There’s also a capability, mandated by the federal interoperability standards (compliance with which federal free money to upgrade local PD radios hinges upon) to zeroize (erase/disable) encryption keys in a radio remotely, for example if one is lost or stolen, to prevent rogue network access.
Misuse of the rekeying admin keys to remotely disable police radios in bulk is a very interesting DoS, and one that should be noted well by (usually civilian outsourced) police radio maintenance admins presently reading this comment if cops or other users of these encrypted radio systems start being deployed to mass murder civilians.
As I understand it, the same interoperability protocols also can interrogate the radios for their locations if GPS equipped. (I have not personally read the spec docs yet.) I’d love to see the mashup made of that data, or an oversight organization using it to track criminal cops and parallel construction efforts.