TEMPEST: voting machines and headsets give away what you are doing, at tens of metres

October 2006, weeks before the Dutch general election: approval of the Sdu voting machines was withdrawn. Not because of a hack. Radiation gave away the vote.

Reporting by EenVandaag and the campaign group ‘Wij vertrouwen stemcomputers niet’ put the security of voting machines on the political agenda. The AIVD was instructed to examine their emission behaviour. For the Sdu NewVote, the image the voter saw on screen proved reproducible at up to forty metres, with a wall between attacker and machine, using equipment an amateur could build. It could be watched live. A second attack, on characteristic audio signals, allowed the party chosen to be distinguished at more than fifty metres.

Minister Nicolaï suspended the approval. Twenty-four municipalities, Amsterdam among them, switched to pencil and paper. Five metres, measured from the machine, was then set as the acceptable residual risk. Sdu modified the machines but did not reach that threshold; on 17 January 2007 the minister maintained the suspension, so the machines could not be used in the provincial elections of 7 March 2007 either. The Nedap machines did stay within five metres. In May 2008 the cabinet decided to return to paper and pencil.

Twenty years ago, but hardly a thing of the past. Ahead of the Brazilian elections of early October 2026, researchers showed that the screen of the voting machines used there can be read remotely: reconstructed frames as real-time video, through a wall, making it possible to follow how a choice changes before the vote is confirmed.

The principle has been known for decades and its origin is Dutch. In 1985 Wim van Eck of the PTT laboratory in Leidschendam showed that a television aerial could reconstruct information from a computer screen at a distance. It has been called Van Eck phreaking ever since, and more broadly TEMPEST: examining and controlling unintended signals that can give information away.

Intelligence services ran with it. A leaked NSA catalogue contains the RAGEMASTER implant, hidden in the ferrite core of a video cable. Illuminate it and the video signal is reflected back, so the image can be reconstructed at a distance.

This summer, researchers at USENIX Security 2026 showed that an implant is not even necessary. Their InjectEave attack transmits a tuned radio signal at ordinary electronics. Non-linear components such as amplifiers, analogue-to-digital converters and power converters mix that signal with the analogue signal inside the device and radiate it again.

Across eleven commercially available devices, from makers including Sony, Philips and HP, the researchers recovered information this way. Per-device distances were typically between one and six metres. With an external power amplifier of just over four hundred dollars, raising transmission power from 18 to 40 dBm, they reconstructed intelligible speech from headphones at thirty metres. Through glass, wood and concrete as well. The researchers note that existing defences such as cryptographic masking and randomised clocking help little here: those are built to obscure digital logic, while the leak arises in the analogue path.

From voting machine to headphones: the wall of your building is not the information boundary. That lies where the signal is no longer usable.

For voting machines, five metres counted as acceptable residual risk. What boundary do you apply to the room where your board discusses an acquisition, or where your CFO sits on a confidential call with earbuds in? And has that ever been measured?

In 2006 the AIVD mapped how far voting information reached. Do you know how far confidential information reaches at your organisation?