What Is TEMPEST Certification?

TEMPEST certification is evidence that a piece of equipment has passed testing against a TEMPEST standard, which limits its compromising emanations. Every electronic device gives off small electromagnetic, conducted and sometimes acoustic signals as it works. If those signals follow the data being processed, someone nearby with a sensitive receiver could rebuild a screen image, keystrokes or a document without touching the device or its network.

TEMPEST began as a US government codename, not an acronym, although several backronyms circulate. The problem was found during the Second World War, when Bell Telephone engineers noticed that an encrypting teleprinter leaked readable signals that could be picked up at a distance. Public research in the 1980s showed the same thing for computer monitors. The wider field is called emission security, or EMSEC.

Most of the detailed test limits are classified or restricted, but the structure of the standards is public. NATO uses SDIP-27, with three levels that assume different distances between the equipment and a potential eavesdropper. The US uses NSA standards, historically NSTISSAM TEMPEST/1-92, whose three levels broadly match NATO’s. NATO’s SDIP-28 then grades the sites where equipment is used into zones, so the right level can be matched to each room.

The levels replaced older NATO documents known as AMSG 720B, 788A and 784, which still appear on some datasheets. In practice a programme’s security accreditor sets which level is needed, based on the site survey and the classification of the data.

Testing takes place in a shielded chamber at an accredited laboratory. The device runs known test patterns while receivers sweep a wide range of frequencies on its radiated emissions and on every cable, including power. The engineers look for signals that correlate with the data being processed, not just for overall noise.

Certification applies to one exact configuration. Changing a cable, a drive, a memory module or a peripheral can void it, so TEMPEST products are built and supplied as controlled builds with matching paperwork. Several parties are involved:

A TEMPEST build starts from an ordinary computer, laptop or display and adds layers that stop data-bearing signals from leaving the enclosure.

TEMPEST equipment is used wherever classified information is processed and the surroundings cannot be fully controlled: defense headquarters and command posts, embassies, intelligence sites, vehicles and ships. It complements other protections rather than replacing them. An air-gapped computer stops attacks over a network, but it can still leak data through its emissions if it is not TEMPEST-protected or sited in a suitable zone.

Several products in our range list TEMPEST builds as manufacturer options, to NATO SDIP-27 or to NSA NSTISSAM TEMPEST/1-92 depending on the model. They include military panel PCs, military monitors, military tablets and military laptops. The certificate is issued for the manufacturer’s TEMPEST build, so the option has to be specified at the time of order.

We supply military computers, tablets, laptops and displays configured and tested as standard, and where a program needs TEMPEST protection we source the manufacturer’s listed TEMPEST build with its documentation. Tell us the level and zone your accreditor requires, and we will match the hardware to it.