|
|
|
|
|
|
|
Crypto AG NSA CIA Rubicon →
|
|
The Gentleman's Agreement
|
|
|
Secret agreement between the NSA and Hagelin · 1939-1969
In the past there have been recurring rumours about a secret
collaboration between the NSA
and the Swiss company Crypto AG,
founded in 1952 1 by the Swedish inventor
Boris Hagelin. Former
employees of the company have suggested that there were frequent
visitors from the NSA, but allegations to this effect have always
been firmly denied and substantial proof was never found.
In 2014, the NSA
released more than 7600 documents [1], amounting to over 52,000
pages of historical material relating to the career of
William F. Friedman (1891-1969),
who is considered the dean of American Cryptology.
More than 400 of these documents contain material about
Boris Hagelin
and/or Crypto AG.
Although some documents have been fully declassified,
most of them are still heavily redacted as, according to the
NSA, they may contain information that could harm national security
or any individuals or companies that are mentioned in those documents.
|
 |
-
Although Crypto AG in Zug (Switzerland) opened in 1952, the actual
company structure had been created around 1950, shortly after Hagelin
had moved to Switzerland in 1948 to work with
Dr. Edgar Gretener.
|
Update February 2020 —
The story below is largely based on information from the Friedman Collection,
and covers the period from 1939 to 1969 — the year in which
Friedman passed away. It has since come to light – after a revealing
broadcast by the German television station ZDF – that a year later (1970)
Crypto AG
was fully purchased by the German BND and the American
CIA, each with an equal share. This project, which is seen by many
as the intelligence coup of the century, was internally known as
Operation THESAURUS
(later: RUBICON).
The article below covers 1939 to 1969.
The period from 1970 to 2018 is described in a
separate article
[28].
|
|
The Gentleman's Agreement
|
|
|
|
Paul Reuvers and Marc Simons, 30 July 2015
|
In 2014, the NSA released more than 7600 documents related to the career of
William Friedman,
a former NSA employee who is commonly considered
the dean of American cryptology.
Among the released documents are several hundred letters between
him and Boris Hagelin — a Swedish inventor
who would eventually become a dominant supplier of cryptographic
equipment, first through his Swedish company AB Cryptoteknik
and later through his Swiss company Crypto AG.
It is known that Boris Hagelin
and William Friedman were good
friends. They had the same age, were born in the same part of the world
– the Russian Empire, from which they had to flee –
they shared a passion for cryptography and they
both suffered from depressions.
During World War II they were in close contact after Hagelin
'escaped' to the US in May 1940 and subsequently sold his patent
rights to the Americans, allowing them to build the
M-209 cipher machine
[2][3].
Once the war was over, the two men maintained their friendly relationship,
wrote each other (personal) letters, visited each other a number of times,
and helped each other on several occasions.
Most of these letters are of a personal nature
but some of them contain explicit NSA material. From the documents
in the Friedman Collection it becomes clear that the AFSA (the predecessor
of the NSA) and Hagelin were already negotiating an agreement of
some kind as early as 1951.
Although much of the agreement is still unknown, the article below
proves the existence of a secret Gentleman's Agreement between
the NSA and Hagelin/Crypto AG during the 1950s.
|
|
One of Hagelin's biggest achievements was the sale of
M-209 cipher machines
to the US Army. Based on the C-36
/ C-38 – a small
cipher machine with 6 pin-wheels – the M-209 was adapted to meet the
requirements of the US Army. Although Hagelin would normally build
all machines in his factory in Stockholm (Sweden), he allowed the
American's to build the machine under licence.
|
On 10 May 1940, Hagelin travelled on the last ship from Europe
to the US, with two prototypes of the C-38
in his lugguage. It would eventually evolve into the
M-209
and would become the largest
sale of the so-called C-machines he ever made [3].
The machines were built at the
Corona plant of the L.C. Smith typewriter company in Syracuse,
with a daily output of up to 500 units.
The image on the right shows a typical M-209 as it was used
by the US during WWII. It has 6 pin-wheels at the front,
each with a different number of steps, and a revolving cage with
27 bars.
|
|
|
As Hagelin couldn't return to Sweden during the war,
he stayed in the US where he spent his time serviceing
the BC cipher machines 1 of some American
organisation. When he returned to Sweden in 1944, more than
50,000 M-209 machines had been built by the Smith Corona Typewriter
Company and by the end of the war, this amount had nearly
trippled to a staggering 140,000.
|
To allow production of the
M-209 and the
BC-38 (shown on the right)
in the US, and to avoid paying high tax fees in Sweden,
Hagelin had transferred the full and royalty-free patent rights
to the US Army, for the sum of US$ 3,023,410,
of which US$ 2,548,225 was for him personally.
The balance of US$ 475,185 went to the Hagelin Cryptograph
Company (HCC) in Sweden [4]. 2
In return, the US Government granted Hagelin a royalty-free license
for the production of M-209 and BC-38 machines and improvements
thereof, so that
he was still allowed to sell his invention.
|
|
|
It is worth noting that the machine did not provide absolute secrecy.
During WWII, the Germans were able to decrypt a message in under 4
hours if they had received messages in depth 3 .
This was not considered a problem however, as the M-209 was only used
for tactical messages (e.g. field maneuvers) which had lost their
significance by the time they were broken by the Germans.
|
|
-
A BC cipher machine (e.g. a BC-38) was basically a C-machine
(e.g. C-38) that was extended with a keyboard, a motor-driven
mechanism and a double printer.
-
The exact amount of the fees payed to Hagelin are difficult to
determine from the papers, as the contract was reopened and
renegotiated several times during the war [4]. In the end, Hagelin had
to become a US citizen and pay US$ 700,000 in taxes to the US,
in order to avoid paying much higher taxes in Sweden.
-
In cryptanalysis, receiving messages 'in depth' means that two
or more messages were intercepted that had been encrypted with
the same key. In case of the M-209, two messages were enough to solve it.
|
|
Shortly after WWII, in 1947, many M-209 machines that were no longer
needed by the US Army, started appearing on the US surplus market
for prices as low as US$ 15. On 2 November 1947,
in a letter to Friedman [5],
Hagelin expressed his concern about the fact that the Dutch Purchasing
Commission in the US had bought a first sample order of 100 units.
Hagelin wrote the following:
|
If this goes on, our own business here will be ruined.
He also pointed out that this should not be possible as per agreement
with the War Department. Friedman answered prompty and replied that this
was clearly a mistake and that necessary steps had been taken to
ensure that this would not happen again [6]. Nevertheless, the Dutch
are able to pick up their order of 100 machines in New York a few days
later, which were subsequently sent to the Dutch East Indies,
which Hagelin reported to Friedman on 24 November 1947 [7].
The matter clearly worried Hagelin, as two weeks later, on 13 December,
he wrote again to Friedman asking him to investigate the
Automatic Radio Manufacturing Company
in Boston, who appeared to be offering M-209 A
machines for as little as US$ 2 each [8].
And two days later this was followed by another letter, after he has been
informed by his Dutch agent that the Dutch Army had been offered
450 cipher machines M-209
from an undisclosed source for US$ 2 [9].
Although Friedman replied to him promptly, it seems there was little
he could do. Although the US Army was free to sell the machines within
the US, he reaffirmed that they had no intent to sell any surplus
machines and that he had no idea who was offering them.
He also suggested that the offered M-209 machines may have been
unrepairable ones that should have been destroyed [10].
➤ The issue of the surplus M-209 returns in 1953
|
Immediately after the war, Hagelin started improving his
existing cipher machines by adding new features and, more importantly,
improving security by implementing a new keying mechanism. This new
mechanism caused irregular stepping of the cipher wheels and was therefore
far less predictable than the regular stepping of the wheels in
existing models like the M-209.
In August 1950, Hagelin wrote to Friedman about his recent
developments and announced some new machines [11].
On 5 October 1950, he filed a patent for the new machine with the
US patent office, followed by applications in Sweden and ten further
countries [13].
The improved keying mechanism was ready in early 1951, as confirmed by Hagelin
in a letter on 26 January [12].
|
Another new machine, under development in Stockholm at the time,
is an automatic cipher machine for teleprinter circuits. The machine had a
built-in C-line mechanical cipher machine that is used to create a 5-bit
pseudo random code, which is mixed with the plaintext.
Apart from the C-line pin-wheel mechanism – which is used here as
a key stream generator –
it also has a built-in 5-level paper tape reader that can be used instead.
When the tape is filled with random characters,
the device is converted to a One-Time Tape (OTT)
cipher machine, or mixer.
|
|
|
When properly used, OTT systems are theoretically unbreakable
— they are based on the
One-Time Pad (OTP) cipher — and
provide the best possible protection for sensitive information.
For this reason they were often used for diplomatic traffic. In
practice however, especially in the early 1950s, the key tapes
were sometimes made by means of mechanical — deterministic — methods.
|
|
|
The Hagelin Negotiations
1951
|
|
|
In February 1951, a prototype with the new keying mechanism,
based on a modified M-209, was sent from
Stockholm to the AFSA for evaluation.
The new technology caused great upset, as it defeated the existing
methods for solving pin-wheel cipher machines.
AFSA was afraid that Hagelin might want to sell machines with
this new technology to countries like the USSR [14].
At the same time, Hagelin was regarded a 'good friend' and a valuable
source of information about other nations and their developments.
In a USCIB meeting on 9 March 1951, it was reported that
negotiations with Boris Hagelin
were underway.
On 22 May 1951, in a meeting at AFSA, the situation was discussed
with various parties, including the CIA. At this meeting,
Friedman presented a detailed analysis of the Hagelin Company
and the current situation [14]:
|
- Hagelin is at that moment the only civil manufacturer of cipher machines in the world 1
- AFSA considers the Hagelin Company as a serious international player
- AFSA considers Hagelin's expanding market as a security threat
- AFSA considers Boris Hagelin a good and loyal friend
- Hagelin will continue to sell readable machines to all nations
- CIA will control the worldwide sale of the new unreadable 2 CX-machines
- Hagelin will receive US$ 700,000 as compensation 3
- Hagelin will provide information about all customers and sales
- Hagelin's offices and agents abroad may be used for information-gathering
- Hagelin's new technology will be considered for use by NATO
- Hagelin's OTT technology might also be of use to NATO
|
|
With respect to point (6) above, the report literally says:
|
It would be to the advantage of the U.S. Government if the
proposed new or improved Hagelin cryptoequipments were prevented from being
developed, manufactured, and sold commercially on the open market.
|
Concerning point (9), it was even contemplated that it might
be possible to gather intelligence from the USSR and its satellites,
if Hagelin were allowed to sell to them — closely controlled, of course —
but it was doubted whether the USSR would buy from a (former)
American protegee.
|
-
In this context, 'civil' has to be read as 'on the open market'.
There were other manufacturers, such as
Siemens
and Philips, but
their markets were largely controlled by their governments
and the military.
-
In this context, readable means that the cryptographic algorithms
could be broken by the NSA.
Also known as friendly. In contrast:
algorithms that are not breakable by NSA,
are called unfriendly or unreadable.
-
This was negotiated by Stu Hedden, Hagelin's representative in the US,
who would get US$ 250,000 of it. In 1952, Hedden became Inspector
General at CIA.
|
|
|
Secrecy Order on Patent
1952
|
|
|
Friedman prepared a proposal for an agreement with Hagelin, along the
terms that had been discussed. He put it before the USCIB
and the AFSA Committee (AFSAC), but the latter turns it down.
In June 1951, Friedman tried again, but despite his apocalyptic prospect
— we will be blind within a few years —
AFSAC turned it down again.
This ended the negationations with the CIA.
Despite all this, Hagelin acted as if a deal has been struck, and kept
his part of the 'deal'.
But then, on 14 September 1951, things went horribly wrong when
Hagelin's patent for the new technology (US 188,546)
is placed under Secrecy Order at the request of AFSA,
nearly a year after it was filed by Hagelin.
Hagelin was very upset by this —
he didn't know what to do. Friedman was furious as he saw a
long-term relationship with a reliable and loyal friend being jeopardized.
Friedman commented that the patent had been filed in 10 other countries
over which the US had no control, so there was no secrecy.
He also argued that, if thousands of these systems are in use,
it is unrealistic, if not absurd, to think that one could
keep it secret. Furthermore, the US could be liable to suit
by Hagelin, with claims running into millions of dollars.
Finally, on 27 March 1952,
the Chief of the Office of Communication Security of AFSA
withdrew the secrecy order and requested the relationship
between the US and Mr. Hagelin to be reexamined [13].
|
|
|
Friedman's visit to Stockholm
1953
|
|
|
In 1952, the AFSA was dissolved into the newly established
National Security Agency (NSA)
and not much happened on the Hagelin-front.
This changed in the summer of 1953 when – after the BRUSA 1
Conference of June 1953, the British intelligence service
GCHQ highlighted the Hagelin threat and demanded quick action.
With this report, Friedman went to the director of the NSA.
General Canine, the new NSA director, allowed Friedman
to travel to Stockholm (Sweden) and Zug (Switzerland) to visit
Hagelin's factories and discuss a possible agreement.
Friedman arrived in Stockholm in October 1953 and toured the
factory with Hagelin. He made an informal proposal to renew
the negotiations and speak with General Canine directly.
Hagelin agreed and on 17 November he and Friedman sailed
on a passenger line from Le Havre (France) to New York.
On 5 December 1953, Hagelin, Friedman and Canine set down to
discuss an agreement. They agreed to a denial operation:
|
- NSA will provide a list of proscribed countries (for CX and OTT machines)
- Hagelin can sell to other countries (including NATO, but no guarantees)
- Hagelin will receive compensation for lost sales 2
- Hagelin will provide details about customers, sales and future machines 3
- The deal will be valid for 6 months awaiting a formal written agreement
|
|
In addition, Hagelin agreed that, if and when he would decide to sell
his company, the US would have the first right of refusal, and could
approve any prospective buyer should the US decide not to buy.
In addition, Hagelin suggested that NSA could develop the
crypto heart for the CX-52.
The deal was entirely to the US' advantage but two days later,
to everyone's surprise, the USCIB rejected it. Some argued that
NSA is not in the position to encourage NATO sales, whilst others
did not want to disclose the list of proscribed countries
as it would the reveal NSA's targets.
|
-
BRUSA = Britain-USA (i.e. GCHQ-NSA).
-
DIRNSA Canine suggested supplying surplus M-209 units, or an annual
lump sum payment, but Hagelin was not happy with the latter as
he didn't want to be payed for doing nothing.
-
This includes early prototypes for evaluation by NSA.
|
|
The 'situation' with the M-209
was not solved permanently
and would return on several occasions in the following years.
By October 1953, the US had received requests from several countries for
the release of of M-209 machines, but pending
Negotiations with Mr. Hagelin, the AFSA (by now: NSA)
refused to do so [15].
This prompted the US Army to come up two months later with a list of
countries that were currently using the M-209
and/or who had requested access to them [16]:
|
- Philippines
On 12 June 1951, the US Army supplied 229 converters M-209 to the
Philippine Armed Forces with the consent of AFSA in addition to
the 369 units that were already in use there at the time.
- Uruguay
On 6 October 1952, the Uruguayan Government wanted to buy 36
converters M-209, but this request was turned down on 14 October 1952,
saying that the equipment was not available for sale.
- India
On 16 March 1951, India indicated that they wanted to buy
M-209, M-209a and M-209b machines from commercial sources (presumably
in the US) but that they wanted to have copies of the TM 11-380 manuals
before doing so. The request was denied as it was addressed to
the wrong department.
- France
On 23 september 1952, France wanted 450 converters M-209
in addition to the 1850 units that were already in use at the time.
The request was turned down for several reasons.
On 22 September 1953, France again put in a request for 350 units
for use in French Indo-China. This request was turned down by the
NSA as it might jeopardize current negotiations between the NSA
and Mr. Hagelin in Sweden. The restrictions on France were
later lifted on 12 January 1954 after approval from Hagelin (see below).
- Portugal
On 23 June 1953, Portugal requested clearance for a supply of modified
M-209b converters, but this request was denied on legal grounds.
- Türkiye
On 16 August 1950, The Turkish Army requested procurement of M-209
machines or, if it was denied, suitable action to allow such machines
to be obtained from commercial sources in Sweden. The request was
denied, but the American CSP-845 strip cipher was offered as an
alternative. On 22 May 1953, Türkiye put in a request for 600 M-209s,
but it was turned down again, this time on the ground that it
would exhaust US reserves.
- Latin America
M-209 converters were in use by the Governments of Ecuador (1947),
Venezuela (1948), Argentina, Columbia and Peru (1951).
Some training was given to those countries, although this was strictly
prohibited, as reconfirmed in a memo of 17 February 1953.
|
The request for M-209 machines from France
in September 1953 was denied by the NSA pending negotiations with Hagelin.
Although there was not yet a deal in place between the NSA and Hagelin at
that time, on 12 January 1954, the restriction for France was lifted after
Boris Hagelin had given his consent. This allowed the French
to buy more M-209 machines for Indo-China [17].
|
|
|
Gentleman's Agreement
1954
|
|
|
|
In the meantime, Hagelin further developed his new machines
and was ready to take them into production. The first one was
the C-52.
It was similar to the old
M-209,
but had removable pin-wheels.
The next one was the CX-52,
which was similar, but featured the new keying mechanism.
|
The order of the pin-wheels could be swapped and it was
even possible to have up to twelve different wheels to choose from.
The machine was suitable for the 26 letters of the Latin
alphabet. Each wheel had a different number of segments and
advanced in an irregular manner.
In a memorandum of 5 February 1954, the NSA expressed its concerns
about the newly released Hagelin machines, in particular
the CX-52,
the TC-52
and the planned TC-55.
Friedman was asked to liaise and make
a proposal to Hagelin on behalf of the director of the NSA (DIRNSA).
|
|
|
It was also agreed that Friedman would use his personal
stationary and private address for any correspondence with Hagelin,
in order not to ring any bells when official NSA letters arrived
in a small European town [16].
In anticipation of the outcome,
Hagelin and DIRNSA entered into a Gentleman's Agreement or,
as they called it, a Gentleman's Understanding,
for a period of 6 months, during which time the details of the
renewed Hagelin Negotiations would be finialised.
Although the exact details of the negotiations with Hagelin have
not yet been declassified, it must have been a very serious matter,
as it took the NSA twelve months, rather than the anticipated six months,
to come up with a suitable proposal. Finally, in February 1955, Friedman
went to Zug (Switzerland) for a 'personal' visit to Boris
Hagelin, with the intent to present him a new proposal.
In the meantime, in June 1954, the Analytic Equipment Technical
Committee — who are tasked with breaking alien cipher systems —
asks their research team to review the current
codebreaking equipment and evaluate the impact of any newly developed
cipher machines, such as the CX-52.
In their final report of 15 November 1954, the special study group
reported on page 18 [27]:
|
2.6.6.2 The Hagelin C-38 is well covered at present by computer
programs and special-purpose machines. Any CX-52 traffic that appears
will tax our present facilities severely. It will require more compli-
cated, faster programs; and most of the present special-purpose equipment
will not be applicable.
The following information was extracted from the report that
Friedman filed on his return to the US, on 15 March 1955. Unfortunately,
much of this report has been redacted, but fortunately, there are
three versions of this document, each of which has been redacted
differently [18]. As a result we are able to fill-in some
of the gaps and get a more complete picture.
In February 2020, we were able to fill in even more of the gaps, after the
revelation of
Operation Thesaurus/Rubicon — the secret purchase of Crypto AG by BND and CIA.
|
|
Friedman's visit to Zug
1955
|
|
|
21-28 February 1955
In late 1954, NSA director Ralph Canine advised that the Hagelin
negotiations should begin again. On 17 December, the USCIB authorised
a visit to Zug, where Friedman would propose a new deal:
in return for controlled sales,
USCIB will authorise a statement to NATO that, if properly used,
the CX-52 provides good security.
USCIB hopes that this proposal will satisfy Hagelin.
➤ More...
On 21 February 1955, Friedman arrived in Zug (Switzerland) and
stayed at Hagelin's home for a full week, during which time they
discussed cryptography, business and private matters.
Boris Hagelin's son, Bo, was also present during some of the
meetings.
During these meetings, Friedman asked about the differences
between the various machine variants and about the customers
that these machines were sold to. Finally, he put the authorised
proposal forward.
|
|
At this point in time, the factory in Stockholm (Sweden) was manufacturing
the current C-line of machines (C-52
and CX-52)
with a capacity of 60 to 80 machines per month. Besides these machines,
the Stockholm plant had also received an order for 500 to 1000 old
C-446 machines.
Hagelin was about to close down the factory in Sweden and
move the entire production and the production facilities over to a
new building in Zug (Switzerland) as soon as it would be ready.
|
The top floor of the new building would be converted into an appartment
for Sture Nyberg, the current plant manager in Stockholm, who would move
to Zug with his family to become the new plant manager there. It was
Hagelin's intention to let his son Boris Hagelin Jr. (Bo) take over the
company when he himself would retire in two years time when he reaches
the age of 65.
The message that the old C-446
is to be taken into production again, plus Hagelin's suggestion
that he might want to make more, and sell them to other countries,
clearly pleased Friedman.
|
|
|
Being very similar to the M209,
Friedman reported about the C-446:
This model is, of course, easier to solve than the new models.
Production of the C-446 machines would be completed in Sweden, even
after the move to Zug is complete, where the Johannes Gauge Company
had taken over the building and the workers, and had been given the
tools, jigs and dies on loan.
|
|
Amoung the things Friedman wanted to discuss, were the capabilities of
the new machines, in particular the C-52
and CX-52, and the various variants of these
machines. For this, Friedman and the Hagelins agreed to use specific
(secret) designators, which are actually suffixes to the model name.
First of all, Hagelin recognised the following two classes of C-line
machines:
|
- Class 1
Where all keywheels advance the same number of steps.
In the case of the M-209,
the C-446 and a particular version of the
C-52, the advance is 1 step. The machines
in this class are not to be equipped for operation with
One-Time Tape (OTT).
- Class 2
Where stepping is irregular and where OTT readers are provided, as well
as equipment for producing OTT tapes.
These machines use the new technology.
|
- M-209
No longer in production but still in use with the US Army and some
of its customers. Available in large quantities on the surplus market.
- C-446
No longer in production but still in use by some countries, including
The Netherlands. Would be taken into production again for a limited
period, following an order for 500 to 1000 units by the Foreign Office
and the Department of Defense of The Netherlands.
- C-52
By default, this model is compatible with the
M-209
and C-446, but can also
be made to function with interchangeable pin-wheels
and with pin-wheels that have a larger number of elements
(steps) than M-209
and C-446.
The C-52 can be supplied with more than 6
pin-wheels and may also have more slide bars than
the M-209
and C-446.
|
|
The Class 2 machines, i.e. the various CX-52
versions, were given a secret designator that was not printed on the model
number plate of the device. In the list below, this secret designator
is printed as a lower case suffix.
|
- CX-52a
This model is supplied with Standard A slide bars, which
produce irregular or varying angular displacements of the key wheels,
each wheel advancing 0, 1, 2, 3, 4 or 5 steps on each operation.
This is the default and most secure version of the machine.
- CX-52b
This model is supplied with Standard B slide bars, which
produce regular or fixed anglular displacements of the key wheels,
all advancing the same number of steps, but the number of steps may
be any one from 1 to 32. It is weaker than the a-variant.
- CX-52c
This model is compatible with the old types of C-machines, the M-209, the
C-446 and a certain version of the C-52. It is the weakest of the models.
- CX-52ak
This is basicially a CX-52a that is enhanced with the so-called
Complementary feature (German: Komplementär),
also known as the Hüttenhain feature. 1
- CX-52bk
This is a CX-52b that is enhanced with the Hüttenhain 1 feature.
This variant is built by HELL
(licenced by Hagelin) for the German and
Austrian market for which HELL has an exclusive contract.
It is the only version that is approved by
Dr. Erich Hüttenhain 1
for use by the German Bundeswehr (Army), where it is known as the
HELL H-54.
- CX-52ck
CX-52c with Hüttenhain feature. 1
- CX-52/10
This is a 10-digit numbers-only variant of the CX-52.
These machines can be of the a, b or c type and may have the complementary
feature as well. For example: CX-52ak/10.
- CX-52/30
This is a 30 character version of the CX-52, suitable for the Arabic
(and possibly Russian) alphabets.
For example: CX-52/30 Arabic.
- CX-52/RT
This is the Random Tape or
One-Time Tape (OTT) variant of the machine.
|
|
|
One of the goals of Friedman's visit to Zug, was to find out what models
Hagelin was selling to which customers. When asked, Hagelin gave a full
rundown of his current customer base, without any hesitation,
and provided details of the machines
he has sold or was currently selling to them:
|
Egypt Negotiating for 50 x C-52 and 10 x BC-52 Jordan 10 x C-52, 20 x BC-52 (UK is paying for this order) Iran No agent, no interest Iraq Negotiating for 50 to 200 x C-52 with Arabic characters Syria 50 x C-36 1 Saudi Arabia No agent, no sales yet India Interested in C-52 and BC-52 Pakistan Waiting for C-52 for Hindustani (29 or 30 characters) Belgium 200+ x CX-52a, 100 variable type wheels for C-446 France 80 x CX-52a, 20 x CX-52a/10 (for study), interested in HX Portugal 5 x CX-52a Italy Awaiting NATO viewpoint on CX-52 Greece and Türkiye Interested, documentation sent. Trip postponed. Holland 500 to 1000 x C-446, some with OTT (C-446/RT) Dutch Army Interest in CX-52 and BCX-52. United Kingdom 2 x CX-52 Germany and Austria H-54 supplied by HELL (CX-52bk) 2 Sweden Will replace their C-446 by CX-52 units (long-term) Spain Interested in C-52, no orders yet Eire 2 x CX-52 Indonesia 20 to 30 x C-52 (waiting for order) Poland and Hungary 2 x C-446 each 3 Jugoslavia Interested in C-machines 4 Central America Not much interest (see below) Costa Rica 2 x C-446 Cuba Initially interested, but no sales Mexico Currently trying to raise interest Venezuela About to order some machines Brazil 60 x CX-52c, interested in 500 more Argentine 13 x CX-52c Chile Not much interest, will buy some Peru Interested in 200 x CX-52 Paraguay No interest Uruguay 5 x CX-52, 2 x BC-52 (first experience with crypto) Columbia 100 x CX-52, 40 x BCX-52
|
|
|
-
Being asked by Friedman where he got the old C-36 machines from,
Hagelin replied that they had found some in the basement of the
plant in Stockholm.
-
The CX-52bk (or HELL H-54)
was the only model that was approved by
Dr. Erich Hüttenhain
for use by the German Bundeswehr (Army).
-
The head of Swedish COMINT, Rossby, didn't think the Russians were
helping their satellites with cryptographic advice or material.
Friedman decided not to comment on this.
-
At this point, Hagelin was treating Yugoslavia the same as the Arab
countries, but Friedman suggested to treat them as a satellite of the
USSR (Russia). Hagelin replied: That's OK with me if you want it
that way.
|
|
As announced in 1950, Hagelin now also produced equipment for the online/offline
protection of teleprinter circuits. During the meeting,
Hagelin told Friedman that the TC-52,
which had been in production for a while, would soon be replaced by the
improved TC-55.
Both machines offer two types of encryption: built-in pin-wheel encryption
and, as an option, One-Type Tape (OTT).
The NSA was clearly worried about the availability of automatic OTT equipment
to certain countries.
|
|
Both Hagelins were very enthusiastic about a new pocket
cipher device that was currently being developed. It uses six
notched discs and operates just like the C-machines, albeit without
the slide bars. The cipher discs would be made of plastic and should be
user-configurable. Furthermore, Hagelin Sr. hoped to be able to add a small
paper strip printer to the design.
|
Although Hagelin Sr. gave the impression that he invented the machine
himself, his son Bo told Friedman in a private conversation, that it
was actually his idea and that it was initially rejected by his
father in 1951. The idea came to mind after repeated requests from
various customers for a cipher machine that would fit a pocket.
A competitive pocket cipher machine
– HC-9 – had just been
introduced by the Swedish company
Transvertex.
It was developed by Vigo Lindstein, a former Hagelin employee,
and appeared to be under evaluation by NATO.
|
|
|
|
According to Bo, this prompted his father to come up with an even smaller
device, of which he now claims the invention. When Bo suggested
that it was actually his idea, and that he would like to receive
some royalties from it, his father had become furious, Bo told Friedman
in confidence.
Patents for the new machine, designated CD-55, had been filed
and it would soon be taken into production. Various models were being
considered, including one – if possible – with OTT.
|
Many other interesting points were raised during the various meetings
between Friedman and Hagelin on this visit, such as the modification of
the B-211 for the French,
and the production of HX
and CX machines by the private French company
Societé Electronique Automatisme (SEA).
Another point that was raised, is the current situation with
Siemens and Halske.
Although the German Siemens company clearly was a competitor of
Hagelin, there were strong connections and there were frequent exchanges
of information between the two companies, some of which in relation to the
work of Dr. Erich Hüttenhain,
the former Cryptologist of the Third Reich
who now works for the German Intelligence Service, the
Bundesnachrichtendienst (BND).
At several moments in history, Hagelin contemplated selling
his company to Siemens, but this never happened. In the talks with Friedman,
Hagelin mentioned that the relations with Siemens and Halske had been formalised
in a signed contract. As a result, Siemens would not make any cryptomachines
themselves and Hagelin would refrain from producing teleprinter machines.
In this contract, the market for teleciphering machines had been divided as follows:
Siemens alone
- West Germany
- West Austria
- Jugoslavia
- Portugal
- Ireland
- America (all except Brazil, USA and Canada)
- Africa (all except Egypt)
- Asia (all except India, Indonesia and China)
- Australia
Crypto AG alone
- France
- Italy
- Switzerland
- Sweden
- Norway
- Benelux 1
- Brazil
- Egypt
- India
Siemens and Grypto AG together
- Denmark
- Greece
- Spain
- Indonesia
Areas not yet agreed
- Finland
- Russia and all satellites
- East Germany
- China
- USA and Canada
|
|
-
Benelux is the abbreviation for Belgium,
Netherlands and Luxemburg.
|
|
On the evening of 25 February, after having been Hagelin's guest for
several days, Friedman felt the time had come to place the NSA
proposal before Hagelin, or as he wrote in his report:
|
... the real object of my visit to Zug
He began by thanking Hagelin for his patience
and for keeping his part of the Gentleman's Agreement, despite the
fact that the NSA had exceeded the deadline.
NSA had been struggling for more than twelve months – rather than the
anticipated six – to work out a proposal that would be satisfactory for them
(the NSA) as well as perhaps acceptable to Hagelin.
They had hit upon a simple one that Friedman was now authorised
to present to Hagelin.
Hagelin replied by thanking Friedman for the appreciation and understanding
of his position and for various favours that were done for him and his
family, in particular for his son-in-law Conradi and for his wife's cousin
Miss Barth, who had been given a position at the NSA or the US Army.
Friedman then conveyed to him practically verbatim the terms of the
proposal authorised in USCIB: 29.14/29
of 27 December 1954.
He told Hagelin that he did not have to decide right away, and
that he could take some time to think it over, but to his great surprise,
Hagelin accepted the proposal then and there, without any reservations
or desire for modifications.
When Friedman offered him to ask DIRNSA to confirm the deal
in a formal letter, Hagelin replied that he didn't want anything
with respect to this deal on paper.
Although the contents of the proposal authorized in USCIB: 29.14/29
are still classified, we now know the details:
|
- From 28 February 1955 onwards, the agreement between NSA and Hagelin is official
- The deal is secret and is open-ended (i.e. no end-date)
- Hagelin will refrain from selling to proscribed countries 1
- Hagelin will not be payed for this
- Hagelin will continue to supply information to NSA
- NSA will write the brochures and manuals for the CX-52 models [21] 2
- NSA will approve CX-52 for NATO (if properly used)
- NSA will write the 'proper usage' manual for for NATO 3
|
|
In addition to this, we can make the following 'educated guesses':
|
- Hagelin will continue to receive personal favours for him and his family
- Hagelin will be able to buy back several lots of M-209 machines
- Bo Hagelin Jr. has asked for a TYPEX machine which Friedman hopes to find for him
- The US Army will place a large order for C-52 and CX-52 machines
|
-
Hagelin will not sell secure machines
(like CX-52 and OTT machines)
to countries on this list.
-
These manuals were written by Dr. Harold J. Stukey
and Francis A. Raven of the NSA
[16].
-
In order to make best use of their machines, Hagelin usually
released a manual for 'proper usage'. For the machines
used by NATO, it was agreed that NSA would write this manual.
This could imply that Hagelin received NATO orders as part of the
deal with the NSA, but this can not be confirmed at present.
|
In the past, Hagelin had noticed that some of his customers were not using
their cipher machine to the best of its abilities. For example: the
configurable pins on the pin-wheels and the lugs on the sliding bars
can be set up in such a way that the cipher period 1 is shortened.
In order to avoid such situations, Hagelin issued a manual for
'proper usage' for each of his machines.
One of the outcomes of the Hagelin Deal was that NSA would provide
the manual for 'proper usage' of the CX-52. The manual would
be written by Dr. Harold Stukey and Francis A. Raven, two high ranking
cryptologists at NSA. Although this can be seen as a gesture of
courtesy on behalf of the NSA, it is far more likely that it was used
by NSA to weaken the cipher by manipulating the instructions for
best use. It took the NSA seveal months to complete the manual,
during which time Friedman regularly kept Hagelin informed about the
progress.
During the meeting, Hagelin was clearly worried about the proper use of his
machines by NATO. He asked Friedman how he could assure that NATO uses
the devices properly. Friedman answered that he does not need to worry
and that the NSA will take care of that too. This means that NSA
would also write the instructions for best use for NATO.
This fits in with the NSA's desire of the 1950s to improve the overall
cipher security of their NATO partners, in particular that of France. 2
|
|
-
In cryptography, the cipher period is the time it takes for the
key stream to repeat itself.
-
At this point, France was known to use weak cipher systems and/or
use their stronger cipher systems in an improper manner, as a result
of which many NATO secrets had leaked to the USSR (Russia).
Various memos in the Friedman Archive confirm that NSA was
determined to fix this leak.
|
It is worth noting, that during Friedman's visit he became aware of
problems in the relationship between father Boris and son Bo.
He made two remarks: (1) Bo had acquired the exclusive sales rights of
the new portable CD-55 cipher machine,
and (2) Bo offered to spy by providing copies of internal correspondence,
if that would help to cement the relationship with the Americans.
The first remark (CD-55) would eventually get in the way of a smooth
relationship with the Americans, who regarded Bo Hagelin as an unguided
missile, more inclined than his father to sell to the highest
bidder, rather than to a friendly nation [28].
|
|
|
Friedman's retirement
1955
|
|
|
On his return from Zug on 3 April 1955, Friedman suffered a heart attack and
was hospitalised, which delayed the implementation of parts
of the agreement. After he was discharged from the hospital, Friedman
worked from his home for a while and wrote to Hagelin several times.
Later that year, in August 1955, Friedman officially retired from the NSA
but remained working for the agency as a consultant. Due to his bad health —
he had a serious heart condition — he was no longer able to handle Hagelin
directly and was forced to take a step back.
He was replaced by Dr. Lawrence (Larry) Shinn,
who would later be replaced by Howard Barlow.
|
The Hagelin deal had imploded the moment Friedman entered the hospital.
The first problem was the deal that NSA would write the manual for proper use
for NATO. The organisation strongly objected and refused to do so.
On 24 May Canine expressed Friedman's and his own dismay. But to no avail.
NSA disliked the USCIB agreement and Sinn wrote a letter to Hagelin,
asking him to stop informing potential customers that NATO approval
was forthcoming. Clearly, it was not.
NATO was rolling out AFSAM-7 (KL-7)
and not some mechanical Hagelin machine.
Sales of CX-machines
to NATO countries would eventually dry up.
Another problem was the list of proscribed countries. The COMINT department
of NSA protested, as this was actually a list of targets, which NSA
was very reluctant to share with anyone, least of all an uncleared foreigner.
In late 1955, Sinn was ordered to visit Hagelin in an attempt to repair
the broken relationship. He appologised for NSA's inability to keep their
part of the bargain, and – to his surprise – Hagelin accepted.
During Sinn's visit, Hagelin was asked about sales of CX-machines to Egypt,
that had been brought to the NSA's attention, but Hagelin said he knew
nothing about that.
|
Although Hagelin initially wanted to let his son Bo take over control
of the company after his planned retirement in 1957, he had his doubts
about the competence of his son and feels it would be better to let him
run his own business for a while. He suggested that Bo should handle the
Latin American crypto market, before taking over the company
completely. Bo, meanwhile married to his American wife Edith,
moved to Washington where he set up his own business.
|
|
|
Friedman's visit to Zug
1957
|
|
|
Dr. Lawrence Shinn, who replaced Friedman after his retirement,
only lasted throughout 1955. After a couple of visits to Hagelin,
in which he tried to repair the broken relationship, he was replaced
in 1956 by Howard Barlow, an NSA COMSEC engineer who had previously
travelled Europe together with Friedman, to check out crypto firms.
But like Sinn, Barlow didn't last.
It was clear that Hagelin was not happy. The Americans were not promoting
the CX-machines to NATO (on the contrary),
surplus M-209 machines were still 'leaking' onto the market, his main
competitor Siemens was selling to countries that Hagelin was not allowed
to sell to, and French intelligence people had rumoured that the Americans
and British services disliked Hagelin.
In the meantime, the new CX-machines
were piling up in his warehouse.
In early 1956, Hagelin began to covertly sell them to
denied countries. By late 1957 he had sold 347 machines to
Asian and Middle East countries.
In addition, he started selling to Latin American
countries, but since the US did not want to admit that these were
targets, there was nothing NSA could do about it.
|
In the summer of 1957, during a planned visit of Barlow to the
factories in Stockholm and Zug, Hagelin specifically asked for Friedman
to meet him in Zug in order to continue the talks with regard to the
Gentleman's Agreement, and to see the latest developments.
Friedman was recalled from retirement and arrived in Zug
on 22 September 1957, authorised to modify the agreement.
He stayed at Hagelin's home for a week,
during which many subjects were discussed [22].
During this week, Hagelin himself briefly travelled to Paris for a meeting
with the French Army, where he received a large order for cipher machines.
On his return he reported the French order to Friedman.
During Hagelin's absence, Friedman had visited the factory and laboratories
and was shown the latest developments by manager Sture Nyberg
and chief developer Oskar Stürzinger.
Hagelin and Friedman spoke at great length on a variety of subjects,
customers and competitors. Friedman seemed to be very interested in
what Siemens was doing with respect to their online OTT
systems and how they were handling the problem of radiation
(TEMPEST).
|
|
The first thing to be discussed between Hagelin and Friedman,
was patent 2,802,047
that Hagelin has filed in the US in October 1953
and that had been granted just last month.
Although it was granted in the US, the patent had been declined
in Japan and Hagelin was wondering why.
|
The patent describes a cipher machine in which more
contacts are used on the cipher wheels than are actually needed,
and where the extra contacts of the output of the drum are looped back
to the input. This method can be described as re-entry or
re-injection and would be used in Hagelin's new
HX-machine
that was underway.
Friedman was shocked when he saw the patent, but didn't share that
with Hagelin. The principle of re-injection was registered by the US
around 1940 in a secret patent,
so Hagelin's attempt should have
raised a declaration of interference.
|
|
|
The re-entry principle was conceived during WWII by Albert Small,
whilst working for the Army Signal Intelligence Service (ASIS),
trying to solve the high-level Japanese diplomatic Purple cipher.
It is covered by US Patent 2,984,700
and has since been used at the heart of the high-level
American cipher machine
AFSAM-7
(later: KL-7)
shown above, that was also adopted by NATO.
Although officially Hagelin should not be aware of the existence of
the AFSAM-7,
in later talks he mentioned that many of its
operators are experiencing contact problems with the rotors. 1
This proves that Hagelin was well aware of the existence
of the machine and that he might have been aware of the
re-injection principle being used in it.
He also explained how he conceived the idea after
a trip to Bonn in 1952, were he was told something 2 by
Dr. Huttenhain, followed by discussions with his chief developer
Oskar Stürzinger,
but stressed that it was his own idea.
➤ More about the KL-7
|
|
-
This is actually correct; KL-7 was notorious for its many contact
problems if the maintenance instructions were not strictly followed.
-
It is currently unclear what Hüttenhain told Hagelin on this
occasion, or what Hagelin discussed with Stürzinger afterwards,
as the original document is redacted at this point.
It is entirely possible though, that Hüttenhain was talking
about the AFSAM-7.
The same principle was later also used in the
Russian Fialka.
|
From his arrival on the 22nd, it had been clear to Friedman that there
were problems between Boris Hagelin Sr. and his son Bo. Since arriving
in the US, where he now handled the sales of cipher machines to
the Latin American countries, Bo had been spending too much money
(privately) and had even asked Boris for US$ 25,000 as an advance payment
on his inheritance.
After sending the US$ 25,000 plus another US$ 5,000 to Washington,
Hagelin, irritated by his son's financial conduct,
said that no more money was to be sent to him. According to Boris
and his wife Annie, the problems were largely due to compatibility issues
with Bo's American wife Edith. Dr. Hell,
who had visited Bo in the Spring of 1956,
had reported that Bo was homesick for Switzerland and wanted to return
to Europe, but that his wife Edith had insisted to stay.
Hagelin confined to Friedman that he had contemplated merging his
business with Siemens
as he was tired of being the only whipping boy.
Once merged with Siemens, they could take over the handicaps imposed
by limitations and restrictions as to whom I can sell what machines,
Hagelin said. Friedman asked whether he has thought of merging his
business with Hell, but Hagelin rejected the idea, as Hell was in a different
kind of business. Siemens would be more suitable.
Unknown to his son Bo at this point, was Hagelin's decision to
finally move the activities from the Stockholm factory fully over
to Zug, as he wanted all developments and operations in a single place.
If they wanted, the Stockholm employees were allowed to move to Zug as
well. Although Hagelin initially wanted to handover management of
the company to Bo, he didn't see that happening in the nearby
future, as a result of which he had to stay on for several more years.
Friedman also seemed to have trouble with Bo, as he reported to Hagelin
that Bo was currently visiting every legislation and embassy in
Washington in order to 'educate' them with instructional literature
about proper usage of the equipment. There was one document
in particular that bothered the NSA, and Friedman asked Hagelin what
he can do about it. Hagelin replied that, whilst Bo is a citizen
of the United States,
the NSA is in a far better position to handle the issue.
|
|
Friedman and Hagelin had long discussions about
Siemens and their use of OTT equipment.
Hagelin had heard that Siemens was about to sell OTT equipment to
a country behind the Iron Curtain, and wanted to know
whether this was true. It was then that he learned that the
German Government had given Siemens the green light to sell their
OTT equipment, including suitable OTT generators,
to every country in the world, except for the USSR and its satellite
states.
|
Hagelin thought that his company would follow suit. Siemens was
currently developing an OTT key tape generator for the German Government
designed by Hüttenhain. For other customers
they would order the key tape generators from Hagelin. Alternative
generators were currently being developed at Lorenz, Olivetti
and OMI. 1
Hagelin had developed OTT extensions for most of his
existing cipher machines. This means that the pin-wheels of
machines such as the C-446,
the C-52 and the CX-52
could be removed and replaced by an optional drop-in OTT adapter.
|
|
|
|
Friedman was clearly impressed by the mechanical quality of
the OTT assemblies and the relative ease with which they could be
installed. He thought that they could be suitable for NATO countries
and their allies. Asked again about Siemens, Hagelin revealed that
they have already sold OTT equipment to Yugoslavia and probably also
to Egypt and India. It would later turn out that on a recent trip
to Yugoslavia, Sture Nyberg had made a large sale for Hagelin
as well.
|
-
Is is currently unknown what type of key tape generator was being
developed by Dr. Hüttenhain (as this is redacted). Apparently neither
Hagelin nor Friedman were aware that Willi Reichert
was meanwhile developing the only true random generator for OTT
production, the so-called 'Würfel' (dice).
|
|
Something that was completely new to Friedman and that he had not heard
from Hagelin in any of his earlier conversations or letters, was the fact
that Crypto AG now produced three different versions of each of their
machines. Hagelin himself had initially thought that two categories
would have been sufficient, but after talking with NATO people, Nyberg
and Stürzinger had decided that three would be better. The three types
or categories are:
|
- Best security
Machines for the West or West-oriented countries, including NATO members
and NATO-friendly countries. These machines will be the best Crypto AG
can produce. They will offer the maximum flexibility with regards to usage,
and will have OTT capability where appropriate.
These machines will also be properly shielded against unwanted radiation
(TEMPEST)
and will be supplied with instructions for proper usage.
- Medium security
Machines for the friendly neutral countries.
These machines are not as flexible as the Type I machines.
Countries belonging to this category have not yet been determined,
but Finland, Switzerland and Pakistan are suggested.
- Low security
These machines offer the lowest quality and flexibility.
They will have a simpler keying mechanism and can not be equipped
with an OTT option. The Middle East, Asia, USSR and satellites
fall into this category, as do
Indonesia, India and Egypt.
|
|
Lacking NSA cooperation with respect to writing the manuals, Hagelin
reported that he has done it himself.
The brochures, instruction manuals and guidelines for proper usage
would be different for each category and would have 'secret marks'
to make them distinguishable. According to Hagelin it would be difficult
but necessary, to record which version each country is using.
|
|
The pocket cipher devices, that Hagelin had talked about on their
previous meeting in 1955, were now ready and in production. There are
two different versions, the
CD-55
and CD-57,
that are cosmetically identical. In other words:
the average user will not be able to tell them apart.
|
The CD-55 would be available to all customers in all countries, and would
be housed in a green case. It's operation is similar to that of the
C-38, C-446 and
M-209 and the machine would therefore be easy
to break or solve by the NSA.
The second variant is the CD-57 that is built around the new keying
mechanism, similar to the one used in the CX-52, although from the
outside this is not visible. In addition, the CD-57 can be converted
into an OTT machine quite easily, by removing the keying mechanism
and replacing it with a drop-in OTT adapter.
|
|
|
|
The CD-57 is housed in a grey case 1 and would only be available to
NATO (friendly) countries.
Although it was intially planned to have a small built-in printer, this
was dropped in the final version. Instead, the operator now reads the
output from an revolving alphabet disc at the front. Furthermore,
the cipher discs are now made of aluminium rather than plastic.
According to Boris Hagelin Sr., the small CD machine would be suitable
for secret agencies and small army units.
|
-
According to Hagelin, the CD-55 is housed in a green case, whilst the
CD-57 is grey. He probably refers to the colour of the Hamerite paint
here. For NATO, the CD-57 was also avaialable in olive green.
|
Before Friedman arrived in Zug, he had made a brief stop in Frankfurt
where he was brought up to speed by his colleagues at NSAEUR and ASAE.
They informed him about a certain Willi Reichert,
who was selling surplus WWII
Siemens T-52 machines
(also known as Geheimschreiber, Tunny and Sturgeon) to the French.
He asks Hagelin whether he knows Willi Reichert.
Hagelin replied that he doesn't know him personally, but that he
doesn't think very high of him as he sells to both sides.
Hagelin thought that Reichert had some kind of 'secret cache'
from which he obtained the old machines and spare parts, but that his
supply was about to dry up.
It is unknown why NSA was interested in
Willi Reichert,
but it must have been around this time, that Reichert had obtained
a patent for a noise generator, from Dr. Werner Liebknecht at Lorenz.
Reichert needed it to build a
true random number generator
for the creation of OTT tapes for the German Government in Bonn.
He built a successful business from this and would later move
his company to neutral Austria, where it existed until 2018 as
Mils Electronic.
|
Siemens engineers had recently discovered that radiation from a cipher
machine (both acoustic and electromagnetic) could lead to unwanted leaking
of information. In some cases it had turned out to be possible to recover
most of the plaintext from an intercepted signal, in particular when
using landlines for transmission. During his short stay in Frankfurt,
Friedman was updated on the subject and he now wanted to find out
how much Hagelin knows about this topic.
Hagelin seemed to be well-informed as he told Friedman pretty much the
same as what he had learned in Frankfurt. Like Siemens, Hagelin was now
taking the necessary precautions to shield the machines against such
radiation. According to Hagelin, the French were also aware of the
problem, but didn't take it very seriously. For Friedman this
confirmed the French situation. 1
Although Friedman acted as if this whole radiation issue was new to him,
he must have been familiar with it, as it was known at NSA for
quite some time, and had certainly been exploited by them. Unintended
leaking of information, or unwanted emanations, is also known as
TEMPEST.
|
|
-
For a number of years, high-level NATO information had been leaking
to the USSR (Russia) due to insufficient cipher security by the
French (see also above).
|
Whilst Friedman was his house guest, Hagelin left him for a couple
of days for a scheduled meeting with the French Interdepartmental Committee
on Cryptography in Paris. On his return, sooner than expected, he gave
Friedman an account of his business with the French, and shared
with him that he had just received an order for about US$ 250,000 for
CX and TC
machines. The machines were intended for use by the French Army, the Air Force
and the Foreign Office.
Whilst in Paris, he briefly discussed his Gentleman's Agreement
with the French, who told him that they too would be very happy if he
would refrain from selling certain machines to certain countries, but
that they had no legal means of forcing him to do so. Despite this, they give
him substantial orders for equipment, not just one or two like the US,
Hagelin jokingly added.
|
Friedman's intervention was appreciated by Hagelin, and the
relationship with Howard Barlow – his new NSA contact – improved.
In November 1957, Barlow visited Zug again to talk with Hagelin
and they parted as good friends.
On his return in Washington, Barlow reported that he thought Hagelin
was also pressed with sales restrictions by the French and Swedes.
His was certain of Hagelin's loyalty towards the Americans however,
as he was well aware of the M-209 threat.
|
In the following years, Friedman's health deteriorated, sending him
in and out of the hospital. As a result, he would be unable to visit
Hagelin in Europe in the foreseable future and did most of his work
from the study in his home. Financial (tax) issues prevented him from
travelling on his own expense and the agency wouldn't permit him to
visit Hagelin anyway, he wrote in 1961.
In 1962, Friedman picked up a consultancy job at RCA and started
thinking about leaving his collection to some organisation.
After Princeton University turned down his offering, he decided
to come over to Zug (Switzerland) and work with Boris Hagelin
on writing the latter's biography. He even wanted to move
to Europe permanently, but this never happened. He loved the US more.
On his return to the US, Friedman wanted work out the notes and tape
transcripts of Hagelin's biography, but recurring health problems
prevented him from doing so. In spring 1966, Hagelin's wife Annie
didn't feel well and after a short illness she died on 29 November 1966,
just a month after she and Boris had moved into their new appartment in
Minusio (Switzerland).
In 1967, Friedman found the Marshall Foundation willing to accept
The Friedman Collection and look after it. In September 1967,
Elizabeth Friedman wrote that Bill now had dayly visits from a
typist of the foundation, who was taking down his oral history.
Bill was too weak to write or type himself but he was feeling
better. She also wrote that Bo was having troubles with his wife Edith,
and that Bill was being plagued by newly released books by
David Kahn and Farago. Apparently both men had approached Friedman
several times and he had difficulty fighting them off.
In May 1968, Hagelin planned a trip to the US and was invited to
Friedman's home again. He wanted to talk about the activities
in Zug and about new technologies, such as integrated
circuits that they were now using in their devices.
On his arrival on 8 October however, Friedman had just
suffered another heart attack,
so they had to meet in the hospital in Washington.
Over the past 10 years, the relationship between Boris and his son Bo
had not been too well, to put it mildly. Although they wrote
each other occasionally, and no longer fought over the
CD-57 patent issue, they each did their
business in their own part of the hemisphere. Friedman on the other
hand, had built quite a good relationship with Bo in recent years
and saw him regularly.
In March 1969, Friedman's health had improved enough to write
a long letter to Hagelin in which he commented that
Bo had recently mentioned that he hadn't seen his father in the past
5 or 6 years, whilst he (Bill) had seen him at least three times
in the recent past. He hoped the two would see each other again
soon and spend some time together.
A month later, he returned
the hand-written biography of Hagelin to Zug, as he has no
energy left to finish it. He hoped Boris would find a good biographer
to complete it. In November 1969, Friedman died at the age of 78.
Sadly, Bo died the next year in a fatal car accident. Soon
after that, Boris Sr. resigned from the board of Crypto AG
and finished his memoirs a few years later in 1979,
first in German [2]
and then in 1981 in the English language [3].
By the time he dies on 7 September 1983 – aged 91 –
he leaves behind a healty company with customers in over 130 countries.
He leaves a legacy of beautifully crafted mechanical cipher
machines, but he also leaves Crypto AG his clouded past.
|
UPDATE —
Unknown to Friedman, Boris Hagelin had meanwhile opened negotiations
with the CIA and the German BND about procurement of his company.
On 12 June 1970, the CIA and BND secretly purchased
Crypto AG
as part of a secret operation codenamed THEASAURUS
(later: RUBICON), just six months after
Friedman's death. Bo Hagelin, who was against the deal with the CIA
and BND, died in a car crash five months later.
|
|
Der Fall Hans Bühler
1992
|
|
|
|
In 1992, Crypto AG sales representative
Hans Bühler,
was arrested in Iran on the suspicion that the Hagelin cipher machines
used by the Iranian Government were flawed, or in more popular terminology:
that they contained a backdoor.
A loose remark of US President Ronald Reagan about evidence against Libya
made them to believe that Crypto AG was cooperating with the US.
|
Bühler, fully unaware of any manipulation with the machines,
was interrogated three times a day for nine months and was finally released
in 1993, after the bail of US$ 1,000,000 was payed by Crypto AG.
This incident is certainly not the finest period in the history of Crypto AG.
Immediately after Bühler's release from prison and his subsequent
return to Switzerland, he was fired and, in addition to that,
the company wanted him to repay the US$ 1,000,000.
Bühler then decided to go public and confined his story to a book
that is published in 1994 [23].
|
|
|
The Swiss Federal Police, the Bundesanwaltschaft, investigated the
matter and questioned several people, and reported that no irrefutable
evidence against Crypto AG was ever found.
The outcome of the investigation however, remains classified to this day
and repeated requests from journalists for public disclosure of the results
of the investigation have been denied so far.
Since Hans Bühler went public, some of his former colleagues have decided
to come out as well. Former software engineer Jürg Spörndli
confirmed that the company was visited frequenty by NSA specialists and that
on several occasions he was instructed by his manager to swap a
cryptographic algorithm that he had developed, for an alternative one
that was clearly weaker [24].
In 2008, Crypto Museum had the priviledge to have a private talk with
Oskar Stürzinger,
former chief engineer at Crypto AG and first employee
of Boris Hagelin when he established his
company in Switzerland [25].
When asked about the case of Hans Bühler, he confirmed that the company
had frequent visits from NSA people who had meetings with software
engineers and that on some occasions he wasn't even allowed to be present
in the room. He said it made him feel uneasy. 1
Stürzinger also confirmed that since the Bühler case had become publicly known,
there have been governmental investigations. As a result,
the current management of Crypto AG had taken the necessary measures
to ensure that this should never happen again. He was confident about that.
➤ More bout the Hans Bühler affair
|
|
From the evidence found in the documents from the Friedman Archives [1] —
(partly) released by the NSA in 2014 — it has become clear that
some kind of agreement existed between the NSA
and Hagelin as early as 1951
and that this agreement was reviewed and/or renewed several times, in any case
in 1955 and in 1957. This agreement was never confined to paper and did not
have a termination date, and it is likely that it continued after Hagelin's
death in 1983.
In closing, we feel that we should say a few words in Hagelin's defense.
Given the fact that he had a very good relationship with the Americans
— in particular with Bill Friedman —
and that they brought him his initial
fortune by allowing him to supply cipher machines to the US Army during
WWII,
it seems only natural that he remained loyal to his old friends.
From the correspondence between him and Friedman, we get the impression
that he was a man of his word, and that he did what he did with the best
intentions with respect to safety in Europe and in the rest of the world.
The above story is the result of extensive research in the Friedman
Collection of Official Papers by the British Broadcasting Corporation
(BBC) and Crypto Museum in July 2015. It was the subject of a radio program
that was aired on 28 July 2015 on BBC Radio 4 [26].
In an official reaction to the BBC, Crypto AG issued the usual
deniel statements:
|
... whatever happened in the past, this is certainly not happening
today [...] mechanisms have been put in place, to prevent this from
happening in the future.
In 2020 however, the German TV station ZDF revealed that since 1970, the
company was jointly owned by the German BND and the
American CIA, and since 1994 exclusively by the
CIA
[28].
It means that for many years, Western intelligence services were
able to manipulate the algorithms of
Crypto AG's products
and read the communications of many of its customers. Although the
company also sold unreadable 1 equipment, the list of countries
that had access to such secure technology became shorter every year.
According to the NSA, all encryption should be readable.
➤ For further details on this topic, please refer to our follow-up
story Operation RUBICON.
|
-
In this context, readable means that the cryptographic algorithms
could be broken by the NSA.
Also known as friendly. In contrast:
algorithms that are not breakable by NSA,
are called unfriendly or unreadable.
|
- Boris Hagelin Sr.
Founder and initial owner of Crypto AG.
- Boris (Bo) Hagelin Jr.
Son of Boris Sr. who was supposed to take over the company in due course.
Died in a car accident in 1970, just five months after Boris had sold
Crypto AG
to BND
and CIA.
- William (Bill) Friedman
Cryptologist during WWII. Worked for AFSA and later for NSA.
After his retirement he remained an NSA consultant.
- Oskar Stürzinger
First employee of Hagelin in 1952 after the company had moved to Zug (Switzerland).
Head of developments at Crypto AG. Worked for
Gretag before joining Hagelin.
- Sture Nyberg
Hagelin's factory manager in the Stockholm factory,
later factory manager in Zug.
- Dr. Erich Hüttenhain
Former Cryptologist of the Third Reich
who later worked for the German Intelligence Service, the
Bundesnachrichtendienst (BND).
- Hans Bühler
Top Crypto AG sales representative who was arrested in Iran
in 1992 on the suspicion that Crypto AG equipment had a
backdoor.
- Dr. Rudolf Hell
Inventor of the Hellschreiber and the fax.
Also manfacturer of the H-54 cipher machine
under licence from Hagelin. Had an exclusive contract for the supply of these
machines to the German Army (Bundeswehr).
|
|
AFSA
|
|
Armed Forces Security Agency
Predecessor of the NSA (1949-1952).
|
|
ASA
|
|
Army Security Agency
|
|
DIRNSA
|
|
Director of the NSA
Common abbreviation for the director of the
National Security Agency (NSA),
also referred to as Director, NSA.
|
|
USCIB
|
|
United States Communications Intelligence Board
|
|
NSAEUR
|
|
NSA Europe
|
|
ASAE
|
|
Army Security Agency Europe
|
-
Declassified by NSA on 17 June 2014 (EO 13526).
|
- NSA, William F. Friedman Collection of Official Papers
Retrieved July 2015. 1
- Boris Hagelin, Die Geschichte der Hagelin-Cryptos
Original manuscript by Boris Hagelin in German language. Zug, Fall 1979.
- Boris Hagelin, The Story of Hagelin Cryptos
English translation of the above. BCW Hagelin, Zug, Spring 1981.
Later edited by David Kahn and published in Cryptologia, Volume 18, Issue 3, July 1994, pp 204-242.
- Collection of M-209 patents and license agreements
A66684. Declassified by NSA on 11 June 2014 (EO 13526).
- Boris Hagelin, Personal letter to William Friedman, 2 November 1947
A2263076. Declassified by NSA on 30 July 2014 (EO 13526).
- William Friedman, Personal letter to Boris Hagelin, 8 November 1947
A2263080. Declassified by NSA on 30 July 2014 (EO 13526).
- Boris Hagelin, Personal letter to William Friedman, 24 November 1947
A2263085. Declassified by NSA on 30 July 2014 (EO 13526).
- Boris Hagelin, Personal letter to William Friedman, 13 December 1947
A2263092. Declassified by NSA on 30 July 2014 (EO 13526).
- Boris Hagelin, Personal letter to William Friedman, 15 December 1947
A2263095. Declassified by NSA on 30 July 2014 (EO 13526).
- William Friedman, Personal letter to Boris Hagelin, 21 December 1947
A2263097. Declassified by NSA on 30 July 2014 (EO 13526).
- Boris Hagelin, Personal letter to William Friedman, 9 August 1950
A58956. Declassified by NSA on 14 July 2014 (EO 13526).
- Boris Hagelin, Post-War development work on ciphering devices by Boris Hagelin
26 January 1951. A72379. Declassified by NSA on 8 July 2014 (EO 13526).
- Release of Hagelin US Patent Application 188,546
27 March 1952. A66665. Declassified by NSA on 10 June 2014 (EO 13526).
- William Friedman, Negotiations with Mr. Hagelin
22 May 1951. Includes full report about AB Cryptoteknik, Stockholm, Sweden.
A60611. Partly declassified by NSA on 6 November 2014 (EO 13526).
- James H. Douglas, Release of the M-209 to Foreign Nations
Memorandum for the record, 15 October 1953.
A66649. Declassified by NSA on 23 January 2015 (EO 13526).
- Thomas M. Larner, Converters, M209
Memorandum for Director, National Security Agency. 15 December 1953.
A66618. Declassified by NSA on 11 June 2014 (EO 13526).
- Ralph J. Canine, Release of M-209's to the French
12 January 1954. A66647. Declassified by NSA on 10 June 2014 (EO 13526).
- William Friedman, Report of Visit to Crypto AG (Hagelin) 21-28 February 1955
15 March 1955. TOP SECRET. Draft version with hand-written changes.
A2436259. Partly declassified by NSA on 22 July 2014 (EO 13526).
- William Friedman, Report of Visit to Crypto AG (Hagelin) 21-28 February 1955
28 March 1955. TOP SECRET. Final version.
A2436243. Partly declassified by NSA on 22 July 2014 (EO 13526).
- William Friedman, Report of Visit to Crypto AG (Hagelin) 21-28 February 1955
28 March 1955. TOP SECRET. Adapted final version.
A60616. Partly declassified by NSA on 20 June 2014 (EO 13526).
- Captain I. T. McDonald, USAF, 16 June Comments of Mr. Friedman
Memorandum for Colonel Davis, 17 June 1955.
A62443. Declassified by NSA on 17 June 2014 (EO 13526).
- William Friedman, Hagelin Negotiations (draft)
Report about Friedman's visit to Zug, 18 December 1957.
A60669. Partly declassified by NSA on 20 July 2014 (EO 13526).
- Res Strehle, Verschlüsselt, Der Fall Hans Bühler
Switzerland, 1994. ISBN 3-85932-141-2.
- Line Dugstad & Osman Kibar, Den skjulte partneren
Dagens Næringsliv. Website. 2 january 2015 (updated 13 February 2015).
- Crypto Museum, Interview with Oskar Stürzinger
Basel, 7 November 2008.
- BBC Radio 4, Document - The Crypto Agreement
Evidence of a secret deal between Crypto AG (Hagelin) and the NSA.
28 July 2015, broadcast, presented by Gordon Corera.
- S.S. Snyder, Report of Special Study Group on FARMER-NOMAD
15 November 1954. TOP SECRET FROTH. Page 18.
Partly declassified by NSA on 16 June 2014 (EO 13526).
- Crypto Museum, Operation RUBICON
February 2020.
|
|
-
This link might be disfunctional, as the NSA keeps changing its URLs.
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Thursday 30 July 2015. Last changed: Tuesday, 22 July 2025 - 15:42 CET.
|
|
|
|
|
