[Cryptography] Regulations of Tempest protections of buildings

[Jon Callas]

> On Apr 2, 2017, at 8:48 AM, mok-kong shen <mok-kong.shen at t-online.de> wrote:
> 
> 
> I wrote previously in a  follow-up to a thread that I vaguely remember to have read
> that in US a permission is needed for Farady shielding of rooms, whereupon a few
> readers doubted its correctness. I have just succeeded to again find the source:
> 
> A. Stanoyevitch, Discrete Structures with Contemporary Applications. CRC Press,
> 2011. On p.301 there is:
> 
>     Buildings can be fitted using a special insulation procedure that protects
>     against tempest devices, but any company or individual in the US who has
>     this insulation must first obtain a license from the federal Government.

I'll share the skepticism, but also provide a possible explanation.

Many years ago, I worked with a group that produced TEMPEST gear. That gear was not sold to the general civilian population. There's nothing that would stop someone from making shielded equipment, there's nothing that would stop someone from putting it through the same testings that TEMPEST gear went through. But your gear wouldn't be TEMPEST, because it hadn't gone through TEMPEST testing and approvals.

Similarly, there's nothing that stops you from making a shielded room; it's not illegal. There's nothing that stops you from making a shielded room that meets or exceeds TEMPEST standards. However, I would not be surprised if you couldn't get a TEMPEST approval for that room without some license or something from the government. 

There's a danger in conflating the testing and approvals process from the raw technology itself. I share the other skepticism that there is any authority by which the USG can control shielding technology, but can completely believe (though I don't know one way or the other) that you can't have your shielded thingie called TEMPEST without some restricted testing process that you don't have access to without a contract, license, or whatever. 

That's the subtle difference, and thus it can both be true that you need a license for TEMPEST and there's no restriction on making shielded whatevers.

	Jon