History of TEMPEST & Shielding Specs

Everything in this table is historical. Superseded documents are listed so readers can recognize old citations, not so anyone designs to them.

Sources NSA, TEMPEST: A Signal Problem · Wikipedia: Tempest (codename) · NSA 94-106 (historical mirror)

Reading the table:

• Policy and facility countermeasures (CNSSP 300, CNSSI 7000) and installation guidance (CNSSAM TEMPEST/1-13) are controlled documents. The public construction documents (ICD 705, ICS 705-1, the Tech Spec) defer TEMPEST decisions to the CTTA instead of restating them.
• The 2010 shift from DCID 6/9 to ICD 705 changed the IC's document structure. It didn't make TEMPEST requirements public.

Sources DoDI 8523.01 · Wikipedia: Tempest (codename) · ICD 705 · IC Tech Spec v1.5.1 (NAVFAC mirror) · IEEE 299-2006 · DoDM 5205.07 (2025) · UL 2050 Ed. 6

The story is told in NSA's declassified article TEMPEST: A Signal Problem.

What happened. During WWII, the Bell Telephone 131-B2 mixer was in use for encrypted communications. A Bell engineer "noticed, quite by accident, that each time the machine stepped, a spike appeared on an oscilloscope." Those spikes could be read as the plain text being encrypted. The machine was leaking what it was supposed to protect.

The proof. Bell engineers set up across the street from a wartime cryptocenter, roughly 80 feet away, and "produced about 75% of the plain text" from the leaking signals.

The response. Bell Labs identified three families of fixes that still frame the field:

The Signal Corps also chose to control a zone around the cryptocenter. That's an early form of what is now called inspectable space. Distance and control of space later joined shielding and filtering as standard countermeasures.

The name. NSA's history records: "This problem of compromising radiation we have given the covername TEMPEST." TEMPEST is a covername, not an acronym. The expansions found on some vendor websites were invented after the fact.

What builders should take from it. The first compromise wasn't a spy planting a bug. It was ordinary equipment doing its job, with signals escaping through the air and along wires. Every filter, waveguide and RED/BLACK rule in a modern SCIF traces back to that discovery.

Sources NSA, TEMPEST: A Signal Problem · Wikipedia: Tempest (codename)

1951: the problem comes back. In 1951 the CIA rediscovered the effect and read "plain text about a quarter mile down the signal line." That detail matters for builders. The leak traveled along a wire, far past any wall. Conducted emanations became as important as radiated ones, which is why filters and fortuitous conductors matter today.

Control zones and their limits. Early responses defined zones of control around equipment. NSA's own history later described one such zone as "quite arbitrary." Fixed distances were a blunt instrument. Modern practice replaced them with a CTTA's facility-specific assessment of threat, equipment and inspectable space.

Standards take shape:

NACSIM 5000's contribution. It separated circuits handling "national security plain language information in electric signal form (RED)" from those handling "encrypted or non-national security information (BLACK)." It used the term "Controlled Space," a forerunner of inspectable space. It also explained why grounding matters: "appreciable impedances can and do exist between various points of the return paths." That is the physics behind today's rule that RED/BLACK grounding is engineered, not improvised.

The Moscow embassy. NSA's article notes that in 1964 "more than 40 microphones were discovered in the U.S. embassy in Moscow." That's a separate threat (audio bugging), but it shows why technical security grew into a discipline alongside TEMPEST.

Sources NSA, TEMPEST: A Signal Problem · NACSIM 5000 (historical mirror) · Wikipedia: Tempest (codename)

For four decades TEMPEST was a government secret. In 1985 it became a public research topic.

Wim van Eck, 1985. "Electromagnetic Radiation from Video Display Units: An Eavesdropping Risk?" appeared in Computers & Security 4(4):269–286. Van Eck showed that the image on a video display could be reconstructed remotely "at a range of hundreds of metres, using just $15 worth of equipment plus a television set" (Wikipedia). The technique is still called van Eck phreaking.

Why it mattered.

• It proved that compromising emanations weren't limited to cipher machines and teletypes. Ordinary office computers leaked too.
• It moved the threat from nation-state labs to anyone with modest skill and cheap parts.
• It explained to the public why government facilities cared about screens, cabling and room construction.

Later public work.

Equipment standards, briefly. NSTISSAM TEMPEST/1-92 (15 Dec 1992), Compromising Emanations Laboratory Test Requirements, Electromagnetics, set laboratory test levels for equipment. It superseded 1-91 (21 Mar 1991). Wikipedia maps its Levels I, II and III to NATO SDIP-27 Levels A, B and C. These are equipment evaluation standards. They explain why a CTTA asks what equipment will process classified information: evaluated equipment can reduce the facility countermeasures needed.

What it means for designers. Public research is why TEMPEST can't be treated as exotic. The threat is well documented and the tools are inexpensive. What stays controlled is the specific countermeasure criteria, which is why they come from your CTTA and not from the internet.

Sources Wikipedia: Van Eck phreaking · Wikipedia: Tempest (codename) · NSTISSAM TEMPEST/1-92 (historical mirror)

Many RF-shielding datasheets still cite "NSA 65-6" or "NSA 94-106." Here's where those names come from.

The FOIA context. In 1999–2000, requests and appeals publicized by Cryptome produced redacted releases of several NSA and NSTISS documents, including 94-106. The mirrored copies are useful for understanding what kinds of things an enclosure specification addressed: structure, doors, vents, filters, grounding, testing and warranty. The public mirror doesn't include 94-106's Figure 1 performance values.

How vendors use the names today. ETS-Lindgren's DKE door datasheet lists testing per "MIL-STD-285, NSA 65-6/NSA 94-106, ITSG-02/IEEE 299 or EN 50147-1." Test labs still offer 94-106-style testing. A citation on a datasheet tells you what method a product was tested to. It doesn't tell you what your project requires.

See: RF Shielding, Penetrations & Installer Methods for current testing practice.

Sources NSA 94-106 (historical mirror) · Wikipedia: Tempest (codename) · IEEE 299-2006 · ETS-Lindgren DKE door datasheet · Keystone Compliance: NSA 94-106 testing

Document structure (per the public mirror):

Test frequencies listed (historical):

Topics it addressed, and the modern practice each one foreshadows:

The lesson. Almost every item that fails a shield test today (filters, seams, doors, vents, grounding) was already a named requirement in 1994. The technology changed; the weak points didn't.

See: RF Shielding, Penetrations & Installer Methods.

Sources NSA 94-106 (historical mirror) · Wikipedia: Tempest (codename)

Three families of national TEMPEST documents run in parallel: policy, facility countermeasures and installation guidance. A fourth family covers equipment testing.

What 2-95 contained (structure only). Sections: 1 Introduction; 2 Definitions; 3 RED/BLACK Installation Recommendations; 4 TEMPEST Integrity; 5 Secure Voice; 6 SCI; 7 Tactical Transportable; 8 Aircraft; 9 Ships. It implemented NSTISSP 300, NSTISSI 7000 and 7001, and superseded NACSIM 5203 "except Appendix K."

Concepts from 2-95 that still teach well:

• CTTA primacy: "There should be no commitment of funds without CTTA concurrence."
• Dedicated RED and BLACK wireways and incompatible patch connectors
• Optical fiber that doesn't "conduct or radiate radio frequency interference," but with "no metallic stiffeners or metallic sheath"
• Filters and isolators "when separation requirements cannot be met"
• Fortuitous conductors, and the warning that "a long slender ground wire is not an effective RF ground"

Facility countermeasure process (historical NSTISSI 7000). The CTTA conducts or validates a review and determines the inspectable space. Location, information volume and sensitivity, physical controls, equipment TEMPEST profiles and the threat environment drive the countermeasures. That risk-based model is still how the IC Tech Spec works: countermeasures come "when recommended by the CTTA."

Sources NSTISSAM TEMPEST/2-95 (historical mirror) · NSTISSI 7000 (historical mirror) · NACSIM 5000 (historical mirror) · DoDI 8523.01 · CNSS memoranda listing

Before 2010. IC SCIF physical and technical security lived in DCID 6/9 (with its Manual and Annexes), supplemented by Intelligence Community Policy Memoranda. The SAP world used the parallel JAFAN 6/9 manual, now a legacy standard.

26 May 2010. DNI Dennis C. Blair signed ICD 705, Sensitive Compartmented Information Facilities. It rescinded DCID 6/9 and ICPMs 2005-700-1, 2006-700-7 and 2007-700-2. It set a layered structure that remains in place:

How the Tech Spec evolved (from its change history):

TEMPEST in the ICD 705 era. The public documents don't restate national TEMPEST criteria. They assign the decision to the CTTA (Tech Spec 3.A.3) and name the triggers: RF protection "at the direction of the CTTA" (3.C.4), and dielectric breaks or grounding "when recommended by the CTTA" (3.G.2). The TEMPEST Checklist is a standard Tech Spec form.

Parallel changes:

• SAPFs: DoDM 5205.07 Vol 3 (23 Apr 2015) pointed SAPF construction to the IC Tech Spec. The consolidated DoDM 5205.07 (17 Jan 2025) cancelled Vols 1–3.
• Intrusion detection: UL 2050 Edition 6 (7 Apr 2025) replaced Edition 5 (5 Nov 2010). See: Intrusion Detection & UL 2050 / Extent 3.

Grandfathering. ICS 705-1 lets SCIFs accredited before ICD 705 continue under the standards in effect at their most recent accreditation. On re-accreditation they must meet current IDS standards unless waived.

Sources ICD 705 · ICS 705-1 · ICS 705-2 · IC Tech Spec v1.5.1 (NAVFAC mirror) · DoDM 5205.07 (2025) · UL 2050 Ed. 6

History isn't trivia on a SCIF project. It shows up on datasheets, legacy drawings, old facilities and the internet.

1. Legacy citations are everywhere. Datasheets cite "NSA 65-6," "NSA 94-106" and "MIL-STD-285." Old specifications reference DCID 6/9 or JAFAN 6/9. When you see an old citation, ask what the current contract, CTTA recommendation and AO require. A datasheet's test method isn't the project's acceptance criterion.

2. FOIA documents teach concepts, not requirements. 2-95 and 94-106 are publicly mirrored, well written and superseded. Use them to understand why filters, waveguides and single-point grounds exist. Never lift a number, distance or table from them into a design.

3. Existing SCIFs may predate current rules. Because of ICS 705-1 grandfathering, a renovation can land in a facility built to older standards. On re-accreditation, current IDS standards apply unless waived. Ask the AO before assuming old conditions carry forward.

4. The threat lessons are permanent. Signals travel along wires (1951), ordinary equipment leaks (1985), and fixed zones proved "quite arbitrary." That's why the modern system is risk-based and CTTA-driven, and why builders shouldn't substitute a rule of thumb for the TCR.

5. Requirements are still moving. The Tech Spec went through five versions in under a decade. UL 2050, DoDM 5205.07 and IEEE 299 all changed status in 2023–2025.

Sources IC Tech Spec v1.5.1 (NAVFAC mirror) · ICS 705-1 · NSTISSAM TEMPEST/2-95 (historical mirror) · NSA, TEMPEST: A Signal Problem · NCSC regulations page

Documents marked Historical are FOIA-released or superseded. Read them for background only. Controlled documents (CNSSP 300, CNSSI 7000, CNSSAM TEMPEST/1-13) aren't listed because they aren't public. Get applicable requirements through your AO or CTTA.

See: Reference Library for the full current document list.

Sources NSA, TEMPEST: A Signal Problem · Wikipedia: Tempest (codename) · NIST CSRC Glossary: TEMPEST · IC Tech Spec v1.5.1 (NAVFAC mirror) · IEEE 299-2006