Those charged with ensuring that land-mobile-radio (LMR) systems operate reliably need to “wake up” to the cybersecurity risks associated with these critical voice-centric services, according to one LMR consultant
By Donny Jackson, Editor
Cyberattacks typically are acknowledged as a challenge to Internet Protocol (IP) networks, but those charged with ensuring that land-mobile-radio (LMR) systems operate reliably need to “wake up” to the cybersecurity risks associated with these critical voice-centric services, according to one LMR consultant.
Manager of wireless technologies for Mission Critical Partners, Nick Falgiatore said that one of the LMR industry’s shortcomings is “the belief that radio systems are closed networks.”
“They’re not,” Falgiatore said during an IWCE 2025 conference session entitled LMR cybersecurity: It’s time to wake up. “Land-mobile-radio networks are just as susceptible to [cyberattacks] as any other network. And the networks are more susceptible to cyberattacks today than they were in the past—big time.”
Indeed, old-school LMR networks—many of which were siloed systems—revolved around issues like RF interference, unauthorized system access and cloning of radios, according to Falgiatore.
“These are all things that we’ve lived with in the radio world for a long time, and they happen at the local level,” he said. “Typically, it’s because somebody locally is intentionally trying to disrupt communications, steal copper, or do something [else] that happens locally.
“It’s generally not an event that is going to take your system down for an extended period of time. They are a major nuisance, but we have tools out there for trying to deal with these types of events.”
But the increased use of modern, IP-based networking technologies and software throughout LMR networks—not just in the radio technology, but also in things like backhaul connectivity—make them more susceptible to ransomware and other cyberattacks that can have “catastrophic” implications in comparison to local LMR issues, Falgiatore said.
“Cybersecurity vulnerabilities … run the risk of resulting in your entire system being completely disabled for a prolonged period of time,” Falgiatore said. “These are attacks that are happening from overseas. They’re happening from foreign countries.
“They’re happening from anyone out there in the world who is trying to find any network out there that they can adjust with some bit of malware that would then encrypt all of the data on your network—making all of the data entirely unusable—until you pay them a check, so they will give you a special key to hopefully recover that network.”
One of the benefits of IP-based networking is that it can make many historically time-consuming processes—such as monitoring the health of an LMR network or updating software—much more convenient and efficient. However, features like remote-monitoring functionality can create potential cybersecurity vulnerabilities, Falgiatore said.
“I was sitting at one of our client’s … radio-management terminals, doing some testing, and I was shocked at how many times you would see the mouse from some sort of remote connection moving around,” Falgiatore said. “Somebody had access to the network. And every single person that did that had the same standardized login and password that they were using for that connection. The county had no idea who it was or what they were doing, but it was happening all the time—probably several times an hour.
“This what we see as standard across most systems. If you aren’t controlling your vendor and dictating policy and rules about how that network is accessed, they’re going to do things they way that they always have, which is using these standard practices of sharing passwords.”
Some radio vendors offer cybersecurity services, but Falgiatore said most of these are quite expensive and primarily involve security monitoring for only the radio network.
Such tools “have eyes on the network that can show us that—if something happens—to notify someone that something is happening,” Falgiatore said. “But this is only part of the solution. We can’t just have a security monitor that waves its hands and says, ‘You’ve got a problem’ and not have anything to do about it.
“We need to know not just that we have a problem, but that we have some plan for what we’re going to do about it.”
But few public-safety operators of LMR networks are prepared for such a situation, according to Falgiatore.
“Response and recovery are grossly lacking,” he said. “I am seeing virtually no agencies focusing on response and recovery plans.”
Falgiatore acknowledged that the response and recovery to a potential cyberattack on an LMR system will be daunting tasks, which is why it is important for network operators to have plans in place to address such a scenario.
“Think about how much time and resources it would take to repair an LMR network that’s been compromised,” Falgiatore said. “Do you think anybody in your organization or you vendor’s organization has the resources or have planned to figure out what that looks like? This is the type of unimaginable situation that we need to do everything we can in our industry to keep from happening.”
A lack of education and training among those overseeing LMR networks makes the cybersecurity issue even more challening, Falgiatore said.
“We go from organization to organization, and the folks that manage radio systems are generally technicians—folks that are used to fixing radios and managing radio systems,” Falgiatore said. “They don’t understand IP. They don’t understand networking. They don’t come out of the IT space. They certainly don’t understand cybersecurity.
“So, we have a major gap within our industry, in terms of the folks managing these [LMR] systems even understanding these protocols and what we need to do to protect our networks. What is good cyber hygiene, what are the right policies we need to have in place, and how do we force our vendors to put these solutions where they need to be?”
