TEMPEST Shielding

A Faraday cage is a continuous conductive enclosure that attenuates external electromagnetic fields. For TEMPEST applications, entire rooms or equipment racks are lined with copper or aluminum mesh to create a grounded shield. This prevents radio frequency (RF) energy generated by processors, memory buses, and video cables from propagating outside the secure perimeter. The attenuation effectiveness is measured in decibels (dB), with high-security installations requiring 100dB+ of shielding across a broad frequency spectrum.

This foundational doctrine mandates strict physical and electrical segregation between RED (classified plaintext data) and BLACK (encrypted or unclassified) signals. RED signals must never be routed through BLACK conduits or equipment. Key implementation rules include:

• Physical distance: Minimum 1-meter separation between RED and BLACK cables.
• Filtered interfaces: RED power lines require dedicated filters to prevent data leakage onto shared electrical circuits.
• Optical isolation: Data diodes or fiber-optic media converters enforce unidirectional data flow, physically breaking the metallic path for return signals.

Conducted emissions travel along power and signal cables. Low-pass filters are installed at the boundary of the shielded volume to attenuate high-frequency compromising signals while allowing low-frequency power or data to pass. Critical filter types include:

• Power line filters: Insertion loss of 100dB from 14 kHz to 10 GHz.
• Telephone and data line filters: Common-mode and differential-mode rejection to prevent carrier modulation.
• Filtered connectors: D-subminiature and circular connectors with embedded ceramic capacitors to shunt RF energy to chassis ground directly at the penetration point.

A low-impedance single-point ground is essential to prevent the shielded enclosure from acting as an antenna. All metallic components—including door frames, cable trays, and filter housings—must be bonded to the same reference ground. This prevents ground loops that could radiate differential signals. Specifications typically require a ground resistance of less than 10 milliohms between any two points on the shield, verified by periodic bonding tests.

Ventilation and access panels are necessary but create apertures in the shield. A waveguide beyond cutoff is a honeycomb-structured metal vent that acts as a high-pass filter. The waveguide's diameter is precisely calculated so that frequencies below the cutoff are exponentially attenuated. For TEMPEST, this allows air to flow for cooling while blocking RF signals up to 18 GHz. The depth-to-diameter ratio determines the shielding effectiveness.

Fiber optic cables are inherently immune to electromagnetic induction and do not radiate signals. TEMPEST-secure facilities replace all copper data connections with fiber optic links wherever possible. For electronic devices that require copper interfaces, media converters are placed inside the shielded boundary. This ensures that only photons—not electrons—cross the perimeter, eliminating the risk of conducted or radiated emanations from the data path itself.

A fundamental TEMPEST design principle that mandates strict physical distance and filtering between circuits carrying classified plaintext data (RED) and those carrying encrypted or non-sensitive signals (BLACK). This prevents plaintext signals from coupling onto cables that exit the secure perimeter.

• Minimum Distance: Standards specify 1-3 meters of separation between RED and BLACK equipment and cabling
• Power Isolation: RED and BLACK devices must use separate power distribution units with filtered inputs
• Optical Isolation: Fiber optic links are preferred for BLACK connections as they emit no electromagnetic signals

Unintentional intelligence-bearing signals emitted by electronic equipment that, when intercepted and processed, can reveal the information being processed. TEMPEST shielding specifically targets these emanations, which include:

• Video Emanations: CRT and LCD displays emit radio frequencies that can be reconstructed into readable screen images at distances exceeding 100 meters
• Keyboard Emanations: The ground plane modulation of keystroke signals can be recovered from power lines
• CPU Emanations: Cryptographic operations produce distinct electromagnetic signatures that can leak key material through side-channel analysis

A spatial security model that defines concentric zones of electromagnetic control around TEMPEST-protected assets. Each zone imposes progressively stricter emission limits and access controls.

• Zone 0: The innermost area containing the protected equipment, often a shielded enclosure or SCIF
• Zone 1: The controlled space immediately surrounding Zone 0, typically 20 meters, where no unauthorized RF devices are permitted
• Zone 2: The inspectable space extending to the facility perimeter, monitored for unauthorized receivers
• Instrumented Zoning: Modern implementations deploy spectrum analyzers at zone boundaries to detect anomalous emissions in real time

The installation of low-pass filters on all power conductors entering a TEMPEST-shielded volume to prevent conducted emissions from riding out on electrical wiring. Without filtering, the power grid itself becomes an antenna broadcasting sensitive signals.

• Insertion Loss: Filters must provide at least 60 dB of attenuation from 14 kHz to 10 GHz
• Filter Placement: Filters are mounted at the shield boundary, with the filtered side inside the protected volume
• Neutral and Ground: All conductors, including neutral and ground lines, must be filtered—not just the hot line