## 2 Overview of Cyber Threats in EM
### Communication Media
#### 2.1.4 Professional Mobile Radio  
Communication between EM personnel, vehicles and equipment is often based on domain-specific mobile radio technologies, such as Terrestrial Trunked Radio (TETRA) developed in Europe and P25 developed in the United States. TETRA and P25 networks do not suffer the congestion issues of public cellular networks, but provide low communication speeds in comparison with modern standards.  
TETRA and P25 have been designed with protection against eavesdropping as a primary consideration from the start. TETRA relies mainly on four encryption algorithms (TEA1-4), which differ depending on the organisation involved (commercial _vs._ public safety; and whether within the EU or not). It supports the mutual authentication of a mobile station and the network, so as to control access to the network and for the mobile station to check whether the network can be trusted. Keys can be static or dynamic depending on the situation, terminals can be disabled if lost or stolen, and encryption is end-to-end. As one would expect, details of the implementation of each encryption algorithm in P25 and TETRA have not been published, but their security architectures have been detailed in several publications [28, 29].  
_Open issues in the security of Professional Mobile Radio used in EM_: Despite the emphasis of TETRA and P25 on relatively strong encryption approaches, researchers have identified flaws in both. TETRA's TEA2 advanced cipher, which is available only to European public safety organisations, has been shown to be unable to protect against attacks that clone both the terminal identifier and the authentication key if the latter were exposed when distributed to the authentication centre [28].  
One of the first known security analyses of P25 has been published in [29]. Its authors have used the GNUradio open-source SDR software as their research platform and have identified that the lack of authentication on P25 voice and most other types of data traffic constitutes a significant problem. They have demonstrated a location privacy attack that can locate a radio even when its user is not actively using it. They have also discussed a physical layer jamming technique that can be used to perform denial of service. As communication speeds provided by P25 are already relatively low, a denial of service attack would have a severe effect on the first responders' coordination during an emergency.  
Also using GNUradio as the basis of their investigation, [PERSON] _et al_. [30] have developed an open-source P25 packet sniffer and analyser. With this system in place, they have demonstrated how to bypass the authentication and access control mechanism and how to disable specific nodes at will, as well as passive recovery of encryption keys. In a laboratory environment, they have captured traffic from various radio systems and transmitted and received them using P25 radios. Most significantly, they have described in detail a widely-used proprietary P25 cipher system and have shown how to recover the encryption key without considerable effort. According to their research, this is primarily the result of the fact that encryption is optional in P25, thus allowing a malicious user to inject messages in the clear that the network infrastructure will handle as if they are legitimate. Another significant shortcoming is the lack of a key hierarchy, which means that a single key is used to encrypt traffic between many users over many sessions.  
As the authentication of both TETRA and P25 has been shown to be possible to overcome with only low cost equipment, it is not safe to assume that passive cryptographic mechanisms will be enough to protect communication over professional mobile radio during an emergency. Thus, an open issue for research is the development of active methods for detecting a successful security breach.