SIGABA — Volume 6 — Security in the Field — Guarding the Machine

6.1 About This Volume

The SIGABA was designed on the assumption that the enemy might one day hold a machine. Its security rested on the key — the choice and order of rotors, their wirings, the daily settings — and Volume 5 showed how carefully those were made and handled. But the United States did not act as if the machine itself were expendable. Quite the reverse: the services came to believe that the stepping maze was so far ahead of anything else in the world that its principle had to be protected for its own sake, from enemies and allies alike. They guarded it with a thoroughness that surprised even their own officers.

This volume describes how. It begins with the joint Army–Navy policy of June 1942, then follows the machine into its safes and lockers and through the destruction drills its crews were taught. It then tells, from the Army’s own investigation, the story of the one SIGABA known to have left American hands during the war — the machine lost at Colmar in February 1945 — and of a lesser-known near-miss in China the year before. It ends with the postwar rules, which were stricter still.

6.2 A Machine Nobody Else May See

6.2.1 The joint policy of 26 June 1942

Seven months after Pearl Harbor the Army and the Navy put their policy in writing. It was printed at the front of the Navy’s operating manual, where every operator would read it before touching the machine:

“It is mutually agreed that the ECM-M134C will not be placed ashore in foreign territory except at such places where armed personnel of U.S. forces are stationed in sufficient numbers to properly safeguard the physical security of the machine.

“The Army or Navy may make the machine available to the Allies of the United States if the machine is accompanied by a Liaison Officer and Communication Group. It will be the duty of the Liaison Officer to prevent the viewing of the machine or its operation or associated equipment by other than authorized personnel of U.S. armed forces.

“The U.S. Army and Navy mutually agree that they will regard as secret information to be divulged only to the armed forces of the U.S. or to any U.S. citizen required to possess this information in the interests of the United States, any details concerning the ECM-M134C including rotors, wiring diagrams, keys, keying instructions and operating instructions.”

— “Army-Navy Joint Policy Concerning Distribution and Disclosure of Cryptographic Design of the ECM-M134C”, 26 June 1942, printed in CSP 1100(C), p. 3

The policy meant what it said, and it applied to Britain. The two countries shared most of their cryptologic secrets during the war, including the breaking of Enigma; they did not share this. SIGABAs installed at British facilities were operated and stored in secure enclaves that host-nation personnel could not enter. Combined traffic between the two nations went over other machines — first Typex, later the Combined Cipher Machine of Volume 7 — while the SIGABA carried American traffic alongside (Mucklow 2015, pp. 25–26). The same rules governed the machine in Moscow, where the US military mission used it “under special precautions” (Friedman, c. 1946).

The machine itself was classified CONFIDENTIAL and registered; its rotor sets and key lists were SECRET and registered. Every item was accounted for by register number; it was never to be shipped without its crate; and in transit the machine and its publications “will … invariably be accompanied by a commissioned officer” (CSP 1100(C), paras 104, 107, 109). Any loss, or any circumstance that might amount to a compromise — a safe found unlocked, a publication left unguarded — was to be reported to the Chief of Naval Operations at once by dispatch (para. 110).

6.3 Lockers, Safes and Guards

6.3.1 Afloat: the Type 8 Safe Locker

Aboard ship the ECM lived in the code room, bolted down “in both the operating and stowage positions” so that it could not be damaged by the ship’s motion; quarter-inch threaded holes in its base were provided for the purpose. The Navy designed a special cabinet for it, the Type 8 Safe Locker: 18⅞ inches wide, 14¼ deep and 45 high, weighing 172 lb empty, obtainable only by letter to the Norfolk Navy Yard at $90.00. The machine sat in the upper compartment on a shelf that pulled out for operation. A lamp of at least 25 watts was to be “kept lighted at all times in order to keep the compartment free from moisture” (CSP 1100(C), paras 101–102).

The Navy was candid about the locker’s limits. “Due to its special design, the Type 8 Safe Locker cannot be considered as secure as standard safes,” the manual says, and it was suitable stowage “except at shore stations where it may be unobserved for long periods of time” (para. 101(d)). Its real protection was the code room itself and the watch kept in it. On the submarines in the Pacific, where there was no room for anything else, the machine lived in a special safe locker built into the radio room.

6.3.2 Ashore: the CH-76 field safe

The Army, which had to move its machines with headquarters in the field, used the Field Safe CH-76, a heavy steel chest in two sections that could be separated for carrying. Each section weighed about 255 lb empty and measured 31 by 20¾ by 22 inches; with the machine in its special wooden box (about 140 lb) the complete assembly weighed some 650 lb. Four handles were fitted to each section, and the safe had provision “for holding two M-1 Thermite Bombs in position, ready for instant use” (CSP 1100(C), para. 103). The Navy kept a few for naval holders ashore at advanced bases. Mucklow describes the Army fitting thermite and TNT charges to SIGABA security cabinets of around 800 lb carried aboard tactical communications vehicles (Mucklow 2015, note 42).

6.3.3 Guards

Where the machine went ashore in foreign territory, the 1942 policy required enough armed Americans to protect it. In practice that meant an armed guard over the code room or the vehicle, around the clock. Overseas, Mucklow notes, the 24-hour armed guard “had been the usual practice during the war”. The Colmar story below shows what happened when, for one night, it was not.

6.4 Destruction

The Navy’s 1944 manual devotes four closely written pages to destroying the machine, and the order of priorities is revealing. The machine was the least important part; the rotors came first.

6.4.1 Order of destruction

Afloat, the simplest method came first: “Emergency destruction of the ECM and associated publications carried afloat is most readily accomplished by throwing them overboard in deep water” — deep enough that they could not be salvaged. Ashore or in shallow water the procedure was set out step by step, in this order: code wheels, key lists, machines (CSP 1100(C), paras 111–112). Within each category the most widely distributed material went first, and reserve material before effective material — on the reasoning that its compromise would affect the most holders.

• Code wheels. The wiring was destroyed first: with a small torch the wires were unsoldered and pulled out with long-nosed pliers, then cut into small pieces and disposed of. Without a torch, the wires were cut as close to the solder lugs as possible or pulled off. The CCM’s wheels, whose rims carried the cam contours that controlled their stepping, had to be smashed as well — “with a heavy hammer smash the Code Wheel faces into bits”. If there was no time, the wheels were to be disposed of so as at least to delay recovery: “If thrown overboard, they should be thrown singly in different directions” (para. 113).
• Key lists were burned, and the ashes broken up. Some were printed on coated paper from which the ink would loosen in water, but that was “an emergency provision only”. Without time to burn them, they went overboard in a perforated, weighted bag, or at least were torn into bits and scattered (para. 114).
• The machine. “The most important cryptographic part of the ECM is the Cipher Unit and wiring which leads to it. The Zeroizer is next in importance.” The operator was to pull the cipher unit, smash the index wheels with a heavy hammer, cut the wires; take off the cover, unsolder or cut the connections, and cut the cables to the distributor plates “as ‘straight across’ as possible” so that the colour-coding of the wires could not be used to reconstruct the circuit; remove the zeroizer wiring; then smash everything, cover it with inflammable material and burn it (para. 115).

6.4.2 Demolition charges and thermite

For quicker destruction there were explosives and incendiaries. A destruction kit for each machine held two half-pound TNT demolition charges, electric and fuse detonators, four-foot lengths of fuse, an exploder, and a heavy hammer or axe with a metal plate or rock on which to smash code wheels. The charges went into the front left-hand corner of the cavity left by the removed cipher unit. The manual warned that explosives “should not be depended upon to destroy the Code Wheels” (para. 116).

The preferred incendiary was the M-1 Thermite Bomb, standard in both services, which came in a wooden container weighing about 55 lb, 24 by 20 by 3½ inches. To use it, the operator took the code wheels out of the machine, put the cipher unit back in (index wheels and all), left the lid off, laid one set of code wheels flat on top of the machine — no more than three deep in an emergency — placed the bomb across them and fired it, electrically from anything between a flashlight cell and a 110-volt lighting circuit, or by pulling the firing ring. “The M-1 Bomb does not explode,” the manual notes, but in about two minutes it would “spend itself”, and “the machine will be left burning furiously” (para. 117).

The two services disagreed about thermite at sea. Navy tests reduced the ECM’s critical components to molten metal in 97 seconds, but the Navy banned the bombs from ships, where fire is the greatest danger. The Army had fewer qualms about fitting thermite and TNT to its security cabinets on vehicles. Mucklow notes that there is no record of an unintended mishap with these devices, but that the Navy’s caution was “partly vindicated by more than one Army incident of a near discharge” (Mucklow 2015, note 42).

6.5 A Near-Miss in China, May 1944

Destruction doctrine was easier to write than to carry out. In 2018 the NSA’s Center for Cryptologic History published an incident it had only just found in the files of the Office of the Theater Signal Officer, India–Burma Theater. In early May 1944 the Japanese were advancing on the Chinese city of Hengyang and the nearby airstrip of the US Fourteenth Air Force. The airstrip’s personnel were warned — prematurely, as it turned out — that Japanese paratroops had already landed. The code-room staff decided to evacuate and join Chinese forces in Hengyang.

“In the frenzy and excitement,” the CCH account says, “no one thought of destroying the SIGABA machines or other cryptographic systems.” One team member grabbed a set of rotors — the source calls them “SIGTELP” rotors, a short title the CCH says it has been unable to link to the SIGABA — and ran with the others to the river. They crowded into a sampan, which capsized. The man carrying the rotors drowned, and the rotors were never recovered (NSA CCH, “A CBI SIGABA Near-Miss”, 2018; Library copy). The same theatre file mentions another SIGABA compromise scare, without detail.

6.6 The Colmar Incident, February–March 1945

6.6.1 The setting

By the beginning of February 1945 the Allied armies were preparing the final assault into Germany. In southern Alsace, the French First Army, with American divisions under its command, was eliminating the Colmar Pocket, the last German foothold west of the Rhine in that sector. The US 28th Infantry Division was among them. Colmar itself had been evacuated by the Germans a few days earlier; on the day of the theft the enemy was only about four miles north of the city.

The stakes were described by the NSA’s internal account, which is based mainly on the Army Security Agency’s report on the incident of 15 April 1952. The SIGABA “was a vital part of a world-wide Combined (UK/US) communications system”. All the Allied war plans for the spring assault had been enciphered on it, as had the arrangements for President Roosevelt’s pending trip to Yalta. “And it was the only highly secure U.S. cipher system available to many U.S. units in Europe at that time” (NSA, “The Colmar Incident”, p. 13; Library copy).

6.6.2 The theft

On 4 February 1945 the chief of the 28th Division signal company’s message centre left Kaysersberg with an advance section of his cryptographic team and equipment to set up a message centre in Colmar. There were no billets ready, so they found an unoccupied house — the source gives the address as No. 16 “Barbarassastrasse” — obtained permission to use it, unloaded their equipment and opened communications.

On 5 February the second half of the team followed, with spare sets of cryptographic equipment including a SIGABA, locked in a safe in the “code room” carried on a 2½-ton truck. The company’s motor pool section, responsible for setting up a guarded truck park, had not yet arrived. The men were told to park as near to their billet as possible, and the truck, with the SIGABA aboard, was left for the night in front of No. 20 on the same street — “but without guards, as normally required” (p. 14).

The next morning two officers went to the truck to make some repairs, and it was gone. At about 11:15 a.m. they found its trailer abandoned on a dead-end road; tyre tracks showed that the trailer had been unhitched and the truck turned round and driven out of town. Men of the same company had been making frequent trips throughout the night to a radio car parked across the street, to run its engine, but they had seen and heard nothing.

6.6.3 “Grave possibility of compromise”

On 6 February Headquarters, Communications Zone, European Theater of Operations, in Paris sent an urgent SECRET message to all strategic commands in Europe, with an information copy to the War Department and Arlington Hall:

Suspend use immediately of editions 18 and 19 of systems 2201, 2222, and 2242, editions 10 and 11 of CCBP 0125 and 0126 and edition 2 of 514. Grave possibility of compromise all mentioned exist, all Commanders to be informed of possibility of enciphered traffic via radio in above systems being read by enemy. Reserve systems now being distributed.

— COMZ ETO message of 6 February 1945, quoted in “The Colmar Incident”, p. 13 (text restored from a poor scan)

Arlington Hall did not learn the details until 10 February, when the officer in charge of the War Department Code Center telephoned, and a transatlantic enciphered telephone call the next day filled in the rest: a 2½-ton truck stolen from a city street in Colmar, the SIGABA and other material in a locked safe in its code room.

The search that followed was enormous. The division’s intelligence staff and the military police searched Colmar; the division’s inspector general investigated the men responsible. All units were ordered to make officer-supervised searches of “all sheds, barns, woods, mountain areas, etc.”; SHAEF was asked for a theatre-wide search; the Sixth Army Group ordered every headquarters and subordinate unit to inventory the serial numbers of its 2½-ton trucks and inspect their contents. The French police and the Sécurité Militaire were brought in and given descriptions of the truck and safes, though not of their contents. General Eisenhower became personally involved, ordered a vigorous search and gave the recovery top priority; “all Allied high commands participated” (p. 14).

Suspicion fell first on the French. A truck resembling the stolen GMC had run a roadblock at Montbéliard; the Seventh Army’s Counter Intelligence Corps detachment had had three jeeps stolen by French units during a single overnight visit to Colmar; French soldiers from units not involved in the fighting had appeared in the town as soon as it was taken and “appropriated” whatever vehicles they could. But there was a more ominous possibility. Men of the 28th Division’s signal company had been captured by the Germans before 5 February, so the enemy could have known that such material was in the area and made a special effort to get it. The serial-number checks turned up one revealing fact: stealing trucks from the front line was common practice, and six other 2½-ton trucks were found in the hands of the wrong units (pp. 14–15).

6.6.4 The truck and the river

On the morning of 9 March 1945 the truck was found abandoned in a wooded area several miles north of Rambervillers, on the western side of the Vosges, some 45 miles from Colmar. Its bumpers had been removed and its numbers painted out; otherwise it was undamaged. The safes were gone.

That afternoon a search party from the Deuxième Bureau of II Corps, First French Army, found the upper half of the safe — designated SIGRINO, Chest CH-76 — together with a small company field safe, submerged in the Giessen (the source spells it “Gressen”), a small mountain stream that runs between Châtenois and Scherwiller, near Sélestat. The upper half of the CH-76 contained the SIGABA and other classified equipment. The lower half, which held the rotors, instructions and pamphlets, was still missing.

The river was dredged near the bridge, and plans were drawn up to divert the stream. On the theory that the safes had gone into the water in early February, when the river was higher and faster, the dredging moved downstream. On 20 March the lower half of the safe was recovered from the river bed about 100 feet below the bridge (p. 15).

6.6.5 What was inside

The recovered equipment was too waterlogged and muddy for fingerprinting. The verdict rested on two observations: the safes’ combination settings had not been moved, and there was no sign that anyone had tried to open them. The Sixth Army Group’s intelligence staff and the Signal Intelligence Service therefore concluded that no compromise had occurred.

The lower safe’s combination was clogged with silt, so it was sent to Paris and “opened” at a ceremony attended by at least half the intelligence staffs in the city. An attempt was made with a cutting torch, which — “fortunately” — ran out of oxygen after about two inches. When the safe was finally cut and drilled open later, after the visitors had gone, it was found to contain two 55-lb thermite bombs and blocks of TNT, all wired to detonators. They were not a booby trap, the account notes, merely “the devices normally carried with cipher machines to destroy them if they were in danger of being captured by the enemy” (p. 15).

Inspection also turned up a second breach of the rules. The rotors were found set up in the arrangement for 5 February: “This was, however, in violation of strict security rules for moving the machine, as rotors were never to be left in place when transporting such equipment” (p. 15, note 2).

6.6.6 Who took it

No written record identified the thieves. An officer who had worked on the case at Headquarters ETO later recalled that, during the inspector general’s investigation, two French peasants had remarked that the Americans could find their truck in the “woods” and the “boxes” in the “river”. Their description of the area was good enough to find both, and the two men were arrested on suspicion. Under interrogation they said the thief was a friend of theirs, a farmer, who had taken the truck to move his household furniture. They would not give his name, and he was never questioned. The consensus at Sixth Army Group was that the truck had been stolen for its own value, and “that the thieves were unaware that the truck contained highly valuable and sensitive cryptographic equipment” (p. 16).

6.6.7 The cost

The Army treated the loss as a compromise until proven otherwise, and the cost of that assumption was large. Systems were suspended across the European theatre; reserve systems were rushed out; landline and courier carried what they could. According to Mucklow, the Army and Navy, suspecting a physical compromise of the machine, “produced an entirely new set of fifteen rotors for each of the 10,060 machines in the inventory” in a surge effort, and it was General Eisenhower who personally ordered the new rotors fielded; “at the war’s end, each SIGABA was equipped with two sets of rotors” (Mucklow 2015, p. 30). A more detailed account on the intelligence-history blog Christos military and intelligence corner, drawing on NSA and NATO files, records that the CCM rotor basket and its basic rotors (CCBP 0111) were also treated as compromised, that 17,840 new rotors were wired between February and August 1945 to replace them, and that one lesson drawn was that the emergency plans had made no provision for reserve rotors (Christos military and intelligence corner, 2025).

6.6.8 What the sources disagree about

Two details of the Colmar story vary between sources, and the series follows the NSA’s account where they differ.

• The date. The NSA narrative places the theft on the night of 5–6 February 1945, with the loss discovered on the morning of the 6th and the suspension message sent the same day. Some secondary sources give 3 February — Wikipedia’s SIGABA article cites David Kahn’s The Codebreakers for that date, and the National Cryptologic Foundation’s “This Day in History” calendar uses it as well. The 3 February date is incompatible with the NSA account, in which the team carrying the SIGABA left Kaysersberg only on 5 February; it is treated here as an error, but the point is flagged for checking against Kahn’s text.
• The geography. The NSA account describes Rambervillers as “approximately 45 miles northeast of Colmar”. Rambervillers lies north-west of Colmar, across the Vosges; the distance is about right, the direction is not. It also says the Montbéliard roadblock was “35 miles north of Colmar”; Montbéliard is to the south-west. The OCR of the declassified copy is poor, and these may be transcription errors in the original typescript.

6.7 After the War: Stricter Still

Peace did not relax the rules; it tightened them. Postwar studies of German and Japanese capabilities convinced the services that the SIGABA was even further ahead of the rest of the world than they had thought, and that its principles needed more protection after the war than during it. The fear was less that an enemy might break it than that an enemy might copy it to protect his own communications. Policy required every SIGABA to be guarded 24 hours a day by armed military personnel, wherever it was (Mucklow 2015, p. 26).

When some commands proposed relaxing the requirement for machines stored in locked rooms, the Army Security Agency refused in a letter of 9 May 1946:

This Agency does not consider that the cessation of hostilities justifies any relaxation in security regulations pertaining to cryptographic material and has noted with alarm a tendency towards such relaxation during recent months as has been evidenced by an increase in the number of physical and cryptographic compromises. … Since the cryptographic principle and design of Converter M-134-C is in the sole possession of the United States and it is considered to be the best cryptographic device of its type, it is not advisable to jeopardize its use or storage under unsatisfactory security conditions. It is considered that eliminating the necessity for a 24-hour armed guard, regardless of geographical location, even if the converter were stored in a CH-76 in a locked code room, would result in such a condition.

— Col. George A. Bircher, Army Security Agency, to the Commanding General, Army Air Forces, 9 May 1946, quoted in Mucklow 2015, note 75

The services also removed SIGABAs from places where they might be lost and replaced them with the SIGROD, a smaller, cheaper five-rotor machine cryptographically close to the CCM and Typex, which could carry TOP SECRET traffic but “if compromised would not disclose the sensitive cryptographic principles embodied in SIGABA” (Mucklow 2015, p. 26). By March 1949 the SIGROD was in use in 52 of the 60 US Army attaché offices around the world (NSA CCH, “Changing Machines”, 2019; Library copy). Mucklow notes that, according to research published after the earlier histories, the SIGABA was eventually withdrawn as much to keep its technology out of Soviet hands as because it could not keep up with modern high-speed communications — and that because “every SIGABA and rotor had been accounted for”, the services were confident its secrets had been kept (note 78). Volume 7 returns to the SIGROD and Volume 9 to the end of the machine’s service.

6.8 What Colmar Showed

The Colmar loss is remembered because it was the exception. Of the 10,060 machines built, it is the only one known to have left American control during the war, and it did so not through enemy action but because of a missing motor-pool section, a tired signal company, and a farmer who needed to move his furniture. Every safeguard that failed had been written down: the truck should have been guarded; the rotors should not have been in the machine. Every safeguard that held had been written down too: the safes were locked and stayed locked, the destruction charges were in place, and the reserve systems existed to be issued.

The incident also shows what the system cost to run. To protect a machine whose principle the enemy almost certainly could not have exploited in the time left, the Army suspended systems across a theatre on the eve of its final offensive, involved the Supreme Commander in a search for a lorry, and rewired tens of thousands of rotors. In retrospect, Mucklow judges, given the state of Axis cryptanalysis “this was not warranted”. At the time nobody could know that, and the services’ willingness to pay the price is part of the reason the SIGABA was never broken.

Sources

• NSA, “The Colmar Incident: A Cryptographic Device Lost in World War II Operations” (Library copy) (internal article based mainly on the Army Security Agency report of 15 April 1952; approved for release 2008, FOIA case 51551), media.defense.gov PDF.
• US Navy, CSP 1100(C), Operating Instructions for ECM Mark 2 (CSP 888/889) and CCM Mark 1 (CSP 1600), 16 May 1944, joint policy (p. 3) and Part I, paras 101–119, transcribed by Richard Pekelney, maritime.org.
• Timothy J. Mucklow, The SIGABA / ECM II Cipher Machine: “A Beautiful Idea” (NSA CCH, 2015; Library copy), pp. 16, 25–26, 30, and notes 42, 75, 78, govinfo.gov PDF.
• NSA Center for Cryptologic History, “A CBI SIGABA Near-Miss” (History Today, 3 October 2018; Library copy), nsa.gov PDF.
• NSA Center for Cryptologic History, “Changing Machines” (History Today, 18 March 2019), nsa.gov PDF (Library copy).
• “The Combined Cipher Machine — 1942–1962”, Christos military and intelligence corner (March 2025), blog.
• National Cryptologic Foundation, “1945: Truck Lost at Colmar, France, Causes Theater-wide Search” (This Day in History, 3 February), cryptologicfoundation.org.

---

Next — Volume 7: The CCM and Allied Interoperability. Two allies, two machines and a policy that forbade sharing one of them; an American naval engineer’s adapters that turned both a SIGABA and a Typex into the same simpler machine; thousands of conversions on both sides of the Atlantic; a short cycle of 338 letters found in Dayton, Ohio, and not fully studied for six months; “lobsters”; and a machine that went on to serve NATO until the 1960s.