Link Layer Authentication. Essentially the radios are loaded with an encryption algorithm that the system uses to encrypt the registration handshake of the radio. If the algorithm exchange is is successful, then the radio is authenticated on the radio system (approved for use). This encryption algo is separate from talkgroup encryption. It's a method to keep unauthorized users off the system (i.e. those who have the ability to clone radio IDs). LLA shouldn't be confused with LLE (Link Layer Encryption) which is where the entire OTA data stream is encrypted (i.e. not even scanners or SDRs would be capable of monitoring without the correct key).