PEDs, Wireless Detection, Telecom & CCTV

ICS 705-1 §G.2.e states the risk: "Portable Electronic Devices pose a risk to SCI since they often include capabilities to interact with other information systems and can enable hostile attacks targeting classified information in SCIFs." It sends readers to the IC Tech Spec for PED restrictions. ICS 705-1 §G.2.a adds that RF transmitters are not allowed in a SCIF unless a competent authority, such as the CTTA, evaluates and mitigates them to low risk and the AO approves.

The site SOP turns these documents into local rules, and the AO (or the PSO for a SAP) decides what may enter. The integrator's job is narrower: lockers, signage, detection and entry sequencing that support the policy without adding a new transmitter, microphone or network path at the perimeter.

Sources ICS 705-1 · IC Tech Spec v1.5.1 · SCIF TEMPEST Checklist · DoDM 5105.21 Vol. 2 · DCSA SAP Compliance Checklist (Jan 2026) · UFC 4-010-05

Tech Spec Chapter 10 has four parts: A. Approved Use of PEDs/RCET in a SCIF; B. Prohibitions; C. PED/RCET Risk Levels; D. Risk Mitigation. The chapter title pairs PEDs with "Recording Capabilities and Embedded Technologies" (RCET); the acronym's exact expansion was not verified. Instead of one banned-items list, the chapter uses risk levels: the AO approves specific device types with specific mitigations.

What this means in practice

• An approval attaches to a device type and its mitigation, not to "phones" or "watches" in general.
• The medium tier turns on physical disabling. A settings toggle is a different claim, and only the AO decides whether it is acceptable.
• User agreements and forensic-seizure consent are administrative controls run by the security office. Detection systems and entry logs can support them but do not replace them.
• Any approved transmitter involves both the AO and the CTTA. An approval from one alone is incomplete.

Sources IC Tech Spec v1.5.1 (NAVFAC mirror) · IC Tech Spec v1.5.1 · IC Tech Spec v1.4 (archived)

Lockers and signs are the first PED control and the cheapest one. They give people a place to leave devices before they reach the first SCIF reader, and they make the rule impossible to miss.

Entry routine (design practice)

1. Place the locker bank on the approach path, before the first controlled door, where people naturally stop.
2. Post the prohibited-items sign at the lockers and again at the entrance.
3. If a detector is used, put it after the lockers, so a detection means a device got past the locker point.
4. Keep the locker area outside the perimeter and away from any rooms processing unencrypted information.

Sources UFC 4-010-05 · 12 FAM 710 (State)

Not every electronic device at the door is contraband. Government-issued equipment, medical devices and some wearables can be approved, but only through a specific process, and the approval is local.

The 2016 DoD CIO wearables memo is often misread. Its own FAQ says it does not apply to SCIFs or SAPFs, which follow IC directives.

Detection systems must handle approved devices. An approved medical device may itself transmit. Bastille says its system supports allow-listing of "personal medical devices" [vendor claim]. Whatever the product, the allow-list is a security-office record, and each entry should trace to a written approval.

Sources IC Tech Spec Chs. 7–10 (v1.4 archive; text source) · 12 FAM 710 (State) · DCSA SAP Compliance Checklist (Jan 2026) · DoD CIO wearable devices memo (2016) · Bastille: WIDS

After the April 2023 unauthorized disclosure case, the Secretary of Defense signed the memorandum "Security Review Follow-on Actions" on 30 June 2023. Two of its directions concern PEDs.

The common overstatement. Vendor-authored trade articles have described the memo as requiring detection systems to be in place in every DoD SCIF and SAPF by 30 September 2024. The memo's verb is "program for." That is planning and budgeting language: put detection and mitigation into the component's program and budget. It is not the same as "installed and operating by" that date. The memo also pairs detection systems with "mitigation measures."

How to use it correctly

• Quote the memo, not a summary of it.
• Do not tell a DoD customer they are "out of compliance" for lacking a detector. What is fielded depends on component implementation guidance and the AO's decisions.
• The memo applies to DoD SCIFs and SAPFs. IC element and civilian agency facilities follow their own policy.

Sources SECDEF memo, Security Review Follow-on Actions (30 Jun 2023) · IC Insiders article (vendor-authored) · Military Embedded Systems article (vendor-authored)

DCSA's DoW SAP Security Compliance Checklist (January 2026, v2) ties SAP security questions to DoDM 5205.07, which DoD consolidated on 17 January 2025 (Volume 3 cancelled). Several items touch PEDs and wireless.

What this means for design (derived)

• Approval comes first. F-10 asks whether approvals were obtained before a device entered. A detector that finds an unapproved device afterward supports the program but does not answer F-10.
• SAP and SCI PED rules converge. The SAP checklist cites Tech Spec Chapter 10 directly, so a SAPF PED design should read that chapter as closely as a SCIF design does.
• Co-utilized facilities take the stricter rule. Tech Spec 1.B.2 holds a co-utilized SAPF to the highest requirement, so the tighter PED policy governs.
• Warning beacons are perimeter devices. An F-13 beacon or annunciator adds wiring and hardware at the boundary. Route it inside the perimeter and include it in CTTA review.

Deliverables that help the PSO answer these items

• An equipment list for any detection system, including sensor locations and data paths
• Written approvals for any sensor or transmitter placed inside the SAPF
• A description of how detector alerts reach security staff and where logs are kept

Sources DCSA SAP Compliance Checklist (Jan 2026) · IC Tech Spec v1.5.1

Three jobs a detection system does

1. Listen passively. The sensors receive and never transmit. That matters in a SCIF: a detector that transmitted would itself be an RF transmitter needing CTTA evaluation and AO approval under ICS 705-1 §G.2.a. Cellbusters states its Zone Protector "does not have any jamming abilities" [vendor].
2. Classify. Sensor networks decode protocols, such as cellular, Wi-Fi, Bluetooth, Bluetooth Low Energy (BLE) and other IoT radios. Simpler detectors measure energy in frequency bands without identifying the device.
3. Locate. Several sensors together estimate a position on a floor plan. Handheld units use direction-finding antennas to walk an operator to the source.

Identifying repeat devices. Radio identifiers such as MAC addresses change (see the next section), so vendors describe device "fingerprinting" to recognize a device across sessions [vendor claim]. Bastille, for example, claims coverage of "50+ wireless protocols" and location "down to 1-3 meters" [vendor claim].

Sources ICS 705-1 · Bastille: WIDS · Bastille: classified areas · Cellbusters Zone Protector · BVS Wolfhound-Ultra

RF detection only finds devices that are transmitting while a sensor is listening. Every limit below follows from that one fact.

Design responses (derived)

• Layer it. Pair RF detection with PED policy, lockers and signage, and add ferrous or metal screening if the AO wants powered-off devices addressed.
• Give it time. A vestibule dwell period gives an idle phone more chance to transmit (design practice).
• Don't allow-list by MAC address. Randomization makes MAC-based allow-lists unreliable. Ask the vendor how its system recognizes approved devices.
• Survey first. Measure the ambient RF at the entry before choosing detector sensitivity and location.

Sources Bastille: classified areas · Apple Support: Airplane Mode · Apple Support: private Wi-Fi addresses · Bluetooth SIG: privacy · BVS Wolfhound-Ultra

Because RF sensors cannot see a powered-off phone, some programs add screening that senses the device's physical materials instead of its radio.

Verified product example. Metrasens markets the Ultra as ferrous-object screening in free-standing or wall-mounted form, with MQTT integration to "VMS, PSIM, access control" [vendor claim]. Claims that it detects phones specifically, or powered-off phones, were not found on the pages reviewed for this knowledge base. Do not repeat them without the vendor's written documentation.

How the layers fit

Operational reality. Screening that alarms on keys and belts needs a place and a person to resolve the alarm, or people learn to ignore it. In a vestibule, design the resolution path: a shelf or tray outside the inner door, a sign, and a defined response from the security office.

Sources Metrasens Ultra · UFC 4-010-05 · Bastille: classified areas

The table repeats only what each manufacturer states about its own product on the pages reviewed. It is not an endorsement or an independent test, and inclusion does not mean the AO will approve a product.

Not included: vendors whose sites could not be reached or whose pages were not reviewed, and companies selling coverage systems (DAS or emergency responder radio) rather than detection.

Sources Bastille · Bastille: WIDS · BVS WallHound-Pro · BVS Wolfhound-Ultra · Cellbusters Zone Protector · Metrasens Ultra

A detector is not neutral furniture. Once mounted in or next to a SCIF, it is electronic equipment with power, cabling, sometimes a network port, and a log that records who carried what. Each of those draws review.

Choosing the connection style (derived)

• Contact-closure only. A unit with dry contacts and no Ethernet, such as the WallHound-Pro as described by BVS, keeps the integration to a supervised input on the ACS. It is the simplest design to review.
• Relay plus local logging. Cellbusters lists relay alerts and "Silent Logging" among its outputs and offers standalone or networked operation.
• Networked sensor platform. Sensor networks with dashboards and integrations provide location and history, and they bring a full network review with them.

Records. Treat detection logs as security records. Keep them on the security office's systems, not the integrator's laptop or a vendor cloud, unless the AO approves otherwise.

Sources ICS 705-1 · BVS WallHound-Pro · Cellbusters Zone Protector · Bastille: WIDS

A vestibule (two doors with a small space between them) gives detection its best chance: a known person, a closed space, and a few seconds of dwell before the inner door opens. The sequence below is a public-level concept. The site SOP and AO approval govern the real one.

Rules the sequence must keep

• Egress is never blocked. Detection and interlock logic apply to entry only. Anyone inside the vestibule or the SCIF can always leave.
• Two technologies stay two technologies. A clean detection result is not an authentication factor. The inner door still needs credential plus PIN or biometric.
• Alarms go to the right people. Detection events go to SCI-indoctrinated staff, the same people who monitor the entrance.
• Visitors follow the same path under escort. A detection on a visitor is resolved by the escort, not by the visitor.

See: Access Control, Identity & Hirsch

Sources UFC 4-010-05 · IC Tech Spec Chs. 7–10 (v1.4 archive; text source) · ICS 705-1 · BVS WallHound-Pro

The integration is ordinary access control engineering: the detector becomes an input, and ACS logic decides what the inner door does. The discipline is in what the detector must not touch.

What the detector must never do

• Never shunt or mask the IDS. Detector logic runs in the ACS. It must not bypass or delay the UL 634 door contact or any IDS zone.
• Never drive a lock on the egress side. Free egress comes from the mechanical door hardware.
• Never change IDS modes. Only SCIF personnel inside the SCIF change IDS access modes.

Fail-state decisions to put in writing (derived)

• Detector power loss or trouble: does the inner door stay available, or does it require security-office release? Either answer is defensible. An unrecorded answer is not.
• ACS server offline: confirm the interlock and detector input logic run at the door controller, not only on the server.

See: Intrusion Detection & UL 2050 / Extent 3

Sources Integrated Mx datasheet · BVS WallHound-Pro · Cellbusters Zone Protector · Metrasens Ultra · IC Tech Spec Chs. 7–10 (v1.4 archive; text source)

A security vestibule where one door stays locked while the other is open is also a path of egress. Fire and building officials treat it that way.

What the model codes say (practitioner reading). Allegion's I Dig Hardware blog reports:

• "The model codes do not currently include prescriptive requirements for control vestibules in use groups other than I-3" (2021).
• "Interlocks are not currently addressed in the model codes, so each interlock application must be approved by the Authority Having Jurisdiction" (2023).

Factors the AHJ may weigh (per Allegion)

SCIF-specific coordination (derived)

• The egress side of each SCIF door keeps FF-L-2890 one-motion mechanical free egress.
• Fire alarm and power loss release the interlock logic, as the AHJ approves. The FF-L-2740 lock and FF-L-2890 deadbolt are different: they secure the SCIF when it is unoccupied, and FF-L-2890 hardware for occupied doors still gives one-hand mechanical egress from inside, so a person left inside is not trapped.
• Emergency exit doors stay alarmed 24/7 with local annunciation (UFC 3-4.6.10).
• The fire alarm interface is a conductor crossing the perimeter. Coordinate it with the CTTA.
• For RF-shielded vestibules, the guide specification calls for electric interlocks between the shielded doors, wired per the door manufacturer's instructions.

See: Penetrations, Utilities & Life Safety

Sources I Dig Hardware: control vestibules (2021) · I Dig Hardware: interlocks (2023) · UFC 4-010-05 · UFGS 13 49 20.00 10

Tech Spec Chapter 11, Telecommunications Systems, covers unclassified telephone systems, unclassified information systems, CCTV at entry points, unclassified wireless, environmental infrastructure systems, emergency notification, system access, unclassified cable control and protected distribution systems.

Telephone security standards were historically written by the Telephone Security Group (TSG). According to a NITAAC vendor showcase, that work now sits with the National Telecommunications Security Working Group under CNSS, and the standards are published as CNSS instructions.

Stricter agency example. State's 5 FAH-2 H-621.1 requires TSG-approved instruments or disconnects in controlled access areas, prohibits speakerphones, cordless phones and stand-alone answering machines, and requires the phone system to be inside a controlled area or a locked, alarmed room.

Sources SCIF Fixed Facility Checklist v1.5 · IC Tech Spec v1.5.1 · TSG approved endpoints list (May 2026) · NITAAC: TSG phones (vendor showcase) · 5 FAH-2 H-620 (State)

Beyond telephones, the Fixed Facility Checklist asks about every other system that can carry sound, images or data across the perimeter. None is automatically forbidden. Each must be declared and configured as the AO approves.

Wireless. Tech Spec 11.E covers unclassified wireless network technology. Under ICS 705-1 §G.2.a, any RF transmitter needs CTTA evaluation and AO approval, and the TEMPEST Checklist asks about transmitters within 3 m of the perimeter. That includes building Wi-Fi access points and DAS antennas mounted on the outside face of a SCIF wall.

Intercoms. Interior intercom stations carry the same audio back-feed and on-hook concerns as telephones. A video intercom at the primary entrance may provide remote door release (UFC 3-4.17.2).

See: Acoustics & Sound Masking

Sources SCIF Fixed Facility Checklist v1.5 · ICS 705-1 · SCIF TEMPEST Checklist · UFC 4-010-05 · IC Tech Spec v1.5.1

CCTV at a SCIF has one job: help people inside see who is at the door. It supplements access control. It never replaces the lock, the ACS or the IDS, and it must never become a way to see inside.

Design guidance (practitioner)

1. Aim. Frame the approach and the face of the person at the door. Keep the keypad, the FF-L-2740 dial and the view through the open door out of frame. VMS privacy masking is a backup, not the primary control.
2. Inside controls. Monitor, intercom master and release button go inside the SCIF, operated by SCI-indoctrinated staff.
3. No audio. Specify cameras and intercoms without microphones, or with microphones physically disabled.
4. Cabling. Keep camera runs outside the SCIF where possible. A line that must enter is a perimeter conductor for CTTA review.
5. Recording. An exterior-view recorder is normally an unclassified system kept off SCIF networks. Its footage shows who enters, so restrict operator access.
6. Security-in-Depth. List corridor and building cameras in the checklist's Security-in-Depth section with coverage maps.

See: Access Control, Identity & Hirsch

Sources IC Tech Spec v1.5.1 (NAVFAC mirror) · UFC 4-010-05 · IC Tech Spec v1.4 (archived) · SCIF Fixed Facility Checklist v1.5

See: Traps & Common Failures

Sources SECDEF memo (30 Jun 2023) · SCIF Fixed Facility Checklist v1.5 · UFC 4-010-05 · ICS 705-1 · I Dig Hardware: interlocks (2023) · DoD CIO wearable devices memo (2016)