M-209
Hagelin
USA
Pin-wheel
C-443 →
BC-38 →
← C-37
Pin-and-lug cipher machine
M-209 was a light-weight portable
pin-and-lug
cipher machine,
developed at the beginning of World War II
by Boris Hagelin
of AB Cryptoteknik
in Stockholm (Sweden), and manufactured
by Smith & Corona in Syracuse (New York, USA).
The machine is designated CSP-1500 by the US Navy and is the
US military variant of the C-38,
which in turn is an improved version
of the C-36
and C-37.
A compatible motorised version – with keyboard – is known as
BC-38
(later: BC-543).
During WWII, the M-209 was known by German cryptanalysts as AM-1
(American Machine #1).
|
The machine measures 178 x 140 x 83 mm – about the size of a lunch box –
and weights 2700 grams. It has six adjustable cipher wheels
with movable lugs, that protrude the top lid.
The wheels, pins and lugs are used to set the initial state of
the machine, also known as the key.
The machine does not require electricity. Text is entered letter-by-letter, by setting the alphabet ring at the left to the desired input letter and turning the black knob at the right by one full revolution. The output letter is then printed on a narrow paper strip by the printer at the left side. |
|
The cryptographic strength of the machine was reasonable for its time, but was not perfect. As of early 1943, it was assumed that German codebreakers were able to break an M-209 message in less than 4 hours. 1 Nevertheless, it was considered sufficiently secure for tactical messages which, due to their nature, would be meaningless after several hours. This is why the M-209 was later also used in the Korean War. The M-209 was succeeded in 1952 by the C-52 and CX-52.
Approx. 140,000 M-209 machines were built. Although Hagelin would generally build his own machines, the M-209 was produced in the US by LC Smith & Co, in Syracuse, New York (USA), under licence 1 from Hagelin [1]. Three different versions of the M-209 are known:
Apart from some manufacturing differences — described in more detail by Nick Gessler [2] — these machines are all compatible. After WWII, Hagelin produced improved versions of the M-209 design, such as the C-443 and C-446, and later the C-52 and the much improved CX-52.
|
The image on the right shows a typical M-209-A machine,
built by LC Smith Corona Typewriters Inc.,
under licence from the US Army.
Acdording to the serial number plate, it was supplied by the Hagelin Cryptograph Company in New Milford, Connecticut (USA). The name Smith Corona is present inside the cover. More pictures of this machine are available below. |
|
|
The M-209B is identical to the M-209A, except for some minor production
differences. In most cases these are simplifications in manufacturing,
described in more detail by
Nick Gessler
[2].
The image on the right shows a typical M-209-B unit in mint condition. It came complete with the original canvas carrying bag, the instruction booklet, all accessories and an empty paper reel. The name of the manufacturer, Smith Corona, is printed on the inside of the cover. |
|
 | ||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The M-209 was usually stowed in the canvas bag shown in the image on the
right
It has several comparments for holding the machine, a pencil,
a message book, spare paper reels and the instruction booklet.
A long canvas strap was supplied to allow the bag to be attached to a soldier's webbing. In addition: a short canvas strap was supplied for fitting the machine to a soldier's knee. |
|
|
The actual M-209 cipher machine was housed in a metal olive drab green
enclosure. It was manufactured by Smith & Corona after the technical
drawing that were provided by Hagelin.
Over the years, small manufacturing changes were made, but these had no effect on the operation or compatibility of the machine. As far as we knowm the machines are designated M-209, M-209A and M-209B. |
|
|
Each machine came with a set of maintenance tools and spares, that were
stowed inside the metal cover. Apart from the paper reel, the cover holds
a pair of tweezers, a screwdriver, an oil tube
(marked 'O') and a tube with
spare ink rollers (marked 'I').
Inside the lid of the oil tube is a needle that can be used to apply oil to the mechanism. If it is empty, use a synthetic motor oil, like 15W40, as a replacement. Never use WD-50. 1 |
|
|
This small message book was used for writing down encrypted or
decrypted messages. It is small enough to be stowed inside one of
the pockets of the canvas carrying bag.
Carbon paper is used to create a duplicate when writing down a message. The duplicate page is thinner than the primary one, so that it can be fitted inside a pigeon capsule more easily. Note that the duplicate pages of the M-210A book are thinner that those of an M-210 book. |
|
|
Once a message was encrypted, it could be handed to a radio operator
for subsequent transmission via
morse code or telegraphy.
Alternatively, the thin duplicate of the message could be folded
down to fit a small capsule that could be attached to the leg of a pigeon.
Note that the duplicate pages of an M-210A book are slightly thinner than those of a standard M-210 book, making them more suitable for transport in a pigeon capsule. |
|
|
During WWII, British pilots took one or two pigeons in the cockpit on each
flight, so that they were able to send an (encrypted) message home after a
crash. The message was then folded and stored in a capsule and attached to the
leg of the pigeon, which was then released.
The carton box shown in the image on the right was used, probably during the Vietnam War, as a cheap and lightweight alternative for a wooden pigeon cage. |
|
|
The M-209 came with a small booklet with operating instructions, that
can be fitted in one of the pockets of the canvas carring bag. The
original TM 11-380 manual was issued in 1942, and provides operating
and maintenance instructions.
A more elaborate version was issued just after WWII, in May 1947. The image on the right shows both versions. ➤ Download 1942 instruction manual |
|
|
The four black steel clips, shown in the image on the right,
were supplied with each machine. They were used to attach a piece of
plaintext to the edge of the metal cover, so that the operator did
not have to hold it in his hand, whilst encrypting.
In practice, only one or two clips were used. The others were supplied as spares. |
|
|
When encrypting (or decrypting) a message, the output letter is printed
onto a narrow paper strip. A suitable paper roll should be installed inside
the cover (behind a metal retainer) and fed into the printer at the left.
Two types of paper were available: regular paper (shown here) and pre-gummed paper. By using a moisturiser, the gummed paper could be glued directly to a message form, in the same way as an old telegram. |
|
|
Two different canvas straps were available for carrying the canvas
storage bag, or for attaching it to a soldier's webbing:
a short one,
that can be used for carrying the bag in the hand,
and a long one,
that allows it to be hung from the shoulder.
In some cases, both straps were provided and attached at the same time, as shown in the image on the right. Furthermore, an adjustable strap could be used to fit the machine on the operator's upper leg, so that it can be operated from within a driving vehicle. |
|
The following stamps and markings may be found on M-209 machines:
SC SCD CACH
In 1935, the US Army was looking for a device
that could replace the aging M-94,
a hand cipher that had been around since
the days of Thomas Jefferson.
The M-94 pocket cipher
was easy to break, and the US Army wanted something more
secure, that was suitable for tactical messages.
For a long time, Boris Hagelin
had been trying to sell his cipher machines to the United States.
He visited the US in 1937 and again in 1939, demonstrating his
C-36
to William (Bill) Friedman,
the cryptographer of the
Signals Intelligence Service (SIS)
of the US Army. Friedman liked Hagelin, but disliked the machine.
Although it was theoretically unbreakable, it could be setup in such a way
that it became weak and readable.
So, Hagelin returned to Sweden to improve the machine.
In April 1940, Germany invaded Norway, whilst the improved machine
wasn't ready yet. Fearing for the future in Sweden, Hagelin persuaded
the Swedish Government to make him an official courier, and left the
country with his wife Annie, trying to make his way to the United States.
On 10 May 1940, following a distressful journey through war-torn Europe,
they finally reached Italy, where they boarded the Conte de Savoia;
the last ship that would sail to the United States.
In his luggage were two dismantled
C-36/C-38 machines
and the engineering drawings. After several days, they safely arrived
in New York, and Hagelin setup an office in Connecticut.
The rest is history. Hagelin finished the design and
sold the rights to the US Government for no less than US$ 8,614,790
using a French banker – James Paulding – and an American Wall Street
broker – Stuart Hedden – as feduciaries. 1 The new machine,
designated M-290,
would become the workhorse of the US Army.
By the end of the war, no less then 140,000 had been built
at Smith & Corona in Syracuse (New York).
It made Hagelin the first crypto millionaire in the world.
He retained a royalty-free reproduction right, and would later sell
a civil variant as the C-38.
➤ Operation RUBICON
In 1942, there was a debate between the US Army cryptologists at Arlington
Hall (Virginia, USA), and the British Government Code & Cipher School
(GC&CS, now: GCHQ) at Bletchley Park (BP)
in the United Kingdom (UK).
The British had been reading Italian Hagelin traffic, and feared that the
Italians would eventually be ably to read American Hagelin traffic.
The Americans chose to ignore it, and kept using the machines. According
to them, the effort to break it was impractically high.
It proved however, that American cryptologist
William Friedman, had been
right all along. He liked the Hagelin machines and had found them
to be theoretically unbreakable, but knew that they could be setup
in such a way that they became weak and vulnerable to cryptanalytic attacks
[8]. British and American codebreakers were able to read the Hagelins
from both enemies and allies.
After the war it became clear that the
Germans were able to read 10% of the American Hagelin traffic: 6%
from cryptanalysis, and 4% from captured keys. But due to the amount of
work involved in breaking, the delay between intercept and decrypt
was usually 7 to 10 days; too long to be usefull for tactical messages
like the ones sent by the US Army.
Apparently, the Japanese also understood many of the principles of Hagelin
exploitation, but hardly broke Hagelin traffic [8].
For high-level messages, the Americans used a rotor machine —
SIGABA — which was similar to Enigma, but
much much more advanced. As far as we know,
SIGABA was never compromised.
Immediately after WWII, in 1947, the NSA started the
development of a cryptanalytic machine
named WARLOCK I
— also known as AFSAF-D79
and CXNK —
that was able to solve the Hagelin C-38/M-209 much faster than
with hand methods.
The machine became operational in 1951 and was used to read the
traffic from many countries that were using M-209 or C-38 machines.
The US had 'accidentally' released large batches of M-209 machines
on the surplus market for as little as US$ 15 and even US$ 2 [8].
Many of these were purchased by South American countries.
In [3], Dennis Richie describes how he collaborated in the 1970s with
Jim Reeds and Bob Morris, on a ciphertext-only attack on the M-209.
It allowed them to solve messages of 2000-2500 characters.
After discussions with the NSA, it was decided not to publish the details
of their investigations at the time, as the principle was applicable to
machines that were still in use.
Note that WARLOCK I could also be used against
similarly operating Hagelin machines, such as the C-38,
BC-38, BC-543, C-443, C-446
and probably also the C-52 (but not the CX-52).
The document below was used as a training manual for Dutch cryptanalists,
probably during the 1970s.
It describes the Hagelin M-209 and the C-446A in great
detail and also discusses the machine's cryptanalysis and methods for its attack.
The document is in Dutch and was released for publication
by the Dutch school for Military Intelligence (DIVI) in 2011 [5].
➤ Download description and cryptanalysis of M-209 (Dutch)
|
An excellent simulator with superb graphics is available from Dirk
Rijmenants in Belgium. It is fully compatible with the real thing and can be
downloaded directly from his website.
It runs on Windows 98/ME/2000/XP/Vista and Windows 7. Under emulation it also runs on Linux (WINE) and Mac (Parallels Desktop). ➤ Download (off-site) |
|
|
A fully operational 3-dimensional M-209 simulator was created in 2024 by
Martin Gillow of Virtual Colossus
fame. There is no need to install anything
on your computer, as it runs entirely in the browser.
Use your mouse to watch the machine from every angle, open the lid, rotate the rotors, select an input letter and rotate the encryption knob. Full instructions are on the website. ➤ Run Virtual M-209 (off-site) |
|
|
A command-line M-209 simulator was made by Mark Blair and can be downloaded here.
It is written in C++ and runs on UNIX and macOS.
The simulator comes with a Key List Generator. ➤ Download (off-site) |
|
Device Purpose Class Manufacturer Country Inventor Period Predecessor Successor Pin-wheels Segments Period Lock Operation Lugs Colour Alphabet Dimensions Weight Quantity
1 1 1 4 2 1 2 2 1
Part of David Stroud Collection. Scanned by Nick Spark.
TM 11-380. 27 April 1942.
US Signals Corps, 3 September 1945.
Descryption and analysis of the Hagelin C-446A and M-209 (Dutch).
Dutch Department of Defence, Military Intelligence School.
Crypto AG. Crypto Hauszeitung Nr. 11. Jubilieumausgabe September 1992.
Details useful in identifying the various models and subtypes.
Date unknown. Updated 5 May 2000. Retrieved November 2011.
Als Deutscher Code-Knacker im Zweiten Weltkrieg.
Klaus Schmeh. 23 September 2004.
Description and analysis of the Hagelin C-446A and M-209 (Dutch).
Dutch Department of Defence, Military Intelligence School.
Retrieved July 2016.
A66684. Declassified by NSA on 11 June 2014 (EO 13526).
➤ More on this subject
Internal CIA publication TOP SECRET, 2005-2008. pp. 8-9.
➤ See: Crypto Museum, Operation RUBICON