For half a century, the governments of more than a hundred countries paid for the certainty that their secrets were securely locked away. The lock was Swiss, the reputation impeccable, and the key was in the pocket of the very people they were locking it away from.
This story has a specific face, and it belongs to a man with a biography that seems written for a spy novel nobody would buy because there are simply too many coincidences. Boris Hagelin was born in the Russian Empire—his father worked at the Nobel oil fields in Baku—grew up and studied in Sweden, built cipher machines for the Allies during World War II, and then moved his business to quiet Zug, Switzerland—a city where banking secrecy hangs in the air. In 1952, he founded Crypto AG, and the company quickly became synonymous with neutral, independent cryptography. Switzerland belonged neither to NATO nor to the Warsaw Pact. Who could be more trustworthy?
Hagelin was no innocent. His early machines—the mechanical M-209 and CX-52 cipher devices—had already been supplied to the U.S. Army during the war. His connection to American intelligence existed long before it took formal shape. The key figure on the other end of the line was William Friedman, the legendary cryptanalyst often called the father of American cryptology. What developed between Hagelin and Friedman was something the documents delicately describe as a “gentleman’s agreement”: Hagelin pledged not to sell his strongest machines to certain countries, and in return gained access to the American market and discreet protection. It was not a contract—more a handshake between two men who understood each other without needing many words.
The handshake grew into something more tangible. On November 10, 1960, a licensing agreement codenamed SPARTAN was signed. Its terms were entirely material: a one-time payment of $600,000 and annual payments of $75,000. In exchange, Hagelin agreed to coordinate his machines’ cryptographic parameters with U.S. intelligence—the agreement was signed by the CIA: AFSA, the NSA’s predecessor, had been disbanded eight years earlier, while the NSA itself refused to put its name on it. In essence, Crypto AG still formally remained a private Swiss firm, but its products were already passing through a filter installed at Fort Meade. Put bluntly, its neutrality was real—just with qualifications known to three people.
By the end of the sixties, the gentleman’s agreement no longer suited either side. Hagelin was aging, and the question of succession arose: who would control the company after him? A new owner might prove less accommodating. The Americans wanted more—not merely a say in the parameters, but complete control over the cryptographic core of the devices. The solution was elegant in its audacity: buy the entire company, but in such a way that no one would ever know.
On June 4, 1970, the deal was done. The CIA and West Germany’s BND acquired Crypto AG for 25 million Swiss francs—nearly six million dollars at the exchange rate of the time. The money moved through a chain of front entities whose names sound like characters in a bureaucratic thriller: AEH, Anstalt Domar, DTU, BVV, Blanko Zession. Every link existed for precisely one reason: to ensure the next could not be connected to the one before it. Liechtenstein Anstalten, German intermediary firms, Swiss trust structures—it was all arranged so that even a meticulous auditor would run into a wall of legal entities, behind which stood other legal entities, and behind them—silence.
Inside the intelligence agencies, the project was given the codename THESAURUS. Later, in 1987, it was renamed RUBICON—and that second name would prove prophetic: the Rubicon really had been crossed. The company itself was referred to in secret documents as MINERVA. Formally, Crypto AG continued operating as a Swiss firm with an impeccable reputation, paying taxes in the canton of Zug and sending its engineers to international trade fairs. Its director until 1975 was Sture Nyberg, succeeded by Heinz Wagner, who ran the company in full awareness of who was actually signing the checks.
An external advisory board—the Beirat—also served as cover, with representatives from Siemens among its members. The German technology giant provided not so much technical expertise, though that too, as a facade of respectability: if Siemens stood beside Crypto AG, then it was serious business, solid in the German way.
This is where the story enters territory that requires caution. The temptation to write “the CIA read everything” is great, but inaccurate. Reality was more complicated and, on reflection, more sophisticated than simple total control.
Crypto AG produced several lines of devices. Early models—mechanical ones such as the upgraded CX-52M—operated on principles that by the seventies were no longer considered impregnable. The shift to electronics opened up new possibilities. The H-460 became one of the first electronic models. It was followed by the HC-570, built around the Motorola 6800 microprocessor, then the HC-520, developed with Siemens’ participation, the HC-740, and others. Every new generation of devices meant a new round of negotiations among Crypto AG engineers, NSA cryptographers, and specialists from the German cipher office ZfCh (Zentralstelle für das Chiffrierwesen).
The point of the manipulation was not to make the encryption “cardboard”—that would have been too obvious. Algorithms with hidden vulnerabilities were designed so that, for an outside cryptanalyst without knowledge of the specific parameters, breaking them would remain a computationally difficult task; but for someone who knew the structure of the weakness, the search space shrank by orders of magnitude. It is like a lock that appears to have ten pins but in fact has three decorative ones, and whoever knows this chooses a key from a thousand possibilities rather than a million. I confess, I am fascinated by this engineering double-dealing: creating a product that passes external audit, looks sound to a professional—and yet contains a path visible only to its architect.
But—and this is crucial—not every device and not every client received equally weakened protection. Declassified materials and journalistic investigations indicate that the intelligence services could influence the cryptographic parameters of a number of devices sold to selected clients. The logic was targeted: countries of greatest intelligence interest received equipment with deeper vulnerabilities. NATO allies buying Crypto AG equipment for less sensitive channels might receive versions with different parameters. To claim that absolutely all correspondence from all clients was being read in real time is to present speculation as fact.
Among Crypto AG’s employees were people who began noticing strange things. Peter Frutiger, an engineer at the company, discovered problems in equipment supplied to Syria and—an act that cost him his career—tried to fix them. In 1977, Frutiger was fired. The official reason surely sounded neutral, but the real one was simple: he was repairing what had been broken by design. Frutiger became one of the first victims of the operation’s internal contradiction—the company hired talented engineers who, by definition, might spot the trick.
Another key figure was Mengia Caflisch, an engineer whose role in the Crypto AG story was tied to the development of algorithms. And at the turn of the seventies and eighties, Swedish mathematician Kjell-Ove Widman was drawn into the operation’s orbit: the CIA gave him the cryptonym ATHENA, while his colleagues at the firm simply called him “Henry”—no one could pronounce his surname. Widman was recruited as a scientific adviser and became the link between the NSA and Crypto AG’s engineering department. His task was to ensure that cryptographic solutions arriving from Fort Meade were seamlessly woven into the Swiss firm’s products—without traces, without seams, without suspicion.
The scale of the operation was defined by its sales geography. Crypto AG equipment was purchased by dozens of states across Latin America, the Middle East, Africa, Asia, and even some European countries. Its client base encompassed more than a hundred governments. Meanwhile, the USSR and China—the main adversaries of the Cold War—relied on their own cryptographic developments and did not buy Crypto AG equipment. This created a paradoxical situation: Operation RUBICON offered enormous advantages in dealings with the “Third World,” allies of both blocs, and neutral countries, but did not provide direct access to the communications of the principal adversary.
Several interception episodes are confirmed by documents or multiple independent sources, and each is a separate chapter in a textbook of intelligence ethics that no one will ever write.
Camp David, 1978. During the negotiations between Egypt and Israel, the American side, according to available information, was able to monitor Egyptian President Anwar Sadat’s communications with Cairo. Imagine it: the mediator at the negotiating table knows what instructions one side is receiving. An advantage impossible to overstate and impossible to detect—as long as it works.
The Iranian hostage crisis, 1979. After the seizure of the U.S. embassy in Tehran, the interception of Iranian diplomatic communications through Crypto AG equipment, according to available accounts, gave Washington an additional window into what was happening. The irony was that Iranian authorities who had seized the embassy as a sign of distrust toward America continued communicating through equipment that belonged to that very America.
The Falklands War, 1982. Here the operation’s geography revealed itself in full: Argentina used Crypto AG equipment, and U.S. intelligence, according to investigations, passed intercepted data to Britain. Allied solidarity multiplied by a cryptographic backdoor—a combination that could influence the course of combat operations in the South Atlantic.
Operation Condor—the coordination of South American dictatorships in persecuting political opponents—relied, among other things, on the Condortel communications network, which used encryption equipment. The question of the extent to which U.S. intelligence monitored those communications, and how it used the information obtained, remains one of the most painful aspects of the whole story.
Berlin, 1986. After the bombing of the La Belle nightclub, among whose dead were American servicemen and a Turkish woman, intercepted Libyan diplomatic messages allowed the Reagan administration to place responsibility on Libya and justify retaliatory airstrikes. The decrypted dispatches became, in effect, public evidence—though the source of the decryptions was, naturally, never disclosed.
Each of these episodes is documented in varying degrees of detail. But extrapolating them to Crypto AG’s entire client base would be a mistake. The transition from electromechanical machines to digital cryptography changed the nature of possible vulnerabilities. Early mechanical devices could be analyzed through the study of physical characteristics—the length of the cycle, the structure of the rotors. Electronic systems made it possible to embed subtler mathematical weaknesses, but also made them potentially easier for a competent outside cryptographer to detect—given access to the hardware and algorithms. The operation balanced on a knife-edge: the vulnerability had to be deep enough to exploit, yet hidden enough that none of the hundreds of engineers servicing the equipment in dozens of countries would find it.
Every joint venture carries the seeds of discord, and a secret joint venture between two intelligence services is no exception. By the early nineties, the BND found itself in an increasingly uncomfortable position. German reunification in 1990 changed the political landscape: Crypto AG’s former clients in Eastern Europe were now potential allies rather than surveillance targets. The risks of exposure were growing. Scandals were already beginning to leak—in 1992, Crypto AG salesman Hans Bühler was detained in Iran and spent nine and a half months in an Iranian prison before the BND posted his million-dollar bail, splitting the cost with the CIA. Bühler apparently knew nothing about the double nature of his employer, but his arrest triggered a chain reaction of suspicions.
In 1993, the BND decided to leave the project and sold its share to the CIA: in December, an advance payment of twelve million dollars arrived, and the final settlement—around seventeen million—was completed in the summer of 1994. The Germans took their profit and distanced themselves from an operation that, by their calculations, was bound to become public sooner or later. Their calculation was correct—the only question was when.
The CIA, now sole owner, continued exploiting MINERVA for another quarter-century. What strikes me is the patience: in 1995, the Baltimore Sun published an article laying out suspicions of Crypto AG’s ties to American intelligence for the first time. The publication caused a stir but did not lead to a final exposure. The company denied everything, Swiss authorities showed no excessive zeal in investigating, and the operation continued. Twenty-three years after the first newspaper article. Twenty-five years after the German partners withdrew. The inertia of secrecy proved stronger than journalistic curiosity—up to a point.
The CIA owned Crypto AG until 2018, when the company’s assets were finally sold off: its product portfolio went to Swedish entrepreneur Andreas Linde and his Crypto International, while the Swiss division was bought out by management and continued under the name CyOne Security. The Swiss company with a half-century history quietly ceased to exist in its former form—without press conferences, without ceremonial farewells.
The full exposure came in February 2020, when The Washington Post, German broadcaster ZDF, and Swiss broadcaster SRF published the results of a joint investigation based on declassified internal CIA documents. These documents—the history of the operation written by its participants for internal use—contained such a level of detail that no room for denial remained. Codenames, sums, names, mechanisms—everything was laid out with the bureaucratic thoroughness of people accustomed to documenting their achievements.
The Swiss government commissioned an independent investigation and then—in a manner characteristic of Swiss politics—ran into a question it did not want to answer: did Swiss intelligence know? Were they accomplices or fools? Both options are reputationally devastating for a country whose brand is neutrality and reliability. The investigation by former federal judge Nils Melzer—though that is a separate and unfinished chapter—showed that there are no simple answers here.
The reaction of client countries was predictably varied: from official silence to diplomatic notes. But the main damage was done not to individual states, but to the very principle on which the international market for cryptographic equipment is built.
Cryptography is a discipline in which trust plays a structural role. You may mathematically prove an algorithm’s strength, but you cannot mathematically prove that the manufacturer implemented that exact algorithm rather than a weakened version of it. Between specification and implementation lies an abyss filled only by trust in the manufacturer. Crypto AG turned that abyss into an operational space.
The Cold War paradox with which we began, upon closer inspection, turns out not to be a paradox at all but a pattern. Governments bought Swiss cipher machines not because they tested their cryptographic strength down to the last bit—most buyers simply lacked the expertise. They bought a reputation. The Swiss flag on a device’s casing was the chief cryptographic argument. And that argument was compromised—not from outside but from within, not by mathematics but by corporate law and shell companies in Liechtenstein.
What remains after RUBICON? A precedent that cannot be undone. Every manufacturer of encryption equipment now exists under the shadow of the question: “Is this another Crypto AG?” Open source, independent auditing, formal verification—all these are tools that emerged in part as a response to a story that unfolded for half a century in the silence of Swiss Zug. But none of these tools resolves the problem once and for all, because the problem is not technical. It is that between the lock and the person who locks it, there is always the person who made it. And Operation RUBICON demonstrated that this third person can wear someone else’s face for decades—and not one of more than a hundred clients will suspect the substitution until the archives open on their own.