- cypherpunks-legacy - lists.cpunks.org

TEMPEST not restricted
by norm＠xanadu.com 17 Dec '92

17 Dec '92

While taxpayers paid for TEMPEST and NACSIM 5100A and it would undoubtedly be useful to taxpayers were it declassified, it is not true that compliance with NACSIM 5100A is necessary and sufficient to be secure from eavesdropping. Some of RSA's charm is that it was not promulgated by NSA!

1 0

No Subject
by dclunie＠pax.tpa.com.AU 17 Dec '92

17 Dec '92

> Here is parts of the article I posted regarding the legality of the use > of emf shielding. Read it carefully, and I suggest you also read the > posted document in full as well. This poses many problems to the public > in general, and the private sector in specific. > PERRY, I suggest you read this. > > NACSIM 5100A is classified, as are all details of TEMPEST. The information may be classified, as perhaps it should be. If I were an organization of any kind trying to protect my data I wouldn't run around publicizing the details of the technology required to protect it either. This does not mean though, that it is illegal to reinvent the wheel and apply it yourself. Besides, who is to say what is an "acceptable" level of EM radiation - the government has clearly chosen what it considers acceptable levels to facilitate equipment supply by contractors. If you want more or less protection then you and any other member of the public are free to define, manufacture or purchase whatever you want. And if you can't get it from a local source I am sure there are plenty of governments and manufacturers elsewhere in the world you can deal with, though of course exporting the technology may be another matter, but there is nothing new about that. There are plenty of other government conspiracies to focus on ! This one seems a bit lame. david

2 2

No Subject
by pmetzger＠shearson.com 17 Dec '92

17 Dec '92

Close, but no cigar, Mr. "Treason". Anyone reading your "proof" can see for themselves that there is no law making it illegal to shield your computers, only some regulations on people that sell equipment to the government can't tell other people what their specifications are. Big deal. The line in the article saying Without the right to possess TEMPEST ELINT equipment manufacturers who wish to sell to the public sector cannot determine what a safe level of emanations is. is mostly bull, in the sense that people can probably judge what is safe without knowing the government standards. In any case, you have demonstrated nothing making it illegal to shield your computers, and we've already seen a post containing a dozen purveyors of shielding equipment. Repeating, you don't know what you are talking about. Now go away. Perry Original message included for reference: > From cypherpunks-request(a)toad.com Thu Dec 17 14:13:11 1992 > Date: Thu, 17 Dec 92 12:38:34 -0500 > From: treason(a)gnu.ai.mit.edu > Content-Length: 3194 > > Here is parts of the article I posted regarding the legality of the use > of emf shielding. Read it carefully, and I suggest you also read the > posted document in full as well. This poses many problems to the public > in general, and the private sector in specific. > PERRY, I suggest you read this. > > NACSIM 5100A is classified, as are all details of TEMPEST. > To obtain access to it, contractor must prove that there is > demand within the government for the specific type of equipment > that intend to certify. Since the standard is classified, the > contractors can not sell the equipment to non-secure governmental > agencies or the public. This prevents reverse engineering of the > standard for its physical embodiment, the Certified equipment. > By preventing the private sector from owning this anti- > eavesdropping equipment, the NSA has effectively prevented the > them from protecting the information in their computers. > A number of companies produce devices to measure the > emanations from electrical equipment. Some of these devices > are specifically designed for bench marking TEMPEST > Certified equipment. This does not solve the problem. The > question arises: how much radiation at a particular > frequency is compromising? The current answer is to refer > to NACSIM 5100A. This document specifies the emanations > levels suitable for Certification. The document is only > available to United States contractors having sufficient > security clearance and an ongoing contract to produce > TEMPEST Certified computers for the government. Further, > the correct levels are specified by the NSA and there is no > assurance that, while these levels are sufficient to prevent > eavesdropping by unfriendly operatives, equipment certified > under NACSIM 5100A will have levels low enough to prevent > eavesdropping by the NSA itself. > The accessibility of supposedly correct emanations > levels does not solve the problem of preventing TEMPEST > eavesdropping. Access to NACSIM 5100A limits the > manufacturer to selling the equipment only to United States > governmental agencies with the need to process secret > information.[33] Without the right to possess TEMPEST ELINT > equipment manufacturers who wish to sell to the public > sector cannot determine what a safe level of emanations is. > Further those manufacturers with access to NACSIM 5100A > should want to verify that the levels set out in the > document are, in fact, low enough to prevent interception. > Without an actual eavesdropping device with which to test, > no manufacturer will be able to produce genuinely > uncompromising equipment. > > PERRY, now I put up, now YOU SHUT UP! > > sheesh. > > treason@gnu. >

1 0

SS&S response to TEMPEST inf0 request
by wendtj＠jplpost.Jpl.Nasa.Gov 17 Dec '92

17 Dec '92

About 30 minutes after I got off the phone requesting product information and related materials, I recieved a voice mail message from Ray Helsop of SS&S. When I returned his call, he informed me that the address that I gave looked like a residential address (Hmmm), and that they usually don't send information to private homes, apts, bird-baths, e.t.c. He then informed me that he had called my employer (the Junior Proletarian Laboratory), and varified my name in the directory, and the department that I worked in; and that since I work for a Federal Research Facility (DoD sinkhole) everything was `ok'. He then proceded to tell me about foreigners calling the company requesting TEMPEST information, and other "spooky" callers, and that it was now allright to send the product information to my home. After I told him my interests in the hardware, he ran down a list of avilable equipment, and asked about numbers, requirements, and said he'd send it right out to me. I hate to be presumptuous... but I think an "I'm trying to protect my personal computer from prying eyes" would fall on very deaf ears at SS&S, and I'll leave it at that. ;-) JPW

1 0

Re: New number for Secure Systems & Services
by Richard Childers 17 Dec '92

17 Dec '92

> and they give free samples ;-)) "Great. Now does anyone know of where to get equipment to test how effective it is? " I'd guess that virtually any hardware lab that has to test its equipment to make sure it meets FCC criteria for minimal emissions, would have a test lab onsite. Such a test lab normally consists of the following : - a very wide frequency range analyzer ( HP makes these ) - a set of antennas by which to sample the EMF field(s) - a platform adjacent to the antenna mount, upon which such equipment as is being tested, is rotated, to allow the antenna to sample the entire 360- -degree field at incremented altitudes and var- -iable angles in incidence. Those test labs I've been acquainted with are usually found at a distance from production facilities, usually small outbuildings in fields out back, insulated by distance from the EMF of the surrounding buildings. I can see how this paper might make it possible to move the lab back indoors ... To answer your question specifically, I'd check a HP electronic test products catalog, with an emphasis on signal/frequency/harmonic analyzers. -- richard ===== -- richard childers rchilder(a)us.oracle.com 1 415 506 2411 oracle data center -- unix systems & network administration "If Life is a drama, then, surely, the hardest parts go to the most skillful."

1 0

New number for Secure Systems & Services
by wendtj＠jplpost.Jpl.Nasa.Gov 17 Dec '92

17 Dec '92

The new number for SS&S is (214) 907-9288 Also, Lindgren RF Enclosures informed me that they now have exclusive license to market International Paper Company's SAF'N SHIELDED; and they give free samples ;-)) JPW

2 1

No Subject
by treason＠gnu.ai.mit.edu 17 Dec '92

17 Dec '92

Here is parts of the article I posted regarding the legality of the use of emf shielding. Read it carefully, and I suggest you also read the posted document in full as well. This poses many problems to the public in general, and the private sector in specific. PERRY, I suggest you read this. NACSIM 5100A is classified, as are all details of TEMPEST. To obtain access to it, contractor must prove that there is demand within the government for the specific type of equipment that intend to certify. Since the standard is classified, the contractors can not sell the equipment to non-secure governmental agencies or the public. This prevents reverse engineering of the standard for its physical embodiment, the Certified equipment. By preventing the private sector from owning this anti- eavesdropping equipment, the NSA has effectively prevented the them from protecting the information in their computers. A number of companies produce devices to measure the emanations from electrical equipment. Some of these devices are specifically designed for bench marking TEMPEST Certified equipment. This does not solve the problem. The question arises: how much radiation at a particular frequency is compromising? The current answer is to refer to NACSIM 5100A. This document specifies the emanations levels suitable for Certification. The document is only available to United States contractors having sufficient security clearance and an ongoing contract to produce TEMPEST Certified computers for the government. Further, the correct levels are specified by the NSA and there is no assurance that, while these levels are sufficient to prevent eavesdropping by unfriendly operatives, equipment certified under NACSIM 5100A will have levels low enough to prevent eavesdropping by the NSA itself. The accessibility of supposedly correct emanations levels does not solve the problem of preventing TEMPEST eavesdropping. Access to NACSIM 5100A limits the manufacturer to selling the equipment only to United States governmental agencies with the need to process secret information.[33] Without the right to possess TEMPEST ELINT equipment manufacturers who wish to sell to the public sector cannot determine what a safe level of emanations is. Further those manufacturers with access to NACSIM 5100A should want to verify that the levels set out in the document are, in fact, low enough to prevent interception. Without an actual eavesdropping device with which to test, no manufacturer will be able to produce genuinely uncompromising equipment. PERRY, now I put up, now YOU SHUT UP! sheesh. treason@gnu.

4 3

Re: tempest devices and use
by hkhenson＠cup.portal.com 17 Dec '92

17 Dec '92

Actually the posting is a takeoff on the crypto restrictions. Keith

1 0

Re: tempest devices and use
by hkhenson＠cup.portal.com 17 Dec '92

17 Dec '92

I just sent email the first time, but hey, guys, does this not look almost exactly like some of the restrictive proposals? Someone is pulling your chains. Just because they don't put a :-) on it does not keep a posting from being satirical. Keith

1 0

A stupid move
by Bill O'Hanlon 17 Dec '92

17 Dec '92

Edgar Swank helpfully pointed out that I messed up when I sent my remailer and personal keys out. I sent the wrong personal key. Here's both, once again. Here's mine: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQCNAiq/Z6sAAAEEAL8au0gDOEj8xQbaV8jS1BM+baetvF6RciEeyfb9A/1Csdpz 87PTEN19tIteDOX8bQIS9exwztaEG7Upa9WlPs9bNsn5TITJAtEOIalqRwlWd1Qh dsrX7jkytL89MFlVTdBWHhlVuKiGTa4yrFcycoiakXPmf51f0xiQVHeOVJ+HAAUT tCBCaWxsIE8nSGFubG9uIDx3bW9AcmVibWEubW4ub3JnPokAlQIFECsT6HDlC9IM 15aj/QEBiucD/iS5u+7ze0X0QVI3cVMrFDmkQpQDWb5mm7uPcaeYra3VGm7+Cfxn LkqwMkMwPytxxkNC9NvFCsrndrFFmuP8eLVBSQpZinfs/2d2A9AJsVsZAd4uDvP3 CKXpF415zgCWBHUt6JrT+pjk00sKUhQYSgUKj1z1uyYfw3q1AMWjrP5s =k9RJ -----END PGP PUBLIC KEY BLOCK----- Here's the remailer(a)rebma.mn.org, signed with mine. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQCNAisUI2QAAAEEAKgm07Hsje5KpmXYd5azk0R6AES+qK7LcofnVGojUs7GBghD WbwrmW8oOEOhRorlShRALKeYspV4xYIw4WDkJcJxuf1B254scz1urF/Eem3zPW9b yPAx7W/cGwvs6SouZvFcSDq4v1zApvGE9hP4szPzHeGmVr0NVNeaDK0guoCpAAUR tCBSZW1haWxlciAocmVtYWlsZXJAcmVibWEubW4ub3JnKYkAlQIFECsUJGEYkFR3 jlSfhwEB1zgD/1LG9DttNEVPFddxkULPw+AkkbmSolrqJUmVx/3y3QS1AtW+vVqF 0yhgWgvg770b7+xMnwzO/I1nh0FK2shd1Jkx4FVCA5ctyqUzVFjk1NE6VaaRc5Bv BD1nUxtUheR0WXDc50f+ANHgRNkx22MGRvphseMyXq/Ok88opSn7DIrO =nBQt -----END PGP PUBLIC KEY BLOCK----- -- Bill O'Hanlon wmo(a)rebma.mn.org

1 0