A Display Technique for Preventing

Electromagnetic Eavesdropping Using Color

Mixture Characteristic of Human Eyes

Takashi Watanabe, Hiroto Nagayoshi, and Hiroshi Sako

Hitachi, Ltd., Central Research Laboratory

1-280 Higashi-koigakubo Kokubunji-shi, Tokyo, Japan
{takashi.watanabe.dh,hiroto.nagayoshi.wy,hiroshi.sako.ug}@hitachi.com

Abstract. The security problem of screen image leakage on a cathode-

ray tube (CRT) through electromagnetic radiation from several meters
away, “transient electro-magnetic pulse emission surveillance technology”
(TEMPEST), has attracted wide interest by security researchers since
Van Eck wrote about this problem. On the industry side, the problem
is considered a serious risk, especially for computers used in operations
related to such areas as critical business and information management
at banks. To solve the problem, techniques for reducing the S/N ratio
of emanating information by signal reduction and noise generation have
been investigated as countermeasures. We have developed a technique
that introduces noise to displayed images. With this technique there is
less of a quality penalty on the visible images. This is a result of us-
ing a human visual characteristic known as additive color mixing, which
occurs when an eye is continuously exposed to quickly changing colors.
Although we used hardware to implement this technique, using software
for low-cost systems is possible. We tested and confirmed the effective-
ness of the technique using both analog and digital systems: a computer
connected with a CRT or LCD by an analog RGB cable.

Keywords: TEMPEST, Compromising Emanation, Side Channel Ana-

lysis, Electromagnetic Radiation.

1 Introduction
After Van Eck published his paper [1] in 1985, the risk of information leakage
through electromagnetic radiation from a display unit, not only cathode-ray tube
(CRT) but also liquid-crystal display (LCD) [2], has been widely known. The
technique to capture information through electromagnetic (EM) radiation is now
referred to as “TEMPEST” (transient electro-magnetic pulse emission surveil-
lance technology) or “compromising emanations”. However, little information on
guidelines or requirements for preventing TEMPEST has been unveiled, though
some companies have been selling TEMPEST testing devices.
The most significant literature on TEMPEST that is publicly available is a
thesis by Markus Kuhn [3]. He states that million-dollar devices were required

K. Solanki, K. Sullivan, and U. Madhow (Eds.): IH 2008, LNCS 5284, pp. 1–14, 2008.


c Springer-Verlag Berlin Heidelberg 2008
2 T. Watanabe, H. Nagayoshi, and H. Sako

to eavesdrop EM information from ordinary display units a few decades ago.

Although such high-end products cost the same today, lower-range products,
those costing as little as thousands of dollars, are nearly capable of capturing
partial information from a few meters away, which is due to improvements in
radio management technologies. Furthermore, with rapid advances in software
definition radio (SDR) and field programmable gate array (FPGA), the cost of
information retrieval is expected to decrease to less than a thousand dollars in the
near future. Because of these changes, development of low-cost countermeasures
applicable to ordinary computers is required.
Countermeasures are woven to reduce the S/N ratio of leakage information and
are categorized as signal reduction and noise generation. For signal reduction,
smoothing devices such as a low-pass filter or Gaussian filter are applied to screen
fonts [4,5] and entire images. For noise generation, an additional noise source is
placed near the sources of signal emission, and in addition they are synchronized
with a pixel clock to effectively cover the frequency range of information leakage.
Our technique increases noise by spreading information in a time domain
and then introduces noise on the displayed images. The visible images, however,
maintain their quality by reducing the noise on the human eye. In our technique,
we use the human visual characteristic known as the additive mixing of colors,
which occurs when quickly changing colors are seen. From a technical standpoint,
sub-images are generated from an original image and a noise pattern and then
sub-images are displayed in a quick flipping manner. The images seen by the user
on the display and those seen by the attacker who is monitoring EM radiation
are different, even when he is an averaging attacker [6], because the information
that travels through EM radiation is effectively modulated by our technique.
Furthermore, since the information is randomized by noise, the attacker cannot
retrieve any information on what the user sees.
With the same objective, Kuhn [3] suggests a technique that randomizes the
lower significant bits of pixels, which are those that do not significantly affect
image quality. Our technique introduces a large amount of noise with less of an
image quality penalty.
This paper is organized as follows. In the following chapter, we describe a
leakage model, a test setup for eavesdropping, and the preliminary results of our
test. In the third chapter, we describe our technique for preventing information
leakage and show test results.

2 Leakage Model and Test Setup

2.1 Leakage Source
A target (or victim) system is illustrated in Fig. 1. It consists of a personal
computer (PC) connected to a CRT or an LCD by an analog RGB cable. In
the system, the picture to be displayed on the CRT screen is generated in a
CPU or a GPU and then stored in the RAM of the PC or the GRAM of a
graphic board. The graphic board is equipped with a digital-to-analog converter
that accesses the RAM or the GRAM to retrieve the picture and convert it in
 A Display Technique for Preventing Electromagnetic Eavesdropping 3

digital form to analog form in order to transmit the analog value to the CRT
through the analog RGB cable. The CRT receives the analog value and activates
a regulator to modulate the strength of an electron beam to an adequate level.
The electron beam then activates the phosphorogen coated layer on the screen
so that the luminance at the position reaches the expected value corresponding
to the picture. In some CRTs, the regulator is directly controlled by the input
analog signal. On the other hand, various CRTs buffer incoming analog values
in digital form by an analog-to-digital converter. Then, after digital filters are
applied, a digital-to-analog converter is used to activate the electron beam. In
either case, analog voltages corresponding to the luminance of the pixels in the
picture are transmitted in the system.
A conventional desktop PC and a CRT are connected by an analog RGB cable,
which transmits luminance information pixel-by-pixel. Each pixel is made up of
three colors: red, blue, and green of the RGB color system. Color information
is represented by a 0.7-Vpp analog signal and is divided into 256 levels so that
each level has a 30-mV margin. Pixels are transmitted in order from the top
left to the bottom right by raster scanning, which is illustrated in Fig. 1, where
the addresses (0,0) and (w − 1, h − 1) are respectively located at the top left
and bottom right parts of the screen. Here, w and h are the width and height
of the screen. In raster scanning, the pixel at (0,0) is transmitted first, followed
by (1,0), (2,0), etc. Once the scan reaches the rightmost address (w − 1, 0), the
scan goes to the next line (0,1), (1,1), (2,1), etc. After (w − 1, h − 1), the scan
goes back to the top left, (0,0). This scanning sequence of one screen is called

Fig. 1. Leakage sources (thick black lines) in system of computer and CRT or LCD
connected by analog RGB cable
4 T. Watanabe, H. Nagayoshi, and H. Sako

a “frame”. In ordinary PCs and CRTs, the frame rate is set to between 60 and
85 Hz. The human visual system cannot follow such high-frequency images and
thus identifies them as smooth motion pictures.
As illustrated in Fig. 1, sources of information leakage, represented by thick
black lines, are spreading nearly throughout the system. The leakage spreads
from the output of the graphic board’s VRAM to the CRT’s regulator of the
electron beam and the LCD drivers. If an attacker can couple an antenna to the
leakage source, they can retrieve information from a distance without having to
be near the target device. Even worse, EM analysis is passive and so evidence of
information leakage is not detectable.

2.2 Leakage Model

As Maxwell’s theorem states, current fluctuation in a circuitry board generates

electromagnetic radiation using wires as antennas. The point where there is the
most leakage in the system is the ground line, where a large current modulated
by signal activity is present in the circuit.
If a PC and a CRT are connected by an analog RGB cable, the system operates
as described below.

1. Through an input port, analog RGB, horizontal sync, and vertical sync sig-
nals are received.
2. The pixel clock, the horizontal sync, and the vertical sync signals locate the
angle of the electron beam at the target position.
3. At the target position, depending on the RGB signal, the electron beam
stimulates phosphorogen on the screen, resulting in the material glowing
with corresponding luminance.

In 1 and 3, electromagnetic radiation related to current fluctuation occurs,

caused by a pixel value (RGB signal). In the analog system, which consists of
an analog RGB cable and a CRT, since a pixel value is numerically expressed
by voltage level, current vibrations are caused depending on the transition of
two successive pixel values. In Fig. 2, an EM radiation pattern that represents
successive t − 1, t and t + 1 pixel values is shown. As illustrated, red, green
and blue information is treated separately and thus independently cause EM
radiation. What we see is a combination of these radiations.

CRT System. In a CRT system, most of the power consumption is used by the
electron beam, which is controlled by a power regulator of which input depends
on a pixel value. For the regulator, a 100-V power source is boosted to about
a few thousands of voltage to activate the electron beam. Because the power
level of the electron beam corresponds to the pixel value, the resultant EM
radiation also depends on the pixel value and thus an attacker monitoring the
EM radiation can retrieve information on this value.
If a screen size becomes larger, decreasing the transition speed of the electron
beam is necessary. When an interval between spotting times of adjacent pixels is
 A Display Technique for Preventing Electromagnetic Eavesdropping 5

Fig. 2. Encoding of digital (a) 24-bit parallel bus, (b) digital DVI, (c) 24-bit LVDS
and analog, (d) RGB

long, the beam is controlled by the ZR (zero return) method, which zeroizes the
voltage of the beam before the next pixel value is charged. In this case, the pixel
value itself leaks. On the other hand, if the interval is short, zeroizing the beam
is difficult, thus the beam keeps the voltage and starting from it, changes to the
next voltage level. In this case, the differences of two successive pixel values leak.
The latter case is common today, and in a system with an analog RGB cable
and a CRT, the difference of pixel values in the raster scanning order is the basic
leakage information.

LCD System. If the CRT is replaced by an LCD, we need to consider a more

complex leakage model because LCDs are digitally different from CRTs. In the
LCD system, the RGB cable leaks pixel values in a numerical manner, as de-
scribed above, whereas the LCD leaks pixel values in a logical manner.
At an input port of an LCD, an analog pixel value from the RGB cable is sam-
pled at a high frequency and then converted to a digital form by an analog-to-
digital converter. The output digital data are stored in an internal RAM. Then,
when one frame, or one line, of data is filled, the data are transmitted to a digital-
to-analog converter to generate a charge current for the capacitors on each TFT.
The digital data are transmitted through buses, which are pre-charge and static
buses. In the pre-charge bus, the bus is charged to 0 or 1 before a datum is trans-
mitted. On the other hand, the static bus keeps the previous datum and then it
directly changes to the next datum state. Apparently, leakage information is dif-
ferent in either bus. For high-speed systems, the static bus is preferred.
The following is the leakage information in the digital system.

1. Hamming distance of two successive pixel values. (static bus)

2. Hamming weight of a pixel value. (pre-charge bus)
6 T. Watanabe, H. Nagayoshi, and H. Sako

Table 1. Image information leakage source and its forms

Leakage source Leakage information

RGB cable (analog DVI-Ij Difference of adjacent pixels’ luminance.
CRT electron beam part Difference of adjacent pixels’ luminance.
DVI cable (digital DVI-D) Relates to a pixel value represented in binary form.
LVDS transmission Relates to a pixel value represented in binary form.
LCD logical circuit Hamming distance of two successive pixel values.

Today, most high-resolution display units use a low-voltage differential signal

(LVDS) or FPD-Link for the purpose of building a system with a high bandwidth
and fewer wires. The LVDS is a differential signaling bus, and because it serializes
pixel values, a logically represented pattern of pixel values leaks: 47 patterns for
8-bit value. The FPD-Link is almost the same as the LVDS except for differences
related to encoding (Fig. 2). The digital video interface (DVI) is same because
the DVI uses the TMDS (transaction minimized differential signaling) format,
also shown in Fig. 2.
Note that in the digital system, there is more information leakage than in the
analog system, as summarized in Table 1.

2.3 Test Setup

Figure 3 illustrates connections between evaluation devices. This setup consists of
two systems: a target system and an eavesdropping system, which are connected
only by electromagnetic waves. The wide-band receiver captures electromagnetic
radiation by searching a full range of frequencies between 10 MHz and 1 GHz.
The power sources of the two systems are also separated because electronic
information travels through these sources.

2.4 Preliminary Test Result

The center and right-side pictures in Fig. 4 show the results of a test using the
previously described system (Fig. 3), targeting a PC and an LCD connected by
an analog RGB cable. In our experiment, one CRT and two LCDs were tested.
The values of the horizontal sync and vertical sync signals used are shown in
Table 2.
As shown in Table 1, and described in the previous section, we can extract
various types of images showing leakage, which are distributed over frequencies
of at least between 10 MHz and 1 GHz, as illustrated in Fig. 5. We thus need
to suppress not only the “edge” leakage but also the “bit pattern” leakage,
especially when we connect a computer and an LCD using an analog RGB cable.
When hsync or vsync signals are generated on an attacker’s system and are
inconsistent with those of the target device, displayed eavesdropping images
scroll vertically or horizontally or both. To stabilize the images, we need to
match the value at the 6th to 7th precision.
 A Display Technique for Preventing Electromagnetic Eavesdropping 7

Fig. 3. Structure of electromagnetic leakage evaluation system

Fig. 4. Displayed image (left) and eavesdropped images (center and right)

Fig. 5. Frequencies of image leakage (represented by lines and arrows) and eaves-
dropped images
8 T. Watanabe, H. Nagayoshi, and H. Sako

3 Proposed Countermeasure and Test Results

3.1 Proposed Countermeasure
Our countermeasure adds or subtracts randomly generated n sets of values to the
original pixels, so that n + 1 sub-images are generated, and then it quickly dis-
plays these images in turn. Since the sub-images change over a short period, their
average luminance can be seen by people. Thus, if we add a value to the original
image in one sub-image and subtract the value from the original image in the other
sub-image, a person can see the original image in his/her brain even though the
randomized sub-images are displayed on the display unit. This human character-
istic is also used for blur reduction of movies on an LCD by inserting a black or
lower luminance image between actual images by doubling the frame rate.
Because it does not compromise generality, we restrict the number of sub-
images to two.
The proposed technique first generates a noise pattern randomly and then adds
and subtracts values to and from the original pixel value to make two sub-images.
In other words, a random value is added to the original pixel value to generate
the pixel value of the first sub-image, and the random value is subtracted from
the original pixel value to generate the pixel value of the second sub-image. Con-
sequently, the average pixel value of the first and second sub-images becomes the
same as that of the original image. This averaging function is achieved by quickly
changing the screen between the first and second sub-images.
Here we describe our algorithm. The pixel values pi are numbered in the order
of raster scanning from the origin (0,0). The ui and vi are the pixel values of the
first and second sub-images, respectively, which are numbered in the same way
as previously described.

1. Generate three sets of w × h 8-bit uniformly distributed random numbers ri .

(or only one set for a grayscale image.)
2. Read the input value pi .
3. For each pixel and each color plane, RGB, apply (a) and (b) in turn.
(a) Calculate ui = pi +ri . If ui > 255, then set ui = 255. Then set vi = pi −ri .
If vi < 0, then set vi = 0.
(b) Calculate ui = pi − ri and vi = pi + ri . If ui < 0, then set ui = 0, and if
vi > 255, then set vi = 255
4. Display u and v in turn for 1/60 seconds each or faster. (Repeat this for the
period that p is expected to be displayed, as shown in Fig. 6)
5. Return to 1.

Table 2. Target devices and tuning frequencies

Target device Hsync(kHz) Vsync(Hz)

A (CRT) 48.47327212 75.0962
B (LCD) 48.38397523 60.0987
C (LCD) 48.53026104 60.0248
 A Display Technique for Preventing Electromagnetic Eavesdropping 9

Fig. 6. Display technique with two sub-images

As previously mentioned, the electromagnetic radiation depends on the differ-

ence of two successive pixel values, and the displayed pixel values are randomized,
thus the leaking information is randomized. We can improve the randomness of
the sub-images by increasing the number of these images. However, changing the
screen in such a short period to activate human color-mixture characteristics be-
comes more difficult because display units may not be able to process such quick
changes.
Here we explain how our system works. Consider the screen resolution w ×
h and the pixel value at location (x,y) as px,y . If we describe the power of
electromagnetic radiation at time t by w(t), it is:

w(f ) = a · |pXi ,Yi − pXi−1 ,Yi−1 |

where:

Xt = fp · t mod w , Yt = (fp · t − Xt )/w mod h

Xt−1 = fp · (t − 1) mod w , Yt−1 = (fp · (t − 1) − Xt−1 )/w mod h

Here, a is a coefficient that depends on leakage sources.

Our technique generates a noise value αx,y and then px,y = px,y − αx,y , px,y =
px,y + αx,y from the original pixel value px,y . Although the noise value αx,y is
independent of the location (x, y), the value is constant at each location.
When we quickly change the sub-images over a short period, the human eye
can see the average value:

(px,y + px,y ) (px,y − αx,y + px,y + αx,y )

= = px,y .
2 2
This value is equal to the original pixel value.
The above equation is also valid for Xt , Yt rather than x, y. Therefore leakage
from the first sub-image w (t) and second sub-image w (t) are:

w (f ) = a · |pXt ,Yt − pXt−1 ,Yt−1 | = a · |cXt ,Yt − αXt ,Yt + αXt−1 ,Yt−1 |
w (f ) = a · |pXt ,Yt − pXt−1 ,Yt−1 | = a · |cXt ,Yt + αXt ,Yt − αXt−1 ,Yt−1 |
10 T. Watanabe, H. Nagayoshi, and H. Sako

Here, cXt ,Yt is set to cXt ,Yt = pXt ,Yt − pXt−1 ,Yt−1 , which is equivalent to the
leakage without a countermeasure.
If the horizontal and vertical sync signals match those of the target device,
the image visible to the attacker corresponds to the average value of w (t) and
w (t). The result is divided into the following four cases.
i) cXt ,Yt − αXt−1 ,Yt−1 + αXt−1 ,Yt−1 ≥ 0, cXt ,Yt + αXt−1 ,Yt−1 − αXt−1 ,Yt−1 ≥ 0

w (f ) + w (f )
2
a · (cXt ,Yt − αXt ,Yt + αXt−1 ,Yt−1 ) + a · (cXt ,Yt + αXt ,Yt − αXt−1 ,Yt−1 )
=
2
= a · cXt ,Yt
ii) cXt ,Yt − αXt−1 ,Yt−1 + αXt−1 ,Yt−1 ≥ 0, cXt ,Yt + αXt−1 ,Yt−1 − αXt−1 ,Yt−1 < 0

w (f ) + w (f )
2
a · (cXt ,Yt − αXt ,Yt + αXt−1 ,Yt−1 ) − a · (cXt ,Yt + αXt ,Yt − αXt−1 ,Yt−1 )
=
2
= a · (αXt−1 ,Yt−1 − αXt ,Yt )
iii) cXt ,Yt − αXt−1 ,Yt−1 + αXt−1 ,Yt−1 < 0, cXt ,Yt + αXt−1 ,Yt−1 − αXt−1 ,Yt−1 ≤ 0

w (f ) + w (f )
2
−a · (cXt ,Yt − αXt ,Yt + αXt−1 ,Yt−1 ) + a · (cXt ,Yt + αXt ,Yt − αXt−1 ,Yt−1 )
=
2
= a · (αXt ,Yt − αXt−1 ,Yt−1 )
iv) cXt ,Yt − αXt−1 ,Yt−1 + αXt−1 ,Yt−1 < 0, cXt ,Yt + αXt−1 ,Yt−1 − αXt−1 ,Yt−1 < 0

w (f ) + w (f )
2
−a · (cXt ,Yt − αXt ,Yt + αXt−1 ,Yt−1 ) − a · (cXt ,Yt + αXt ,Yt − αXt−1 ,Yt−1 )
=
2
= −a · cXt ,Yt
In ii) and iii), the results only depend on the random value, and there is
no image leakage, whereas in i) and iv), the result is equivalent to the original
leakage without a countermeasure, so the attacker sees the information related
to the original picture on his/her screen.
The above equations imply that ii) or iii) tends to be satisfied if a smaller
cXt ,Yt is achieved. If we are not informed in advance about the original picture,
one strategy is to accomplish such a situation by generating αXt ,Yt , αXt−1 ,Yt−1
to let |αXt ,Yt − αXt−1 ,Yt−1 | be a larger value. As illustrated geometrically in Fig.
7, the right strategy is better than the one on the left.
 A Display Technique for Preventing Electromagnetic Eavesdropping 11

Fig. 7. Example of picture value allocation to first and second sub-images (right case
is preferable)

3.2 Test Results

We implemented our technique on an FPGA with RGB input and output ports.
The unit was directly connected to the video output port of the computer, and
its output port was connected to the CRT or the LCD. This system is able to
process pictures in real time with up to XGA resolution.
Figure 8 is the sub-images generated from the original picture in Fig. 4 using
our method. Magnified images of character “S” are shown in Fig. 9. If these
sub-images are displayed by quickly flipping them on the screen, what we see
is virtually depicted in Fig. 8. Notably, the resulting image has less contrast
compared with the original picture because we cannot express a pure black or
white value using two different values.

CRT System. Results of EM eavesdropping on a CRT system are summarized

in Table 3. Without a countermeasure, as shown in the left columns of Table
3, the edges of characters clearly leak at three intervals of frequencies 40 to 80
MHz, 120 to 180 MHz, and 210 to 270 MHz, although only the strongest leak
images in each range are shown. These frequencies are recognized as harmonics
of the base pixel clock frequency 65 MHz for an XGA screen.

Fig. 8. Generated sub-images using method (corresponds to u and v in section 3.1)

12 T. Watanabe, H. Nagayoshi, and H. Sako

(a) (b) (c) (d)

Fig. 9. Magnified images of character “S” in (a) original image, (b) 1st sub-image,
(c) 2nd sub-image and (d) visible image on human eyes. (d) is calculated virtually by
averaging (b) and (c).

Table 3. Comparison of eavesdropped images from the target system with or without
countermeasure in analog system
 A Display Technique for Preventing Electromagnetic Eavesdropping 13

Table 4. Comparison of eavesdropped images in the digital system

The right columns in Table 3 show the results of applying our method. The
edges of characters found in the left columns are dismissed, implying that re-
trieving any information about the original image is not possible.
The last row in Table 3 contains estimated leak images made by the leakage
model described in the second section. The left picture shows information on the
edges of the characters, whereas the right picture shows only noise. Both seem
to well explain the test results.

LCD System. The same test was conducted for a system in which a CRT was
replaced by an LCD. Table 4 shows the results of this test. Although, as we
pointed out for Fig. 5, leakage is seen at lower frequencies, the results for these
regions are the same as those in Table 3.
14 T. Watanabe, H. Nagayoshi, and H. Sako

4 Conclusion

We developed a signal reduction and noise generation technique that uses human
visual characteristic related to an additive mixture of colors, which is what occurs
during continuous exposure to quickly changing colors. We tested the technique
using a system of a computer and CRT or LCD connected by an analog RGB
cable with an image conversion hardware that is realized by a FPGA board.
With the same goal, Kuhn [3] suggested a technique that randomizes lower
significant bits of pixel value that do not significantly affect the quality of an
image. Our method introduces a significantly larger amount of noise with less of
an image quality penalty.
Although our technique has the drawback of contrast reduction on a displayed
image, this can be done at a low cost using software. Furthermore, our method is
independent from previously proposed methods, and thus, our method combined
with others will effectively improve security against electromagnetic eavesdrop-
ping.

References
1. van Eck, W.: Electromagnetic Radiation from Video Display Units: An Eavesdrop-
ping Risk? Computer & Security 4, 269–286 (1985)
2. Kuhn, M.: Electromagnetic Eavesdropping Risks of Flat-Panel Displays. In: 4th
Workshop on Privacy Enhancing Technologies, pp. 1–20 (2004)
3. Kuhn, M.: Compromising emanations: eavesdropping risks of computer displays.
University of Cambridge Technical Report Number 577 (December 2003)
4. Kuhn, M., Anderson, R.: Soft Tempest: Hidden Data Transmission Using Electro-
magnetic Emanations. In: Aucsmith, D. (ed.) IH 1998. LNCS, vol. 1525, pp. 124–142.
Springer, Heidelberg (1998)
5. Tanaka, H., Takizawa, O., Yamamura, A.: Evaluation and Improvement of TEM-
PEST fonts. In: Lim, C.H., Yung, M. (eds.) WISA 2004. LNCS, vol. 3325, pp.
457–469. Springer, Heidelberg (2005)
6. Shiwei, D., Jiadong, X., Chenjiang, G.: Bit error rate of a digital radio eavesdropper
on computer CRT monitors. In: IEEE International Symposium on Communications
and Information Technology (ISCIT), vol. 2, pp. 1093–1099 (2004)