What a sweep can and cannot establish

A sweep records what was examined and found at the time of the examination, within a scope determined in advance on the basis of the threat picture. That provides a methodically substantiated picture of the room. It offers no absolute guarantees for what lies outside the scope or changes after the examination. We advise on how to limit the residual risk and keep the room resilient after the examination as well.

The question behind an assignment

Organisations often observe: we assume that sensitive, confidential information does not leave this building, but we have never established that. The context differs, the underlying question is usually the same.

What an examination does

Before the examination

A sound examination begins by establishing the relevant threat profile. We draw that up together in advance, based on organisational characteristics, the environment, the interests to be protected and the nature of the adversary or adversaries. From that threat picture we determine which attack vectors are relevant and jointly define the scope of the sweep.

We agree in advance which locations, zones, systems and operating situations are examined. Depending on the threat picture, a full sweep may consist of, among other things:

• radio-frequency examination within the agreed measurement range, as described on the page about EVO/TSCM sweeps;
• physical inspection of the room, furniture, equipment and accessible infrastructure;
• examination of telephone, network, power and other conductive connections;
• non-linear junction detection of electronic components (semiconductors) that do not transmit;
• thermal and optical measurements where the threat picture gives cause for them.

Every method has a detection threshold. In RF examination, relevant factors include transmit power, distance, antenna characteristics, shielding, transmission behaviour and the ambient noise floor. A transmitter that is not active during the measurement produces no radio signal at that time.

Equipment that is switched off, records only locally or is not transmitting can be found through physical inspection and non-linear junction (semiconductor) detection. Detection depends on accessibility, placement, materials, shielding and the ability to distinguish legitimate electronics from an anomaly. For that reason we deploy a broad range of examination methods.

What the examination delivers

A sound examination report promises no absolute certainty. It makes demonstrable what was examined, what was found and where the limits of what can be examined lie.

The report describes which domains were examined, such as conducted emissions, radio-frequency radiation, acoustic channels and, where relevant, optical attack vectors. For each domain we record the measurement methodology applied, the detection limitations and the components outside the scope.

We make this explicit deliberately. Suggesting absolute certainty where it cannot be substantiated technically only makes a conclusion less reliable. When it is clear what was and was not examined, a report is verifiable and usable as a factual basis for accountability towards clients, auditors or the competent authority.

The survey time is part of the scope

A sweep is performed at a recorded time, against a documented baseline. Preferably the room is controlled during the examination to prevent unexpected access and changes.

The conclusion applies to the situation examined at that time. Maintenance, building work, new cabling or equipment, uncontrolled access or a specific incident can change that situation. In such cases, additional or renewed examination may be needed.

When repeat work is appropriate

There is no meaningful standard interval that applies to every room or organisation. The need for repeat work follows from the threat picture, the use of the room and the degree to which access, changes and works are controlled. Reasons for additional or renewed examination include:

• uncontrolled or unexpected access to the room;
• building, maintenance or installation work;
• new audiovisual equipment, network components or cabling;
• a specific indication, a (security) incident or a change in the threat picture;
• use of the room for discussions with high confidentiality or impact.

For rooms in which sensitive discussions take place structurally, a periodic examination strategy may be appropriate. It can consist of a documented baseline survey as a reference situation, targeted checks after relevant changes, and repeat examination based on risk and threat picture.