Home      Discussion      Topics      Dictionary      Almanac
Signup       Login


Ask a question about 'TEMPEST'
Start a new discussion about 'TEMPEST'
Answer questions from other users
Full Discussion Forum
Van Eck phreaking

). Compromising emanations are defined as unintentional intelligence
Intelligence (information gathering)


Compromising emanations consist of electrical

, mechanical
Mechanical energy
In physics, mechanical energy is the sum of potential energy and kinetic energy present in the components of a mechanical system. It is the energy associated with the motion and position of an object. The law of conservation of energy states that in an isolated system that is only subject to...

, or acoustical

National security
National security is the requirement to maintain the survival of the state through the use of economic, diplomacy, power projection and political power. The concept developed mostly in the United States of America after World War II...

 information. This energy may relate to the original encrypted

In cryptography, plaintext is information a sender wishes to transmit to a receiver. Cleartext is often used as a synonym. Before the computer era, plaintext most commonly meant message text in the language of the communicating parties....

Electrical conductor
In physics and electrical engineering, a conductor is a material which contains movable electric charges. In metallic conductors such as copper or aluminum, the movable charged particles are electrons...


Magnetic field

- and/or electric field
Electric field

 radiation, line conduction, or acoustic emissions.

The term TEMPEST is often used broadly for the entire field of Emission Security or Emanations Security (EMSEC). The term TEMPEST was coined in the late '60s and early '70s as a codename for the NSA operation to secure electronic communications equipment from potential eavesdroppers and vice versa the ability to intercept and interpret those signals from other sources.

The U.S. government has stated that the term TEMPEST is not an acronym and does not have any particular meaning, however various backronyms have been suggested, including "Transmitted Electro-Magnetic Pulse / Energy Standards & Testing"; "Telecommunications ElectroMagnetic Protection, Equipment, Standards & Techniques"; "Transient ElectroMagnetic Pulse Emanation STandard"; and "Telecommunications Electronics Material Protected from Emanating Spurious Transmissions"; or, jokingly (but just as factually as the other attempts), "Tiny ElectroMagnetic Particles Emitting Secret Things".

TEMPEST measurement standards

The US and NATO TEMPEST standards define three levels of protection requirements:
"Compromising Emanations Laboratory Test Standard"
This is the strictest standard for devices that will be operated in NATO Zone 0 environments, where it is assumed that an attacker has almost immediate access (e.g. neighbour room, 1 m distance).
"Laboratory Test Standard for Protected Facility Equipment"
This is a slightly relaxed standard for devices that are operated in NATO Zone 1 environments, where it is assumed that an attacker cannot get closer than about 20 m (or where building materials ensure an attenuation equivalent to the free-space attenuation of this distance).
"Laboratory Test Standard for Tactical Mobile Equipment/Systems"
An even more relaxed standard for devices operated in NATO Zone 2 environments, where attackers have to deal with about 100 m worth of free-space attenuation (or equivalent attenuation through building materials).

Additional standards include:
  • NATO SDIP-29 (formerly AMSG 719G)
"Installation of Electrical Equipment for the Processing of Classified Information"
  • AMSG 799B
"NATO Zoning Procedures"

All these documents remain classified
Classified information

 and no published information is available about the actual emission limits and detailed measurement procedures that they define. However, some very basic TEMPEST information has not been classified information in the United States
Classified information in the United States
The United States government classification system is currently established under Executive Order 13526, the latest in a long series of executive orders on the topic. Issued by President Barack Obama in 2009, Executive Order 13526 replaced earlier executive orders on the topic and modified the...

 since 1995. Short excerpts from the main U.S.
United States

 TEMPEST test standard, NSTISSAM TEMPEST/1-92
NSTISSAM TEMPEST/1-92, sub-titled COMPROMISING EMANATIONS LABORATORY TEST REQUIREMENTS ELECTROMAGNETICS , is a reference document published as an NSTISSAM by the United States National Security Agency . The document was originally classified, but has been declassified with sensitive information...

, are now publicly available, but all the actual emanation limits and test procedures have been redacted
Sanitization (classified information)
Sanitization is the process of removing sensitive information from a document or other medium, so that it may be distributed to a broader audience. When dealing with classified information, sanitization attempts to reduce the document's classification level, possibly yielding an unclassified...

 from the published version. A redacted version of the introductory TEMPEST handbook NACSIM 5000 was publicly released in December 2000. Equally, the NATO standard SDIP-27 (before 2006 known as AMSG 720B, AMSG 788A, and AMSG 784) is still classified.

The US AIR FORCE has published a few mandatory standards regarding Emission Security:

TEMPEST certification


The United States Army
United States Army

 also has a TEMPEST testing facility, as part of the U.S. Army Information Systems Engineering Command, at Fort Huachuca
Fort Huachuca
Fort Huachuca is a United States Army installation under the command of the United States Army Installation Management Command. It is located in Cochise County, in southeast Arizona, about north of the border with Mexico. Beginning in 1913, for 20 years the fort was the base for the "Buffalo...

, Arizona

. Similar lists and facilities exist in other NATO countries.

TEMPEST certification must apply to entire systems, not just to individual components
Electronic component
An electronic component is a basic electronic element and may be available in a discrete form having two or more electrical terminals . These are intended to be connected together, usually by soldering to a printed circuit board, in order to create an electronic circuit with a particular function...

, since connecting a single unshielded
Shielded cable
A shielded or screened cable is an electrical cable of one or more insulated conductors enclosed by a common conductive layer. The shield may be composed of braided strands of copper , a non-braided spiral winding of copper tape, or a layer of conducting polymer. Usually, this shield is covered...

 component (such as a cable) to an otherwise secure system could dramatically alter the system RF characteristics.

RED/BLACK separation

TEMPEST standards require "RED/BLACK
RED/BLACK concept
The RED/BLACK concept refers to the careful segregation in cryptographic systems of signals that contain sensitive or classified plaintext information from those that carry encrypted information, or ciphertext ....

 separation", i.e. maintaining distance or installing shielding between circuits and equipment used to handle plaintext


Correlated emanations

One aspect of TEMPEST testing that distinguishes it from limits on spurious emission
Spurious emission

s (e.g. FCC Part 15) is a requirement of absolute minimal correlation between radiated energy or detectable emissions and any plaintext data that are being processed.

Public research

In 1985, Wim van Eck
Van Eck phreaking

The metre , symbol m, is the base unit of length in the International System of Units . Originally intended to be one ten-millionth of the distance from the Earth's equator to the North Pole , its definition has been periodically refined to reflect growing knowledge of metrology...

s, using just $15 worth of equipment plus a television


In consequence of this research such emanations are sometimes called "van Eck radiation", and the eavesdropping technique van Eck phreaking
Van Eck phreaking

Bell Labs

 noted this vulnerability to secure TTY
TTY may stand for:* Teleprinter or Teletypewriter or Teletype Printer, a typewriter paired with an electronic communication channel, used for telecommunications or as a computer terminal....

 communications during World War II
World War II

 and was able to produce 75% of the plaintext being processed in a secure facility from a distance of 80 feet. Additionally the NSA published Tempest Fundamentals, NSA-82-89, NACSIM 5000, National Security Agency (Classified) on February 1, 1982. In addition, the van Eck technique was successfully demonstrated to non-TEMPEST personnel in Korea

 during the Korean War
Korean War

 in the 1950s
The 1950s or The Fifties was the decade that began on January 1, 1950 and ended on December 31, 1959. The decade was the sixth decade of the 20th century...


Markus Kuhn
Markus Kuhn
Markus G. Kuhn is a German computer scientist, currently teaching and researching at the University of Cambridge Computer Laboratory. A graduate of the University of Erlangen , he received his MSc at Purdue University and PhD at the University of Cambridge...

Cathode ray tube

 displays and analogue
Analog signal

 video cables, filtering out high-frequency components from fonts

 before rendering them on a computer screen will attenuate the energy at which text characters are broadcast. With modern flat panel display
Flat panel display
Flat panel displays encompass a growing number of electronic visual display technologies. They are far lighter and thinner than traditional television sets and video displays that use cathode ray tubes , and are usually less than thick...

s, the high-speed digital serial interface (DVI
Digital Visual Interface
The Digital Visual Interface is a video interface standard covering the transmission of video between a source device and a display device. The DVI standard has achieved widespread acceptance in the PC industry, both in desktop PCs and monitors...

) cables from the graphics controller are a main source of compromising emanations. Adding random noise to the less significant bits
Least significant bit
In computing, the least significant bit is the bit position in a binary integer giving the units value, that is, determining whether the number is even or odd. The lsb is sometimes referred to as the right-most bit, due to the convention in positional notation of writing less significant digits...

8B/10B encoding
In telecommunications, 8b/10b is a line code that maps 8-bit symbols to 10-bit symbols to achieve DC-balance and bounded disparity, and yet provide enough state changes to allow reasonable clock recovery. This means that the difference between the count of 1s and 0s in a string of at least 20 bits...

 for trying to transport an evenly balanced signal of 0 and 1 bits there may not be much difference between two pixel colours that differ very much in their colour or intensity. It may also be that the generated emanations may differ totally even if only the last bit of a pixel's colour is changed. The signal received by the eavesdropper does also depend on the frequency where the emanations are detected. The signal can be received on many frequencies at once and each frequency's signal differs in contrast
Contrast (vision)
Contrast is the difference in visual properties that makes an object distinguishable from other objects and the background. In visual perception of the real world, contrast is determined by the difference in the color and brightness of the object and other objects within the same field of view...

 and brightness

Saturation (telecommunications)
In telecommunications, the term saturation has the following meanings:*In a communications system, the condition at which a component of the system has reached its maximum traffic-handling capacity...

 and thus overwhelming the receiver input.

Light-emitting diode

 indicators on computer equipment can be a source of compromising optical emanations. One such technique involves the monitoring of the lights on a network switch
Network switch
A network switch or switching hub is a computer networking device that connects network segments.The term commonly refers to a multi-port network bridge that processes and routes data at the data link layer of the OSI model...

. Almost all network switches flash to show activity, and it is normal for the flashes to be directly taken from the data line. As such, a fast optical system can easily see the changes in the flickers from the data being transmitted down the wire.

Further, recent research has shown it is possible to detect the radiation corresponding to a keypress event from not only wireless
Wireless telecommunications is the transfer of information between two or more points that are not physically connected. Distances can be short, such as a few meters for television remote control, or as far as thousands or even millions of kilometers for deep-space radio communications...


See also

  • Computer surveillance
    Computer surveillance
    Computer surveillance is the act of performing surveillance of computer activity, and of data stored on a hard drive or being transferred over the Internet....

  • Computer insecurity
    Computer insecurity
    Computer insecurity refers to the concept that a computer system is always vulnerable to attack, and that this fact creates a constant battle between those looking to improve security, and those looking to circumvent security.-Security and systems design:...

    ECHELON is a name used in global media and in popular culture to describe a signals intelligence collection and analysis network operated on behalf of the five signatory states to the UK–USA Security Agreement...

  • Side channel attack
    Side channel attack

External links