Manitoba·CBC Investigates

City of Winnipeg manager in charge of police radios arrested after 2-year investigation

Winnipeg police have arrested a city manager for allegedly updating police radios with software he got from a person the U.S. Department of Homeland Security considered a security threat, CBC News has learned.

'You don’t want to know where these came from': Police allege he directed employees to use fraudulent software

A manager with the City of Winnipeg's radio shop was surprised to learn he was the subject of a police probe. In early February, Ed Richardson told CBC News he was never contacted by investigators about any allegations. Days later, he was placed on administrative leave, more than two years after the police investigation began. (Trevor Brine/CBC)

Winnipeg police have arrested a manager with the city for allegedly updating police radios with fraudulent software he got from a person considered to be a security threat by the U.S. Department of Homeland Security, CBC News has learned.

Back in 2011, Ed Richardson allegedly obtained millions of dollars worth of illegal software and instructed city employees to use it, police said in a January 2018 sworn affidavit, submitted to the Provincial Court of Manitoba when officers were seeking permission to search the man's emails.

Until his arrest last Thursday, Richardson was the manager of the City of Winnipeg radio shop, responsible for repairing and maintaining radios used by the Winnipeg Police Service and Winnipeg Fire Paramedic Service.

The allegations stem from a time when the police service used fully encrypted Motorola radios, which allowed officers to talk in secret, as the only way to unlock the audio and listen to the conversations was with an encryption key. (Prior to 2010, anyone who wanted to eavesdrop on police calls could potentially do so through websites that provided access to police scanners.)

The Winnipeg Police Service began using fully encrypted Motorola radios to communicate in 2010, which allowed officers to talk in secret, as the radios require an encryption key to unlock the audio. (Motorola Solutions)

In the affidavit, police said the Motorola radios needed frequent updating, which could only be done if the city purchased a "refresh key" or licence from the company to unlock the proprietary software. Motorola charged about $94 per update per radio, the document said, and a radio shop employee told police Richardson didn't like that.

"[The employee] does not believe his actions were for personal gain; he believes that Richardson likes the idea of not giving more money to Motorola," the affidavit said.

The employee came forward with information in 2017. At the time, the WPS and WFPS were in the process of launching a new emergency radio system for first responders — a project Richardson was leading.

"[The employee] is concerned that Richardson's lack of integrity may put the security of this new radio system in jeopardy," the affidavit said. 

Winnipeg police seized a USB reader and a device called an iButton, pictured at left, from the City of Winnipeg radio shop in April 2017 as part of the investigation. (Manitoba Provincial Court)

According to the affidavit, the employee told police that in 2011, Richardson gave him a device known as an iButton that was preloaded with more than 65,000 refresh keys and told him "you don't want to know where these came from."

The employee said they "clearly" didn't come from Motorola, the court document stated.

If the fraudulent refresh keys had been legitimately purchased, it would have cost the city millions, police allege. It's estimated the keys were used over 200 times and cost Motorola nearly $19,000 in lost revenue.

U.S. Homeland Security investigating

In the affidavit, police said they suspect Richardson got the unauthorized software from a Winnipeg ham radio enthusiast who was under investigation south of the border.

In September 2016, a special agent from the U.S. Department of Homeland Security (DHS) travelled to Winnipeg to brief local law enforcement about an investigation into the activities of the Winnipeg man, the court document said.

The agent said the man reprogrammed Motorola radios for clients around the world and was capable of encrypting them.

"This allows the criminal element to communicate without fear of interception by government or law enforcement," the court documents said. "A significant number of these encrypted radios have been seized from the Mexican drug cartel members."

Motorola examined some of those seized radios and believed that the techniques used to "hack" them were consistent with the method used by the Winnipeg man, the affidavit said.

"There is a Chinese method of achieving the same result but it is quite different," the document read.

The Winnipeg man was detained by DHS agents in May 2016 while on his way back to Canada from a radio convention in Dayton, Ohio, the affidavit said. Agents seized his electronics, including a laptop, and tools needed to encrypt Motorola radios.

They also seized an iButton. "There is no legitimate way that [the man] could be in possession of this device and [it] would have had to been supplied to him nefariously."

Police said in the affidavit they believe Richardson gave the man the iButton.

Richardson awarded for his work

In spring 2017, the WPS and WFPS transitioned from Motorola radios to Harris equipment — a project spearheaded by Richardson that took four years to complete.

As the city was bragging about an award Richardson won for the project, he was under police investigation.

Ed Richardson was awarded 'technologist of the year' in December 2018 from the Association of Public-Safety Communications Officials in Canada. He was recognized for his work on a project to upgrade the emergency radio systems for first responders — all while he was the subject of a two-year police investigation. (City of Winnipeg)

"Ed was instrumental in providing leadership to our project team," Glen Cottick, the city's senior manager of business technology services, said in a Dec. 12, 2018 statement announcing the award.

Twelve months earlier, Cottick had been served a court order to provide police with Richardson's emails that were stored on the city's servers. (Cottick was not under investigation; it's his job to make sure the city complies with court orders.)

When CBC News contacted Richardson earlier this month, he said he was surprised to learn he had been under investigation for more than two years. No one from the Winnipeg Police Service had ever questioned him about any allegations, he said.

Richardson declined an interview request, citing concerns it could compromise the case, but said he was going to get in touch with officers to see if he could talk. Richardson also said he was aware police were at one point looking into the radio enthusiast, who he knows through the broader radio community, but said he wasn't sure if that investigation was still ongoing.

Days later, Richardson was placed on administrative leave. According to a co-worker, employees were told not to contact him, but were not given a reason why.

A city spokesperson would not comment on Richardson's leave, saying "it is a human resources matter."

When CBC News contacted the city again after Richardson's arrest, a spokesperson declined to answer questions, saying it was a "human resources and police matter."

A Winnipeg police spokesperson said its investigation is now complete and Richardson is expected to be formally charged during a court appearance next month, when he will face a number of criminal code offences, including fraud over $5,000, unauthorized use of a computer, possession of a device to obtain unauthorized use of a computer and possession of a device to obtain telecommunication service.

There is no allegation the fraudulent software put the security of police radios at risk.

None of the allegations have been proven in court.

No other arrests are expected, police said.

Winnipeg police have arrested a manager with the city for allegedly updating police radios with fraudulent software he got from a person considered to be a security threat by the U.S. Department of Homeland Security, CBC News has learned. 2:54

About the Author

Caroline Barghout

Investigative Reporter, CBC Manitoba I-Team

Caroline began her career co-hosting an internet radio talk show in Toronto and then worked at various stations in Oshawa, Sudbury and Toronto before landing in Winnipeg in 2007. Since joining CBC Manitoba as a reporter in 2013, she has won an award for her work on crowded jails and her investigation into Tina Fontaine's death led to changes in the child welfare system. Email: caroline.barghout@cbc.ca