TEMPEST: How Electromagnetic Eavesdropping Works and Why It Still Matters

What Is TEMPEST?

Every electronic device leaks. Not data through a network port or a misconfigured firewall, but electromagnetic radiation through the air and along cables. These unintentional emissions carry information - the contents of your screen, the keys you type, the data flowing through your cables. TEMPEST is the U.S. government's classified standard for protecting against the intelligence threat posed by these emissions.

The name TEMPEST itself is not an acronym, despite decades of backronym attempts. It is a codeword assigned by the NSA to the study and prevention of compromising emanations - electromagnetic signals that, if intercepted and analyzed, reveal classified or sensitive information. The full TEMPEST standard remains classified, though enough has leaked and been independently researched to paint a detailed picture of what it covers.

The concept is straightforward: if a device processes information, the electrical activity involved produces electromagnetic fields. Those fields propagate. Someone with the right receiver and enough expertise can reconstruct the original information. This is not theoretical. It has been demonstrated repeatedly in academic research and is widely assumed to be an active capability of signals intelligence agencies worldwide.

Van Eck Phreaking: Watching Your Screen from Next Door

In 1985, Dutch researcher Wim van Eck published a paper that brought compromising emanations into the public domain. He demonstrated that a modified television set could reconstruct the image displayed on a CRT monitor from several hundred meters away, using only the electromagnetic radiation the monitor emitted during normal operation.

sequenceDiagram
    participant Monitor as Target Monitor
    participant EM as EM Radiation
    participant Antenna as Receiving Antenna
    participant Receiver as SDR/Receiver
    participant Processing as Signal Processing
    participant Display as Reconstructed Display
    
    Monitor->>EM: Electron beam sweeps screen
    EM->>EM: Unintentional RF emission
    EM->>Antenna: Signal propagates (up to 300m+)
    Antenna->>Receiver: Raw RF signal captured
    Receiver->>Processing: Demodulation and filtering
    Processing->>Processing: Sync recovery (H-sync, V-sync)
    Processing->>Processing: Pixel intensity extraction
    Processing->>Display: Frame reconstruction
    Display->>Display: Real-time screen mirror

Signal flow in a Van Eck phreaking attack - from unintentional monitor emissions to reconstructed display image.

The technique, which became known as Van Eck phreaking, worked because CRT monitors used an electron beam to paint the screen line by line. The beam's intensity varied with the brightness of each pixel, and this variation produced a corresponding electromagnetic signal. By receiving that signal and synchronizing to the monitor's horizontal and vertical scan rates, van Eck could reproduce the image in real time.

The equipment was not expensive. Van Eck used components worth about $15 at the time - a demonstration that compromising emanations were not exclusively the domain of intelligence agencies with billion-dollar budgets. The paper was a watershed moment. Security professionals who had previously dismissed EM eavesdropping as paranoid fantasy had to reckon with a practical, published demonstration.

Van Eck was not the first to discover this. Intelligence agencies had known about compromising emanations since at least the 1950s - the NSA's TEMPEST program dates to that era. Bell Labs had documented similar findings even earlier. But Van Eck's paper made the threat public and reproducible.

How Electromagnetic Emanations Work

To understand why electronic devices leak information, you need to understand what happens when current flows through a conductor. Every wire carrying a changing electrical signal acts as an antenna. The signal creates an electromagnetic field that radiates outward. The strength and frequency of this radiation depend on the signal's characteristics - its voltage, frequency, rise time, and the geometry of the conductor.

Digital electronics are particularly noisy. Digital signals have fast rise and fall times - the transitions between logic 0 and logic 1 happen in nanoseconds or less. These sharp transitions produce harmonics that extend well into the radio frequency spectrum, often hundreds of megahertz or more above the fundamental clock frequency. A processor running at 3 GHz produces harmonics at 6 GHz, 9 GHz, 12 GHz, and beyond.

There are two primary paths for compromising emanations. Radiated emissions travel through the air as radio waves. Conducted emissions travel along cables, power lines, and other conductors that act as unintentional antennas. A USB cable, a power cord, an Ethernet cable - all can carry compromising signals far beyond the device that generated them.

The information content of these emissions depends on what part of the device generated them. A display cable carries video data, so its emissions contain the screen contents. A keyboard cable carries keystroke data, so its emissions reveal what you type. A processor's power consumption varies with the instructions it executes, so its emissions can reveal cryptographic keys. Each source requires a different interception and analysis approach, but the underlying physics is the same.

HDMI and Display Emanations

The transition from CRT to LCD did not eliminate display emanations - it changed them. Modern displays use digital interfaces like HDMI and DisplayPort. These carry high-speed serial data streams with clock rates in the gigahertz range, producing rich harmonic spectra.

HDMI cables are particularly problematic. An HDMI 2.0 cable carries data at up to 18 Gbps across multiple differential pairs. Despite the use of differential signaling (which theoretically cancels common-mode emissions), the cable shields are never perfect. Connectors, bends, and manufacturing variations all create points where the signal couples to the shield or radiates directly.

Researchers at Tel Aviv University demonstrated in 2020 that they could reconstruct screen contents from HDMI cable emissions at distances of several meters using commercial software-defined radio (SDR) hardware. The method exploited the TMDS (Transition-Minimized Differential Signaling) encoding used by HDMI. Because TMDS encodes pixel data in a predictable way, the electromagnetic signature of each pixel value is distinct and recoverable.

The resolution of recovered images is not pixel-perfect, but it is good enough to read text and identify application windows. An attacker across a hallway or in an adjacent hotel room could see what you are typing, which websites you visit, and which documents you have open. The required equipment - an SDR like a HackRF One or USRP, a directional antenna, and custom software - costs a few hundred to a few thousand dollars.

graph TD
    subgraph Target["Target System"]
        GPU[GPU/Display Adapter]
        HDMI[HDMI Cable]
        Monitor[LCD Monitor]
    end
    
    subgraph Emissions["Emission Sources"]
        E1[Cable Shield Gaps]
        E2[Connector Leakage]
        E3[PCB Trace Radiation]
        E4[Power Line Coupling]
    end
    
    subgraph Attacker["Interception Setup"]
        ANT[Directional Antenna]
        SDR[Software Defined Radio]
        DSP[DSP Software]
        REC[Reconstructed Image]
    end
    
    GPU -->|TMDS Signal| HDMI
    HDMI -->|Display Data| Monitor
    HDMI --> E1
    HDMI --> E2
    GPU --> E3
    HDMI --> E4
    
    E1 -->|RF| ANT
    E2 -->|RF| ANT
    E3 -->|RF| ANT
    E4 -->|Conducted| ANT
    
    ANT --> SDR
    SDR --> DSP
    DSP --> REC

HDMI display emanation attack - emission sources and interception chain.

Keyboard Emanations

Keyboards are another significant emanation source, and they are a particularly attractive target because they carry authentication credentials, messages, and other high-value data character by character.

Wired keyboards generate distinct electromagnetic signatures for each keystroke. The scan matrix inside a keyboard activates specific row and column lines for each key. The electrical paths differ for each key position, producing slightly different emission patterns. Researchers have demonstrated the ability to identify individual keystrokes from these emissions at distances of up to 20 meters.

A 2009 study by Martin Vuagnoux and Sylvain Pasini at EPFL in Switzerland tested 12 different wired keyboards, including USB and PS/2 models, and found that every single one was vulnerable to electromagnetic keystroke recovery. They identified four distinct attack methods, each exploiting different aspects of the keyboard's electrical behavior. The attacks worked through walls and at distances that would allow an attacker in an adjacent office or parked vehicle to capture everything typed.

Wireless keyboards add a radio transmission channel on top of the emanation problem. While modern wireless keyboards use encryption (typically AES-128), earlier models transmitted keystrokes in the clear or with trivially broken encryption. The KeySweeper project by Samy Kamkar demonstrated a covert keystroke logger disguised as a USB wall charger that intercepted Microsoft wireless keyboard transmissions from across a room.

Even encrypted wireless keyboards can leak through side channels. The timing of encrypted packets reveals when keys are pressed. Packet sizes may vary with key type. And the RF characteristics of the radio itself - transmission power, frequency offset, modulation artifacts - can fingerprint specific keyboards, enabling targeted interception.

Other Emanation Sources

Displays and keyboards get the most attention, but compromising emanations are everywhere in a computing environment.

Network cables carry data signals that radiate. Unshielded twisted pair (UTP) Ethernet cable, the Cat5e and Cat6 found in most offices, emits detectable signals. A researcher within range can potentially reconstruct network traffic from cable emissions, bypassing encryption at the network layer entirely by capturing the physical layer signals before encryption is applied or after decryption occurs at the endpoint.

Printers and copiers emit during operation. The signals generated by a laser printer's scanning mirror and photodrum contain information about what is being printed. An LED printer's array of LEDs produces characteristic emissions for each line of print. These attacks are harder to exploit in practice but have been demonstrated in laboratory settings.

Power consumption itself is an emanation channel. Every logic gate in a processor draws slightly different current depending on whether it transitions from 0 to 1, 1 to 0, or stays the same. This differential power consumption has been extensively exploited in side-channel attacks against cryptographic implementations. Simple Power Analysis (SPA) and Differential Power Analysis (DPA) can recover encryption keys by statistically analyzing power consumption traces during cryptographic operations.

Even acoustic emanations carry information. Researchers have recovered RSA keys by recording the high-frequency sounds emitted by laptop computers during decryption operations. The sound comes from vibrations in ceramic capacitors and voltage regulators on the motherboard, which vary with processor workload. The attack required placing a microphone within about 30 centimeters of the target laptop, but a parabolic microphone extended the range to several meters.

The TEMPEST Standard

The TEMPEST standard defines three levels of protection, based on the assumed threat environment. The specifics remain classified, but the general framework is publicly known through declassified portions and industry documentation.

TEMPEST Level I (NATO SDIP-27 Level A) provides the highest level of protection. It is designed for environments where a sophisticated attacker could position themselves within approximately 1 meter of the equipment. This level applies to equipment used in locations adjacent to a hostile country's embassy, for example, or in forward military positions. Level I equipment undergoes the most stringent testing and requires the heaviest shielding.

TEMPEST Level II (NATO SDIP-27 Level B) covers equipment that must be protected against eavesdropping from about 20 meters. This applies to most secure government facilities where the building perimeter provides some standoff distance from potential attackers. Level II is the most commonly deployed protection level.

TEMPEST Level III (NATO SDIP-27 Level C) protects against interception from approximately 100 meters. This is used in environments where the attacker cannot easily get close to the building - military bases with large perimeters, for instance.

TEMPEST-certified equipment must pass rigorous testing that measures its electromagnetic emissions across a wide frequency range. The testing procedures, defined in documents like NSTISSAM TEMPEST/1-92 (partially declassified), specify measurement distances, bandwidth, and acceptable emission levels for each protection zone. Equipment that passes testing receives a certification that specifies which level of protection it provides.

Shielding and Countermeasures

Protection against compromising emanations uses a layered approach combining multiple techniques.

Faraday cages are the most complete solution. A properly constructed Faraday cage - a continuous conductive enclosure - blocks electromagnetic radiation from entering or leaving. Secure facilities use shielded rooms (SCIFs - Sensitive Compartmented Information Facilities) where walls, floors, ceilings, doors, and ventilation openings are all electromagnetically sealed. The attenuation provided by a well-built shielded room exceeds 100 dB across the relevant frequency range, reducing emanation strength by a factor of 10 billion or more.

Building a shielded room is expensive - typically $50,000 to $500,000 or more depending on size and performance requirements. Every penetration (power, data, HVAC) requires filtered feedthroughs. Doors need spring-loaded contact fingers around the entire perimeter. Windows are either eliminated or replaced with honeycomb waveguide vents that block RF while allowing light or air.

Equipment-level shielding addresses emanations at the source. TEMPEST-rated computers, monitors, and peripherals have enhanced shielding built in - additional conductive gaskets, filtered connectors, shielded cables, and careful PCB layout designed to minimize emissions. A TEMPEST-rated laptop might cost three to five times more than its commercial equivalent.

Zone-based protection uses distance as a countermeasure. The TEMPEST zones model establishes controlled areas around sensitive equipment. Zone 0 contains the equipment itself. Zone 1 is the immediate area where emanations are strongest. Zone 2 extends to the building perimeter. Zone 3 is everything outside. By keeping potential attackers outside a certain zone, you can use a lower (and cheaper) protection level.

Noise generation provides active protection by flooding the electromagnetic environment with broadband noise that masks compromising emanations. White noise generators and jamming systems make it statistically difficult to extract the signal of interest from the noise floor. This approach is cheaper than full shielding but less absolute in its protection.

Fiber optics eliminate conducted emanations entirely for data connections. Light in a glass fiber produces no electromagnetic field. Converting electrical signals to optical at the source and back to electrical only inside a shielded area is a common approach for network connections to secure facilities.

Modern Research and Practical Attacks

Academic research continues to push the boundaries of what can be recovered from emanations, using increasingly affordable equipment.

In 2014, researchers Daniel Genkin, Adi Shamir, and Eran Tromer demonstrated RSA key extraction from a laptop using its electromagnetic emissions. They placed a near-field probe close to the laptop and recorded emissions during GnuPG decryption operations. The attack recovered the full 4096-bit RSA key in about an hour of measurement. The same team later showed that the attack worked using the electromagnetic sensor in a consumer smartphone held near the target laptop.

The TempestSDR project (formerly ExtIO_RTL) provides open-source software for reconstructing screen images from HDMI emissions using a cheap RTL-SDR dongle (about $25). While the results require ideal conditions - close range, minimal RF interference, known screen resolution and refresh rate - the tool demonstrates that Van Eck phreaking is accessible to anyone with basic SDR knowledge.

Air-gapped computers - machines with no network connection - have been shown to be vulnerable to data exfiltration through intentionally generated emanations. Researchers at Ben-Gurion University have published dozens of papers demonstrating exfiltration through electromagnetic emissions (AirHopper), acoustic signals (Fansmitter, DiskFiltration), thermal gradients (BitWhisper), and even the blinking of hard drive LEDs (LED-it-Go). These attacks require malware on the air-gapped machine, but they show that physical isolation alone does not guarantee security.

Power line attacks have also advanced. A 2019 study demonstrated that cryptographic keys could be recovered by monitoring the power line connected to a computer performing encryption operations. The power consumption variations during cryptographic computations modulate the current drawn from the wall outlet, and this modulation propagates along the power wiring to outlets that may be accessible to an attacker - potentially in a different room or even a different floor of the building.

What This Means for Security

For most individuals and organizations, TEMPEST attacks represent a low-probability, high-impact threat. The attacks require physical proximity (meters to tens of meters for most techniques), specialized equipment, technical expertise, and time to set up and calibrate. Your average cybercriminal is not going to park a van outside your office with a directional antenna aimed at your monitor cable.

But for high-value targets - government agencies processing classified information, defense contractors, financial institutions handling large transactions, law firms working on sensitive mergers, journalists protecting sources in hostile countries - the threat is real and well-documented. Nation-state intelligence agencies have the resources, motivation, and demonstrated capability to conduct TEMPEST-class surveillance.

The practical takeaways for security-conscious organizations include awareness of the threat, understanding which assets are most at risk, and implementing proportional countermeasures. Not every computer needs a Faraday cage. But the one processing your most sensitive data might need one, or at minimum some attention to cable routing, shielding, and physical security perimeters.

Wireless security tools like the BLEShark Nano focus on a different layer of the same fundamental problem - unintentional or poorly secured wireless emissions. While TEMPEST deals with emanations from devices that are not supposed to be transmitting at all, BLE and WiFi security deals with devices that transmit intentionally but may leak more than they should. The underlying principle is the same: if it radiates, it can be intercepted.