https://jaycorp.us/sdr-tempest-research.html

Skip to content (https://jaycorp.us/sdr-tempest-research.html#main)
jaycorp.us (https://jaycorp.us/) / Research

HackRF, RSP1 and the limits of signal research

Published and checked 18 October 2026 · Plaintext (https://jaycorp.us/sdr-tempest-research.txt) · Changelog (https://jaycorp.us/changelog.html)

HackRF One and the original SDRplay RSP1 can help investigate signals, interference and information leaking from electronics. Turning those measurements into claims about a screen, a heartbeat or a mind requires a different experiment for each claim.

Research status · 18 October 2026. Literature review and read-only equipment inventory. The experiments below are proposed; no capture stream was opened, device retuned, signal transmitted or biometric collected for this article. Van Eck phreak mode is not enabled.

Explore other physical interfaces in Beyond radio: programmable instruments, ranked (https://jaycorp.us/instrument-platforms.html), an S+–F guide with model, accessory and evidence limits.

Contents
• Hardware and present state (https://jaycorp.us/sdr-tempest-research.html#hardware)
• Capability matrix (https://jaycorp.us/sdr-tempest-research.html#capabilities)
• Van Eck phreak mode (https://jaycorp.us/sdr-tempest-research.html#van-eck)
• Radios and people (https://jaycorp.us/sdr-tempest-research.html#human-interface)
• Proposed research (https://jaycorp.us/sdr-tempest-research.html#research-plan)
• Evidence and unknowns (https://jaycorp.us/sdr-tempest-research.html#evidence)
• Archive reading (https://jaycorp.us/sdr-tempest-research.html#archive)

Start with the receiver that is actually present

A USB descriptor identifies an attached HackRF One. A second USB identifier matches the original RSP1 documented by the local radio project; its firmware and analogue performance were not interrogated. Installed files include SoapySDR, SoapyMiri and HackRF support. The RSP1 has a live receiver process and an existing radio-service owner. The HackRF ownership file was empty at inspection, which does not reserve the device or prove it is free. Existing services were left running.

Published hardware limits; these are not measurements of this installation

Instrument | Useful limits | Research consequence |

HackRF One | 1 MHz–6 GHz; 2–20 million quadrature samples/second; 8-bit samples; half-duplex. | It can receive or transmit, but cannot continuously do both at once. Tuning across a broad range does not capture that entire range simultaneously. |

Original RSP1 | 10 kHz–2 GHz; receive-only; nominal 12-bit converter and up to 10 MHz visible bandwidth, with mode-dependent effective resolution. | A useful receiver with different limits from an RSP1A or RSP1B. Neither its sampling resolution nor a waterfall is a calibrated field-strength or physiological measurement. |

Sources and retrieval limits: HackRF One specification (https://hackrf.readthedocs.io/en/stable/hackrf_one.html); original RSP1 nominal limits from SDRplay’s November 2016 datasheet, whose legacy URL returned 404 during this check. Those RSP1 figures remain historical specifications, not freshly measured performance. The current manufacturer API page (https://sdrplay.com/hardware-api/) still lists the RSP1, while SDRconnect (https://sdrplay.com/sdrconnect/) explicitly excludes it. Software support and a hardware specification are different evidence.

Two independent radios are not automatically phase coherent. Their clocks, sample timing, gain, antennas and receiver response differ. The HackRF synchronization documentation (https://hackrf.readthedocs.io/en/stable/synchronization_checklist.html) describes explicit requirements even for synchronized HackRF devices. No shared reference or phase calibration has been established for this pair.

A capability matrix with honest boundaries

Feasibility assessment, not a list of deployed features

Question | What the equipment could contribute | What is missing |

Where does an RF signal or noise come from? | Receive-side spectra and comparisons across time and controlled equipment states. | Calibration, antenna characterization and independent attribution. Signal appearance alone cannot identify an operator or purpose. |

Does an owned screen leak its displayed pattern? | A receive-only TEMPEST feasibility experiment using synthetic screen content. | A verified signal path, sufficient bandwidth and held-out reconstruction results. Readable images are not promised. |

Can movement or respiration affect radio signals? | A future controlled sensing study might test changes in a known radio channel. | Known illumination, suitable geometry, timing and reference motion. Receiving a changing signal is not proof that a person caused it. |

Can this pair identify a heartbeat or its owner? | Signal-processing simulations and comparison with published radar methods. | A validated coherent radar chain and consented validation. No heartbeat detection or authentication has been demonstrated here. |

Can it detect emotion or read/write thoughts? | It can feed ordinary audio and visual interfaces. It might carry data from a separate sensor. | No established SDR-only route to arbitrary thought decoding or insertion. Physiological classification is not access to private mental content. |

Can it detect Schumann resonances or portals? | It can help examine RF claims within its actual passband. | Direct measurement near 8 Hz is below both radios’ tuning ranges. No validated portal detector is established by the sources reviewed. |

Van Eck phreak mode: an owned-screen experiment

Here, Van Eck phreak mode names a proposed research mode for measuring unintended electromagnetic emissions from an owned display and its cable. The target would show generated patterns and synthetic text, with no passwords, personal messages or third-party screens. It would be receive-only and explicitly scheduled around the existing radio owner. This article does not install or activate it.

Deep-TEMPEST (2024) (https://arxiv.org/abs/2407.09717) combines complex radio samples with learned image restoration. The paper describes a 50 MS/s sampling limit for the USRP B200-mini-class receiver used in its experiments. That statement is about the paper’s setup, not a general hardware specification or a demonstrated HackRF or RSP1 replication. The authors’ repository (https://github.com/emidan19/deep-tempest) is a research reference; installation and compatibility here remain untested.

The first useful result would be a repeatable relationship between a deliberately changed display pattern and a measured signal. After that, compare classical reconstruction with a learned model. Keep untouched measurements alongside every enhanced output. A language or image model can make noise look plausible: convincing letters do not establish that those letters were displayed.

• Hold out complete recording sessions, fonts and screen contents before training. Adjacent windows from one recording must not appear on both sides of the test split.
• Include random strings, blank screens and display-off controls. Score incorrect reconstruction on the controls as a failure, even when the result looks readable.
• Report character error rate, missed content and false reconstruction, alongside sample rate, hardware configuration and uncertainty. Compare with a no-signal baseline.
• Evaluate a defensive change on the same held-out material. Counter-Screen (2024) (https://research.utwente.nl/en/publications/counter-screen-a-no-hardware-method-to-prevent-eavesdropping-of-v/) studies a display-side mitigation; it is not a universal emissions-security certificate.

How a radio can interact with a human

The most direct useful path is radio samples → demodulated audio or visualization → hearing or vision → interpretation. Sonification can make a pattern easier to notice. A separate, properly acquired EEG signal could enter a validated decoder and produce software feedback. Neither route turns the radio antenna into an EEG electrode. The companion Bada article examines thought reading and writing (https://bada.im/signals-brains-and-evidence.html#read-write), binaural beats and the limits of those analogies.

Cardiac sensing is a radar problem

Radar measures changes in reflected signals associated with movement; it does not receive an ECG broadcast or a thought transmission. Cardiac Scan (https://cse.buffalo.edu/~wenyaoxu/papers/conference/xu-mobicom2017.pdf) used custom, coherent, DC-coupled 2.4 GHz Doppler hardware with separate transmit and receive paths. EQ-Radio (https://eqradio.csail.mit.edu/files/eqradio-paper.pdf) used a custom 5.46–7.25 GHz FMCW system.

The RSP1 cannot directly receive either of those bands. HackRF covers 2.4 GHz but is half-duplex, and its upper limit does not cover EQ-Radio’s full sweep. Combining HackRF transmission with RSP1 reception somewhere in their shared range is a different, unvalidated research design. It would need coherence, timing, isolation, dynamic range and appropriate safety assessment; it is not physically ruled out merely because it is below 2 GHz. No such transmitter experiment is proposed for execution here.

Purpose-built radar illustrates the missing engineering: TI’s IWR6843 (https://www.ti.com/product/IWR6843) integrates 60–64 GHz radar functions and multiple channels. TI also demonstrates vital-sign measurement through fine-motion phase sensing (https://www.ti.com/video/5428037798001). These are examples of a different hardware class, not a purchase recommendation or proof of identity authentication.

A 2018 Wi-Fi study (https://personal.stevens.edu/~ychen6/papers/Monitoring%20Vital%20Signs%20and%20Postures%20During%20Sleep%20Using%20WiFi%20Signals.pdf) used an Intel 5300 channel-state-information receiver and an access point to study six participants. Fine-grained channel state information (CSI) is different from signal-strength bars or an SDR waterfall. The laptop’s ability to expose suitable CSI has not been established.

A heartbeat estimate also does not establish a unique, authenticated identity. The companion analysis (https://bada.im/signals-brains-and-evidence.html#cardiac-identity) separates pilot biometric results, emotion labels and the security requirements of a real login. No physiological monitoring or password mechanism has been implemented.

Useful hardware, with a separate job for each instrument

Proposed comparisons only; nothing purchased or enrolled. Begin with the question being measured. An authentication device, an ECG reference and a radar are not substitutes for one another.

Candidates for a separately approved design; compatibility and validation remain to be tested

Candidate | Role | Limit |

Two FIDO2 security keys (https://www.yubico.com/products/) | A primary key and a separately stored recovery key. Security Key by Yubico is one family; YubiKey Bio adds a local fingerprint-verification option. | A product choice still needs platform and recovery checks. No credentials have been provisioned. |

TI IWR6843ISK (https://www.ti.com/tool/IWR6843ISK) | A 60–64 GHz radar research board with four receive and three transmit channels; USB access to processed data. | Raw ADC capture needs an additional DCA1000 board. It is not an identity product, and the present SDRs do not replace it. |

Polar H10 (https://github.com/polarofficial/polar-ble-sdk/blob/master/documentation/products/PolarH10.md) | A contact ECG reference for a future consented comparison of cardiac timing. | Electrical cardiac measurements differ from reflected mechanical motion. Neither alone establishes secure identity. |

OpenBCI Cyton and appropriate electrodes (https://docs.openbci.com/Cyton/CytonSpecs/) | Separate EEG acquisition and neurofeedback research. | Electrode setup, artifacts and task validation matter. It is not an arbitrary thought decoder or an automatic login system. |

The proposed authentication design separates presence, identity and intent (https://bada.im/signals-brains-and-evidence.html#authentication). Optional radar or physiological context may request reauthentication or pause a session; it must not silently grant access. A passkey or security key establishes credential control, and sensitive AI actions still require explicit approval. Local minimal processing, a non-biometric fallback and recovery are part of the design, which remains unimplemented.

Drunvalo-linked Merkaba or light-body teaching is discussed as spiritual framing on Bada (https://bada.im/signals-brains-and-evidence.html#light-bodies). No measurable RF identity or light-body authentication capability has been established here.

Proposed work that can produce useful negative results

• Start offline. Use synthetic signals and published methods with clear data rights. Compare a periodogram or other classical detector with a small learned classifier at the same false-alarm rate. A model that only recognizes the receiver or the recording session has not learned the intended signal class.

• Document the measurement. A future authorized recording should carry instrument, antenna, clock, gain, sample-rate, timing, consent and processing provenance. SigMF (https://github.com/sigmf/SigMF) provides a metadata format; metadata alone does not validate the observation. TorchSig (https://github.com/TorchDSP/torchsig) is one candidate for synthetic impairments, not a tested local dependency.

• Test transfer. Split by device and day before windowing. Compare receivers on an owned, controlled source only after their differing passbands and gains are accounted for. Keep an “unknown” outcome instead of forcing every signal into a familiar label.

• Control ordinary explanations. For HF noise, log permitted equipment-state changes and repeat the comparison. Receiver spurs, overload and local electronics can resemble external transmissions. ITU-R P.372-18 (2026) (https://www.itu.int/dms_pubrec/itu-r/rec/p/R-REC-P.372-18-202609-I!!SUM-HTM-E.htm) covers natural and human-made radio noise; a spectral shape by itself does not establish a Russian, intelligence or biological origin.

• Keep research separate from account access. Evaluate cardiac algorithms on appropriately licensed existing data or simulations first. Any future human study needs a separate consent, acquisition and review plan. Keep actual access on a passkey or security key; an experimental biometric must not silently become the login gate.
The useful AI contribution is reproducible analysis, error accounting and hypothesis comparison. “Dimensional root access” can remain a literary name for questioning a model of the world. It is not a radio command, a measured physical capability or a result of this project.

Claim and evidence ledger

What would justify the next claim?

Claim | Evidence class today | Remaining gap |

The two radios are attached | Read-only USB identifiers, process metadata and local project documentation, checked 18 October 2026. | No calibration, device interrogation, antenna assessment or new acquisition. |

An owned screen is recoverable here | Published work on other equipment; proposed local experiment. | Local raw evidence, controls and held-out reconstruction scores. |

Nearby cardiac motion can identify someone here | Published custom-radar pilots; hardware mismatch documented above. | Validated sensing chain, cross-day testing and an authentication threat model. |

A near-8-Hz pattern is a Schumann measurement | NASA describes lightning-driven resonances near 8 Hz (https://svs.gsfc.nasa.gov/10891). | A suitable low-frequency instrument. An 8-Hz modulation envelope after demodulation is not a direct 8-Hz field measurement; frequency overlap with an EEG band does not establish coupling. |

RF writes thoughts or opens a portal | No validated method in the reviewed sources. Fiction and historical investigation are discussed separately on Bada. | A defined measurable prediction and independently replicated evidence; a waterfall or compelling model output is insufficient. |

RF exposure can interact physically with tissue. That does not establish semantic instruction decoding, and a transmitter’s tuning range does not establish selective neural control. ICNIRP’s RF assessment (https://www.icnirp.org/en/frequencies/radiofrequency/index.html) discusses thermal interaction and small EEG findings whose biological meaning is unclear. This note provides no human-exposure protocol or medical claim.

Read the history without borrowing its conclusions

Richard Thieme’s Mind Games (https://thiemeworks.com/words/books/mind-games/) and Neal Stephenson’s Snow Crash (https://www.nealstephenson.com/snow-crash.html) offer literary ways to explore perception, identity and information. Bada develops that “root access” metaphor (https://bada.im/signals-brains-and-evidence.html#root-access) while keeping it separate from laboratory evidence.

• Electromagnetic Threats for Information Security (https://aol.pm/conferences/records/ccc-a39634b4-d220-4c84-bf5a-e52c375827c5.html) — a route into the historical conference catalog.
• Blinkenlights, friend or foe (https://aol.pm/conferences/records/ccc-95099b1c-9374-4dbe-89b3-83bab07a4188.html) — a side-channel history record.
• Software Defined Radio (https://aol.pm/conferences/records/ccc-5ea04767-ac2f-49f0-8525-906b548777d8.html) — an SDR talk record.
• Foundations (https://aol.pm/foundations.html), hacker and phreak myths (https://aol.pm/myths.html) and techniques and evidence (https://aol.pm/evidence-history.html) — methods, culture and source discipline.
These links are catalog entries and original historical commentary. They are not reviewed transcripts, local compatibility tests or endorsements. The proposed work here requires its own evidence.

Original analysis with linked sources. Research proposals are explicitly labeled; no deployment or clinical validation is implied. Disclaimer (https://jaycorp.us/disclaimer.html) · jaycorp.us (https://jaycorp.us/) · Changelog (https://jaycorp.us/changelog.html)