VIRVE Network Vulnerabilities: One Person with a Laptop Can Crack the Authorities' Secrets

VIRVE is the backbone of Finland's public safety communications: a critical radio network used by the police, emergency services and the defence forces. It enables secure communication in the field, whether at an accident scene or during a military operation. The network is built on the TETRA standard, which has served for years — but now its weaknesses have been exposed. The findings of the Dutch research group Midnight Blue from 2023 and 2025 are alarming: encryption algorithms such as TEA2 contain vulnerabilities that enable oracle attacks and keystream leaks. These are not mere theories — they are real gaps that can be exploited.

In Finland, the transition to the new VIRVE 2 is underway. This 5G-based network promises quantum-safe encryption and better protection, but full migration is dragging on until at least 2028. The legacy TETRA-based VIRVE is being maintained for critical operations, which means every delay exposes the country's security to risk. Imagine if someone gained access to the police's real-time communications or the defence forces' routines. The worst part is that the greatest threat no longer comes from massive state-level operations — it comes from skilled individuals. Technology has made it possible and frighteningly easy.

Technology Levels the Playing Field: Anyone Can Be a Threat

Previously, attacks of this kind required state-level budgets and years of research. That has changed. The hardware is cheap: the HackRF Pro, a versatile SDR (software-defined radio), costs just 400–600 euros and fully covers VIRVE's frequencies. Pair it with a powerful laptop — a high-end MacBook or a Ryzen machine (under 3,000 euros) — and you have a portable recording and analysis system.

The software is freely available. GitHub hosts the cryptographic primitives published by Midnight Blue, the OsmoTETRA project for protocol processing, and GNU Radio for signal demodulation. A skilled individual can assemble these building blocks in weeks — no need to reinvent the wheel. If personal skill falls short, help is available through dark web freelance services: "Write a script for radio signal analysis, paying 1,000 euros." No one asks about the intended use — though free and unrestricted llama-based local AI models can do the same for nothing, and in capable hands, more reliably.

Cloud computing changes everything. AWS, Google Cloud or Azure offer massive processing power at hourly rates — a few hundred euros buys a thousand-core cluster for a day. And AI helps: language models like Claude or Grok assist with code debugging and optimisation. "Write a Python function to decode a TETRA frame" — and you get a skeleton in moments.

This democratisation means that thousands of Finns — IT professionals, students or hobbyists — have the necessary skills. Budget? Under 5,000 euros. Time? A few weeks. And all of it is legal: SDR devices are standard tools for radio amateurs, and cloud computing is a normal IT service.

A One-Person Operation: How It Could Happen

Imagine a skilled individual — say, a journalist who suspects they are under surveillance, perhaps because of their work or activism. They know about VIRVE's vulnerabilities and decide to investigate further. The work begins with preparation: they fire up the HackRF Pro and their powerful laptop, download the necessary tools from GitHub. AI helps connect the pieces: they build an automated recording system that captures VIRVE traffic in the background.

They carry the setup in a backpack: HackRF connected to the laptop via USB, data flowing to an SSD, and a couple of large power banks. As they move through the city — shops, hobbies, errands — the backpack is with them, recording all radio traffic in their vicinity. Over a few days, gigabytes of raw data accumulate, though it is limited: only local traffic, not the entire country.

The first analysis phase happens in real time or immediately after recording. They do not need to break the encryption straight away, because TETRA traffic contains metadata — device IDs, timestamps and protocol frames — that can be decoded directly. Using OsmoTETRA tools, they parse recurring patterns from the recordings: "This ID appears frequently when I'm on the move — it's likely a surveillance radio." They build profiles: daily rhythms (e.g., active in the mornings), location correlations (IDs appearing in the same places) and communication chains (who talks to whom). This way, they map the structure of the surveillance without ever listening to a voice.

The surveillance data also makes it possible to identify which operational agencies are involved: Is it the police, the NBI, SUPO or military intelligence — or the emergency services? This is entirely realistic, as different organisations share the VIRVE network, and metadata or decoded content often reveals involvement through, for example, message types or device IDs.

Next comes full decryption. In the evening at home, after first enjoying a cup of tea, they launch the tools: GNU Radio demodulates the signals, OsmoTETRA processes the frames, and Midnight Blue's primitives enable an oracle attack on the TEA2 encryption. If the data set is small (a few minutes), their own laptop suffices — processing takes 10–30 minutes on a powerful M4 processor. A larger batch? They rent cloud capacity; a few hours costs a few hundred euros.

Results: Decrypted voice, text and metadata.

If needed, they know what is being said on VIRVE in near real time: While ordering a pizza at a restaurant, they can open their laptop and check the situation: "They're sending reinforcements this way." Who is communicating with whom, operational routines, and even terminal locations. Near-real-time capability enables counter-response: they can change their plans immediately, before the surveillance team has time to react.

The entire operation: budget roughly a few thousand euros (hardware, rent, cloud and restaurant bills).

Time: a few weeks.
Personnel: One. They look like any ordinary person with a laptop — perhaps working remotely at a café or a lunch restaurant, enjoying a meal. No one notices.

Why This Is More Frightening Than State-Level Operations

Large-scale state operations leave traces: personnel are moved, infrastructure is built, communications are monitored. Intelligence services can detect them. One skilled individual? They need no logistics — everything fits in a backpack. The hardware is legal, the software is free, the cloud is cheap. Defence is difficult: you cannot monitor every HackRF buyer or ban open-source projects.

Across Europe, the situation is the same. Countries using TEA2 encryption — such as Sweden (RAKEL), Germany (BOSNET) and Britain (Airwave) — face the same threat. Transitions to new networks are progressing, but delays leave gaps. In Finland, VIRVE 2 is critical, but every day on the old network is a risk. The worst part: we do not know whether this has already been exploited. The operation is so discreet that it could happen without anyone knowing.

What happens to the collected intelligence? Depending on the actor, such an individual could, if they chose, expose the operational details of state agencies, reveal resource allocation — how many resources have been spent surveilling a single person — and, with all traffic decrypted, also lay bare command chain communications. Of course, today, precisely for security reasons, not all traffic passes through VIRVE — but what does pass through is revealing.

Wake-Up Call: Act Before It Is Too Late

This is not science fiction — it is reality in 2026. Technology has placed the power of state-level tools within the reach of individuals. VIRVE's vulnerabilities combined with cheap computing power create a situation where one skilled person can compromise national security.

The solution? Accelerate the rollout of VIRVE 2, increase awareness among authorities, and consider legislation for technology oversight — without restricting freedoms. Openness is the best defence: share information, investigate threats and build better networks. This is how we ensure that public safety communications remain protected — even from individual threat actors.

Sources

• Midnight Blue: TETRA:BURST (2023) and 2TETRA:2BURST (2025) research, available on GitHub.
• Erillisverkot Oy: VIRVE 2 transition information (official website, updated 2026).
• ETSI: TETRA standards and TEA2 encryption (technical specifications).
• Osmocom project: Open-source TETRA tools.