Crypto AG

» see crypto.ch as it lived, on the wayback machine

~ the last words ~

Boris Hagelin built cipher machines for the Allies during the war and moved his company to Switzerland in 1952, which was the sensible place to sell secrets-keeping equipment to everybody at once. Swiss neutrality was the product as much as the mechanism was. A government that did not want American hardware and did not want Soviet hardware could buy Swiss, and for sixty-six years Crypto AG was what Swiss looked like in a cipher room.

In June 1970 the CIA and the West German BND bought the company outright for 5.75 million dollars through a Liechtenstein front. The CIA called the arrangement Thesaurus and later Minerva; in the German files it was Rubikon. The BND held its half until roughly 1993 and then sold out. The CIA kept going alone until 2018. Across that half-century the agencies chose which customers got machines that worked and which got machines that could be read, and the engineering staff in Zug mostly did not know which was which.

The company was wound up in 2018. The Swiss domestic business was carved off as CyOne Security, while the brand and everything attached to it abroad went to a Swedish businessman, Andreas Linde, under the name Crypto International. On 11 February 2020 the Washington Post and Swiss broadcaster SRF published what the arrangement had been, working from the agencies' own internal histories. By then there was no Crypto AG left to answer questions.

~ the record ~

~ who the customers were ~

More than 120 governments bought this equipment. Iran was a customer for decades, as were India and Pakistan, much of Latin America and Africa, and the Vatican. A handful of NATO members in southern Europe were on the list too, buying from an ally without knowing it. Argentine traffic during the Falklands reached London through this route, Egyptian traffic during Camp David reached Washington, and the 1986 Berlin disco bombing was pinned on Libya partly because Libyan cables could be read at leisure.

Nobody reading this ever owned one. That is the honest distance on this grave: the whole customer base was foreign ministries and defense staffs, the units cost what a car costs, and the brand never existed in a shop. I know Crypto AG the way anyone outside a cipher room knows it, which is from the February 2020 reporting and from what has been declassified since. What makes it a grave worth writing is not the spycraft. It is that the trust was the product, sold by the unit, for sixty-six years.

~ how it came apart ~

The leaks started long before 2020. In March 1992 Iran arrested Hans Buehler, the company's top international salesman, and held him for nine months on the accusation that Crypto AG machines leaked. Buehler genuinely did not know; he had been selling in good faith. Crypto AG paid a million dollars in bail to get him out in January 1993, then fired him and demanded the money back, at which point he started talking publicly and a Swiss press cycle began that never fully closed.

Researchers kept finding the seams. The algorithms in certain export models had structures that made no sense as engineering and perfect sense as a channel. None of it could be proven from outside, so it stayed in the category of things cryptographers said at conferences and journalists could not print. The proof, when it came, came from the CIA's own classified account of the operation rather than from the machines.

~ what stayed buried with it ~

The Swiss parliament ran an inquiry and concluded in November 2020 that Swiss intelligence had known since at least 1993 and said nothing, including to the government. Crypto International, which bought the name, has spent the years since insisting it is a different company with different owners, which is true and which has not helped it much. CyOne told Swiss customers the same thing.

What actually died in 2018 is a business model. The idea that a small neutral country could sell you the lock, hold no key, and be believed about it, worked for a very long time and cannot be sold again. Every government that got burned went and built its own crypto or bought from a patron it already trusted. The machines themselves sit in museum cases now, beautiful mechanical things, working exactly as the brochure promised and exactly as the owners intended.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »