Your network is air-gapped.
Your power lines are not.
Power Line Exfiltration is a peer-reviewed attack technique that steals data through the building wiring you cannot disconnect. Every Bantam product stops it — inherently, without adding a single component.
The threat your network controls don’t see
Air-gapping a network — physically isolating computers from the internet — is the gold standard for protecting the most sensitive systems in government and enterprise IT: election servers, 911 CAD systems, SCADA control rooms, law enforcement records, court data, classified research networks.
But an air gap only severs network connections. It does nothing about the power wiring.
Every switched-mode power supply in every computer, server, and workstation on your floor generates electromagnetic signals as a byproduct of normal operation — transistor switching pulses that modulate current draw on the AC mains. Those signals, which encode information about what the device is doing and what data it is processing, propagate through the building’s electrical conductors: Line, Neutral, and especially Ground.
Ground is the worst leak path. Because safety code requires an uninterrupted return to the electrical panel, any signal that couples onto the ground wire is potentially detectable anywhere the building’s wiring reaches — inside or outside the facility.
An attacker who has planted software on a target device — through a malicious USB drive, a compromised supply chain, or an insider — can instruct that software to modulate CPU utilization in a pattern that encodes data. The resulting current fluctuations on the power lines carry that data out of the facility, silently, while every network monitor, endpoint detection agent, and SIEM shows nothing.
This attack technique was demonstrated and documented in peer-reviewed research beginning in 2018. Researchers at Ben-Gurion University’s Cyber Security Research Center published PowerHammer, showing data exfiltration at up to 1,000 bits per second via an in-room power cord, and at 10 bits per second at the building’s service panel — a rate sufficient to extract a 4,096-bit encryption key in under seven minutes from outside the building. Subsequent research — COVID-bit (2022), PowerBridge (2024), RAMBO (2024) — has demonstrated increasingly accessible collection methods, including commodity smartphones used as receivers.
The attack does not appear in any network log. It generates no SIEM alert. It bypasses endpoint detection. It requires no RF hardware visible to a physical security sweep. And it exploits infrastructure — the power grid — that no organization can disconnect.
Why PLE is not stopped by conventional defenses
Two categories of protection exist for emanation security, and both have significant limitations.
TEMPEST / NSTISSAM-compliant filtering
Military-grade TEMPEST filters (NSTISSAM TEMPEST/1-92, NATO SDIP-27) achieve the attenuation levels required to suppress conducted emanations at the power inlet of classified facilities. These solutions work, but they were designed for SCIFs and classified military installations. They are specification-order products, available only through classified-defense channels, priced in the hundreds to thousands of dollars per outlet, and require SCIF-grade installation. They are not commercially accessible to state and local government agencies, healthcare organizations, financial institutions, or most defense contractors operating at CUI rather than classified levels.
Standard EMI / line filters and conventional surge protectors
Commercial EMI filters and surge protectors address conducted emissions in the 150 kHz–30 MHz band — the CISPR 22 / FCC Part 15 compliance window. PowerHammer and related attacks operate deliberately below this band, primarily in the 0–60 kHz range, where commercial filters provide little to no attenuation. A device that is FCC-compliant and CISPR-certified still leaks the signals a PLE attacker targets. Conventional surge protectors — which rely on MOV components wired in parallel on Line and Neutral, dumping surge energy to Ground — make this problem worse by actively propagating signals onto the ground path.
A compliant EMI filter does not stop PLE. A conventional surge protector actively worsens it by using Ground as a dump path.
How Bantam Clean Power stops it — and why it was always going to
Bantam’s patented Leveler Technology was designed in 1996 to solve a different problem: power conditioning for switched-mode power supplies, which are current-sensitive rather than voltage-sensitive and which require protection on all three conductors, including Ground. The circuit places inductors in series on Line, Neutral, and Ground simultaneously, applying selective inductance and performing magnetic decoupling of adjacent wires.
The same physics that makes this circuit an exceptional power conditioner also makes it an effective PLE suppressor — not by design intent, but by the nature of the inductor’s operation. An inductor in series on a conductor reshapes the current waveform passing through it, reducing amplitude at frequencies above its designed passband and preventing the coupling of high-frequency signals between adjacent wires. The switching-pulse signals that a PLE attacker harvests are, in circuit terms, precisely the unwanted high-frequency current components that the Bantam circuit was designed to suppress.
This means three things with direct procurement implications.
- PLE prevention is not a feature — it is an inherent property
Every Bantam Citadel, Vanguard, and Tempest product has delivered PLE suppression since the first unit shipped. No firmware update, no additional module, no incremental cost. The PLE capability is not added to the power conditioner — it is the same circuit, evaluated for both purposes.
- Bantam protects Ground — conventional products do not
PLE’s most dangerous exfiltration path is the ground wire, because safety codes require it to be an uninterrupted path back to the building panel. Conventional surge protectors treat Ground as a dump path for surge energy — which propagates PLE signals rather than suppressing them. Bantam filters Ground in series, the same as Line and Neutral, and does so bi-directionally: preventing signals from entering connected devices and preventing signals generated by connected devices from reaching the building wiring.
- One SKU, one installation, two functions
Deploying a Bantam product in front of a sensitive workstation, server, or SCADA HMI simultaneously provides UL- or MET-certified surge protection, third-party-verified power conditioning, and PLE signal suppression — from a single rack unit or outlet-level device, at commercial pricing, through standard distribution channels. No classified procurement pathway. No SCIF-grade installation requirements.
How Bantam compares
|
Conventional approach |
Bantam Clean Power Technology |
|
Parallel MOV diversion to Ground — actively propagates PLE signals |
Series inductors on all three conductors — suppresses PLE signals on Line, Neutral, and Ground |
|
Filters Line and Neutral only; Ground is the dump path |
Filters Line, Neutral, and Ground bi-directionally |
|
Standard EMI compliance (150 kHz–30 MHz) does not address PowerHammer band (0–60 kHz) |
Inductor-based suppression operates from below fundamental frequency upward |
|
No auditable PLE claim — no published mechanism for emanation control |
Patented circuit with published mechanism; PLE suppression is a documented byproduct of the conditioning architecture |
|
TEMPEST-certified alternatives: classified-channel procurement, $hundreds–$thousands per outlet, SCIF installation |
Commercial availability: Amazon, Firefold, Menards, direct; $135–$320 per device; standard electrical install |
Compliance and regulatory mapping
The following table maps Bantam’s PLE suppression capability to relevant standards and mandates affecting government, enterprise, and defense-adjacent buyers.
|
Standard / Control |
Requirement |
How Bantam addresses it |
|
NIST SP 800-53 PE-19 |
Information Leakage — organizations must protect against unintended emanations from information systems |
Series inductors on all three conductors suppress conducted emanations; bi-directional filtering prevents device-generated signals from reaching building wiring |
|
NIST SP 800-53 PE-21 |
Electromagnetic Pulse Protection — systems must be protected against electromagnetic pulse effects |
Inductor-based series filtering provides passive EMI/EMP attenuation on all power conductors |
|
CJIS Security Policy v6.0 §5.9 |
Physical protection of CJI — facilities must protect against emanation-based threats to CJI-processing equipment |
Bantam on CJIS-scope workstations, servers, and terminals provides auditable in-line filtering without classified infrastructure |
|
IRS Publication 1075 |
Safeguards for Federal Tax Information — physical safeguards must prevent unauthorized access to FTI through all technical means |
Ground-path filtering prevents FTI-processing devices from leaking process-indicative signals to shared building infrastructure |
|
CMMC Level 2 / DFARS 252.204-7012 |
CUI protection — defense contractors must implement NIST 800-171, which references NIST 800-53 PE controls |
PE-19 implementation via Bantam is auditable, commercially procured, and does not require classified-channel approval |
|
HIPAA Physical Safeguards §164.310 |
Facility access controls and workstation security — covered entities must protect ePHI from unauthorized physical access |
Bantam filtering prevents ePHI-processing workstations from leaking operational signatures through shared electrical infrastructure |
Bantam products with built-in PLE suppression
Every current Bantam product delivers PLE suppression as an inherent property of the circuit.
Citadel Series — rack and desktop power conditioner
1U rack-mount or desktop form factor. 8 outlets (2 front IEC C10, 6 rear NEMA). 12A, 1440 VA (120V) or 2880 VA (230V). LCD real-time metering of voltage, current, power factor, harmonics, and surge count. UL File E521973. Designed for server rooms, network closets, dispatch centers, and control rooms requiring visible power quality confirmation alongside PLE protection.
Vanguard PP18004A — outlet-level power conditioner
4-outlet, 15A, 1800 VA. Point-of-use protection for individual workstations, terminals, and sensitive peripherals. Compact form factor for deployment at the device level in environments where rack infrastructure is not present.
Vanguard PP300 Series — compact 3A conditioner
2- and 4-outlet, 3A, 360 VA. Low-load applications: VoIP phones, IoT nodes, security cameras, access control panels, and other network-connected infrastructure at the edge.
Tempest SA3600A — OEM power conditioning module
Designed for integration into third-party enclosures: UPS systems, PDUs, custom rackmount equipment, PLC cabinets, and industrial control panels. UL-listed. Thermally stable to under 90°C at full load. The first commercial power conditioning module certified and marketed with PLE suppression as a named capability, and the basis for the Vertiv Geist PLE115 rack PDU.