RED/BLACK, TEMPEST & EMI Filters

TEMPEST is a covername, not an acronym. NSA's declassified history says: "This problem of compromising radiation we have given the covername TEMPEST." Ignore the vendor backronyms. NIST's public glossary (citing CNSSI 4009) defines TEMPEST as the "investigation, study, and control of unintentional compromising emanations."

The idea is older than 2-95. NACSIM 5000, TEMPEST Fundamentals (1 Feb 1982), already separated "national security plain language information in electric signal form (RED)" from "encrypted or non-national security information (BLACK)."

Sources NSTISSAM TEMPEST/2-95 (historical mirror) · NACSIM 5000 (historical mirror) · NSA, TEMPEST: A Signal Problem · NIST CSRC Glossary: TEMPEST

Bell Labs identified three classic countermeasures during WWII: shielding (for radiated and magnetic fields), filtering (for conducted signals) and masking. Distance and control of the surrounding space came later. In construction terms:

Shielding is threat- and site-driven, not automatic. The Tech Spec (3.C.4) installs RF protection "at the direction of the CTTA when a SCIF utilizes electronic processing and does not provide adequate RF attenuation at the inspectable space boundary." Its wall notes treat foil as an add-on: "CTTA recommended countermeasures (foil backed GWB or layer of approved Ultra Radiant R-Foil)" (3.C.3.e). Overseas SCIFs not under Chief of Mission authority are the opposite case. There, "TEMPEST countermeasures shall be pre-engineered into the construction of the SCIF" (4.H.1).

Conducted leaks don't need a missing shield to happen.

• A BLACK cable that leaves the SCIF can pick up RED signals if it is bundled with RED cable.
• Metal conduit, pipe and duct can carry signals out of the room.
• Poor grounding puts RED return currents on shared paths. NACSIM 5000 warns that "appreciable impedances can and do exist between various points of the return paths."

So an unshielded SCIF still depends on the installer doing the basics: follow the drawings and CTTA notes, label RED and BLACK, never mix them, use fiber where it's called for, and add no metallic penetrations.

Sources NSA, TEMPEST: A Signal Problem · IC Tech Spec v1.5.1 (NAVFAC mirror) · IC Tech Spec v1.5 · NACSIM 5000 (historical mirror) · Wikipedia: Tempest (codename)

The CTTA (Certified TEMPEST Technical Authority) is the government-certified TEMPEST engineer who decides which countermeasures a facility needs. Neither integrators nor GCs nor architects make that call.

• Tech Spec 3.A.3 / ICS 705-1: the CTTA shall "Review SCIF construction or renovation plans to determine if TEMPEST countermeasures are required and recommend solutions." The CTTA gives the CSA and AO documented results with recommendations. As far as practicable, the mitigations are built into the design.
• Tech Spec 2.A.3.a: the CTTA "shall use the National Security Agency Information Assurance (NSA IA) list as an additional resource."
• UFC 4-010-05 calls the CTTA's documented output the TEMPEST Countermeasures Review (TCR). "For an initial TCR, the addendum will be submitted to AO during the planning phase" (1-19.3).
• DoD: DoDM 5105.21 Vol. 1 gives DIA "centralized physical security and TEMPEST accreditation for the DoD Components and DoD contractors," except those under NSA/CSS, NGA or NRO cognizance.

Governing TEMPEST issuances. These are named here for orientation only. Their technical content isn't public and isn't reproduced.

Sources IC Tech Spec v1.5.1 (NAVFAC mirror) · ICS 705-1 · UFC 4-010-05 · DoDM 5105.21 Vol 1 · DoDM 5105.21 Vol 2 · DoDI 8523.01 · NSTISSAM TEMPEST/2-95 (historical mirror)

The public Tech Spec never lists filter ratings or separation distances. It states when the CTTA's direction applies. For a builder, those clauses are the triggers to watch for on the drawings.

Conditions that commonly drive a CTTA toward countermeasures (conceptual):

• Little or no inspectable space, for example a SCIF in a shared or leased building
• A high-threat or overseas location
• Non-evaluated equipment, or high volume or sensitivity of RED processing. These were factors in historical NSTISSI 7000.
• Program or sponsor requirements, for example some SAPFs

Recommendations can be partial: foil on certain walls, shielded racks, or filtered power only.

Sources IC Tech Spec v1.5.1 (NAVFAC mirror) · IC Tech Spec v1.5 · ICS 705-1 · NSTISSI 7000 (historical mirror)

• Who sets it: the CTTA. The Tech Spec delegates this determination, and CNSSI 7000 defines the term.
• Why it matters: RF protection is required when a SCIF "does not provide adequate RF attenuation at the inspectable space boundary" (Tech Spec 3.C.4). A small inspectable space tends to mean more shielding, filtering or separation.
• What goes into it: the facility's location, who controls the surrounding floors, parking and neighboring buildings, the threat environment, and the equipment's TEMPEST profile. Historical NSTISSI 7000 listed location, information volume and sensitivity, physical controls, equipment profiles and threat as the drivers.
• Older term: NACSIM 5000 (1982) used "Controlled Space."

What builders should take from this:

1. The TEMPEST Checklist asks for the distance from the SCIF perimeter to the closest limit of the inspectable space. The owner and SSM supply it, not the GC.
2. A tenant move, a new neighbor, or a lease change on an adjacent floor can change the CTTA's conclusions.
3. UFC 4-010-05 §1-16.3 states that TEMPEST vulnerabilities are classified at a minimum of CONFIDENTIAL when associated with a physical location. Never discuss a specific site's inspectable space, findings or countermeasures in email, bids or marketing.

Sources NSTISSAM TEMPEST/2-95 (historical mirror) · NSTISSI 7000 (historical mirror) · IC Tech Spec v1.5.1 (NAVFAC mirror) · SCIF TEMPEST Checklist v1.4 (public form) · UFC 4-010-05

The SCIF TEMPEST Checklist is a Tech Spec form (Chapter 14 in v1.5.1). It collects the facts a CTTA needs to write the TCR. The Fixed Facility Checklist (§I) says a facility that electronically processes classified information completes it. DoD programs submit it as the TEMPEST Addendum to the FFC. The v1.5 form is organized as A General, B SCIF Equipment/Systems and C Information Processing.

These are reporting questions. They aren't separation distances or pass/fail criteria.

How the builder contributes: the integrator and electrical contractor supply accurate lists of every conductor and pipe that crosses the perimeter, every radio (wireless IDS, Wi-Fi, cellular alarm communicators, BAS radios), and the wall, ceiling and floor construction. The SSO or SSM completes and submits the form.

Sources SCIF TEMPEST Checklist v1.4 (public form) · SCIF TEMPEST Checklist v1.5 · SCIF Fixed Facility Checklist v1.5 · CDSE SAPF short guide · UFC 4-010-05

RED/BLACK separation has two parts. Physical separation reduces radiated and inductive coupling between equipment and cables. Electrical separation covers signal distribution, power, grounding and filtering. This section covers the physical concepts. The CTTA and engineer of record set the specifics.

Concepts every installer should apply:

• Label everything. UFC 4-010-05 §3-4.19 calls for cabling, patch panels, outlets and connectors to be color-coded or clearly marked by classification. Cabling enters the protected area "from a single location."
• Separate pathways. Use dedicated RED and BLACK raceways, trays and patch fields. Never share a bundle, tray or panel. Historical 2-95 described "dedicated RED/BLACK wireways" and incompatible patch connectors so RED can't be patched into BLACK.
• Plan equipment placement. The CTTA may "zone" equipment, matching its emanation level to the distance to the inspectable-space boundary. Public detail is limited, so treat placement as a CTTA determination.
• Keep crypto close. UFC 3-3.3.2 locates telecom spaces with encryption equipment "within or adjacent (shared wall) to the secure area to enhance security and minimize or eliminate Protected Distribution System (PDS) requirements."
• Avoid PDS where possible. When unencrypted classified lines must cross lesser-classified space, CNSSI 7003 PDS applies. UFC 3-4.20: "Avoid the use of PDS whenever possible due to inspection requirements." See: DISA Traditional Security STIG & PDS.
• Don't improvise routes. If the planned path is blocked, stop and ask. A reroute can put a BLACK cable next to RED equipment.

Sources UFC 4-010-05 · NSTISSAM TEMPEST/2-95 (historical mirror) · IC Tech Spec v1.5.1 (NAVFAC mirror) · SPG: De-mystifying TEMPEST

Power. Every power conductor that leaves the SCIF is a possible conducted path out. The TEMPEST Checklist asks about power lines exiting the SCIF. Power filters and isolation are CTTA countermeasures; the public Tech Spec doesn't specify them. Utilities should enter at a single point (Tech Spec 3.G.4). Feeding the SCIF from a dedicated panel at the entry point is common practitioner practice, not a published Tech Spec requirement.

Grounding. Grounding is where good intentions cause the most harm.

• NACSIM 5000 warns that "appreciable impedances can and do exist between various points of the return paths." Shared grounds can carry RED return currents onto BLACK systems.
• Historical 2-95 discussed equipotential-plane and single-point grounding approaches and warned that "a long slender ground wire is not an effective RF ground."
• RED/BLACK grounding schemes are designed by the engineer of record and the CTTA, not in the field. The NEC safety ground is never optional. Never add an isolated "clean" earth rod on your own.

Fiber preference.

In Compliance Magazine (2022) recommends bringing data through the shield on fiber via a waveguide instead of filtering copper data lines. See: RF Shielding, Penetrations & Installer Methods.

Sources NACSIM 5000 (historical mirror) · NSTISSAM TEMPEST/2-95 (historical mirror) · SCIF TEMPEST Checklist v1.4 (public form) · In Compliance: SCIF and RF secured facility design · IC Tech Spec v1.5.1 (NAVFAC mirror)

How it works. A power filter is a passive low-pass filter. Genisco explains that it lets "lower frequency signals… pass" and presents "high impedance to high frequency signals," using "only passive elements (inductors, capacitors and in some cases resistors)." AC power is 50, 60 or 400 Hz, so power filters are low-pass by design. Their purpose is "to keep conducted high frequency noise from entering or exiting the shielded room via the power or communication lines."

How it's rated: insertion loss. Tech-Etch defines insertion loss as "The ratio between the power received at a specified load before and after the insertion of a filter," expressed in dB. Every 10 dB is a factor of ten in power, so 100 dB is a 10^10 power ratio.

Published "100 dB class" examples. These are vendor data, not requirements.

The attenuation level and frequency range for a project come from the CTTA, the shield designer and the specification, not from a catalog.

Sources Genisco: How EMI/RFI filters work · Genisco: Filter panels · Tech-Etch glossary · Premier SCIF composite filters · ETS-Lindgren LPRX/LFPRX · Captor TEMPEST filters

This is the most common question from electricians. The answer is always the same: dirty outside, clean inside.

 UNPROTECTED SIDE                                                    PROTECTED ROOM
                                              || SHIELD PLANE ||
 panel -> feeder -> [ LINE / DIRTY compartment || filter || LOAD / CLEAN compartment ] -> branch circuits
                                              ||        ||
            the shield plane runs THROUGH the filter case at its internal RF barrier plate;
            the case is bonded metal-to-metal, paint-free, so it closes the hole it occupies

Read this as a rule about conductors, not about boxes. "Dirty outside, clean inside" describes which conductors may cross, not which way the housing projects. The case has to be bonded into the shield plane so it closes its own hole. Whether the body then sits proud of the outer face, flush in the wall, or proud of the inner face is a mounting decision: MIL-HDBK-1195 §2.8 puts filters at the penetration "either inside or out, depending usually on available access or space," and adds that "for TEMPEST installation requirements, the conduit runs are best located inside of the shielded enclosure."

What the manufacturers say:

• ETS-Lindgren's manual calls the compartments the "dirty side" and "clean side," with outputs "EMI isolated from the inputs." "The output conductors are brought into the clean side wiring compartment of the filter through a conduit penetration."
• Astrodyne TDI: install "at power entry locations where electrical services pass through the RF shield."
• Premier: mount "as close as possible to the entry point of the input power wires" and "Maintain physical isolation and separation between filter input and output wires."

Why reversing it fails. If the load side faces outward, the unfiltered conductors run inside the protected room. RF on those conductors radiates inside the shield, and RED signals can couple onto them. The filter is still in the circuit, but the conductors that matter have bypassed it.

Why sharing a box fails. If dirty and clean conductors share a junction box, gutter or raceway, RF jumps from input to output wiring and bypasses the filter completely.

Sources ETS-Lindgren EMI/EMP filter manual · Astrodyne TDI shielded facility filters · Premier: Filter installation best practices · MIL-HDBK-1195, RF Shielded Enclosures (1988, historical DoD handbook) · UFGS 13 49 20.00 10, Shielded Enclosures

A filter works by shunting RF through its capacitors to its case. The case therefore has to be part of the shield electrically. If the case isn't bonded, the rated dB is never achieved.

Bonding the case.

• Premier: "Ensure filter housing is bonded… via metal-metal connection," with mating surfaces "void of paint or other insulating material."
• Holland Shielding: filters "should be grounded to the Faraday cage so that there is a connection with a low impedance to the body of the shield."
• Use short, flat braid rather than long round wire (Premier). Historical 2-95 put it bluntly: "a long slender ground wire is not an effective RF ground."

The penetration itself.

• ETS-Lindgren: "All filter penetrations include attached conductive elastomeric gaskets."
• Genisco uses "a gasketed pipe to penetrate into a shielded environment." Premier and Genisco both offer threaded-pipe outputs.
• ETS-Lindgren's "/PEN" option provides the penetration conduit as part of the filter assembly.

Filter boxes and panels. Multi-filter panels group several circuits behind one bonded enclosure. Genisco describes an "RF tight inner area, secured with a RF gasket." Panels simplify single-point entry, inspection and testing.

Conduit rules.

See: RF Shielding, Penetrations & Installer Methods for single-point entry panels and grounding.

Sources Premier: Filter installation best practices · Holland Shielding: 101 EMI shielding tips · ETS-Lindgren LPRX/LFPRX · Genisco: Power line filters · Genisco: Filter panels · NSTISSAM TEMPEST/2-95 (historical mirror) · MIL-HDBK-1195, RF Shielded Enclosures (1988, historical DoD handbook) · UFGS 13 49 20.00 10, Shielded Enclosures

Power isn't the only conductor that crosses a boundary. Every telephone pair, fire alarm loop, door contact, reader cable and data line is a path too.

What signal filters do. A signal filter is also low-pass, but it's tuned to pass the wanted signal and block RF above it.

The limitation. A low-pass filter must pass the signal it carries. That works for POTS telephone, fire alarm loops, relays, dry contacts and low-speed serial. It's difficult for high-speed Ethernet, whose signal energy extends far into the frequencies a filter needs to block. The usual answer is all-dielectric fiber through a waveguide with media converters on each side. Purpose-built data filters exist, but whether a filtered copper data path is acceptable is a CTTA call.

Integrator impact. Inside a shielded room, every low-voltage device needs a treated path out:

See: PEDs, Wireless Detection, Telecom & CCTV for audio back-feed rules.

Sources Captor signal line filters · Genisco: Communication filters · ETS-Lindgren 10G Ethernet Filter · Holland Shielding: 101 EMI shielding tips · SCIF Fixed Facility Checklist v1.5

HEMP and TEMPEST are opposite problems.

MIL-STD-188-125 addresses HEMP protection for ground-based facilities performing critical, time-urgent missions. It combines a shield with point-of-entry protection on every penetrating conductor. A HEMP-hardened shield can support TEMPEST goals, but SCIF accreditation doesn't require HEMP protection.

Vendor examples (not requirements):

• ETS-Lindgren EMP/TEMPEST filters are "designed to meet point-of-entry requirements of MIL-STD-188-125-1 & -2 for Short and Intermediate Pulses," with transient suppression.
• ETS-Lindgren's manual says the MOV "should be replaced annually, when it is estimated that a high incidence of over voltages have occurred."
• Premier HEMP filters span "16A to 4000A."

Practical guidance:

1. Confirm whether the project has a HEMP requirement (program, sponsor or mission), a TEMPEST recommendation, both, or neither.
2. Don't substitute a HEMP filter for a TEMPEST filter, or the reverse, without agreement from the engineer of record and the CTTA. Leakage, kVAR, size and maintenance differ.
3. HEMP filters with MOVs add a maintenance item. Put MOV inspection and replacement in the O&M manual.
4. HEMP verification uses pulse-injection testing under MIL-STD-188-125. Specific test values weren't published on the vendor pages in our research, so get them from the project specification.

Sources Wikipedia: Nuclear electromagnetic pulse · Wikipedia: MIL-STD-188 · MIL-STD-188-125-1 · ETS-Lindgren EMP/TEMPEST filters · ETS-Lindgren EMI/EMP filter manual · Premier HEMP filters

MIL-STD-220 is the "Test Method Standard Method of Insertion Loss Measurement" (Genisco). Captor, ETS-Lindgren, Astrodyne and the historical NSA 94-106 (which cited MIL-STD-220A) all reference it. When a datasheet says "100 dB per MIL-STD-220," this is the bench test behind the number.

What the bench number means, and what it doesn't.

• Premier: datasheets show insertion loss "relative to 50 ohm source and load impedances," in common and differential mode.
• Premier continues: "As actual system impedances may differ, testing is critical."
• Installed source and load impedances differ from the 50-ohm bench setup. Installed performance also depends on case bonding, input/output wiring separation and gaskets.
• That's why the finished room is tested for shielding effectiveness after installation (IEEE 299 or the method the specification names). A filter's bench rating doesn't replace that test. See: RF Shielding, Penetrations & Installer Methods.

Submittal review checklist for filters:

Sources Genisco: Filter selection criteria · Premier: Filter installation best practices · Premier: Selecting an EMI filter · Captor shielded-room filters · NSA 94-106 (historical mirror) · MIL-HDBK-1195, RF Shielded Enclosures (1988, historical DoD handbook) · UFGS 13 49 20.00 10, Shielded Enclosures

Leakage is built into the design. A filter's line-to-case capacitors pass a small continuous 60 Hz current to ground. It isn't a defect. Captor publishes "5mA maximum @ 120 VAC" for one TEMPEST filter. Premier notes that leakage limits "are usually dictated by the end use environment." Leakage adds up across every filter and every phase on a feeder.

The ground must never be lost. ETS-Lindgren: "provide uninterruptible safety earth ground from the main power source to the product input wiring terminals." A filter that loses its equipment grounding conductor can put hazardous voltage on its case, and the case is bonded to a shield people touch.

The GFCI conflict.

A GFCI upstream of a TEMPEST filter is likely to nuisance-trip. One approach engineers evaluate is placing code-required GFCI protection on load-side branch circuits inside the room and coordinating equipment ground-fault protection with total filter leakage. The electrical engineer of record and the AHJ make that call.

Grounding rules of thumb for electricians:

• Keep the equipment grounding conductor continuous from the source to the filter input terminals.
• Don't create a separate, unbonded "clean" or "TEMPEST" earth electrode. It's a safety and code problem. The EE and AHJ confirm the electrode system.
• Don't lift grounds to "fix" nuisance trips.
• Shield grounding and RED/BLACK grounding are designed, not improvised. See: RF Shielding, Penetrations & Installer Methods.

Sources Captor TEMPEST filters · Premier: Selecting an EMI filter · ETS-Lindgren EMI/EMP filter manual · Wikipedia: Residual-current device

A de-energized filter can still bite. Large filter capacitors hold charge after the breaker opens. Manufacturers add bleeder (discharge) resistors to drain it, but the drain takes time, and a failed resistor doesn't announce itself.

Manufacturer warnings (examples; read the label on your unit):

Field procedure before opening a filter compartment:

1. Lock out and tag out the feeder, including any UPS or generator source.
2. Wait at least the discharge time on the filter label.
3. Verify zero voltage with a properly rated meter on every line terminal, to ground and line to line.
4. Apply a shorting stick per the manufacturer's instructions.
5. Only then open the compartment or touch terminals.

This is a general safety caution. The detailed procedure comes from the filter manufacturer and your electrical safety program.

Maintenance items for the O&M manual:

• ETS-Lindgren: "Periodically power down the filter and remove the wiring compartment lids to check inside for dirt, debris and corrosion."
• Replace torn EMI gaskets with factory parts only.
• For HEMP-rated filters, inspect or replace MOVs per the manufacturer.
• Any work that disturbs a filter's bond or gasket is a shield-integrity event. Tell the SSM, who decides whether a retest is needed.

Sources ETS-Lindgren EMI/EMP filter manual · Captor shielded-room filters · Genisco: Power line filters

The problem. A 100 dB power filter usually contains a lot of capacitance. Capacitance draws reactive power (kVAR) even when the room's equipment is idle. Utility power absorbs this easily. A standby generator often can't.

Premier documents three generator failure modes for high-capacitance filters. They can:

• "Overload generator capacity"
• "Cause voltage instability"
• "Prevent generator startup altogether"

Why it hits SCIFs. Some SCIF projects require standby power. UFC 4-010-05 §2-10.2.1 says that when a standby power system is required, "provide a standby engine-driven generator sized for essential and uninterruptible loads," with UPS "for the uninterruptible loads to filter commercial power" (2-10.2.2). A filtered shielded room on a generator or UPS is therefore a common combination, and a common commissioning surprise.

Mitigations:

Who needs to know:

1. Electrical engineer of record: filter kVAR, leakage, voltage drop and generator/UPS compatibility.
2. Generator and UPS vendors: leading power factor at light load.
3. Filter vendor: capacitance per line and low-kVAR alternatives.
4. Commissioning agent: a transfer test with filters energized.

Sources Premier: Filters and generator startup (low kVAR) · ETS-Lindgren LKV-4500 · UFC 4-010-05

Sources Genisco: How EMI/RFI filters work · Premier: Filter installation best practices · ETS-Lindgren EMI/EMP filter manual · Captor TEMPEST filters · IC Tech Spec v1.5.1 (NAVFAC mirror) · MIL-HDBK-1195, RF Shielded Enclosures (1988, historical DoD handbook) · UFGS 13 49 20.00 10, Shielded Enclosures

Sources Premier: Filter installation best practices · Premier: Filters and generator startup (low kVAR) · ETS-Lindgren EMI/EMP filter manual · Wikipedia: Residual-current device · NSTISSAM TEMPEST/2-95 (historical mirror) · MIL-HDBK-1195, RF Shielded Enclosures (1988, historical DoD handbook) · UFGS 13 49 20.00 10, Shielded Enclosures

What happened. On 27 Sep 2017, UpGuard researcher Chris Vickery found a misconfigured, publicly accessible Amazon S3 bucket named "inscom." It held U.S. Army INSCOM data, including files marked Top Secret/NOFORN and virtual hard drives tied to the DCGS-A platform. A defunct contractor was associated with it. UpGuard published on 28 Nov 2017, after the bucket was secured. The cause was misconfiguration, not an attack.

Why it belongs in a TEMPEST module. No filter, shield or RED/BLACK separation protects information that has already been copied onto a contractor's file share. Data about secure systems is often more useful to an adversary than a single emanation:

Rules for the build team:

• UFC 4-010-05 §1-16.3 treats TEMPEST vulnerabilities associated with a physical location as classified at a minimum of CONFIDENTIAL. Handle project documents as the AO directs.
• Keep drawings, schedules and test reports off public cloud shares, personal email and open bid portals.
• Share on a need-to-know basis with subcontractors, and collect copies at closeout.
• Never use a real project's TEMPEST details in marketing, training slides or case studies.

Sources UpGuard: Black Box, Red Disk (INSCOM) · UFC 4-010-05