Hidden History: The Cipher Machine That Turned Switzerland Into a Listening Post
For decades, governments bought encryption machines from Crypto AG, a company based in Zug, Switzerland. The devices promised secure diplomatic communication. The secret was that the company was covertly controlled by the CIA and West Germany’s intelligence service, the BND, in an operation later known as Rubicon.
This is not a spy novel. Declassified records and a Swiss parliamentary investigation document the operation. The startling part is that a trusted Swiss manufacturer became a route through which other governments’ messages flowed.
Story six in Hidden History. The account distinguishes confirmed findings from claims that overstate the operation’s reach.
A company with two kinds of customer
Crypto AG grew from the work of engineer Boris Hagelin, whose cipher machines were used by governments around the world. In 1970, the CIA and BND secretly acquired the company. Under Rubicon, they could influence the design and sale of encryption equipment to foreign customers. Weaknesses in some devices made messages easier for the intelligence partners to decode.
The value came from ordinary traffic: diplomatic cables, military communications and reports sent by governments that believed their messages were protected. A machine did not need to expose every message from every state to be useful. It needed to give intelligence agencies a window into selected communications when it mattered.
In 2020, Switzerland’s parliamentary oversight delegation published an inspection report. It found that Swiss intelligence had known about the foreign intelligence operation for years and had itself benefited from information gathered through the machines. The report also examined how senior officials were informed and whether they assessed the political and legal risks.
What Rubicon does not prove
Early coverage suggested that the devices enabled surveillance of more than a hundred countries. The affected customers and success rate varied by machine, version and period. The Swiss report documents institutional knowledge and oversight, while also identifying gaps in the evidence. A careful account should not turn the entire world into one undifferentiated target list.
Trust was the real technology
Rubicon depended on a reputation for neutrality and precision. Buyers did not have to be careless to be deceived; the supplier was considered dependable. That makes this story larger than encryption. Security is also a relationship between a maker, a customer and the institutions that certify trust.
The Swiss report raised another question: what should a government do when its intelligence service knows about a foreign operation inside a domestic company The answer touches oversight, export controls and the risk to employees whose work may have been connected to an operation they did not understand.
A final thought
Crypto AG’s machines looked like small metal boxes with turning wheels. Their most important feature was invisible. For years, the gap between what customers believed and what their supplier knew became a global intelligence system.
Secrets do not always hide in locked rooms. Sometimes they travel through a product trusted by everyone who uses it.
Sources and image credits
- Swiss Parliament: Crypto AG inspection and report
- Swiss National Museum: the CX-52 cipher machine
- BBC: the Crypto AG intelligence operation
Images: CX-52 machine via the Swiss National Museum; machine internals via BBC. Rights remain with the respective publishers and photographers.
Have a project behind the idea?
I work on websites, branding and film. If you need help turning your next idea into something people can see and use, tell me what you have in mind.
What did you think?
A thought, a different perspective, a little appreciation. You’re welcome here.
.png){kind=icon}
