☰Series Navigation (13 parts)
Imagine buying the best safe on the market. You research it, you pay a premium, you bolt it to the floor, and you put your most valuable things inside, confident that only you have the combination. Now imagine the company that built the safe was owned, in secret, by the exact people you were hiding those valuables from, and every safe they ever sold came with a hidden way in that only they knew about.
That’s the true story of Crypto AG, and it ran for over fifty years. It’s the pager attack again, decades earlier and without the explosives, and it’s worth studying because it shows how old and how patient this trick really is.
No story in the series is uglier than this one. The customers did their homework, paid for a reputable product from a neutral country, and got sold out by the vendor itself. I understand the intelligence value. I still think selling deliberately broken locks to the world and cashing the checks is a betrayal of every buyer who trusted the label, and I’d say the same about any government that did it.
What did Crypto AG sell, and to whom?
Crypto AG was a Swiss company that made encryption machines, the devices governments used to scramble their diplomatic and military messages so that anyone intercepting them would see only gibberish.
Switzerland’s reputation for neutrality and precision made a Swiss maker especially attractive. If you were a smaller nation that didn’t trust the Americans or the Soviets, a machine from neutral Switzerland felt like the safe choice.
The company was good at its job, and it sold to everyone.
Over the decades, more than 120 countries used Crypto AG equipment: Iran, Egypt, Pakistan, Saudi Arabia, Italy, the military governments of Latin America, and many more. Embassies ran their traffic through these machines. Militaries trusted them with operational orders. For a huge share of the world’s governments outside the two superpowers, Crypto AG was how you kept a secret.
What none of those customers knew is that the company had been compromised from close to the beginning, and not by an outside attacker. Its owners compromised it.
From the buyer’s chair, I can’t think of a worse position to be in. Every precaution a customer could take assumed the vendor was on its side, and nothing in a contract, a test, or an inspection would have told those governments otherwise.
Who really owned Crypto AG?
The answer stayed hidden for decades. A trove of internal intelligence histories reported by the Washington Post and the German broadcaster ZDF confirmed it in 2020: the American CIA and the West German intelligence service, the BND, secretly owned and ran Crypto AG. The operation went by several code names over the years. The BND called it Rubicon. The CIA called it Minerva. Earlier it was Thesaurus.
The arrangement traces back to a quiet deal in the late 1940s between the company’s founder, a Swedish businessman named Boris Hagelin, and American intelligence. Hagelin agreed to build hidden weaknesses into his machines, weaknesses invisible to anyone who didn’t know to look, that American code-breakers could exploit and his foreign customers could not.
By 1970 the CIA and BND had moved from that informal understanding to outright ownership, buying the company through a web of shell corporations so nothing pointed back to Washington or Bonn.
The company was, in every legal sense that mattered, a front. Its engineers designed real machines, its salespeople made real sales, and its customers received real products. The only thing wrong with any of it was that the encryption had been deliberately weakened in ways only the owners could exploit.
The details of the split read like fiction. The two agencies divided the company’s profits each year, and by one account the BND handled the accounting and delivered the CIA’s share as cash in an underground parking garage.
The Americans and Germans argued, the way partners do, over money and over how many allies it was acceptable to spy on. The Germans were reportedly uneasy about how freely the Americans read the traffic of NATO members like Spain, Greece, Turkey, and Italy. In 1993 the CIA bought out the German stake for around $17 million and ran the operation alone into the 2000s.
What strikes me is how ordinary the fights were. The two agencies argued about money and about how many allies it was acceptable to read, the way business partners argue about margins. Once a betrayal is making that much money, the people running it stop seeing the customers as people, and I think that’s the most dangerous thing any vendor relationship can turn into.
How did the rigged machines work?
The genius of the operation, and the reason it lasted so long, is that the agencies didn’t have to break the encryption. They owned it. They controlled the design. Think about the difference. Breaking a code is hard, expensive work that you have to redo every time the target changes the code. But if you build the lock, you can put a master key mechanism in the blueprints, invisible to anyone who doesn’t know it’s there.
The Crypto AG machines were built with exactly that: weaknesses engineered into the encryption algorithms, subtle enough that a customer inspecting the machine or the math would see a strong, working cipher. To the buyer, the messages were secure. To the CIA and BND, who knew where the hidden weakness was, the same messages fell open.
The payoff was staggering. At its height, intelligence from Crypto AG machines made up a large share of what American and German code-breakers produced.
By some internal accounting, the compromised devices accounted for roughly 40 percent of the NSA’s machine-derived decryption at one point, and for the BND they supplied around 90 percent of its diplomatic intelligence reporting. One rigged company was carrying a huge fraction of two nations’ entire foreign intelligence take.
The agencies read Iran’s traffic during the 1979 hostage crisis. Country after country conducted its most sensitive business believing it was speaking in private, into a device that was carrying every word to Washington and Bonn.
And there was a telling moment that shows how carefully the owners guarded the secret.
At one point an engineer at the company, not fully in on the operation, improved the algorithms and produced a batch of machines with strong encryption. The owners had to secretly buy back and destroy those machines, because they couldn’t allow properly secure devices to reach the market. They never allowed the product to be as good as it looked.
That detail disturbs me. An engineer did the job properly and built machines that would have protected the people who bought them, and the owners had those machines bought back and destroyed so no customer could keep one.
What did the spying make possible?
It’s easy to read a story like this as a clever caper, spies outwitting other spies, no real victims. The record is darker than that. Among the countries running their traffic through rigged Crypto AG machines were the military governments of Latin America during the years of Operation Condor, a coordinated campaign of repression, disappearance, and killing carried out by regimes in Chile, Argentina, Uruguay, and their neighbors. Declassified records show the United States was reading those governments’ communications as they conducted that campaign.
What Washington knew, when it knew it, and what it did or failed to do with the knowledge is a heavy question historians are still working through. I raise it only to make one point clear: this was never a victimless game. Real people lived and died inside the traffic those machines were carrying.
That’s worth holding onto when the supply chain attacks later in this series arrive wearing the bloodless language of software. A poisoned update or a backdoored device gets described in terms of records accessed and systems compromised, but those systems run real hospitals, real power, and real lives. I get impatient with incident reports that never mention a human being, because Crypto AG shows how far down a compromised supplier reaches: all the way to the people the traffic is about.
Why does a Cold War spy operation belong in this series?
Because it’s the clearest, longest-running proof of the single idea I built this whole series on: when your adversary controls the thing you trust to protect you, no amount of care with that thing can save you.
Every Crypto AG customer did the responsible thing. They recognized that their communications needed protection, and they went out and bought protection from a reputable, neutral supplier. That’s exactly the instinct that led Iran to air-gap Natanz and led Hezbollah to switch to pagers. And it failed for exactly the same reason. The defense was sound against the threat they imagined, an outsider intercepting scrambled messages, and useless against the threat they never considered, that the supplier itself was the adversary.
I keep coming back to a hard truth from thirty-three years around these systems. You can inspect a product all you like, and inspection only tells you whether the product does what it claims. It can’t tell you who else the product answers to.
A Crypto AG machine encrypted your messages exactly as advertised. It also decrypted them for someone else, and nothing a customer could examine would reveal that second job. The betrayal lived in the design, placed there by the people you paid, and the people you paid were the last people you would think to suspect.
The modern versions of this are all around us, and they don’t require a front company. They require a supplier who can be pressured, a piece of software with a hidden function, a device that phones home to somewhere you didn’t authorize. Crypto AG is the ancestor of every one of them. Any organization that still picks its security vendors on reputation and price alone, without asking who owns them and who they answer to, is repeating the mistake more than 120 governments made, and it has far less excuse.
The next article goes back to a USB drive in a parking lot and the breach that created the U.S. military’s cyber force. For the wider view, the cybersecurity hub collects the rest of my work on this.
