TEMPEST, Van Eyck Radiation, and Eavesdropping

TEMPESTpunks, 

The theme of TEMPEST/RF/eavesdroping/Faraday cages/Van Eyck
Radiation/etc. comes up on this list every month or so, nearly as
often as the threads about generating random numbers in hardware.

(If you don't know about eavesdropping on computer sessions by
monitoring and decoding RF emissions by the computers, keep reading
this list and the topic will pop up, as it just has!)

Anyway, I found this item interesting. I'm not yet sure we need to
become "Faraday-Cage-punks quite yet, but the articles and laws
mentioned in this report might be useful for someone.


From: mitchell@ncsa.uiuc.edu (myself)
Newsgroups: talk.politics.crypto
Subject: Re: illegal taps
Date: 8 Nov 1993 22:39:54 GMT
Distribution: world
Reply-To: mitchell@ncsa.uiuc.edu (myself)


In article <2bjdvm$6gh@vixen.cso.uiuc.edu>, trh42502@uxa.cso.uiuc.edu
(Dream Weaver) writes:
|> I suggest that this be the last post here, as the topic is going well
|> out of the groups charter. Please redirect, somewhere else.

|> 
|> This officer was in the same way. He freely admited that he was monitoring
|> cellular freqs. My reading of the posting as that he had no idea that
this was 
|> illegal. BAD training, and/or lack of understanding of technology
based laws!
|> It needs to be emphasized to police that just because something is 
|> transmitted in the air does not mean they can listen to it! Ordinary
|> telephone lines transmit, microwave repeaters for long distance & etc.
|> Does anyone know if Tempest or any other non-visual surveillance is
|> legal without a warrant?
|> 

There is a file available from NIST discussing TEMPEST tech, and its
legal status.  It is quite an interesting read.

Anonymous ftp to csrc.ncsl.nist.gov
file /pub/secpubs/tempest.txt

It summarizes the legal status of TEMPEST as follows:

The use of TEMPEST is not illegal  under  the  laws  of  the
United  States3,  or  England.    Canada has  specific  laws
criminalizing TEMPEST eavesdropping but the  laws do more to
hinder surveillance countermeasures than  to prevent TEMPEST
surveillance.  In  the United  States it is  illegal for  an
individual  to  take   effective  counter-measures   against
TEMPEST surveillance.   This leads to the  conundrum that it
is legal  for individuals and  the government to  invade the
privacy of others but illegal for individuals to  take steps
to protect their privacy.

<quote.off> The reason for the preventive equipment being illegal
is that it is classified. (Shocker!)  The eavesdropping is legal
due to the fact that the radiation emitted in not considered to
be a 'communication', and hence is not covered by ECPA, etc.

I am leaving this followup in talk.politics.crypto due to the fact
the as crypto gets better, the best way to 'crack' it will be
through techniques such as TEMPEST.  Even a one-time pad doesn't
help if your opponent can read monitor from a half-mile away!

Anyway, I highly recommend that everyone interested in this thread
get a copy of the file.  Curious that it should show up on an NIST
server.  Looks more like something EFF would be distributing.

-David Mitchell

|> Tom
|> 
|>
______________________________________________________________________________
|> Tom Hilquist                                     
Internet:t-hilquist@uiuc.edu
|> Disclamer: I didn't write this!                   Email for PGP Public Key
|> PGP 2.3a Key fingerprint = 20 FF CA 46 1D B8 CD 55  F7 9D 71 B0 BD B7 B3 B5

>surveillance.  In  the United  States it is  illegal for  an
>individual  to  take   effective  counter-measures   against
>TEMPEST surveillance.   This leads to the  conundrum that it

I really DO wish this particular bit of misinformation would go away!
It is most definitely NOT illegal to shield one's computers against
TEMPEST surveillance. In fact, the FCC requires that manufacturers
limit the same spurious radiations that TEMPEST exploits to minimize
interference to nearby radio and TV receivers. The details appear in
Part 15 of the FCC rules.  They are more stringent ("Class B") for
devices intended for home use, since receivers are much more likely to
be nearby than for devices intended solely for office use ("Class A").

The Part 15 interference rules for computers came into being in the
mid 1980s, so anything you may read about the ease of intercepting
computer emissions that was written before that time is somewhat
suspect.  Thanks to the rules, modern computers are FAR quieter than
those sold in the 1970s and early 1980s, though they're still not
completely silent.

Phil