Subject: [NEXTEL-1] City fights hackers with fire radio plan

From: [email-masked]
Date: Thu, 15 Apr 2004 12:50:00 -0400

City fights hackers with fire radio plan

http://www.chicagotribune.com/technology/chi-0404150168apr15,1,4023910.story

By John McCormick
Tribune staff reporter
Published April 15, 2004

While the Chicago Fire Department tries to determine who is responsible
for the latest racial slurs broadcast on its radio system--including
some targeting Cortez Trotter, the city's first African-American fire
commissioner--officials said several of the transmissions likely came
from hackers, not firefighters.

It's a plausible scenario, especially given the antiquated design of the
department's radio system. Such problems have repeatedly crept up across
the country, in cases where hackers have illegally transmitted
everything from burps to false emergency calls to pornographic noises on
police and fire frequencies.

Digital systems, which have been installed in Philadelphia, Honolulu and
other cities, are much more difficult to break into because they require
expensive radios and extensive software programming. The systems convert
voices to numeric code, making both illegal hacking and legal monitoring
by scanner enthusiasts and news organizations significantly more
difficult.

For now, however, just about anyone can transmit on the Fire
Department's radio system by using programmable radios bought for a few
hundred dollars and modified for public safety frequencies with help
from hacking-related Web sites.

Trotter, named fire commissioner this month, was the subject of at least
one of the four racial slurs broadcast in succession early Sunday
morning on the Fire Department's two main dispatch channels, the eighth
such incident in the last two months.

City officials said they're almost positive the latest broadcasts did
not come from a Fire Department radio because they did not contain the
identification codes programmed into department radios. They couldn't,
however, rule out firefighters who might have disabled the
identification feature or used a non-department radio.

"I don't know who it is, but we're 99 percent sure that it's not coming
from a Chicago Fire Department radio," said Larry Langford, a spokesman
for the city's Office of Emergency Management and Communications.

Because of the design of the Fire Department's current radio
network--parts of it dating to the late 1960s--it's among the most
vulnerable to hacking. Before the recent wave of incidents, though,
Langford said the only other inappropriate transmissions in recent years
had been the occasional broadcast of radio music.

"The system was never designed to be a high-security system," he said.
"Hacking was not considered an issue when the system was designed."

One of the reasons the system is so vulnerable is that it uses
frequencies in the VHF portion of the radio spectrum, where an abundance
of radios use nearby channels.

"It is very easy to get radios programmed for those frequencies," said
Daniel Worroll, a communications consultant and coordinator of the
emergency operations center in Milford, Conn.

Hacking arose in late 1980s

Experts say hackers were almost non-existent before the late-1980s, when
computer-controlled programmable radios became widely available. Before
that, specific "crystals" had to be ordered to transmit on any given
channel.

"The only time you would hear of this is when an officer had a radio
lost or stolen," said Chuck Jackson, a vice president for
Schaumburg-based Motorola Inc., the nation's leading provider of public
safety communications.

Although the Federal Communications Commission doesn't track all hacking
incidents, a review of news reports shows cases around the Midwest and
on both coasts in recent years.

In early March, for example, a University of Wisconsin graduate student
in Madison was convicted in federal court of intentionally blocking
police radio communications more than 20 times over nearly a year.

Two years ago, a suburban Minneapolis man was sentenced to 120 days in
jail after being caught broadcasting on police frequencies more than 100
times, including transmissions where he pretended to be a wounded
officer.

And in 2001, a 16-year-old boy in Denver used a hand-held radio and
computer to send police cruisers and a helicopter to fake emergencies
and to steer officers away from legitimate 911 calls for more than a
month before being caught, authorities said.

Ham radios modified

Hackers have been known to use modified ham radios, as well as those
designed for construction sites and other commercial purposes. They
typically need to snip only a few components or add a solder joint to
modify the radios so they'll work on frequencies other than those they
were designed for. Although the modifications are illegal, information
on how to make the changes is widely available on European Web sites and
elsewhere.

If caught, people making malicious transmissions can be criminally
prosecuted and fined up to $10,000 per offense. But finding hackers is
notoriously difficult because their broadcasts are typically very short.

The way the Fire Department has programmed its radios is another reason
that catching those responsible for the racial slurs has been difficult.
Before the incidents, it was easy to override the embedded code in a
radio's signals that identifies it as being assigned to a specific
firefighter or truck.

An unofficial firefighter Web site in early March described how the
identification could be defeated simply by turning off the radio or
disconnecting its battery before ending a transmission. In recent weeks,
the department has reprogrammed most of its radios so they transmit the
code at the start of transmissions, as is done in many other cities.

Besides making hacking much more difficult, the new network also will
transmit better into buildings--especially high-rises--something that's
periodically been a problem for firefighters. It will accomplish this by
using more transmission towers at lower heights.

The overall cost of converting the city's fire, police and public works
radio systems to digital is estimated at more than $150 million. No
timetable has been set for radio systems outside the Fire Department.

Experts said city officials may be tempted to use the recent batch of
inappropriate messages to help win funding for the conversion, but the
new technology cannot eliminate any chance of hacking.

"As technology moves forward, the hackers move just as fast," said Tony
Harrison, president of The Public Safety Group near Oklahoma City.
"Sometimes politicians overstate the capabilities of technology for
political reasons."