TEMPEST and compromising emanations

What the AIVD means by TEMPEST

The AIVD’s formulation is more precise than most in circulation. Every electrical device in use emits electromagnetic energy; as long as that stays within limits and causes no interference, nothing is wrong. But a device can radiate energy from which the information it processes can be reconstructed. For equipment handling classified information, that creates the risk of the information being read at a distance. The AIVD names that phenomenon, in its own words, TEMPEST.

In Dutch government usage, then, TEMPEST is the name of the problem and not of the solution. In practice the word is also used for the countermeasures, and for the NATO and EU schemes under which equipment and companies are assessed. Those three meanings run together in market material, which is what makes a claim so easily uncheckable.

The AIVD gives EMSEC, emission security, as a second term. In international documents that is the broader label for denying information that can be derived from unintended emissions. Alongside electromagnetic radiation there are related physical leakage channels, acoustic and optical ones and those via power consumption. The public description of Dutch TEMPEST policy is directed at electromagnetic energy; the wider family belongs in the discussion, but does not automatically fall under the same rule.

Why a CE marking says nothing about this

This is what procurement conversations most often miss, although the public AIVD text leaves little room for doubt about it. A CE marking shows that a device’s emissions stay within the stated limits and cause no interference. The AIVD sets against that, explicitly, that despite the CE marking a device can radiate energy from which the information it processes can be reconstructed.

Electromagnetic compatibility and compromising emanations are therefore different questions, with different standards and different measurement set-ups. That a device satisfies the first says nothing about the second. A supplier pointing at a CE marking in answer to a TEMPEST question is not answering the question.

Who is responsible

In the Netherlands the task of National TEMPEST Authority (NTA) sits with the NBV of the AIVD. The national policy is set out in VBV 32000 (B) of 6 November 2006. The AIVD does not publish that document, but states that the TEMPEST documents are available from the NBV to interested parties, and gives a postal address, a visiting address and a telephone number.

VIRBI 2025 aligns with that: the Unit Weerbaarheid prescribes the communications security regulations, and those regulations can be requested from the Unit Weerbaarheid. VIRBI 2025, annex, table 1, row E

One unit, three names. The Nationaal Bureau voor Verbindingsbeveiliging (NBV) is called NLNCSA in English-language documents and Unit Weerbaarheid on the current AIVD pages. The NBIV is a different organisation: the Nationaal Bureau Industrieveiligheid, which handles the contracts side. Anyone working under the ABRO goes through the NBIV; anyone fitting out a secured zone inside central government ends up at the NTA.

From which level it is mandatory

The obligation sits in two places, and the two are not identical. VIRBI 2025 governs central government; ABRO 2026 governs what a contractor must arrange for a Special Contract.

The ABRO split is striking and deserves explanation, because summaries almost always get it wrong. Requirement 3.3.32, the standard TEMPEST measures following the NBIV’s instruction, is ticked in the official table at TBB 3 / Stg. C only. At the two highest levels requirement 3.3.33 applies instead: first a zoning measurement, then determine the measures in consultation with the NBIV.

That is not sloppiness but a sequence. The ABRO defines a zoning measurement as “the measurement carried out to determine which TEMPEST measures are required”. At Stg. C you follow the standard instruction; from Stg. G upward you first measure what the situation on site demands. Anyone drawing up a procurement file is therefore buying different things at those two levels. ABRO 2026, requirements 3.3.32 and 3.3.33, and the definitions

TEMPEST is not an electronic security survey

Both regulations keep the two firmly apart, and that is the most important correction to common usage. In VIRBI 2025, TEMPEST is row I of table 5.1; the TSCM/electronic security survey sits separately in rows J and K. In the ABRO, the survey is requirement 3.3.31 while the TEMPEST requirements are 3.3.32 and 3.3.33.

They are different questions in substance too. A TEMPEST measure or zoning measurement concerns what the equipment itself gives away unintentionally. An electronic security survey concerns what has been placed in the room that does not belong there. An organisation that has had one done has not thereby done the other. What a survey can and cannot establish is set out in what a sweep can and cannot establish; the examination obligation itself is set out in the Dutch national TSCM/EVO policy advice.

The international layer

For NATO or EU classified information, those organisations’ policies apply. VIRBI 2025 provides that information obtained under a treaty or international agreement retains the classification assigned to it, and that divergent provisions from that treaty are applied. VIRBI 2025, article 2(3)

The AIVD names the sources. NATO policy sits in the CIS Security Technical and Implementation Directive on Emission Security (AC/322D(2019)0021). That document in turn refers to four SECAN publications:

• SDIP-27/3, on requirements and evaluation procedures, November 2024.
• SDIP-28/3, on zoning procedures, November 2024.
• SDIP-29/3, on selection and installation of equipment, November 2024.
• SDIP-55/1, on vendor qualification and control, May 2024.

EU policy sits in IASP 7 of September 2013, with four guidelines IASG 7-01 to 7-04.

What is public here are the titles, numbers and dates. The content is not. As NTA, the NBV can on request nominate companies making such equipment to NATO and the EU; those meeting SDIP-55 go on NATO’s “List of Certified TEMPEST Vendors”, those meeting IASG 7-04 on the EU’s “List of Accredited TEMPEST Companies”. The NBV visits the companies it recognises periodically to check that they still meet those documents.

That is also the yardstick for a supplier claim. “TEMPEST certified” only becomes a checkable statement once it says which scheme, which document, which version and which object it refers to, and whether the company appears on the relevant list.

What public research has actually shown

The public evidence base is narrow, but what is in it holds up. In 1985 Wim van Eck described in Computers & Security how electromagnetic radiation from video display units could be intercepted and turned back into display information, using an ordinary television receiver. That article concerns the display technology and the conditions of that experiment, and yields no generally valid distance for present-day equipment.

The Dutch reference point is the AIVD’s 2006 study of voting machines. For the Sdu NewVote the screen image was reconstructable at distances up to forty metres, with a wall between attacker and machine taken into account. The accompanying audio attack worked with modest means and over greater distance: with a reasonable world receiver or scanner, distinctions could be made at over fifty metres. For the Nedap machines the opposite held: reading at a distance was unlikely other than at very short range, under five metres.

Those figures come with the caveat the report itself supplies: because the signals could be further cleaned up, amplified or post-processed, the distances given may be read as minimum distances. They also concern that equipment, in that set-up, in 2006. The case is described at greater length in the insight on voting machines and headsets.

What follows from this is not a safe distance. There is no publicly substantiated radius around arbitrary office equipment, and a figure quoted without equipment, set-up and measurement conditions is therefore not a measurement result but a rule of thumb.

When the subject is proportionate

For an organisation working at Stg. C or above under VIRBI or the ABRO, the question is not whether TEMPEST is relevant. The measure sits in the minimum table; what remains is the question of how it is met.

Outside that, the order reverses, and the weighing starts with the information rather than with shielding. First establish which information is involved and which regime applies. Then consider whether an adversary could obtain a usable observation position or a conductive path out: the distance to the facade, what sits on the other side of the wall, who comes into the building, how cabling and power run. Inventory which equipment is actually in the room. Only then weigh emission security against more ordinary controls.

VIRBI itself is a useful model for that. In the same table, TEMPEST sits alongside access detection, visitor registration, countering eavesdropping and sight of and reflection of information, approved storage, key management and the physical protection of network cabling. It sits among them, not above them. Which threat is realistic in your case is covered under threat profiles.

What market language about TEMPEST does and does not mean

The Dutch offering around this subject consists largely of parties supplying shielding, safes, screened rooms or measurement services. That is legitimate; it only means their product descriptions record what they offer, and not what is necessary or sufficient in your situation.

Three questions make the difference. Which authority or scheme stands behind the claim, and can the company be found on the corresponding NATO or EU list? Which object does the claim cover exactly: a device, a building specification or a service? And on which measurement does a stated distance or attenuation rest, carried out by whom and under which conditions?

There is one independent anchor. The Dutch Accreditation Council maintains a public register of accredited laboratories, in which it can be checked whether a party invoking laboratory work is actually registered for it, and for which activities. That confirms the existence and scope of the accreditation, and nothing beyond it.