Tempest (codename) - Tempest Measurement Standards

Tempest Measurement Standards

The US and NATO Tempest standards define three levels of protection requirements:

• NATO SDIP-27 Level A (formerly AMSG 720B) and USA NSTISSAM Level I

"Compromising Emanations Laboratory Test Standard"

This is the strictest standard for devices that will be operated in NATO Zone 0 environments, where it is assumed that an attacker has almost immediate access (e.g. neighbouring room, 1 m distance).

• NATO SDIP-27 Level B (formerly AMSG 788A) and USA NSTISSAM Level II

"Laboratory Test Standard for Protected Facility Equipment"

This is a slightly relaxed standard for devices that are operated in NATO Zone 1 environments, where it is assumed that an attacker cannot get closer than about 20 m (or where building materials ensure an attenuation equivalent to the free-space attenuation of this distance).

• NATO SDIP-27 Level C (formerly AMSG 784) and USA NSTISSAM Level III

"Laboratory Test Standard for Tactical Mobile Equipment/Systems"

An even more relaxed standard for devices operated in NATO Zone 2 environments, where attackers have to deal with about 100 m worth of free-space attenuation (or equivalent attenuation through building materials).

Additional standards include:

• NATO SDIP-29 (formerly AMSG 719G)

"Installation of Electrical Equipment for the Processing of Classified Information"

This standard defines installation requirements, for example in respect to grounding and cable distances.

• AMSG 799B

"NATO Zoning Procedures"

Defines an attenuation measurement procedure, according to which individual rooms within a security perimeter can be classified into Zone 0, Zone 1, Zone 2, or Zone 3, which then determines what shielding test standard is required for equipment that processes secret data in these rooms.

All these documents remain classified and no published information is available about the actual emission limits and detailed measurement procedures that they define. However, some very basic Tempest information has not been classified information in the United States since 1995. Short excerpts from the main U.S. TEMPEST test standard, NSTISSAM TEMPEST/1-92, are now publicly available, but all the actual emanation limits and test procedures have been redacted from the published version. A redacted version of the introductory Tempest handbook NACSIM 5000 was publicly released in December 2000. Equally, the NATO standard SDIP-27 (before 2006 known as AMSG 720B, AMSG 788A, and AMSG 784) is still classified.

The United States Air Force has published a few mandatory standards regarding Emission Security:

• Instruction AFI 33-203 Vol 1, Emission Security (Soon to be AFSSI 7700)
• Instruction AFI 33-203 Vol 3, EMSEC Countermeasures Reviews (Soon to be AFSSI 7702)
• Instruction AFI 33-201 Vol 8, Protected Distributed Systems (Soon to be AFSSI 7703)