Hacker in a Car Outside Your Window, or Why Shielding Matters

Introduction

We live in an era when WiFi signal flows through walls like air, and that is precisely the problem. Every wireless device emits electromagnetic radiation that can easily pass out through a window, where an attacker with an antenna may be waiting. The WAVETRAP technology addresses this issue elegantly: specially engineered glass with films containing conductive layers built directly into façades, or as an integrated shielded glass room in an office building, selectively attenuates WiFi, Bluetooth or 5G signals while still looking like an ordinary window.

This essay analyzes how this technology helps fulfill obligations under Act No. 264/2025 Coll. on Cybersecurity, Acts No. 412/2005 Coll. and No. 266/2025 Coll. on the Protection of Classified Information, Regulation DORA (EU) 2022/2554 and GDPR (EU) 2016/679.

Physical principles of electromagnetic shielding

A window made of ordinary glass is, from the electromagnetic perspective, practically transparent. A WiFi signal at 2.4 GHz can be detectable 80–120 meters from a building, so an attacker can comfortably sit in a car or a café in front of the building and eavesdrop.

Shielding glass works on the principle of multi-layer glass into which a conductive layer is integrated, typically a film or a thin metal mesh. Part of the electromagnetic energy is reflected and part is absorbed. The result is a signal attenuation in the range of 30–60 dB in key UHF bands (WiFi 2.4 GHz, Bluetooth, GSM/LTE) and SHF bands (WiFi 5 GHz, WiFi 6E, 5G NR). A significant advantage is the passive nature of the technology, which, once installed, requires no power or operation, eliminating dependence on daily operational discipline and contributing to long-term reliability of protection.

Protection against digital eavesdropping

A cyber attacker today does not have to penetrate a network. It is enough to stand around the corner with a directional antenna and a spectrum analyzer and monitor what 'flows' out. So-called Van Eck phreaking can even reconstruct an image from electromagnetic emissions of a monitor.

Shielding glass addresses this threat at the source. It physically prevents signal leakage through the most vulnerable parts of any building, namely glazed surfaces. It reduces the organization's attack surface even before an attacker approaches the network or attempts active reconnaissance of the wireless environment.

Importance for cybersecurity of wireless technologies

Traditional cybersecurity focuses on the logical layer: authentication, encryption and network segmentation. However, if an organization neglects the physical layer of signal propagation, it leaves a backdoor open to an attacker without even realizing it.

Shielding glass closes that backdoor and becomes a key element of the defense-in-depth concept, where physical limitation of electromagnetic leakage complements firewalls, IDS/IPS systems, encryption and employee training. It is particularly relevant for SOC/NOC facilities, server rooms, crisis centers and meeting rooms for strategic discussions, where even seemingly minor signal leakage represents an unacceptable vulnerability.

Threats mitigated by shielding technology

Eavesdropping and data leakage are the primary threats. An attacker with a directional antenna and a spectrum analyzer can capture traffic from WiFi, Bluetooth or GSM networks, reconstruct communication contents, obtain credentials or sensitive data. Physically blocking the signal at the perimeter directly eliminates this possibility.

Industrial espionage and attacks on control systems form a second category of risk. Electromagnetic emanations (EMR) can reveal know-how, plans, process recipes or operational data, enabling an attacker to analyze operating modes of control elements of critical infrastructure and prepare targeted attacks. Limiting the range of EMR from SCADA and OT environments significantly complicates this attack vector.

The third category involves jamming attacks. An attacker can transmit disruptive signals that make communication inside the protected facility impossible or cause control system outages. Shielding material installed on the building envelope prevents such signals from penetrating from outside.

The fourth threat is lateral movement within a network. If an attacker gains access to an internal network via an unsecured wireless access point detected outside the premises, they can move across the infrastructure and gain elevated privileges. Eliminating remote reconnaissance of the wireless infrastructure makes this path into the network practically inaccessible.

The Cybersecurity Act and its requirements

Act No. 264/2025 Coll. on Cybersecurity implements requirements of the European NIS2 directive (EU 2022/2555) and came into force on November 1, 2025. It significantly expands the range of obligated entities and requires, among other things, carrying out risk assessments including EMR risks, introducing technical and organizational measures, reporting incidents within 24 hours of detection, and ensuring the physical security of premises.

Shielding glass installed on windows and façades of buildings directly satisfies the Act's requirements as a technical measure at the physical layer: it interrupts one of the main vectors of cyber attacks, remote eavesdropping of wireless communications. The Act assumes a defense-in-depth approach in which the physical layer works together with the network, application and personnel layers, and shielding glass strengthens the physical layer in a way that is architecturally integrated, operationally passive and reliable over the long term.

The forthcoming implementing decree to Act No. 264/2025 Coll. is expected to standardize methodologies for measuring EMR leakage and set requirements for certified shielding materials with a minimum attenuation of 30 dB in the 2.4–5 GHz band. From a compliance perspective, it is not enough to implement a measure — the Act requires its documentation, verification and regular review, which for shielding materials means measuring effectiveness, recording technical parameters and integrating them into security documentation.

Acts on the protection of classified information, critical infrastructure resilience and EMR shielding

Act No. 412/2005 Coll. on the Protection of Classified Information and Security Eligibility requires so-called protected areas guarded against compromising emanations for processing information classified as 'Secret' and 'Top Secret.' This principle, internationally known as TEMPEST (Transient ElectroMagnetic Pulse Emanation Standard) under NATO standards SDIP-27 and SDIP-28, is directly addressed by shielding glass.

Act No. 266/2025 Coll. updates these requirements in the context of modern wireless technologies. It requires assessing risks of compromising emanations, implementing technical measures to prevent electromagnetic signals from leaking outside protected spaces, regularly verifying the effectiveness of shielding measures with certified measurements, and documenting everything for security reviews by the National Security Authority (NBÚ).

Shielding glass allows integrating protective functionality directly into transparent building elements without having to build fully opaque and architecturally unsuitable solutions. For 'Top Secret' spaces (required total attenuation 60–80 dB) it constitutes the baseline layer of a multi-layer solution. For lower secrecy levels and for protection of sensitive but not classified information, achieving 35–45 dB attenuation is generally sufficient and can be provided by shielding glass alone.

DORA regulation and risk management measures

Regulation DORA (EU) 2022/2554 on the digital operational resilience of the financial sector entered into force in January 2025. Article 9 requires ensuring physical and logical control measures for access to ICT assets; Article 10 requires detection of cyber threats, and unauthorized access via capture of electromagnetic signals outside a building precisely corresponds to the type of threat that must be systematically addressed.

Banks, insurers, investment firms and payment institutions process transactional data, authentication credentials and business strategies, often in densely built-up areas where eavesdropping from an adjacent building is a real threat. Shielding glass as an element of the physical layer of ICT security reduces the likelihood of an attack via the wireless vector to an acceptable level of residual risk. For regulated institutions, this helps demonstrate proportionality of measures during audits by ČNB or ESA.

GDPR, measures under Articles 25 and 32

Article 32 GDPR (EU) 2016/679 requires technical measures ensuring ongoing confidentiality, integrity and availability of systems processing personal data. Leakage of WiFi communications from hospitals, call centers or HR departments, if they carry unencrypted or weakly encrypted personal data, may constitute a breach under Article 4(12) GDPR, with an obligation to notify ÚOOÚ within 72 hours of detection.

Article 25 GDPR (privacy by design) goes further: a space designer who integrates shielding technologies into the design from the outset for spaces where personal data will be processed demonstrates deliberate privacy protection in accordance with Article 25(1) GDPR. For controllers processing special categories of personal data under Article 9 GDPR — e.g., healthcare facilities, law firms, courts, and public authorities — physical protection of the environment against eavesdropping is especially relevant, since unauthorized disclosure of such information could have serious consequences for the rights and freedoms of individuals.

Normative framework and technical standards

The ČSN EN 50600 standard for data centers sets requirements for physical security, including shielding of walls and windows with a minimum attenuation of 40 dB in the 1–10 GHz band, use of certified shielding materials (glass with an indium tin oxide layer) and grounding resistance ≤ 1 Ω.

International standard IEEE Std. 299.1-2013 defines the methodology for measuring shielding effectiveness of electromagnetic waves in buildings and equipment. Leading shielding glass manufacturers such as AGC Glass Europe, manufacturer of the WAVETRAP technology, supply their glass with certificates according to this standard, thereby guaranteeing verified and demonstrable shielding quality.

Standards ČSN EN 61000-4-3 and ČSN EN 55022/55024 define immunity test methodologies and limits for electromagnetic emissions (emissions ≤ 30 dBμV/m at 10 m). The ISO/IEC 27001 standard requires implementation of physical controls as part of a comprehensive ISMS; shielding glass naturally forms part of the physical and environmental security domain under Annex A.11 of that standard. NATO standards SDIP-27 and SDIP-28 (TEMPEST) specify shielding requirements for processing classified information in an international security environment.

Without technical documentation, measurement reports and regular inspections, no shielding material can be regarded as a compliance tool, and this condition applies without exception.

Implementation: from risk analysis to operational validation

The starting step is a risk analysis. Identifying EMR sources and potential leakage points is done with a spectrum analyzer (e.g., Rohde & Schwarz FSH) under real operational conditions, at different times of day and under varying wireless traffic loads, since signal intensity changes dynamically.

Designing measures includes selecting a specific shielding solution based on required attenuation, aesthetic and architectural constraints, and financial possibilities. For spaces handling 'Top Secret' information it is usually necessary to combine shielding glass with additional elements such as shielding foil on walls and specially constructed doors. For spaces that process sensitive but unclassified information, shielding glass alone may suffice.

Installation and validation are critical phases on which the actual effectiveness of the entire measure depends. Achieving declared attenuation depends not only on the quality of the glass but especially on precise installation: sealing frames, correctly bonding shielding layers to the building structure and grounding. After installation, verification measurements according to IEEE 299.1 must be performed and the results documented.

Regular review is required both by technical standards (at least once a year) and by legal regulations. Damaged shielding layers, for example during window replacement or building modifications, create weak points in protection that can remain undetected for a long time. A modern approach links the shielding system to the Building Management System (BMS) and a SIEM platform, enabling more comprehensive correlation of security events and improved anomaly detection capability.

Shielding glass in the context of layered protection and future challenges

Shielding glass is not and cannot be the only layer of protection. Its strength lies in physically eliminating or significantly weakening one of the main vectors of cyber attacks — remote eavesdropping of wireless communications — thereby increasing overall system resilience. Within the defense-in-depth approach it complements the network layer (network segmentation, firewalls, IDS/IPS), the application layer (end-to-end encryption, strong authentication, certificate management) and the personnel layer (employee training, awareness programs, access rights management).

Future challenges are linked to the development of new technologies. The arrival of 6G networks will bring use of frequency bands above 24 GHz (mmWave), where propagation and shielding properties of EMR differ — waves propagate more line-of-sight with higher material attenuation, but will require new approaches to shielding. Research is focusing on graphene layers, metamaterials and adaptive shielding glass that can dynamically change signal attenuation according to current needs. The proliferation of IoT devices (typically 868 MHz, LoRaWAN) further expands the spectrum of frequency bands that must be addressed. Ongoing harmonization of CEN/CENELEC standards in the area of electromagnetic compatibility (EMC) shielding aims to unify requirements across EU member states and facilitate cross-border implementation of certified solutions.

Limits and conditions of effectiveness

Although shielding glass is very effective, it cannot be absolutized. By itself it does not guarantee complete protection against all forms of electromagnetic attack. Its effectiveness depends on material quality, professional installation, continuity with other building elements and whether there are no other leakage points in the space, such as gaps, unprotected doors or cable penetrations.

Another limitation is the need to align shielding with operational requirements. Organizations must carefully consider which signals they want to limit and which they need to keep. In some facilities complete shielding may be desirable; in others, controlled attenuation is preferable. This underlines that correct deployment must be based on an individualized analysis of the environment.

Technological development will bring new frequency ranges and communication protocols, and therefore shielding solutions must be regularly reassessed for future compatibility. A truly secure organization does not treat a one-time installation as the final solution but as part of a continuous risk management process.

Conclusion

WAVETRAP is a modern, architecturally integrated and legally defensible solution that physically eliminates one of the least visible cyber threats: remote eavesdropping of electromagnetic emissions. From a compliance perspective it contributes to fulfilling obligations under Act No. 264/2025 Coll. (technical measures for physical security, EMR risk assessment), Acts No. 412/2005 Coll. and No. 266/2025 Coll. (prevention of compromising emanations, compliance with TEMPEST standards per NATO SDIP-27/28), Regulation DORA (physical layer protection of ICT assets, limiting the wireless attack vector) and GDPR (technical measures under Article 32, privacy by design under Article 25).

The key is to treat this solution as an integral part of a layered security architecture, with risk analysis, spectrum measurements, professional installation with verification according to IEEE 299.1, ongoing documentation and regular inspections. Only then does shielding glass realize its full potential and an organization achieves demonstrable compliance with legislative and normative requirements.