City of Winnipeg manager in charge of police radios arrested after 2-year investigation
'You don’t want to know where these came from': Police allege he directed employees to use fraudulent software
UPDATE: In October of 2020, Manitoba's prosecution services told CBC News they don't plan on proceeding with any charges in this matter.
Winnipeg police have arrested a manager with the city for allegedly updating police radios with fraudulent software he got from a person considered to be a security threat by the U.S. Department of Homeland Security, CBC News has learned.
Back in 2011, Ed Richardson allegedly obtained millions of dollars worth of illegal software and instructed city employees to use it, police said in a January 2018 sworn affidavit, submitted to the Provincial Court of Manitoba when officers were seeking permission to search the man's emails.
Until his arrest last Thursday, Richardson was the manager of the City of Winnipeg radio shop, responsible for repairing and maintaining radios used by the Winnipeg Police Service and Winnipeg Fire Paramedic Service.
The allegations stem from a time when the police service used fully encrypted Motorola radios, which allowed officers to talk in secret, as the only way to unlock the audio and listen to the conversations was with an encryption key. (Prior to 2010, anyone who wanted to eavesdrop on police calls could potentially do so through websites that provided access to police scanners.)
In the affidavit, police said the Motorola radios needed frequent updating, which could only be done if the city purchased a "refresh key" or licence from the company to unlock the proprietary software. Motorola charged about $94 per update per radio, the document said, and a radio shop employee told police Richardson didn't like that.
"[The employee] does not believe his actions were for personal gain; he believes that Richardson likes the idea of not giving more money to Motorola," the affidavit said.
The employee came forward with information in 2017. At the time, the WPS and WFPS were in the process of launching a new emergency radio system for first responders — a project Richardson was leading.
"[The employee] is concerned that Richardson's lack of integrity may put the security of this new radio system in jeopardy," the affidavit said.
According to the affidavit, the employee told police that in 2011, Richardson gave him a device known as an iButton that was preloaded with more than 65,000 refresh keys and told him "you don't want to know where these came from."
The employee said they "clearly" didn't come from Motorola, the court document stated.
If the fraudulent refresh keys had been legitimately purchased, it would have cost the city millions, police allege. It's estimated the keys were used over 200 times and cost Motorola nearly $19,000 in lost revenue.
U.S. Homeland Security investigating
In the affidavit, police said they suspect Richardson got the unauthorized software from a Winnipeg ham radio enthusiast who was under investigation south of the border.
In September 2016, a special agent from the U.S. Department of Homeland Security (DHS) travelled to Winnipeg to brief local law enforcement about an investigation into the activities of the Winnipeg man, the court document said.
The agent said the man reprogrammed Motorola radios for clients around the world and was capable of encrypting them.
"This allows the criminal element to communicate without fear of interception by government or law enforcement," the court documents said. "A significant number of these encrypted radios have been seized from the Mexican drug cartel members."
Motorola examined some of those seized radios and believed that the techniques used to "hack" them were consistent with the method used by the Winnipeg man, the affidavit said.
"There is a Chinese method of achieving the same result but it is quite different," the document read.
The Winnipeg man was detained by DHS agents in May 2016 while on his way back to Canada from a radio convention in Dayton, Ohio, the affidavit said. Agents seized his electronics, including a laptop, and tools needed to encrypt Motorola radios.
They also seized an iButton. "There is no legitimate way that [the man] could be in possession of this device and [it] would have had to been supplied to him nefariously."
Police said in the affidavit they believe Richardson gave the man the iButton.
Richardson awarded for his work
In spring 2017, the WPS and WFPS transitioned from Motorola radios to Harris equipment — a project spearheaded by Richardson that took four years to complete.
As the city was bragging about an award Richardson won for the project, he was under police investigation.
"Ed was instrumental in providing leadership to our project team," Glen Cottick, the city's senior manager of business technology services, said in a Dec. 12, 2018 statement announcing the award.
Twelve months earlier, Cottick had been served a court order to provide police with Richardson's emails that were stored on the city's servers. (Cottick was not under investigation; it's his job to make sure the city complies with court orders.)
When CBC News contacted Richardson earlier this month, he said he was surprised to learn he had been under investigation for more than two years. No one from the Winnipeg Police Service had ever questioned him about any allegations, he said.
Richardson declined an interview request, citing concerns it could compromise the case, but said he was going to get in touch with officers to see if he could talk. Richardson also said he was aware police were at one point looking into the radio enthusiast, who he knows through the broader radio community, but said he wasn't sure if that investigation was still ongoing.
Days later, Richardson was placed on administrative leave. According to a co-worker, employees were told not to contact him, but were not given a reason why.
A city spokesperson would not comment on Richardson's leave, saying "it is a human resources matter."
When CBC News contacted the city again after Richardson's arrest, a spokesperson declined to answer questions, saying it was a "human resources and police matter."
A Winnipeg police spokesperson said its investigation is now complete and Richardson is expected to be formally charged during a court appearance next month, when he will face a number of criminal code offences, including fraud over $5,000, unauthorized use of a computer, possession of a device to obtain unauthorized use of a computer and possession of a device to obtain telecommunication service.
There is no allegation the fraudulent software put the security of police radios at risk.
None of the allegations have been proven in court.
No other arrests are expected, police said.
ABOUT THE AUTHOR
