So I have a TEMPEST PC (Patreon)

Some of you will get what that means, but for the uninitiated: TEMPEST was a big cause celebre in government infosec starting (?) in the 80s, but it's a very intriguing sounding name for a very simple concept. Basically, all electronic devices radiate energy when in operation, and in theory it may be possible to pick up that energy passively and find out what a computer is being used for. The Reagan-era US government became concerned that Soviet spies with dish antennas would rent apartments across from their field offices and read our nuclear secrets out of the air as they were typed into, and radiated out of, consumer-grade keyboards and monitors.

The validity of the problem is indisputable; proofs of the concept abound, you can download example apps from github that will transmit AM radio signals off your computer monitor or, in fact, display a blurry image of what's on the monitor. The degree to which this is a realistic, provable, or exploited concern however is unclear.

The whole topic was classified until sometime in the 2000s I think (and the DoD etc. continue to take it seriously to this day) but there's also just no real reason to tell anyone "hey, the russians might have skyhooked The Codes out from under our noses" even if that happened. Also, the signals in question are incredibly faint at the best of times, and while there are papers and studies proving that they can be received at some distance, the results seem pretty crappy, and I'm just not sure if it's worthwhile for foreign adversaries who have had proven success decade after decade with just bribing janitors.

Anyway.

The important (?) thing is that I have a TEMPEST / EMR (electro magnetic radiation) hardened PC that IBM made for the government. There were a bunch of models - variations on everything from the original PC forward for at least a decade - but mine is the 4459 TPC 4, the hardened version of the IBM PC AT, aka 5170.

It's not mine, mind you - it's on loan from the computer store, and by the way, if you'd like to buy a mint-condition TEMPEST-rated PC (at market price, to be clear) hit the DMs and I'll get you in touch, because I'd love to see this thing go to someone who actually appreciates it. Which, of course, is not me.

It is, in no uncertain terms, a heavy, bulky, and inconvenient IBM 5170 Personal Computer AT. No, like, literally - that is a bog standard type III 5170 motherboard, utterly unmodified from the consumer variant, and the same goes for the power supply and disk drive. And that, I think, is the point.

The various agencies would have performed certification tests on the consumer version of the AT, which is what would have sat on the desks of 99% of their workers who didn't deal with Top Secret stuff. When it came to the people who did handle sensitive info, they would have wanted to buy exactly one (1) machine for just the person who needed maximum security, but then expect it to work exactly like all the others. Having to recertify the entire machine functionally would suck, so it's probably not a bug, but rather a feature that this machine is incredibly boring.

The 4459's only distinctions are the chassis, the backplane, and the keyswitch.

The case: The standard AT case is two 90-degree-offset U shapes that intersect to form a rough box. The steel is not very thick, and there are plenty of gaps at all the seam points, around vents, the card backplane openings, and so on.

Here, the entire lower chassis is made of heavier sheet that's been bent up, and all it's seams welded closed, forming a "bucket" which the computer's components sit inside of, that's only open on the top.

The top is then sealed by a 1/8" thick die-cast aluminum cover which attaches with 10 bolts. This firmly meshes the lip protruding from the top of the "bucket" into the groove in the lid, creating a labyrinth seal through which energy can't escape without being absorbed into the grounded metal. We'll explore how effective that is later. Otherwise, however, the case is largely like that of a typical AT, from the motherboard mounts to the drive cages.

The backplane: Normal PC cards are pretty decently shielded. The backplane bracket is steel, bolted to steel, and the connectors have steel shields; all of it's grounded, and signal leakage is pretty minimal, but there are still gaps through which emanations can sneak out. To solve for this, the 4459 replaces the standard backplane with one that has more robust D-sub connectors bolted straight to the case, so there's no gaps; unpopulated cutouts are capped with heavy die-cast aluminum covers.

This should do the job - but it's still not good enough. Even though the shield of a D-sub plug grounds it, that might not make it to the shell of the plug, and there might still be gaps. So, TEMPEST cabling goes a bit harder.

I do not have the 4453 TPC Color Monitor, but here's a pic from eBay showing the mesh that squashes against the matching mesh on the 4459's backplane to absolutely ensure zero leakage. They were not fucking around. Did they actually need to fuck around this little? Unclear, but this is how they did it.

This is also probably why - as you may have noticed - there is no DIN plug on the back for the keyboard; it's much harder to do this mesh thing with DIN, and it also isn't possible to screw the connector in. For (I'm guessing) one or both of those reasons, the keyboard connector is a DE9, which mated with a special shielded keyboard (unobtanium at this point ofc.) That said, there are two circular cutouts on the TPC's back panel, which do not appear in any of the documentation I've found. Presumably these are for DIN plugs, so perhaps this got solved at some point.

Now, this is neat and all, but hey, doesn't this require a bunch of custom cards to fit those holes?

This is, again, a bog standard AT, so it has to take standard AT cards; otherwise it wouldn't be "a PC." Specifically, the machine included a CGA card (wow! garbage!), two serial/parallel cards, a 3Com ethernet card, a 3MB RAM expansion, and an MFM HDD/FDD controller, all completely ordinary.

So, to make them compatible with this funky fully sealed backplane, you have to jumper the actual plugs over to the rear D-subs using these little cables. Needless to say it's not fun to fiddle with all this, though fortunately the jack panel module can be unbolted, giving you a lot more room to work.

Other than that though, you can see from the collected pics above that the machine is essentially a box-inside-a-box - a totally standard 5170 PC, installed behind a second layer of metal that both mitigates its EMR and allows for more meticulous sealing. So that just leaves...

The keyswitch: You can see this on the front panel in the first pic. Instead of a standard paddle switch on the side, the 4459 uses a keyswitch to control the power state, so the machine can't be turned on (or off) without authorization. Presumably it would be installed inside a metal cage that prevented access to the back panel to pull the plug, etc.

The original AT already had a keyswitch to disable the keyboard, and this displaces it, so it combines the two features into a three position switch: Power off, power on, power-on-but-keyboard-locked. This is achieved by two microswitches and a little relay box in the back with a relay that interrupts power to the PSU. I don't have the key, so in order to make the machine usable I had to rewire the switches; nbd.

And... that's it. The only other difference between this and a 5170 is that the power supply fan is airgapped from the back panel using a plastic duct. It is, overall, an intensely dull and unremarkable computer inside a very interesting but unremarkable box, so once you know what it is, you know just about everything. This doesn't mean you can't have some fun with it, though.

While there are a few TEMPEST demo apps out there, none of them are designed to run on a computer nearly this old. Fortunately, a friend (thanks, mxshift!) was able to produce a utility that will run on here, which performs memory writes with very specific timing, producing a crudely modulated AM radio signal that radiates off the system bus and can be picked up by a typical consumer radio. This works better than I expected, as you can see/hear above.

(The melody is supposed to be the bassline from Brad Sucks' Bad Attraction, but unfortunately i can't quite get it to be recognizable for a multitude of reasons.)

This clip demonstrates two things: First, that it is possible to radiate a useful signal off an unmodified PC (remember, the motherboard here is the same as you'd find in a consumer 5170), but also how important the chassis is to mitigating this risk. A standard 1/16" PC case side reduces the signal strength by perhaps 50% (perceived), while the 4459's heavy die-cast cover reduces it into the noise floor. It's a very succinct demo - question, answered. But hey, why not have a second clip just for fun?

I recorded this after getting the whole rig home, hooking it up, and failing to pick up the signal. After tinkering for a bit, I tried holding the top cover next to the radio, and found that putting it between the LCD and PC eliminated the interference. It was actually worse than this at first - without the shielding in place, the melody was completely inaudible. I'm not sure what changed between tests. Also, I tried unplugging everything in and around that monitor and nothing eliminated the noise, so... that's interesting. Anyway.

So there's the big trick this thing can pull off, but you'll notice I've posted no pics of it actually running, for the obvious reason that it'd just be a dos prompt or commander keen. Okay, well, jokes on you - keen requires 640k and this machine only has 512k of conventional, despite having 3MB of XMS, but I've tried other games and apps and of course they all work because why wouldn't they? It's a PC.

And that is the fundamental problem here - like so many other PCs, I struggle to find anything to show it doing, but worse, I can't even seem to come up with anything to talk about. it's one of those video subjects where I can only really seem to come up with five minutes of content, but I just don't do that. Show and tell is just not my thing; I need to say SOMETHING, but I can't think of anything.

The fact is that I find TEMPEST mind-numbingly dull as a topic. It feels, to me, like making a video that opens with "we all know about lightbulbs, right? but did you know that lightbulbs cast shadows?" And I realize that's not fair, this stuff will be new to lots of people, but I just can't seem to get in the headspace because I've been thinking about EMR my entire life. One of my favorite toys, age eight, was my dad's inductive amplifier from his tone-and-trace kit; I'd walk around the house amplifying induced current from lights, computers, the microwave. I have taken it for granted almost as long as I've been alive that everything you do with a device is audible if you have the right kind of ears, so this hat is so old to me that I genuinely can't summon any enthusiasm for the subject - and that sucks, because I'm the Make Boring Things Exciting Guy.

It's made even worse because this topic is largely uncovered on Youtube, and if I don't do it, there's a good chance it never will be. There are of course a bunch of videos demonstrating TEMPEST, but all of them are demos of the various modern projects you can slurp off github, e.g. TempestSDR; nobody has covered any of the IBM TPCs, presumably because they are stupendously rare. So I kinda feel compelled to do this, since once I get rid of this machine, there's no guarantee anyone with my presentation skills will ever get one again. But I'm just struggling to get my claws to sink into the subject - it's a 5170 in a heavy box, what is there to say? I can do the bus-radio demonstration, but that's 40 seconds of content and it speaks for itself. Now what?

This isn't the first time I've had this kind of struggle, and I'll keep banging away at it, but if you have any suggestions I'm all ears. If you have info on these things, or on the larger subject, that isn't what would come up in a two-minute google search or wiki scrub, let me know. I have probably seen that PDF; and that one; and that one, and i've certainly seen the "TEMPEST-resistant fonts" paper, but none of that really has any texture or grit. I am looking for any kind of boots-on-the-ground firsthand experience, or ideally, some kind of govt. documentation of this thing's existence, like a listing in the GSA catalog with pricing, the date when it was first available, etc. Anything you have, lmk. Thanks!

Oh! Also, IBM sold these with a removable cartridge disk drive as an option, and apparently they were quite commonly sold, but I can't figure out what that actually was. The manual mentions it and one machine on eBay has it - pic below - but I can't find a model number or any documentation outside of a few technical details in one of IBM's "PC family maintenance guide." Anyone know what this thing was, let alone where I can get one?