Click for homepage
Hagelin
USA
Pin-wheel
  
C-52 →
C-446 →
← C-37
  
M-209   CSP-1500
Pin-and-lug cipher machine

M-209 was a light-weight portable pin-and-lug cipher machine, developed at the beginning of World War II by Boris Hagelin of AB Cryptoteknik in Stockholm (Sweden), and manufactured by Smith & Corona in Syracuse (New York, USA). The machine is designated CSP-1500 by the US Navy and is the US military variant of the C-38, which in turn is an improved version of the C-36 and C-37. A compatible motorised version – with keyboard – is known as BC-38 (later: BC-543). During WWII, the M-209 was known by German cryptanalysts as AM-1 (American Machine #1).

The machine measures 178 x 140 x 83 mm – about the size of a lunch box – and weights 2700 grams. It has six adjustable cipher wheels with movable lugs, that protrude the top lid. The wheels, pins and lugs are used to set the initial state of the machine, also known as the key.

The machine does not require electricity. Text is entered letter-by-letter, by setting the alphabet ring at the left to the desired input letter and turning the black knob at the right by one full revolution. The output letter is then printed on a narrow paper strip by the printer at the left side.
  
M-209 cipher machine

The cryptographic strength of the machine was reasonable for its time, but was not perfect. As of early 1943, it was assumed that German codebreakers were able to break an M-209 message in less than 4 hours. 1 Nevertheless, it was considered sufficiently secure for tactical messages which, due to their nature, would be meaningless after several hours. This is why the M-209 was later also used in the Korean War. The M-209 was succeeded in 1952 by the C-52 and CX-52.

  1. Although the Germans occasionally succeeded in breaking an M-209 intercept in about 4 hours, it generally took much longer than that, and was only possible if messages had been received in depth. 2 It typically took them several days or even weeks. More...
  2. In depth means that two or more messages have been intercepted that were created on the same key (which means identical internal and external settings of the machine).

M-209 with cover closed M-209 - frontal view M-209 cipher machine Advance knob Paper feed and letter selector Documents stowed in pocket of canvas bag M-209 and accessories M-209 seen from the front
A
×
A
1 / 8
M-209 with cover closed
A
2 / 8
M-209 - frontal view
A
3 / 8
M-209 cipher machine
A
4 / 8
Advance knob
A
5 / 8
Paper feed and letter selector
A
6 / 8
Documents stowed in pocket of canvas bag
A
7 / 8
M-209 and accessories
A
8 / 8
M-209 seen from the front

Features
Click to see more


Models
Approx. 140,000 M-209 machines were built. Although Hagelin would generally build his own machines, the M-209 was produced in the US by LC Smith & Co, in Syracuse, New York (USA), under licence 1 from Hagelin [1]. Three different versions of the M-209 are known:

Apart from some manufacturing differences — described in more detail by Nick Gessler [2] — these machines are all compatible. After WWII, Hagelin produced improved versions of the M-209 design, such as the C-443 and C-446, and later the C-52 and the much improved CX-52.

  1. In has since become known, from documents released by the NSA in 2014 [7], that Hagelin had sold the patent rights of the M-209 to the US Army at the beginning of WWII. As part of the deal, Hagelin's company had obtained a royalty-free reproduction right of the machine. More...

M-209-A
The image on the right shows a typical M-209-A machine, built by LC Smith Corona Typewriters Inc., under licence from the US Army.

Acdording to the serial number plate, it was supplied by the Hagelin Cryptograph Company in New Milford, Connecticut (USA). The name Smith Corona is present inside the cover. More pictures of this machine are available below.
  
M-209-A opened and ready for use

M-209-B
The M-209B is identical to the M-209A, except for some minor production differences. In most cases these are simplifications in manufacturing, described in more detail by Nick Gessler [2].

The image on the right shows a typical M-209-B unit in mint condition. It came complete with the original canvas carrying bag, the instruction booklet, all accessories and an empty paper reel. The name of the manufacturer, Smith Corona, is printed on the inside of the cover.
  
M0209 interior

M-209-A opened and ready for use The closed unit The interior of the M-209-A, seen from the right Close-up of the cage of the M-209-A. Also showing part of the pin-wheels. The interior of the M-209-A, seen from the left. Close-up of the printer Close-up of the serial number plate of the M-209-A The serial number plate mounted on top of the cover of the M-209-A
M-209 with cover closed Prnting mechanism Mechanism M-209 cipher machine M0209 interior Manufacturer's name printed inside top cover Top cover with maintenance tools Serial number plate
B
×
B
1 / 16
M-209-A opened and ready for use
B
2 / 16
The closed unit
B
3 / 16
The interior of the M-209-A, seen from the right
B
4 / 16
Close-up of the cage of the M-209-A. Also showing part of the pin-wheels.
B
5 / 16
The interior of the M-209-A, seen from the left.
B
6 / 16
Close-up of the printer
B
7 / 16
Close-up of the serial number plate of the M-209-A
B
8 / 16
The serial number plate mounted on top of the cover of the M-209-A
B
9 / 16
M-209 with cover closed
B
10 / 16
Prnting mechanism
B
11 / 16
Mechanism
B
12 / 16
M-209 cipher machine
B
13 / 16
M0209 interior
B
14 / 16
Manufacturer's name printed inside top cover
B
15 / 16
Top cover with maintenance tools
B
16 / 16
Serial number plate




M-209 with accessories

Parts
Canvas storage and transport bag
Bag
M-209 cipher machine Maintenance tools Message book Pigeon capsules Pigeaon cage (carton) Operating instructions paper clips
Paper rolls (gummed) Short and long webbing straps
Carrying Bag
The M-209 was usually stowed in the canvas bag shown in the image on the right It has several comparments for holding the machine, a pencil, a message book, spare paper reels and the instruction booklet.

A long canvas strap was supplied to allow the bag to be attached to a soldier's webbing. In addition: a short canvas strap was supplied for fitting the machine to a soldier's knee.
  
Canvas carrying bag for M-209 cipher machine

M-209
The actual M-209 cipher machine was housed in a metal olive drab green enclosure. It was manufactured by Smith & Corona after the technical drawing that were provided by Hagelin.

Over the years, small manufacturing changes were made, but these had no effect on the operation or compatibility of the machine. As far as we knowm the machines are designated M-209, M-209A and M-209B.
  
M-209 with cover closed

Maintenance tools
Each machine came with a set of maintenance tools and spares, that were stowed inside the metal cover. Apart from the paper reel, the cover holds a pair of tweezers, a screwdriver, an oil tube (marked 'O') and a tube with spare ink rollers (marked 'I').

Inside the lid of the oil tube is a needle that can be used to apply oil to the mechanism. If it is empty, use a synthetic motor oil, like 15W40, as a replacement. Never use WD-50. 1
  
Top cover with maintenance tools

  1. Although WD-40 is sold as a lubricant, it is fact a water displacer (WD) that will cause the moving parts of the machine to bind when it is not operated frequently.

Message Book   M-210
This small message book was used for writing down encrypted or decrypted messages. It is small enough to be stowed inside one of the pockets of the canvas carrying bag.

Carbon paper is used to create a duplicate when writing down a message. The duplicate page is thinner than the primary one, so that it can be fitted inside a pigeon capsule more easily. Note that the duplicate pages of the M-210A book are thinner that those of an M-210 book.
  
M-210 message book for M-209

Pigeon capsules
Once a message was encrypted, it could be handed to a radio operator for subsequent transmission via morse code or telegraphy. Alternatively, the thin duplicate of the message could be folded down to fit a small capsule that could be attached to the leg of a pigeon.

Note that the duplicate pages of an M-210A book are slightly thinner than those of a standard M-210 book, making them more suitable for transport in a pigeon capsule.
  
Click to see more

Pigeon cage
During WWII, British pilots took one or two pigeons in the cockpit on each flight, so that they were able to send an (encrypted) message home after a crash. The message was then folded and stored in a capsule and attached to the leg of the pigeon, which was then released.

The carton box shown in the image on the right was used, probably during the Vietnam War, as a cheap and lightweight alternative for a wooden pigeon cage.
  
Carton pigeon cage

Operating instruction
The M-209 came with a small booklet with operating instructions, that can be fitted in one of the pockets of the canvas carring bag. The original TM 11-380 manual was issued in 1942, and provides operating and maintenance instructions.

A more elaborate version was issued just after WWII, in May 1947. The image on the right shows both versions.

 Download 1942 instruction manual

  
Manuals

Paper retaining clips
The four black steel clips, shown in the image on the right, were supplied with each machine. They were used to attach a piece of plaintext to the edge of the metal cover, so that the operator did not have to hold it in his hand, whilst encrypting.

In practice, only one or two clips were used. The others were supplied as spares.
  
Paper retaining clips

Gummed paper
When encrypting (or decrypting) a message, the output letter is printed onto a narrow paper strip. A suitable paper roll should be installed inside the cover (behind a metal retainer) and fed into the printer at the left.

Two types of paper were available: regular paper (shown here) and pre-gummed paper. By using a moisturiser, the gummed paper could be glued directly to a message form, in the same way as an old telegram.
  
Paper roll

Canvas straps
Two different canvas straps were available for carrying the canvas storage bag, or for attaching it to a soldier's webbing: a short one, that can be used for carrying the bag in the hand, and a long one, that allows it to be hung from the shoulder.

In some cases, both straps were provided and attached at the same time, as shown in the image on the right. Furthermore, an adjustable strap could be used to fit the machine on the operator's upper leg, so that it can be operated from within a driving vehicle.
  
Carrying straps

Canvas carrying bag for M-209 cipher machine Canvas bag with short carrying strap Carrying straps Short canvas strap Long canvas strip Manuals Technical manual 1942 Instruction manual
Documents stowed in pocket of canvas bag Paper roll Pigeaon capsules for N-209 messages Paper retaining clips Paper retaining clip Top cover with maintenance tools Tools stowed inside top cover
The four tools that are usually stored inside the top cover Close-up of the tip of the screwdriver Ink container Spare ink rolls stored inside the ink container Oil container Taking oil fro the container Taking oil from the container Carton pigeon cage
C
×
C
1 / 24
Canvas carrying bag for M-209 cipher machine
C
2 / 24
Canvas bag with short carrying strap
C
3 / 24
Carrying straps
C
4 / 24
Short canvas strap
C
5 / 24
Long canvas strip
C
6 / 24
Manuals
C
7 / 24
Technical manual 1942
C
8 / 24
Instruction manual
C
9 / 24
Documents stowed in pocket of canvas bag
C
10 / 24
Paper roll
C
11 / 24
Pigeaon capsules for N-209 messages
C
12 / 24
12 / 24
C
13 / 24
Paper retaining clips
C
14 / 24
Paper retaining clip
C
15 / 24
Top cover with maintenance tools
C
16 / 24
Tools stowed inside top cover
C
17 / 24
The four tools that are usually stored inside the top cover
C
18 / 24
Close-up of the tip of the screwdriver
C
19 / 24
Ink container
C
20 / 24
Spare ink rolls stored inside the ink container
C
21 / 24
Oil container
C
22 / 24
Taking oil fro the container
C
23 / 24
Taking oil from the container
C
24 / 24
Carton pigeon cage

Markings
The following stamps and markings may be found on M-209 machines:

  • SC
    Source Control
  • SCD
    Source Control Drawing (or Source Control Document)
  • CACH
    Manufacturer's code for Smith-Corona (the US manufacturer)
Close-up of the serial number plate of the M-209-A Serial number plate SC stamp The manufacturer's name Smith Corona printed inside the top cover Manufacturer's name printed inside top cover
D
×
D
1 / 5
Close-up of the serial number plate of the M-209-A
D
2 / 5
Serial number plate
D
3 / 5
SC stamp
D
4 / 5
The manufacturer's name Smith Corona printed inside the top cover
D
5 / 5
Manufacturer's name printed inside top cover

History
In 1935, the US Army was looking for a device that could replace the aging M-94, a hand cipher that had been around since the days of Thomas Jefferson. The M-94 pocket cipher was easy to break, and the US Army wanted something more secure, that was suitable for tactical messages.

For a long time, Boris Hagelin had been trying to sell his cipher machines to the United States. He visited the US in 1937 and again in 1939, demonstrating his C-36 to William (Bill) Friedman, the crypto­grapher of the Signals Intelligence Service (SIS) of the US Army. Friedman liked Hagelin, but disliked the machine. Although it was theoretically unbreakable, it could be setup in such a way that it became weak and readable. So, Hagelin returned to Sweden to improve the machine.

In April 1940, Germany invaded Norway, whilst the improved machine wasn't ready yet. Fearing for the future in Sweden, Hagelin persuaded the Swedish Government to make him an official courier, and left the country with his wife Annie, trying to make his way to the United States.

On 10 May 1940, following a distressful journey through war-torn Europe, they finally reached Italy, where they boarded the Conte de Savoia; the last ship that would sail to the United States. In his luggage were two dismantled C-36/C-38 machines and the engineering drawings. After several days, they safely arrived in New York, and Hagelin setup an office in Connecticut.

The rest is history. Hagelin finished the design and sold the rights to the US Government for no less than US$ 8,614,790 using a French banker – James Paulding – and an American Wall Street broker – Stuart Hedden – as feduciaries. 1 The new machine, designated M-290, would become the workhorse of the US Army. By the end of the war, no less then 140,000 had been built at Smith & Corona in Syracuse (New York). It made Hagelin the first crypto millionaire in the world. He retained a royalty-free reproduction right, and would later sell a civil variant as the C-38.

 The Gentleman's Agreement
 Operation RUBICON

  1. Hagelin wanted the royalties to be described as 'capital gains' which were not taxed in Sweden. Instead he payed 25% income tax in the US [8]. His gross proceeds were US$ 2.8 million (netting at US$ 1.8 million). Pauling received US$ 430,000 and Hedden US$ 140,000. Smith & Corona made a profit of US$ 5 million.

Cryptanalysis
WWII
In 1942, there was a debate between the US Army cryptologists at Arlington Hall (Virginia, USA), and the British Government Code & Cipher School (GC&CS, now: GCHQ) at Bletchley Park (BP) in the United Kingdom (UK). The British had been reading Italian Hagelin traffic, and feared that the Italians would eventually be ably to read American Hagelin traffic. The Americans chose to ignore it, and kept using the machines. According to them, the effort to break it was impractically high.

It proved however, that American cryptologist William Friedman, had been right all along. He liked the Hagelin machines and had found them to be theoretically unbreakable, but knew that they could be setup in such a way that the became weak and vulnerable to cryptanalytic attacks [8]. British and American codebreakers were able to read Hagelin from both enemies and allies.

After the war it was discovered that the Germans were able to read 10% of the American Hagelin traffic: 6% from cryptanalysis, and 4% from captured keys. But due to the amount of work involved in breaking, the delay between intercept and decrypt was usually 7 to 10 days; too long to be usefull for tactical messages like the ones sent by the US Army. Apparently, the Japanese also understood many of the principles of Hagelin exploitation, but heardly broke Hagelin traffic [8].

For high-level messages, the Americans used a rotor machine — SIGABA — which was similar to Enigma, but much much more advanced. As far as we know, SIGABA was never compromised.

Cold War
In [3], Dennis Richie describes how he collaborated in the 1970s with Jim Reeds and Bob Morris, on a ciphertext-only attack on the M-209. It allowed them to solve messages of 2000-2500 characters. After discussions with the NSA, it was decided not to publish the details of their investigations at the time, as the principle was applicable to machines that were still in use.

Training
The document below was used as a training manual for Dutch cryptanalists, probably during the 1970s. It describes the Hagelin M-209 and the C-446A in great detail and also discusses the machine's cryptanalysis and methods for its attack. The document is in Dutch and was released for publication by the Dutch school for Military Intelligence (DIVI) in 2011 [5].

 Download description and cryptanalysis of M-209 (Dutch)

Today
A detailed description of the cryptanalysis of the M-209 is available from Jean-François Bouchaudy [6]. During his M-209 challenge in 2012, he discovered that a single message of less than 400 characters still can't be broken today, not even with super computers.

 Detailed cryptanalysis (off-site)


Simulators
M-209 for Windows
A very good M-209 simulator has been created by Dirk Rijmenants from Belgium. It is both graphically and functionally an accurate representation of the M-209 and it is available directly from his website.

The image on the right shows a screenshot of the M-209 running on Windows. It can be used on Windows 98/ME/2000/XP/Vista and Windows 7, and it also runs under emulation on Linux (WINE) and Mac (Parallels Desktop).

 Download (off-site)
  
Click here to download the M-209 simulator from Dirk Rijmenants website

Command line version
A command-line M-209 simulator was made by Mark Blair and can be downloaded here. It is written in C++ and runs on UNIX/Mac.

 Download (off-site)


Specifications
  • Alphabet
    Latin, 26 characters (A-Z)
  • Cipher wheels
    6
  • Lugs
    Movable
  • Dimensions
    180 × 140 × 80 mm
  • Weight
    2.7 kg
  • Colour
    Green
Checklist
  • 1
    × Can, ink pad
  • 1
    × Can, oil
  • 1
    × Case, carrying, canvas
  • 4
    × Clip, message
  • 2
    × Message book M-210
  • 1
    × Screwdriver
  • 2
    × Tape, paper, 3/8" wide, 1 use 1 sp
  • 2
    × Technical Manual, TM 11-380
  • 1
    × Tweezers, 4-5/16" long
Documentation
  1. War Department, Technical Manual, Converter M-209
    Part of David Stroud Collection. Scanned by Nick Spark.
    TM 11-380. 27 April 1942.

  2. Original WWII M-209 checklist
    US Signals Corps, 3 September 1945.

  3. SMID, C-446A en M-209 Beschrijving en Analyse
    Descryption and analysis of the Hagelin C-446A and M-209 (Dutch).
    Dutch Department of Defence, Military Intelligence School.
References
  1. Hans Stadlin, 100 Jahre Boris Hagelin 1982-1992 (German)
    Crypto AG. Crypto Hauszeitung Nr. 11. Jubilieumausgabe September 1992.

  2. Nick Gessler, Differences between M-209 models
    Details useful in identifying the various models and subtypes.

  3. Dennis Richie, Dabbling in the Cryptographic World - A Story
    Date unknown. Updated 5 May 2000. Retrieved November 2011.

  4. Klaus Schmeh, Breaking M-209 during WWII (German)
    Als Deutscher Code-Knacker im Zweiten Weltkrieg.
    Klaus Schmeh. 23 September 2004.

  5. SMID, C-446A en M-209 Beschrijving en Analyse
    Description and analysis of the Hagelin C-446A and M-209 (Dutch).
    Dutch Department of Defence, Military Intelligence School.

  6. Jean-François Bouchaudy, M-209 Cryptanalysis
    Retrieved July 2016.

  7. Collection of M-209 patent and license agreements
    A66684. Declassified by NSA on 11 June 2014 (EO 13526).
     More on this subject

  8. CIA Historian, MINERVA, a History
    Internal CIA publication TOP SECRET, 2005-2008. pp. 8-9.
     See: Crypto Museum, Operation RUBICON
Other websites
Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Wednesday 05 August 2009. Last changed: Sunday, 14 June 2020 - 10:49 CET.
Click for homepage