18 March 1998

    To: cypherpunks@toad.com
    Subject: Re: EMI, Van Eck, etc.
    Date: Wed, 18 Mar 1998 13:09:10 +0000
    From: Markus Kuhn <Markus.Kuhn@cl.cam.ac.uk>

    The Spectre wrote on 1998-03-18 05:11 UTC:
    > In almost every writing I've come across regarding Van Eck, I notice the
    > phrase "...simply a modified television" or something along those lines.
    >
    > Does anyone have a document for actually modifying a television set to do
    > this sort of thing?  It doesn't have to be extremely long ranged, and could
    > in fact be very short range.. I am interested in performing my own
    > experiments into defeating this sort of eavesdropping.

    Ingredients for a minimum cost quick & dirty TEMPEST experiment:

    1 RF tuner of a VCR
    1 antenna amplifier
    1 antenna
    1 multisync PC monitor
    1 PC with a video card (or a pair of tuneable sync oscillators)

    Connect the PC with the video card to the SYNC inputs of the multisync
    monitor. Program the video card to a video mode with the same deflection
    frequencies as that used by the target system. Connect the baseband output
    of your tuner to the VIDEO-IN pins of your monitor. Connect the antenna
    and amplifier to the RF input of your tuner. Switch on. Fill the
    screen of the target device with a big symbol consisting of dithered and
    non-dithered areas for best results in the first trials. Now tune
    through the VHF bands starting with the dot clock frequency of the
    target.

    That's it basically. Such a primitive TEMPEST monitor is of course
    unsuitable for evaluating the threat from much more sophisticated wide-band
    DSP eavesdropping receivers that directly attempt OCR-style algorithms
    on the signal with matched filters. But it is fun to play around with, it
    is useful for getting a feeling for the effect, and it is suitable for
    demonstrating most of the Soft Tempest tricks that I described in
    <http://www.cl.cam.ac.uk/~mgk25/ih98-tempest.pdf>.

    > Also, would it be possible to scramble the signal into an unusable level by
    > simply putting another device emanating RF at the snooping frequencies
    > nearby the machine that you want to protect?  Something generating white
    > noise at that frequency, but with a purposely built antenna, say a high
    > gain type turned outward from the monitor, with a significantly higher
    > power output than the monitor?

    The FCC and your radiologist advise against this. Shielding is much
    more elegant than jamming. Remember that CRT content is a periodic
    signal, thus you can suppress uncorrelated noise by periodic averaging
    rather easily. Good jamming must produce a correlated output signal.
    See United States Patents 5165098 and 5297201 for descriptions of
    correlated jammers. I don't think, these are widely used though, as the
    TEMPEST standards seem to mandate shielding and not jamming, which I
    think is very sensible.

    Markus

    --
    Markus G. Kuhn, Security Group, Computer Lab, Cambridge University, UK
    email: mkuhn at acm.org,  home page: <http://www.cl.cam.ac.uk/~mgk25/>

    JYA Note: TEMPEST information: http://www.eskimo.com/~joelm/tempest.html