IEEE Spectrum September, 2014 - 49

a pulse width of about 1 nanosecond. Such
a pulse would contain frequencies between
100 megahertz and several gigahertz.
Whether the attacker transmits via an
antenna or a hardwired connection depends
on circumstances. The radiated field method
gives attackers greater flexibility, but the
power decreases rapidly the farther they are
from the target. A hardwired approach lets
attackers put the pulsed power where they
want it without as much wastage, but it does
require that they get close enough to the target to make the physical connection. Even
this needn't be very hard: Many commercial buildings have vulnerable communica-

tions cabinets and external power outlets, as
Daniel Månsson, at the KTH Royal Institute of
Technology, in Stockholm, has documented.
An attack might be staged as follows. A
larger electromagnetic weapon could be
hidden in a small van with side panels made
of fiberglass, which is transparent to EM
radiation. If the van is parked about 5 to
10 meters away from the target, the EM
fields propagating to the wall of the building can be very high. If, as is usually the
case, the walls are mere masonry, without metal shielding, the fields will attenuate only slightly. You can tell just how well
shielded a building is by a simple test: If your

cellphone works well when you're inside,
then you are probably wide open to attack.
When the pulsed fields enter the building,
they induce a current in the internal wiring that flows into the electronics, either
damaging the equipment or just producing
a disruption, which in turn might require a
manual restart or corrupt some data.
The fields are of two kinds: narrowband
and wideband. A narrowband waveform
is essentially a single frequency of power,
delivered over a period of anywhere from
100 ns to several microseconds. Narrowband attacks are usually of very high power,
on the order of thousands of volts per meter.
Achieving such strong fields is fairly easy
because the electrical energy is concentrated in a narrow band. The frequency
can be optimized for one purpose and then
modulated for another. For instance, the
attackers might beam in a gigahertz wave-
perfect for penetrating small apertures in
equipment cases-and then modulate it to
produce a lower-frequency signal (just as
AM radio is modulated to encode music).
That lower-frequency signal, in turn, is
intended to pour energy into the electronics
inside the case. But the attack will succeed
only if the frequency matches the resonance
pattern in the equipment. If no resonance
occurs, or if the resonance is confined to just
a portion of the equipment, then the effect
will be much less serious, or nonexistent.
To increase the odds that such "coupling"
occurs, the attacker can continue to shift
the signal to other frequencies.
Wideband (sometimes called ultrawideband) packs a different punch. Here, the
power of each pulse is spread over a range
of frequencies, for example, from 100 MHz
to 1 gigahertz. If the range is wide enough-
that is, if the ratio of the highest to the lowest
frequencies in a single pulse is 10 or more-
it's considered hyperband. There's less power
at any one frequency, and that means less
damage will be inflicted per pulse than in
a narrowband attack. But wideband pulse
generators can easily produce 1,000 pulses
per second for many minutes at a time, and
that greatly increases the chance of damaging a system, or at least interfering with
communications through a straightforward
denial of service. Yury Parfenov, of the Russian Academy of Sciences, Joint Institute for
High Temperatures, has demonstrated how
a high repetition rate can reduce wired Ethernet communications to nearly zero.

spectrUm.ieee.orG

North AmericAN

sep 2014

http://spectrUm.ieee.orG

Table of Contents for the Digital Edition of IEEE Spectrum September, 2014