is the story of Boris Hagelin, a brilliant engineer, and
his famous cipher machines. He is the only inventor and
developer of crypto machines in history to have made a
fortune in that market. Hagelin and Crypto AG were most
respected names in the world of crypto machines and have
dominated the commercial market of cryptology for many
decades, until the firm was liquidated in 2019. Soon
after, disclosed CIA documents revealed that the CIA and
BND joint-purchased Crypto AG from Boris Hagelin, as
early as 1970, making it the largest ever worldwide
compromise of secure communications for many decades.
The Man and the Firm
Boris Hagelin was born
on July 2nd, 1892 in Adschikent, Russia. His
Swedish father sent him to Sweden, where he
graduated in 1914 as mechanical engineer. His
future was already planned in the Nobel company's
Oilfields, where his father was the manager.
Initially, he specialized in electrical
engineering in order to become supervisor of the
construction of an electric power plant for the
Nobel Company in Baku. After the revolution in
1920 the Nobel family entered into a partnership
with the Standard Oil Company in the US, and
Boris moved to the US to work in their General
engineering Department. After one year he
returned to Sweden.
Nobel asked Boris Hagelin to supervise a small
Swedish company, A.B. Cryptograph, which
manufactured cipher machines, invented by the
Swedish engineer Arvid Damm. In 1925 he took over
management and started developing new machines.
In 1932 A.B Cryptoteknik replaced the liquidated
A.B. Cryptograph. Hagelin promoted his popular
C-35 cipher machine during the Second World War
in the United States. Adapted for the U.S. Army
under the name M-209, this machine became a huge
success and Hagelin made a fortune.
After WWII Hagelin moved to Zug
in neutral Switzerland and established Crypto AG
in 1952. This relocation was required since
Sweden considered Cryptographic equipment as
weapons, and thus prohibited their export. The
pre-war reputation of mechanical "Hagelin
Cryptos" devices and the need for enciphered
telegraph equipment helped the firm to grow and
laid the foundation for a new generation of
electronic cipher equipment. Boris Hagelin died
in 1983 at the age of 91.
Hagelin B-21 and the First
the Swedish General Staff contacted A.B.
Cryptograph to design a machine that would be
superior to the German Enigma. Hagelin developed
a prototype for evaluation called B-21. The B-21
was approved for the Swedish General Staff and
Hagelin also sold the machine to several other
countries. Its principle was based on Arvid
Damm's simplified rotors, a 5 x 5 grid design.
The machine had a keyboard, 2
rotors of which the stepping was controlled by
two pairs of pin-wheels and a display with 25
lamps that presented the output of the
encipherment or decipherment. The machine was
operated on 110 or 220 volt and the lamp panel
was powered by a battery. Depressing a key would
close two contacts, each contact in one of two
groups of five contacts. The signal then passed
through two rotors to the 25 lamps.
Interchangeable leads, in series with the rotors,
could be connected as desired.
This machine was the first to
apply pin-wheels, a feature that was used in many
of its successors. A pin-wheel is a disk with a
number of axial holes in which pins are located.
These pins can be moved either to the left or to
the right side of the disk. On one side, these
pins are inactive, on the other side active. With
each step, the pin-wheel moves one pin position.
Several different pin-wheels with different
numbers of pins without a common factor are used
to obtain a very long key period.
In 1932 the French Army was
interested in the B-21 but asked for two
important modifications. The machine had to be
portable and should be able to print the text.
Hagelin developed the B-211 which could be
operated either with electric power or by hand
with a crank. He replaced the lamp panel with a
type-wheel printing mechanism and the ciphering
circuits were powered by a battery. About 500
B-211 machines were built. In 1940 Hagelin
installed a workshop in Sweden with the profits
of the successful B-211 and A.B. Cryptograph was
renamed in A.B. Ingenieursfirman Cryptoteknik.
Already in 1934 the French Cipher Bureau
asked Hagelin to develop a compact cipher machine
that could also print. Hagelin got the idea to
adapt a calculating mechanism from a money
changer into a small crypto device. The infamous
pin-and-lug machines were born.
The first machine, the C-35,
consisted of a drum with 25 bars, five pin-wheels
(identical to the ones used in the B-21) and an
alphabet-knob/type-wheel with reciprocal alphabet
(type-wheel alphabet reversed to knob alphabet).
By using a reciprocal encryption it was very easy
to switch between enciphering and deciphering.
The text was printed on a small paper ribbon. The
compact device had the size of a small lunch box.
Military personnel could put it in a side pocket
of the uniform.
To encipher a letter the
operator turned the alphabet knob to the desired
letter and turned the handle at the right side of
the machine. The type-wheel, fixed to the
alphabet knob, then turned a number of steps,
depending on the settings of the machine. The
enciphered letter was printed on the paper ribbon
or the operator could read off the reciprocal
alphabet on the knob.
The wheel-pins were set each
day according to a key sheet. Before each
enciphering of a new message, the operator would
set a new start position of the 5 pin-wheels on
the exterior. The movable slide-bars on the drum
contain fixed lugs. When the drum is revolved
with the handle outside the machine, the
different lugs pass 5 cams that are under control
of the pins on the five pin-wheels. If a pin is
active, the cam of that wheel will push a passing
lug to the left. The slide-bar on which that lug
is fixed will also move to the left and comes out
of the drum as a small teeth.
left side of the drum will therefore act as a
gear wheel with a variable number of teeth,
engaging the type wheel. The number of tooth, and
thus the displacement of the type wheel, depends
on the settings of the lugs and pins. The 5
wheels had 17, 19, 21, 23 and 25 pins. Since
these numbers have no common factor the same
wheel setting would only occur once every
3,900,225 steps. On top of this, there were
theoretically 10E29 different possibilities to
set the many pins on the wheels.
An improved version with protective
casing and another lug arrangement, and later on
with movable lugs on the drum, was designated
C-36 and. Its successor, the C-38, had six
pinwheels. The lugs on this machine could slide
on the drum bars in one of 5 active or an
inactive position. This improvement, together
with the larger wheel period, provided a very
large key space. Another version, designated
BC-543, was fitted with a keyboard.
In 1940 Hagelin went to the USA
to promote his C Type machines which resulted in
the largest sale ever of crypto machines. The US
military selected his C-38 as tactical ciphering
device and designated it as M-209. By the end of
the Second World War over 140,000 of these small
M-209 machines were produced in the US. A
simulator of the M-209 can be downloaded on this page.
The C-52 and CX-52
Although the C-36 and C-38 were ideal
for tactical purposes they were insufficient for
the enciphering of high level message traffic
that could resist extensive cryptanalysis. An
improved version would open the door to the
market of high level military and diplomatic
encryption. Hagelin went back to the drawing
table to improve his C Machines.
Several improvements were
introduced in the C-52 model. The rotation of the
pin-wheels became irregular. Whether a wheel
moved or not on a given cycle depended on the pin
positions of the previous wheels. For the 6 wheel
model there was now the choice between 12
pin-wheels, with 25, 26, 29, 31, 34, 37, 38, 41,
42, 43, 46 and 47 pins. The number of slide-bars
was increased to 32. A second type wheel was
added to print both plain and ciphered text at
the same time on a split paper ribbon and it was
possible to set a relative position between the
primary and secondary type wheel. Also, a type
wheel with letters that could be rearranged
became available. The later CX-52 model has 6
pinwheels with 47 pins each and a more flexible
pinwheel advancing system as the C-52, resulting
in a complex and highly irregular wheel movement.
Instead of developing a version
with fixed keyboard like the BC-543 machine, the
C-52 could be fitted with a separate keyboard
attachment, called B-52 which included the
electric motor to drive the drum of the C-52. The
configuration with keyboard was designated BC-52.
The very popular C-52, CX-52 and BC-52 were sold
all over the world. More technical details on the
52 model on this page.
You can download a BC-52 simulator on this page.
The CX-52 RT has a tape reader
to use of one-time tapes. Another development,
based on the 52 series was the PEB machine
designed to make enciphering easier for telex
traffic. This was a combination of an adapted
BC-52 model, called BC-621, connected to the
PEB-61 tape punch and reader.
On demand of the French Gendarmerie, a
small pocket device was developed with the name
CD-55. Two years later, the CD-57 was
manufactured. Input and output consisted of a
ring with an alphabet and a rotatable disk
inside. The alphabet was displaced by pressing a
lever with the thumb. The displacement depended
on the setup of 6 small pin-wheels, similar to
those used in the C Type machines. About 12,000
of these pocket models were sold to different
countries. The CD-57 RT is has an option to use
one-time tapes (random five bit punched tapes).
Hagelin goes On-line
After abandoning the TMX
all-in-one Ciphering Teleprinter prototype,
Hagelin decided in 1948 to develop the Telecrypto
Machine, an on-line crypto device, connected
between a standard teleprinter and the line,
which could encipher and decipher the telex
signals in real-time.
machine was designated T-52 and had 6 fixed pin-wheels
and a drum with 2 x 12 slide-bars, similar to the C-36
model. The T-52 was produced in series between 1953 and
1954. Its successor, the T-55 used 6 interchangeable
pin-wheels and a drum with 22 slide-bars, similar to the
C-52 series. The T-55 had a tape reader that could be
used to perform a superencipherment. This was a
combination of the normal enciphering with a random
one-time-tape. The T-55 was in production until 1956.
Prototypes and rare models
Hagelin did research on various types of
mechanical encryptions and developed several
different prototypes. One special version of the
C Machine was the C-36 with Autokey, which had a
second drum, connected via gears to the
indicating disk. The device never came into
production because of the problems, inherent to
the Autokey system, to recover the message when
an error during transmission occurred.
The TMX-53 was a ciphering
teleprinter but its development was stopped as
Crypto AG could not compete with major
teleprinter firms. Instead, Crypto AG focused on
the Telecrypto Machine which could be connected
to standard teleprinter machines.
An advanced electromechanical
cipher machine was developed and designated
HX-63. The HX-63 had 9 rotors with 41 circuits of
which the surplus wires were looped back on the
outside (somewhat similar to the KL-7 ADONIS).
All circuits could be rearranged and the rotors
performed irregular movements like the C-52
series. All this provided an incredible key space
of 10600. Manufacture of the HX-63 was
abandoned due to the development of fully
electronic cipher machines.
The CBI-53 was a random number
generator with a printer, which used 40 type
wheels and mixing chambers which held 26 steel
balls of which one ball was a bit larger than the
other 25 balls. After mixing, the balls were run
into a tube until the thick ball blocked the
tube. The number of balls in the tube was
measured and determined the rotation of the type
Crypto AG kept playing a leading role in
the development of new crypto systems after the
transition from mechanical and electromechanical
machines to fully electronic crypto equipment. In
the 1970s, they developed the H-460 and H-4605
text encryption machines, the HC-500 CRYPTOMATIC
series with the text encryption machines HC-550,
HC-570, HC-580 and the HC-520 pocket device. In
the 1980s came the HC-5205 Electronic Message
Unit for use with radio and the HC-5700 Message
Digitalization and the Internet
brought new possibilities and challenges in the
early 1990s. Crypto AG developed a range of
network solutions such as the PSTN encrypted
HC-2203 phone, HC-4221 fax encryption, the secure
IP VPN Crypto Mobile Client HC-7835, Crypto
Desktop HC-9300 and HA-2500 encrypted VoIP
They also developed various
fixed and mobile military encryption system.
Encrypted military IP Networks for HF, VHF and
UHF, and secure satellite messaging systems, the
SECOS radio series, MultiCom HC-2650 radio
encryption and HC-2605 Terminal, the Crypto Field
Terminal all-in-one messaging system and much
The renowned Switzerland based crypto
firm, a world leader on commercial crypto equipment
throughout the Cold War, with customers in more than 120
countries, came under suspicion in the 1992 Hans Bühler
case. Iran, one of the many countries using Crypto AG
equipment, became suspicious after some of their secret
communications had leaked. Bühler, a salesman for Crypto
AG, was arrested in Iran, imprisoned and interrogated for
nine months. This was only the tip of the iceberg.
In 2014, declassified NSA documents showed
a close cooperation between Boris Hagelin, founder of
Hagelin Cryptos (later Crypto AG) and his close friend
William Friedman. Friedman, a brilliant U.S.
cryptologist, already had a career from SIS over AFSA to
chief cryptologist for NSA (National Security Agency).
Their 1950's gentlemen's agreement ensured that Boris
Hagelin would sell to "questionable states"
only crypto machines of which the message could be
decrypted by NSA. The Gentlemen's Agreement seemed to
extend into the 1990's, as the Hans Bühler case showed.
This cooperation between Crypto AG and NSA was pretty big
news in the cryptologic world.
Journalists from German television ZDF
and American newspaper The Washington Post uncovered
the last pieces of the puzzle in 2020. The CIA and the
BND (Bundesnachrichtendienst, West-German Federal
Intelligence Service) joint-purchased and took full
control over Crypto AG already in 1970. This enabled the
CIA, in cooperation with NSA, to develop unnoticeable
weakened crypto equipment, sell these worldwide and
eavesdrop on the compromised communications of many
countries for decades. Eventually, this intelligence
coup, called operation RUBICON, reached such proportions
that BND decided to pull out in 1993, making CIA the sole
owner of Crypto AG. The documents revealed that they not
only sold weakened machines to "questionable
states" but also to several NATO allies.
In 2019, just before CIA and BND
ownership and operation RUBICON came to light, Crypto AG
was liquidated and its assets temporarily transferred to
The Crypto Group (TCG), later renamed into TCG Legacy AG.
Two companies independently acquired part of the TCG
assets. CyOne Security AG, lead by three members of the
Crypto AG board, took over the Swiss part and has the
Swiss government as only customer.
Crypto International Group AB from
Sweden took over the international branch and also
acquired the brand name Crypto AG. The owner of Crypto
International stated that they are a completely different
company, until recently unaware of links between Crypto
AG, CIA and BND. He planned to change the company name.
However, with the export license suspended, the new owner
had no other option than to dismiss virtually all
employees in 2020 and the firm moved to Hünenberg. In
July 2021 it was announced that the iconic Crypto AG
building in the Zugerstrasse in Steinhausen would be
demolished to make room for apartments.