Spy radio
Burst encoders
• • • Donate • • •
   Click for homepage
Hagelin M-209
Tactical mechanical cipher machine

The M-209 was a light-weight portable hand-operated pin & lug mechanical cipher machine, developed by Hagelin in Sweden for the US Army, as the successor to the M-94 hand cipher. The M-209 was used by the US Army during WWII and for a long time thereafter. The machine is also known as C-38 (Hagelin) and CSP-1500 (US Navy) and is compatible with the motorized BC-38. During WWII, the M-209 was known by German cryptanalysts as AM-1 (American Machine #1).

The image on the right shows a typical M-209 machine. The 6 coding wheels are on the front right and protrude the top lid of the machine.

Text is entered one letter at a time, by setting the alphabet ring at the left to the desired position and turning the black knob at the right one full revolution, until a letter is printed on a paper tape at the left, by the built-in printer.

One of the strongest points of the M-209 is that it is a purely mechanical machine that needs no electricity or any other power source to operate.
M-209 opened and ready for use

The cryptographic strength of the machine was pretty good for its time, but was not perfect. As of early 1943, it was assumed that German codebreakers were able to break an M-209 message in less than 4 hours. 1 Nevertheless, it was considered sufficiently secure for tactical messages which, due to their nature, would be meaningless after several hours. This is why the M-209 was later also used in the Korean War. The M-209 was succeeded in 1952 by the C-52 and CX-52.

  1. Although the Germans occasionally succeeded in breaking an M-209 intercept in about 4 hours, it generally took much longer than that, and was only possible if messages had been received in depth. 2 It typically took them several days or even weeks. More...
  2. In depth means that two or more messages have been intercepted that were created on the same key (which means identical internal and external settings of the machine).

M-209 opened and ready for use The tools of the M-209 stored in the top lid Typical M-209 setup
Approx. 140,000 M-209 machines were built. Although Hagelin would generally build his own machines, the M-209 was produced in the US by LC Smith & Co, in Syracuse, New York (USA), under licence 1 from Hagelin [1]. Three different versions of the M-209 are known:

Apart from some manufacturing differences, described in more detail by Nick Gessler [2], these machines are all compatible. After WWII, Hagelin produced improved versions of the M-209 design, such as the C-446, the C-52 and the later CX-52.

  1. In has since become known, from documents released by the NSA in 2014 [7], that Hagelin had sold the patent rights of the M-209 to the US Army at the beginning of WWII. As part of the deal, Hagelin's company had obtained a royalty-free reproduction right of the machine. More...

The image on the right shows a typical M-209-A machine, built by LC Smith Corona Typewriters Inc., under licence from the US Army.

The serial number plate on the case says that it was supplied by the Hagelin Cryptograph Company in New Milford, Connecticut (USA). The name Smith Corona is present inside the top lid of the case. More pictures of this machine are available below.
M-209-A opened and ready for use

M-209-A opened and ready for use The closed unit The interior of the M-209-A, seen from the right Close-up of the cage of the M-209-A. Also showing part of the pin-wheels. The interior of the M-209-A, seen from the left. Close-up of the printer Close-up of the serial number plate of the M-209-A The serial number plate mounted on top of the cover of the M-209-A
The M-209-B is identical to the M-209-A, except for some minor production differences. In most cases these are simplifications in the manufacturing process. The differences are described in more detail by Nick Gessler [2] on his website.

The image on the right shows a typical M-209-B unit in mint condition. It came complete with the original canvas carrying bag, the instruction booklet, all accessories and an empty paper roll. The name of the manufacturer, Smith Corona, is printed on the inside of the top cover.

M-209 opened and ready for use The tools of the M-209 stored in the top lid Serial number plate

The M-209 was usually stored inside a canvas carrying bag (see below), together with paper rolls, manual and a message book. For simple maintenance of the machine in the field, some tools were stored inside the top lid of the case. Of the surviving machines, one or more of these tools are often missing. The top lid also acts as the paper tape holder.

The image on the right shows the inside of the top lid of a typical M-209 machine. At the center is the paper tape holder, with its paper guided directly to the printing mechanism on the left of the machine. Four maintenance tools are stored around the paper tape.

At the right is a pair of tweezers, used for feeding the paper through the printer and removing blocked paper. At the left is a yellow screwdriver and two small containers (tubes) hidden in the leftmost corners of the cover. They contain oil (O) and ink (I).
The tools of the M-209 stored in the top lid

Both containers can be opened by unscrewing the cap. The oil-tube has a needle attached to its cap, allowing oil to be applied to the mechanism, one drop at a time. When maintaining a machine, one should be careful not to use WD-40. As it is wax rather than oil, it tends to block the machine over time. Use synthetic motor oil (15W40) instead.

Blue or purple ink was used with the M-209. The (I)-tube usually contained a number of spare pre-inked rollers. If you want to re-ink the print roller, always use stamp-ink. It dries only when printed on paper, and prevents the ink roller from drying up.

The tools of the M-209 stored in the top lid The four tools that are usually stored inside the top cover Close-up of the tip of the screwdriver Ink container Spare ink rolls stored inside the ink container Oil container Taking oil fro the container Taking oil from the container

Carrying Bag
For the M-209, a military-grade canvas bag was available, allowing it to be used under harsh conditions. It was usually supplied with two straps: a short one and a long one. The short one allowed the canvas bag to be attached to the soldier's webbing. More about the long one below.

The canvas bag has several compartments. The largest compartment if for the M-209 machine itself. It is closed with a large flap. On the front of the bag is a pocket for storage of one or two spare paper rolls.

Right behind the paper-pocket, is a slightly larger pocket with space for a message book such as the M-210 (see below). It was also used to store the user instruction booklet. At the right side is a narrow pocket for storing a pencil. The image on the right shows a typical M-209 setup.
Typical M-209 setup

The bag was also supplied with a long canvas strap. Although it was often used to carry the M-209 on the sholder, it was intended for strapping the machine to the knee of the operator. This way, the M-209 could be operated aboard a vehicle. The M-209 would be mounted on the knee, whilst both ends of the strap were attached to the bottom of the machine. The strap would then run under the foot of the operator, so that sufficient pressure could be used to keep the machine in place.

M-209 canvas carrying bag All items packed in the canvas carrying bag Close-up of canvas bag with items Typical M-209 setup

M-210 Message Book
This small message book was packed with the M-209 inside a pocket of the canvas carrying bag. It was used to write down a ciphered message on a page of the book. A thin carbon sheet is used to make an immediate copy on very thin paper.

Once a message was enciphered, it could be handed to a radio operator for subsequent transmission via morse code or telegraphy. Alternatively, the thin duplicate of the message could be folded down to fit a small capsule that was attached to the leg of a pigeon.

Two slightly different variants of the message book are known, with the only difference that the pages from the M-210 book are slightly more robust than the pages from the M-210-A book. The latter is more suitable for mailing via pigeon.

Typical M-209 setup

The following stamps and markings may be found on M-209 machines:

Stamp Meaning
SC Source Control
SCD Source Control Drawing (or Source Control Document)
CACH Manufacturer's code for Smith-Corona (the US manufacturer)

Close-up of the serial number plate of the M-209-A Serial number plate SC stamp The manufacturer's name Smith Corona printed inside the top cover
The C-38 was developed by Boris Hagelin around 1938. In 1940, it was adopted by the US Army who renamed it M-209. The design was simplified and the mechanics were made more robust, before the machine went into mass production in the United States in 1942. The initial price for a single machine was US$ 64. It was first used during the invasion of Africa in November 1942. Licensee Smith Corona built about 140,000 units before it was discontinued in the early 1960s.

Although it is the general understanding that the M-209 design was owned by Boris Hagelin and that he licenced it to the US Army, papers released by the NSA in 2014 show that it was in fact the other way around [7]. In May 1940, with the M-209 designs in his luggage, Hagelin 'escaped' to the US, where he transferred the royalty-free patent rights to the US Army for US$ 3,023,410.

 Read the fully story of the secret Hagelin/NSA deal

The cryptographic strength of the M-209 was pretty good for its time, but it was by no means perfect. During WWII, the German Intercept Service managed to break M-209 messages on a regular basis, exploiting weaknesses in the system, such as the fact that numbers had to be spelled out in full. As messages were generally 1000 to 4000 characters long, the Germans were sometimes able to break an M-209 message within a few hours in 1943 and 1944 [4], but only if messages had been received in depth. In practice it commonly took several days or even weeks.

In [3], Dennis Richie describes how he collaborated in the 1970s with Jim Reeds and Bob Morris, on a ciphertext-only attack on the M-209. It allowed them to solve messages of 2000-2500 characters. After discussions with the NSA, it was decided not to publish the details of their investigations at the time, as the principle was applicable to machines that were still in use.

The document below was used as a training manual for Dutch cryptanalists, probably during the 1970s. It describes the Hagelin M-209 and the C-446A in great detail and also discusses the machine's cryptanalysis and methods for its attack. The document is in Dutch and was released for publication by the Dutch school for Military Intelligence (DIVI) in 2011 [5].

Although the M-209 didn't provide absolute security, it was considered sufficient for tactical field messages, such as information about troup movements and artiliary during the Africa Campaign in 1942. For secure high-level messages, the Americans used SIGABA which, as far as we know, was not compromized. A detailed description of the cryptanalysis of the M-209 is available from Jean-François Bouchaudy [6]. During his M-209 challenge in 2012, he discovered that a single message of less than 800 characters still can't be broken today, not even with super computers.

 Detailed cryptanalysis (off-site)

A very good M-209 simulator has been created by Dirk Rijmenants in Belgium. It is both graphically and functionally an accurate representation of the M-209 and it is available directly from his website.

The image on the right shows a screenshot of the M-209 running on Windows. It can be used on Windows 98/ME/2000/XP/Vista and Windows 7, and it also runs under emulation on Linux (WINE) and Mac (Parallels Desktop).

 Download (off-site)

A command-line M-209 simulator can be downloaded here. It is written by Mark Green in C++ and runs on UNIX/Mac.
Click here to download the M-209 simulator from Dirk Rijmenants website

  1. War Department, Technical Manual, Converter M-209
    Part of David Stroud Collection. Scanned by Nick Spark.
    TM 11-380. 27 April 1942.

  2. SMID, C-446A en M-209 Beschrijving en Analyse
    Descryption and analysis of the Hagelin C-446A and M-209 (Dutch).
    Dutch Department of Defence, Military Intelligence School.
  1. Crypto AG (Hagelin), Crypto Hauszeitung Nr. 11 (German)
    100 Jahre Boris Hagelin 1892-1992. Die Geschichte des Firmagründers Crypto AG 6301 ZUG. History of Boris Hagelin. September 1992. p. 48-53.

  2. Nick Gessler, Differences between M-209 models
    Details useful in identifying the various models and subtypes.

  3. Dennis Richie, Dabbling in the Cryptographic World - A Story
    Date unknown. Updated 5 May 2000. Retrieved November 2011.

  4. Klaus Schmeh, Breaking M-209 during WWII (German)
    Als Deutscher Code-Knacker im Zweiten Weltkrieg.
    Klaus Schmeh. 23 September 2004.

  5. SMID, C-446A en M-209 Beschrijving en Analyse
    Descryption and analysis of the Hagelin C-446A and M-209 (Dutch).
    Dutch Department of Defence, Military Intelligence School.

  6. Jean-François Bouchaudy, M-209 Cryptanalysis
    Retrieved July 2016.

  7. Collection of M-209 patent and license agreements
    A66684. Declassified by NSA on 11 June 2014 (EO 13526).
     More on this subject
Other websites
Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Wednesday 05 August 2009. Last changed: Saturday, 01 July 2017 - 11:25 CET.
Click for homepage