Equipment, wires and signals carrying unencrypted classified information
"equipment that processes unencrypted NSI that requires protection during electrical/electronic processing"
BLACK
Equipment and signals carrying only encrypted or unclassified information
"equipment that processes only unclassified and/or encrypted information"
RED/BLACK concept
Keep RED physically and electrically apart from BLACK
"Separation of electrical and electronic circuits, components, equipment, and systems that handle national security information (RED)… from those that handle non-national security information (BLACK)"
Compromising emanations (CE)
Accidental radiated or conducted signals that reveal what equipment is processing
"Unintentional signals that, if intercepted and analyzed, would disclose the information…"
Fortuitous conductor
Metal never meant to carry signals that carries them anyway: conduit, pipe, duct, cable armor, steel strength members
Conduit, pipe or duct around lines leaving the controlled area "can become a fortuitous conductor"
TEMPEST is a covername, not an acronym. NSA's declassified history says: "This problem of compromising radiation we have given the covername TEMPEST." Ignore the vendor backronyms. NIST's public glossary (citing CNSSI 4009) defines TEMPEST as the "investigation, study, and control of unintentional compromising emanations."
The idea is older than 2-95. NACSIM 5000, TEMPEST Fundamentals (1 Feb 1982), already separated "national security plain language information in electric signal form (RED)" from "encrypted or non-national security information (BLACK)."
Bell Labs identified three classic countermeasures during WWII: shielding (for radiated and magnetic fields), filtering (for conducted signals) and masking. Distance and control of the surrounding space came later. In construction terms:
Countermeasure
What it looks like in a building
Shielding
Welded or modular shielded rooms, foil-backed wallboard, shielded racks
Filtering
Power and signal filters where conductors cross the boundary
Shielding is threat- and site-driven, not automatic. The Tech Spec (3.C.4) installs RF protection "at the direction of the CTTA when a SCIF utilizes electronic processing and does not provide adequate RF attenuation at the inspectable space boundary." Its wall notes treat foil as an add-on: "CTTA recommended countermeasures (foil backed GWB or layer of approved Ultra Radiant R-Foil)" (3.C.3.e). Overseas SCIFs not under Chief of Mission authority are the opposite case. There, "TEMPEST countermeasures shall be pre-engineered into the construction of the SCIF" (4.H.1).
Conducted leaks don't need a missing shield to happen.
A BLACK cable that leaves the SCIF can pick up RED signals if it is bundled with RED cable.
Metal conduit, pipe and duct can carry signals out of the room.
Poor grounding puts RED return currents on shared paths. NACSIM 5000 warns that "appreciable impedances can and do exist between various points of the return paths."
So an unshielded SCIF still depends on the installer doing the basics: follow the drawings and CTTA notes, label RED and BLACK, never mix them, use fiber where it's called for, and add no metallic penetrations.
The CTTA (Certified TEMPEST Technical Authority) is the government-certified TEMPEST engineer who decides which countermeasures a facility needs. Neither integrators nor GCs nor architects make that call.
Tech Spec 3.A.3 / ICS 705-1: the CTTA shall "Review SCIF construction or renovation plans to determine if TEMPEST countermeasures are required and recommend solutions." The CTTA gives the CSA and AO documented results with recommendations. As far as practicable, the mitigations are built into the design.
Tech Spec 2.A.3.a: the CTTA "shall use the National Security Agency Information Assurance (NSA IA) list as an additional resource."
UFC 4-010-05 calls the CTTA's documented output the TEMPEST Countermeasures Review (TCR). "For an initial TCR, the addendum will be submitted to AO during the planning phase" (1-19.3).
DoD: DoDM 5105.21 Vol. 1 gives DIA "centralized physical security and TEMPEST accreditation for the DoD Components and DoD contractors," except those under NSA/CSS, NGA or NRO cognizance.
Governing TEMPEST issuances. These are named here for orientation only. Their technical content isn't public and isn't reproduced.
Issuance
Title
Role
CNSSP No. 300
National Policy on Control of Compromising Emanations
National TEMPEST policy
CNSSI No. 7000
TEMPEST Countermeasures for Facilities
How agencies decide facility countermeasures; defines inspectable space
CNSSAM TEMPEST/1-13
RED/BLACK Installation Guidance
Separation, cabling, grounding and filtering guidance (U//FOUO)
CNSSI No. 7003
Protected Distribution Systems
PDS for unencrypted classified lines crossing lesser areas
The public Tech Spec never lists filter ratings or separation distances. It states when the CTTA's direction applies. For a builder, those clauses are the triggers to watch for on the drawings.
Clause
Public text (abridged)
What it means for the build team
Tech Spec 3.A.3
CTTA reviews plans "to determine if TEMPEST countermeasures are required"
Submit plans early. Countermeasures arrive as TCR items.
Tech Spec 3.C.3.e
"CTTA recommended countermeasures (foil backed GWB or layer of approved Ultra Radiant R-Foil)"
Architectural RF foil appears only if the CTTA recommends it
Tech Spec 3.C.4
RF protection "at the direction of the CTTA when a SCIF utilizes electronic processing and does not provide adequate RF attenuation at the inspectable space boundary"
Shielding scope is site-specific
Tech Spec 3.E.5.g
"SCIF Perimeter doors shall meet TEMPEST requirements per CTTA guidance"
Door selection may be affected
Tech Spec 3.G.2
"Metallic penetrations may require TEMPEST countermeasures, to include dielectric breaks or grounding, when recommended by the CTTA"
Every metal pipe, conduit or duct is a review item
Tech Spec 3.G.4
"Electrical Utilities should enter the SCIF at a single point"
Plan one entry point for power and signal
Tech Spec 4.H.1
Overseas (not COM): "pre-engineered into the construction"
Assume countermeasures are part of the design from the start
ICS 705-1 G.1.a(4)
RF shielding "should be planned for installation during initial construction"
Retrofit costs far more
ICS 705-1 G.2.a
RF transmitters need evaluation "by a competent authority (e.g., CTTA)" and AO approval
Radios and wireless devices are review items
Conditions that commonly drive a CTTA toward countermeasures (conceptual):
Little or no inspectable space, for example a SCIF in a shared or leased building
A high-threat or overseas location
Non-evaluated equipment, or high volume or sensitivity of RED processing. These were factors in historical NSTISSI 7000.
Program or sponsor requirements, for example some SAPFs
Recommendations can be partial: foil on certain walls, shielded racks, or filtered power only.
Who sets it: the CTTA. The Tech Spec delegates this determination, and CNSSI 7000 defines the term.
Why it matters: RF protection is required when a SCIF "does not provide adequate RF attenuation at the inspectable space boundary" (Tech Spec 3.C.4). A small inspectable space tends to mean more shielding, filtering or separation.
What goes into it: the facility's location, who controls the surrounding floors, parking and neighboring buildings, the threat environment, and the equipment's TEMPEST profile. Historical NSTISSI 7000 listed location, information volume and sensitivity, physical controls, equipment profiles and threat as the drivers.
Older term: NACSIM 5000 (1982) used "Controlled Space."
What builders should take from this:
The TEMPEST Checklist asks for the distance from the SCIF perimeter to the closest limit of the inspectable space. The owner and SSM supply it, not the GC.
A tenant move, a new neighbor, or a lease change on an adjacent floor can change the CTTA's conclusions.
UFC 4-010-05 §1-16.3 states that TEMPEST vulnerabilities are classified at a minimum of CONFIDENTIAL when associated with a physical location. Never discuss a specific site's inspectable space, findings or countermeasures in email, bids or marketing.
The SCIF TEMPEST Checklist is a Tech Spec form (Chapter 14 in v1.5.1). It collects the facts a CTTA needs to write the TCR. The Fixed Facility Checklist (§I) says a facility that electronically processes classified information completes it. DoD programs submit it as the TEMPEST Addendum to the FFC. The v1.5 form is organized as A General, B SCIF Equipment/Systems and C Information Processing.
Topic on the form
What it asks (public form, paraphrased)
Location and controlled space
Distance from the building to the compound boundary; distances to boundaries in each cardinal direction; distance from the SCIF perimeter to the closest limit of the inspectable space
Neighbors
Foreign-national-occupied areas within 100 meters of the SCIF
RED equipment
Manufacturer, model, type and classification of equipment that processes unencrypted NSI; share or volume of processing at each classification
Signal lines exiting the SCIF
Fiber, coax or copper, and whether a filter or isolation device is installed
Power lines exiting the SCIF
Listed and described
RF devices
Radio transmitters or receivers in the SCIF or within three meters of the perimeter wall, and their distance to the nearest RED equipment
Construction
Perimeter walls, true and false ceilings, floors, windows, and any existing countermeasures
These are reporting questions. They aren't separation distances or pass/fail criteria.
How the builder contributes: the integrator and electrical contractor supply accurate lists of every conductor and pipe that crosses the perimeter, every radio (wireless IDS, Wi-Fi, cellular alarm communicators, BAS radios), and the wall, ceiling and floor construction. The SSO or SSM completes and submits the form.
RED/BLACK separation has two parts. Physical separation reduces radiated and inductive coupling between equipment and cables. Electrical separation covers signal distribution, power, grounding and filtering. This section covers the physical concepts. The CTTA and engineer of record set the specifics.
Concepts every installer should apply:
Label everything. UFC 4-010-05 §3-4.19 calls for cabling, patch panels, outlets and connectors to be color-coded or clearly marked by classification. Cabling enters the protected area "from a single location."
Separate pathways. Use dedicated RED and BLACK raceways, trays and patch fields. Never share a bundle, tray or panel. Historical 2-95 described "dedicated RED/BLACK wireways" and incompatible patch connectors so RED can't be patched into BLACK.
Plan equipment placement. The CTTA may "zone" equipment, matching its emanation level to the distance to the inspectable-space boundary. Public detail is limited, so treat placement as a CTTA determination.
Keep crypto close. UFC 3-3.3.2 locates telecom spaces with encryption equipment "within or adjacent (shared wall) to the secure area to enhance security and minimize or eliminate Protected Distribution System (PDS) requirements."
Avoid PDS where possible. When unencrypted classified lines must cross lesser-classified space, CNSSI 7003 PDS applies. UFC 3-4.20: "Avoid the use of PDS whenever possible due to inspection requirements." See: DISA Traditional Security STIG & PDS.
Don't improvise routes. If the planned path is blocked, stop and ask. A reroute can put a BLACK cable next to RED equipment.
Power. Every power conductor that leaves the SCIF is a possible conducted path out. The TEMPEST Checklist asks about power lines exiting the SCIF. Power filters and isolation are CTTA countermeasures; the public Tech Spec doesn't specify them. Utilities should enter at a single point (Tech Spec 3.G.4). Feeding the SCIF from a dedicated panel at the entry point is common practitioner practice, not a published Tech Spec requirement.
Grounding. Grounding is where good intentions cause the most harm.
NACSIM 5000 warns that "appreciable impedances can and do exist between various points of the return paths." Shared grounds can carry RED return currents onto BLACK systems.
Historical 2-95 discussed equipotential-plane and single-point grounding approaches and warned that "a long slender ground wire is not an effective RF ground."
RED/BLACK grounding schemes are designed by the engineer of record and the CTTA, not in the field. The NEC safety ground is never optional. Never add an isolated "clean" earth rod on your own.
Fiber preference.
Why fiber helps
What still matters
Glass is non-conductive. Historical 2-95 noted that optical fibers "do not conduct or radiate radio frequency interference"
Metal in the cable: 2-95 warned a strength member "can be made of steel or other metal" and called for "no metallic stiffeners or metallic sheath" for BLACK fiber in RED distribution
No conductive path across the perimeter
Specify all-dielectric cable: no armor, metallic strength member or tracer wire
Avoids high-speed copper filtering problems
Media converters need power, and that power must come from filtered or approved circuits
In Compliance Magazine (2022) recommends bringing data through the shield on fiber via a waveguide instead of filtering copper data lines. See: RF Shielding, Penetrations & Installer Methods.
How it works. A power filter is a passive low-pass filter. Genisco explains that it lets "lower frequency signals… pass" and presents "high impedance to high frequency signals," using "only passive elements (inductors, capacitors and in some cases resistors)." AC power is 50, 60 or 400 Hz, so power filters are low-pass by design. Their purpose is "to keep conducted high frequency noise from entering or exiting the shielded room via the power or communication lines."
How it's rated: insertion loss. Tech-Etch defines insertion loss as "The ratio between the power received at a specified load before and after the insertion of a filter," expressed in dB. Every 10 dB is a factor of ten in power, so 100 dB is a 10^10 power ratio.
Published "100 dB class" examples. These are vendor data, not requirements.
Product
Published attenuation
Other published facts
Premier SCIF composite filters (16–250 A)
"100dB (14KHZ-40GHZ)"
"UL1283 Listed"; threaded-pipe output option
ETS-Lindgren LPRX/LFPRX panels
"100 dB, 14 kHz to 40 GHz"
Two compartments; cites MIL-STD-220, UL-1283
Captor TEMPEST filters
"100 dB @ 14 kHz to 10 GHz (as per MIL-STD-220)"
"Leakage current: 5mA maximum @ 120 VAC, 60 Hz"
Genisco filter panels
"100 dB shielding effectiveness (minimum 14 kHz to 18 GHz)"
"RF tight inner area, secured with a RF gasket"
The attenuation level and frequency range for a project come from the CTTA, the shield designer and the specification, not from a catalog.
This is the most common question from electricians, and it deserves a direct answer before the nuance: the filter goes at the penetration, and either face is allowed. MIL-HDBK-1195 §2.8 puts filters "at the conductor penetration locations, either inside or out, depending usually on available access or space," and states no preference between the two faces for a filter mounted there.
What is not a free choice is where the conductors go. The shorthand electricians use is dirty outside, clean inside, and it is a rule about conductors, not about which way the housing faces. Getting that distinction wrong is what makes people reject correct installations, so the rest of this section is about the distinction — and about the one case, remote mounting, where the face genuinely does come with conditions.
UNPROTECTED SIDE PROTECTED ROOM
|| SHIELD PLANE ||
panel -> feeder -> [ LINE / DIRTY compartment || filter || LOAD / CLEAN compartment ] -> branch circuits
|| ||
the shield plane runs THROUGH the filter case at its internal RF barrier plate;
the case is bonded metal-to-metal, paint-free, so it closes the hole it occupies
Side
Also called
Carries
Where its conductors go
LINE (input)
Dirty side, unfiltered
Building power, including any RF noise it carries
Terminate on the unprotected side. They never cross the boundary
LOAD (output)
Clean side, filtered
Filtered power for equipment in the room
The only conductors that continue into the room
Read this as a rule about conductors, not about boxes. "Dirty outside, clean inside" describes which conductors may cross, not which way the housing projects. The case has to be bonded into the shield plane so it closes its own hole. Whether the body then sits proud of the outer face, flush in the wall, or proud of the inner face is a mounting decision: MIL-HDBK-1195 §2.8 (1988, historical, and scoped to RF shielded enclosures) puts filters at the penetration "either inside or out, depending usually on available access or space," and adds no TEMPEST qualifier to that sentence. Read §2.8 in order and the TEMPEST language that follows belongs to a different case — see Remote mounting below. Build the face the drawings show.
What the manufacturers say:
ETS-Lindgren's manual calls the compartments the "dirty side" and "clean side," with outputs "EMI isolated from the inputs." "The output conductors are brought into the clean side wiring compartment of the filter through a conduit penetration."
Astrodyne TDI: install "at power entry locations where electrical services pass through the RF shield."
Premier: mount "as close as possible to the entry point of the input power wires" and "Maintain physical isolation and separation between filter input and output wires."
Why reversing it fails. If the load side faces outward, the unfiltered conductors run inside the protected room. RF on those conductors radiates inside the shield, and RED signals can couple onto them. The filter is still in the circuit, but the conductors that matter have bypassed it.
Why sharing a box fails. If dirty and clean conductors share a junction box, gutter or raceway, RF jumps from input to output wiring and bypasses the filter completely.
Remote mounting: the case where the face does carry conditions. Everything above assumes the filter sits at the penetration. Read MIL-HDBK-1195 §2.8 in sentence order and the sentences after "either inside or out" open a separate subject — a filter "mounted remotely from the shielding surface." Four requirements attach to that case and to no other:
Requirement
§2.8
Continuous metal conduit from filter to penetration
"threaded ferrous with welded joints, preferred"
For TEMPEST, run that conduit inside
"For TEMPEST installation requirements, the conduit runs are best located inside of the shielded enclosure" — the subject is the conduit runs in a remote installation, not the mounting face of a filter at the penetration
A remote filter outside needs a controlled area
"If the filter must be mounted outside of the TEMPEST enclosure in a remote location, then the conduit run from the filter to the shielding must be within a controlled access area"
That conduit is isolated from building steel
"Any required suspension hangers or conduit clamps must provide electrical isolation of the conduit from the building structure ground," with the isolation section "on the input or source side of the filter"
So a remotely mounted filter is not automatically an error — the handbook allows it — but the conduit between it and the shield becomes part of the boundary, and it carries conditions a filter at the penetration does not.
A filter works by shunting RF through its capacitors to its case. That shunted current needs somewhere to go, and how well it gets there is the whole ballgame. MIL-HDBK-232A §4.5 (1987, historical) states the requirement: "Because a filter operates by shunting the interfering or compromising energy to a return path and reflecting it back to the source, the path provided to the return must (a) be able to carry the amount of current which may be delivered, and (b) present minimal impedance to ground to the shunted current at all frequencies of interest. When a filter is used at the point where a conductor passes through a shield, the desired effect is accomplished by directly bonding the filter return (usually its chassis) to the shield." If the case isn't bonded, the rated dB is never achieved.
Bonding the case.
Premier: "Ensure filter housing is bonded… via metal-metal connection," with mating surfaces "void of paint or other insulating material."
Holland Shielding: filters "should be grounded to the Faraday cage so that there is a connection with a low impedance to the body of the shield."
Use short, flat braid rather than long round wire (Premier). Historical 2-95 put it bluntly: "a long slender ground wire is not an effective RF ground."
The penetration itself.
ETS-Lindgren: "All filter penetrations include attached conductive elastomeric gaskets."
Genisco uses "a gasketed pipe to penetrate into a shielded environment." Premier and Genisco both offer threaded-pipe outputs.
ETS-Lindgren's "/PEN" option provides the penetration conduit as part of the filter assembly.
Filter boxes and panels. Multi-filter panels group several circuits behind one bonded enclosure. Genisco describes an "RF tight inner area, secured with a RF gasket." Panels simplify single-point entry, inspection and testing.
Conduit rules.
Item
Rule
Feeder conduit (line side)
Terminates at the dirty compartment. It never continues through the shield on its own.
Clean-side conduit
Leaves through the penetration detail the project specification calls for. MIL-HDBK-1195 §2.8: "The preferred method of penetration of the filter connection in the shielding surface is by means of continuously welded metal piping," and RF gasket materials for that penetration "should be specifically forbidden in the specifications." UFGS 13 49 20.00 10 §2.7.1.2 likewise calls for "weldable threaded conduit hubs" that are EM welded "circumferentially in place." Gasketed and threaded outputs are common on commercial rooms
Spare or future conduit
Not open. Tech Spec 3.G.6's "acoustic fill and capped" is acoustic only. On an RF shield, spares need an RF closure and must be tested (confirm with the shield vendor).
Feeder conduit isolation
MIL-HDBK-1195 §2.8: "Any required suspension hangers or conduit clamps must provide electrical isolation of the conduit from the building structure ground," and "The required electrical isolation section on the conduit connection to the filter must be on the input or source side of the filter." Bonding that conduit to building steel does the opposite of what the handbook asks
Hangers and strut
Must not touch or pierce the shield except at designed bond points
Most ICD 705 SCIFs are not RF-shielded rooms. If the CTTA directs power-line filtering at an ordinary drywall or CMU perimeter, there is no shield plane for the case to bond into. So what does it bond to?
Start from the requirement, not the hardware. MIL-HDBK-232A §4.5 asks for a return path that can carry the current and "present minimal impedance to ground to the shunted current at all frequencies of interest." Bonding to a shield is how that requirement gets met when the conductor passes through a shield. The shield is the best available instance of a low-impedance return. It is not the requirement itself.
What public federal doctrine says. The one categorical statement is MIL-STD-188-124B §5.1.2.2.4: "All power line filter cases shall be directly bonded in accordance with 5.2 to the equipment case or enclosure." §5.3.2.3 adds that "Power line filters shall be completely shielded with the filter case grounded in accordance with 5.2.10." That standard treats the facility ground system as four electrically interconnected subsystems — earth electrode, fault protection, lightning protection and signal reference (§4.2.1) — so "earth electrode or signal reference or equipment ground" is a false choice. It is one bonded system.
Step
What the case bonds to
1
The filter case bonds to the equipment case or enclosure it is mounted in (188-124B §5.1.2.2.4)
2
That enclosure bonds to its rack or frame, or to the nearest point of the equipotential plane (§5.1.2.1.1.2, §5.2.10.2)
3
Which is part of the facility ground system, all four subsystems interconnected (§4.2.1)
Always
Plus the equipment grounding conductor the NEC requires of any metal enclosure around conductors. A safety bond is not an RF bond, and neither substitutes for the other
What the vendors say. Premier: "Ensure filter housing is bonded to host cabinet via metal-metal connection." And for the case that most resembles a non-shielded room: "For non-metal housings and/or cabinets, the filter is primarily grounded via the incoming safety wire. Make sure this wire is as short as possible upon entry into the host equipment." Short and flat is the whole mitigation.
Power isn't the only conductor that crosses a boundary. Every telephone pair, fire alarm loop, door contact, reader cable and data line is a path too.
What signal filters do. A signal filter is also low-pass, but it's tuned to pass the wanted signal and block RF above it.
Vendor example
Published data (not requirements)
Captor signal-line filters
"Insertion Loss 3 to 100 dB @ 10 kHz to 1 GHz"; "Pass Band < 1 dB @ 0 to 1 MHz"; for "telephone, fire alarm, communications, control and data"
Genisco communication filters
Data "(1200-128,000 BAUD)"; GF58270-21 "is commonly installed in most commercial fire alarm systems"
ETS-Lindgren 10G Ethernet Filter
"over 100 dB rejection from 50 Hz to 40 GHz" for 10 Mbps–10 Gbps
The limitation. A low-pass filter must pass the signal it carries. That works for POTS telephone, fire alarm loops, relays, dry contacts and low-speed serial. It's difficult for high-speed Ethernet, whose signal energy extends far into the frequencies a filter needs to block. The usual answer is all-dielectric fiber through a waveguide with media converters on each side. Purpose-built data filters exist, but whether a filtered copper data path is acceptable is a CTTA call.
Integrator impact. Inside a shielded room, every low-voltage device needs a treated path out:
Device
Typical treatment (per design and CTTA)
Card readers, keypads, REX, door contacts, electrified locks
Signal-line filters at the penetration panel, or fiber
IDS sensors to the PCU
Filtered conductors or fiber. The PCU location follows IDS rules.
IP cameras, network devices
Fiber and converters on filtered power. No PoE copper through the shield.
Fire alarm and notification
Listed filters, coordinated with the AHJ and the "no audio back feed" requirement
A huge, fast incoming pulse from a high-altitude nuclear burst
Speed
Continuous, low-level emanations
E1 rises "in some five nanoseconds" (Wikipedia)
Governing standard
CTTA recommendations under CNSS guidance
MIL-STD-188-125-1 (17 Jul 1998, fixed ground-based facilities) and -2 (3 Mar 1999, transportable systems)
Extra hardware
Low-pass filter elements
Filter plus transient suppression (e.g., MOVs) at the point of entry
MIL-STD-188-125 addresses HEMP protection for ground-based facilities performing critical, time-urgent missions. It combines a shield with point-of-entry protection on every penetrating conductor. A HEMP-hardened shield can support TEMPEST goals, but SCIF accreditation doesn't require HEMP protection.
Vendor examples (not requirements):
ETS-Lindgren EMP/TEMPEST filters are "designed to meet point-of-entry requirements of MIL-STD-188-125-1 & -2 for Short and Intermediate Pulses," with transient suppression.
ETS-Lindgren's manual says the MOV "should be replaced annually, when it is estimated that a high incidence of over voltages have occurred."
Premier HEMP filters span "16A to 4000A."
Practical guidance:
Confirm whether the project has a HEMP requirement (program, sponsor or mission), a TEMPEST recommendation, both, or neither.
Don't substitute a HEMP filter for a TEMPEST filter, or the reverse, without agreement from the engineer of record and the CTTA. Leakage, kVAR, size and maintenance differ.
HEMP filters with MOVs add a maintenance item. Put MOV inspection and replacement in the O&M manual.
HEMP verification uses pulse-injection testing under MIL-STD-188-125. The vendors do not publish specific test values, so get them from the project specification.
MIL-STD-220 is the "Test Method Standard Method of Insertion Loss Measurement" (Genisco). Captor, ETS-Lindgren, Astrodyne and the historical NSA 94-106 (which cited MIL-STD-220A) all reference it. When a datasheet says "100 dB per MIL-STD-220," this is the bench test behind the number.
What the bench number means, and what it doesn't.
Premier: datasheets show insertion loss "relative to 50 ohm source and load impedances," in common and differential mode.
Premier continues: "As actual system impedances may differ, testing is critical."
Installed source and load impedances differ from the 50-ohm bench setup. Installed performance also depends on case bonding, input/output wiring separation and gaskets.
That's why the finished room is tested for shielding effectiveness after installation (IEEE 299 or the method the specification names). A filter's bench rating doesn't replace that test. See: RF Shielding, Penetrations & Installer Methods.
Submittal review checklist for filters:
Datasheet item
Why it matters
Insertion loss vs frequency, and the test standard
Must cover the range the TCR or specification requires
Leakage is built into the design. A filter's line-to-case capacitors pass a small continuous 60 Hz current to ground. It isn't a defect. Captor publishes "5mA maximum @ 120 VAC" for one TEMPEST filter. Premier notes that leakage limits "are usually dictated by the end use environment." Leakage adds up across every filter and every phase on a feeder.
The ground must never be lost. ETS-Lindgren: "provide uninterruptible safety earth ground from the main power source to the product input wiring terminals." A filter that loses its equipment grounding conductor can put hazardous voltage on its case, and the case is bonded to a shield people touch.
The GFCI conflict.
Fact
Source
Personnel-protection GFCIs trip at about 5 mA
Wikipedia, residual-current device
One TEMPEST filter can leak up to about 5 mA
Captor datasheet
Leakage from multiple filters and phases adds
Engineering principle
A GFCI upstream of a TEMPEST filter is likely to nuisance-trip. One approach engineers evaluate is placing code-required GFCI protection on load-side branch circuits inside the room and coordinating equipment ground-fault protection with total filter leakage. The electrical engineer of record and the AHJ make that call.
Grounding rules of thumb for electricians:
Keep the equipment grounding conductor continuous from the source to the filter input terminals.
Don't create a separate, unbonded "clean" or "TEMPEST" earth electrode. It's a safety and code problem. The EE and AHJ confirm the electrode system.
A de-energized filter can still bite. Large filter capacitors hold charge after the breaker opens. Manufacturers add bleeder (discharge) resistors to drain it, but the drain takes time, and a failed resistor doesn't announce itself.
Manufacturer warnings (examples; read the label on your unit):
Source
Published statement
ETS-Lindgren manual
"AUTOMATIC BLEEDER RESISTORS DISCHARGE THE CAPACITORS TO 50 V FIVE (5) SECONDS AFTER POWER IS REMOVED."
ETS-Lindgren manual
"USE A SHORTING STICK… PRIOR TO TOUCHING THE FILTER."
ETS-Lindgren manual
"Capacitors… may still be CHARGED even when instrument is disconnected."
Captor shielded-room filters
"Discharge to less than 30 Volts within the 30s after power removal"
The problem. A 100 dB power filter usually contains a lot of capacitance. Capacitance draws reactive power (kVAR) even when the room's equipment is idle. Utility power absorbs this easily. A standby generator often can't.
Premier documents three generator failure modes for high-capacitance filters. They can:
"Overload generator capacity"
"Cause voltage instability"
"Prevent generator startup altogether"
Why it hits SCIFs. Some SCIF projects require standby power. UFC 4-010-05 §2-10.2.1 says that when a standby power system is required, "provide a standby engine-driven generator sized for essential and uninterruptible loads," with UPS "for the uninterruptible loads to filter commercial power" (2-10.2.2). A filtered shielded room on a generator or UPS is therefore a common combination, and a common commissioning surprise.
Mitigations:
Option
Notes
Low-kVAR filter designs
Premier offers low-kVAR SCIF filters. ETS-Lindgren's LKV-4500 is a "low KVAR design" with "100 dB insertion loss from 14 kHz to 40 GHz" (vendor claim).
Early load analysis
The EE includes total filter kVAR in generator and UPS sizing
Transfer and startup testing
Test generator start and transfer with filters connected, during commissioning
Staged loading
Per generator manufacturer and EE design (project-specific)
Who needs to know:
Electrical engineer of record: filter kVAR, leakage, voltage drop and generator/UPS compatibility.
Generator and UPS vendors: leading power factor at light load.
Filter vendor: capacitance per line and low-kVAR alternatives.
Commissioning agent: a transfer test with filters energized.
What happened. On 27 Sep 2017, UpGuard researcher Chris Vickery found a misconfigured, publicly accessible Amazon S3 bucket named "inscom." It held U.S. Army INSCOM data, including files marked Top Secret/NOFORN and virtual hard drives tied to the DCGS-A platform. A defunct contractor was associated with it. UpGuard published on 28 Nov 2017, after the bucket was secured. The cause was misconfiguration, not an attack.
Why it belongs in a TEMPEST module. No filter, shield or RED/BLACK separation protects information that has already been copied onto a contractor's file share. Data about secure systems is often more useful to an adversary than a single emanation:
Project document
Why it's sensitive
CTTA recommendations (TCR) and TEMPEST Checklist
Describe a real facility's TEMPEST posture
Penetration schedules and filter panel drawings
Map every conductive path across the boundary
Shield test reports
Show where performance was weakest
IDS/ACS configurations and zone lists
Show how detection works
Rules for the build team:
UFC 4-010-05 §1-16.3 treats TEMPEST vulnerabilities associated with a physical location as classified at a minimum of CONFIDENTIAL. Handle project documents as the AO directs.
Keep drawings, schedules and test reports off public cloud shares, personal email and open bid portals.
Share on a need-to-know basis with subcontractors, and collect copies at closeout.
Never use a real project's TEMPEST details in marketing, training slides or case studies.
