TEMPEST INDUSTRY AND PEOPLE GRAPPLE WITH CHANGING PERSPECTIVES
Bruce C. Gabrielson, PhD
Security Engineering Services
Chesapeake Beach, Maryland
THE TEMPEST INDUSTRY
The TEMPEST industry is a 1.5 billion dollar industry which grew by 9% in 1990 according to one recent report. Despite a two year slump, the industry is still experiencing stable growth, with a current Frost and Sullivan market survey estimating that the TEMPEST market will expand by another $100 to $200 million per year until at least 1992. From the commercial sector, basically manufacturers of various data processing or telecommunications related products want to sell these products within the defense industry. The commercial need for TEMPEST support is therefore primarily in the realm on design and accreditation work.
NEEDS AND COSTS
Defense companies face TEMPEST needs from two directions: direct and indirect. Many contracts involve TEMPEST design identified directly in the statement of work for a product. Labor costs involved in hiring and supporting full time employees for single contract TEMPEST requirements are high.
The second TEMPEST need faced by defense contractors is not as specific. In this case, the contractors have security requirements imposed on their programs which define the need to physically perform the engineering and documentation work on processing equipment that has been TEMPEST emission secured. To satisfy this requirement, contractors can purchase TEMPEST secure equipment directly, or they can meet the TEMPEST requirement through a facility zoning approach. The zoning approach again requires either in-house employee technical support, or the use of outside consultants.
If the purchase of TEMPEST secure equipment is necessary, this need provides an additional support requirement from the equipment manufacturer. In this case, the manufacturers of commercial versions of the secure equipment must either redesign and test the equipment in-house, or seek out a firm specializing in TEMPEST work to perform the necessary engineering and/or testing activities. Many companies choose a combination of training supported by some outside consulting.
WHO DOES TEMPEST WORK?
With significant technical requirements driving the need for outside TEMPEST support, two types of organizations have evolved to serve marketplace. In the commercial equipment industry, since engineering costs generally amount to 70% of a TEMPEST design and accreditation program, the real governing factor in awarding a several hundred thousand dollar program is actual costs.
The least expensive support comes from design and documentation type organizations which perform all non-testing related activities for an organization, then farm out the actual accreditation test to a local test house. Overhead costs for the consulting only type firms are substantially lower then test organizations due to differences in test equipment expenses and maintenance. While consultants with substantial direct experience are rare, these organizations have become extremely popular in recent years.
The primary drawback to engineering service only commercial support organizations is that they are not recognized directly by NSA currently under the Endorsed TEMPEST Services Program. However, since the NSA directly evaluates all documentation submitted by both the Company Appointed TEMPEST Authority and by the Certified TEMPEST Engineer, so long as experienced and recognized individuals submit the necessary documents and the resulting designs successfully pass the test requirements at an approved laboratory, the equipment is approved regardless of who did the work. This approach is similar to what is taking place in the FCC equipment certification industry currently, with consultants charging considerably less then approved test organizations to redesign equipment for emission control.
Large defense industry organizations with direct TEMPEST support requirements are very limited in the methods they can use to satisfy contractual requirements. Major consulting firms have high overheads, and subcontracting costs, while short term in nature, will be higher then hiring in-house personnel directly. Small business consultants are also normally expensive. In addition, few are willing to take on major projects that require full time support for extended periods of time. Probably the best approach for a defense contractor with a small or medium technical requirement is to hire the lower cost less experienced employee, and then arrange for an established consultant to support the program on a part-time basis.
WHERE IS THE TECHNICAL SUPPORT AVAILABLE
The majority of TEMPEST test work is performed along the East Coast from Washington D.C. north to New England. Since NSA and the Department of Defense are headquartered near Washington D.C., most industry support and talent has developed in this region.
There are two large companies, Atlantic Research in Alexandria, and Honeywell in Annapolis, that combined control between 20% and 25% of the entire TEMPEST design support and test market. There are also a few smaller TEMPEST test service companies in the D.C. area such as Comsearch in Reston, Ford Aerospace near Ft Meade, and Sachs/Freeman in Landover. The remainder of the local TEMPEST test labs are in-house product oriented and do not concentrate on developing a large outside base. These organizations include , Iverson Technologies, CR Labs, T2I, Hitech Engineering, and TPI. Southwest Research is a competitive test organization in Texas, Radiation Sciences is a test organization located near Philadelphia, Chromarics is a relatively new and primarily test oriented organization in New England, and Dayton T. Brown is a test only organization located in New York. All these companies are effected by the high overhead costs associated with maintaining test labs.
Design engineering organizations are scattered throughout the country. Booze, Allen and Hamilton, while having a limited in-house COMSEC base, has not historically been recognized as a TEMPEST support or consulting organization. ICT supports considerable EMC related consulting work, but very little TEMPEST related work at this time. R&B Enterprises subcontracts most of its TEMPEST work to independent consultants. Security Engineering Services in Chesapeake Beach, Maryland supports only design and training activities.
Most successful TEMPEST consultants reside in the Washington D.C. region. As the industry currently stands, the majority of TEMPEST consulting business, except for Atlantic Research and Honeywell, is provided to customers based on individual name recognition. Major customers that have been comfortable working with a TEMPEST individual tend to send business to that individual regardless of where he is employed. Manufacturers new to TEMPEST tend to seek out individuals with established reputations to insure their programs will be successful.
INDUSTRY CAPABILITIES AND STRUCTURE
The majority of TEMPEST design and/or test organizations, even the largest, are strategically structured around a few key individuals who are recognized industry experts. Many successful small test organizations have only one experienced TEMPEST design expert on staff, and even fewer have only one or two certified engineers with a few years experience directing their commercial TEMPEST operations. TEMPEST certification is very seldom a requirement for defense contractor related work.
The problem with many TEMPEST oriented commercial and consulting organizations is their major reliance on these few key technical staff members. Virtually all of the existing TEMPEST organizations are owned by either engineers or businessman with non-technical TEMPEST backgrounds. Without someone at the top who can technically run the entire program, these organizations are continually forced to negotiate with available talent to keep their business operations active. Since less technically experienced and qualified individuals that have past a NSA sponsored test oriented examination are all that is necessary to accredit TEMPEST equipment, test organizations concentrate to these individuals. The problem has led to massive salary increases for individuals who in any other technical marketplace would demand significantly less pay levels, while at the same time forcing high level TEMPEST designers to look elsewhere for work. The situation also has driven industry costs, and has put a substantial strain on companies to maintain their competitiveness.
The cost and resultant problems in years past with companies who took shortcuts forced the National Security Agency to recently change its existing procedures regarding commercial equipment accreditation requirements. While there is still a great deal of uncertainty and flux within the commercial industry and profession, NSA is currently making considerable progress towards easing the strain caused by previous programs with the formal initiation recently of its three new programs directly aimed at the product manufacturing, test equipment manufacturing, and test laboratory marketplace. Although the new programs will eventually ease the current strain on professionals working in the industry, the short term effects have caused considerable confusion and the upgrading of both existing test lab and manufacturing capabilities at many organizations.
WHERE DO WE GO
While no one knows for sure where all the current change and uncertainty in the industry will eventually lead, some projections can be made based on what technically similar industries have experienced. Both the FCC support industry and the EMI support industry have matured over the years from black arts to technical intensive and cost competitive fields of endeavor. Their primary difference from TEMPEST technology is that these disciplines are structured from a different perspective, and do not necessarily require a security clearance for their direct support by individuals with substantial technical expertise. However, the design techniques and many of the test activities between the EM disciplines are similar. Radiated and conducted emissions use the same medium, regardless of where they originate.
What has happened in the FCC and EMI industry over the years is that as more and more individuals became competent in their ability to solve technical problems, these individuals either went out on their own as consultants, opened their own organizations (design, test, or both), or continued with large or small companies in direct support roles. The point is that as the knowledge base increased, the FCC and/or the EMC industry took on a less exclusive appearance, and cost competitiveness started to play a substantial roll.
With the costs for TEMPEST experts at a premium, although the NSA can control the rate of expansion of the existing technical base somewhat through clearance requirements, it is only a matter of time before TEMPEST travels the same road EMC and FCC have already gone. The emergence of this trend is already taking place.