M-209 — Volume 6 — After the War — Crypto AG, the CX-52 and Operation Rubicon

6.1 About This Volume

The war made Boris Hagelin rich. The roughly 140,000 M-209s built by Smith-Corona for the US Army and Navy (Volume 4) paid him royalties in the millions of dollars, and the design they were built on — his own C-38 — was the most widely copied pin-and-lug machine in the world. This volume follows the machine and its inventor after 1945: the surplus M-209s sold off by the crate and the National Security Agency’s quiet interest in who bought them; Hagelin’s move from Stockholm to Zug and the founding of Crypto AG; the CX-52, the M-209’s descendant with an irregular stepping mechanism that made it, used properly, far harder to break; the long friendship between Hagelin and the American cryptologist William F. Friedman and the unwritten “gentleman’s agreement” it produced in 1955; and the 1970 purchase of the company, in secret, by the CIA and the West German Bundesnachrichtendienst (BND). The operation that followed — first called THESAURUS, later RUBICON — ran until 2018 and was made public in February 2020.

Much of the later story rests on a classified CIA history, MINERVA, and a companion BND account, which were obtained by journalists and reported, not published in full. Where a fact comes only from those reported documents, the text says so. Where sources conflict — on the purchase price, on dates, on who in the Swiss government knew what — both versions are given. The wartime story of the M-209 is in Volume 4 and the cryptanalysis of the Hagelin machines in Volume 5; Hagelin’s early life and the C-38 are in Volume 2.

6.2 The M-209 After 1945

When the war ended the M-209 was not retired. It stayed the US Army’s standard tactical cipher machine for the rest of the 1940s and went to Korea with the divisions that fought there; the Crypto Museum summarises its status as a machine considered good enough only for tactical messages that would be worthless “after several hours”, and that is how it was used (Crypto Museum, M-209). The Navy knew it as the CSP-1500.

The bigger postwar story was what happened to the surplus. With tens of thousands of machines no longer needed, the US released large batches onto the surplus market; the Crypto Museum records prices as low as US$15 and even US$2 a machine, and notes that many were bought by South American governments. A 1949 Army memorandum in the Friedman papers records that M-209s had been furnished “in token quantities” to Central and South American countries under military aid, with a small number planned for Turkey (NSA Friedman Collection, patent-equipment folder 371). Hagelin and Friedman corresponded about the surplus sales as early as 1947 (Crypto Museum, “The Gentleman’s Agreement”). Allied armies, Norway among them, also used the machine.

Selling a cipher machine whose weaknesses one has studied for five years is a peculiar kind of foreign aid. The American codebreakers knew exactly how the M-209 and its commercial twin the C-38 could be attacked (Volume 5), and in 1947 they began building WARLOCK I, a special-purpose machine operational in 1951 that was used to read traffic from countries using the M-209 or C-38 (Crypto Museum, M-209). Every M-209 sold cheaply to a foreign army was, in effect, a channel the United States could expect to read.

Hagelin, meanwhile, went on building the design under his own name. His Stockholm company produced the C-443 and the nearly identical C-446 from 1946: an M-209 in all essentials, with six fixed pinwheels and the familiar lug cage, but with proper locks on the cover and the mechanism, a double printer that typed plaintext and ciphertext on separate strips, and a letter counter. The Dutch Navy and Air Force and the Norwegian Army used it through the 1950s, and kept it in storage as a backup into the 1970s; a C-446/RT variant replaced the pinwheels with a five-level paper-tape reader so the machine could run as a one-time-tape device (Crypto Museum, C-446).

6.3 Zug — Hagelin Starts Again

Hagelin had spent the war years in the United States and returned to Sweden with his wife Annie in 1944. Sweden did not stay home for long. An undated NSA history in the Friedman papers gives the reason plainly: “Swedish law enabled the government to appropriate inventions” needed for national defence, “Because of this, Hagelin moved his operation to Zug, Switzerland in 1948” (NSA Friedman Collection, REF ID A61628). Other accounts add taxes, and Swedish export restrictions that treated cipher machines as armaments; the motives are not exclusive, and Switzerland offered neutrality, low taxes and a tradition of precision mechanics in one package.

The company itself followed in stages. Crypto AG was set up in 1950 and began trading in 1952; Stockholm wound down over the following years, and in 1966 the firm moved to a purpose-built plant in Steinhausen, a few kilometres outside Zug, where it stayed for the rest of its life (Crypto Museum, Crypto AG). The same NSA history dates the incorporation to 1959, against 1952 almost everywhere else; the earlier date is the one supported by the company’s own product record. A Liechtenstein holding company sat above the Swiss operating company, a detail that would matter in 1970.

Hagelin was in his late fifties and wealthy. He had a son, Bo, whom he hoped would one day take the business over. The firm he built in Zug sold cipher machines to governments on every continent: by the mid-1950s its CX-52 alone was in use by some fifty countries (Crypto Museum, CX-52).

6.4 The CX-52 — A Hagelin That Could Not Be Read

The M-209’s weakness, as Volume 5 explains, was its regularity. Every pinwheel advanced exactly one step for every letter. However the pins and lugs were set, the key stream was the output of six wheels marching in lockstep, and that regularity gave cryptanalysts something to grip: two messages sent on the same key, or a stretch of known plaintext, let them reconstruct the pin settings wheel by wheel. Hagelin knew this. Shortly after the war he developed a new keying mechanism that broke the lockstep, and around 1950–51 a modified M-209 with it reached the Armed Forces Security Agency, which studied it and did not tell him the results. Hagelin filed patents on the mechanism in the United States, Switzerland, France and Italy; the US patent application was placed under a secrecy order in September 1951 and released in March 1952 (Crypto Museum, “The Gentleman’s Agreement”).

The production machine was the CX-52, developed around 1952 and made first by Cryptoteknik in Stockholm and then by Crypto AG (Crypto Museum, CX-52). It kept the M-209’s architecture — pinwheels, a drum of sliding bars with lugs, a print wheel — but changed three things:

Table 1 — The production machine was the CX-52, developed around 1952 and made first by Cryptoteknik in Stockholm and then by Crypto AG ([Crypto Museum, CX-52](https://www.cryptomuseum.com/crypto/hagelin/cx52/index.htm)). It kept the M-209's architecture — pinwheels, a drum of sliding bars with lugs, a print wheel — but changed three things

Feature	M-209 (1942)	CX-52 (c. 1952)
Pinwheels	6, fixed, of 26, 25, 23, 21, 19, 17 positions	6, removable, chosen from a set of 12 (25, 26, 29, 31, 34, 37 and 38, 41, 42, 43, 46, 47 positions), in any order
Drum	27 bars	32 bars
Wheel motion	every wheel steps once per letter	wheels step 0–5 places per letter, depending on the drum bars
Compatibility	—	with standard “C” bars fitted, can work M-209, C-446 and C-52 traffic

The irregular motion came from cams on the drum bars. Each bar carried cams of four kinds: one that advanced its wheel only when the bar had been pushed sideways by a lug, one that advanced it only when the bar had not been pushed, one that always advanced it, and one that never did. Because the pushing depended on the pins, the way the wheels moved now depended on the key, and a wheel might stand still, step once, or jump up to five places on one letter. The period of the key stream, already long on the M-209, became longer and much less regular, and the wheel-by-wheel attacks that worked on the M-209 no longer applied directly. Volume 7 sets out the M-209’s own mathematics; the CX-52’s are of the same kind with one more layer of dependence.

The CX-52 came in many versions: grey for civil customers, green for military; a ten-digit model; a 30-character model; the CX-52/RT, which read its key from a one-time paper tape; and the BCX-52, the machine mounted on an electric keyboard base, as in the figure at the head of this volume. West Germany’s Bundeswehr used a licensed clone, the H-54, made by HELL. A pocket-sized relative of about 1957, the CD-57, packed six pinwheels into a case that fit in one hand and was worked by pressing a lever on its side once for each letter; NATO and friendly countries received it, others the less secure CD-55 (Crypto Museum, CD-57) (Crypto Museum, CX-52).

There was a catch, and it is the hinge of everything that follows. The CX-52’s strength depended on how it was keyed. Some combinations of bars and cams made the wheels cycle quickly, giving a short period that was easy to break; a Norwegian evaluation found it “virtually impossible to select a key that is guaranteed to generate a long cycle”, and the Crypto Museum’s summary is blunt: “Unwitting users could easily select a weak key.” A later model, the CX-52M, was modified to guarantee a long cycle, but the motion it produced was predictable, and according to the reported CIA history the NSA could break it (Crypto Museum, CX-52). Whoever wrote the manual — whoever told the customer how to choose keys — therefore had a great deal of say over how secure the customer’s traffic would be. For that reason, the Crypto Museum notes, the CX-52 was never adopted by the US Army or by NATO.

6.5 Friedman and Hagelin — The Gentleman’s Agreement

When the US Army was considering Hagelin’s machine in 1941–42, William Friedman, according to the same NSA history, turned in an unfavourable report on the M-209 because, although its cryptosecurity was “theoretically quite good”, it had a low degree of security if improperly used. He was overruled: neither the Signal Intelligence Service nor the Signal Corps Laboratories “had developed anything that was better than the Hagelin machine or even as good” (NSA Friedman Collection, REF ID A61628). The two men became friends regardless. The Washington Post, quoting the CIA history, describes “a lifelong friendship over their shared backgrounds and interests” (Washington Post via Anchorage Daily News, 11 February 2020). The NSA history records a visit Friedman paid to Hagelin in Switzerland after the war, and Friedman’s note of an “almost tearful farewell with the Hagelins. They are such charming people”.

The friendship became policy because of the CX-52. A Hagelin machine that American cryptanalysts could not read, sold to any government that could pay, was a direct threat to the NSA’s work, and the 1950s files in the Friedman Collection — some 400 of the more than 7,600 documents the NSA released in 2014 concern Hagelin or Crypto AG, many still heavily redacted — show a long negotiation about what to do. The Crypto Museum, which worked through them with the BBC in 2015, reconstructs the sequence (Crypto Museum, “The Gentleman’s Agreement”; BBC Radio 4, Document: The Crypto Agreement, 28 July 2015):

• 1951. Friedman put a proposal to the Armed Forces Security Agency that the CIA control worldwide sales of the new CX machines, with Hagelin compensated US$700,000. The AFSA Council did not approve it. The Washington Post’s reading of the CIA history places the first deal over dinner at the Cosmos Club in Washington the same year, with “as much as $700,000 up front”.
• 1953. Hagelin, Friedman and the NSA director, General Ralph Canine, discussed a “denial operation”; the US Communications Intelligence Board rejected it.
• 1954. Hagelin and the NSA entered a six-month “Gentleman’s Understanding”, and in December the board authorised a new proposal. (Cipher equipment had been put on the US Munitions List in November 1954.)
• 21–28 February 1955. Friedman stayed with Hagelin in Zug. The deal was accepted on 25 February and took effect on 28 February. Hagelin wanted nothing in writing.
• 3 April 1955. Friedman suffered a heart attack; he retired that August, and the agreement began to fray when the NSA did not keep its side of it.
• September 1957. Friedman, recalled as a consultant, returned to Zug to renegotiate.

The terms, as far as the redacted papers allow them to be read, were that Hagelin would not sell his strongest machines to countries the United States proscribed; that he would continue to supply the NSA with information; and that the NSA would write the CX-52 manuals — the key-selection instructions on which the machine’s security depended — and approve the CX-52 for NATO if properly used. Other elements, such as buying back lots of surplus M-209s or a US Army order for C-52s, are guesses on the evidence available. By late 1957 Hagelin had nonetheless sold 347 CX machines to Asian and Middle Eastern countries, and Latin American sales went ahead because the United States could not stop them without admitting that those countries were targets.

The arrangement deepened in 1960, when, according to the CIA history as summarised by the Crypto Museum, a CIA licensing agreement paid Hagelin US$600,000 in compensation and an annual fee of US$75,000, with a further US$10,000 a year added in 1963 for sales efforts (Crypto Museum, Operation RUBICON).

One often-repeated story should be set aside. Crypto AG’s most sophisticated mechanical design, the nine-rotor HX-63 of 1963, is sometimes said to have been withdrawn because Friedman insisted it was too secure. The Crypto Museum finds no evidence for this: Friedman discussed an early HX machine with Hagelin in 1957, the subject was not raised again, and by 1963 he had left the NSA. Hagelin’s own memoir says manufacture ended “Due to the development of electronic machines” (Crypto Museum, HX-63).

6.6 MINERVA — The 1970 Purchase

By the late 1960s Hagelin was in his mid-seventies and thinking about who would own the firm after him. In 1967 a French and West German partnership approached him; he told the CIA, and the Americans chose to work with the Germans and not the French. The BND and the CIA agreed to buy the company together. Siemens was originally meant to take a stake and appear as the owner; it pulled out of a 50 per cent holding in December 1969 but stayed on as a “legend” that could be presented as the owner if anyone asked, and supplied an advisory board through which the BND’s cipher office influenced products (Crypto Museum, Operation RUBICON).

The shares passed to the BND on 4 June 1970, and on 12 June a memorandum of understanding gave the CIA half. Ownership was held through the Liechtenstein holding company and trustees, so that no public record connected Crypto AG to either government. The CIA called the company MINERVA, and its internal history of the operation carries the same title. The price is reported two ways: the Washington Post gives “approximately $5.75 million” for the buy-out; the Crypto Museum, from the BND side of the documents, gives CHF 25 million (then about US$7 million) paid in three instalments (Washington Post via ADN; Crypto Museum, Operation RUBICON).

Bo Hagelin, the son his father had hoped would inherit the business, was regarded by the CIA as a risk to the arrangement. He died in a car crash in November 1970, about five months after the transfer. The Washington Post reported that the CIA history found “no indications of foul play”, and no source has produced any evidence otherwise.

The joint operation was named THESAURUS; in 1987 it was renamed RUBICON.

6.7 Thesaurus and Rubicon — How the Machines Were Weakened

What the two agencies bought was not a single back door but control of design. According to the reported CIA history, the NSA did not install “crude ‘back doors’” or make the machines leak their keys; instead it shaped the algorithms so that traffic looked random to the customer but could be solved by someone who knew the weakness, and “the company always made at least two versions of its products” — secure ones for approved governments and weakened ones for the rest (Washington Post via ADN).

For the mechanical machines the lever was the one Friedman had identified in the 1950s: the manuals and the key-generating rules. With the electronic machines that replaced the CX-52 from about 1970 the lever was the “cryptologic”, the key-generating circuit itself. The reported history and the Crypto Museum’s reconstruction of it give a sequence of episodes (Crypto Museum, Operation RUBICON):

• H-460 (c. 1970). An electronic teleprinter cipher machine “whose inner workings were completely designed by the NSA”, in the Post’s words. Italy returned the first 82 units; a German-directed redesign followed in 1972, and by 1976 Italian and Egyptian specialists had found the weakness. Crypto AG answered with customer-specific cryptologics, which the NSA could still read.
• HC-500 series (1977 onwards). Pocket and desk electronic machines whose algorithm was attributed to the NSA mathematician Peter Jenks. The HC-520, developed by Siemens in Munich, sold especially well in Argentina. In 1979 a Crypto AG engineer, Jürg Spörndli, found a known-plaintext weakness; the replacement accepted was an NSA one.
• Internal resistance. Some of the company’s own engineers kept finding the weaknesses. The head of research, Peter Frutiger, improved one cryptologic and was dismissed in March 1977; the mathematician Mengia Caflisch, hired in 1978, broke the HC-500 algorithm and designed a strong one for the HC-740, which the NSA then had made readable with a substitute chip. In 2020 Frutiger said he had been fully aware of the project.

The scale is what made the operation extraordinary. Crypto AG sold to more than 120 countries over the life of the operation. The Soviet Union and China, America’s principal adversaries, “were never Crypto customers”; the harvest came from everyone else — allies, neutrals, non-aligned and hostile governments alike. The Post reports that in the 1980s Crypto accounted for roughly 40 per cent of the diplomatic cables and other foreign-government transmissions that NSA cryptanalysts decoded. The Crypto Museum’s summary of the history gives figures for individual targets: in 1988, for instance, some 19,000 Iranian messages were read, put at 80–90 per cent of that traffic.

The reported episodes include Iran during the 1979 hostage crisis; intelligence on Argentina’s forces passed to Britain during the Falklands War of 1982 — “The Argentines swallowed hard, but kept buying CAG equipment”, the history says; Libyan officials congratulating themselves on the 1986 bombing of the La Belle discotheque in West Berlin, the intercept that President Reagan cited publicly when he ordered air strikes on Libya; and the Vatican’s use of Crypto devices during the 1989 hunt for Manuel Noriega. The CIA history’s own verdict is the line most often quoted: “It was the intelligence coup of the century.” It added that foreign governments “were paying good money to the U.S. and West Germany for the privilege” of having their communications read. The company was also profitable, and the two agencies split the profits and spent them on other operations.

6.8 The Bühler Affair

The arrangement nearly came apart over one salesman. In March 1992 Hans Bühler, a Crypto AG salesman, flew to Tehran on business and did not come back. The Swiss embassy reported at the end of the month that he had been arrested with others on charges including spying. He was held for about nine months and interrogated repeatedly; by every account he knew nothing of the arrangement, and so had nothing to tell. In September 1992 bail was set at US$1 million. The White House refused to let the CIA pay its half, and the BND put up the whole sum, routed through Crypto AG. Bühler reached Zurich on 5 January 1993 (Crypto Museum, Operation RUBICON).

The company then dismissed him, in March 1993, and asked him to repay the bail. Bühler went public. With the Swiss journalist Res Strehle he told his story in the book Verschlüsselt: Der Fall Hans Bühler (1994), and in March 1994 he appeared on Swiss and Austrian television saying the BND stood behind the company. Swiss and German press reports in 1994, and a long investigation by Scott Shane and Tom Bowman in the Baltimore Sun in December 1995, put the charge that Crypto AG’s machines were rigged into print. The company denied it, a Swiss federal investigation opened in 1994 produced no public finding against the firm, and customers kept buying. The secret held for another quarter-century.

6.9 The Long Divorce

The Bühler affair, the end of the Cold War and German doubts about the risk ended the partnership. In 1993 the BND told the CIA that the relationship had to change. Under a memorandum signed in December 1993 the CIA made an advance payment of US$12 million; the shares were valued at US$17.1 million in February 1994, the CIA paid the balance, and on 30 June 1994 it became the sole owner (Crypto Museum, Operation RUBICON).

The CIA kept the company for another 24 years, while the market moved from dedicated cipher machines to software and commodity encryption and Crypto AG’s value as a source declined. In January 2018 the business was split. The international product line, the brand and the distribution network were sold to Andreas Linde as Crypto International AG, an unwitting buyer, and the Swiss domestic business became CyOne Security in a management buy-out. Crypto AG itself was liquidated on 31 October 2019 (Crypto Museum, Crypto AG).

6.10 February 2020 — The Story Breaks

On 11 February 2020 the Washington Post, the German broadcaster ZDF and Swiss television SRF published the results of a joint investigation, built on the CIA’s MINERVA history and a BND account, with the historians Erich Schmidt-Eenboom and Richard Aldrich and technical advice from the Crypto Museum’s Paul Reuvers and Marc Simons. The Dutch programme Argos took part in the reporting (Crypto Museum, Operation RUBICON).

The Swiss reaction was immediate. The government suspended the export licences of Crypto International pending investigation, and the parliamentary intelligence oversight delegation (GPDel) opened an inquiry. Its report, adopted on 2 November and published on 10 November 2020, found that the Swiss Strategic Intelligence Service had known since 1993 that foreign intelligence services were behind Crypto AG, and had used the resulting intelligence; it called it regrettable that the Swiss political leadership “were not informed until the end of 2019”, barely a year after the operation ended (GPDel press release, 10 November 2020; The Register, 12 November 2020). The CIA history’s statement that a former Swiss defence minister, Kaspar Villiger, had been told of the ownership was denied by him (swissinfo); this remains disputed. In late 2020 Swiss television reported that a second Swiss firm, Omnisec, had also sold weakened equipment.

Crypto International, unable to export, laid off 83 of its 85 staff in July 2020. In 2021 the CRYPTO lettering came off the building in Steinhausen.

6.11 What Is Known, and What Is Claimed

Because so much of this story arrived through leaked histories written by the agencies about themselves, it is worth separating its layers.

Documented in released primary sources. Hagelin’s move to Zug and the reasons the NSA gave for it; the M-209 surplus sales; the friendship with Friedman; the AFSA and USCIB deliberations of 1951–1957 and Friedman’s 1955 visit to Zug, in the redacted Friedman Collection released by the NSA in 2014.

Documented in reported but unpublished documents. The 1970 purchase, the THESAURUS/RUBICON names, the payments, the design of individual cryptologics, the percentages of traffic read and the specific episodes (Iran, the Falklands, Libya, the Vatican), all from the CIA’s MINERVA history and the BND account as quoted by the Washington Post, ZDF and SRF and summarised by the Crypto Museum. These are the agencies’ own accounts, with an institutional interest in their success.

Officially confirmed. The Swiss parliamentary report of November 2020 confirmed the foreign control of Crypto AG and the Swiss intelligence service’s knowledge from 1993. Neither the CIA nor the BND has published its history.

Disputed or unknown. The exact 1970 price; what individual Swiss politicians knew; how many machines of each version went to which country; and how much of the reported success depended on rigged designs as against ordinary cryptanalysis of customers who chose weak keys.

6.12 The Last Years of Boris Hagelin

After the sale Hagelin retired, dividing his time between Switzerland and Sweden. His wife Annie had died in 1966; in 1969 he married again. He wrote an account of his machines and his firm, The Story of the Hagelin Cryptos, dated 1981 by an NSA history and published in Cryptologia (vol. 18, no. 3, pp. 204–242) in July 1994, eleven years after his death. According to the reported CIA history, when he fell seriously ill in Sweden in 1982, his second wife Elsa helped the CIA search his study in Zug, with his consent.

Boris Hagelin died on 7 September 1983, aged 91. He is buried in his father Karl Wilhelm Hagelin’s family grave at Norra begravningsplatsen, outside Stockholm, with his first wife Annie and his son Bo.

6.13 What the M-209 Left Behind

Every machine in this volume is a descendant of the one the Army called the Converter M-209. The CX-52 is its mechanism with the lockstep removed; the C-446 is the M-209 itself with better locks; and the knowledge that let the NSA treat a Hagelin machine as readable began with the American, British, German and Italian cryptanalysts who learned to break the C-38 and M-209 during the war (Volume 5). The bargain Friedman struck in 1955 was possible because the United States had bought, built and studied the M-209 more thoroughly than anyone; the operation of 1970–2018 was possible because the firm that designed it was willing first to be advised and then to be owned.

The machine itself survived its maker’s company. M-209s are now collectors’ pieces, sold at auction and restored by hobbyists; their mechanism is simple enough to reproduce on a home 3D printer, as Volumes 8 and 9 show. Before building one, it helps to know exactly what it computes.

---

Next — Volume 7: The Mathematics of Pins and Lugs — Period, Key Space and a Worked Encipherment. Six wheels of 26, 25, 23, 21, 19 and 17 positions, 131 pins and 27 bars: how many different keys that allows, why the wheels repeat only after more than 101 million letters, what that number does and does not say about security, and one message enciphered letter by letter through the unit’s simulator — the arithmetic that the cryptanalysts of Volume 5 turned against the machine.