What is TEMPEST?

Every machine that processes information electrically can give off signals it was not designed to send. TEMPEST is the name the U.S. Government uses for the study of those signals and the measures that keep them from being read. The National Institute of Standards and Technology (NIST) glossary, drawing on the Committee on National Security Systems (CNSS) glossary, defines it as the investigation, study, and control of "unintentional compromising emanations" from telecommunications and automated information systems equipment. The word appears in every SCIF and SAPF accreditation, usually in the phrase "TEMPEST countermeasure review," and this post explains where it came from, who performs the review, what the countermeasures are, and which parts of the subject are public.

Compromising emanations, in plain terms

The thing TEMPEST controls has its own definition. The NIST glossary entry for compromising emanations, also drawn from CNSS sources, calls them unintentional signals that, if intercepted and analyzed, would disclose the information transmitted, received, handled, or otherwise processed by telecommunications or information systems equipment.

The clearest public explanation of the mechanism is in a National Security Agency (NSA) article declassified and posted on a Department of Defense server, TEMPEST: A Signal Problem, from the Summer 1972 issue of the agency's internal journal Cryptologic Spectrum. The author's name is redacted. The article states the problem in one paragraph: any time a machine is used to process classified information electrically, the switches, contacts, relays, and other components in that machine may emit radio frequency or acoustic energy. Those emissions may radiate through free space, in some cases for half a mile or more, or be induced on nearby conductors such as signal lines, power lines, telephone lines, or water pipes and carried along them, in which case the article says the distance may be a mile or more. When they can be intercepted and recorded, it is frequently possible to recover the information being processed. The article says the phenomenon affects not only cipher machines but teletypewriters, duplicating equipment, intercoms, facsimile machines, and computers.

For cryptographic equipment the article gives the problem special significance, because the emissions may reveal not only the plain text of a message but the internal workings of the machine, which could conceivably lead to reconstruction of its keying variables. The article's authors wrote that "we have given the covername TEMPEST" to this problem of compromising radiation. That is the only origin of the word the public record supports.

The public history: a Bell Labs oscilloscope in 1943

The article tells the story from the beginning. During World War II the Army and Navy encrypted teletypewriter traffic with one-time tapes and a Bell Telephone mixing device called the 131-B2. While one was being tested in a Bell laboratory, a researcher noticed by accident that each time the machine stepped, a spike appeared on an oscilloscope in a distant part of the lab, and that the spikes could be read as the plain text being enciphered.

Bell told the Signal Corps, which did not believe a laboratory curiosity could be exploited in the field and asked for proof. The Bell engineers were placed in a building on Varick Street in New York, about 80 feet across the street from a Signal Corps cryptocenter, recorded signals for about an hour, and 3 or 4 hours later produced about 75 percent of the plain text. In roughly 6 months Bell Labs had identified 3 separate phenomena and proposed 3 suppression measures: shielding against radiation through space and magnetic fields, filtering against conducted signals on power and signal lines, and masking by drowning the signal in others. Bell built a modified mixer, the 131-A-1, that used shielding and filtering. The Signal Corps rejected it because containing the signals meant encapsulating the machine, which caused heat problems, hampered maintenance, and could not be shipped as a field modification kit. Instead the Corps warned commanders to control a zone about 100 feet in diameter around their communications centers.

Then, the article says, the war ended, the people went home, the files were dispersed, and the problem was forgotten for about 7 years. In 1951 the Central Intelligence Agency rediscovered it with the same 131-B2 mixer, reporting that it could read plain text about a quarter mile down the signal line. Filters were installed on power and signal lines, which handled conducted signals but not space radiation, and the Armed Forces Security Agency issued the first radiation policy: control a zone 200 feet in all directions around a cryptocenter, or run at least 10 teletypewriters at once as masking, or get a waiver. The article admits the 200-foot figure was arbitrary, chosen as the largest zone most stations could maintain.

Through the 1950s every cipher machine tested was found to radiate. A fourth phenomenon, power line modulation, appeared when the voltage on rotor machines fluctuated with the number of rotors moving. Acoustic emanations were a fifth: ordinary microphones planted to pick up conversations in a cryptocenter could record machine sounds with enough fidelity to exploit, and such microphones were found in Prague, Budapest, Warsaw, and Moscow. The article opens with a 1962 incident in Japan, where an officer inspecting the 200-foot zone around a small cryptocenter found a concealed dipole antenna under the eaves of a hospital across the street, and a Yagi antenna on its roof aimed at the cryptocenter; the dipole was gone the next day. It also recalls the more than 40 microphones found in the U.S. embassy in Moscow in 1964 and asks what those microphones could have done to the cipher machines. The later pages, on the KL-7 cipher machine, remain largely redacted.

What TEMPEST is not

Three misconceptions are worth clearing. TEMPEST is not an acronym in any government document cited here; the 1972 article calls it a covername, and the NIST glossary lists it as a term. TEMPEST is not a classification level or a clearance; it is an engineering discipline applied to facilities and equipment. And TEMPEST is not a blanket requirement to shield every room. DoD Manual 5205.07, the Special Access Program Security Manual effective January 17, 2025, says plainly that processing classified information, or submitting a facility for review, "does not imply a requirement to implement TEMPEST countermeasures," though countermeasures should be considered whenever electronic processing occurs. The review is mandatory; the countermeasures follow from what the review finds.

The CTTA

The person who makes that finding is the Certified TEMPEST Technical Authority (CTTA). The NIST glossary, drawing on CNSS Advisory Memorandum TEMPEST/01-13, defines a CTTA as an experienced, technically qualified U.S. Government employee who has met established certification requirements under CNSS-approved criteria and has been appointed by a department or agency to fulfill CTTA responsibilities. Two things follow: the CTTA is a government employee, not a contractor, and the authority comes from appointment as well as certification.

The Intelligence Community documents give the CTTA 2 jobs. Intelligence Community Standard (ICS) 705-1, effective September 17, 2010, and Chapter 3 of the IC Tech Spec, Version 1.5, dated March 13, 2020, say the CTTA reviews SCIF construction or renovation plans to determine whether TEMPEST countermeasures are required and recommends solutions, incorporating mitigation into the design to the maximum extent practicable, and then provides the Cognizant Security Authority and Accrediting Official with documented results. ICS 705-1 also names the CTTA as an example of the competent authority that must evaluate and mitigate a radio frequency transmitter to a low risk before the Accrediting Official approves bringing it into a SCIF. When the CTTA assesses threat, Chapter 2 of the Tech Spec says to use the NSA Information Assurance list as an additional resource, and it notes that those threat documents are classified, so that associating a threat level with a SCIF location normally carries the same classification.

DoD Manual 5205.07 adds the DoD side. A CTTA must conduct or validate all TEMPEST countermeasure reviews in accordance with the NCSC SCIF Specifications and CNSS Instruction 7000. If countermeasures are required, the CTTA recommends the most cost-effective one that will contain compromising emanations within the inspectable space. When a recommended countermeasure is not implemented, the program's central office must accept the risk in writing.

The TEMPEST countermeasures review under ICD 705

In a SCIF the review is part of accreditation. ICS 705-02, dated December 22, 2016, says a TEMPEST review and verification of countermeasures by a CTTA "is a necessary part of the accreditation process," and it requires the letter of accreditation to state that the SCIF meets all physical, TEMPEST, and technical security standards in place.

The Tech Spec shows what the CTTA has to work with:

• Perimeter walls. Radio frequency (RF) protection is installed at the direction of the CTTA when a SCIF uses electronic processing and does not provide adequate RF attenuation at the inspectable space boundary. The wall drawings note that CTTA-recommended countermeasures, foil-backed gypsum wallboard or a layer of approved radiant foil, go between the plywood and the wallboard, installed to the best practices for architectural RF shielding kept by the Center for Security Evaluation.
• Windows and doors. Windows are treated for RF protection when the CTTA recommends it, and perimeter doors meet TEMPEST requirements per CTTA guidance.
• Penetrations. Metallic penetrations of the perimeter may need dielectric breaks or grounding when the CTTA recommends them, and penetrations are kept to a minimum.
• Telecommunications. Unclassified telephone systems and their infrastructure are physically isolated from classified systems in accordance with Director of National Intelligence and CNSS TEMPEST guidance. For an emergency notification system whose speakers are installed in a SCIF but which is not wholly contained in it, all incoming wiring breaches the perimeter at one point, and TEMPEST or technical surveillance concerns may require electronic isolation approved by the CTTA.
• Wireless. Devices using wireless technologies pose a high risk and need approval from the Accrediting Official, the CTTA, and the information technology approving authority before they enter, must meet all TEMPEST requirements, and are subject to every separation and isolation standard in the TEMPEST standards.
• Temporary and shipboard SCIFs. Hardened temporary SCIFs are designed with TEMPEST countermeasures identified by the CTTA, with RED/BLACK separation and protected distribution guidance for field installation under CNSSAM TEMPEST 1/13 and CNSS Instruction 7003. On ships, the CTTA conducts a countermeasures inspection and recommends safeguards, which should be engineered into the platform.

ICS 705-1 adds the budget argument: when RF shielding is required by a CTTA evaluation, it should be planned for installation during initial construction, because costs are significantly higher to retrofit after construction is complete.

Shielding, zoning, and inspectable space

Two glossary terms explain how a CTTA decides whether shielding is needed. Inspectable space, in the NIST glossary, is the three-dimensional space surrounding equipment that processes classified or sensitive information within which TEMPEST exploitation is not considered practical, or where legal authority to identify and remove a potential exploitation exists. The glossary says the term is synonymous with zone of control. A TEMPEST zone is a designated area within a facility where equipment with appropriate TEMPEST characteristics may be operated.

The logic connects them. If the inspectable space extends far enough that emanations have faded to nothing useful by its boundary, no shielding is needed. If it does not, something must close the gap: either the building attenuates the signal, or the equipment radiates less. DoD Manual 5205.07 lists the choices a CTTA may recommend as shielded sections or architectural shielding, equipment that has TEMPEST profiles or TEMPEST zones matching the inspectable space, distance, or zone, and RED and BLACK separation. It adds that telephone line filters, power filters, and non-conductive disconnects are not required for TEMPEST purposes unless a CTTA recommends them, which is a change from the blanket filtering of the 1951 policy the NSA article describes.

The Tech Spec's TEMPEST Checklist shows what the CTTA measures the inspectable space against. The checklist asks for an external map with the distance from the SCIF perimeter to the closest limit of the inspectable space boundary when the facility is not inside a controlled compound, and for the location of any area within 100 meters occupied by foreign nationals or controlled by foreign entities. In a multi-story building not entirely controlled by the U.S. Government it asks for the occupants of the floors above and below, and it notes that General Services Administration buildings are not exempt. A completed checklist is classified according to the facility's classification authority.

RED/BLACK separation

The third countermeasure has its own vocabulary. The NIST glossary, citing NSA/CSS Policy 3-12, defines the RED/BLACK concept as separation of electrical and electronic circuits, components, equipment, and systems that handle classified plain text information in electrical signal form, called RED, from those that handle unclassified information in the same form, called BLACK. The glossary's separate entries draw the line: BLACK applies to systems and circuits in which national security information is encrypted or not processed, and RED is sensitive or classified information that is not encrypted.

The separation is physical. DoD Manual 5205.07 names the RED and BLACK separation installation guidance in CNSS Advisory Memorandum TEMPEST/01-13 as the governing document, and the Tech Spec applies it to temporary SCIFs. The internal map in the Tech Spec's TEMPEST Checklist asks the facility to identify every signal line and distribution system as BLACK or RED, including telephone, signal, and alarm lines, to show where each leaves the SCIF, and to show the location of all filters, isolators, and amplifiers. The 1943 oscilloscope shows why: a spike on an instrument in a distant part of the lab carried the plain text being enciphered.

TEMPEST in a SAPF

Special access program facilities follow the same physical standards as SCIFs, and DoD Manual 5205.07 states the review requirement outright. Section 15.5 says a TEMPEST countermeasure review "is required for all SAPFs" and will be provided by a CTTA. Section 15.13 says only countermeasures recommended by the CTTA and authorized by the government program manager or government SCI contracting official should be implemented, and Section 15.7 requires every SAPF to keep current copies of its accreditation documents, TEMPEST among them, on site. The post on what a SAPF is covers the rest of that manual.

What is public and what is not

The subject has a reputation for secrecy that is partly deserved. What the public record contains is this. The definitions are public: the NIST glossary attributes them to the CNSS glossary, CNSSI 4009, and through it to CNSSAM TEMPEST/01-13 and NSA/CSS Policy 3-12. The 1972 history is public with redactions, and NSA approved it for release on September 27, 2007, under a Freedom of Information Act case. The Intelligence Community and DoD facility documents, ICS 705-1, ICS 705-2, the Tech Spec, and DoD Manual 5205.07, are public and describe when a review happens, who performs it, and what the CTTA may recommend. The CNSS documents they cite by name include CNSSAM TEMPEST/01-13 for RED/BLACK installation, CNSS Instruction 7000 for countermeasures reviews and risk acceptance, and CNSS Instruction 7003 for protected distribution systems, and the reference list of DoD Manual 5205.07 adds CNSS Policy 300, the national policy on control of compromising emanations. Those CNSS documents are not reproduced here, and this post does not rely on their contents beyond what the glossary and the facility documents quote from them.

What is not public is the measurement side: the emanation limits equipment must meet, the test methods, and the threat assessments. The Tech Spec says the threat documents a CTTA uses are classified and that SCIF planning documents that associate a threat level with a location must be protected accordingly. A completed TEMPEST Checklist is classified. The NSA article's own treatment of the KL-7 machine is still redacted more than 50 years later. Anyone who claims to know the current separation distances or attenuation figures from public sources should be asked which document they are reading.

What TEMPEST means for software

None of this is written about software, but the review reaches it. The Tech Spec ties the need for RF protection to whether the SCIF "utilizes electronic processing," which every computer does. Wireless hardware is a high-risk item that needs the CTTA's approval before it enters, and unclassified systems in the room must be isolated from classified ones under TEMPEST guidance. A product that depends on a Wi-Fi or cellular link therefore brings a hardware question to the CTTA and the Accrediting Official before anyone evaluates what the product does. A program that runs on an approved machine inside the perimeter, with no radio and no outside connection, raises no new TEMPEST question of its own.

What to check

• Whether the space has a current CTTA review on file, and whether the equipment and signal lines in the room still match the TEMPEST Checklist that review was based on.
• Whether the countermeasures the CTTA recommended were implemented, and if not, whether the risk acceptance required by DoD Manual 5205.07 exists in writing.
• Whether a proposed device has any transmitting capability, which brings in the Accrediting Official and the CTTA under Chapter 11 of the Tech Spec.
• Whether the facility's inspectable space boundary has changed because a neighbor, tenant, or lease changed.
• For a renovation, whether RF shielding is in the design now rather than planned as a retrofit.
• What the software connects to outside the perimeter, and whether it works when it connects to nothing.

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Questions people ask

What is TEMPEST?

The NIST glossary, drawing on the Committee on National Security Systems glossary CNSSI 4009, defines TEMPEST as the investigation, study, and control of unintentional compromising emanations from telecommunications and automated information systems equipment. In practice the word covers 3 things: the physics of signals that leak from equipment processing classified information, the measurements and tests that find them, and the countermeasures, such as shielding, separation distances, and filtering, that keep them inside a controlled space.

Is TEMPEST an acronym?

Not in the public record. The declassified NSA article TEMPEST: A Signal Problem, from the Summer 1972 issue of the agency's Cryptologic Spectrum, says the problem of compromising radiation was given the covername TEMPEST. The article does not expand it, and neither does the NIST glossary, which lists it as a term rather than an abbreviation. Expansions offered on the internet are not supported by the government documents cited here.

What are compromising emanations?

The NIST glossary defines them as unintentional signals that, if intercepted and analyzed, would disclose the information transmitted, received, handled, or otherwise processed by telecommunications or information systems equipment. The 1972 NSA article explains the mechanism: the switches, contacts, relays, and other components in a machine processing classified information electrically may emit radio frequency or acoustic energy, which can radiate through free space or be induced on nearby conductors such as signal lines, power lines, telephone lines, or water pipes.

Who discovered TEMPEST?

According to the declassified NSA article, a Bell Telephone researcher noticed during World War II that each time a 131-B2 mixer, used to encrypt Army and Navy teletypewriter traffic, stepped, a spike appeared on an oscilloscope elsewhere in the lab, and that the spikes could be read as the plain text. Bell engineers then recorded signals from a Signal Corps cryptocenter on Varick Street in New York from about 80 feet away and recovered about 75 percent of the plain text. The problem was largely forgotten after the war and rediscovered by CIA in 1951.

What is a CTTA?

A Certified TEMPEST Technical Authority. The NIST glossary, drawing on CNSSAM TEMPEST/01-13, defines a CTTA as an experienced, technically qualified U.S. Government employee who has met certification requirements under CNSS-approved criteria and been appointed by a department or agency to fulfill CTTA responsibilities. Under the IC Tech Spec and DoD Manual 5205.07, the CTTA reviews construction or renovation plans, decides whether TEMPEST countermeasures are required, recommends solutions, and documents the results for the Accrediting Official.

What is RED/BLACK separation?

The NIST glossary defines the RED/BLACK concept as separation of electrical and electronic circuits, components, equipment, and systems that handle classified plain text information in electrical signal form, called RED, from those that handle unclassified information in the same form, called BLACK. DoD Manual 5205.07 lists RED and BLACK separation installation guidance under CNSS Advisory Memorandum TEMPEST/01-13 as one of the countermeasures a CTTA may recommend, and the IC Tech Spec TEMPEST Checklist asks the facility to label every signal line RED or BLACK.

What is TEMPEST shielding and does every SCIF need it?

Shielding is one countermeasure among several, and no, not every SCIF needs it. Chapter 3 of the IC Tech Spec says radio frequency protection is installed at the direction of the CTTA when a SCIF uses electronic processing and does not provide adequate attenuation at the inspectable space boundary. Options the specification names include foil-backed gypsum wallboard, RF treatment of windows, and dielectric breaks or grounding on metallic penetrations. ICS 705-1 adds that shielding should be planned during initial construction because retrofitting costs significantly more.

What is a TEMPEST zone and what is inspectable space?

Both terms come from the NIST glossary, drawing on CNSS documents. Inspectable space is the three-dimensional space around equipment that processes classified or sensitive information within which TEMPEST exploitation is not considered practical, or where legal authority exists to identify and remove a potential exploitation; the glossary calls it synonymous with zone of control. A TEMPEST zone is a designated area within a facility where equipment with appropriate TEMPEST characteristics may be operated. DoD Manual 5205.07 describes matching equipment zones to the inspectable space as a countermeasure.

Is TEMPEST required in a SAPF?

A review is always required. DoD Manual 5205.07, effective January 17, 2025, says a TEMPEST countermeasure review is required for all special access program facilities and will be provided by a Certified TEMPEST Technical Authority, who must conduct or validate all such reviews in accordance with the NCSC SCIF Specifications and CNSS Instruction 7000. The manual also says that processing classified information does not imply a requirement to implement countermeasures, and that only those the CTTA recommends and the government program manager authorizes should be installed.

What TEMPEST documents are public?

The definitions are public through the NIST glossary, which attributes them to CNSSI 4009, CNSSAM TEMPEST/01-13, and NSA/CSS Policy 3-12. The 1972 NSA history is public with redactions. The IC Tech Spec, ICS 705-1, ICS 705-2, and DoD Manual 5205.07 describe when a review happens and what the CTTA may recommend, and they cite CNSSAM TEMPEST/01-13, CNSS Instruction 7000, and CNSS Instruction 7003 by name. The Tech Spec says the technical threat documents a CTTA uses are classified, and a completed TEMPEST Checklist is classified according to the facility's classification authority.

Sources

1. 1TEMPEST (glossary entry) · National Institute of Standards and Technology
2. 2Compromising emanations (glossary entry) · National Institute of Standards and Technology
3. 3Certified TEMPEST Technical Authority (glossary entry) · National Institute of Standards and Technology
4. 4Inspectable space (glossary entry) · National Institute of Standards and Technology
5. 5RED/BLACK concept (glossary entry) · National Institute of Standards and Technology
6. 6BLACK (glossary entry) · National Institute of Standards and Technology
7. 7RED (glossary entry) · National Institute of Standards and Technology
8. 8TEMPEST zone (glossary entry) · National Institute of Standards and Technology
9. 9TEMPEST: A Signal Problem (declassified article, Cryptologic Spectrum, Summer 1972) · National Security Agency
10. 10Legacy Periodicals Lists (Cryptologic Spectrum listing: TEMPEST: A Signal Problem, Summer 1972, Vol. 2, No. 3) · National Security Agency (page archived October 1, 2026)
11. 11Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, Version 1.5 · National Counterintelligence and Security Center
12. 12Intelligence Community Standard 705-1, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities · Office of the Director of National Intelligence
13. 13Intelligence Community Standard 705-02, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities · National Counterintelligence and Security Center
14. 14DoD Manual 5205.07, Special Access Program Security Manual · Department of Defense

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.