The gentleman's agreement
Secret deal between the NSA and Hagelin · 1939-1969
In the past there have been recurring rumours about a secret
collaboration between the NSA
and the Swiss company Crypto AG,
founded in 1952 1 by the Swedish inventor
Boris Hagelin. Former
employees of the company have suggested that there were frequent
visitors from the NSA, but allegations to this effect have always
been firmly denied and substantial proof was never found.
In 2014, the NSA
released more than 7600 documents , amounting to over 52,000
pages of historical material relating to the career of
William F. Friedman (1891-1969),
who is considered the dean of American Cryptology.
More than 400 of these documents contain material about
and/or Crypto AG.
Although some documents have been fully declassified,
most of them are still heavily redacted as, according to the
NSA, they may contain information that could harm national security
or any individuals or companies that are mentioned in those documents.
Although Crypto AG in Zug (Switzerland) opened in 1952, the actual
company structure had been created shortly after Hagelin had moved
to Switzerland in 1948 to work with
Dr. Edgar Gretener.
Update February 2020 —
The story below is largely based on information from the Friedman Collection,
and covers the period from 1939 to 1969 — the year in which
Friedman passed away. It has since come to light – after a revealing
broadcast by the German television station ZDF – that a year later (1970)
was fully purchased by the German BND
and the American
, each with an equal share. This project, which is seen by many
as the intelligence coup of the century, was internally known as
The article below covers 1939 to 1969.
The period from 1970 to 2018 is described in a
It is no secret that Boris Hagelin
and William Friedman were good
friends. They were born in the same part of the world
– the Russian Empire, from which they had to flee –
they shared a passion for cryptography and they
both suffered from depressions.
During World War II they were in close contact after Hagelin
'escaped' to the US in May 1940 and subsequently sold his patent
rights to the Americans, allowing them to build the
M-209 cipher machine
Once the war was over, the two men maintained their friendly relationship
and helped each other on several occasions.
Among the released documents are several hundreds of letters between
and Hagelin. Most of these letters are of a personal nature
but some of them contain explicit NSA material. From the documents
in the Friedman Collection it becomes clear that the AFSA (the predecessor
of the NSA) and Hagelin were already negotiating an agreement of
some kind as early as 1951.
Although much of the agreement is still unknown, the article below
proves the existence of a secret Gentleman's Agreement between
the NSA and Hagelin/Crypto AG during the 1950s.
One of Hagelin's biggest achievements was the sale of
M-209 cipher machines
to the US Army. Based on the
C-38 – a small
cipher machine with 6 pin-wheels – the M-209 was adapted to meet the
requirements of the US Army. Although Hagelin would normally build
all machines in his factory in Stockholm (Sweden), he allowed the
American's to build the machine under licence.
On 10 May 1940, Hagelin travelled on the last ship from Europe
to the US, with two prototypes of the C-38 in his lugguage. It would
eventually evolve into the
and would become the largest
sale of the so-called C-machines he ever made .
The machines were built at the
Corona plant of the L.C. Smith typewriter company in Syracuse,
with a daily output of up to 500 units.
The image on the right shows a typical M-209 as it was used
by the US during WWII. It has 6 pin-wheels at the front,
each with a different number of steps, and a cage with 27 bars
at the rear.
As Hagelin couldn't return to Sweden during the war,
he stayed in the US where he spent his time serviceing
the BC cipher machines 1 of some American
organisation. When he returned to Sweden in 1944, more than
50,000 M-209 machines had been built by the Smith Corona Typewriter
Company and by the end of the war, this amount had nearly
trippled to a staggering 140,000.
To allow production of the
M-209 and the
BC-38 (shown on the right)
in the US, and to avoid paying high tax fees in Sweden,
Hagelin had transferred the full and royalty-free patent rights
to the US Army, for the sum of US$ 3,023,410,
of which US$ 2,548,225 was for him personally.
The balance of US$ 475,185 went to the Hagelin Cryptograph
Company (HCC) in Sweden . 2
In return, the US Government granted Hagelin a royalty-free license
for the production of M-209 and BC-38 machines and improvements
thereof, so that
he was still allowed to sell his invention.
It is worth noting that the machine did not provide absolute secrecy.
During WWII, the Germans were able to decrypt a message in under 4
hours if they had received messages in depth 3 .
This was not considered a problem however, as the M-209 was only used
for tactical messages (e.g. field maneuvers) which had lost their
significance by the time they were broken by the Germans.
A BC cipher machine (e.g. a BC-38) was basically a C-machine
(e.g. C-38) that was extended with a keyboard, a motor-driven
mechanism and a double printer.
The exact amount of the fees payed to Hagelin are difficult to
determine from the papers, as the contract was reopened and
renegotiated several times during the war . In the end, Hagelin had
to become a US citizen and pay US$ 700,000 in taxes to the US,
in order to avoid paying much higher taxes in Sweden.
In cryptoanalysis, receiving messages 'in depth' means that two
or more messages were intercepted that had been encrypted with
the same key. In case of the M-209, two messages were enough to solve it.
Shortly after WWII, in 1947, many M-209 machines that were no longer
needed by the US Army, started appearing on the US surplus market
for prices as low as US$ 15. On 2 November 1947,
in a letter to Friedman ,
Hagelin expresses his concern about the fact that the Dutch Purchasing
Commission in the US had bought a first sample order of 100 units.
In the letter Hagelin writes:
If this goes on, our own business here will be ruined.
He also points out that this should not be possible as per agreement
with the War Department. Friedman answers prompty and replies that this
was clearly a mistake and that necessary steps had been taken to
ensure that this would not happen again . Nevertheless, the Dutch
are able to pick up their order of 100 machines in New York a few days
later, which were subsequently sent to the Dutch East Indies,
as Hagelin reports to Friedman on 24 November 1947 .
The matter clearly worries Hagelin, as two weeks later, on 13 December,
he writes again to Friedman asking him to investigate the
Automatic Radio Manufacturing Company
in Boston, who appears to be offering M-209 A machines
for as little as US$ 2 each .
And two days later this is followed by another letter, after he has been
informed by his Dutch agent that the Dutch Army has been offered
450 cipher machines M-209 from an undisclosed source for US$ 2 .
Although Friedman replies to him promptly, it seems that there is little
he can do. Although the US Army is free to sell the machines within the
US, he reaffirms that they have no intent to sell any surplus
machines and that he has no idea who is offering them.
He also suggests that the offered M-209 machines may have been
unrepairable ones that should have been destroyed .
➤ The issue of the surplug M-209 returns in 1953
Immediately after the end of WWII, Hagelin sets out to improve his
existing cipher machines, by adding new features and, more importantly,
improving security by implementing a new keying mechanism. This new
mechanism causes irregular stepping of the cipher wheels and is therefore
far less predictable than the regular stepping of the wheels in
existing models like the M-209.
In August 1950, Hagelin writes to Friedman about his recent
developments and announces some new machines .
On 5 October 1950, he files a patent for the new machine with the
US patent office, followed by applications in Sweden and ten further
Early in 1951, the new keying mechanism is ready, as confirmed
in a letter that Hagelin writes on 26 January .
Another new machine, that is at at that under development in Stockholm, is an
automatic cipher machine for teleprinter circuits. The machine has a
built-in C-line mechanical cipher machine that is used to create a 5-bit
pseudo random code, which is mixed with the plaintext.
Apart from the C-line pin-wheel mechanism – which is used here as
a key stream generator –
it also has a built-in 5-level paper tape reader that can be used instead.
When the tape is filled with random characters,
the device is converted to a One-Time Tape (OTT)
cipher machine, or mixer.
When properly used, OTT systems are theoretically unbreakable
— they are based on the
One-Time Pad (OTP) cipher — and
provide the best possible protection for sensitive information.
For this reason they were often used for diplomatic traffic. In
practice however, especially in the early 1950s, the key tapes
were sometimes made by means of mechanical — deterministic — methods.
The Hagelin Negotiations
In February 1951, a prototype with the new keying mechanism,
based on a modified M-209, is sent from Stockholm to the AFSA
for evaluation. The new technology causes great upset,
as it defeats the existing methods for solving pin-wheel cipher
The AFSA is afraid that Hagelin might want to sell machines with
this new technology to countries like the USSR .
At the same time, Hagelin is regarded a 'good friend' and a valuable
source of information about other nations and their developments.
In a USCIB meeting on 9 March 1951, it is reported that
negotiations have been started with Boris Hagelin.
On 22 May 1951, in a meeting at AFSA, the situation is discussed
with various parties, including the CIA. At this meeting,
Friedman presents a detailed report in which the Hagelin Company
and the current situation are analysed .
- Hagelin is at that moment the only civil manufacturer of cipher machines in the world 1
- AFSA considers the Hagelin Company as a serious international player
- AFSA considers Hagelin's expanding market as a security threat
- AFSA considers Boris Hagelin a good and loyal friend
- Hagelin will continue to sell readable machines to all nations
- The CIA will control the worldwide sale of the new secure (unreadable) CX-machines
- Hagelin will receive US$ 700,000 as compensation 2
- Hagelin will provide information about all customers and sales
- Hagelin's offices and agents abroad may be used for information-gathering
- Hagelin's new technology will be considered for use by NATO
- Hagelin's OTT technology might also be of use to NATO
With respect to point (5) above, the report literally says:
It would be to the advantage of the U.S. Government if the
proposed new or improved Hagelin cryptoequipments were prevented from being
developed, manufactured, and sold commercially on the open market.
Concerning point (7), it is even contemplated that it might
be possible to gather intelligence from the USSR and its satellites,
if Hagelin was allowed to sell to them — closely controlled, of course —
but it is doubted as to whether the USSR would buy from a (former)
In this context, 'civil' has to be read as 'on the open market'.
There were other manufacturers, such as
and Philips, but
their markets were largely controlled by their governments
and the military.
This was negotiated by Stu Hedden, Hagelin's representative in the US,
who would get US$ 250,000 of it. In 1952, Hedden would be Inspector
General at CIA.
Secrecy Order on Patent
Friedman prepares a proposal for an agreement with Hagelin, along the
terms that had been discussed. He puts it before the USCIB
and the AFSA Committee (AFSAC), but the latter turns it down.
In June 1951, Friedman tries again, but despite his apocalyptic prospect
— we will be blind within a few years —
AFSAC turns it down again.
This ends the negationations with the CIA.
Despite all this, Hagelin acts as if a deal has been struck and keeps
his part of the 'deal'.
But then, on 14 September 1951, things go horribly wrong when
Hagelin's patent for the new technology
is placed under Secrecy Order at the request of the AFSA,
nearly a year after it was filed by Hagelin.
Hagelin is very upset by this —
he doesn't know what to do — and Friedman is furious as he sees a
long-term relationship with a reliable friend being jeopardized.
Friedman comments that the patent has been filed in 10 other countries
in which the US has no jurisdiction, so there is no secrecy whatsoever.
He also argues that, if thousands of these systems are
in use, it is unrealistic, if not absurd, to think that one could
keep it secret. Furthermore, the US could be liable to suit
by Hagelin, with
claims running into millions of dollars.
Finally, on 27 March 1952,
the Chief of the Office of Communication Security of AFSA
withdraws the secrecy order and requests the relationship
between the US and Mr. Hagelin to be reexamined .
Friedman's visit to Stockholm
In 1952, the AFSA was dissolved into the newly established
National Security Agency (NSA)
and not much happened on the Hagelin-front.
This changed in the summer of 1953 when – after the BRUSA 1
Conference of June 1953, the British intelligence service
GCHQ highlighted the Hagelin threat and demanded quick action.
With this report, Friedman went to the director of the NSA.
General Canine, the new director of the NSA allowed Friedman
to travel to Stockholm (Sweden) and Zug (Switzerland) to visit
Hagelin's factories and discuss a possible agreement.
Friedman arrived in Stockholm in October 1953 and toured the
factory with Hagelin. He made an informal proposal to renew
the negotiations and speak with General Canine directly.
Hagelin agreed and, on 17 November, he and Friedman sailed
on a passenger line from Le Havre (France) to New York.
On 5 December 1953, Hagelin, Friedman and Canine set down to
discuss an agreement. They agreed to a denial operation:
- NSA will provide a list of proscribed countries (for CX and OTT machines)
- Hagelin can sell to other countries (including NATO, but no guarantees)
- Hagelin will receive compensation for lost sales 2
- Hagelin will provide details about customers, sales and future machines 3
- The deal will be valid for 6 months awaiting a formal written agreement
In addition, Hagelin agreed that, if and when he got ready to sell
his company, the US would have the first right of refusal, and could
approve any prospective buyer, should the US decide not to buy.
In addition, Hagelin suggested that the NSA could develop the
crypto heart for the CX-52.
The deal was entirely to the US' advantage but two days later,
to everyone's surprise, the USCIB rejected it. Some argue that
NSA is not in the position to encourage NATO sales, whilst others
do not want to disclose the list of proscribed countries
as it would the reveal the NSA's targets.
Britain-USA (i.e. GCHQ-NSA).
DIRNSA Canine suggests supplying surplus M-209 units, or an annual
lump sum payment, but Hagelin is not happy with the latter as
he doesn't want to be payed for doing nothing.
This includes early prototypes for evaluation by the NSA.
The 'situation' with the M-209 was not solved permanently
and would return on several occasions in the following years.
By October 1953, the US had received requests from several countries for
the release of of M-209 machines, but pending Negotiations with
Mr. Hagelin, the AFSA
(by now: NSA)
refused to do so .
This prompted the US Army to come up two months later with a list of
countries that were currently using the M-209 and/or who had
requested access to them :
On 12 June 1951, the US Army has supplied 229 converters M-209 to the
Philippine Armed Forces with the consent of AFSA in addition to
the 369 units that were already in use there at the time.
On 6 October 1952, the Uruguayan Government wanted to buy 36
converters M-209, but this request was turned down on 14 October 1952,
saying that the equipment was not available for sale.
On 16 March 1951, India indicated that they wanted to buy
M-209, M-209a and M-209b machines from commercial sources (presumably
in the US) but that they wanted to have copies of the TM 11-380 manuals
before doing so. The request was denied as it was addressed to
the wrong department.
On 23 september 1952, France wanted 450 converters M-209
in addition to the 1850 units that were already in use at the time.
The request was turned down for several reasons.
On 22 September 1953, France again put in a request for 350 units
for use in French Indo-China. This request was turned down by the
NSA as it might jeopardize current negotiations between the NSA
and Mr. Hagelin in Sweden. The restrictions on France were
later lifted on 12 January 1954 after approval from Hagelin (see below).
On 23 June 1953, Portugal requested clearance for a supply of modified
M-209b converters, but this request was denied on legal grounds.
On 16 August 1950, The Turkish Army requested procurement of M-209
machines or, if it was denied, suitable action to allow such machines
to be obtained from commercial sources in Sweden. The request was
denied, but the American CSP-845 strip cipher was offered as an
alternative. On 22 May 1953, Turkey put in a request for 600 M-209s,
but it was turned down again, this time on the ground that it
would exhaust US reserves.
- Latin America
M-209 converters were in use by the Governments of Ecuador (1947),
Venezuela (1948), Argentina, Columbia and Peru (1951).
Some training was given to those countries, although this was strictly
prohibited, as reconfirmed in a memo of 17 February 1953.
The request for M-209 machines from France in September 1953 was
denied by the NSA pending negotiations with Hagelin. Although
there was not yet a deal in place between the NSA and Hagelin at that
time, on 12 January 1954, the restriction for France was lifted after
Boris Hagelin had given his consent. This allowed the French
to buy more M-209 machines for Indo-China .
In the meantime, Hagelin had further developed his new machines
and was ready to take them into production. The first one was
It was similar to the old
but had replaceable wheels.
The next one was the CX-52,
which was similar, but featured the new keying mechanism.
The order of the pin-wheels could be swapped and it was
even possible to have up to twelve different wheels to choose from.
The machine was suitable for the 26 letters of the Latin
alphabet. Each wheel had a different number of segments and
advanced in an irregular manner.
In a memorandum of 5 February 1954, the NSA expresses its concerns
about the newly released Hagelin machines, in particular
and the forthcoming TC-55.
Friedman is asked to liaise and make
a proposal to Hagelin on behalf of the director of the NSA (DIRNSA).
It is further agreed that Friedman will be using his personal
stationary and private address for any correspondence with Hagelin,
in order not to ring any bells when official NSA letters arrive
in a small European town .
Following this, and in anticipation of the outcome,
Hagelin and DIRNSA enter into a Gentleman's Agreement or,
as they call it, a Gentleman's Understanding,
for a period of 6 months, during which time the details of the
renewed Hagelin Negotiations will be finialised.
Although the exact details of the negotiations with Hagelin have
not yet been declassified, it must have been a very serious matter,
as it took the NSA twelve months, rather than the anticipated six months,
to come up with a suitable proposal. Finally, in February 1955, Friedman
travels to Zug (Switzerland) for a 'personal' visit to Boris
Hagelin, with the intent to present him a new proposal.
In the meantime, in June 1954, the Analytic Equipment Technical
Committee — who are tasked with breaking alien cipher systems —
asks their research team to review the current
codebreaking equipment and evaluate the impact of any newly developed
cipher machines, such as the CX-52. In their final report of
15 November 1954, the special study group reports on page 18 :
188.8.131.52 The Hagelin C-38 is well covered at present by computer
programs and special-purpose machines. Any CX-52 traffic that appears
will tax our present facilities severely. It will require more compli-
cated, faster programs; and most of the present special-purpose equipment
will not be applicable.
The following information was extracted from the report that
Friedman filed on his return to the US, on 15 March 1955. Unfortunately,
much of this report has been redacted, but fortunately, there are
three versions of this document, each of which has been redacted
. As a result we are able to fill-in some
of the gaps and get a more complete picture.
In February 2020, we were able to fill in more of the gaps, after the
Operation Thesaurus — the secret purchase of Crypto AG by BND and CIA
Friedman's visit to Zug
21-28 February 1955
In late 1954, NSA director Ralph Canine advised that the Hagelin
negotiations should begin again. On 17 December, the USCIB authorises
a visit to Zug, where Friedman shall propose a new deal:
in return for controlled sales,
USCIB will authorise a statement to NATO that, if properly used,
the CX-52 provides good security.
USCIB hopes that this proposal will satisfy Hagelin.
On 21 February 1955, Friedman arrives in Zug (Switzerland) and
stays at Hagelin's home for a full week, during which time they
discuss cryptographic, business and private matters.
Boris Hagelin's son, Bo, will also be present during some of the
During these meetings, Friedman asks about the differences
between the various machine variants and about the customers
that these machines are sold to. Finally, he puts the authorised
At this point in time, the factory in Stockholm (Sweden) is manufacturing
the current C-line of machines (C-52
with a capacity of 60 to 80
machines per month. Besides these machines, the Stockholm plant has also
received an order for 500 to 1000 old
Hagelin is about to close down the factory in Sweden and
move the entire production and the production facilities over to a new building
in Zug (Switzerland) as soon as this is ready.
The top floor of the new building will be converted into an appartment
for Sture Nyberg, the current plant manager in Stockholm, who will move
to Zug with his family to become the new plant manager there. It is Hagelin's
intention to let his son Boris Hagelin Jr. (Bo) take over the company
when he himself retires in two years time as he reaches the age of 65.
The message that the old C-446
is to be taken into production again, plus Hagelin's suggestion
that he might want to make more, and sell them to other countries,
clearly pleases Friedman.
Being very similar to the M209,
Friedman reports about the C-446:
This model is, of course, easier to solve than the new models.
Production of the C-446 machines will be completed in Sweden, even
after the move to Zug is completed, where the Johannes Gauge Company
has taken over the building and the workers and has been given the
tools, jigs and dies on loan.
Amoung the things Friedman wants to discuss, are the capabilities of
the new machines, in particular the
CX-52, and the
various variants of these machines. For this, Friedman and the Hagelins
agree to use specific (secret) designators, which are actually suffixes
to the model name. First of all, Hagelin recognises the
following two classes of C-line machines:
- Class 1
Where all keywheels advance the same number of steps.
In the case of the M-209, the C-446 and a particular version of the
C-52, the advance is 1 step. The machines in this class are not
to be equipped for operation with
One-Time Tape (OTT).
- Class 2
Where stepping is irregular and where OTT readers are provided, as well
as equipment for producing OTT tapes.
These machines use the new technology.
No longer in production but still in use with the US Army and some
of its customers.
No longer in production but still in use by some countries, including
The Netherlands. Will be taken into production again for a limited
period, following an order for 500 to 1000 units by the Foreign Office
and the Department of Defense of The Netherlands.
By default, this model is compatible with the
and C-446, but can also
be made to function with interchangeable key wheels and with key wheels
that have a larger number of elements (steps) than M-209 and C-446.
The C-52 can be supplied with more than 6 key wheels and may also have
more slide bars than the M-209 and C-446.
This model is supplied with Standard A slide bars, which
produce irregular or varying angular displacements of the key wheels,
each wheel advancing 0, 1, 2, 3, 4 or 5 steps on each operation.
This is the default and most secure version of the machine.
This model is supplied with Standard B slide bars, which
produce regular or fixed anglular displacements of the key wheels,
all advancing the same number of steps, but the number of steps may
be any one from 1 to 32. It is weaker than the a-variant.
This model is compatible with the old types of C-machines, the M-209, the
C-446 and a certain version of the C-52. It is the weakest of the models.
This is basicially a CX-52a that is enhanced with the so-called
Complementary feature (here written as 'Komplimentary'),
also known as the Hüttenhain 1 feature.
This is a CX-52b that is enhanced with the Hüttenhain 1 feature.
This variant is built by HELL
(licenced by Hagelin) for the German and
Austrian market for which HELL has an exclusive contract.
It is the only version that is approved by
Dr. Erich Hüttenhain 1
for use by the German Bundeswehr (Army), where it is known as the
CX-52c with Hüttenhain 1 feature.
This is a 10-digit numerical-only variant of the CX-52.
These machines can be of the a, b or c type and may have the complementary
feature as well. For example: CX-52ak/10.
This is a 30 character version of the CX-52, suitable for the Arabic
(and possibly Russian) alphabets.
For example: CX-52/30 Arabic.
This is the Random Tape or
One-Time Tape (OTT) variant of the machine.
One of the goals of Friedman's visit to Zug, is to find out what models
Hagelin is selling to which customers. When asked, Hagelin gives a full
rundown of his current customer base, without any hesitation,
and provides details of the machines
he has sold or is currently selling to them:
EgyptNegotiating for 50 x C-52 and 10 x BC-52
Jordan10 x C-52, 20 x BC-52 (UK is paying for this order)
IranNo agent, no interest
IraqNegotiating for 50 to 200 x C-52 with Arabic characters
Syria50 x C-36 1
Saudi ArabiaNo agent, no sales yet
IndiaInterested in C-52 and BC-52
PakistanWaiting for C-52 for Hindustani (29 or 30 characters)
Belgium200+ x CX-52a, 100 variable type wheels for C-446
France80 x CX-52a, 20 x CX-52a/10 (for study), interested in HX
Portugal5 x CX-52a
ItalyAwaiting NATO viewpoint on CX-52
Greece and TurkeyInterested, documentation sent. Trip postponed.
Holland500 to 1000 x C-446, some with OTT (C-446/RT)
Dutch ArmyInterest in CX-52 and BCX-52.
United Kingdom2 x CX-52
Germany and AustriaH-54 supplied by HELL (CX-52bk) 2
SwedenWill replace their C-446 by CX-52 units (long-term)
SpainInterested in C-52, no orders yet
Eire2 x CX-52
Indonesia20 to 30 x C-52 (waiting for order)
Poland and Hungary2 x C-446 each 3
JugoslaviaInterested in C-machines 4
Central AmericaNot much interest (see below)
Costa Rica2 x C-446
CubaInitially interested, but no sales
MexicoCurrently trying to raise interest
VenezuelaAbout to order some machines
Brazil60 x CX-52c, interested in 500 more
Argentine13 x CX-52c
ChileNot much interest, will buy some
PeruInterested in 200 x CX-52
Uruguay5 x CX-52, 2 x BC-52 (first experience with crypto)
Columbia100 x CX-52, 40 x BCX-52
Being asked by Friedman where he got the old C-36 machines from,
Hagelin replied that they had found some in the basement of the
plant in Stockholm.
The CX-52bk (or HELL H-54)
was the only model that was approved by
Dr. Erich Hüttenhain
for use by the German Bundeswehr (Army).
The head of Swedish COMINT, Rossby, didn't think the Russians were
helping their satellites with cryptographic advice or material.
Friedman decided not to comment on this.
At this point, Hagelin was treating Yugoslavia the same as the Arabic
countries, but Friedman suggested to treat them as a satellite of the
USSR (Russia). Hagelin replied: That's OK with me if you want it
As announced in 1950, Hagelin now produces equipment for the online/offline
protection of teleprinter circuits. During the meeting,
Hagelin tells Friedman that the TC-52,
which has been in production for a while now, will soon be replaced by the
Both machines offer two types of encryption: built-in pin-wheel encryption
and, as an option, One-Type Tape (OTT).
The NSA is clearly worried about the availability of automatic OTT equipment
to certain countries.
Both Hagelins are very enthusiastic about the new pocket
cipher device that is currently being developed. The device uses six
notched discs and operates just like the C-machines, albeit without
the slide bars. The cipher discs will be made of plastic and should be
user-configurable. Furthermore, Hagelin Sr. hopes to be able to add a small
paper strip printer to the design.
Although Hagelin Sr. gives the impression that he invented the machine
himself, his son Bo tells Friedman, in a private conversation, that it
was actually his idea and that it was initially rejected by his
father in 1951. The idea came to mind after repeated requests from
various customers for a cipher machine that would fit in a pocket.
Recently, the Swedish company
introduced a small pocket size cipher machine that was developed by
Vigo Lindstein, a former Hagelin employee. The machine is called
HC-9 and was at this time
under evaluation at NATO.
According to Bo, this has prompted his father to come up with a smaller
device, of which he now thinks that he invented it. When Bo suggested
that it was actually his idea, and that he would like to receive
some royalties over it, his father had become furious, Bo tells Friedman
Patents for the new machine, that will be called CD-55, have been filed
and it will soon be taken into production. Various models are being
considered, including one, if possible, with OTT.
Many other interesting points are raised during the various meetings
between Friedman and Hagelin on this visit, such as the modification of
the B-211 for the French,
and the production of HX
and CX machines by the private French company
Societé Electronique Automatisme (SEA).
Another point that is raised, is the current situation with
Siemens and Halske.
Although the German Siemens company clearly is a competitor of
Hagelin, there are strong connections and there have been frequent exchanges
of information between the two companies, some of which in relation to the
work of Dr. Erich Hüttenhain,
the former Cryptologist of the Third Reich
who now works for the German Intelligence Service, the
At several moments in history, Hagelin contemplated selling
his company to Siemens, but this never happened. In the talks with Friedman,
Hagelin mentions that the relations with Siemens and Halske are now formalised
in a signed contract. As a result, Siemens will not make any cryptomachines
themselves and Hagelin will refrain from producing teleprinter machines.
In this contract, the market for teleciphering machines is
divided as follows:
Crypto AG alone
- West Germany
- West Austria
- America (all except Brazil, USA and Canada)
- Africa (all except Egypt)
- Asia (all except India, Indonesia and China)
Siemens and Grypto AG together
- Benelux 1
Areas not yet agreed
- Russia and all satellites
- East Germany
- USA and Canada
Benelux is the abbreviation for Belgium,
Netherlands and Luxemburg.
After having been Hagelin's guest for several days, on the evening of 25
February, Friedman feels the time has come to place the NSA proposal
before Hagelin, or, as he puts it in his report:
the real object of my visit to Zug.
He begins by thanking Hagelin for his patience
and for keeping his part of the Gentleman's Agreement, despite the
fact that the NSA has exceeded the deadline.
The NSA had been struggling for more than twelve months, rather than the
anticipated six, to work out a proposal that would be satisfactory for them
(the NSA) as well as perhaps acceptable to Hagelin.
They had hit upon a simple one that he was now authorised
to put before Hagelin.
Hagelin replies by thanking Friedman for the appreciation and understanding
of his position and for various favours that were done for him and his
family, in particular for his son-in-law Conradi and for his wife's cousin
Miss Barth, who had been given a position at the NSA or the US Army.
Friedman then conveyed to him practically verbatim the terms of the
proposal authorised in USCIB: 29.14/29
of 27 December 1954.
He tells Hagelin that he does not have to decide right away, and
that he can take some time to think it over, but to his great surprise,
Hagelin accepted the proposal then and there, without any reservations
or desire for modifications.
When Friedman offers him to ask DIRNSA to confirm the deal
in a formal letter, Hagelin replies that he doesn't want anything
with respect to this deal on paper.
Although the contents of the proposal authorized in USCIB: 29.14/29
are still classified, we now know the details:
- From 28 February 1955 onwards, the agreement between NSA and Hagelin is official
- The deal is secret and is for an undefined term (no end-date)
- Hagelin will refrain from selling to proscribed countries 1
- Hagelin will not be payed for this
- Hagelin will continue to supply information to the NSA,
- NSA will write the brochures and manuals for the CX-52 models . 2
- NSA will approve CX-52 for NATO (if properly used)
- NSA will write the 'proper usage' manual for for NATO. 3
Further to this we can make a few 'educated guesses':
- Hagelin will continue to receive personal favours for him and his family.
- Hagelin will be able to buy back several lots of M-209 machines.
- Bo Hagelin Jr. has asked for a TYPEX machine which Friedman hopes to find for him.
- The US Army will place a large order for C-52 and CX-52 machines.
Hagelin will not sell secure machines (like CX-52 and OTT machines)
to countries on this list.
These manuals were written by Dr. Harold J. Stukey
and Francis A. Raven of the NSA .
In order to make best use of their machines, Hagelin usually
released a manual for 'proper usage'. For the machines
used by NATO, it was agreed that the NSA would write this manual.
This could imply that Hagelin received NATO orders as part of the
deal with the NSA, but this can not be confirmed at present.
In the past, Hagelin has noticed that some of their customers are not using
their cipher machine to the best of its abilities. For example: the
configurable pins on the cipher wheels and the lugs on the sliding bars
can be set up in such a way that the cipher period 1 is shortened.
In order to avoid such situations, Hagelin has issued a manual for
'proper usage' for each of his machines.
One of the outcomes of the Hagelin Deal, is that the NSA will provide
the manual for 'proper usage' of the CX-52. The manual will
be written by Dr. Harold Stukey and Francis A. Raven, two high ranking
cryptologists at the NSA. Although this can be seen as a gesture of
courtesy on behalf of the NSA, it is far more likely that it was used
by the NSA to weaken the cipher by manipulating the instructions for
best use. It takes the NSA seveal months to complete the manual,
during which time Friedman regularly keeps Hagelin informed about the
During the meeting, Hagelin is clearly worried about the proper use of his
machines by NATO. He asks Friedman how he can assure that NATO uses
the devices properly. Friedman answers that he does not need to worry
and that the NSA will take care of that too. This means that the NSA
will also write the instructions for best use for NATO.
This fits in with the NSA's desire of the 1950s to improve the overall
cipher security of their NATO partners, in particular that of France. 2
In cryptography, the cipher period is the time it takes for the
key stream to repeat itself.
At this time, France is known to use weak cipher systems and/or
use their stronger cipher systems in an improper manner, as a result
of which many NATO secrets have leaked to the USSR (Russia).
Various memos in the Friedman Archive confirm that the NSA is
determined to fix this leak.
It is worth noting, that during Friedman's visit he becomes aware of
problems in the relationship between father Boris and son Bo.
He makes two remarks: (1) Bo has acquired the exclusive sales rights of
the new portable CD-55 cipher machine,
and (2) Bo offers to provide copies of internal correspondence
(i.e. spy), if that would help to
cement the relationship with the Americans.
The first remark (CD-55) would eventually get in the way of a smooth
relationship with the Americans, who regarded Bo Hagelin as an unguided
missile, more inclined than his father to sell to the highest
bidder, rather than to a friendly country .
On his return from Zug on 3 April 1955, Friedman suffers a heart attack and
is hospitalised, which delays the implementation of some of the points
of the agreement. After he is discharged from the hospital, Friedman
works from his home for a while and writes to Hagelin several times.
Later that year, in August 1955, Friedman officially retires from the NSA but will
remain working for the agency as a consultant. Due to his bad health -
he has a serious heart condition - he is unable to handle
Hagelin, so the NSA sends Dr. Lawrence (Larry) Shinn in his place while Bill Friedman
takes a step back. He would later be replaced by Howard Barlow.
The Hagelin deal had imploded the moment Friedman entered the hospital.
The first problem was the deal that NSA would write the manual for proper use
for NATO. The organisation strongly objected and refused to do so. On 24 May
Canine expresses Friedman's and his own dismay. But to no avail.
NSA disliked the USCIB agreement and Sinn wrote a letter to Hagelin
to demand that he stop informing potential customers that NATO approval
was forthcoming. Clearly, it was not.
NATO would be implementing AFSAM-7
and not some mechanical Hagelin machine. Sales of CX-machines
to NATO countries would eventually dry up.
Another problem was the list of proscribed countries. The COMINT department
of NSA protested, as this was actually a list of targets, which NSA
was very reluctant to share with anyone, let alone an uncleared foreigner.
In late 1955, Sinn was ordered to visit Hagelin in an attempt to repair
the broken relationship. He appologised for NSA's inability to keep their
part of the bargain, and – surprisingly – Hagelin accepted.
During Sinn's visit, Hagelin was asked about sales of CX-machines to Egypt,
that had been brought to the NSA's attention, but Hagelin said he knew
nothing about that.
Although Hagelin initially wanted to let his son, Bo, take over control
of the company after his planned retirement in 1957, he has his doubts
about the competence of his son and feels it would be better to let him
run his own business for a while. He suggests that Bo should handle the
Latin American crypto market, before taking over the company
completely. Bo, meanwhile married to his American wife Edith,
moves to Washington and sets up his own business there.
Friedman's visit to Zug
Dr. Lawrence Shinn, who replaced Friedman after his retirement,
would only last through 1955. After a couple of visits to Hagelin,
in which he tried to repair the broken relationship, he was replaced
in 1956 by Howard Barlow, an NSA COMSEC engineer who had previously
travelled Europe together with Friedman, to check out crypto firms.
Like Sinn, Barlow would not last.
It was clear that Hagelin was not happy. The Americans were not promoting
the CX-machines to NATO (on the contrary), surplus M-209 machines were
still 'leaking' onto the market, his main competitor Siemens was selling to
countries that Hagelin was not allowed to sell to, and French intelligence
people had rumoured that the Americans and British services disliked Hagelin.
In the meantime, the new CX-machines were piling up in his warehouse.
In early 1956, Hagelin began to covertly sell them to
denied countries. By late 1957 he had sold 347 machines to
Asian and Middle East countries.
In addition, he had started selling to Latin American
countries, but since the US did not want to admit that it targeted
those countries, there was nothing to be done.
Then in the summer of 1957, during a planned visit of Barlow to the
factories in Stockholm and Zug, Hagelin specifically asks for Friedman
to meet him in Zug in order to continue the talks with regard to the
Gentleman's Agreement, and to see the latest developments.
Friedman is recalled from retirement and arrives in Zug
on 22 September 1957, authorised to modify the agreement.
He stays at Hagelin's home for a week,
during which time a variety of subjects are touched.
During this week, Hagelin himself briefly travels to Paris for a meeting
with the French Army, where he gets a large order for cipher machines.
On his return he reports his dealings with the French to Friedman.
Whilst Hagelin is away, Friedman visits the factory and laboratories
and is shown the latest developments by manager Sture Nyberg
and chief developer Oskar Stürzinger.
Hagelin and Friedman talk at great length on a variety of subjects,
customers and competitors. Friedman seems to be very interested in
what Siemens are currently doing with respect to their online OTT
systems and how they are dealing with the problem of radiation
The first thing to be discussed between Hagelin and Friedman,
is patent 2,802,047
that Hagelin has filed in the US in October 1953
and that had been granted just last month.
Although it was granted in the US, the patent was declined in Japan.
Hagelin wonders why that would be the case.
The patent describes a cipher machine in which more
contacts are used on the cipher wheels than are actually needed
and where the extra contacts of the output of the drum are looped back
to the input. This method can be described as re-entry or
re-injection and will be used in Hagelin's new
which is underway.
Friedman was shocked when he saw the patent, but didn't say that
to Hagelin. The principle of re-injection was registered by the US
around 1940 in a secret patent,
so Hagelin's attempt should have
raised a declaration of interference.
The re-entry principle was conceived during WWII by Albert Small,
whilst working for the Army Signal Intelligence Service (ASIS),
trying to solve the high-level Japanese diplomatic Purple cipher.
It is covered by US Patent 2,984,700
and has since been used at the heart of the high-level
American cipher machine
shown above, that was also adopted by NATO.
Although officially Hagelin should not be aware of the existence of
in later talks he mentions that many of its
operators are experiencing contact problems with the rotors. 1
This proves that Hagelin was well aware of the existence
of the machine and that he might have been aware of the
re-injection principle being used in it.
He also explains how he conceived the idea after
a trip to Bonn in 1952, were he was told something 2 by
Dr. Huttenhain, followed by discussions with his chief developer
but stresses that it was his own idea.
➤ More about the KL-7
This is actually correct; the KL-7 was known for its many contact
problems if the maintenance instruction were not strictly followed.
It is currently unclear as to what Hüttenhain told Hagelin on this
occasion, or what Hagelin discussed with Stürzinger afterwards,
as the original document is redacted at this point.
It is entirely possible though, that Hüttenhain was talking
about the AFSAM-7.
The same principle was later also used in the
From his arrival on the 22nd, it had been clear to Friedman that there
were problems between Boris Hagelin Sr. and his son Bo. Since arriving
in the US, where he is now handling the sales of cipher machines to
the Latin American countries, Bo had been spending too much money
(privately) and has even asked Boris for US$ 25,000 as an advance payment
on his inheritance.
After sending the US$ 25,000 plus another US$ 5,000 to Washington,
Hagelin, irritated by his son's financial conduct,
said that no more money was to be sent to him. According to Boris
and his wife Annie, the problems were largely due to compatibility issues
with Bo's American wife Edith. Dr. Hell,
who had visited Bo in the Spring of 1956,
had reported that Bo was homesick for Switzerland and wanted to return
to Europe, but that his wife had opposed to this idea.
Hagelin confines to Friedman that he had contemplated merging his
business with Siemens
as he is tired of being the only whipping boy.
Once merged with Siemens, they could take over the handicaps imposed
by limitations and restrictions as to whom I can sell what machines,
Hagelin says. Friedman asks whether he has thought of merging his
business with Hell, but Hagelin rejects that idea, as Hell is in a different
kind of business, whilst Siemens would be more suitable.
Unknown to his son Bo at this point, is Hagelin's decision to
finally move the activities from the Stockholm factory fully over
to Zug, as he wants all developments and operations in a single place.
If they want to do so, the Stockholm employees are allowed to move to Zug as
well. Although Hagelin initially wanted to handover management of
the company to Bo, he doesn't see that happening in the nearby
future, and thinks that he has to stay on for a number of years.
Friedman also seems to have trouble with Bo, as he reports to Hagelin
that Bo is currently visiting every legislation and embassy in
Washington in order to 'educate' them with instructional literature
about proper usage of the equipment. There was one document
in particular that bothered the NSA and Friedman asks Hagelin what
he can do about it. Hagelin answers that, with Bo being a citizen
of the United States,
the NSA is in a far better position to handle the issue.
Friedman and Hagelin have long discussions about
Siemens and their
use of OTT equipment.
Hagelin has heard that Siemens was about to sell OTT equipment to
a country behind the Iron Curtain, and he wanted to find out
whether this was true. It is then that he learned that the
German Government had given Siemens the green light to sell their
OTT equipment, including suitable OTT generators,
the every country in the world, except for the USSR and its satellites.
Hagelin thinks that his company will follow suit. Siemens is
currently developing an OTT key tape generator designed
by Hüttenhain for the German Government, but for other customers
they will order the key tape generators from Hagelin. Alternative
generators are currently being developed at Lorenz, Olivetti
and OMI. 1
Hagelin has developed OTT extensions for most of their
existing cipher machines. This means that the cipher units of
machines such as the C-446,
the C-52 and the CX-52
can be removed and replaced by a drop-in OTT mechanism.
Friedman is clearly impressed with the mechanical quality of
the OTT assemblies and the relative ease with which they can be
installed. He thinks that they could be suitable for NATO countries
and their allies. Asking again about Siemens, Hagelin reveals that
they have already sold OTT equipment to Yugoslavia and probably also
to Egypt and India. It would later turn out that on a recent trip
to Yugoslavia, Mr. Nyberg had made a relative large sale for Hagelin
Is is currently unknown what type of key tape generator was being
developed by Dr. Hüttenhain (as this is redacted). Apparently neither
Hagelin nor Friedman are aware that Willi Reichert
is meanwhile developing the only true random generator for OTT
production, the so-called 'Würfel' (dice).
Something that was completely new to Friedman and that he had not heard
from Hagelin in any of his earlier conversations or letters, was the fact
that Crypto AG now produces three different versions of each of their
machines. Hagelin himself had initially thought that two categories
would have been sufficient, but after talking with NATO people, Nyberg and
Stürzinger had decided that three would be better. The three types
or categories are:
- Best security
Machines for the West or West-oriented countries, including NATO members
and NATO-friendly countries. These machines will be the best Crypto AG
can produce. They will offer the maximum flexibility with regards to usage,
and will have OTT capability where appropriate.
These machines will also be properly shielded against unwanted radiation
and will be supplied with instructions for proper usage.
- Medium security
Machines for the friendly neutral countries.
These machines are not as flexible as the Type I machines.
Countries belonging to this category have not yet been determined,
but Finland, Switzerland and Pakistan are suggested.
- Low security
These machines offer the lowest quality and flexibility.
They will have a simpler keying mechanism and can not be equipped
with an OTT option. The Middle East, Asia, USSR and satellites
fall into this category, as do
Indonesia, India and Egypt.
Lacking NSA cooperation with respect to writing the manuals, Hagelin
reports that he has done it himself.
The brochures, instruction manuals and guidelines for proper usage
will be different for each category and will have 'secret marks'
to make them distinguishable. According to Hagelin it will be difficult,
but necessary, to maintain records of what version each country is using.
The pocket cipher devices, that Hagelin had talked about on their
previous meeting in 1955, are now ready and in production. There appear
to be two different versions, the
that are cosmetically identical, in other words:
the average user will not be able to tell them apart.
The CD-55 will be available to all customers in all countries, and will
be housed in a green case. It's operation is similar to that of the
C-38, the C-446 and the M-209 and the machine will therefore be easy
to break or solve by the NSA.
The second variant is the CD-57 that is built around the new keying
mechanism, similar to the one used in the CX-52, although from the
outside this is not visible. In addition, the CD-57 can be converted
into an OTT machine quite easily, by removing the keying mechanism
and replacing it with a drop-in OTT assembly.
The CD-57 is housed in a grey case 1 and will only be sold to NATO
and NATO-friendly countries.
Although it was intially planned to have a small built-in printer, this
was dropped in the final version. Instead, the operator now reads the
output from an revolving alphabet disc at the front. Furthermore,
the cipher discs are now made of aluminium rather than plastic.
According to Boris Hagelin Sr., the small CD machine will be suitable
for secret agencies and small army units.
According to Hagelin, the CD-55 is housed in a green case, whilst the
CD-57 is grey. He probably refers to the colour of the Hamerite paint
here. For NATO, the CD-57 was also avaialable in NATO olive green.
Before Friedman arrived in Zug, he had made a brief stop in Frankfurt
where he was brought up to speed by his colleagues at NSAEUR and ASAE.
On this occasion they informed him about a certain Willi Reichert,
who is selling surplus WWII
machines (also known as T-52, Tunny and Sturgeon) to the French.
He asks Hagelin whether he knows Willi Reichert.
Hagelin says that he doesn't know him personally, but that he
doesn't think very high of him as, according to him,
he sells to both sides.
Hagelin thinks that Reichert has some kind of 'secret cache'
from which he gets the old machines and parts, but that his supply
is about to run out.
It is unknown why the NSA was interested in
but it must have been around this time, that Reichert had obtained
a patent for a noise generator, from Dr. Werner Liebknecht at Lorenz.
Reichert needed it to build a
true random number generator
for the creation of OTT tapes for the German Government in Bonn.
Reichert built a successful business from this and would later move
his company to neutral Austria, where it still existed in 2018 as
Siemens engineers had recently discovered that radiation from a cipher
machine (both acoustic and electromagnetic) can lead to unwanted leaking
of information. In some cases it had turned out to be possible to recover
most of the plaintext from an intercepted signal, in particular when
using landlines for transmission. During his short stay in Frankfurt,
Friedman had been informed about this and he is now trying to find out
how much Hagelin knows about this subject.
Hagelin seems to be well-informed as he tells Friedman pretty much the
same as what he had learned in Frankfurt. Like Siemens, Hagelin is now
taking the necessary precautions to shield his machines against such
radiation. According the Hagelin, the French are also aware of this
problem, but do not take it very seriously. For Friedman this
confirms the French situation. 1
Although Friedman acts as if this whole radiation issue is new, he must
have been familiar with it, as the effect had been known at the NSA for
quite some time, and had certainly been exploited by them. Unintended
leaking of information, or unwanted emanations, is also known as
For a number of years, high-level NATO information has been leaking
to the USSR (Russia) due to insufficient cipher security by the
French (see also above).
Whilst Friedman is his house guest, Hagelin has to leave him for a couple
of days for a scheduled meeting with the French Interdepartmental Committee
on Cryptography in Paris. On his return, sooner than expected, he gives
Friedman an account of his business with the French Government and tells
him that he has just got an order for about US$ 250,000 for CX and TC
machines. The machines were intended for use by the French Army, the Air Force
and the Foreign Office.
Whilst in Paris, he briefly discussed his Gentleman's Agreement
with the French, who told him that they too would be very happy if he
would refrain from selling certain machines to certain countries, but
that they had no legal means of forcing him to do so. Despite this, they give
him substantial orders for equipment, not just one or two as does the US,
Hagelin jokingly adds.
Friedman's intervention was clearly appreciated by Hagelin, and the
relationship with Howard Barlow – his new NSA contact – improves.
In November 1957, Barlow visits Zug again to speak with Hagelin
and they part as good friends.
On his return in Washington, barlow reports that he thinks that Hagelin
is also pressed with sales restrictions by the French and Swedes.
His is certain of Hagelin's loyalty towards the Americans however,
as he is well aware of the M-209 threat.
In the following years, Friedman's health deteriorates and he is
in and out of the hospital. As a result, he will not be able to visit
Hagelin in Europe in the foreseable future and does most of his work
from the study in his home. Financial (tax) issues prevent him from
travelling on his own expense and the agency wouldn't permit him to
visit Hagelin anyway, he writes in 1961.
In 1962, Friedman picks up a consultancy job at RCA and starts
thinking about leaving his collection to some organisation.
After Princeton University turns down his offering, he decides
to come over to Zug (Switzerland) and work with Boris Hagelin
on writing the latter's biography. He even contemplates moving
to Europe permanently, but this never happens. He loves the US more.
On his return to the US, Friedman will work out the notes and tape
transcripts of Hagelin's biography, but recurring health problems
prevent him from doing so. In spring 1966, Hagelin's wife Annie
doesn't feel well and after a short illness she dies on 29 November 1966,
just after she and Boris had moved into their new appartment in Minusio
(Switzerland) a month earlier.
In 1967, Friedman has found the Marshall Foundation willing to accept
The Friedman Collection and look after it. In September 1967,
Elizabeth Friedman writes that Bill now has dayly visits from a
typist of the foundation, who is taking down his oral history.
Bill is too weak to write or type himself but he is feeling better
now. She also writes that Bo is having troubles with his wife Edith,
and that Bill is being plagued by newly released books from
David Kahn and Farago. Apparently both men have approached Friedman
several times and he has difficulty fighting them off.
In May 1968, Hagelin plans a trip to the US and is invited to
Friedman's home again. He wants to talk about the activities
in Zug and about new technologies, such as integrated
circuits that they are now beginning to use in their devices.
Unfortunately, on his arrival on 8 October, Friedman had just
suffered another heart attack,
so they have to meet in the hospital in Washington.
Over the past 10 years, the relationship between Boris and his son Bo
has not been too well, to put it mildly. Although they do write to
each other occasionally, and no longer fight over the CD-57 patent
issue, they each do their business in their own
part of the hemisphere. Friedman on the other hand, has built quite
a good relationship with Bo in recent years and sees him
In March 1969, Friedman's health has improved to the point
were he writes a long letter to Hagelin in which he comments that
Bo mentioned recently that he hadn't seen his father in the past
5 or 6 years, whilst he (Bill) had seen him at least three times
in the recent past. He hopes the two will see each other again
soon and spend some time together. A month later, he returns
the hand-written biography of Hagelin to Zug, as he has no
energy left to finish it. He hopes Boris will find a good biographer
to complete it. In November 1969, Friedman dies at the age of 78.
Sadly, Bo dies the next year in a fatal car accident and soon
after that, Boris Sr. resigns from the board of Crypto AG
and finishes his memoirs a few years later in 1979,
first in German 
and then in 1981 in the English language .
By the time he dies on 7 September 1983 – aged 91 –
he leaves behind a healty company with customers in over 130 countries.
He leaves us a legacy of beautifully crafted mechanical cipher
machines, but he also leaves Crypto AG his clouded past.
Der Fall Hans Bühler
In 1992, Hans Bühler,
a top sales representative of Crypto AG is
arrested in Iran on the suspicion that the Hagelin cipher machines
used by the Iranian Government are flawed, or in more popular terminology:
that they contain a backdoor.
A loose remark of US President Ronald Reagan about evidence against Libya
had led them to believe that Crypto AG was cooperating with the US.
Bühler, who is fully unaware of any manipulation with the machines,
is interrogated three times a day for nine months and is finally released
in 1993, after the bail of US$ 1,000,000 is payed by Crypto AG.
This incident is certainly not the finest period in the history of Crypto AG.
Immediately after Bühler's release from prison and his subsequent
return to Switzerland, he is fired and, in addition to that,
the company also wishes him to repay the US$ 1,000,000.
Bühler then decides to go public and confines his story to a book
that is published in 1994 .
The Swiss Federal Police, the Bundesanwaltschaft, has investigated the
matter and questioned several people, and it is said that no irrefutable
evidence against Crypto AG was ever found.
The outcome of the investigation
however, remains classified to this day and repeated requests from
journalists for public disclosure of the results of the investigation
have been denied so far.
Since Hans Bühler went public, some of his former colleagues have decided
to come out as well. Former software engineer Jürg Spörndli
confirms that the company was visited frequenty by NSA specialists and that
on several occasions he was instructed by his manager to swap a
cryptographic algorithm that he had developed, for an alternative one
that was clearly weaker .
In 2008, Crypto Museum had the priviledge to have a private talk with
former chief engineer at Crypto AG and first employee
of Boris Hagelin when he established his company in Switzerland .
When asked about the case of Hans Bühler, he confirmed that the company
had frequent visits from NSA people who had meetings with software
engineers and that on some occasions he wasn't even allowed to be present
in the room. He said it made him feel uneasy. 1
Stürzinger also confirmed that since the Bühler case had become publicly known,
there have been governmental investigations. As a result,
the current management of Crypto AG had taken the necessary measures
to ensure that this should never happen again. He was confident about that.
➤ More bout the Hans Bühler affair
From the evidence found in the documents from the Friedman Archives ,
that were (partly) released by the NSA in 2014, it has become certain that
some kind of agreement existed between the NSA
and Hagelin as early as 1951
and that this agreement was reviewed and/or renewed several times, in any case
in 1955 and in 1957. This agreement was never confined to paper and did not
have a termination date, and it is likely that it continued after Hagelin's
death in 1983.
In closing, we feel that we should say a few words in Hagelin's defense.
Given the fact that he had a very good relationship with the Americans
— in particular with Bill Friedman —
and that they brought him his initial
fortune by allowing him to supply cipher machines to the US Army during
it seems only natural that he remained loyal to his old friends.
From the correspondence between him and Friedman, we get the impression
that he was a man of his word, and that he did what he did with the best
intentions with respect to safety in Europe and in the rest of the world.
The above story is the result of extensive research in the Friedman
Collection of Official Papers by the British Broadcasting Corporation
(BBC) and Crypto Museum in July 2015. It was the subject of a radio program
that was aired on 28 July 2015 on BBC Radio 4 .
In an official reaction to the BBC, Crypto AG said that, whatever
happened in the past, this is certainly not happening today,
and that mechanisms have been put in place, to prevent this from
happening in the future.
In 2020 however, the German TV station ZDF revealed that since 1970, the
company was jointly owned by the German BND and the
American CIA, and since 1994 exclusively by the
It means that for many years, Western intelligence services were
able to manipulate the algorithms of
Crypto AG's products
and read the communications of many of its customers. Although the
company also sold unreadable 1 equipment, the list of countries
that were given access to such technology became shorter every year.
According to the NSA, all encryption should be readable.
➤ For further information on this topic, please refer to our follow-up
story Operation RUBICON.
In this context, readable means that the cryptographic algorithms
could be broken by the NSA.
Also known as friendly. In contrast:
algorithms that are not breakable by NSA,
are called unfriendly or unreadable.
- Boris Hagelin Sr.
Founder and initial owner of Crypto AG.
- Boris (Bo) Hagelin Jr.
Son of Boris Sr. who was supposed to take over the company in due course.
Died in a car accident in 1970, just five months after Boris had sold
- William (Bill) Friedman
Cryptologist during WWII. Worked for AFSA and later for NSA.
After his retirement: consultant for the NSA.
- Oskar Stürzinger
First employee of Hagelin in 1952 after the company had moved to Zug (Switzerland).
Head of developments at Crypto AG. Worked for
Gretag before joining Hagelin.
- Sture Nyberg
Hagelin's factory manager in the Stockholm factory,
later factory manager in Zug.
- Dr. Erich Hüttenhain
Former Cryptologist of the Third Reich
who later worked for the German Intelligence Service, the
- Dr. Rudolf Hell
Inventor of the Hellschreiber and the fax.
Also manfacturer of the H-54 cipher machine
under licence from Hagelin. Had an exclusive contract for the supply of these
machines to the German Army (Bundeswehr).
Armed Forces Security Agency
Predecessor of the NSA (1949-1952).
Army Security Agency
Director of the NSA
Common abbreviation for the director of the
National Security Agency (NSA),
also referred to as Director, NSA.
United States Communications Intelligence Board
Army Security Agency Europe
Declassified by NSA on 17 June 2014 (EO 13526).
- NSA, William F. Friedman Collection of Official Papers
Retrieved July 2015. 1
- Boris Hagelin, Die Geschichte der Hagelin-Cryptos
Original manuscript by Boris Hagelin in German language. Zug, Fall 1979.
- Boris Hagelin, The Story of Hagelin Cryptos
English translation of the above. BCW Hagelin, Zug, Spring 1981.
Later edited by David Kahn and published in Cryptologia, Volume 18, Issue 3, July 1994, pp 204-242.
- Collection of M-209 patents and license agreements
A66684. Declassified by NSA on 11 June 2014 (EO 13526).
- Boris Hagelin, Personal letter to William Friedman, 2 November 1947
A2263076. Declassified by NSA on 30 July 2014 (EO 13526).
- William Friedman, Personal letter to Boris Hagelin, 8 November 1947
A2263080. Declassified by NSA on 30 July 2014 (EO 13526).
- Boris Hagelin, Personal letter to William Friedman, 24 November 1947
A2263085. Declassified by NSA on 30 July 2014 (EO 13526).
- Boris Hagelin, Personal letter to William Friedman, 13 December 1947
A2263092. Declassified by NSA on 30 July 2014 (EO 13526).
- Boris Hagelin, Personal letter to William Friedman, 15 December 1947
A2263095. Declassified by NSA on 30 July 2014 (EO 13526).
- William Friedman, Personal letter to Boris Hagelin, 21 December 1947
A2263097. Declassified by NSA on 30 July 2014 (EO 13526).
- Boris Hagelin, Personal letter to William Friedman, 9 August 1950
A58956. Declassified by NSA on 14 July 2014 (EO 13526).
- Boris Hagelin, Post-War development work on ciphering devices by Boris Hagelin
26 January 1951. A72379. Declassified by NSA on 8 July 2014 (EO 13526).
- Release of Hagelin US Patent Application 188,546
27 March 1952. A66665. Declassified by NSA on 10 June 2014 (EO 13526).
- William Friedman, Negotiations with Mr. Hagelin
22 May 1951. Includes full report about AB Cryptoteknik, Stockholm, Sweden.
A60611. Partly declassified by NSA on 6 November 2014 (EO 13526).
- James H. Douglas, Release of the M-209 to Foreign Nations
Memorandum for the record, 15 October 1953.
A66649. Declassified by NSA on 23 January 2015 (EO 13526).
- Thomas M. Larner, Converters, M209
Memorandum for Director, National Security Agency. 15 December 1953.
A66618. Declassified by NSA on 11 June 2014 (EO 13526).
- Ralph J. Canine, Release of M-209's to the French
12 January 1954. A66647. Declassified by NSA on 10 June 2014 (EO 13526).
- William Friedman, Report of Visit to Crypto AG (Hagelin) 21-28 February 1955
15 March 1955.
TOP SECRET. Draft version with hand-written changes.
A2436259. Partly declassified by NSA on 22 July 2014 (EO 13526).
- William Friedman, Report of Visit to Crypto AG (Hagelin) 21-28 February 1955
28 March 1955.
TOP SECRET. Final version.
A2436243. Partly declassified by NSA on 22 July 2014 (EO 13526).
- William Friedman, Report of Visit to Crypto AG (Hagelin) 21-28 February 1955
28 March 1955.
TOP SECRET. Adapted final version.
A60616. Partly declassified by NSA on 20 June 2014 (EO 13526).
- Captain I. T. McDonald, USAF, 16 June Comments of Mr. Friedman
Memorandum for Colonel Davis, 17 June 1955.
A62443. Declassified by NSA on 17 June 2014 (EO 13526).
- Res Strehle, Verschlüsselt, Der Fall Hans Bühler
Switzerland, 1994. ISBN 3-85932-141-2.
- Line Dugstad & Osman Kibar, Den skjulte partneren
Dagens Næringsliv. Website. 2 january 2015 (updated 13 February 2015).
- Crypto Museum, Interview with Oskar Stürzinger
Basel, 7 November 2008.
- BBC Radio 4, Document - The Crypto Agreement
Evidence of a secret deal between Crypto AG (Hagelin) and the NSA.
28 July 2015, broadcast, presented by Gordon Corera.
- S.S. Snyder, Report of Special Study Group on FARMER-NOMAD
15 November 1954.
TOP SECRET FROTH. Page 18.
Partly declassified by NSA on 16 June 2014 (EO 13526).
- Crypto Museum, Operation RUBICON
This link might be disfunctional, as the NSA keeps changing their URLs.
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?|
© Crypto Museum. Created: Thursday 30 July 2015. Last changed: Monday, 22 February 2021 - 22:23 CET.