M-209 — Volume 4 — In the Field — Smith-Corona, Key Lists and Signal Procedure

4.1 About This Volume

A cipher machine is only half of a cipher system. The other half is paper and people: the key lists that tell the operator how to set the machine, the rules for writing them, the procedure for opening and closing each message, the checks that catch a mistake before it reaches the enemy, and the discipline that keeps operators from taking shortcuts. The M-209’s security in the field depended at least as much on that half as on its pins and lugs.

This volume follows the machine from the factory to the message center. It covers its manufacture by L. C. Smith & Corona Typewriters of Syracuse, New York; the variants and the Navy’s version; the kit an operator was issued; the cipher-key list and the rules in the Army’s manual for making one; the indicators that headed every message; the procedures for enciphering, deciphering and correcting garbles; the security cautions and destruction orders; and the machine’s service from North Africa to Korea and beyond.

The main source is the Army’s own manual, TM 11-380, Converter M-209, M-209-A, M-209-B (Cipher), in its edition of 17 March 1944, which superseded the first edition of 27 April 1942 and a supplement of 20 September 1943 (TM 11-380, 1944, NSA Friedman Collection, REF ID A67854). Paragraph numbers below refer to that edition. How the mechanism works is the subject of Volume 3; what happened when the procedures failed is Volume 5.

4.2 From Stockholm to Syracuse

The M-209 was the Army’s answer to a gap it had known about since the mid-1930s. Its front-line units enciphered by hand with the M-94, a cylinder of 25 lettered aluminium disks adopted in the early 1920s, and with strip ciphers. Higher headquarters had the electric rotor machine SIGABA, designed by the Signal Intelligence Service and built in small numbers, which was far too heavy, too valuable and too secret to go forward to a battalion. What was needed in between was something portable, cheap, quick to learn and good enough for traffic whose value lasted hours rather than years. Volume 2 tells how Boris Hagelin arrived in 1940 with exactly that, and how William Friedman’s objection that it was weak “if improperly used” was overruled because nobody had anything better.

The Army did not build the machine itself. Production went to L. C. Smith & Corona Typewriters, Inc., whose name is on the machines’ plates with the address Syracuse, N.Y. (Crypto Museum). Hagelin himself wrote that it was made “by the Corona plant of the L.C. Smith typewriter company, with a daily output of up to 500 units” (Hagelin, The Story of the Hagelin Cryptos, 1981, p. 26); other accounts give 400 a day. A typewriter maker was a natural choice. The M-209 is a precision mechanism of small stamped and machined steel parts, springs, a type wheel, an inking pad and a paper feed — the vocabulary of the office-machine industry — and Smith-Corona’s Syracuse works were already making parts for other weapons (Central New York history).

How many were made depends on whom one asks. Hagelin and most later histories say more than 140,000 by the end of the war, and Hagelin added that more than 50,000 had been built by the time he went home to Sweden in 1944. A US Army memorandum of February 1949 says “approximately 112,000” were manufactured during the war, “with a lead time requirement of approximately one year”, and that on completion of the contract “the tools, dies, and fixtures used in the manufacture of the equipment were destroyed” (Army memorandum, 17 February 1949, NSA Friedman Collection). Jerry Proc’s history gives a unit price of $64 (Jerry Proc); the 1949 memorandum compares that with about $250 for the equivalent commercial machine from Sweden.

4.2.1 Variants and names

The manual covers three models with one symbol: “Converter M-209-(*)” means the M-209, M-209-A and M-209-B. They were fully compatible and differed only in manufacturing details (Crypto Museum, citing Nick Gessler’s comparison). The Navy bought the same machine as the CSP-1500 and used the same keying and operating procedures as the Army (Jerry Proc). The word “converter” in the Army’s name was a deliberate understatement, of a piece with calling SIGABA the “Converter M-134-C”.

4.3 What Came in the Case

The converter was “contained in a metal box” and “normally carried in a canvas case, suspended by a strap over the shoulder”. The case had compartments for the manual, pencils, extra tape, message books and message clips. Clamps inside the machine’s cover held a screwdriver, a pair of tweezers, an oil can, an ink-pad can and the roll of paper tape in use. A hand strap could be fitted to the left side, and the carrying strap could be passed under the operator’s foot to hold the machine on his knee — “the base of the machine is shaped to fit the curvature of the knee” (TM 11-380, pars. 2 and 8b).

The accessory list in the manual (par. 3) and a Signal Corps checklist of September 1945 agree on the essentials:

Table 1 — The accessory list in the manual (par. 3) and a Signal Corps checklist of September 1945 agree on the essentials

Item	Use
Canvas case, carrying strap, hand strap	Carrying; strapping the machine to the knee
Paper tape, 3/8 in wide (one roll in use, one spare)	The printed output
Ink pad and spare in a can	Inking the type wheel
Screwdriver	Setting pins and lugs
Tweezers	Turning the key wheels without damaging them
Oil can	Lubrication
Message clips (four)	Holding tape and forms
Message book M-210	Message forms
Technical Manual TM 11-380	Instructions

Jerry Proc describes the M-210 message book as 25 sets of triplicate message forms, three sets of duplicate forms for pigeon messages, and 23 sheets of tracing paper (Jerry Proc). The pigeon forms are a reminder of how mixed the Army’s communications still were in 1944. With its accessories the converter weighed a little over seven pounds.

4.4 The Key List

The secret part of the M-209 was a sheet of paper. A cipher-key list was issued with each unit’s Signal Operation Instructions (SOI) and gave, for a stated period, the settings of the two internal keying elements: which of the 131 key-wheel pins were to be pushed to the right, effective position, and where on the 27 drum bars the 54 lugs were to sit. Each key list also carried a two-letter cipher-key indicator and a 26-letter check (TM 11-380, pars. 7–9).

4.4.1 Setting the machine

With the machine zeroized — all pins to the left, all lugs in the neutral positions — the operator opened the inner lid and worked through Table I wheel by wheel, pushing to the right every pin whose letter appeared in the column. “Each pin must be moved all the way to the left or right,” the manual warned; “a garble will result if pins are left in an intermediate position.” Then he set the lugs from Table II. Its entries read like “3-6” or “0-4”: on bar 1 the left-hand lug goes to position 3 and the right-hand lug to position 6; on bar 6 the left lug stays at the left zero and the right lug goes to 4. Each lug had to be pushed slightly toward the front of the machine to release it, slid along, and clicked into its hole; a lug left between holes “will jam the machine”. The manual recommended keeping left-hand lugs in positions 1, 2, 3 and the left zero, and right-hand lugs in 4, 5, 6 and the right zero (par. 8).

The 26-letter check came next. The operator zeroized the letter counter, set the C–D knob to C, turned all six key wheels to A, and enciphered the letter A twenty-six times. The printed tape had to match the check on the key list exactly: “if they differ by one or more letters, there is an error in the initial settings of the converter which must be corrected before proceeding” (par. 8e). For the training key list in the 1944 manual the check is TNJUWAUQTKCZKNUTOTBCWARMIO. Transcribed from the printed tables, that key list gives exactly this string on the series’ simulator (03-outputs/tools/m209_sim.py --check), which makes the manual’s own key list a test for the replica of Volumes 8 and 9.

A key list was valid “from (date) to (date)”. How often it changed was up to the signal officer. The manual’s advice was blunt: systems using the converter “can be solved, especially if a large volume of traffic is enciphered without changing the arrangement of the keying elements. A daily change in the internal keying elements is advisable”, and “there is no reason for allowing the enemy to ‘break’ a message enciphered with Converter M-209 because the keying elements were not changed often enough” (par. 7c).

4.4.2 How a key list was written

Appendix I of the manual tells the signal officer how to make key lists. The method was a lesson in practical randomness.

For the pins, he prepared 156 cards, 78 marked R and 78 marked L, shuffled them thoroughly and drew one card for each pin position, starting at A on wheel 1: an L meant the letter was crossed out, an R meant it stayed. Runs of “more than six consecutive effective or noneffective pins on any wheel must be rearranged”, and the method assured that between 40 and 60 per cent of pins were effective.

For the lugs, he chose a set of six numbers from tables printed in Appendix II — for example 1, 2, 3, 5, 10, 12 — one number for each key wheel, telling how many drum bars that wheel’s guide arm should engage. Because there are only 27 bars and the six numbers usually add up to more, some bars must carry two effective lugs; the excess is the overlap (in the example, 33 − 27 = 6). The overlaps were to be spread across most of the six numbers, “several small overlaps … in preference to one large overlap”, and never more than four between any two numbers. The crucial rule was a check: “a single number, or the sum of any two, three, four, five, or all six of the numbers, yields all the values from 1 to 27, inclusive” — remembering that two effective lugs on one bar count only once. The numbers were then put in random order and written into a worksheet and finally into a Table II.

The manual does not explain why these rules exist; Volume 7 does. In short, the pins decide which guide arms are active on each letter, and the lug arrangement converts each of the 64 possible patterns of active arms into a shift between 0 and 27. A careless lug setting can make many patterns give the same shift, or leave some shifts unreachable, and that makes the machine’s output less uniform and easier to attack.

4.5 Opening a Message: the Indicators

Every message carried indicators so that the receiving operator could set his machine to match. The manual names three (par. 9):

• The system indicator tells the receiver which cryptographic system is in use.
• The message indicator gives the starting alignment of the six key wheels — the external key.
• The cipher-key indicator names the key list in force.

Its training example, explicitly “only a sample method”, builds two groups. The system indicator FW takes the first two letters of the first group. The operator reads the six letters on the key wheels at the bench mark, say QAHNKE, and splits them: QAH ends the first group and NKE begins the second. The key-list indicator LP ends the second group. The message therefore opens FWQAH NKELP, and the same two groups are repeated at the end, after the last cipher group. The indicators “must be added in pencil in both cases” — they were never enciphered on the machine — and the receiving operator was to check those at the start against those at the end. “In some systems,” the manual adds, the message indicator “will be enciphered before transmission to provide additional security” (par. 9b). Later Army procedure did exactly that; Brian Neal’s open-source implementation of the procedure from the training film T.F. 11-1400, which the series’ simulator uses as a test, includes a message indicator that is itself enciphered on the machine.

The choice of the six letters was the operator’s alone, and the manual gave him rules. He was to move each wheel individually, “choosing the letters which line up on the white bench mark. These letters should not spell a word, nor should the same letter be found twice in one key wheel alignment”, and “different letters must be selected for every message” (pars. 7a and 10b). He was also to note the alignment “to prevent using the same arrangement of letters for future messages”. A clerk who picked AAAAAA, or his initials, or the same six letters as yesterday, created exactly the condition the Germans looked for: two messages enciphered from the same point in the key.

4.6 Enciphering, Deciphering and Garbles

The manual’s worked procedure (par. 10) enciphers the sentence REINFORCEMENTS URGENTLY NEEDED. The operator checks that the drive knob is locked, turns the C–D knob to C, zeroizes the letter counter so that the output will fall into five-letter groups, sets and notes the six-letter starting position, and advances enough tape to write in the indicators. Then, for each letter, he turns the indicating disk until the letter lines up with the index and turns the drive knob until it locks: “avoid a rapid or jerky movement … a moderate steady motion is preferable.” The knob cannot turn again until the disk has been moved, so a double letter needs the disk moved away and back. Between words he enciphers a Z.

At the end he advances the tape, tears it off and counts. If the last group is short, he adds X’s in pencil to make five: “DO NOT ENCIPHER THESE X’s TO COMPLETE THE LAST GROUP. Such a practice reduces the security of the system and aids the enemy in solving the message” (par. 10c). Then the indicators go at the front and the back, and the message goes to the message center for transmission under the Army’s general signal procedure in FM 24-5.

Deciphering is the same process with the knob at D, the key wheels set to the message indicator, and the cipher text entered letter by letter, carrying “one 5-letter group at a time” in mind to keep errors down. The printer suppresses the Z’s and prints spaces in their place, so the plaintext comes out in words — with the small cost that a word containing a real Z loses it: “ORGANIZED will appear in clear text as ORGANI ED” (par. 13b). The tape was then pasted to a message blank.

4.6.1 When it came out wrong

A field cipher has to survive bad radio, tired operators and cold fingers, and TM 11-380 spends more space on errors than on anything else. The letter counter made recovery possible without starting again: an operator who lost his place could count to the last correct letter, turn the counter back to that number and resume (par. 14). The manual then lists five common causes of garbled text and how to recognise each (par. 15):

Table 2 — A field cipher has to survive bad radio, tired operators and cold fingers, and TM 11-380 spends more space on errors than on anything else. The letter counter made recovery possible without starting again: an operator who lost his place could count to the last correct letter, turn the counter back to that number and resume (par. 14). The manual then lists five common causes of garbled text and how to recognise each (par. 15)

Symptom	Cause	Remedy
Single wrong letters at regular intervals	A key-wheel pin set wrongly	The interval (26, 25, 23, 21, 19 or 17 letters, counting spaces) identifies the wheel; count back to the pin and correct it
Scattered wrong letters, each one letter off in the alphabet	A drum-bar lug set wrongly	Try the letters before and after in the alphabet and read the message
Unreadable from the start	Wrong indicator	Recover the correct indicator
Scattered errors	Poor transmission	Use context, or ask for a repeat
Clear up to a point, then garble	A letter or group repeated or dropped	Skip the repetition, or move the counter on by one or five

The examples in the manual show how well an operator could learn to read through a garble. With one pin wrong on wheel 6, “NOW IS THE TIME FOR ALL GOOD MEN” comes out as “NOW IS LHE TIME FOR ALL XOOD MEN”, with the errors exactly 17 letters and spaces apart. With one lug wrongly made effective, every error is the next letter of the alphabet. There is no way to find which lug is wrong from the text, the manual concedes, “however, it is possible to obtain clear text” by substituting neighbouring letters (par. 15c).

Every request for a repetition was a security risk, because a message re-sent with the same indicators and slightly different text is a depth (Volume 5). The manual therefore insisted that “the operator should always make every possible attempt to decipher a message before asking for a service on it” (par. 15a), and its short list of security cautions (par. 17) reads as a summary of the attacks the Germans used:

• Change the message indicator for each message sent.
• Destroy all printed tape not pasted to a message blank.
• Do not encipher X’s to fill out the last cipher group.
• Be very careful to avoid errors while enciphering. “Errors may help an enemy to break down the cryptographic system in use.”

4.7 Closing Down, and Destroying Everything

At the end of a day or a period of operation the internal keying elements “must be zeroized”: all pins pushed to the left, all lugs moved to their zero positions, any printed tape torn off, and the machine closed and returned to its canvas case (par. 12). A zeroized M-209 captured by the enemy held no key at all. The key list was a different matter, and it was the key list that the Germans most wanted; an American estimate of 1950 put the share of M-209 traffic the Germans read at about 10 per cent, of which about 4 per cent came from captured key lists rather than cryptanalysis (Volume 5).

For the worst case, the manual opens with a destruction notice. Why: “To prevent the enemy from using or salvaging this equipment for his benefit.” When: “When ordered by your commander.” How: smash with “sledges, axes, handaxes, pickaxes, hammers, crowbars, heavy tools, heel of a boot”, cut, burn with “gasoline, kerosene, oil, flame throwers, incendiary grenades”, use explosives, and dispose of the remains — “bury in slit trenches, fox holes, other holes. Throw in streams. Scatter.” The preliminary step was to zero the lugs and pins. The last line is in capitals: “DESTROY EVERYTHING.”

4.8 Who Used It

The manual’s own statement of the M-209’s place is “divisions and lower units, down to and including battalions”, though larger units and “any other organization authorized by the Chief Signal Officer” could use it too (par. 1). A 1949 memorandum gives a sense of the scale: the table of equipment of an infantry division called for 117 converters (Army memorandum, 1949). At the 1950 Anglo-American review of M-209 security, an American officer estimated that as many as 75 different M-209 key lists had been in use at once, since every division, corps, military police battalion and Army Air Forces unit had its own (Volume 5).

Jerry Proc dates the machine’s first general use to the invasion of North Africa, Operation Torch, in November 1942 (Jerry Proc). From then until 1945 it went wherever the Army went, in Europe, the Mediterranean and the Pacific, and its traffic — short, formatted, often repetitive messages about positions, supplies, casualties and fire missions — was exactly the kind for which it had been designed. The US Navy used its CSP-1500s more sparingly and, the Germans later admitted, with far stricter discipline; they read “almost no” Navy M-209 traffic (Volume 5).

Allied armies used it too. The 1949 memorandum records that “during the past war the Converter M-209 was issued to allied troops, including the French, Brazilians, and Mexicans”, and that since the war it had been “furnished in token quantities to various South and Central American countries through military aid programs”. Its author recommended stopping even that: in peacetime, he argued, “it is unwise to give wide dissemination to our security procedures since it permits a potential enemy to prepare himself to handle our wartime communications”. The same memorandum makes the point about the machine’s classification: the converter was not classified at all, because it was a commercial product, but “the method of operation of the M-209 as used in the U.S. Army is a purely U.S. development. Instructions obtained with the Swedish device are nowhere near as complete nor do they provide as secure encipherment.” In other words, the Army regarded this volume’s subject — key lists, indicators, procedure — as the part worth protecting.

4.8.1 Korea and after

About 32,000 M-209s were in depot stock in 1949, and the machine went to war again in Korea in 1950 as the standard cipher of American units below division. At the 1950 conference a British officer pointed out that it was “the only system available to U.S. forces at the equivalent U.S. level”, so that British and American units fighting side by side might have to share it (Volume 5). Training manuals kept appearing: an expanded 170-page edition of TM 11-380 was issued in May 1947 and amended in 1951 (Jerry Proc).

The machine’s last recorded military role came in the early years of American involvement in Vietnam. According to Jerry Proc, drawing on Thomas R. Johnson’s official history of American cryptology, in mid-1964 the United States supplied M-209s to South Vietnamese and South Korean forces for battalion-level use (Jerry Proc). By then the converter was more than twenty years old, its weaknesses were well understood on both sides, and the postwar fate of the design — surplus sales, WARLOCK and the Hagelin company’s own successors — belongs to Volume 6.

4.9 The Lesson of the Manual

Read as a whole, TM 11-380 is a document about trust. It trusted the machine to do its arithmetic without error, which it did. It did not trust the people who used it, and with good reason. Nearly every instruction in it — a new indicator every message, X’s in pencil, no long runs of pins, a daily key change, tape destroyed, lugs zeroed — closes a door that a cryptanalyst could use. The 1950 American estimate that an armored division in England before D-Day had made depths “almost every day”, so that its traffic could be read on 29 days in a month, shows what happened when those doors were left open (Volume 5). Friedman had warned in 1940 that the machine’s security was low if it was improperly used. The manual was the Army’s attempt to make sure it was used properly.

---

Next — Volume 5: Breaking the Hagelin — German, Italian and Allied Attacks. January 1943: a German Army cryptanalyst finds a 682-letter depth between two American messages, and the M-209 — “AM-1” to its attackers — begins to give up its settings. Bletchley Park reads the Italian Navy’s Hagelin on the North African convoy routes; a 1950 Anglo-American conference argues over how much the Germans really read; and three researchers at Bell Labs work out how to break the machine from ciphertext alone, and decide not to publish.