M-209 — Volume 1 — The M-209 — A Cipher Machine in a Lunchbox

1.1 About This Volume

This is the entry point to a ten-volume deep dive on the Converter M-209, the small, hand-cranked, purely mechanical cipher machine that the United States Army carried through the Second World War and the Korean War. It needed no batteries and no mains power. It fitted in a canvas case slung over a shoulder, it could be strapped to an operator’s knee, and it printed its output on a paper tape. Between 1942 and 1945 a typewriter company in Syracuse, New York, made something like 140,000 of them under licence from a Swedish inventor, Boris Hagelin, whose royalties are usually said to have made him the first person to grow rich from cipher machines.

The M-209 is the natural companion to the Enigma, which has its own shelf in this collection. Both were the field ciphers of great armies; both were attacked by the other side; and they work on entirely different principles. The Enigma scrambles an electric current through wired rotors. The M-209 does arithmetic with levers: a row of pinwheels decides how many bars on a rotating drum stick out, and that number decides how far a lettered print wheel turns.

This volume explains in plain terms what the machine was, how one turn of its knob enciphers one letter, how it was used, and why its security was always described as “good enough for tactical traffic” and never better. It then tours the whole series in miniature. Readers who want the inventor can go straight to Volume 2; the mechanism is Volume 3 and its mathematics Volume 7; the field service and the codebreaking are Volumes 4 and 5; Crypto AG and the strange afterlife of the Hagelin company are Volume 6. The series ends on a workbench, with three volumes on designing, printing, assembling, keying and testing a working mechanical replica.

1.1.1 The Ten-Volume Series

Table 1 — The Ten-Volume Series

Vol	Title	Focus
1	The M-209 — A Cipher Machine in a Lunchbox (this volume)	Orientation: what it was, how it worked, the whole story in miniature
2	Boris Hagelin — From AB Cryptograph to the C-38	The inventor, Arvid Damm’s company, the B-21, the C-35 and the 1940 voyage to America
3	How the M-209 Works — Pins, Lugs, the Drum and the Print Wheel	The mechanism part by part, one turn of the knob at a time
4	In the Field — Smith-Corona, Key Lists and Signal Procedure	Manufacture, the kit, key lists, indicators, operating discipline
5	Breaking the Hagelin — German, Italian and Allied Attacks	German Army solutions, Bletchley Park and the C-38m, the Bell Labs paper
6	After the War — Crypto AG, the CX-52 and Operation Rubicon	Zug, the CX-52, Friedman and Hagelin, the CIA–BND ownership
7	The Mathematics of Pins and Lugs — Period, Key Space and a Worked Encipherment	The arithmetic of the machine, worked on the series’ simulator
8	⭐ Building an M-209 — Design and Printing	Surveying open designs; parts, materials and printer settings for a replica
9	⭐ Building an M-209 — Assembly, Setting the Key and Testing	Putting it together, keying it, and checking it against the simulator
10	Using the M-209 — A Field Message, Sent and Broken	A message enciphered in proper procedure, then attacked

---

1.2 A Cipher Machine in a Lunchbox

Open the hinged olive-drab lid and the M-209 looks more like an office machine than a weapon. Its case is about 178 × 140 × 83 mm (7 × 5½ × 3¼ in) — the Crypto Museum’s comparison, “about the size of a lunch box”, has stuck — and it weighs about 2.7 kg, or 6 lb, plus roughly another pound for the canvas case (Crypto Museum; Wikipedia). The 1944 edition of its manual gives the weight with all its accessories as a little over seven pounds, about ten pounds packed for shipment, and the packed volume as 0.37 cubic foot (TM 11-380, 17 March 1944, par. 3).

On the outside there are only a few controls:

• On the left, a setting knob with a lettered indicating disk, on which the operator dials each letter of the message.
• On the right, a drive knob, which the operator turns through one full revolution for every letter.
• Across the front, a window showing the six key wheels, each with letters around its rim.
• An encipher–decipher knob marked C and D, a letter counter that counts up to 9999, and a paper tape that feeds out on the left side with the result printed on it.

Under the inner lid are the parts that hold the secret: the pins on the six key wheels and the lugs on a drum of 27 bars. Those were set from a printed key list, usually once a day. Everything else about the machine — its design, its wiring of levers, even the manual — was not secret at all. The Army stated plainly in 1949 that the M-209 “is a copy of a commercial equipment which can be purchased from a manufacturing concern in Sweden, and therefore does not require classification” (Army memorandum, 17 February 1949, NSA Friedman Collection). That is a modern idea, sometimes called Kerckhoffs’s principle: the security lives in the key, not in hiding the machine.

1.2.1 What it was for

The manual is precise about the job. The M-209 was “a cryptographic device issued by the Signal Corps for use in divisions and lower units, down to and including battalions”, providing “a secure and rapid method of cryptographing tactical messages” that could be “operated by personnel not extensively trained in cryptography” (TM 11-380, 1944, par. 1). It replaced the M-94, a cylinder of 25 lettered aluminium disks that had served the Army since the 1920s, and it sat below the big electric rotor machine SIGABA, which protected traffic at the highest levels and was never broken.

“Rapid” is relative. An experienced operator took two to four seconds a letter, which works out at roughly 15 to 30 letters a minute (Wikipedia; Jerry Proc). A short tactical message — a request for ammunition, a change of position, an artillery target — took a few minutes to encipher and the same again to decipher. The design aim, from the beginning, was a machine whose messages an enemy could not read until their contents had gone stale. Whether it met that aim is the subject of Volume 5.

1.3 How It Works, in One Turn of the Knob

The machine’s principle, which Hagelin called the “C-type” and cryptographers call the pin-and-lug design, can be described in five steps. Volume 3 takes the mechanism apart in detail; Volume 7 does the arithmetic.

1. Six key wheels. Six wheels sit side by side, with 26, 25, 23, 21, 19 and 17 positions. Each position carries a small pin that can be pushed to the right (“effective”) or to the left (“ineffective”). Together they hold 131 pins. At any moment, one pin on each wheel is in the sensing position, and it either pushes a guide arm forward or leaves it back.

2. A drum of 27 bars. Behind the wheels is a cylindrical cage, the drum, made of 27 horizontal bars. Each bar carries two movable lugs, which can be set opposite any of the six guide arms or parked in a neutral position. When the drive knob is turned, the drum makes one revolution. As each bar passes the guide arms, it is shifted sideways — “kicked out” — if either of its lugs meets a guide arm that is pushed forward.

3. Counting. The shifted bars act like the teeth of a gear with a variable number of teeth. They engage a gear connected to the print wheel and turn it by one step each. If 11 bars are kicked out, the print wheel turns 11 steps. Hagelin’s own description of the drum was exactly that: it “acts like a gearwheel with a variable number of teeth” (Hagelin, The Story of the Hagelin Cryptos, p. 25).

4. A reciprocal substitution. The print wheel is lettered so that the effect is, in the manual’s words, “that of sliding a normal-alphabet sequence against reversed normal alphabet” (TM 11-380, par. 18). A cipher of that kind is its own inverse: the same key and the same starting position turn plaintext into ciphertext and ciphertext back into plaintext. The C–D knob changes only how the output is printed — in five-letter groups when enciphering; with spaces restored when deciphering.

5. Stepping. After each letter every key wheel advances one position. Because the six wheel sizes have no common factor, the pattern of active pins repeats only after 26 × 25 × 23 × 21 × 19 × 17 = 101,405,850 letters — far longer than any message.

Two details of operating practice follow from the design. The machine has no space key, so operators enciphered the letter Z between words; on deciphering, the printer leaves Z out and prints a space, so that “ORGANIZED” comes out as “ORGANI ED” (TM 11-380, par. 13). And because every message must start from a different place in that hundred-million-letter cycle, the operator chose a fresh six-letter starting position for the key wheels for each message and sent it, in the clear, at the head of the message as the message indicator.

1.3.1 Inside and outside keys

The manual divides the key into two parts, and the distinction matters for everything that follows in the series.

The internal keying elements are the pins and the lugs. They were set by hand with a small screwdriver from a table in a cipher-key list and were meant to be changed regularly; “a daily change in the internal keying elements is advisable”, says the 1944 manual, “although the frequency of change will depend upon the tactical situation” (par. 7c). After setting them, the operator enciphered 26 A’s from the starting position AAAAAA and compared the result with a 26-letter check printed on the key list; any difference meant a mistake.

The external keying element is the six letters showing on the key wheels when a message begins. It was “the responsibility of the operator alone” and had to be changed for every message.

Almost every successful attack on the M-209 started from a failure of the second rule: two messages sent from the same starting position on the same internal key. Cryptanalysts call them a depth. Volume 4 describes the procedures meant to prevent them, and Volume 5 what happened when they failed.

1.4 The Machine at a Glance

Table 2 — The Machine at a Glance

Feature	Converter M-209
Designer	Boris Hagelin, AB Cryptoteknik, Stockholm (commercial type C-38)
US maker	L. C. Smith & Corona Typewriters, Inc., Syracuse, New York
Other names	CSP-1500 (US Navy); “AM-1” to German Army cryptanalysts
Variants	M-209, M-209-A, M-209-B — compatible, differing in manufacturing details
Size	about 178 × 140 × 83 mm (7 × 5½ × 3¼ in)
Weight	about 2.7 kg (6 lb); about 0.45 kg more for the canvas case
Power	none — hand-operated
Key wheels	six, of 26, 25, 23, 21, 19 and 17 positions (131 pins)
Drum	27 bars, two movable lugs per bar
Period	101,405,850 letters
Output	printed paper tape, 3/8 in wide; ciphertext in five-letter groups
Speed	roughly 2–4 seconds a letter for a practised operator
Built	about 140,000 by the end of the war (an Army memorandum of 1949 says about 112,000)
In service	US forces 1942 to the 1950s; Korean War; later supplied to allies

Sources: Crypto Museum, Wikipedia, TM 11-380 (1944), the 1949 Army memorandum cited above, and Hagelin’s own account.

1.5 The Story in Miniature

1.5.1 The inventor (Volume 2)

Boris Caesar Wilhelm Hagelin was born on 2 July 1892 at Adschikent, near Baku, where his Swedish father managed the oil fields of the Nobel brothers. He trained as a mechanical engineer in Stockholm and expected a career in Russian oil until the revolution of 1917 ended it. In the early 1920s Emanuel Nobel, his father’s closest friend, put him into a small, loss-making Stockholm company called AB Cryptograph, founded to exploit the cipher-machine inventions of Arvid Gerhard Damm. Hagelin took over its management in 1925 and won it its first real order — from the Swedish General Staff, in competition with the German Enigma — with a two-rotor machine called the B-21.

His breakthrough came in 1934, when the French asked him for a pocket-sized cipher machine that would print its output. Hagelin remembered a calculating mechanism he had designed for a coin-changing machine that was never built: a drum of sliding bars that turned a type wheel by a variable amount. He replaced its keys with pinwheels and its numbers with letters, and the C-35 was the result. Its successors, the C-36 and the C-38, sold across Europe. In May 1940, with Germany overrunning Scandinavia, he sailed from Genoa to New York with two machines in his luggage. The US Army tested the design, adopted the C-38 as the Converter M-209, and Hagelin spent the war years in America.

1.5.2 The mechanism (Volume 3)

Volume 3 follows one letter through the machine: how the pins on each key wheel are read a fixed distance away from the letter in the window, how the guide arms and the lugs interact, how the drum kicks out bars and the print wheel counts them, how the letter counter forms five-letter groups, and how the printer drops the Z’s on deciphering. It also explains why two lugs on the same bar count only once — a detail with large consequences for both security and key-list writing.

1.5.3 In the field (Volume 4)

The machine was built by L. C. Smith & Corona, the typewriter maker, at a rate Hagelin put at up to 500 a day. Volume 4 describes the kit — case, strap, tape, ink pad, tweezers and screwdriver — and the system around it: the cipher-key lists issued with a division’s Signal Operation Instructions, the rules for writing those key lists by shuffling cards, the indicator groups, the 26-letter check, the procedures for garbled messages and, printed on the first page of the manual, the instruction for what to do if capture threatened: “DESTROY EVERYTHING”.

1.5.4 Breaking the Hagelin (Volume 5)

German Army cryptanalysts, who called the machine “AM-1”, were reading some M-209 traffic from early 1943, almost always by finding two messages in depth. After the war, an Anglo-American conference in 1950 reviewed the German evidence and concluded that a “considerable amount” of M-209 traffic had been broken, yielding little tactical intelligence but “an appreciable amount” of strategic intelligence. On the other side of the war, Bletchley Park read the Italian Navy’s Hagelin C-38m and used it against Axis convoys to North Africa. The volume ends at Bell Telephone Laboratories in the late 1970s, where Robert Morris, Dennis Ritchie and James Reeds — two of them names from the early history of the Unix operating system — worked out a way to solve M-209 messages from ciphertext alone and then, after a conversation with the National Security Agency, chose not to publish it. Ritchie recalled that an early Unix crypt command had been modelled on the M-209.

1.5.5 After the war (Volume 6)

Hagelin moved to Zug, in Switzerland, and founded Crypto AG in 1952. His CX-52, with irregular wheel stepping, was a far harder machine than the M-209, and his friendship with William F. Friedman, the doyen of American cryptology, became an understanding about what Crypto AG would and would not sell. In 1970 the firm was bought in secret by the CIA and the West German BND, which for two decades and more sold weakened machines to governments around the world. The operation, eventually called Rubicon, became public in February 2020.

1.5.6 The mathematics (Volume 7)

How large is the key? How many distinct lug arrangements actually matter, given that the effect of the drum depends only on how many bars each combination of wheels kicks out? Why did the Army’s key-list rules forbid long runs of identical pins and insist that the lug numbers be able to produce every count from 1 to 27? Volume 7 answers these questions and works an encipherment letter by letter on the series’ simulator.

1.5.7 The build (Volumes 8–10)

The last three volumes turn to the workbench. Volume 8 surveys the open M-209 replica designs and specifies a working mechanical machine built mainly from 3D-printed parts and stock fasteners: six pinwheels, the 27-bar drum with movable lugs, and a print wheel. Volume 9 covers assembly, setting a key from a period-style key list and checking the machine against the simulator with the 26-letter check. Volume 10 sends a message in full wartime procedure and then shows how it can be broken.

1.6 The Simulator and the Replica

Every worked cipher example in this series comes from one program, a small Python simulator of the M-209 kept with the project at 03-outputs/tools/m209_sim.py. It is checked against published test vectors — key lists and check strings by Mark Blair, the worked example in the Wikipedia article, and Brian Neal’s open-source m209 package, which implements the full message procedure of the War Department training film T.F. 11-1400. A replica that agrees with the simulator on a 26-letter check is, for practical purposes, an M-209.

The machine is also unusually friendly to replication. It is a mechanism of levers, pins, a drum and a counter, with no electrical parts and no wired rotors to reproduce. Its dimensions, its parts list and even its maintenance procedures are documented in manuals that are now public. That makes it a fair subject for a printed replica, and a good machine for learning what a cipher actually does.

1.7 Why It Matters

The M-209 matters in the history of cryptography for three reasons.

First, it marks the mechanisation of tactical cipher. Before it, front-line units of the US Army enciphered by hand, with strip and cylinder devices that were slow and error-prone. After it, every battalion had a machine. The cost of that change was modest — about $64 a unit in wartime contract terms, according to Jerry Proc’s history — and its effect was to make a reasonable cipher available to the people who most needed speed.

Second, it shows the gap between theoretical and practical security. On paper, the M-209’s key space is vast. In practice, its long period was undone by human habits: reused starting positions, short and stereotyped messages, garbles and retransmissions. William Friedman made exactly this point before the Army adopted the machine, when he reported that the machine’s security was theoretically quite good but low “if improperly used”; he was overruled because nobody had anything better (NSA history of Hagelin and Friedman). The German success against it was, in the 1950 conference’s judgment, a success against operators.

Third, it was the start of an industry. The money from the M-209 financed the postwar Hagelin company, which for forty years sold cipher machines to more than a hundred countries. That company’s later history — its weakened machines and its secret owners — is one of the great intelligence stories of the twentieth century, and it begins with the machine in this lunchbox.

1.8 How to Read This Series

The volumes are written to be read in order, but each stands alone. Machine designations follow the sources: Hagelin’s company names (B-21, C-35, C-38, CX-52) for his commercial machines and the US Army’s for the M-209. Measurements are given as the sources give them, usually in inches for the US manuals and in millimetres for museum catalogues. Quotations from manuals keep their original wording, including the period word “cryptographing”.

Three kinds of figure appear: photographs of surviving machines and of the people and places in the story; scans from the original manuals and documents, which are labelled with their source; and line diagrams drawn for this series, whose generating scripts are kept with the project.

1.9 The One-Paragraph Version

The Converter M-209 was a hand-cranked, purely mechanical cipher machine the size of a lunchbox, designed by the Swedish engineer Boris Hagelin as his commercial C-38 and built under licence by L. C. Smith & Corona in Syracuse, New York, in numbers usually given as about 140,000. Six key wheels of 26, 25, 23, 21, 19 and 17 pins decided how many of the 27 bars on a rotating drum were kicked out on each turn of the knob, and that count set a print wheel to the cipher letter; the same settings enciphered and deciphered. The US Army used it from 1942 for tactical traffic from division down to battalion, and it served again in Korea. German Army cryptanalysts read part of its traffic, mostly when operators sent messages in depth; Bletchley Park read its Italian naval cousin. The Hagelin fortune it created built Crypto AG, which the CIA and the BND later secretly owned. The remaining nine volumes are the long version, ending with a replica that anyone with a 3D printer can build.

---

Next — Volume 2: Boris Hagelin — From AB Cryptograph to the C-38. A boy born in the Nobel oil fields of Baku; an engineer stranded by the Russian Revolution; a loss-making Stockholm company and its eccentric founder, Arvid Damm; a six-month race against the Enigma for the Swedish General Staff; a French request for a cipher machine that would fit in a pocket, answered with the insides of a coin changer; and a voyage on the last liner out of Genoa with two cipher machines in the luggage.