NYPD faces backlash as it prepares to encrypt radio communications | New York | The Guardian

fne8w2ah@lemmy.world to Technology@lemmy.world – 461 points –
NYPD faces backlash as it prepares to encrypt radio communications
theguardian.com
131

Why are they encrypting their communications? Do they have something to hide?

If they've got nothing to hide, then they've got nothing to fear.

Or so I've heard, anyway, right?

They're public employees. Their privacy is non-existent while on duty. There is actually no reason for police radios to be encrypted. The only reason police feel even a modium of responsibility to the public is because they are able to be constantly watched by citizens, and their unencrypted comms is an important part of that.

ETA: I get what you were saying and adding onto it, not trying to contradict

Their privacy is non-existent while on duty.

True, but your privacy exists even in this case.

There is actually no reason for police radios to be encrypted.

Actually I can think of a couple of reasons.

One is that this way the parents of a violent crime or lethal incident victim can be informed about the condition before the press publish the news. Last year we had some cases here in Italy where the parents of people who passed away for some incident/crime discover it from the press even before the authority had time to inform them.
True, in this case is the press that is in the wrong, but they could do it because they had access to the communications.

Another is that maybe it is not a good idea to let criminals know what the police are doing to catch them.

BUT I understand your point given the news about US police I read around.

What I think about it is that if you think that all the US police officers are bad then I agree that the not having access to the radio communications can be a problem. The solution however is not to keep the communications open but to fix the US police.

In that case the records need to be auditable, e.g. available for subpoenas and all that. But given the frequency of their body feels suddenly "malfunctioning" during arrests, I don't see that happening in the shower term.

What we need BEFORE encrypted comms is stronger accountability laws and harsher punishments for police brutality.

Otherwise I won't buy the "protect and serve" excuse. They just want to save their own asses.

It's worth noting that in Italy, police communications are encrypted (they use TETRA radios, like most police forces in Europe). I'm not saying it can't help prevent this, but when weighing the cost and benefits of encryption for police radios, we should take into account that this benefit is not absolute.

I don't quite get these comments, I think our emergency services went encrypted a while back in Vancouver Canada and I'm surprised NY wasn't already encrypted?

What about keeping the communications encrypted for the privacy and safety of people involved, and storing the records for a set amount of time. Anyone with access to the live feed can access the backups during that time, and report issues as needed.

I'm not familiar with the issues with the police department, so maybe a better compromise would be to open up the feeds publicly after a set amount of time?

I'll put it simple.

American cops are not equivalent to Canadian cops. US cops use tax payer money to pay lawsuits but are allowed a special police union as well. No other public servants get a union to do their bidding while tax payers foot the bill.

Open the channels. What's there to hide. In emergency events, yes it could be an issue. But people also need to know where serious events might be occurring in their areas.

I'd much rather have some real accountability measures than the accidental accountability occasionally provided by broadcasting their communications.

How about both? The governmental systems are supposed to be open so that they can be observed to be truthful and trustworthy, and then keep checking anyways.

I don't think things like names of suspects or victims should be made public.

Historically in the USA many police agencies have tried to cover-up and hide evidence of wrongdoing by on duty officers. Some people viewed the open radio policy as a way to monitor the police to make sure they're not breaking the law themselves. I personally have never tried to listen in to a police radio so it doesn't bother me much but some people are upset about it.

Hey I love snooping on shit and watching reality shows as much as the next guy but I couldn't be that mad about the police wanting to have a secure way of communicating

I wouldn’t imagine that radio communications contain much evidence of wrongdoing. All the real illegal shit happens in person.

Police interactions are public information. If you go to a police station and do a FOIA request, you get all that info anyway. Why would it need to be kept secret before the point it is requested?

Apart from the fact that many departments deny legal FOIA requests and force people to take legal action to get the information they are legally entitled to.

Oh wait. Maybe that’s why they want encryption.

Isn't personal information taken out of FOIA requests first? I can see why victims wouldn't their names and addresses given freely out. Heck I think suspects should get the same amount of privacy too.

Suspects would already be covered, FOIA requests usually aren’t released before a case is closed, and you ideally don’t close a case half finished.

Yes, some information is redacted from FOIA requests, but it’s normally not stuff that would be broadcast over a radio. For instance, they may blur the faces of bystanders, or mute a section where someone is giving the officer personal info. But again, there would be no reason to broadcast this info over the radio regardless.

When I was in the USCG Auxiliary in Boston in the 90’s they used the same VHF radio as all boaters for most comms, but they also had an encrypted radio they could switch to if they needed to discuss anything sensitive. The encrypted radio was crap though and only worked over short distances. But they’d use it when relaying personal details of boats/people they stopped, dealing with drunk boaters, etc.

As time progressed they switched to using mobile phones when they wanted privacy. Cell coverage along the coast proved far better than the proprietary encrypted radio…

Where I live it's partly to protect the privacy of the people involved.

Hm everywhere else they're not all for privacy ... Must be a coincidence.

It's not the proper argument but I get your point. Of course they got things to hide. However, public servants like police shouldn't be allowed to hide anything.

Copy/pasting from another comment, but it's assholes who ruin it for everyone

In prior articles on this, religious nutjobs would listen to police radio and visit the active crime scene and start praying in the middle of the chaos. Like, every crime scene. People and police started getting really sick of their shit during an emergency. Other flavors of morons would also show up to watch shit go down. Sometimes, private information would also get said on the radio such as names or addresses, which could lead to harassment or true crime nuts showing up to victims' homes.

I kinda get why making channels private for everyone but reporters (for transparency) is happening.

They currently aren't hiding anything on the radio and are still getting away with the shit they've been doing since forever, hard to see this as actually being worse when the lack of encryption hasn't lead to a perfectly transparent police force.

Aside from the transparency issue, did you see how much it's going to cost?

Four hundred million dollars! The city is cutting back on pretty much everything else but wants to spend that on police radios.

Everyone has to tighten their belts while the thin blue line gets fatter and more dangerous.

No matter what it costs, we will shield police from accountability.

Name a price and go fuck yourself.

One city's cops want more than a dollar per US citizen for something I could personally implement for a small group of people?

They actually need to focus on hospital communications. It's scary what all you can pick up from paging systems in cleartext with a $20 USB SDR and a laptop. Patient names, rooms numbers, alert codes, everything.

I worked in a hospital, and patient names should never be paged. Room numbers and alert codes are not PHI, and generally they would say "Adult Male blah blah blah...". Unfortunately, in concrete mazes, paging is still the most reliable (as seen by how easy it is for others to see). And when you're as important as a doctor, you need reliability.

1 more...

I find it fascinating how in the United States police radio communications aren't encrypted and therefore anyone can listen to them. In my European country all emergency service communications are TETRA encrypted.

Which had/has a built-in backdoor for years.

https://www.wired.com/story/tetra-radio-encryption-backdoor/

EU security forces didn't really care as TEA2 wasn't backdoored. It's a mid-90s standard with different encryption levels for different actors, it should be blindingly obvious that whatever is publicly available is backdoored. You may not like it, I do not like it, but it should've been obvious.

The actual own goal was that while all EU security forces always had access to the secure stuff plenty of operators of critical infrastructure (think energy suppliers etc) used TEA1 as that's what they were given. Also some EU forces bought TEA1 equipment presumably because they didn't know what they were doing, with or without help from manufactures with an overstock of TEA1 radios.

Here's a 37c3 talk about the whole thing, from the people actually breaching the protocol.

Aside from those encryption issues (which are finally getting addressed btw) TETRA is a great protocol, though. By now a bit dated so bandwidth isn't exactly stellar (forget video streaming or such) but devices can talk directly to another just as in olden times, setting up a base station simply increases range, radio channels are now virtual, it's all very sweet. Basically TETRA is to radio what GSM is to rotary phones. Which, as GSM phones don't tend to be wired, makes a hell a lot more sense.

Wait the CCC speaks English? I thought they were German!

Projecting a wee bit, aren't we?

Also the presenters are Dutch. The congress is bilingual though IIRC simultaneous translation is only in place for German->English.

1 more...
1 more...

Well, for starters, European police are actually trained professionals (in general, much more so than American police) and have different oversight. American police also handle a wider variety of things that really aren't law enforcement - things that should be handled by other kinds of professionals.

EDIT: American law enforcement agencies are also home to some of the highest rates of domestic violence perpetrators and right-wing extremism.

American police shoot and kill 3-4 people each day. That doesn't take into account deaths that occur in jails and prisons due to negligence.

What do American police handle that European police do not?

He already stated that. They shoot and kill 3-4 people a day!

/s

Not all llaw enforcement or emergency services are in the clear. The Feds are all encrypted (except for some intentional in-the-clear channels for open comms).

One of the biggest criticisms after 9/11 was the lack of easy comms across agencies because of radio set ups, different 10-codes, etc.

Hopefully this is something they are accounting for with this change.

Also $400m doesn't seem that crazy for an endeavor like this given the size of NYPD.

40k officers and staff + backhaul + tower upgrades + vehicle radio upgrades and installation /$400m

And is that $400m entire lifecycle cost? Over 5-10 years or whatever that's really not insane.

It seems insane that they were communicating out in the open.

On the one hand, you probably hear all kinds of cool shit. On the other hand, how in the fuck are they just discussing all their sensitive shit out in the open??

They don't? I mean, you can listen to them, they are not discussing sensitive shit because it's public.

So what do they use to do that? Or is it that they can't because they don't have a secure channel?

Cell phones are a common option.

Jesus. I can't believe they haven't encrypted sooner. "We have a situation here, wait let me call you."

Why would the situation need to be kept private? “We have a jumper at this and this street”, “shots fired on scene”, “I ate a burrito.”

I’m honestly curious, what vitally secret info do you think needs to be communicated over radio? They aren’t for conversations.

To keep the private info of the people involved actually private. License plates, descriptions, home addresses, personally identifiable info. It seems mad that all of that is just broadcasted out to everyone. Probably wouldn't even be legal where I live because of privacy concerns.

License plates are not private, they literally sit out in public all day. Descriptions are, again, not private. Even your license info is public.

Not to mention, police reports are info that can be requested with a FOIA request. So all that info is public anyway, even if it was originally private.

Would you be willing to share your license plate number here?

License plate, connected to description and description of the situation, medical stuff etc. would obviously be something I wouldn't want broadcasted to just anyone. I don't know how Americans are comfortable with that.

Or well, probably aren't since they're finally getting around to encrypting that stuff. It's wild that it wasn't done before.

Here? No. I keep my online and personal lives separate. That would be directly tying what are essentially two different people together.

Are you willing to put your license plate on a piece of paper and display it on your house? What about your address on your car? Your name on your car, house, phone number?

All this info is already there. You can find it all yourself, or pay like $15 to have a company do it for you, and you’ll get a boatload more. Employer history, address history, vehicle history, current phone number, current address, and more.

I guarantee this info is all readily available in other countries as well, though I admit the legality of general public getting their hands on it may be in question.

I wouldn't want any of my info being broadcasted to public without my specific approval. Especially connected to other info like a specific situations with police, medical info, whatever might come up. Imagine being a victim and on top of the shittyness of that having all your info just broadcasted out like that.

You said license plates were public info you were fine with being broadcasted in public. Not sure why you're hesitating now.

I'm being facetious. Of course I know. Nobody wants that shit being broadcasted out without their approval. Imagine if I just shared your address or license plate. The audience here is undoubtedly smaller than what you'd get with NYC police radio, but still.

7 more...
7 more...
7 more...
7 more...
7 more...
7 more...
7 more...
7 more...

Communicate private health information? A lot of times they still use fax machines. Information can also be stored in a secured database where access is recorded and monitored. If needed, they can always pick up the phone and talk directly with a person if you need something. HIPAA is fairly specific about this.

An encrypted two-way radio, where only the two parties requiring the information would be on the call, that might be fine as long as you're careful to make sure someone standing nearby can't overhear. But that's not what NYC is building.

7 more...
7 more...
7 more...

I think most eu countries use tetra for emergency services. it's great for cross service group/task communications also.

8 more...

Yeah police radio should never be encrypted.

I suspect it would be helpful for protecting sensitive situations. Currently (at least with EMS) they call each other's cellphones for that, not ideal.

What kind of situations?

EMS communication over unencrypted channels is limited by HIPAA, patient information must be kept vague to protect patient privacy. In the event that, say, an individuals name needs to be given to the receiving facility to facilitate review of records prior to arrival by the ER physician, some other method of communication has to be used.

It's not a HIPAA violation for a report like this to go over unsecured radio waves:

16 year old male, unresponsive. Suspected alcohol poisoning. EMS required. Address to be provided by emergency services

I know, which is why my example was about providing the patient's name over the radio.

Does EMS typically provide patient names over the radio? That honestly seems like information that would normally not be needed, or potentially even known.

They have to keep it vague like that because the channel is open to all. It's a limitation of the system.

Encryption on radio communications would not help that at all. It would still be a HIPAA violation to share sensitive information on a broadcast, even if it is encrypted.

Edit: I hope y'all downvoters aren't actually responsible for patient information.

That's very incorrect. End to End encryption is legal under HIPPA. All the receiving parties have likely filled out the HIPPA yearly thing, so they'd be covered.

That's absurd. There are very specific guidelines for sharing protected health information with and among law enforcement. There is no paperwork that "all receiving parties" can fill out to cover a blanket broadcast of protected information to anyone with an encrypted police radio. You would still need to have a specific purpose for disclosure, and disclose only the required information to only the necessary parties. An encrypted channel would still be available to dispatchers, administrators, and a bunch of random people that don't need to receive that information.

Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official's request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person's death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.34

https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html

Source? If you broadcast encrypted data you're not sharing it with anyone who doesn't have the right key to decrypt it. Someone could theoretically crack the encryption, but literally every method of transmitting information is vulnerable to being intercepted by a sufficiently motivated attacker.

I'll copy my reply to the above, but add that someone who has the key to encrypt a broadcast doesn't necessarily have a need to receive private health information. Law enforcement officials may receive protected information if they need it in the course of their duties. Private health information should only be shared in a secure communication, but encrypting the broadcast doesn't change the fact that

This is like HIPAA training 101 stuff. If you're a doctor at a hospital, you might be able to access any patient's records. But if you peek at a celebrity's serologies, you've violated HIPAA. Broadcasting on an encrypted channel would be like posting test results in a locker room and arguing that it's OK because only doctors have a key to the room. Having access to information is not the same as needing access to information, regardless of whether everyone has their paperwork in order.

That's absurd. There are very specific guidelines for sharing protected health information with and among law enforcement. There is no paperwork that "all receiving parties" can fill out to cover a blanket broadcast of protected information to anyone with an encrypted police radio. You would still need to have a specific purpose for disclosure, and disclose only the required information to only the necessary parties. An encrypted channel would still be available to dispatchers, administrators, and a bunch of random people that don't need to receive that information.

Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official's request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person's death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.34

https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html

Ok, I think I see where our disagreement is. Would you agree that an encrypted broadcast is ok if you encrypt the sensitive information with a key that is only accessible to the specific individuals who need it? Not that I see any advantage to doing so—it's just a hypothetical scenario.

Off of the top of my head, I can see how an announcement of an open shooter at a location might attract some Meal Team 6 Rambo wanna-be to try and bust in and save the day and making it significantly worse.

I've never heard of this happening. It's probably more for people avoiding police and maybe ambulance chasers.

We had a kid cross state lines to show up to a riot with a gun to defend property and shoot people. Just because you haven’t heard about it doesn’t mean it’s not plausible as a valid reason.

And? Do you think he heard about it from a police radio, and not literally every news outlet that was covering it at the time?

You must know that unencrypted police radios have been a upstream source for local media for a long time, right?

And I’m not arguing that encryption is a good idea, in fact I think a blanket encryption of emergency radio is a bad idea (but nuance on social media is invisible).

This thread is simply in answer to an earlier poster who asked for a situation where it could be helpful to protect a sensitive situation and I provided one that we have seen analogs of in real life.

Sure, they get some information from radios. They also usually have at least one person at the headquarters at all times. They will know about big events regardless.

I forgot that police have no filters or power in person to be more private in discussions about sensitive topics just because there’s a person at their precinct. All conversations happen wide open just like you get with a police-band scanner. 🤦🏻‍♂️

Plausible, but is it likely? Enough to be even remotely worth it...?

OK, so something thats never happened before needs to be curtailed?

And even if so, active shooters are rare, do we need to encrypt ALL chatter for something that happens maybe every few years for a given precinct/jurisdiction?

Nope, even never had any sort of analogous situation where armed civilians show up to insert themselves and potentially complicate matters: https://www.washingtonpost.com/news/national/wp/2018/07/13/feature/in-all-reality-there-were-three-shooters-oklahomans-kill-an-active-shooter-and-its-not-as-simple-as-it-sounds/

do we need to encrypt ALL chatter…

I never suggested we did. The original poster referenced a specific context of a “sensitive situation” and you asked for an example, so I provided one that could qualify.

Newsflash: Cellphone calls are not encrypted either, believe it or not.

That may be the case with older technologies but VoLTE very much is.

Or fucking use telegram or Whatsapp. Anything except the official equipment.

Those are both terrible examples of messaging apps, because they are not properly secured (end-to-end encrypted). Signal would be a much better option.

WhatsApp is, Telegram isn't.

Nah, Telegram really isn't good https://www.youtube.com/watch?v=rtRQKQkvUfE

1 more...
1 more...

Surprised it's not encrypted in the first place. You haven't been able to listen to police communications in Finland since the 90's. I would assume most of Europe is the same way.

Apparently Americans feel like this is a way of keeping taps on what their police do.

It's interesting. One argument for encrypting is that it keeps private info of the people involved private. But some retort that they can just use other means to communicate that info. But wouldn't that mean that it doesn't help keeping taps on the police doing shady shit since they can just use those more secure means of communicating anyway?

They're getting away with shady shit now, via the unencrypted channels, hiding behind qualified immunity and get away with literal murder.

The question should be how successful is it holding the police accountable based solely on their radio communications. I'd imagine the answer is "not fucking likely".

i'm all for full transparency regarding all police activity - i'm not for full realtime transparency regarding all police activity.

active shooter scenarios, violent crimes and everything that invites rubbernecking (read: situations where MORE people are a bad idea, which is most police/ambulance business) should probably not attract people; a 24h delay for release would be enough tho.

my inner cynic already tells me - without searching - that noone thought about automatically releasing the info after a delay. :-(

I genuinely like this idea, because it would allow to reach both goals.

The problem I see is that this would probably go down the same as the bodycam idea, with inconvenient recordings vanishing due to "technical issues".

You'd need an independent third party doing life recording and delayed release. Subjectively, the US don't have a great track record with these.

Easier idea: Just publish last week's encryption key. Probably won't happen because some tech supplier will lobby for a more expensive solution.

They already find any reason not to release body camera footage. You really think they're gonna release all policy activity after 24 hours?

Yes, this is absolutely suspicious and definitely a sign of police overreach and government's misplaced priorities.

But.

I do want to point out that, whenever a cop wants to do something shady right now, they don't do it over the unencrypted radio. It's not like we're giving them a new way to be malfeasant. It's not like they're currently completely accountable and transparent, and they won't be later.

Right now, they just use their cell phone when they want to do something shady.

If you have nothing to hide, you have nothing to fear (or something like that)

I'm surprised it was nos encrypted already.

Any one can silently hear their frequency. I looks like an easy way to know if police is coming your way, and how avoid them.

Regular phone calls and text messaging are still a thing. They don't need this at all.

It's insane it hasn't been encrypted ages ago. Bizarre

This is the best summary I could come up with:


The New York police department (NYPD) is facing serious backlash after announcing additional details about its plan to encrypt its radio communications system, which experts warn will limit transparency and accountability.

The entire “upgrade” to a new, encrypted radio system will be completed by December 2024 and cost an estimated $400m, a hefty price tag as several city agencies have been forced to swallow major budget cuts.

Maisel said that during Hurricane Sandy in 2012, when more than 200 people died, he was able to provide public safety updates on social media by listening to the police radio.

The encryption plans also have support from Mayor Eric Adams, who said during a July press conference that “bad guys” are listening to the police radios, the New York Times reported.

Cahn added that police have been unable to provide “concrete examples” of criminals abusing the radio system, especially to justify citywide encryption.

“I really do think that we have a fundamental rule-of-law issue under Eric Adams, where the NYPD continues to be enabled to lawlessly pursue this surveillance agenda without abiding by the protections that already exist under law,” Cahn said.


The original article contains 918 words, the summary contains 190 words. Saved 79%. I'm a bot and I'm open source!

just the police doing everything they can to make sure that no one ever knows what they're doing because they're such great big heroes that we normal people just can't handle their awesomeness

They're not encrypted? What? That's a gigantic security hole.

Damn, are these guys up on modern tech or living in the 90s?

Regular police radio should not be encrypted. Police should not be operating under a cloak of secrecy especially in the US.

Theres a case for real time communication having at least some channels with dedicated encryption, just because every criminal and their mother is capable of buying a police scanner. Especially if there's records and transcripts for after the fact review.

The problem is that current police forces simply can't be trusted to use it for above the board means. More than likely it'd be used as a means of subverting law and order, not upholding it.

They already get around the open radio issue by calling each other, messaging, etc. but encrypting all communications would make it even worse.