Sorry, the air interface IS encrypted, just as mobile phones are, but
from BTS to control is not.

Which class air interface encryption are they using then? No key,
static or dynamic ?