unknown, as the author of Unitrunker 2 has not include ISP decoding in the program.
The sharing of knowledge about P25 ISP opcodes could be used by Unitrunker's author to improve the program's decoding capabilities.

This is a list of 10 ISP opcodes utilized by the PPSTN that Unitrunker 2 is unable
to decode: 0x17, 0X23, 0x36, 0x92, 0x93, 0x98, 0xA3, 0xA4, 0xAB, and 0xAD.

Unitrunker 2 ISP message errors seen in other partially decoded messages:
Message has the opcode incorrectly labelled.
Message labelled as a Response, but is in fact be a Request.
Message labelled as Grant, but is in fact be a Request.
Message labelled as Update, but is in fact be a Request.
Message labelled as a Command, but is in fact be a Request.

Examples of incorrect/false ISP messages decoded by Unitrunker 2:
opcode = 0x8A = Telephone Incoming Request, Harris, (Caller ID).
opcode = 0x08 = TELE INT DIAL REQ, Harris, (Telephone Voice Grant).
No telephone voice grant OSP messages have ever been seen on the PPSTN.

In addition to all of those, Unitrunker 2 will not always display the RID, TG and FNE information correctly.

Some ISP opcodes are "Reserved" for future use or special purpose, so they will be unknown until we discovered their purpose.
There is always a very high inbound packet message error rate, but the more time that I spend doing this, I learn to recognize those errors.
I look at both the ISP request messages and the OSP response messages at the same time to decode the unknown ISP messages.
Making my task even more difficult are those ISP messages having being sent and never seeing a visible response message from the network.

But I have discovered what those 10 unknown ISP opcodes are used for and labeled them.
This list contains 13 opcodes with the first opcode 0x17 message being (Extended 01.1) and it shows the previous radio site ID the RID was registered on.
The opcode 0x17 message is seen when an RCMP Zone 3 (East-Central) SU travels outside of it's home Zone and into Zone 4 (South).

01 is opcode = 0x17 = Unit Extended Function Command, Response, FD 00, 21 CC E6 = RID 2215142, 81 2D 00 00, C7 1F = CRC-->
01.1 is (Extension), A0 0A = WACN System ID, 21 CC E6 = RID 2215142, 48 = site #72, 00 32 = TG 50, D5 9C CA 8C = CRC
02 is opcode = 0x23 = Unit Cancel Service Request, 08 00, 21 C1 06 = RID 2212102 80 00 00 00, D2 D3.
03 is opcode = 0x36 = Unit Roaming Address Request, 00 00 00 00, (9F FC), 22 5E DE = RID 2252510, 99 64 = CRC.
04 is opcode = 0x80 = Unit Group Voice Channel Request, 00 04 = Unprotected, 00 00, 14 07 = TG 5127, 22 5F 72 = 2252658, 60 25 = CRC.
05 is opcode = 0x92 = Unit Data Channel Request, 00 01 00 01 00 = FNE 16777472, 00 21 C1 05 = RID 2212101, 97 92 = CRC.
06 is opcode = 0x93 = Unit Cancel Data Service Request, 00 01 20 00 01 00 = 18874369 FNE, 21 C2 B1 = RID 2212529, A7 4A = CRC.
07 is opcode = 0x98 = Unit Status Message, 00 01 00 = is used to call the RCMP DOC, FF FF FC = FNE 16777212, 21 C1 03 = RID 2212099, F8 5A = CRC.
08 is opcode = 0xA3 = Unit Cancel Service Request, 00 12 20 00 00 00, 22 82 26 = RID 2261542, 9E 15 = CRC.
09 is opcode = 0xA4 = Unit Extended Function Radio Check Command, Response (not to be confused with the Harris MFID 0xA4)
10 is opcode = 0xA8 = Unit Group Affiliation Request, 00 00 00 0A 00, 12 = TG 18, 21 C1 15 = RID 2212117, CE 47 = CRC.
11 is opcode = 0xAB = Unit De-Registration Request, 00 00 00 00 A0 0A = WACN System ID = 10, 21 C1 02 = RID 2212098, 2F 5C = CRC
12 is opcode = 0xAC = Unit Global Registration Request, 00 00 00, 00 A0 0A = WACN System ID = 10, 22 5F 53 = RID 2252627, 1B C6 = CRC.
13 is opcode = 0xAD = Unit Location Registration Request, 00 00 00, 47 = site 71, 00 12 = TG 18, 21 C1 03 = RID 2212099, 5A 93 = CRC.



Moving on to look at the PPSTN Data Services.

Utilizing Unitrunker 2, as intended for decoding the OSP control channel messages I see 2 to 3 or more messages together and all are labelled as data.
Those are just data channel grants, Unitrunker 2 does not display any "real" information about those data messages.

To get a greater understanding of what those multi-block (extended) data messages are, I look at the ISP messages sent by the SUs.

The data message sender's RID and the destination FNE address are sent by an SU on the RX input control channel frequency.
Example:
92 00 00 00 00 00 00 21 C2 D0 5B 6A, no destination FNE address, sender's RID is 2212560.
This message is followed by an unknown message to nowhere on a voice channel.
92 00 01 00 01 00 00 21 C2 D0 59 19, 16777472 is FNE address, followed by RID of the sender.
This message is followed by an unencrypted data message.
92 00 01 00 01 00 00 21 C2 D0 59 19, 16777472 is FNE address, followed by RID of the sender.
This message is followed by an AES data message.

The following messages are sent on the RX input side of a voice channel. The FNE address is never seen in these messages.

A Motorola Fire Department SU data message (Extended).

All the messages sent by this and all the other FD/EMS SUs never contain the FNE address, so those messages go nowhere.
56 C6 00 22 3B D4 81 02 68 00 CB 9F, the sender's RID is 2243540, ALGID is DES along with one of the 10 different Key IDs.
0B C2 1C 00 00 02 00 00 00 14 EF AA, unknown message to nowhere.
03 0B 00 22 3B D4 80 00 00 00 CB 6C, the sender's RID is sent again, but this time there is no AGID = unencrypted, no Key ID.
63 60 41 55 46 6B 63 41 5D 73 06 47, data, unknown, as this base station RID is not equipped with a GPS antenna.
These messages are never followed by any Cancel Service Request messages, as no FNE address was in the opcode 0x92 message.

A Harris RCMP SU data message (Extended).

The first message sent by this and all of the RCMP SUs never contains the FNE address, so those messages go nowhere.
56 C6 00 21 C1 08 81 02 58 00 BD FF, the sender's RID is 2212104, ALGID is DES with one of the 10 different Key IDs in use.
0B C2 1C 00 00 02 00 00 00 14 EF AA, unknown message to nowhere and is not followed by a Cancel Service message, as no FNE address was in the 0x92 message.
The second message is sent to FNE address 16777472.
03 0F 00 21 C1 08 80 00 00 00 24 76, the sender's RID is sent again, but this time the message is unencrypted, no key.
51 46 41 60 52 75 51 59 69 64 30 55, GPS location data that is followed by a Cancel Service Request, opcode 0xA3 message.
The third message is again sent to the same FNE address 16777472.
56 C0 00 21 C1 08 84 02 08 02 75 CF, the sender's RID is sent again, ALGID is AES with one of the 10 different Key IDs being used.
09 94 09 FC 02 44 7E 00 22 19 02 EC, encrypted GPS location message is then cancelled by an opcode 0X93 message.

So what did I discover?

All of the radios on the PPSTN utilize encryption for data services.
These radios appear to have been delivered with DES as the default algorithm for data transmission.
The DES having been supplanted by the AES that is currently utilized, and we see the same 10 DES Key IDs
appear to have just been reused for the AES. Yes, the same Key IDs, but with the upgraded (longer) Keys used by the AES.
PPSTN data services appear to have a far greater level or protection than voice services.
The data messages that are sent to the FNE are both unencrypted and encrypted utilizing AES.
And yes, the first part of this data message is unencrypted but because the second part of the
message is encrypted, this makes the decoding the competed message impossible for those on the outside.

Looking at this mix of messages and encryption algorithms, I can only conclude that no effort was made to first delete and then replace.
This helps to explains why I am seeing three different Cancel Service Request opcode messages, following the mix of data messages on the system.
This is akin to upgrading a PC with a new software program, but failing to delete the old software program, because we were afraid of what might happen.

And then there's this unusual OSP message: D5 D6 54 5A D5 59 57 5A 47 7A 47 6B Harris Discarded.
It is now all over the place, frequently following almost any control channel message.

The PPSTN com-techs appear to have mixed and messed things up, but the top-floor management team is far too dim to comprehend it.

Cheers and do remember to share.

 

[wolffe]

Happy New Year to everyone.

Wow Mobby great information as always. Its going to take some time for me to go through it.

TG 5502 is a group that I kept seeing but was never able to get an ID on. As is turns out it is JCH Jim Pattison's Childrens Hospital. They work out of the RUH. Both regular EMS and STARS have been seen on it.

Still looking for the residents of these TG's

5473 I have seen Medavie EMS on it
5493 I have seen STARS on it.

Unknowns all EMS TG's

5141
5144
5145
5146
5168
5171
5174
5180
5119
5232
5234
5241
5261
5299
5368
5369
5385
5304
5314
5341
5342
5493

Not much for other activity, a few chases involving air support. It seems that no matter what direction from Saskatoon the chase is, the same IDs are showing up, I am following up on that to see if these IDs are a special unit.

Thank you Mobby for your dedication, you are helping us all to understand the system more.

 

[Mobby1-Kenobby]

Hi to all.

What I have been seeing.

Jan 21, RID 2212103 A283 is repeatedly Denied from the network, unit has not been used for many weeks and now I see why.
Jan 21, RIDs 2212713 CIRT Sierra 3 and 2214836 E240 ERT, on sites 71 and 72 from 4:25 to 5:25 pm.
Jan 22, RIDs 2263357 SHP and 2211837 C622 both are out of Swift Current, on site 72 from 2:41 to 3:27 pm.

Jan 22, Harris Super-Group patch 2043, 00=No Key, 80=Open, Public Talk-Groups 152 to 155. It lasted about 60 seconds.
16:31:42.711 047 7 -B0 A4 78 07 FB 00 00 80 00 98 EE 96 Harris Patch Super 07FB adds G 0098 status 78
16:31:43.178 047 7 -B0 A4 78 07 FB 00 00 80 00 99 FE B7 Harris Patch Super 07FB adds G 0099 status 78
16:31:43.279 047 7 -B0 A4 78 07 FB 00 00 80 00 9A CE D4 Harris Patch Super 07FB adds G 009A status 78
16:31:43.343 047 7 -B0 A4 78 07 FB 00 00 80 00 9B DE F5 Harris Patch Super 07FB adds G 009B status 78

Commands to end patches:
16:32:08.250 047 7 -B0 A4 00 07 FB 00 00 00 00 00 79 AB Harris Patch Other
16:32:08.284 047 7 -B0 A4 00 07 FB 00 00 00 00 00 79 AB Harris Patch Other
16:32:08.319 047 7 -B0 A4 00 07 FB 00 00 00 00 00 79 AB Harris Patch Other

Jan 23, Harris Super-Group patch 2044, 37=Key ID, 84=AES, Encrypted Talk-Groups 6225 and 76. In place for many hours.
12:37:10.841 047 7 -B0 A4 79 07 FC 00 37 84 18 51 02 BF Harris Patch Super 07FC drops G 1851 status 79
12:37:10.908 047 7 -B0 A4 79 07 FC 00 37 84 00 4C 4B F9 Harris Patch Super 07FC drops G 004C status 79
The Talk-Group 76 is utilized by Lloydminster and is frequently patched to Talk-Group 6225.

Is the Talk-Group 6225 used to connect the PPSTN to the Alberta P25 system?

Calling all Alberta RR members, what are you seeing over there?
This patch is still in place as I post this.
Encrypted patches are only seen in the Unitrunker 2 logging file.

Cheers.

 

[wolffe]

Hmmm, interesting I have been looking for a TG like that. I talked to someone in Lloyd (I forget his name) if he knew of any link from Alberta to Lloyd about a year ago and he hadn't seen anything like that. His thought was that the border RCMP had a radio that covered both systems. I looked it up and they do make radios that does that split so I dropped it. When the Onion Lake manhunt was on I saw a lot of activity that I didn't recognize, but it was summer and I didn't have the time to go through it. I will try to look back on that date.

The units I have seen on 6225 is RID 2214120
6227 2211712
6229 2213955
2213352
6230 2214153
2213776

On TG 2044 all I have seen is Wynyard EMS 2 different units.

If 6225 was a link to Alberta could the other TGs be links from Alberta and Manitoba? I always thought that there would be multiple sites and TGs linking from different parts of the province. I do know that the border towers have an extend range and run more power, the range is more than double other towers. St Walburg falls in that footprint with a tower from Cold Lake, unfortunately I no longer have coverage there. This summer I will have a station set up that is a lot closer to these sites.

This past Monday the 22nd

2043 added 154 155 152 on tower 19 at 16:31

At 16:31 Tower 34 Warman saw SuperGroup 2043 added TG 153

Site 030-030 system 0000A-00C, a site I believe to be at Rosthern or east of Rosthern.
On Monday at 16:25 TG 164 Major Crimes came on the tower then at 16:32 SuperGroup 2043 added TGs 152 154 155

Nothing on tower 047 Langham

Previous to this was a great deal of Fire activity from 4084 Fire Zone 6

Now this may be related or not, I thought you would be interested Mobby

At 16:49 on Tower 36 Warman TG 6136 became active, I see 6136 active on tower 36 on a regular basis.

RID on TG 6136 was 2214689 and he logged on at 17:09 related? RID 2264689 always logs into 6136 on the Warman tower. At 17:12 2264672 joined 6136 on same tower. 2264686 joined at 17:31. at 17:55 2264775 logged out and logged back in at 19:49

 

[wolffe]

Looks like the days of PPSTN may be numbered.

I noticed a significant decrease of EMS traffic and at the same time started hearing dispatch ask for the personnel's Samsung unit number. I started checking and found that they are starting to hand out military grade Samsung Galaxy XCover6 Pros. These phones are tough rugged and capable of push to talk technology. When signing up to the First Net system it gives the personnel easy to use communications as the two way radio is, but also is capable of transmitting real time video, and any or all data that their portable monitoring machines spit out. That way the hospital has real time access to all information and data.

ST-Interworking Mission Critical Push-to-Talk between LTE and LMR Report | Homeland Security

FirstNet Authority | First Responder Network Authority

firstnet.gov

They also serve Canada.

They are also capable of CBRS which effectively turns the phone into a two way radio to communicate with other units on site of any given emergency.

What is CBRS, and how is it transforming enterprise networks? - Samsung Business Insights

An overview of CBRS, including potential use cases and how CBRS stands apart from other deployment options.

insights.samsung.com

Pretty incredible piece of tech.

Only a limited number of units have been handed out and I believe they are only in the testing phase, but if this technology proves to be reliable PPSTN may go the way of the Dodo bird. Combined with MDTs that are already in use, voice traffic on PPSTN will all but disappear.

 

[wolffe]

Hi group, I noticed something today that I have not seen to this extent.

All day an Emergency call has been sent out, if you are using Unitrunker in the column that says action (this column tells you if its login or join) for the emergency call it says "message" and in the service column it say "M 00". This has been going out all day on every control channel that I monitor. Mostly on tower 19 and on tower 34. It is a sometimes a different RID and sometimes its the same.

At first I thought that techs were testing something new, but it continued well into the night. I know these radios can be programed over the air, is that it? I don't think so because I don't believe they would use an emergency call.

I have 16777212 ID listed as Emergency call. Maybe that is where I am going wrong.

 

[Mobby1-Kenobby]

Hi, Wolffe

Back in January I put in a request to Rick for an update of Unitrunker 2 to show Harris Super-Group patches on the PPSTN.
I also asked Rick to update Unitrunker 2 to show unit status update messages on the PPSTN.

On February 4, I downloaded Unitrunker version 2.1.0.107.

The program is now showing Saskatchewan PPSTN unit status update messages.
The status 01 message is an alert tone used to page the DOC in Regina = FNE 16777212.
See the screen shot.
B190 paged the DOC and then.
See the Bonus Zip file.
A 10-70 is a status update request/response.

I have been testing the updated version of Unitrunker 2, but I have not seen any Super-Patches in use so far, this month, so I
do not know if the Super-Patch update was successful or not.


A big thank you must go out to Rick for his quick response to my request for this new update.

Cheers.

 

[wolffe]

Thank you Mobby I did start receiving this message after I upgraded.

 

[Mobby1-Kenobby]

Hi to all of you, following this thread.

I think it is time for an update.

Since my last post the RR PPSTN data base was updated with some new talk-group IDs.
The CBSA talk-groups and their uses have been updated.
Some of the RCMP tactical talk-groups have been repurposed for CRT use.

The PRT have new encrypted talk-groups utilizing a common encryption key ID share with the RCMP.

16:11:16.866 047 0 HDU MI A22D5B 0D81ED 2B2100 Standard AES KID 6915 GID 1854 ok
16:11:17.035 047 5 LC 00 00 44 00 18 54 21 C2 DA Group Voice Channel User I 21C2DA G 1854 (4 priority, packet protected) ok
16:11:17.200 047 A ESW MI 1B4ED6 9D6A50 D6C800 AES KID 6915 ok
16:11:17.399 047 5 LC 00 00 44 00 18 54 21 C2 DA Group Voice Channel User I 21C2DA G 1854 (4 priority, packet protected) ok

Several years ago, while having a conversation to an EMT, the technician told me that the PPSTN radio patches do not work.
For this reason, they will never request a patch.

What is the reason for this patch failure? See the zip folder for the details.

Taking a look at the screen shots we can see the EMS SG-patch (Adds/Drops) failures.
In the PRT to RCMP patch screen shot we can see RCMP Harris RIDs, but no provincial policing Motorola RIDs are seen.
The province and the feds are key sharing on the new talk-groups but are unable to utilize SG-patches to communicate.

Provincial Sheriff RIDs are now sending GPS location data to the FNE.
ALG ID is 84=AES Key IDs are 0008, 0018, 0028, 0038, 0048, 0058, 0068, 0078, 0088, and 0098.
These are the same key IDs as previously unused for DES, but now are being used along with the longer keys utilized by AES.


Saskatchewan Municipal (Mike###) Police Service
Unit designators and their agencies. Weyburn PS?

M100 to M249 Saskatoon PS.
M250 to M299 Prince Albert PS.
M350 to M370 File Hills PS.
M400 to M449 Estevan PS.
M450 to M499 Regina PS.
M500 to M505 Dalmeny PS.
M570 to M575 Corman Park PS.
M580 to M585 Vanscoy PS.
M700 to M750 Moose Jaw PS.

Cheers!

 

[Mobby1-Kenobby]

Hi to all.

What I did see this week.


April 29, about 1:00 p.m. the gathering began.
RCMP units C700, C701, C702, C703, C831, SHP HU3355, SE CO0348, CO0345 and others.
At 2:00 p.m. a roadblock began on the #10 highway close to Balcarres.
All the action took place on TG 153 Public 3. Encryption key share fail?
The operation ended at 4:00 p.m.

April 30, 2024, at about 2:00 p.m.
RCMP WEST members located and arrested Kelfort Keller on the
Wahpeton Dakota FNIR #94A in the RM of Buckland #491.
RCMP CIRT along with PDS assisted in this arrest.

RID 2214836 CIRT/ERT (login on "site 71", 11:42 am on TG 46=TAC 3).
RID 2212716 CIRT TAC 3 channel grant at 12:39 pm.
RID 2214835 CIRT/ERT TAC 3 channel grant at 12:40 pm.
RID 2212725 CIRT Alpha 1 TAC 3 channel grant at 12:42 pm.
RID 2212715 CIRT Sierra 5 TAC 3 channel grant at 12:43 pm.
RID 2215109 WEST PA TAC 3 channel grant at 12:44 pm.
RID 2214957 PDS K9 TAC 3 channel grant at 12:44 pm.
RID 2211422 RGIS TAC 3 channel grant at 12:45 pm.
RID 2214763 WEST NB Tac 3 channel grant at 12:47 pm.
RID 2212717 CIRT TAC 3 channel grant at 12:49 pm.
RID 2214900 E175 PDS K9 TAC 3 channel grant at 12:54 pm.
RID 2211144 E279 PDS K9 TAC 3 channel grant at 1:02 pm.
RID 2214764 WEST NB TAC 3 channel grant at 1:19 pm.
RID 2214836 CIRT/ERT (login on "site 71", 1:21 pm on TAC 3).
RID 2214902 PDS K9 TAC 3 channel grant at 1:28 pm.

At 9:12 a.m. on May 2, we see the new encrypted provincial court security talk-groups.
RID 2264954 DS0234 login on site 71 TG 6084, 9:24 voice grant on TG 6084, "At the courthouse".
At 10:43 am RID 2264954 joins TG 6237, joins TG 6239, joins TG 6238, joins TG 6240.
RID 2264954 voice grant on TG 6240, "Court is now closed in Fort Qu'Appelle".
RID 2264980 Responds, encrypted.
At 10:45 am RID 2264954 returns to TG 6084.
At 11:28 a.m. DS0234 voice grant on TG 6084, return trip to Regina.

May 2, 3:26 p.m.
2231753 Weyburn Police CTS unit 4 login TG 3004 on site 71.

May 3, at 3:12 p.m.
New TGs 126 and 127 patch tested.

May 4 at 4:22 pm
RID 2213315 RCMP GIS login TG 163 on site 71.

Now we will look back 3 months.

February 1, Saskatchewan Trafficking Response Team (STRT) RIDs
2216400 STRT seen on the TAC TGs 45 and 47
2216400 STRT seen on the TAC TG 45 and 47
2216401 STRT on TG 168
2216402 STRT on TG 18 Feb 29, 2024
2216405 STRT seen on the TAC TGs 45 and 47
2216419 STRT on TG 161 and 166 east bound sites 71-72
2216422 STRT on site 5
2216425 STRT on site 5
2216428 STRT Regina
2216429 STRT on TG 107
2216430 seen on TG 43
2216432 STRT unit on TG 50
2216433 STRT on TG 49
2216434 STRT on TG 6230
2216437 STRT on TG 49
2216438 STRT on TG 50 site 71/72 April 22, 2024, at 10:50 am
2216439 STRT on TG 6225
2216441 STRT on TG 49
2216442 STRT unit on TG 167
2216443 STRT unit on site 5
2216444 STRT seen on 00C site 47 Lajord
2216448 STRT on site 5
2216552 STRT
2216458 Swift Current STRT TG 180 LI/LO site 71
2216460 Swift STRT TG 180 and TG 12
2216461 Swift STRT on TG 180
2216462 Swift Current STRT on TG 180

February 8, the ICE investigation begins.

RID 2211350 Regina ICE unit, LI 8:51 am on site 71, TG 50 (Melville). See April 11, now.
RID 2211717 Swift Current Traffic Services LI 8:54 am on TG 46 site 71.

The CIRT/ERT Non-Event.

At 12:29 pm CIRT Alpha 08 Commander channel grant on TG 18, not on site 71.
RID 2212734 CIRT Alpha 10 LI 1:20 pm on TG 18 site 71.
RID 2212730 CIRT Alpha 06 LI 1:30 pm on TG 18 site 71.
RID 2212728 CIRT Alpha 04 LI 1:38 pm on TG 18 site 71.
RID 2212722 CIRT LI 1:28 pm on TG 18 site 71.
RID 2212724 CIRT LI 1:40 pm on TG 18 site 71.
At 1:42 pm CIRT Sierra 4 Commander, channel grant TG 18.
RID 2211224 E245 ERT LI 1:40 pm on TG 18 site 71.
RID 2212732 CIRT Alpha 08 Commander channel grant 1:46 pm on TG 18, not on site 71.
RID 2211223 ERT White F250 Camper Special channel grant 1:50 pm on TG 18 not on site 71.
RID 2212714 CIRT Sierra 4 Commander Channel grant 1:54 pm on TG 18 on site 71.
A few channel grants are seen at 1:59 pm.
At 2:04 pm CIRT Alpha 08 Commander LI on site 71.
At 2:06 pm CIRT A08 channel grant, then nothing.

April 1, 2024
TG 49 CRT/TAC 6 and TG 214 WEST Northern Region, patch TG 2030 (SSN 11). See April 11th.
TG 43 CRT/VIP and TG 135 SERT HQ Operations, patch TG 2049 (SSN 09).
TG 40 CRT/TAC 9 and TG 216 West 3 Central Region, patch TG 2050.

April 8, Monday was Court Day.
TG 6240 Provincial Court Security was in use for most of the day, RID 2264935 was on site 71. See April 11th.
RIDs 2264921 to 2265001 lots of coms.
Most RID coms were encrypted but these were not.
RID 2264924
RID 2264925
RID 2244954
RID 2264979

April 10,
Lots of patches were tested.

April 10, SHP in and around this area for 10 hours. C701 and C702 came along with them.
RID 2263369 SHP Yorkton Mobile LI on site 72 at 9:03 am then on site 72 7:00 pm
RID 2263279 SHP Yorkton Portable LI on site 71 at 9:31 am then on site 72 6:50 pm
RID 2263308 SHP Regina Portable LI on site 71 at 9:32 am
RID 2263369 SHP Yorkton Mobile LI on site 71 at 9:45 am
RID 2263370 SHP Regina Mobile LI on site 71 at 9:45 am then on site 72 at 7:05 pm
RID 2263300 SHP Regina Portable LI on site 71 at 10:53 am
RID 2263356 SHP Regina Mobile LI on site 72 at 11:47 am

April 11, 8:36 am RID 2211350 ICE unit LI on TG 43 CRT-VIP, 21 minutes later at 8:57 am it seen on site 72.
This RID is traveling northeast on #10 highway to Melville.
On this day RCMP ICE executed a search warrant at a home in Melville. 28-year-old Dylan Finnerty was charged with
luring a child to facilitate a child pornography offence.
This RID returned at 3:31 pm on the way back to Regina.
RID 2211351 and 2211352 are also RCMP Regina ICE unit.

April 11, Thursday was Court Day. Begins at 10:00 am.
RID 2264935 was on site 71 again but this time it was on TG 6084, and not TG 6240.

Cheers.

 

[wolffe]

Hey Mobby great detail.

The new Justice TG's I have seen

6084 is Sask Justice Prov Wide Prisoner Transport
6238 Is prisoner transport/detention, (court to Correctional and Psych center, etc. They are encrypted)
6235 Is the main Security TG for the Saskatoon Courthouse Kings Bench
6240 Is the main Security TG for the Yorkton Courthouse Kings Bench
6237, 6234, 6236 and 6239 I had a great deal of activity on these TG's for a couple of weeks and the RID's using them were all over the place. Must of been a transition period. But now nothing for over a week. Maybe other court houses are seeing these TG's used. I will continue watching.

 

[Mobby1-Kenobby]

Hi to all.

This is what I have been seeing.

May 6,
8:51 a.m. SHP mobile HU3370 on site 72 to 9:00 a.m.
9:29 a.m. RID 2261881 Com-Cor-Trans joins TG 6083 on sites 71 and 72.
2:26 p.m. HU3370 is again seen on site 72.

May 7,
RID 2255972 on TG 5197 LaRonge Air Medevac 1 at 6:37 am on site 71.
RID 2264778 SPOOK login on TG 6134 on site 72 at 11:12 a.m.
RID 2211504 LI on TAC 3 on site 72 from 12:00 to 12:20 p.m.

May 10,
9:38 a.m. SHP mobile HU3332 login on site 71.
9:43 a.m. SHP portable HU3331 login on site 71. On site 71 until 10:27 a.m.
10:32 a.m. both are seen on site 72. To Melville.
11:18 a.m. Harris SG-patches TGs 22, 10, 6225, ALG ID=AES, Key ID=37 SSN=3.
12:29 p.m. Harris SG-patches all drop.

I recently posted information about the RCMP Regina ICE unit RIDs. See April 11th.
How did ICE get Dylan Finnerty? It was done with CPS Technology!

This information was provided to the media, by a former member of the Sask ICE Unit.
The Sask ICE Unit utilizes a software program that monitors peer-to-peer file transfers worldwide.
When files are transferred from one computer to another it leaves a "fingerprint" of what
that file is. The software program identifies the file as being illegal and the IP address
that it was sent from.

ICE will then obtain the identity of the owner of that IP address.
RCMP members will do a stakeout and surveil the address.
Who comes and goes from the location?
Who is at the location at the time when the files are transferred?
This may take only days or in some cases it may go on for several years and at many locations.
At this point ICE will obtain a search warrant for the location.

Utilizing a virtual private network or VPN to attempt to hide one's IP address isn't foolproof.
There will always be a mirrored IP address. When the "final" IP address location is identified,
and that it came from a certain server the ICE member will contact the authorities in that country.

Once ICE informs those authorities that the investigation is about child pornography those authorities
will immediately act upon the request. With the information from the VPN server ICE can trace it back, even
if it goes through another VPN server, the trail will be traced all the way back.

The CPS Technology software: www.childrescuecoalition.org/law-enforcement/

See: Canadian Police College Home / Technological crime / Child exploitation investigations /
Peer-to-Peer Investigator Course (P2P) this course teaches how to utilize the Child Protection System (CPS).

Cheers.

 

[Mobby1-Kenobby]

Hi, to all.

This is what I have been seeing and hearing since my last post.

May 15, pm.
SHP mobile HU3355 on site 71, 1:58 to 2:50 pm. not on site 72.

May 16, am.
RID 2215097 North Battleford GIS #2 login on site 72 at 10:45 am. talk-group ID 162 GIS #2.

May 16, 1:35 pm.
RID 2215545 Regina Delta mobile login on site 72 at 1:35 pm. talk-group ID 41 TAC #8.
RID 2213314 Prince Albert GIS login on site 72 at 1:36 pm. talk-group ID 41 TAC #8.
RID 2212307 SERT/STRT login on site 72 at 1:36 pm. talk-group ID 41 TAC #8.
RID 2213905 GIS Saskatoon login on site 72 at 1:36 pm. talk-group ID 41 TAC #8.
RID 2212310 SERT/STRT login on site 72 at 1:36 pm. talk-group ID 41 TAC #8.
RID 2212305 SERT/STRT login on site 72 at 1:36 pm. talk-group ID 41 TAC #8.
RID 2212314 SERT/STRT login on site 72 at 1:36 pm. talk-group ID 41 TAC #8.
RID 2216735 SERT/STRT portable login on site 72 at 1:36 pm. talk-group ID 41 TAC #8.
RID 2214691 B755 North Battleford channel grant on talk-group ID 41 TAC #8 at 1:36 pm.
RID 2211362 RMCU login on site 72 at 1:36 pm. at 1:36 pm. talk-group ID 41 TAC #8.
Many channel grants seen on TAC #8 until 1:57 pm. total time on site 72 was 22 minutes.
They travelled through the site 72 coverage area on #10 highway to Yorkton.
The event:
At 2:30 pm. members of the Saskatchewan Trafficking Response Team (STRT) executed search warrants
at three residences in Yorkton along with a traffic stop on 7th Avenue South. Officers seized cocaine,
cash and drug trafficking paraphernalia at the locations.
43-year-old Kenneth Kulaway from Yorkton and two men from Edmonton are facing three to four charges
each and appeared in Yorkton Provincial Court on May 21. This did not come as a surprise to me.
Ken, a known biker-gang member, lived not far from me and worked for the RM#187 North Qu'Appelle as a
grader operator, for a few years, I think it was around 2010-2015.
I think in 2021 that I did see that "biker" Kenny working for a well-known Yorkton paving company.
Another "biker" Kulaway also lives and works around my location.
I was told that once you join a biker-gang (club) it's for life, with one's death being the only way out.
May 16, pm.
RID 2211504 E311 F-Division Livestock Theft Investigator login on talk-group 46, site 72.
RID 2262772 SPOOK login on site 72 at 6:58 pm. on talk-group ID 6035 (has been seen on TG ID 6134).

May 18, 2:48 pm. All units go to Talk-group Public 2 (152) site 71.
RID 2261333 CO# 345/512/506/273/RG020/RG007 Yorkton Mobile (Good Spirit/Duck MTN Parks)
RID 2263651 CO# 0329 Melville Mobile login 3:04 pm.
RID 2261478 CO# 0185/348/315/186/506/512 Yorkton Mobile (Good Spirit Park) login 3:37 pm.
RID 2261681 CO# 0185 Yorkton Portable LI.
RID 2212107 C810 Mobile Traffic Services FQ.
RID 2212832 C700 Yorkton TS Mobile
RID 2216277 C831 Portable FQTS#3 (C700 using it on TG Public 4).
RID 2216278 C810 Portable FQTS#4.
RID 2261463 CO# 0420 Kole's' Portable (Echo Valley P.E.O Ryan using it).
RID 2261423 CO# 0415 Dave's Portable (Echo Valley P.E.O. Morgan using it).
RID 2261585 CO# 0409 Yorkton Mobile
RID 2263342 SHP Regina is Dick's portable on TG Public 1.
RID 2263307 SHP Regina is Dick's Mobile.
Traffic stops were setup from 4:00 to 7:00 pm. at 2 locations on #210 and #56 highways at
the Echo Valley Provincial Park.

May 21, pm. site 71,
RID 2216402 STRT login 1:56 pm. on talk-group TAC 2.
RID 2214916 joins TG TAC 2 at 1:57 pm.
RID 2216401 STRT joins TG TAC 2 at 1:58 pm. Login 2:04 pm. logout 2:13 pm.
RID 2213295 GIS Saskatoon, channel grants on TAC 2 with STRT 2216401.

May 21, 2:19 pm. PRT call to Holdfast.
At 2:36 pm. multi-select patch talk-groups 56 RCMP Craik and 6225 PRT-ENC 1.
At 2:42 pm. OFC RID 2262040 on site 71 goes to talk-group Public 2 (152).
From 2:50 to 3:35 pm. there are many channel grants from these RIDs, on Public 2.
RID 2216336 M457 RPS-CTS portable.
RID 2211069 C513 Mobile.
RID 2263330 SHP Regina portable.
RID 2211039 C102 Regina TS Mobile.
At 3:22 pm. OFC RID 2262040 was still on site 71, TG 152.
The patch is dropped at 4:57 pm.
The Province's Motorola radios do not respond to the Harris A4 Regroup messages and these
Motorola radios do not appear to send the correct AES Key IDs to the RCMP Harris radios.
They have been forced to fallback to using the unencrypted Public talk-groups.

May 22,
RID 2262040 OFC login 9:02 am. on site 71, talk-group 152.
RID 2211717 Swift Current TS unit login 9:09 am. on site 71 TG 10, logout at 9:26 am.
RID 2264754 SPOOK Regina login on site 72 talk-group 6133 at 9:18 am.
SG-patches for RCMP and CBSA talk-groups tested from 10:00 to 10:30 am.
SG-patch seen for EMS Maidstone and Neilburg talk-groups from 10:58 to 9:16 am.

Cheers!