A tamper-evident seal or label shows that someone has opened a case, cover or port. It does not stop them. With a register, photos and regular checks, seals on servers, network equipment and OT controllers give you a simple record of physical access; without those, a seal is just a sticker.
Key points
- Seals record physical access after the fact. They do not prevent it.
- A seal only means something if its serial number and placement are recorded and someone checks them.
- FIPS 140-3 testing calls for tamper-evident seals on some modules from Level 2, and individually identifiable seals at Levels 3 and 4.
- Australia's ISM mentions tamper seals for TOP SECRET cabling, overseas travel devices and high assurance equipment, and tamper-evident packaging for IT and OT deliveries.
- Los Alamos researchers defeated every seal they studied with low-tech methods, so inspector training matters as much as the seal.
How tamper-evident seals and labels work
A seal goes across a join so the cover cannot come off without breaking it. NIST's FIPS 140-2 put it plainly: seals are placed so that they must be broken to attain physical access to what is inside.
Destructible and void materials
Roger Johnston and colleagues in the Vulnerability Assessment Team at Los Alamos National Laboratory describe adhesive label seals as sticky labels that become damaged if removed from what they are stuck to. Frangible seals work the same way: the film, foil or plastic fractures when the item is opened.
Void labels leave a message behind. One FIPS 140-3 security policy published by NIST tells operators that if the word "VOID" appears on a label, it has been tampered with.
Holograms and serial numbers
A holographic layer makes a label harder to copy. The EU Intellectual Property Office notes that holograms cannot be reproduced by colour printers, scanners or cameras, and that checking one needs knowledge of the original. Keep a reference sample or photo so inspectors have something to compare against.
Hard to copy is not the same as showing removal. Johnston's terminology separates anti-counterfeiting tags, where lifting is not a concern, from security tags with tamper-indicating features that reveal lifting attempts.
A unique serial number ties one seal to one device and one record. Without it, someone could open a case and reseal it with a counterfeit or fresh seal of the same design. NIST's FIPS 140-3 implementation guidance says Levels 3 and 4 require individually identifiable seals, which makes a replacement harder to hide.
| Seal type | What it shows | Known weakness |
|---|---|---|
| Destructible (frangible) label | Tears or breaks up when peeled | Los Alamos notes adhesive label seals do not typically provide high levels of security |
| Void label | A message such as "VOID" once disturbed | Fails if it can be lifted and re-applied without a trace; FIPS labs test this with chemical, mechanical and thermal methods |
| Holographic label | An image that is hard to reproduce | Resists copying but does not, on its own, show that a genuine label was lifted |
| Evidence tape over seams | Marks or breaks when a cover is opened | All 28 adhesive tape designs in a 1997 Los Alamos study were defeated |
| Tamper-evident coating or potting | Attempts to probe or reach chips inside a cryptographic module | Evidence only; FIPS 140-2 added tamper detection and response at Levels 3 and 4 |
| Wire, cable, bolt or plastic strap seal | A door, hasp or container has been opened | Every such design in the 1997 study was defeated with low-tech methods |
What a seal can and cannot do
A seal gives evidence after the event. FIPS 140-2 defines tamper evidence as an external indication of an attempt to compromise a module, observable by an operator afterwards. As the Los Alamos team wrote, unlike locks, seals are not meant to prevent physical access, just to record it.
That record only exists once someone looks. The 2003 Los Alamos paper says seals must be inspected before anyone can say whether tampering happened, and that "a seal is no better than the protocols for using it."
A seal also says nothing about the state of the device when it was applied. Seal a board that already carries a swapped part and the seal faithfully protects the swap.
Where standards and government guidance mention seals
FIPS 140-3 and ISO/IEC 19790
FIPS 140-3, published by NIST on 22 March 2019, is based on ISO/IEC 19790:2012, with testing under ISO/IEC 24759:2017. Under that test standard, as quoted in NIST's implementation guidance, doors or removable covers on a multi-chip embedded module at Levels 2 to 4 that lack pick-resistant locks can require tamper-evident seals, "e.g. evidence tape or holographic seals".
Where operators apply the seals, NIST's SP 800-140B Rev. 1 has the security policy state how many seals to place, show placement in numbered photos, explain surface preparation, and name the role that controls unused seals. It gives periodic inspection of seals as an example of an operator action.
The Australian ISM
The September 2026 Information Security Manual mentions seals in several places:
- ISM-1790 and ISM-1791: IT and OT equipment is delivered in a way that keeps its integrity, checked at acceptance. The guidance says such equipment may benefit from tracking and tamper-evident packaging.
- ISM-0195: in shared facilities, uniquely identifiable SCEC-approved tamper-evident seals go on all removable covers of TOP SECRET cable reticulation systems. ISM-0208 lists seal numbers in the cable register.
- ISM-1554: staff travelling to high or extreme risk countries are advised how to apply and inspect tamper seals on mobile devices.
- High assurance IT equipment often carries tamper-evident seals on its external surfaces. The ISM says organisations should limit other labels on it so users can notice changes to the seals, and ISM-0296 requires ASD approval before labelling it.
NIST SP 800-53
In SP 800-53 Rev. 5, the discussion of control PE-3(5) names tamper-detection seals and anti-tamper coatings as anti-tamper technologies. Control SR-10 has organisations inspect components at random, at a set frequency, or on indicators such as packaging changes or staff returning from high-risk travel.
Freight seals: ISO 17712
Cargo security is a useful model. US Customs and Border Protection's CTPAT criteria require container seals that meet the current ISO 17712 standard for high-security seals, plus written procedures, a seal log and a check called VVTT: view, verify the number, tug, twist.
How to run a seal programme
- Control the stock. Buy serialised seals, keep unused ones locked away, and log every seal received and issued. CTPAT restricts seal management to authorised staff.
- Check before you seal. Confirm the device is genuine and configured as approved, since a seal only protects the state it starts with.
- Place seals where entry happens. Cover case joins, chassis screws, blanking plates and unused ports. Juniper's instructions for applying FIPS seals say surfaces must be clean, dry and free of residue, with at least 24 hours for the adhesive to cure.
- Record everything. Log each serial against the asset, location, date and installer, with a numbered photo of every seal. ISM-0336 and ISM-1869 call for IT equipment registers that are maintained and regularly verified.
- Inspect on a schedule and at random. Check on receipt, after any maintenance (ISM-1598), at a fixed interval and without notice. One FIPS 140-3 policy sets checks at least once a month.
- Audit the log. CTPAT requires periodic reconciliation of seal stock against logs, and a review of seal procedures at least once a year.
When a seal is broken
Treat it as a possible incident. CTPAT tells members to retain altered or tampered seals for investigation, document the event and fix the cause. The ISM lists suspected tampering of electronic devices among the incidents to report to ASD.
Take the device out of service until it is checked. The ISM's post-repair check (ISM-1598) is a good model: confirm the equipment retains its approved configuration and has no unauthorised modifications. Then apply a new seal and record the old and new serials together.
Known weaknesses: what the research shows
A 1997 Los Alamos study defeated all 94 seals it examined using rapid, inexpensive, low-tech methods, with a mean defeat time of 4.3 minutes. Seal cost was not a good predictor of security.
By 2003 the team had analysed 213 seals. The fastest attacks averaged 2.7 minutes, with a median of one minute. Their conclusion was that inspectors need hands-on training with examples of attacked seals.
Certification testing has limits too. When labs test seals, NIST's guidance treats an attacker who brings new materials to cover up evidence as out of scope. Real attackers have no such limit.
Where BoardSafe fits
A seal shows whether a case was opened, not what was inside when it closed. BoardSafe covers both. Its scanner checks a circuit board against its original design files, flags parts that are fake, swapped or not in the design, and checks firmware against a known good version, in under 60 seconds per board on site. A passed device then gets a serialised seal across its case join, which anyone opening it, including an insider, has to break.
For what to look for inside the case, see how to detect hardware implants. For the wider picture, read hardware supply chain security in Australia.
Questions people ask
Do tamper-evident seals stop people opening IT equipment?
No. Seals record physical access; they do not prevent it. Los Alamos National Laboratory's Vulnerability Assessment Team wrote that, unlike locks, seals are not meant to prevent physical access, just to record that it occurred. A seal also tells you nothing until someone inspects it and compares its serial number and placement with the record made when it was applied.
Does FIPS 140-3 require tamper-evident seals?
For some modules. FIPS 140-3 is tested under ISO/IEC 24759:2017. NIST's implementation guidance quotes its requirement that doors or removable covers on multi-chip embedded modules at Levels 2 to 4 without pick-resistant locks can need tamper-evident seals, such as evidence tape or holographic seals. At Levels 3 and 4, seals must also be individually identifiable.
What does the Australian ISM say about tamper seals?
The September 2026 ISM calls for uniquely identifiable SCEC-approved tamper-evident seals on removable covers of TOP SECRET cable reticulation systems in shared facilities (ISM-0195). It advises staff travelling to high or extreme risk countries on applying and inspecting tamper seals on mobile devices (ISM-1554), and notes IT and OT equipment may benefit from tamper-evident packaging during delivery.
How often should tamper-evident seals be inspected?
No single interval applies everywhere. NIST SP 800-53 control SR-10 lets organisations inspect at random, at a set frequency, or when indicators appear, such as packaging changes or staff returning from high-risk travel. ISM-1598 calls for inspection after maintenance or repairs, and one FIPS 140-3 security policy sets checks at least once a month.
Can tamper-evident labels be defeated?
Yes. Los Alamos researchers analysed 213 seals and found all of them could be defeated quickly with low-tech methods, at least as conventionally used. The fastest attacks averaged 2.7 minutes, with a median of one minute. The researchers concluded that seal inspectors need hands-on training that includes examples of attacked seals.
Sources
- NIST FIPS 140-3, Security Requirements for Cryptographic Modules
- NIST FIPS 140-2, Security Requirements for Cryptographic Modules (superseded)
- NIST/CCCS Implementation Guidance for FIPS 140-3 and the CMVP (7.3.A Testing Tamper Evident Seals)
- NIST SP 800-140B Rev. 1, CMVP Security Policy Requirements
- NIST CMVP FIPS 140-3 Non-Proprietary Security Policy (TASS Crypto Engine)
- NIST SP 800-53 Rev. 5, Security and Privacy Controls
- ASD Information Security Manual (September 2026)
- Johnston & Garcia, Physical Security and Tamper-Indicating Devices (Los Alamos, 1997)
- Johnston, Tamper-Indicating Seals: Practices, Problems, and Standards (Los Alamos, 2003)
- EUIPO Anti-counterfeiting and anti-piracy technology guide: Security Holograms
- US CBP CTPAT Minimum Security Criteria, Consolidators (October 2021)
- Juniper Networks, Applying Tamper-Evident Seals to the Cryptographic Module