Batboard

We had a portable radio stolen the other day, a HT 1000 and when I called dispatch to see if they could stun the radio they told me they couldn’t do that. (We have ht1250s as well)

I know that it can be done what does it take to send the command? I have a full signaling maxtrac and we have some cdm 1250s. Do I need further equipment? If so other than a console how can I do this on a nonexistent budget?

Any ideas or suggestions?

dont quote me on this, but i think that the ONLY thing that will do stun/kill is a console.

firegood wrote:dont quote me on this, but i think that the ONLY thing that will do stun/kill is a console.

Correct.. the MaxTrac and CDM will only do call alert, radio check, and sel- call.

-Josh

I thought only trunking systems can get stung. Conventional as well?

jmr3865 wrote:I thought only trunking systems can get stung. Conventional as well?

Conventional systems use MDC signalling for things such as inhibiting radios, whereas trunked radios use the built-in data protocols of the control channel to do it. The end result is the same.

Todd

Imagine Joe Criminal being able to stun all the radios on a system using an Ebay Maxtrac. *shiver*

I have yet to hear of an HT1000 being disabled through an inhibit command sent by another radio, but if MDC is used on every portable, and the stolen radio is also MDC enabled, then it should be possible to lock out that MDC code, but I would assume a console command woule be the 'only' method to actually inhibit the radio from the 'system'.

Since I do not have a later version of an HT1000, I have not seen anyplace within the RSS that allows 'STUN' or 'INHIBIT' to be possible, the controller is not configured for those features as the HT1000 is a limited features radio to begin with.

There's also no option for secure capabilities, so an aftermarket board for those options are also 'vaporware'.

Hopefully, a simple command to inhibit that individual radio's MDC identifier will be all that's possible, the radio will still be usable though, which is unfortunate for your department.

MDC is easily configured for repeater usage, I've used a similar controller to limit users on my UHF repeaters in WI. It's a great tool to keep the lids, kids and space cadets OUT, yet allow legit users have free roam.

The ONLY RSS options for the HT1000 are the following:

Remote Monitoring

Radio Check

Emergency ACK Alert

There are NO provisions for Stun or Inhibit within the RSS for this radio.

Killing a HT1000 using MDC1200 is not a programmable feature. It is there by default and does work. Typically a console capable of transmitting the kill signal targeting the radio ID, kills the radio. I believe it even works with MDC1200 capable GP300 portables.

Nand.

Does anybody have or can anybody make a recording of a kill signal being sent?

I will second what NAND said...the HT1000, as well as later radios such as the CM200 series, will respond to an MDC inhibit command. It is NOT an RSS programmable feature...that would circumvent the logic behind the feature.

And, the inhibit command makes the radio a complete brick...no usage at all...which is it's intent. This is why only systems which invest in some sort of console can perform this command.

Todd

olderookie wrote:We had a portable radio stolen the other day, a HT 1000 and when I called dispatch to see if they could stun the radio they told me they couldn’t do that. (We have ht1250s as well)

I know that it can be done what does it take to send the command? I have a full signaling maxtrac and we have some cdm 1250s. Do I need further equipment? If so other than a console how can I do this on a nonexistent budget?

Any ideas or suggestions?

What console are you using? Does it have any MDC features? Perhaps it isn't configured for killing but capable for it, if setup.

Nand.

The Centracom series consoles should be able to send the command...as long as the feature is enabled in the console.

You may want to see if you can have your agencies console get reprogrammed for the feature. What I don't get, my last one had radio check enabled, but inhibit disabled. Go figure.

Zap,

Why do you want a recording of an inhibit signal. If you have heard what an MDC signal sounds like, that would basically be what the inhibit signal sounds like as well.

Am I correct in saying this? Anybody??

Pretty much. We use Zetron consoles with the kill feature and it sounds like a couple short MDC bursts.

nand,

We contract with St. Louis county for dispatching services so we are basically locked into what they say.

I would try to see if we could do more but the civilian in charge of the comms center is a control freak and even though he seemed to be better after 9/11 and New Orleans he has gone back to his old ways.

I think they have something cooking on the horizon as anytime he gets like this it seems that he wants to remain the HMFIC.

I do know they have a bunch of radios that they are going to disperse to the leadership of the county. I did ask about it and he acted as if we were a bother. We spend $30,000 a year and they feel we are a bother, I think I can see a bother coming.

He is already despised in the radio community as it is and he can always seem to make it worse. I hate people that have the "I am not going to share my toys" attitude. I am here to do a job and I need critical communications for it. I am not here to play games and listen to how this is not how I want it. This is about how it needs to be.

If we were to have a major incident in the St. Louis area our comms would fall to the level of car to car and that is it the fancy comms center would be useless again. As it seems to be at times when we can't even get on the air.

I had a foot pursuit and I have to use the orange button to get on the air because of all the congestion we seem to have constantly. That to me sounds like bad management, I could be wrong but I doubt it. (Rant over)

So since I get no help from the contracted agency what can "I" do to shut off a radio in the event it is stolen?

if i am understanding everyone here, you can either get them to upgrade there console. Buy a new console. Or get someone at another comms center that can disable. I do not think that "recording" it and transmitting it over the air is going to have a bit of difference.

There really is not much you can do without a console that is capable MDC1200 kill. And then this only will work if the radio has MDC enabled and you know the ID that was programmed into the radio. And on top of that, the radio needs to be on in order to receive the kill transmission.
If whoever has the radio uses it for listening, he won’t hear nothing more than what you can hear on a scanner. Soon the battery will die. Just hope the radio isn’t used to cause interference.

Nand.

Looking at this from the opposite perspective...

Does inhibiting a radio involve any more than sending the radio's number and the inhibit code? Does this mean that someone with a console (I've seen them on eBay in the $1,000 range, though I don't know much of anything about consoles) could start inhibiting radios after watching their IDs?

Wasn't there an open-source program mentioned here to encode/decode MDC?

Is there an option in RSS to set a radio to not do anything with an inhibit signal? It just seems to me like the people who run Motorola gear as their personal radios would be at a risk should some random idiot get their hands on an old console. Or am I paranoid?

Will an inhibited radio, while appearing dead, listen for an un-inhibit signal?
Is the only way to recover from inhibit, you need to already have an un-inhibited copy of the codeplug and just re-program it with the good copy?
Or does it depend on the radio, or does that not help.
I've only seen one LAB RSS that had the inhibit/un-inhibit as a viewable/changable item.

Doug

You aren't being paranoid. The MDC1200 Inhibit and the P25 inhibit are pretty open signals. They don't have any encryption or authentication AFAIK. If somebody knows the destination ID and can generate the signal on the right frequency (MDC1200 encoders into a terminal mic might work, P25 is harder) they can inhibit the radio. I think that some terminals allow you to block inhibits or to make sure that the inhibit source is also correct.

Zap wrote:Will an inhibited radio, while appearing dead, listen for an un-inhibit signal?
Doug

Yes, in fact it's the 'correct' way to un-inhibit the radio. Older radio models could have a good codeplug cloned into them & bypass the inhibit that way...but newer radio models won't allow that. Even previously capable radios (such as the MTS2000 & MCS2000, Astro Saber/XTS3000) if programmed with the newest CPS versions cannot be revived (read the 'readme.txt' file in the latest CPS versions for verification).

Of course, there's always the LAB RSS to get around that too...but nobody here has that...right? Not to mention, there is no LAB for radios such as the CP/CM series, XTS2500/5000, etc...which can all be inhibited too.

Todd

I seem to remember some of the older tone remote handsets being able to send radio inhibit messages too. Like the old c100, and c200 or am I wrong?

craig wrote:I seem to remember some of the older tone remote handsets being able to send radio inhibit messages too. Like the old c100, and c200 or am I wrong?

Yes, they qualify as consoles. The C100 & C200 "advanced" models with the Stat-Alert package could send an MDC inhibit command. Same with the newer MC2000/2500 series.

Todd

So there is a cheap way to get it done. I have seen C100, C200, and MC2000's for as cheap as $100.00 on ebay. If I'm not mistaken, these can be interfaced to a mobile radio, (maxtrac, etc.) and there you have it.

If my memory serves me correctly, there is an option in (XTS 3000 software) both MDC systems and Astro systems to either ENABLE/DISABLE radio inhibit. If you select DISABLE can your radio still become inhibited upon detecting the kill tone with the correct id?

Wayne

judoka wrote:You aren't being paranoid. The MDC1200 Inhibit and the P25 inhibit are pretty open signals. They don't have any encryption or authentication AFAIK. If somebody knows the destination ID and can generate the signal on the right frequency (MDC1200 encoders into a terminal mic might work, P25 is harder) they can inhibit the radio..

This is one of the reasons I haven't posted any sample code for using the transmit side of my MDC libraries. It'd take about 10 minutes for some idiot with a transmitter on the right frequency to whip up a system that sent "STUN" to every MDC ID it heard using a PC, a sound card, and a little transmitter keying logic. Easy to find whoever it was with DF, of course, but no sense in making it any easier than it already is.

Personally, given the ridiculous total lack of security in the protocol, I'd do whatever programming it took to make sure my radios wouldn't believe an over-the-air stun request.