The Codebreakers

The need to revise this book existed even before it was published on September 27, 1967. I had written what I hoped would be the definitive history of the subject. I did not know at the time of such great matters as the Polish-British-American mastery of the German Enigma cipher machine, which had such great effects on World War II, or of such lesser ones as the tactical value of German front-line telephone taps. Nor did I—or anyone—know of things that had not yet been invented, such as public-key cryptography. The first glimmering that the world of cryptology would not stand still for me came four months after publication, when North Korea seized the U.S. electronic reconnaissance ship Pueblo in January 1968. It marked the first of a series of events that showed the need for revision. I had, indeed, made some minor corrections in printings three through seven, but then I concentrated on other projects.

There followed, however, the Ultra disclosures, the creation of public-key cryptography, and the enormous growth in computer communications, including particularly the appearance of the Internet, where cryptography affords the best means for privacy. At about the same time, the absorption of Macmillan, the original publisher, by Simon & Schuster brought a young, energetic editor named Scott Moyers to handle The Codebreakers. He saw that I could fulfill my obligation to cryptology and at the same time help the book sell better by incorporating the new material as a single chapter. This made sense, and that is what I’ve done.

I have sought to cover the major events, both external and internal, that have affected cryptology in the past quarter century. It is amazing how much these have changed the field. Fortunately for me, while they have added information, they do not change the past, so the first edition remains valid. I hope that this new edition will prove as useful—and perhaps as pleasurable—to readers as the previous one.

DAVID KAHN

Great Neck, New York

May 1996

Preface

CODEBREAKING is the most important form of secret intelligence in the world today. It produces much more and much more trustworthy information than spies, and this intelligence exerts great influence upon the policies of governments. Yet it has never had a chronicler.

It badly needs one. It has been estimated that cryptanalysis saved a year of war in the Pacific, yet the histories give it but passing mention. Churchill’s great history of World War II has been cleaned of every single reference to Allied communications intelligence except one (and that based on the American Pearl Harbor investigation), although Britain thought it vital enough to assign 30,000 people to the work. The intelligence history of World War II has never been written. All this gives a distorted view of why things happened. Furthermore, cryptology itself can benefit, like other spheres of human endeavor, from knowing its major trends, its great men, its errors made and lessons learned.

I have tried in this book to write a serious history of cryptology. It is primarily a report to the public on the important role that cryptology has played, but it may also orient cryptology with regard to its past and alert historians to the sub rosa influence of cryptanalysis. The book seeks to cover the entire history of cryptology. My goal has been twofold: to narrate the development of the various methods of making and breaking codes and ciphers, and to tell how these methods have affected men.

When I began this book, I, like other well-informed amateurs, knew about all that had been published on the history of cryptology in books on the subject. How little we really knew! Neither we nor any professionals realized that many valuable articles lurked in scholarly journals, or had induced any cryptanalysts to tell their stories for publication, or had tapped the vast treasuries of documentary material, or had tried to take a long view and ask some questions that now appear basic. I believe it to be true that, from the point of view of the material previously published in books on cryptology, what is new in this book is 85 to 90 per cent.

Yet it is not exhaustive. A foolish secrecy still clothes much of World War II cryptology—though I believe the outlines of the achievements are known—and to tell just that story in full would require a book the size of this. Even in, say, the 18th century, the unexplored manuscript material is very great.

Nor is this a textbook. I have explained at length only two basic methods of solution, though I have sketched many others. For some readers even this will be too much; them I advise to skip this material. They will not have a full understanding of what is going on, but that will not cripple their comprehension of the stories. For readers who want more detail on these methods, I recommend Helen F. Gaines’s Elementary Cryptanalysis, partly because it is a competent work, partly because it is the only work of its kind in English now easily available (in a paperback reprint, entitled Cryptanalysis). In French, there is Luigi Sacco’s outstanding Manuel de cryptographie (the Italian original is out of print). Nearly all the other books in print are juveniles. Readers interested in cryptanalysis may also join the American Cryptogram Association, which publishes a magazine with articles on how to solve ciphers and with cryptograms for solution.

In my writing, I have tried to adhere to two principles. One was to use primary sources as much as possible. Often it could not be done any other way, since nothing had been published on a particular matter. The other principle was to try to make certain that I did not give cryptology sole and total credit for winning a battle or making possible a diplomatic coup or whatever happened if, as was usual, other factors played a role. Narratives which make it appear as if every event in history turned upon the subject under discussion are not history but journalism. They are especially prevalent in spy stories, and cryptology is not immune. The only other book-length attempt to survey the history of cryptology, the late Fletcher Pratt’s Secret and Urgent, published in 1939, suffers from a severe case of this special pleading. Pratt writes thrillingly—perhaps for that very reason—but his failure to consider the other factors, together with his errors and omissions, his false generalizations based on no evidence, and his unfortunate predilection for inventing facts vitiate his work as any kind of a history. (Finding this out was disillusioning, for it was this book, borrowed from the Great Neck Library, that interested me in cryptology.) I think that although trying to balance the story with the other factors may detract a little from the immediate thrill, it charges it with authenticity and hence makes for long-lasting interest: for this is how things really happened.

In the same vein, I have not made up any conversations, and my speculations about things not a matter of record have been marked as such in the notes. I have documented all important facts, except that in a few cases I have had to respect the wishes of my sources for anonymity.

The manuscript was submitted to the Department of Defense on March 4, 1966.

It is impossible to adequately thank all those who have helped me with this book, giving generously of their time and talents. But perhaps I can at least indicate the size of my debts and publicly express my gratitude to those who have helped.

Foremost is Bradford Hardie, M.D., of El Paso, Texas, who translated a veritable stream of documents in German and read the galleys. His constant warm encouragement was like manna. My good friend Edward S. (Buddy) Miller of Malverne, New York, read many of the early chapters in manuscript and made extremely penetrating and valuable observations on them. Howard T. Oakley of Scotch Plains, New Jersey, and Kaljo Käärik, Ph.D., of Enskede, Sweden, read chapters, provided information, and exchanged views.

Many cryptologists or relatives of cryptologists took the time to talk with me or reply to my queries. I have acknowledged these debts in my notes, but I must pay special tribute to former Ambassador J. Rives Childs, who replied in detail to numerous questions and lent me his entire set of papers from his work in World War I; to Admiral Sir William James, who read the chapter on Room 40 and ransacked his voluminous memory for answers to many queries; to the late Yves Gyldén, who spent four days with me in Sweden; to Naotsune Watanabe and to Shiro Takagi, who wrote detailed reports of their World War II cryptanalytic experiences; to Dr. Hans Rohrbach, who set up some important appointments for me by long-distance telephone; to Harold R. Shaw, who wrote a 27-page reminiscence of his wartime work; to the Boris Hagelins, senior and junior, for hospitality and information; to Mrs. Malcolm Hay of Seaton, for information and photographs; to Parker Hitt, for an important memorandum and for the gift of his invaluable cipher papers; and to Mr. and Mrs. William F. Friedman for numerous kindnesses, though they steadfastly refused to discuss his government work, and for a gift made in 1947, upon my graduation from high school, that was a major step in my cryptologic education.

Many scholars very kindly replied to my queries about cryptology in their fields, and I have also acknowledged these in my notes. But especially generous were T. C. H. Raper of the India Office Library, London, who did a great deal of research on my behalf; C. E. Bosworth of St. Andrews University, Scotland, who furnished important background material in addition to a critical article; and Robert Wolfe, Philip Brower, and W. Neil Franklin of the National Archives, Washington, who replied with courtesy and dispatch to volleys of requests. Without the incredible resources of the New York Public Library and the courteous help of its staff in making them available, this book in its present form would not exist. A great deal of credit is due Mrs. Suzanne Oppenheimer, who typed the bulk of the book from execrable copy, and to Mrs. Harriet Simons, who typed the other chapters. Jenny Hauck made the photographic layouts. Geoffrey C. Jones of Lee-on-the-Solent, England, compiled the index, with some technical assistance by me.

The design department of The Macmillan Company and the Alden Press of Oxford, England, have overcome the many production problems to produce a very handsome book.

In a larger sense, I owe a great deal to former colleagues on Newsday, especially to Al Marlens, my former city editor, who taught me most of what I know about reporting and writing, and also to Bernie Bookbinder, who demonstrated that concern for the human must always be paramount; to Stan Isaacs, who showed how a subject can transcend itself; and to Stan Brooks, whose “Keep it light and bright!” galled me at the time but has since delivered me—I hope—from solemnity.

The errors are, of course, mine. If any reader cares to tell me of any corrections or additions, including personal reminiscences, I shall be very grateful to him.

DAVID KAHN

Windsor Gate

Great Neck, New York

Paris

A Few Words

EVERY TRADE has its vocabulary. That of cryptology is simple, but even so a familiarity with its terms facilitates understanding. A glossary may also serve as a handy reference. The definitions in this one are informal and ostensive. Exceptions are ignored and the host of minor terms are not defined—the text covers these when they come up.

The plaintext is the message that will be put into secret form. Usually the plaintext is in the native tongue of the communicators. The message may be hidden in two basic ways. The methods of steganography conceal the very existence of the message. Among them are invisible inks and microdots and arrangements in which, for example, the first letter of each word in an apparently innocuous text spells out the real message. (When steganography is applied to electrical communications, such as a method that transmits a long radio message in a single short spurt, it is called transmission security.) The methods of cryptography, on the other hand, do not conceal the presence of a secret message but render it unintelligible to outsiders by various transformations of the plaintext.

Two basic transformations exist. In transposition, the letters of the plaintext are jumbled; their normal order is disarranged. To shuffle secret into ETCRSE is a transposition. In substitution, the letters of the plaintext are replaced by other letters, or by numbers or symbols. Thus secret might become 19 5 3 18 5 20, or XIWOXV in a more complicated system. In transposition, the letters retain their identities—the two e’s of secret are still present in ETCRSE—but they lose their positions, while in substitution the letters retain their positions but lose their identities. Transposition and substitution may be combined.

Substitution systems are much more diverse and important than transposition systems. They rest on the concept of the cipher alphabet. This is the list of equivalents used to transform the plaintext into the secret form. A sample cipher alphabet might be:

This graphically indicates that the letters of the plaintext are to be replaced by the cipher letters beneath them, and vice versa. Thus, enemy would become CHCME, and SWC would reduce to foe. A set of such correspondences is still called a “cipher alphabet” if the plaintext letters are in mixed order, or even if they are missing, because cipher letters always imply plaintext letters.

Sometimes such an alphabet will provide multiple substitutes for a letter. Thus plaintext e, for example, instead of always being replaced by, say, 16, will be replaced by any one of the figures 16, 74, 35, 21. These alternates are called homophones. Sometimes a cipher alphabet will include symbols that mean nothing and are intended to confuse interceptors; these are called nulls.

As long as only one cipher alphabet is in use, as above, the system is called monalphabetic. When, however, two or more cipher alphabets are employed in some kind of prearranged pattern, the system becomes polyalphabetic. A simple form of polyalphabetic substitution would be to add another cipher alphabet under the one given above and then to use the two in rotation, the first alphabet for the first plaintext letter, the second for the second, the first again for the third plaintext letter, the second for the fourth, and so on. Modern cipher machines produce polyalphabetic ciphers that employ millions of cipher alphabets.

Among the systems of substitution, code is distinguished from cipher. A code consists of thousands of words, phrases, letters, and syllables with the codewords or codenumbers (or, more generally, the codegroups) that replace these plaintext elements. A portion of a code might look like this:

codenumber	plaintext
3964	emplacing
1563	employ
7260	en-
8808	enable
3043	enabled
0012	enabled to

This means, of course, that 0012 replaces enabled to. In a sense, a code comprises a gigantic cipher alphabet, in which the basic plaintext unit is the word or the phrase; syllables and letters are supplied mainly to spell out words not present in the code. In ciphers, on the other hand, the basic unit is the letter, sometimes the letter-pair (digraph or bigram), very rarely larger groups of letters (polygrams). The substitution and transposition systems illustrated above are ciphers. There is no sharp theoretical dividing line between codes and ciphers; the latter shade into the former as they grow larger. But in modern practice the differences are usually quite marked. Sometimes the two are distinguished by saying that ciphers operate on plaintext units of regular length (all single letters or all groups of, say, three letters), whereas codes operate on plaintext groups of variable length (words, phrases, individual letters, etc.). A more penetrating and useful distinction is that code operates on linguistic entities, dividing its raw material into meaningful elements like words and syllables, whereas cipher does not—cipher will split the t from the h in the, for example.

For 450 years, from about 1400 to about 1850, a system that was half a code and half a cipher dominated cryptography. It usually had a separate cipher alphabet with homophones and a codelike list of names, words, and syllables. This list, originally just of names, gave the system its name: nomenclator. Even though late in its life some nomenclators grew larger than some modern codes, such systems are still called “nomenclators” if they fall within this historical period. An odd characteristic is that nomenclators were always written on large folded sheets of paper, whereas modern codes are almost invariably in book or booklet form. The commercial code is a code used in business primarily to save on cable tolls; though some are compiled for private fims, many others are sold to the public and therefore provide no real secrecy.

Most ciphers employ a key, which specifies such things as the arrangement of letters within a cipher alphabet, or the pattern of shuffling in a transposition, or the settings on a cipher machine. If a word or phrase or number serves as the key, it is naturally called the keyword or keyphrase or keynumber. Keys exist within a general system and control that system’s variable elements. For example, if a polyalphabetic cipher provides 26 cipher alphabets, a key- word might define the half dozen or so that are to be used in a particular message.

Codewords or codenumbers can be subjected to transposition or substitution just like any other group of letters or numbers—the transforming processes do not ask that the texts given to them be intelligible. Code that has not yet undergone such a process—called superencipherment—or which has been deciphered from it is called placode, a shortening of “plain code.” Code that has been transformed is called encicode, from “enciphered code.”

To pass a plaintext through these transformations is to encipher or encode it, as the case may be. What comes out of the transformation is the ciphertext or the codetext. The final secret message, wrapped up and sent, is the cryptogram. (The term “ciphertext” emphasizes the result of encipherment more, while “cryptogram” emphasizes the fact of transmission more; it is analogous to “telegram.”) To decipher or decode is for the persons legitimately possessing the key and system to reverse the transformations and bare the original message. It contrasts with cryptanalyze, in which persons who do not possess the key or system—a third party, the “enemy”—break down or solve the cryptogram. The difference is, of course, crucial. Before about 1920, when the word cryptanalysis was coined to mean the methods of breaking codes and ciphers, “decipher” and “decode” served in both senses (and occasionally still do), and in quotations where they are used in the sense of solve, they are retained if they will not confuse. Sometimes cryptanalysis is called codebreaking; this includes solving ciphers. The original intelligible text that emerges from either decipherment or cryptanalysis is again called plaintext. Messages sent without encipherment are cleartext or in clear, though they are sometimes called in plain language.

Cryptology is the science that embraces cryptography and cryptanalysis, but the term “cryptology” sometimes loosely designates the entire dual field of both rendering signals secure and extracting information from them. This broader field has grown to include many new areas; it encompasses, for example, means to deprive the enemy of information obtainable by studying the traffic patterns of radio messages, and means of obtaining information from radar emissions. An outline of this larger field, with its opposing parts placed opposite one another, and with a few of the methods of each part given in parentheses, would be:

This book employs certain typographic conventions for simplicity and economy. Plaintext is always set lower case; when it occurs in the running text (as opposed to its occurrence in the diagrams), it is also in italics. Cipher-text or codetext is set in SMALL CAPS in the text, keys in LARGE CAPS. They are distinguished in the diagrams by labels. Cleartext and translations of foreign-language plaintext are in roman within quotation marks. The sound of a letter or syllable or word, as distinguished from its written form, is placed within diagonals, according to the convention widely followed in linguistics; thus /t/ refers to the unvoiced stop normally represented by that letter and not to the graphic symbol t.

D. K.

1. One Day of Magic

AT 1:28 on the morning of December 7, 1941, the big ear of the Navy’s radio station on Bainbridge Island near Seattle trembled to vibrations in the ether. A message was coming through on the Tokyo-Washington circuit. It was addressed to the Japanese embassy, and Bainbridge reached up and snared it as it flashed overhead. The message was short, and its radiotelegraph transmission took only nine minutes. Bainbridge had it all by 1:37.

The station’s personnel punched the intercepted message on a teletype tape, dialed a number on the teletypewriter exchange, and, when the connection had been made, fed the tape into a mechanical transmitter that gobbled it up at 60 words per minute.

The intercept reappeared on a page-printer in Room 1649 of the Navy Department building on Constitution Avenue in Washington, D.C. What went on in this room, tucked for security’s sake at the end of the first deck’s sixth wing, was one of the most closely guarded secrets of the American government. For it was in here—and in a similar War Department room in the Munitions Building next door—that the United States peered into the most confidential thoughts and plans of its possible enemies by shredding the coded wrappings of their dispatches.

Room 1649 housed OP-20-GY, the cryptanalytic section of the Navy’s cryptologic organization, OP-20-G. The page-printer stood beside the desk of the GY watch officer. It rapped out the intercept in an original and a carbon copy on yellow and pink teletype paper just like news on a city room wire-service ticker. The watch officer, Lieutenant (j.g.) Francis M. Brotherhood, U.S.N.R., a curly-haired, brown-eyed six-footer, saw immediately from indicators that the message bore for the guidance of Japanese code clerks that it was in the top Japanese cryptographic system.

This was an extremely complicated machine cipher which American cryptanalysts called PURPLE. Led by William F. Friedman, Chief Cryptanalyst of the Army Signal Corps, a team of codebreakers had solved Japan’s enciphered dispatches, deduced the nature of the mechanism that would effect those letter transformations, and painstakingly built up an apparatus that cryptographically duplicated the Japanese machine. The Signal Corps had then constructed several additional PURPLE machines, using a hodgepodge of manufactured parts, and had given one to the Navy. Its three components rested now on a table in Room 1649: an electric typewriter for input; the cryptographic assembly proper, consisting of a plugboard, four electric coding rings, and associated wires and switches, set on a wooden frame; and a printing unit for output. To this precious contraption, worth quite literally more than its weight in gold, Brotherhood carried the intercept.

He flicked the switches to the key of December 7. This was a rearrangement, according to a pattern ascertained months ago, of the key of December 1, which OP-20-GY had recovered. Brotherhood typed out the coded message. Electric impulses raced through the maze of wires, reversing the intricate enciphering process. In a few minutes, he had the plaintext before him.

It was in Japanese. Brotherhood had taken some of the orientation courses in that difficult language that the Navy gave to assist its cryptanalysts. He was in no sense a translator, however, and none was on duty next door in OP-20-GZ, the translating section. He put a red priority sticker on the decode and hand-carried it to the Signal Intelligence Service, the Army counterpart of OP-20-G, where he knew that a translator was on overnight duty. Leaving it there, he returned to OP-20-G. By now it was after 5 a.m. in Washington—the message having lost three hours as it passed through three time zones in crossing the continent.

The S.I.S. translator rendered the Japanese as: “Will the Ambassador please submit to the United States Government (if possible to the Secretary of State) our reply to the United States at 1:00 p.m. on the 7th, your time.” The—“reply” referred to had been transmitted by Tokyo in 14 parts over the past 18½ hours, and Brotherhood had only recently decrypted the 14th part on the PURPLE machine. It had come out in the English in which Tokyo had framed it, and its ominous final sentence read: “The Japanese Government regrets to have to notify hereby the American Government that in view of the attitude of the American Government it cannot but consider that it is impossible to reach an agreement through further negotiations.” Brotherhood had set it by for distribution early in the morning.

The translation of the message directing delivery at one o’clock had not yet come back from S.I.S. when Brotherhood was relieved at 7 a.m., and he told his relief, Lieutenant (j.g.) Alfred V. Pering, about it. Half an hour later, Lieutenant Commander Alwin D. Kramer, the Japanese-language expert who headed GZ and delivered the intercepts, arrived. He saw at once that the all-important conclusion of the long Japanese diplomatic note had come in since he had distributed the 13 previous parts the night before. He prepared a smooth copy from the rough decode and had his clerical assistant, Chief Yeoman H. L. Bryant, type up the usual 14 copies. Twelve of these were distributed by Kramer and his opposite number in S.I.S. to the President, the secretaries of State, War, and Navy, and a handful of top-ranking Army and Navy officers. The two others were file copies. This decode was part of a whole series of Japanese intercepts, which had long ago been given a collective codename, partly for security, partly for ease of reference, by a previous director of naval intelligence, Rear Admiral Walter S. Anderson. Inspired, no doubt, by the mysterious daily production of the information and by the aura of sorcery and the occult that has always enveloped cryptology, he called it MAGIC.

When Bryant had finished, Kramer sent S.I.S. its seven copies, and at 8 o’clock took a copy to his superior, Captain Arthur H. McCollum, head of the Far Eastern Section of the Office of Naval Intelligence.

MAGIC ’s solution of the Japanese one o’clock delivery message

He then busied himself in his office, working on intercepted traffic, until 9:30, when he left to deliver the 14th part of Tokyo’s reply to Admiral Harold F. Stark, the Chief of Naval Operations, to the White House, and to Frank Knox, the Secretary of the Navy. Knox was meeting at 10 a.m. that Sunday morning in the State Department with Secretary of War Henry L. Stimson and Secretary of State Cordell Hull to discuss the critical nature of the American negotiations with Japan, which, they knew from the previous 13 parts, had virtually reached an impasse. Kramer returned to his office about 10:20, where the translation of the message referring to the one o’clock delivery had arrived from S.I.S. while he was on his rounds.

Its import crashed in upon him at once. It called for the rupture of Japan’s negotiations with the United States by a certain deadline. The hour set for the Japanese ambassadors to deliver the notification—1 p.m. on a Sunday—was highly unusual. And, as Kramer had quickly ascertained by drawing a navigator’s time circle, 1 p.m. in Washington meant 7:30 a.m. in Hawaii and a couple of hours before dawn in the tense Far East around Malaya, which Japan had been threatening with ships and troops.

Kramer immediately directed Bryant to insert the one o’clock message into the reddish-brown looseleaf cardboard folders in which the MAGIC intercepts were bound. He included several other intercepts, adding one at the last minute, then slipped the folders into the leather briefcases, zipped these shut, and snapped their padlocks. Within ten minutes he was on his way.

He went first to Admiral Stark’s office, where a conference was in session, and indicated to McCollum, who took the intercept from him, the nature of the message and the significance of its timing. McCollum grasped it at once and disappeared into Stark’s office. Kramer wheeled and hurried down the passageway. He emerged from the Navy Department building and turned right on Constitution Avenue, heading for the meeting in the State Department eight blocks away. The urgency of the situation washed over him again, and he began to move on the double.

This moment, with Kramer running through the empty streets of Washington bearing his crucial intercept, an hour before sleepy code clerks at the Japanese embassy had even deciphered it and an hour before the Japanese planes roared off the carrier flight decks on their treacherous mission, is perhaps the finest hour in the history of cryptology. Kramer ran while an unconcerned nation slept late, ignored aggression in the hope that it would go away, begged the hollow gods of isolationism for peace, and refused to entertain—except humorously—the possibility that the little yellow men of Japan would dare attack the mighty United States. The American cryptanalytic organization swept through this miasma of apathy to reach a peak of alertness and accomplishment unmatched on that day of infamy by any other agency in the United States. That is its great achievement, and its glory. Kramer’s sprint symbolizes it.

Why, then, did it not prevent Pearl Harbor? Because Japan never sent any message saying anything like “We will attack Pearl Harbor.” It was therefore impossible for the cryptanalysts to solve one. Messages had been intercepted and read in plenty dealing with Japanese interest in warship movements into and out of Pearl Harbor, but these were evaluated by responsible intelligence officers as on a par with the many messages dealing with American warships in other ports and the Panama Canal. The causes of the Pearl Harbor disaster are many and complex, but no one has ever laid any of whatever blame there may be at the doors of OP-20-G or S.I.S. On the contrary, the Congressional committee that investigated the attack praised them for fulfilling their duty in a manner that “merits the highest commendation.”

As the climax of war rushed near, the two agencies—together the most efficient and successful codebreaking organization that had ever existed—scaled heights of accomplishment greater than any they had ever achieved. The Congressional committee, seeking the responsibility for the disaster, exposed their activity on almost a minute-by-minute basis. For the first time in history, it photographed in fine-grained detail the operation of a modern codebreaking organization at a moment of crisis. This is that film. It depicts OP-20-G and S.I.S. in the 24 hours preceding the Pearl Harbor attack, with the events of the past as prologue. It is the story of one day of MAGIC.

The two American cryptanalytic agencies had not sprung full-blown into being like Athena from the brow of Zeus. The Navy had been solving at least the simpler Japanese diplomatic and naval codes in Rooms 1649 and 2646 on the “deck” above since the 1920s. Among the personnel assigned to cryptanalytical duties were some of the Navy’s approximately 50 language officers who had served in Japan for three years studying that exceedingly difficult tongue. One of them was Lieutenant Ellis M. Zacharias, later to become famous as an expert in psychological warfare against Japan. After seven months of training in Washington in 1926, he took charge of the naval listening station on the fourth floor of the American consulate in Shanghai, where he intercepted and cryptanalyzed Japanese naval traffic. This post remained in operation until it was evacuated to Corregidor in December, 1940. Long before then, radio intelligence units had been set up in Hawaii and in the Philippines, with headquarters in Washington exercising general supervision.

The Army’s cryptanalytical work during the 1920s was centered in the so-called American Black Chamber under Herbert O. Yardley, who had organized it as a cryptologic section of military intelligence in World War I. It was maintained in secrecy in New York jointly by the War and State departments, and perhaps its greatest achievement was its 1920 solution of Japanese diplomatic codes. At the same time, the Army’s cryptologic research and code-compiling functions were handled by William Friedman, then as later a civilian employee of the Signal Corps. In 1929, Henry L. Stimson, then Secretary of State, withdrew State Department support from the Black Chamber on ethical grounds, dissolving it. The Army decided to consolidate and enlarge its codemaking and codebreaking activities. Accordingly, it created the Signal Intelligence Service, with Friedman as chief, and, in 1930, hired three junior cryptanalysts and two clerks.

The following year, a Japanese general suddenly occupied Manchuria and set up a puppet Manchu emperor, and the government of the island empire of Nippon fell into the hands of the militarists. Their avarice for power, their desire to enrich their have-not nation, their hatred for white Occidental civilization, started them on a decade-long march of conquest. They withdrew from the League of Nations. They began beefing up the Army. They denounced the naval disarmament treaties and began an almost frantic shipbuilding race. Nor did they neglect, as part of their war-making capital, their cryptographic assets. In 1934, their Navy purchased a commercial German cipher machine called the Enigma; that same year, the Foreign Office adopted it, and it evolved into the most secret Japanese system of cryptography. A variety of other cryptosystems supplemented it. The War, Navy, and Foreign ministries shared the superenciphered numerical HATO code for intercommunication. Each ministry also had its own hierarchy of codes. The Foreign Office, for example, employed four main systems, each for a specific level of security, as well as some additional miscellaneous ones.

Meanwhile, the modern-style shoguns speared into defenseless China, sank the American gunboat Panay, raped Nanking, molested American hospitals and missions in China, and raged at American embargoes on oil and steel scrap. It became increasingly evident that Nippon’s march of aggression would eventually collide with American rectitude. The mounting curve of tension was matched by the rising output of the American crypt-analytic agencies. A trickle of MAGIC in 1936 had become a stream in 1940. Credit for this belongs largely to Major General Joseph O. Mauborgne, who became Chief Signal Officer in October, 1937.

Mauborgne had long been interested in cryptology. In 1914, as a young first lieutenant, he achieved the first recorded solution of a cipher known as the Playfair, then used by the British as their field cipher. He described his technique in a 19-page pamphlet that was the first publication on cryptology issued by the United States government. In World War I, he put together several cryptographic elements to create the only theoretically unbreakable cipher, and promoted the first automatic cipher machine, with which the unbreakable cipher was associated. He was among the first to send and receive radio messages in airplanes. As Chief Signal Officer, he retained enough of his flair for cryptanalysis to solve a short and difficult challenge cipher. He was also talented in other directions: he played the violin well and was an accomplished artist, exhibiting at, among others, the Chicago Art Institute.

When he became head of the Signal Corps, he immediately set about augmenting the important cryptanalytic activities. He established the S.I.S. as an independent division reporting directly to him, enlarged its functions, set up branches, started correspondence courses, added intercept facilities, increased its budget, and put on more men. In 1939, when war broke out in Europe, S.I.S. was the first agency in the War Department to receive more funds, personnel, and space. Perhaps most important of all, Mauborgne’s intense interest inspired his men to outstanding accomplishments. More and more codes were broken, and as the international situation stimulated an increasing flow of intercepts, the MAGIC intelligence approached flood stage.

Mauborgne retired in September, 1941, leaving an expanded organization running with smooth efficiency. By then the Japanese had completed the basic outline for a dawn attack on Pearl Harbor. The plan had been conceived in the fertile brain of Admiral Isoroku Yamamoto, Commander-in-Chief Combined Fleet, Imperial Japanese Navy. Early in the year, he had ordered a study of the operation, contending that “If we have war with the United States, we will have no hope of winning unless the United States fleet in Hawaiian waters can be destroyed.” By May, 1941, studies had shown the feasibility of a surprise air attack, statistics had been gathered, and operational planning was under way.

In the middle of that month, the U.S. Navy took an important step in the radio intelligence field. It detached a 43-year-old lieutenant commander from his intelligence berth aboard U.S.S. Indianapolis and assigned him to reorganize and strengthen the radio intelligence unit at Pearl Harbor. The officer was Joseph John Rochefort, the only man in the Navy with expertise in three closely related and urgently needed fields: cryptanalysis, radio, and the Japanese language. Rochefort, who had begun his career as an enlisted man, had headed the Navy’s cryptographic section from 1925 to 1927. Two years later, a married man with a child, he was sent, because of his outstanding abilities, as a language student to Japan, a hard post to which ordinarily only bachelor officers were sent. This three-year tour was followed by half a year in naval intelligence; most of the next eight years were spent at sea.

Finally, in June of 1941, Rochefort took over the command of what was then known as the Radio Unit of the 14th Naval District in Hawaii. To disguise its functions he renamed it the Combat Intelligence Unit. His mission was to find out, through communications intelligence, as much as possible about the dispositions and operations of the Japanese Navy. To this end he was to cryptanalyze all minor and one of the two major Japanese naval cryptosysterns.

His chief target was the flag officers’ system, the Japanese Navy’s most difficult and the one in which it encased its most secret information. From about 1926 to the end of November, 1940, previous editions had provided the U.S.Navy with much of its information on the Japanese Navy. But the new version—a four-character code with a transposition superencipherment—was stoutly resisting the best efforts of the Navy’s most skilled cryptanalysts, and Rochefort was urged to concentrate on it. The other major system, the main fleet cryptographic system, the most widely used, comprised a code with five-digit codenumbers to which were added a key of other numbers to complicate the system. The Navy called it the “five numeral system,” or, more formally, JN25b—the JN for “Japanese Navy,” the 25 an identifying number, the b for the second (and current) edition. Navy cryptanalytic units in Washington and the Philippines were working on this code. Rochefort’s unit did not attack this but did attack the eight or ten lesser codes dealing with personnel, engineering, administration, weather, fleet exercises.

But cryptanalysis was only part of the unit’s task. The great majority of its 100 officers and men worked on two other aspects of radio intelligence—direction-finding and traffic analysis.

Direction-finding locates radio transmitters. Since radio signals are heard best when the receiver points at the transmitter, sensitive antennas can find the direction from which a signal is coming by swinging until they hear it at its loudest. If two direction-finders take bearings like that on a signal and a control center draws the lines of direction on a map, the point at which they cross marks the position of the transmitter. Such a fix can tell quite precisely where, for example, a ship is operating. Successive fixes can plot its course and speed.

To exploit this source of information, the Navy in 1937 established the Mid-Pacific Strategic Direction-Finder Net. By 1941, high-frequency direction-finders curved in a gigantic arc from Cavite in the Philippines through Guam, Samoa, Midway, and Hawaii to Dutch Harbor, Alaska. The 60 or 70 officers and men who staffed these outposts reported their bearings to Hawaii, where Rochefort’s unit translated them into fixes. For example, on October 16, the ship with call-sign KUNA 1 was located at 10.7 degrees north latitude, 166.7 degrees east longitude—or within Japan’s mandated islands.

These findings did not serve merely to keep an eye on the day-to-day locations of Japanese warships. They also formed the basis of the even more fruitful technique of traffic analysis. Traffic analysis deduces the lines of command of military or naval forces by ascertaining which radios talk to which. And since military operations are usually accompanied by an increase in communications, traffic analysis can infer the imminence of such operations by watching the volume of traffic. When combined with direction-finding, it can often approximate the where and when of a planned movement.

Radio intelligence thus maintains a long-range, invisible, and continuous surveillance of fleet movements and organization, providing a wealth of information at a low cost. Of course it has its limitations. A change of the call-signs of radio transmitters can hinder it. The sending of fictitious messages can befuddle it. Radio silences can deafen it. But it cannot be wholly prevented except by unacceptable restrictions on communications. Hence the Navy relied increasingly on it for its information on Japanese naval activities as security tightened in Japan during 1941, and almost exclusively after July, when the President’s trade-freezing order deprived the Navy of all visual observations of Japanese ships not on the China coast.

It was in July that a Japanese tactic set up a radio pattern that was later to deceive the Combat Intelligence Unit. The Nipponese militarists had decided to take advantage of France’s defeat and occupy French Indochina. The naval preparations for the successful grab were clearly indicated in the radio traffic, which went through the usual three stages that preceded major Japanese operations. First appeared a heavy flurry of messages. The Commander-in-Chief Combined Fleet busily originated traffic, talking with many commands to the south, thereby indicating the probable direction of his advance. Then came a realignment of forces. In the lingo of the tranalysis people, certain chickens (fleet units) no longer had their old mothers (fleet commanders). Call-sign NOTA 4, which usually communicated with OYO 8, now talked mostly with ORU 6. Accompanying this was a considerable confusion in the routing of messages, with frequent retransmissions caused by the regrouping: Admiral Z not here; try Second Fleet. Then followed the third phase: radio silence. The task force was now under way. Messages would be addressed to it, but none would emanate from it.

During all this, however, not only were no messages heard from the aircraft carriers, none were sent to them, either. This blank condition exceeded radio silence, which suppresses traffic in only one direction—from the mobile force—not in both. American intelligence reasoned that the carriers were standing by in home waters as a covering force in case of counterattack, and that communications both to and from them were not heard because they were being sent out by short-range, low-powered transmissions that died away before reaching American receivers. Such a blank condition had obtained in a similar tactical situation in February. American intelligence had drawn the same conclusions then and had been proven right. Events soon confirmed the July assessment as well. Twice, then, a complete blank of carrier communications combined with indications of a strong southward thrust had meant the presence of the carriers in Empire waters. But what happened in February and July was not necessarily what would happen in December.

During the summer and fall of 1941, the pressure of events molded America’s two cryptanalytic agencies closer and closer to the form they were to have on December 7. The Signal Intelligence Service, which had 181 officers, enlisted men, and civilians in Washington and 150 at intercept stations in the field on Pearl Harbor Day, had been headed since March by Lieutenant Colonel Rex W. Minckler, a career Signal Corps officer. Friedman served as his chief technical assistant. S.I.S. comprised the Signal Intelligence School, which trained Regular Army and Reserve officers in cryptology, the 2nd Signal Service Company, which staffed the intercept posts, and four Washington sections of the S.I.S. proper: the A, or administrative, which also operated the tabulating machinery; the B, or cryptanalytic; the C, or cryptographic, which prepared new U.S. Army systems, studied the current systems for security, and monitored Army traffic for security violations; and the D, or laboratory, which concocted secret inks and tested suspected documents.

The B section, under Major Harold S. Doud, a West Point graduate, had as its mission the solution of the military and diplomatic systems not only of Japan but of other countries. In this it apparently achieved at least a fair success, though no Japanese military systems—the chief of which was a code employing four-digit codenumbers—were readable by December 7 because of a paucity of material. Doud’s technical assistant was a civilian, Frank B. Rowlett, one of the three original junior cryptanalysts hired in 1930. The military man in charge of Japanese diplomatic solutions was Major Eric Svensson.

The Navy’s official designation of OP-20-G indicated that the agency was the G section of the 20th division of OPNAV, the Office of the Chief of Naval Operations, the Navy’s headquarters establishment. The 20th division was the Office of Naval Communications, and the G section was the Communication Security Section. This carefully chosen name masked its cryptanalytic activities, though its duties did include U.S. Navy cryptography.

Its chief was Commander Laurence F. Safford, 48, a tall, blond Annapolis graduate who was the Navy’s chief expert in cryptology. In January, 1924, he had become the officer in charge of the newly created research desk in the Navy’s Code and Signal Section. Here he founded the Navy’s communication-intelligence organization. After sea duty from 1926 to 1929, he returned to cryptologic activities for three more years, when sea duty was again made necessary by the “Manchu” laws, which required officers of the Army and Navy to serve in the field or at sea to win promotion. He took command of OP-20-G in 1936. One of his principal accomplishments before the outbreak of war was the establishment of the Mid-Pacific Strategic Direction-Finder Net and of a similar net for the Atlantic, where it was to play a role of immense importance in the Battle of the Atlantic against the U-boats.

Safford’s organization enjoyed broad cryptologic functions. It printed new editions of codes and ciphers and distributed them, and contracted with manufacturers for cipher machines. It developed new systems for the Navy. It comprehended such subsections as GI, which wrote reports based on radio intelligence from the field units, and GL, a record-keeping and historical-research group. But its main interest centered on cryptanalysis.

This activity was distributed among units in Washington, Hawaii, and the Philippines. Only Washington attacked foreign diplomatic systems and naval codes used in the Atlantic theater (primarily German). Rochefort had primary responsibility for the Japanese naval systems. The Philippines chipped away at JN25 and did some diplomatic deciphering, with keys provided by Washington. That unit, which like Rochefort’s was attached for administrative purposes to the local naval district (the 16th), was installed in a tunnel of the island fortress of Corregidor. It was equipped with 26 radio receivers, apparatus for intercepting both high- and low-speed transmissions, a direction-finder, and tabulating machinery. Lieutenant Rudolph J. Fabian, 33, an Annapolis graduate who had had three years of communication intelligence in Washington and the Philippines, commanded. The 7 officers and 19 men in his cryptanalytic group exchanged possible recoveries of JN25b codegroups with Washington and with a British group in Singapore; each group also had a liaison man with the other.

Of the Navy’s total radio-intelligence establishment of about 700 officers and men, two thirds were engaged in intercept or direction-finding activities and one third—including most of the 80 officers—in cryptanalysis and translation. Safford sized up the personnel of his three units this way: Pearl Harbor had some of the best officers, most of whom had four or five years of radio intelligence experience; the crew at Corregidor, which in general had only two or three years’ experience, was “young, enthusiastic, and capable”; Washington—responsible for both overall supervision and training—had some of the most experienced personnel, with more than ten years’ experience, and many of the least: 90 per cent of the unit had less than a year’s experience.

Under Safford in the three subsections most closely involved with crypt-analysis were Lieutenant Commanders George W. Welker of GX, the intercept and direction-finding subsection, Lee W. Parke of GY, the cryptanalytical subsection, and Kramer of GZ, the translation and dissemination subsection. GY attacked new systems and recovered new keys for solved systems, such as PURPLE. But while it made the initial breaks in code solutions, the detailed recovery of codegroups (which was primarily a linguistic problem as compared to the more mathematical cipher solutions) was left to GZ. Four officers in GY, assisted by chief petty officers, stood round-the-clock watches. Senior watch officer was Lieutenant (j.g.) George W. Lynn; the others were Lieutenants (j.g.) Brotherhood, Pering, and Allan A. Murray, GY had others on its staff, such as girl typists who also did the simple deciphering of some diplomatic messages after the watch officers and other cryptanalysts had found the keys.

Kramer was in an odd position. Though he worked in OP-20-GZ, he was formally attached to OP-16-F2—the Far Eastern Section of the Office of Naval Intelligence. This arrangement was intended in part to throw off the Japanese, who might have inferred some measure of success in codebreaking if a Japanese-language officer like Kramer were assigned to communications, in part to have an officer with a broad intelligence background distribute MAGIC so that he could answer the recipients’ questions. Kramer, 38, who had studied in Japan from 1931 to 1934, had had two tours in O.N.I. proper before being assigned full time to GZ in June, 1940. An Annapolis graduate, chess fan, and rifle marksman, he lived in a world in which everything had one right way to be done. He chose his words with almost finicky exactness (one of his favorites was “precise”); he kept his pencil mustache trimmed to a hair; he filed his papers tidily; he often studied his MAGIC intercepts several times over before delivering them. Included in this philosophy was his duty. He performed it with great responsibility, intelligence, and dedication.

The first task of OP-20-G and of S.I.S. was to obtain raw material for the cryptanalysts. And in peacetime America that was not easy.

Section 605 of the Federal Communications Act of 1934, which prohibits wiretaps, also prohibits the interception of messages between foreign countries and the United States and territories. General Malin Craig, Chief of Staff from 1937 to 1939, was acutely aware of this, and his attitude dampened efforts to intercept the Japanese diplomatic messages coming into America. But after General George C. Marshall succeeded to Craig’s post, the exigencies of national defense relegated that problem in his mind to the status of a legalistic quibble. The cryptanalytic agencies pressed ahead in their intercept programs. The extreme secrecy in which they were cloaked helped them avoid detection. They concentrated on radio messages, since the cable companies, fully cognizant of the legal restrictions, in general refused to turn over any foreign communications to them. Consequently, 95 per cent of the intercepts were radio messages. The remainder was split between cable intercepts and photographs of messages on file at a few cooperative cable offices.

To pluck the messages from the airwaves, the Navy relied mainly on its listening posts at Bainbridge Island in Puget Sound; Winter Harbor, Maine; Cheltenham, Maryland; Heeia, Oahu; and Corregidor and to a lesser degree on stations at Guam; Imperial Beach, California; Amagansett, Long Island and Jupiter, Florida. Each station was assigned certain frequencies to cover. Bainbridge Island, which was called Station S, copied solid the schedule of Japanese government messages between Tokyo and San Francisco. Its two sound recorders guarded the radiotelephone band of that circuit; presumably it was equipped to unscramble the relatively simple sound inversion that then provided privacy from casual eavesdropping. Diplomatic messages were transmitted almost exclusively by commercial radio using roman letters. The naval radiograms, however, employed the special Morse code devised for kata kana, a syllabic script of Japanese. The Navy picked these up with operators trained in Japanese Morse and recorded them on a special typewriter that it had developed for the roman-letter equivalents of the kana characters. The Army’s stations, called Monitor Posts, were: No. 1, Fort Hancock, New Jersey; No. 2, San Francisco; No. 3, Fort Sam Houston, San Antonio; No. 4, Panama; No. 5, Fort Shafter, Honolulu; No. 6, Fort Mills, Manila; No. 7, Fort Hunt, Virginia; No. 9, Rio de Janeiro.

At first both services airmailed messages from their intercept posts to Washington. But this proved too slow. The Pan-American Clipper, which carried Army intercepts from Hawaii to the mainland, departed only once a week on the average, and weather sometimes caused cancellations, forcing messages to be sent by ship. As late as the week before Pearl Harbor, two Army intercepts from Rio did not reach Washington for eleven days. Such delays compelled the Navy to install teletypewriter service in 1941 between Washington and its intercept stations in the continental U.S. The station would perforate a batch of intercepts onto a teletype tape, connect with Washington through a teletypewriter exchange, and run the tape through mechanically at 60 words per minute, cutting toll charges to one third the cost of manually sending each message individually. Outlying stations of both the Army and Navy picked out Japanese messages bearing certain indicators, enciphered the Japanese cryptograms in an American system, and radioed them to Washington. The reencipherment was to keep the Japanese from knowing of the extensive American cryptanalytic effort. Only the three top Japanese systems were involved in this expensive radio retransmission: PURPLE, RED (a machine system that antedated PURPLE, which had supplanted it at major embassies, but that was still in use for legations such as Vladivostok), and the J series of enciphered codes. The Army did not install a teletype for intercepts from its continental posts until the afternoon of December 6, 1941; the first messages (from San Francisco) were received in the early morning hours of December 7.

The intercept services missed little. Of the 227 messages pertaining to Japanese-American negotiations sent between Tokyo and Washington from March to December, 1941, all but four were picked up.

In Honolulu, where a large Japanese population produced nightmares of antlike espionage and potential sabotage, the 14th Naval District’s intelligence officer, Captain Irving S. Mayfield, had long sought to obtain copies of the cablegrams of Consul General Nagao Kita. If Rochefort’s unit could solve these, Mayfield figured, he might know better which Japanese to shadow and what information they sought.

His intuitions were sound. On March 27, 1941, not two weeks after May-field himself took up his duties, a young ensign of the Imperial Japanese Navy, 25-year-old Takeo Yoshikawa, who had steeped himself in information about the American Navy, arrived in Honolulu to serve as Japan’s only military espionage agent covering Pearl Harbor. Under the cover-name “Tadasi Morimura,” he was assigned to the consulate as a secretary. He promptly made himself obnoxious—and drew suspicion upon himself within the consulate staff—by coming to work late or not at all, getting drunk frequently, having women in his quarters overnight, and even insulting the consul himself on occasion. But he managed to tour the islands, and within a month was sending such messages as: “Warships observed at anchor on the 11th [of May, 1941] in Pearl Harbor were as follows: Battleships, 11: Colorado, West Virginia, California, Tennessee ….” These were sent in the consulate’s diplomatic systems, not in naval code.

But Mayfield’s hopes of peering into these secret activities through the window of a broken code were stymied by the refusal of the cable offices to violate the statute against interception. His desires grew more intense as another source failed to yield any information of counterespionage activity. For months one of his enlisted men, Theodore Emanuel, had tapped half a dozen of the consulate’s telephone lines, recorded the 50 or 60 calls made on them each day, and turned the recordings over to Lieutenant Denzel Carr for translation and summarization. But this eavesdropping produced at best some juicy items about bachelor Kita’s sex life (such as his chasing a maid around a bedpost one night after a sake-soaked Japanese wedding); there was little to help Mayfield.

So when David Sarnoff, president of the Radio Corporation of America, vacationed in Hawaii, Mayfield spoke to him. It was subsequently arranged that thenceforth R.C.A.’s Japanese consulate messages would be quietly given to the naval authorities. But the consulate rotated its business among the several cable companies in Honolulu, and R.C.A.’s turn was not due until December 1.

In Washington, however, intercepts overwhelmed GY and S.I.S. The tiny staff of cryptanalysts simply could not cope with all of them expeditiously. This difficulty was resolved in two ways.

One was to cut out duplication of effort. At first, both services solved all their Japanese diplomatic intercepts. But beginning more than a year before Pearl Harbor, messages originating in Tokyo on odd-numbered days of the month were handled by the Navy, those on even days, by the Army. Each began breaking the messages sent in from its own intercept stations until it reached the Tokyo date of origin; it would then retain them or send them over as the dates indicated. The cryptanalysts utilized the extra time to attack as-yet-unbroken systems and to clean up backlogs.

The other method was to concentrate on the important intercepts and let the others slide, at least until the important ones were completed. But how can a cryptanalyst tell which messages are important until he has solved them? He cannot, but he can assume that messages sent in the more secret systems are the more important. All dispatches cannot be transmitted in a single system because the huge volume of traffic would enable cryptanalysts to break it too quickly. Hence most nations set up a hierarchy of systems, reserving the top ones for their vital needs.

Japan was no exception. Though her Foreign Office employed an almost bewildering variety of different codes, resorting, from time to time, to the Yokohama Specie Bank’s private code, a Chinese ideographic code list, and codes bearing kata kana names, such as TA, JI, or HEN, it relied in the main on four systems. American cryptanalysts ranked these on four levels according to the inherent difficulty of their solution and the messages that they generally carried. Intercepts were then solved in the order of this priority schedule.

Simplest of all, and hence the lowest in rank and last to be read (excluding plain language), was the LA code, so called from the indicator group LA that preceded its codetexts. LA did little more than put kata kana into roman letters for telegraphic transmission and to secure some abbreviation for cable economy. Thus the kana for ki was replaced by the code form CI, the kana for to by IF, the two-kana combination of ka + n by CE. Its two-letter codewords, all of either vowel-consonant or consonant-vowel form and including such as ZO for 4, were supplemented by a list of four-letter codewords, such as TUVE for dollars, SISA for ryoji (“consul”), and XYGY for Yokohama. A very typical LA message is serial 01250 from the Foreign Minister to Kita, dated December 4, which begins in translation: “The following has been authorized as the year-end bonus for employee typists of your office.” This sort of code is generally called a “passport code” because it usually serves for messages covering the administrative routine of a mission, such as issuance of passports and visas, LA was a particularly simple one to solve, partly because it had been in effect since 1925, partly because of the regularities in its construction. For example, all kana that ended in e had as code equivalents groups beginning with A (ke = AC, se = AD), and all that began with k had code equivalents beginning or ending with C. Identification of one kana would thus suggest the identification of others.

One rung up the cryptographic ladder was the system known to the Japanese as Oite and to American codebreakers as PA-K2. The PA part was a two- and four-letter code similar to the LA, though much more extensive and with codegroups disarranged. The K2 part was a transposition based on a keynumber. The letters from the PA encoding were written under this key-number from right to left and then copied out in mixed order, taking first the letter under number 1, then the letter under number 2, until the row was completed. The process was repeated for successive rows.

For example, on December 4 Yoshikawa wired the Foreign Minister that “At 1 o’clock on the 4th a light cruiser of the Honolulu class hastily departed—Morimura.” In romaji (the roman-letter version of the kata kana) this became 4th gogo 1 kei jun (honoruru) kata hyaku shutsu ko—morimura. In PA, with the parentheses getting their own codegroups (OQ and UQ), it assumed this form: BYDH DOST JE YO IA OQ GU RA HY HY UQ VI LA YJ AY EC TY FI BANL, with FI indicating use four-letter code. (The code clerk made two errors. After encoding kata by VI, he encoded an extra ta into LA and an unnecessary re into TY.) This was then written under the keynumber from right to left, with an extra letter I as a null to complete the final five-letter group:

Transcribed line by line according to the numbers (S under 1 first, D under 2 second, etc.), prefixed with system indicator GIGIG and key indicator AUDOB, the message number, and the telegraphic abbreviation of Sikuyu (“urgent”), the message (with three more errors: the Y under 13 became the J in CJYHH, the F under 2 became the E in IYJIE, and the T under 9 became the I in AUIAY) became the one actually sent over Kita’s name:

GAIMUDAIJIN TOKIO

SIKYU 02500 GIGIG AUDOB SDEAT QYOUB DGORY HJOIQ YLAVE AUIAY CJYHH IYJIE ALBIN

KITA

PA-K2 did not pose much of a problem to experienced American crypt-analysts. Rochefort estimated that his unit could crack a PA-K2 message in from six hours to six days, with three days a good average. The transposition was vulnerable because each line was shuffled identically; the cryptanalyst could slice a cryptogram into groups of 15 or 17 or 19 and anagram these simultaneously until the predominant vowel-consonant alternation appeared on all lines; the underlying code could then be solved by assuming that the most frequent codegroups represented the most frequent kana (i, followed by ma, shi, o, etc.) and filling out the skeleton words that resulted. Since the system had remained in use for several years, this reconstruction had long been accomplished by the Washington agencies. Hence solution involved only unraveling any new transposition and, with luck, might take only a few hours. It could also take a few days. Primarily because of PA-K2’s deferred position in the priority list, an average of two to four days elapsed between interception and translation.

The code clerk in Honolulu enveloped Yoshikawa’s final messages in PA-K2 only because higher-level codes had been destroyed December 2 on orders from Tokyo. Normally, espionage reports of shipping movements and military activities, sent routinely by Japanese consuls from their posts all over the world, were framed on that next level of secrecy. Here prevailed a succession of codes called TSU by the Japanese and the J series by Americans. These were even more extensive and more thoroughly disarranged than PA, and they were transposed by a system of far greater complexity than the rather simple and vulnerable K2. Furthermore, the code and the transposition were changed at frequent intervals. Thus J17-K6 was replaced on March 1 by J18-K8, and that in turn by J19-K9 on August 1.

The transposition was the real stumbling block. Like the K2, it used a keynumber, but it differed in being copied off vertically instead of horizontally, and in having a pattern of holes in the transposition blocks. These holes were left blank when the code groups are inscribed into the block. For example, letting the alphabet from A to Y serve as the code message:

The letters were transcribed in columns in the order of the keynumbers, skipping over the blanks: BJMV EHKT NW CGORX AFILQU DPSY. This would be sent in the usual five-letter groups.

The first step in solving a columnar transposition like this, but without blanks, is to cut the cryptogram into the approximately equal segments that the cryptanalyst believes represent the columns of the original block. The blanks vastly increase the difficulty of this essential first step because they vary the length of the column segments. The second step is to reconstruct the block by trying one segment next to the other until a codeword-like pattern appears. Here again the blanks, by introducing gaps in unknown places between the letters of the segments, greatly hinder the cryptanalyst.

A page of a Japanese codebook (about 1931)

The problems of solving such a system are illustrated by the fact that J18-K8 was not broken until more than a month after its introduction. The cryptanalysts had to make a fresh analysis for each pattern of blanks and each transposition key. The key changed daily, the blank-pattern three times a month. Hence J19-K9 solutions were frequently delayed. The key and pattern for November 18 were not recovered until December 3; those for November 28, not until December 7. On the other hand, solution was sometimes effected within a day or two. Success usually depended on the quantity of intercepts in a given key. About 10 or 15 per cent of J19-K9 keys were never solved.

This situation contrasts with that of PURPLE, the most secret Japanese system, in which all but 2 or 3 per cent of keys were recovered and in which most messages were solved within hours. Did the Japanese err in assessing the security of their systems? Yes and no. PURPLE was easier to keep up with once it was solved, but it was a much more difficult system to break in the first place than J19-K9. The solution of the PURPLE machine was, in fact, the greatest feat of cryptanalysis the world had yet known.

The cipher machine that Americans knew as PURPLE bore the resounding official Japanese title of 97-shiki O-bun In-ji-ki. This meant Alphabetical Typewriter ’97, the ’97 an abbreviation for the year 2597 of the Japanese calendar, which corresponds to 1937. The Japanese usually referred to it simply as “the machine” or as “J,”{1} the name given it by the Imperial Japanese Navy, which had adapted it from the German Enigma cipher machine and then had lent it to the Foreign Ministry, which, in turn, had further modified it. Its operating parts were housed in a drawer-sized box between two big black electrically operated Underwood typewriters, which were connected to it by 26 wires plugged into a row of sockets called a plugboard. To encipher a message, the cipher clerk would consult the thick YU GO book of machine keys, plug in the wire connections according to the key for the day, turn the four disks in the box so the numbers on their edges were those directed by the YU GO, and type out the plaintext. His machine would record that plaintext while the other, getting the electric impulses after the coding box had twisted them through devious paths, would print out the ciphertext. Deciphering was the same, though the machine irritatingly printed the plaintext in the five-letter groups of the ciphertext input.

The Alphabetical Typewriter worked on roman letters, not kata kana. Hence it could encipher English as well as romaji—and also roman-letter codetexts, like those of the J codes. Since themachin e could not encipher numerals or punctuation, the code clerk first transformed them into three-letter codewords, given in a small code list, and enciphered these. The receiving clerk would restore the punctuation, paragraphing, and so on, when typing up a finished copy of the decode.

The guts and heart of the machine were the plugboards and the coding wheels. They diverted the current flowing along the connections from the input typewriter to the output one so that when the a key was depressed on the input keyboard an a would not be typed on the output machine. The diversion began with the plugboard connections. If the coding box were not present, a plugboard wire would take the electric impulse from the a key of the plaintext typewriter and bring it directly to, say, the R typebar of the ciphertext machine. Other wires would similarly connect the plaintext keys to noncorresponding ciphertext typebars. This would automatically produce a cipher, though a very elementary one. Each time plaintext a was depressed ciphertext R would appear. So simple a system affords no security. The plugboard connections can be changed from message to message, or even within a message, but this does not noticeably augment the system’s strength.

Here is where the four coding wheels came in. Interposed between the plugboard of the plaintext typewriter and that of the ciphertext machine, they were shifted constantly with respect to one another by their supporting assembly. The enciphering current had to traverse their winding wire paths to get from one typewriter to the other, and the constant shifting continually set up different paths. Thus impulses from a given plaintext letter were switched through the box along ever varying detours to emerge at ever differing cipher-text letters. Plaintext a might be represented in a long message by all 26 letters. Conversely, any given ciphertext letter might stand for any one of 26 plaintext letters. Switches on the coding wheels could be flicked one way or the other; this constituted part of the key and was done by the code clerk before enciphering. Usually the plugboard connections were changed each day.

These factors united to produce a cipher of exceptional difficulty. The more a cipher deviates from the simple form in which one ciphertext letter invariably replaces the same plaintext letter, the harder it is to break. A cipher might replace a given plaintext letter by five different ciphertext letters in rotation, for example. But the Alphabetical Typewriter produced a substitution series hundreds of thousands of letters long. Its coding wheels, stepping a space—or two, or three, or four—after every letter or so, did not return to their original positions to re-create the same series of paths, and hence the same sequence of substitutes, until hundreds of thousands of letters had been enciphered. The task of the cryptanalysts consisted primarily of reconstructing the wiring and switches of the coding wheels—a task made more burdensome by the daily change of plugboard connections. Once this was done, the crypt-analyst still had to determine the starting position of the coding wheels for each day’s messages. But this was a comparatively simple secondary job.

American cryptanalysts knew none of these details when the Japanese Foreign Office installed the Alphabetical Typewriter in its major embassies in the late 1930s. How, then, did they solve it? Where did they begin? How did they even know that a new machine was in service, since the Japanese government did not announce it?

The PURPLE machine supplanted the RED machine,{2} which American cryptanalysts had solved, and so probably their first clue to the new machine was the disconcerting discovery that they could no longer read the important Japanese messages. At the same time, they observed new indicators for the PURPLE system. Clues to the system’s nature came from such characteristics of its ciphertext as the frequency of letters, the percentage of blanks (letters that did not appear in a given message), and the nature and number of repetitions. Perhaps the codebreakers also assumed that the new machine comprised essentially a more complicated and improved version of the one it replaced. In this they were right.

Their first essays at breaking into the cipher both accompanied and supplemented their attempts to determine the type of cipher. Their previous success with the RED machine and with the lesser systems had given them insight into the Japanese diplomatic forms of address, favorite phrases, and style (paragraphs were often numbered, for example). These provided the cryptanalysts with probable words—words likely to be in the plaintext—that would help in breaking the cipher. Opening and closing formulas, such as “I have the honor to inform Your Excellency” and “Re your telegram,” constituted virtual cribs. Newspaper stories suggested the subject matter of intercepts. The State Department sometimes made public the full texts of diplomatic notes from Japan to the American government, in effect handing the cryptanalysts the plaintext (or its translation) of an entire dispatch. (State reportedly did not pass the texts of confidential notes to the cryptanalysts, though this would have helped them considerably and was done by other foreign ministries.) Japan’s Foreign Office often had to circulate the same text to several embassies, not all of which had a PURPLE machine, and a code clerk might have inadvertently encoded some cables in PURPLE, some in other systems—which the cryptanalysts could read. A comparison of times of dispatch and length, and voilà!—another crib to a cryptogram. Errors were, as always, a fruitful source of clues. As late as November, 1941, the Manila legation repeated a telegram “because of a mistake on the plugboard.” How much more common must errors have been when the code clerks were just learning to handle the machine! The sending of the identical text in two different keys produces “isomorphic” cryptograms that yield exceedingly valuable information on the composition of the cipher.

The cryptanalysts of S.I.S. and OP-20-G, then, matched these assumed plaintexts to their ciphertexts and looked for regularities from which they could derive a pattern of encipherment. This kind of work, particularly in the early stages of a difficult cryptanalysis, is perhaps the most excruciating, exasperating, agonizing mental process known to man. Hour after hour, day after day, sometimes month after month, the cryptanalyst tortures his brain to find some relationship between the letters that hangs together, does not dead-end in self-contradiction, and leads to additional valid results. “Most of the time he is groping in the darkest night,” one solver has written. “Now and again a little flicker of light gleams across the darkness, tantalizing him with a glimpse of a path. Hopefully he dashes to it only to find himself in another labyrinth. His knowledge that night is inevitably followed by day keeps his waning courage up, and he steers his course towards where the morning sun is soon to appear. Except that sometimes he is engulfed in an interminable polar night.”

It must have seemed like that interminable night to the cryptanalysts who began attacking the new Japanese machine. The codebreakers went just so far—and for months could not push on further. As William Friedman recalled, “When the PURPLE system was first introduced it presented an extremely difficult problem on which the Chief Signal Officer [Mauborgne] asked us to direct our best efforts. After work by my associates when we were making very slow progress, the Chief Signal Officer asked me personally to take a hand. I had been engaged largely in administrative duties up to that time, so at his request I dropped everything else that I could and began to work with the group.”

Friedman was (and is) the world’s greatest cryptologist. Then in his late forties, he was a quiet, studious man, well liked by his associates, of average height and build, and a natty dresser given to bow ties. Trained as a geneticist, he had become interested in cryptology in 1915 at a research institution in Illinois called the Riverbank Laboratories. He served as a cryptanalyst with the American Expeditionary Forces in World War I, and returned to River-bank to write an 87-page tract that revolutionized cryptanalysis by introducing statistical methods for the first time. Hired by the Signal Corps in 1921, he applied these methods to a cipher-machine solution that placed America in the forefront of world cryptology. During these years, his wife, the former Elizebeth Smith, whom he had met and married at Riverbank, was solving rumrunners’ codes for the Coast Guard. He wrote textbooks in cryptanalysis that are models of clarity. He became head of S.I.S. when it was founded and continued to exercise his extraordinary cryptanalytic abilities. His genius soon manifested itself in the attack on PURPLE.

Lighting his way with some of the methods that he himself had developed, he led the cryptanalysts through the murky PURPLE shadowland. He assigned teams to test various hypotheses. Some prospected fruitlessly, their only result a demonstration that success lay in another direction. Others found bits and pieces that seemed to make sense, (OP-20-G cooperated in this work, with Harry L. Clark making especially valuable contributions, but S.I.S. did most of it.) Friedman and the other codebreakers began to segregate the ciphertext letters into cycles representing the rotation of the coding wheels—gingerly at first, then faster and faster as the evidence accumulated. The polyalphabetic class of ciphers, to which PURPLE belonged, is based ultimately upon an alphabet table, usually 26 letters by 26. To reconstruct the PURPLE tables, the cryptanalysts employed both direct and indirect symmetry of position—names only slightly less forbidding than the methods they denote. Errors, caused perhaps by garbled interceptions or simple mistakes in the crypt-analysis, jarred these delicate analyses and delayed the work. But slowly it progressed. A cryptanalyst, brooding sphinxlike over the cross-ruled paper on his desk, would glimpse the skeleton of a pattern in a few scattered letters; he tried fitting a fragment from another recovery into it; he tested the new values that resulted and found that they produced acceptable plaintext; he incorporated his essay into the over-all solution and pressed on. Experts in Japanese filled in missing letters; mathematicians tied in one cycle with another and both to the tables. Every weapon of cryptanalytic science—which in the stratospheric realm of this solution drew heavily upon mathematics, using group theory, congruences, Poisson distributions—was thrown into the fray.

Eventually the solution reached the point where the cryptanalysts had a pretty good pencil-and-paper analog of the PURPLE machine. S.I.S. then constructed a mechanism that would do automatically what the cryptanalysts could do manually with their tables and cycles. They assembled it out of ordinary hardware and easily available pieces of communication equipment, such as the selector switches used for telephones. It was hardly a beautiful piece of machinery, and when not running just right it spewed sparks and made loud whirring noises. Though the Americans never saw the 97-shiki O-bun In-ji-ki, their contraption bore a surprising physical resemblance to it, and of course exactly duplicated it cryptographically.

S.I.S. handed in its first complete PURPLE solution in August of 1940, after 18 or 20 months of the most intensive analysis. In looking back on the effort that culminated in this, the outstanding cryptanalytic success in the whole history of secret writing up to its time, Friedman would say generously:

Naturally this was a collaborative, cooperative effort on the part of all the people concerned. No one person is responsible for the solution, nor is there any single person to whom the major share of credit should go. As I say, it was a team, and it was only by very closely coordinated teamwork that we were able to solve it, which we did. It represents an achievement of the Army cryptanalytic bureau that, so far as I know, has not been duplicated elsewhere, because we definitely know that the British cryptanalytic service and the German cryptanalytic service were baffled in their attempts and they never did solve it.

Friedman, was, despite his partial disclaimer, the captain of that team. The solution had taken a terrific toll. The restless turning of the mind tormented by a puzzle, the preoccupation at meals, the insomnia, the sudden wakening at midnight, the pressure to succeed because failure could have national consequences, the despair of the long weeks when the problem seemed insoluble, the repeated dashings of uplifted hopes, the mental shocks, the tension and the frustration and the urgency and the secrecy all converged and hammered furiously upon his skull. He collapsed in December. After three and a half months in Walter Reed General Hospital recovering from the nervous breakdown, he returned to S.I.S. on shortened hours, working at first in the more relaxed area of cryptosecurity. By the time of Pearl Harbor he was again able to do some cryptanalysis, this time of German systems.

Meanwhile, S.I.S. constructed a second PURPLE machine and gave it to the Navy. A third was sent to England in January of 1941 on King George V, Britain’s newest and largest battleship, which had just brought over her new ambassador to the United States, Lord Halifax. Two Army and two Navy cryptanalysts accompanied the machine. In return the United States received British cryptanalytic information, presumably about German codes and ciphers. This machine eventually reached the British codebreaking group at Singapore, and was evacuated with it to Delhi after the Japanese swarmed down Malaya. A fourth machine was sent to the Philippines, while a fifth was built as an extra for S.I.S. A machine for Hawaii was under construction at the time of Pearl Harbor; this became instead a second machine sent to England for use there by Great Britain.

OP-20-G contributed importantly to the ease and speed of daily PURPLE solutions when 27-year-old Lieutenant (j.g.) Francis A. Raven discovered the key to the keys. After a number of PURPLE messages had been solved, Raven observed that the daily keys within each of the three ten-day periods of a month appeared to be related. He soon found that the Japanese simply shuffled the first day’s key to form the keys for the next nine days, and that the nine shuffling patterns were the same in all the ten-day periods. Raven’s discovery enabled the cryptanalysts to predict the keys for nine out of ten days. The cryptanalysts still had to solve for the first day’s key by straightforward analysis, but this task and its delays were eliminated for the rest of the period. Furthermore, knowledge of the shuffles enabled the codebreakers to read all the traffic of a period even though they could solve only one of the daily keys.

This fine piece of work, on the shoulders of the tremendous initial Fried-man-S.I.S. effort, resulted in the paradoxical situation of Americans reading the most difficult Japanese diplomatic system more quickly and easily than some lower-grade systems. They also became very facile in reading two-step systems in which PURPLE superenciphered an already coded message. The Japanese did this from time to time to provide extra security, usually with the CA code, the personal code of an ambassador or head of mission. A year after S.I.S. handed in its first PURPLE solution, the cryptanalysts solved a message enciphered in “the highest type of secret classification used by the Japanese Foreign Office.” The message was first enciphered in CA; this was then juggled according to the K9 transposition (normally used with the J19 code), and the transposed codetext was then enciphered on the PURPLE machine. The solution, which on the basis of the number of combinations involved might have been expected to take geologic eons, was completed in just four days.

The question of who should receive this hard-won, easily-lost information was the knottiest, most nagging, most intractable problem in the whole operation of MAGIC. It involved a delicate balancing of security against utility. On the one hand was the need to turn the results to as much good effect as possible, and the more persons who saw it the greater its value would be. “I see no use in breaking a cipher,” one admiral remarked dryly, “unless you use its contents.” On the other hand was the danger that too wide a distribution would jeopardize this invaluable intelligence by increasing the possibility of a leak. In general, policy leaned heavily toward security, toward minimizing the risk as much as practicable by narrowly restricting the number of recipients.

In an agreement dated January 23, 1941, the intelligence chiefs of the Army and the Navy listed those eligible to see MAGIC. The ten named comprised perhaps the most elite group in the American power structure of the day: the President, the secretaries of State, War, and Navy, the Chief of Staff, the Chief of Naval Operations, the heads of the Army and Navy War Plans divisions, and the heads of the Army and Navy intelligence divisions. In practice, of course, many others saw the intercepts, such as McCollum, the heads of the Army and Navy communications divisions (which controlled the cryptanalytic bureaus), and the cryptanalysts and translators themselves. In time so did others not on the original list nor involved in the processing. By December the Navy’s Assistant Chief of Naval Operations was regularly reading MAGIC. On the White House staff, President Roosevelt’s right-hand man, Harry Hopkins, and the President’s military and naval aides saw MAGIC; in fact, when Hopkins was confined to the Navy Hospital in November of 1941, Kramer brought it over to him specially. While Marshall interpreted the rules strictly and did not even entrust one of his closest assistants, Colonel Walter Bedell Smith, secretary to the general staff, with a key to the MAGIC briefcase, other officials, like Hull, Knox, and Stark, let their aides handle the details and so see the intercepts. In addition, at least four subordinate State Department officers saw MAGIC with fair regularity: Sumner Welles, the Under Secretary; Dr. Stanley K. Hornbeck, advisor on political relations; Maxwell M. Hamilton, chief of the Far Eastern desk, and Joseph W. Ballan-tine, a Far Eastern expert.

Excluded from this tiny group were the field commanders of major military and naval forces. Security mainly controlled, but the feeling that this high-level, mainly political information should be analyzed in Washington contributed to this decision. But while the actual intercepts—indeed, the very existence of MAGIC—were kept from them, such intelligence extracted from it as Washington thought would help them was sent to them, usually attributed to “highly reliable sources.” For example, on July 8, Lieutenant General Walter C. Short, commanding in Hawaii, was told that “Movement of Jap shipping from Japan has been suspended and additional merchant vessels are being requisitioned.” This information came from MAGIC.

The Philippines constituted a special case. Cavite was the Navy’s most favorably situated intercept post for Tokyo radio traffic, particularly Tokyo-Berlin, of which Hawaii, the East and West coasts, and England combined could not get more than 50 per cent. To cut the number of retransmissions of intercepts from Cavite to Washington, and thus reduce the danger of Japanese discovery of the MAGIC operation, the Navy in March sent out a PURPLE machine to the Philippines, OP-20-GY radioed the daily PURPLE and J19 keys to Fabian’s unit; he applied these to the messages intercepted by his and the Army’s intercept stations. He was then to forward the important solutions by radio. This procedure was practically abandoned later in the year, when almost every PURPLE message was important and all intercepts bearing its indicator were retransmitted to Washington. The Philippines were also regarded as the most threatened American outpost, and since diplomatic MAGIC was available right there because of a geographical accident, it went to General Douglas MacArthur and to Admiral Thomas C. Hart.

In sending the MAGIC keys to Fabian, OP-20-GY employed a restricted cipher. Had the messages been sent using the general Navy keys, any of the many ships and shore installations holding those keys could have read them. Worse, had the Japanese worked an Oriental MAGIC of their own on these general keys, they would have learned of America’s most precious secret. The most secure naval cryptosystem was the E.C.M., or Electric Coding Machine, a device similar to but much stronger than PURPLE, which used a kind of code-wheel called a rotor. The MAGIC cipher used the E.C.M. with a special set of rotors, resulting, in effect, in a new cipher. Traffic in this cryptochannel, called COPEK, was kept down, and extra precautions were taken to guard against occurrences that might aid cryptanalysis. Only officers of the radio intelligence organizations in Washington, Cavite, and Honolulu held the rotors. They also used COPEK to exchange information on Japanese naval codes that they were solving.

Rochefort in Hawaii could read the COPEK messages sending diplomatic-code keys to Fabian, and it may have been from him that Lieutenant Commander Edwin T. Layton, intelligence officer for the Pacific Fleet, learned that the Asiatic Fleet had the diplomatic MAGIC. On March 11, 1941, he asked McCollum to send it out to him. The head of the Far Eastern branch of naval intelligence declined, expounding what might be called the official line. On April 22 he wrote:

I thoroughly appreciate that you would probably be much helped in your daily estimates if you had at your disposal the DIP. This, however, brings up matters of security, et cetera, which would be very difficult to solve…. It seems reasonable to suppose that the Department should be the origin for evaluated political situations, as its availability of information is greater than that of any command afloat, however large, its staff is larger and it should be in a position to evaluate the political consequences…. I should think that the forces afloat should, in general, confine themselves to the estimate of the strategic and tactical situations with which they will be confronted when the time of action arrives. The material you mentioned can necessarily have but passing and transient interest as action in the political sphere is determined by the Government as a whole and not by the forces afloat…. In other words, while you and the Fleet may be highly interested in politics, there is nothing that you can do about it.

The inconsistency of this position reflects Washington’s more basic inconsistency of, on the one hand, trying to keep MAGIC from the field commanders for security reasons and, on the other, constructing PURPLE machines for them.

Nevertheless, despite Washington’s determination not to send MAGIC to the field, not to use the ordinary Navy cipher for it, and never to identify it as such in dispatches, the Navy in July wired Admiral Husband E. Kimmel, commanding the Pacific Fleet, a whole series of messages that gave the very serial numbers of the Japanese diplomatic messages in summarizing their contents! And on July 19, Washington began a message “PURPLE 14 July Canton to Tokyo” and continued with a quote from it. This practice ceased in August, suggesting tightened security, but again on December 3 the Navy clearly indicated Japanese intercepts as the source of its information.

The tightening may have resulted from several scares that Washington had just had. In March, State lost MAGIC memorandum No. 9. A horrified Army intelligence officer once found another MAGIC memorandum casually discarded in the wastebasket of Brigadier General Edwin M. (Pa) Watson, the President’s military aide. In Boston the F.B.I, picked up a man connected with the cryptanalytic work who was attempting to sell information on it. The worst frights of all came in the spring of 1941.

On the afternoon of April 28, Hans Thomsen, counselor of the German embassy in Washington, cabled his Foreign Ministry, in a message not read by the U.S.: “As communicated to me by an absolutely reliable source, the State Department is in possession of the key to the Japanese coding system and is therefore also able to decipher telegrams from Tokyo to Ambassador Nomura here regarding Ambassador Oshima’s reports from Berlin.” After thinking about it for a few days, Berlin gave this information to its Axis ally through Baron Hiroshi Oshima, the Japanese ambassador to Germany. He passed it to Tokyo on May 3 in a cable saying he believed it, and Tokyo, on May 5, asked Washington “whether you have any suspicion” of the matter. The American codebreakers, who had been following the Japanese messages from Berlin to Tokyo to Washington, held their breath. They remembered how Japan had canceled her J12 code in 1940 on her first inkling that the British and Dutch were reading it. But Nomura’s reply—“The most stringent precautions are taken by all custodians of codes and ciphers”—evidently soothed the Foreign Office, for it contented itself with issuing stricter regulations for coding.

Then, on May 20, Nomura told Tokyo: “Though I do not know which ones, I have discovered the United States is reading some of our codes.” The cryptanalysts shuddered. Would they have to start all over again? Nothing happened at once, but a few days later an incident made it appear that only the shipment of new systems from Japan was delaying the change of codes. On May 30, Japan prohibited her merchant vessels all over the world from further use of Code S. More to the point, she did so less than 24 hours after she learned that U.S. narcotics agents had removed codes from the tanker Nichi Shin Maru near San Francisco during a search.

The dreaded change of code, which would have cost the United States her best source of information just as it was needed more and more, now seemed inevitable. But morning after morning, the messages bore the same aspect and continued to break down under the same treatment. After days of anxious waiting, Navy cryptanalysts read a cable from Tokyo to Mexico on June 23, warning the legation: “There are also some suspicions that they [the Americans] read some of our codes. Therefore, we wish to exercise the utmost caution in accomplishing this mission.”

Was this to be the extent of the Japanese security precautions? It seemed incredible, yet it appeared so. The cryptosystems continued unchanged. The Foreign Office capped its ludicrous cryptosecurity program of pointless warnings and regulation changes with a step that was almost as effective as the others: on November 25, it directed its embassies to print “Kokka Kimitsu” (“State Secret”) in red enamel on the right of the number plate of their cipher machines. Perhaps they thought that this incantation would prevent cryptanalysis as an amulet was supposed to ward off sickness!

But if the Foreign Office discredited the rumors of solution (because, in its natural pride, it could not imagine its codes being anything but impregnable), the American recipients of MAGIC knew that they were all too true. In 1939, the director of naval intelligence had personally brought MAGIC in a looseleaf folder to a recipient, waited there while he read it, then took the folder on to the next recipient. The increasing volume of MAGIC had slowly eaten away at this original iron security. Colonel Rufus S. Bratton, chief of the Far Eastern section of Army intelligence, found himself wasting so much time chaperoning his single copy that he began to have duplicates and triplicates made. The number of copies grew from 4 in early 1941 to 14 by December. Subordinates assumed the time-consuming messenger function. Kramer took over for the Navy. Bratton, who had a higher rank and more responsibilities than Kramer (his opposite number was Kramer’s superior, McCollum), had to delegate some of this work still further. Three assistants in the Japan subsection of his Far Eastern section, Lieutenant Colonel Carlisle C. Dusenbury, Major Wallace H. Moore, and Second Lieutenant J. Bayard Schindel, made some of his rounds for him. Instead of carrying around a single folder, copies were left with the recipient.

Marshall saw danger in all this: “I intervened very directly and required that it [MAGIC] be locked in a pouch and delivered by pouch, the pouch unlocked and it be read by the recipient and put back in the pouch.” The “pouches” were actually zippered briefcases made by the Washington leather shop of Becker & Co. Each had a padlock to which there were only two keys, one held by the disseminator, one by the recipient, either personally or by his aide. This crackdown—about September—compelled the executive officer of the military intelligence division, who had been seeing MAGIC while his chief was on leave, to surrender his key and to stop reading the intercepts. The Navy soon adopted the Marshall precautions. Kramer, for example, often sat next to the recipient and explained references, furnished background, answered questions, and so forth—which is why so valuable an officer was given the apparently menial messenger task. Nevertheless, departures from this ideal occurred. The messenger could not very well stand over the Secretary of War or the Chief of Naval Operations while the messages were being read. In the State Department, the pouch was actually left overnight and exchanged the next day for a new one.

Still, the documents circulated in a cloud of mystery and continuous precaution. When Kramer telephoned in advance to recipients to find out where they were before delivering the intercepts, he would say only guarded words like, “I have something important that you should see.” Bratton’s immediate superior frequently saw him “leave his office with several parcels under his arm and be gone for several hours,” and, because he knew that his superior wanted it that way, never asked about it. He also received packages from S.I.S. chief Minckler when Bratton was out; these he locked up in his safe and turned over to Bratton on his return without having looked into them. Before MAGIC was given to State, Army and Navy officers met with Hull to explain how a loose word could suddenly extinguish the light shed by these intercepts. When Knox received the documents at his apartment, he did not explain them to his wife. At high-level conferences, recipients took care not to mention MAGIC when men not privy to the secret attended. All copies had to be returned. No recipient could retain them for reference, though back copies were sometimes included in new folders when later messages referred to them. The cryptanalytic agencies each filed two copies, one by date, one by subject, and the Far Eastern sections of Army and Navy intelligence each kept one. All other copies were burned.

Before an intercept could even begin the rounds that would end in this fiery immolation, it ordinarily had to be translated, and translation was the bottleneck of the MAGIC production line. Interpreters of Japanese were even scarcer than expert cryptanalysts. Security precluded employing Nisei or any but the most trustworthy Americans. The Navy scoured the country for acceptable translators, and through prodigious efforts in 1941 it doubled its GZ translation staff—to six. These included three whom Kramer called “the most highly skilled Occidentals in the Japanese language in the world.”

But ability in standard Japanese alone did not suffice. Each translator had to have at least a year’s experience in telegraphic Japanese as well before he could be trusted to come through with the correct interpretation of a dispatch. This is because telegraphic Japanese is virtually a language within a language, and, as McCollum, himself a Japanese-language officer, explained, “the so-called translator in this type of stuff almost has to be a cryptographer himself. You understand that these things come out in the form of syllables, and it is how you group your syllables that you make your words. There is no punctuation.

“Now, without the Chinese ideograph to read from, it is most difficult to group these things together. That is, any two sounds grouped together to make a word may mean a variety of things. For instance, ‘ba’ may mean horses or fields, old women, or my hand, all depending on the ideographs with which it is written. On the so-called translator is forced the job of taking unrelated syllables and grouping them into what looks to him to be intelligible words, substituting then such of the Chinese ideographs necessary to pin it down, and then going ahead with the translation, which is a much more difficult job than simple translation.”

Hence the situation of Mrs. Dorothy Edgers. She had lived for thirty years in Japan and had a diploma from a Japanese school to teach Japanese to Japanese students up to high-school level. Yet, because she had only two weeks’ experience in GZ at the time of Pearl Harbor, Kramer considered her “not a reliable translator” in this field. And on the important messages, only reliable translators could be used. To unclog this bottleneck, messages in the minor systems were given only a partial translation. If a translator saw that they dealt with administrative trivia, they were frequently not formally translated at all.

With manifold streamlinings like that, with enlarged staffs, with the fluidity gained by experience, OP-20-G and S.I.S. gradually increased the speed and quantity of their output. In 1939, the agencies had often required three weeks to funnel a message from interceptor to recipient. In the latter part of 1941 the process sometimes took as little as four hours. Occasionally an agency broke down a late intercept that bore on a point of Japanese-American negotiations and rushed it to the Secretary of State an hour before he was to meet with the Japanese ambassadors. Volume attained overwhelming proportions. By the fall of 1941, 50 to 75 messages a day sluiced out of the two agencies, and at least once the quantity swelled to 130. Some of these messages ran to 15 typewritten pages.

The top-echelon recipients of MAGIC clearly could not afford the time to read all this traffic. Much of it was of secondary importance anyway. Kramer and Bratton winnowed the wheat from this chaff. Reading the entire output, they chose an average of 25 messages a day for distribution. At first Kramer supplemented his translations with gists for recipients too busy to read every word of the actual intercepts, starring the important ones, but he abandoned these in mid-November under the pressure of getting out the basic material. Bratton, who had been delivering summaries of MAGIC in the form of Intelligence Bulletins, began on August 5 to distribute MAGIC verbatim at Marshall’s orders. This, however, had the effect of increasing the volume. Marshall complained that to absorb every word of it he would have had to “retire as Chief of Staff and read every day.” To save the recipients’ time, Bratton checked the important messages on a list in the folder with a red pencil; Kramer slid paper clips onto them. The recipients always read the flagged messages; the others they did not always read thoroughly, but they did leaf through the folder and skim them.

Distribution was usually made twice a day. Intercepts that had come in overnight went out in the morning, those processed during the day went out at the end of the afternoon. Especially important messages were delivered at once, often to the recipients’ homes if late in the evening. Each agency sent its MAGIC copies on to the other with exemplary promptitude, despite a natural competition between them. As Bratton put it: “I was further urged on by the fact that if the Chief of Naval Operations ever got one of these things before General Marshall did and called him up to discuss it on the telephone with him, and the General hadn’t gotten his copy, we all caught hell.” (Marshall demurred: “I don’t think I gave anybody hell much.”)

Delivery to the White House and the State Department incurred difficulties. Under the January 23 agreement, the Army and Navy at first alternated in servicing the two. The Army, however, discontinued its deliveries to the White House after its turn in May, partly because of Watson’s wastebasket security bungle, partly because it felt that these diplomatic matters should go to the President through the State Department. The Navy continued its deliveries through the President’s naval aide, Captain John R. Beardall, though once in the summer Kramer himself carried a particularly “hot” message—probably dealing with negotiations the next day—to Roosevelt. Near the end of September, a month originally scheduled for Army delivery, during which nothing was delivered to the White House, the President said he wanted to see the intercept information. In October naval intelligence sent him memoranda based on MAGIC, but on Friday, November 7, Roosevelt said he wanted to see MAGIC itself. Beardall told him that it was an Army month. The President replied that he knew that and that he was either seeing MAGIC or getting information on it from Hull, but that he still wanted to see the original intercepts. He feared that condensing them would distort their meaning. On Monday, a conference agreed that the Navy would furnish the White House with MAGIC and the Army the State Department. At 4:15 p.m., Wednesday, November 12, Kramer made the first distribution to the White House under this system.

Thus, by the fall of 1941, MAGIC was being demanded at the topmost level of government. It had become a regular and vital factor in the formation of American policy. Hull, who looked upon MAGIC “as I would a witness who is giving evidence against his own side of the case,” was “at all times intensely interested in the contents of the intercepts.” The chief of Army intelligence regarded MAGIC as the most reliable and authentic information that the War Department was receiving on Japanese intentions and activities. The Navy war plans chief thought that MAGIC, which was largely diplomatic at this time, affected his estimates by about 15 per cent. The high officials not only read MAGIC avidly and discussed it at their conferences, they acted upon it. Thus the decision to set up the command of United States Army Forces, Far East, which was headed by General MacArthur, stemmed directly from intercepts early in 1941 showing that Germany was pressuring Japan to attack Britain in Asia in the hope of involving the United States in the war; on the basis of this information, the command was created in July to deter Japan by enhancing American prestige in the Western Pacific—and it is a fact that Japan did not then comply with Germany’s wishes.

The intricate mechanism of the American cryptanalytic effort pumped MAGIC to its eager recipients smoothly, speedily, and lavishly. Messages flew back and forth along the COPEK channel as if along nerve cells. Intercepts poured into Washington with less and less of a time lag. S.I.S. and GY grew increasingly adept at solution; the translators picked out the important messages ever more surely. Bratton and Kramer hustled from place to place with their locked briefcases, MAGIC gushed forth in profusion. So effectively did the cryptanalytic agencies perform that Marshall could say of this “priceless asset,” this most complete and up-to-the-minute intelligence that any nation had ever had concerning a probable enemy, this necromantic gift of the gods of which one could apparently never have enough, that “There was too much of it.”

In October the cabinet of Prince Konoye fell, and the Emperor summoned General Hideki Tojo to form a new government. One of the first acts of the new Foreign Minister, Shigenori Togo, was to call in the chief of the cable section. Togo, remembering a book that Herbert O. Yardley had written disclosing his 1920 solution of Japanese diplomatic codes, asked the cable chief, Kazuji Kameyama, whether their current diplomatic communications were secure. Kameyama reassured him. “This time,” he said, “it’s all right.”

With the assumption of total power by the militarists under Tojo, the last real hopes for peace died. Almost at once, events began to slide toward war. On November 4, Tokyo sent to her ambassadors at Washington the text of her proposal B, which Togo described as “absolutely final.” The ambassadors held it while they pursued other avenues, even though Tokyo, on November 5, told them that “Because of various circumstances, it is absolutely necessary that all arrangements for the signing of this agreement be completed by the 25th of this month.”

That same day, Yamamoto promulgated Combined Fleet Top Secret Order Number 1, the plan for the Pearl Harbor attack. Two days later, he set December 8 (Tokyo time) as Y-day and named Vice Admiral Chuichi Nagumo as Commander, First Air Fleet—the Pearl Harbor strike force. In the days that followed, the 32 ships that were to compose the force slipped, one by one, out to sea and vanished. Far from any observation, they headed north to rendezvous in a bay of barren Etoforu Island, one of the chill, desolate Kuriles north of the four main islands of Japan. Behind them the ships left their regular wireless operators to carry on an apparently routine radio traffic in their own “fists,” or sending touch, which is as distinctive as handwriting.

As the force was gathering, the Foreign Office, which knew only that the situation was tense and was never told in advance of the time, place, or nature of the planned attack, prepared an open-code arrangement as an emergency means of notification. Tokyo sent Circular 2353 to Washington on November 19:

Regarding the broadcast of a special message in an emergency.

In case of emergency (danger of cutting off our diplomatic relations), and the cutting off of international communications, the following warning will be added in the middle of the daily Japanese language short-wave news broadcast:

1. In case of Japan-U.S. relations in danger: HIGASHI NO KAZE AME (“east wind rain”)

2. Japan-U.S.S.R. relations: KITA NO KAZE KUMORI (“north wind cloudy”)

3. Japan-British relations: NISHI NO KAZE HARE (“west wind clear”)

This signal will be given in the middle and at the end as a weather forecast and each sentence will be repeated twice. When this is heard please destroy all code papers, etc. This is as yet to be a completely secret arrangement.

Forward as urgent intelligence.

This open code related the winds to the compass points in which the named countries stood in regard to Japan: the U.S. to the east, Russia to the north, England to the west. Tokyo also set up an almost similar code for use in the general intelligence (not news) broadcasts.

As the secret messages establishing these open codes whistled through the air, Navy intercept Station S at Bainbridge Island heard and nabbed them. The station teletyped them to GY, which identified them as J19 and began cryptanalysis.

Many of the ships of the Pearl Harbor strike force had by then gathered in bleak Tankan Bay, where the only signs of human presence were a small concrete pier, a wireless shack, and three fishermen’s huts. Snow covered the surrounding hills. In the gray twilight of November 21, the great carrier Zuikaku glided into the remote harbor to complete the roster. The force swung at anchor, awaiting the order to sortie.

A few hours later, on November 20 (Washington time), the Japanese ambassador to the United States, Admiral Kichisaburo Nomura, and his newly arrived associate, Saburo Kurusu, presented Japan’s ultimatum to Hull. It would have required the United States to reverse its foreign policy, acquiesce in further Japanese conquests, supply Japan with as much oil as she required for them, abandon China, and in effect surrender to international immorality. While Hull began drafting a reply, Tokyo cabled its ambassadors in message 812 that “There are reasons beyond your ability to guess why we wanted to settle Japanese-American relations by the 25th, but if within the next three or four days you can finish your conversations with the Americans; if the signing can be completed by the 29th (let me write it out for you—twenty-ninth); if the pertinent notes can be exchanged; if we can get an understanding with Great Britain and the Netherlands; and in short if everything can be finished, we have decided to wait until that date. This time we mean it, the deadline absolutely cannot be changed. After that things are automatically going to happen.” Two days later, Togo wirelessed: “The time limit set in my message No. 812 is in Tokyo time.”

The calendar had become a clock, and the clock had begun to tick.

On November 25, Yamamoto ordered the Pearl Harbor strike force to sortie next day. At 6 a.m. on November 26, the 32 ships of the force—six carriers, two battleships, and a flock of destroyers and support vessels—weighed anchor and sliced across the wrinkled surface of Tankan Bay. They steamed slightly south of east, heading into the “vacant sea”—the wintry North Pacific, whose wastes were undefiled by merchant tracks and whose empty vastness would swallow up the force. They had been ordered to return if detected before December 6 (Tokyo time); if discovered on December 7, Nagumo would decide whether or not to attack. Strict radio silence was enjoined. Aboard the battleship Hiei, Commander Kazuyoshi Kochi, a communications officer for the force, removed an essential part of his transmitter and put it in a wooden box, which he used as a pillow. The force drove eastward through fog, gale winds, and high seas. No one saw them.

Meanwhile, Hull, after a frantic week of drafting, consultations, and redraftings, had completed the American reply to Japan’s proposal. It called upon Japan to withdraw all forces from China and Indochina and in return promised to unfreeze Japanese funds and resume trade. Nothing was said about oil. On November 26, the day that he handed it to Nomura and Kurusu, a message came from Tokyo setting up an open code for them for telephone use to speed up their reports. In it, the President was MISS KIMIKO, Hull was MISS FUMEKO, Japanese-American negotiations were to be referred to as a MARRIAGE PROPOSAL, the criticality of the situation as the imminence of the birth of a child, the China question as SAN FRANCISCO, and so on. They had occasion to use it the very next night to report on an interview with Hull. Kurusu talked for seven minutes, starting at 11:27 p.m. Washington time, with Kumaicho Yamamoto, the chief of the American bureau of the Japanese Foreign Office.{3} American interceptors had their recording machine running even before the Japanese started theirs, and succeeded in capturing even this rare form of communication. Kramer translated the conversation, interpreted the rather amateurish application of the open code (even detecting an attempt to bolster it with some extraneous comments), added the colorful description of vocal nuances and pauses, and distributed it with the routine MAGIC intercepts the following day.

[Secret]

From: Washington

To: Tokyo

27 November 1941 (2327-2334 EST)

(Telephone Code)—(See JD-1: 6841) (S. I. S. #25344)

Trans-Pacific

Telephone

(Conversation between Ambassador Kurusu and Japanese Foreign Office American Division Chief, Yamamoto.)

Literal translation	Decode of Voice Code
(After connection was completed:)
KURUSU: “Hello, hello. This is Kurusu.”
YAMAMOTO: “This is Yamamoto.”
KURUSU: “Yes, Hello, hello.”
(Unable to get Yamamoto for about six or eight seconds, he said aside, to himself, or to someone near him:)
KURUSU: “Oh, I see, they’re making a record of this, huh?”
(It is believed he meant that the six-second interruption was made so that a record could be started in Tokyo. Interceptor’s machine had been started several minutes earlier.)
KURUSU: “Hello. Sorry to trouble you so often.”
YAMAMOTO: “How did the matrimonial question get along today?”	“How did the negotiations go today?”
KURUSU: “Oh, haven’t you got our telegram† yet? It was sent—let me see—at about six—no, seven o’clock. Seven o’clock. About three hours ago.
“There wasn’t much that was different from what Miss Fumeko said yesterday.”	There wasn’t much that was different from Hull’s talks of yesterday.”
YAMAMOTO: “Oh, there wasn’t much difference?”
KURUSU: “No, there wasn’t. As before, that southward matter—that south, SOUTH—southward matter, is having considerable effect. You know, southward matter.”
YAMAMOTO (Obviously trying to indicate the serious effect that Japanese concentrations, etc. in French Indo-China were having on the conversations in Washington. He tries to do this without getting away from the “Miss Fumeko childbirth, marriage” character of the voice code.):
YAMAMOTO: “Oh, the south matter? It’s effective?”
KURUSU: “Yes, and at one time, the matrimonial question seemed as if it would be settled.”	“Yes, and at one time it looked as though we could reach an agreement.”
KURUSU: “But—well, of course, there are other matters involved too, but—that was it—that was the monkey wrench. Details are included in the telegram{4} which should arrive very shortly. It is not very long and you’ll be able to read it quickly.”
YAMAMOTO: “Oh, you’ve dispatched it?”
KURUSU: “Oh, yes, quite a while ago. At about 7 o’clock.”
(Pause.)
KURUSU: “How do things look there? Does it seem as if a child might be born?”	“Does it seem as crisis is at hand?”
YAMAMOTO (In a very definite tone): “Yes, the birth of the child seems imminent.”	“Yes, a crisis does appear imminent.”
KURUSU: (In a somewhat surprised tone, repeating Yamamoto’s statement:)
“It does seem as if the birth is going to take place?”	“A crisis does appear imminent?”
(Pause.)
KURUSU: “In which direction …”
(Stopped himself very abruptly at this slip which went outside the character of the voice code. After a slight pause he quickly recovered, then to cover up the slip, continued:)
KURUSU: “Is it to be a boy or a girl?”
YAMAMOTO (Hesitated, then laughing at his hesitation took up Kurusu’s cue to reestablish the voice code character of the talk. The “boy, girl, healthy” byplay has no other significance.):
YAMAMOTO: “It seems as if it will be a strong healthy boy.”
KURUSU: “Oh, it’s to be a strong healthy boy?”
(Rather long pause.)
YAMAMOTO: “Yes.”
“Did you make any statement (to the newspapers) regarding your talk with Miss Kimiko today?”	“Did you make any statement regarding your talks with the President today?”
KURUSU: “No, nothing. Nothing except the mere fact that we met.”
YAMAMOTO: “Regarding the matter contained in the telegram{1} of the other day, although no definite decision has been made yet, please be advised that effecting it will be difficult.”
KURUSU: “Oh, it is difficult, huh?”
YAMAMOTO: “Yes, it is.”
KURUSU: “Well, I guess there’s nothing more that can be done then.”
YAMAMOTO: “Well, yes.”
(Pause.)
YAMAMOTO: “Then, today …”
KURUSU: “Today?”
YAMAMOTO: “The matrimonial question, that is, the matter pertaining to arranging a marriage—don’t break them off.”	“Regarding negotiations, don’t break them off.”
KURUSU: “Not break them? You mean talks.”
(Helplessly:)
KURUSU: “Oh, my.”
(Pause, and then with a resigned laugh:)
KURUSU: “Well, I’ll do what I can.”
(Continuing after a pause:)
KURUSU: “Please read carefully what Miss Kimiko had to say as contained in today’s telegram.”{1}	“Please read carefully what the President had to say as contained in today’s telegram.”{1}
YAMAMOTO: “From what time to what time were your talks today?”
KURUSU: “Oh, today’s was from 2:30.”
(Much repeating of the numeral 2.)
KURUSU: “Oh, you mean the duration? Oh, that was for about an hour.”
YAMAMOTO: “Regarding the matrimonial question.”	“Regarding the negotiations.”
“I shall send you another message. However, please bear in mind that the matter of the other day is a very difficult one.”
KURUSU: “But without anything,—they want to keep carrying on the matrimonial question. They do. In the meantime we’re faced with the excitement of having a child born. On top of that Tokugawa is	“But without anything,—they want to of keep on negotiating, In the meantime we really champing at the bit, isn’t he? Tokugawa is, isn’t he?”	have a crisis on hand and the army is champing at the bit. You know the army.”
(Laughter and pause.)
KURUSU: “That’s why I doubt if anything can be done.”
YAMAMOTO: “I don’t think it’s as bad as that.”
YAMAMOTO: “Well,—we can’t sell a mountain.”	“Well,—we can’t yield.”
KURUSU: “Oh, sure, I know that. That isn’t even a debatable question any more.”
YAMAMOTO: “Well, then, although we can’t yield, we’ll give you some kind of a reply to that telegram.”
KURUSU: “In any event, Miss Kimiko is leaving town tomorrow, and will remain in the country until Wednesday.”	“In any event, the President is leaving town tomorrow, and will remain in the country until Wednesday.”
YAMAMOTO: “Will you please continue to do your best.”
KURUSU: “Oh, yes. I’ll do my best. And Nomura’s doing everything too.”
YAMAMOTO: “Oh, all right. In today’s talks, there wasn’t anything of special interest then?”
KURUSU: “No, nothing of particular interest, except that it is quite clear now that that southward—ah—the south, the south matter is having considerable effect.”
YAMAMOTO: “I see. Well, then, good-bye.”
KURUSU: “Good-bye.”
25443
JD-1: 6890	(M) Navy Trans. 11-28-41 ( )

The same day that this conversation was held, Tokyo circularized its major embassies with still another open code. While the winds code envisioned abolition of all communication with the embassies, this new code—called the INGO DENPO (“hidden word”) code—was intended for a less critical situation. It seems to have been arranged at the request of the consul in Singapore in case code but not plain language telegrams were prohibited. It set up such equivalences as ARIMURA = code communications prohibited; HATTORI = relations between Japan and (name of country) are not in accordance with expectation;{6} KODAMA = Japan; KUBOTA = U.S.S.R.; MINAMI = U.S.A.; and so on. “In order to distinguish these cables from others,” Tokyo said, “the English word STOP will be added at the end as an indicator. (The Japanese word OWARI [end] will not be used.)”

The next day, November 28, the Navy cracked the transposition for the J19 message of nine days earlier and learned of the winds code arrangement. The cryptanalytic agencies saw at once that this arrangement, which dispensed with the entire routine of coding, cabling, delivery, and decoding, could give several hours’ advance warning of Japan’s intentions. They erupted into activity to try to intercept it. This wrenched facilities away from the commercial (for Japanese diplomatic), naval, and radiotelephone circuits with which the agencies were familiar and put them on voice newscasts.

The Army asked the Federal Communications Commission to listen for the winds code execute. Army stations at Hawaii and San Francisco tuned to the newscasts, as did Navy stations at Corregidor, Hawaii, and Bainbridge Island, and four or five along the Atlantic seaboard. Rochefort placed his four best language officers—Lieutenants Forrest R. Biard, J. R. Bromley, Allyn Cole, Jr., and G. M. Slonim—on a 24-hour watch on frequencies suggested by Washington and on others that his unit had found. The Dutch in Java and the British in Singapore listened. In Washington, Kramer made up some 3 × 5 cards for distribution to MAGIC recipients. They bore only the portentous phrases, “East Wind Rain: United States. North Wind Cloudy: Russia. West Wind Clear: England.”

Soon plain-language intercepts were swamping GZ. Bainbridge ran up bills of $60 a day to send them in. Kramer and the other translators, already burdened, now had also to scan 100 feet of teletype paper a day for the execute; previously only three to five feet per week of plain-language material had come in. The long strips were thrown into the wastebasket and burned after checking. Several times the GY watch officers telephoned Kramer at his home at night to ask him to come to the office and check a possible execute. It always proved false.

Meanwhile, other signs of increasing tension were not lacking. On the 29th, Baron Oshima in Berlin reported that the German Foreign Minister, Joachim von Ribbentrop, had told him, “Should Japan become engaged in a war against the United States, Germany, of course, would join the war immediately.” Next day, Tokyo replied, “Say very secretly to them that there is extreme danger that war may suddenly break out between the Anglo-Saxon nations and Japan through some clash of arms and add that the time of the breaking out of this war may come quicker than anyone dreams.” Both these messages were translated on December 1, and Roosevelt considered the latter so important that he asked for a copy of it to keep. Kramer, after paraphrasing it for security’s sake, gave him one.

At Pearl Harbor, Rochefort had just been presented with an unpleasant confirmation of that tautening situation. The Japanese fleet reassigned its 20,000 radio call-signs at midnight, December 1—only 30 days after the previous change. It was the first time in Rochefort’s experience that a switch had occurred so soon after a previous one.

The one on November 1 had been expected; it had followed by the usual six months the regular spring call-sign shift. With the facility born of long experience, Rochefort’s Combat Intelligence Unit identified in fairly rapid order the senders and receivers of a large percentage of the traffic. The unit observed the rising volume and southward routing of messages on the 200 radio circuits of the Japanese Navy. This fitted in almost perfectly with the widely known Japanese buildup for what the world thought was a strike at Siam or Singapore. By the third week in November, the unit had sensed the formation of a Third Fleet task force and its imminent departure in the direction of those areas. Aircraft carriers were not addressed during this buildup, nor did they transmit. To Rochefort, the situation shaped up like those of February and July, when Japanese fleet units moved south to support the takeover in French Indochina while the carriers remained in home waters as a reserve. They were there, he felt, to protect the exposed flank of the Japanese forces from the American fleet, which, from its bases at Cavite and Pearl, could sever the supply lines of the aggressor.

Rochefort’s view was shared by fleet intelligence officer Layton. He knew that the two main carrier divisions had not appeared in the traffic for at least two weeks, and maybe three. He suspected their presence in home waters, but since he lacked positive indications of it, he omitted his presumptions from a report on the Japanese fleet that he submitted to Kimmel on December 1. Whereupon, Layton recalled:

Admiral Kimmel said, “What! You don’t know where Carrier Division 1 and Carrier Division 2 are!”

I replied, “No, sir, I do not. I think they are in home waters, but I do not know where they are. The rest of these units, I feel pretty confident of their location.” Then Admiral Kimmel looked at me, as sometimes he would, with somewhat a stern countenance and yet partially with a twinkle in his eye, and said:

“Do you mean to say that they could be rounding Diamond Head and you wouldn’t know it?” or words to that effect. My reply was that “I hope they would be sighted before now,” or words to that effect.

On the same day that Layton gave his report to Kimmel, the Office of Naval Intelligence produced a memorandum of “Japanese Fleet Locations” that Layton, when he saw it, considered as “dotting the i’s and crossing the t’s” of his own estimates. It placed Akagi and Kaga (Carrier Division 1), and Koryu and Kasuga in southern Kyushu waters, and Soryu and Hiryu (Carrier Division 2) and Zuikaku, Shokaku, Hosho, and Ryujo at the great naval base of Kure. All this was just a more precise way of saying “home waters.”

These estimates were based on the November observations. The call-sign change of December 1 obliterated the intricate communication networks that the radio intelligence units had so painstakingly built up and forced them to begin anew. The Japanese bedeviled them with new communication-security measures. Dispatches were sent “on the umbrella”—broadcast to the fleet at large and copied by all ships. This sort of blanket coverage made identification difficult. Multiple addresses were used. They sent dummy traffic, which, however, did not confuse the listeners. Just before the change, the communicators passed many old messages. Rochefort’s unit spotted them, and guessed that they were attempts either to pad the volume or to get through to the addressee before the change caused routing difficulties.

On December 2, after only two days of analyzing the new calls, Rochefort’s unit stated in its Communications Intelligence Summary: “Carriers—Almost a complete blank of information of the Carriers today. Lack of identifications has somewhat promoted this lack of information. However, since over two hundred service calls have been partially identified since the change on the first of December and not one carrier call has been recovered, it is evident that carrier traffic is at a low ebb.” In the next day’s summary appeared the last mention of carriers before December 7, and it was rather negative: “No information on submarines or carriers.”

Other messages, however, clearly indicated the drive to the south, which Japan made no attempt to conceal. Twice before, Rochefort, Fabian, Layton, and O.N.I. had seen exactly the same conditions, and twice before their reasoning that the carriers were being held in empire waters had been proved right. Now, they thought, they were seeing it happen again. Temporarily oblivious to the possibility of a surprise attack on Pearl Harbor, they watched the forces moving against Malaya as hypnotically as a conjuror’s audience stares at the empty right hand while the left is pulling the ace out of a sleeve.

American preconceptions were reinforced by two PURPLE messages of December 1, which the Navy read that same day. In the first, Tokyo directed Washington: “When you are faced with the necessity of destroying codes, get in touch with the naval attaché’s office there and make use of chemicals they have on hand for this purpose. The attaché should have been advised by the Navy Ministry regarding this.” Five days earlier, the cryptanalysts had read Tokyo’s detailed instructions on how to destroy the PURPLE machine in an emergency. These two code-destruction messages appeared to be just precautionary measures in a tense situation, and this impression was strengthened by the second message of December 1. It seemed to virtually announce a Japanese invasion of British and Dutch possessions and to relegate conflict with the United States to a subsequent date: “The four offices in London, Hongkong, Singapore and Manila have been instructed to abandon the use of the code machines and to dispose of them. The machine in Batavia has been returned to Japan. Regardless of the contents of my circular message #2447 [which MAGIC did not have], the U.S. (office) retains the machines and the machine codes.” American officials breathed easier. The messages appeared to give the United States a bit more of what it needed most—time, time to build up its pitifully weak Army and Navy.

While the world gazed with tunnel vision toward Southeast Asia, and American radio intelligence envisioned the Japanese carriers in home waters, six of them—Akagi, Kaga, Hiryu, Soryu, Shokaku, and Zuikaku—were in fact butting eastward through the high winds and waves of the vacant sea. Late in the afternoon of December 2, Tokyo time, the force picked up, apparently on a blanket broadcast, an electrifying open-code message intended for it: NIITAKA-YAMA NOBORE (“Climb Mount Niitaka”). It informed the strike force that the decision for war had been made and directed it to Proceed with attack. Niitaka-yama, also known as Mount Morrison, is a peak on Formosa whose 12,956-foot elevation made it the highest point of what was then the Japanese empire. The symbolism could not have been lost on the officers. The force refueled from its tankers.

There was trouble in Honolulu. The F.B.I. had, early in November, begun to tap the telephone of the manager of an important Japanese firm in the hope of obtaining some clues to possible espionage activity. The tap was in addition to those placed on the Japanese consulate by Mayfield, who was helped by an employee of the telephone company whom the 14th Naval District Intelligence Office had cultivated as its contact. Unexpectedly, however, a telephone repairman came across the jumper wire that the F.B.I. had put across the connections in the junction box. The Navy’s contact man immediately tipped off Mayfield’s office, which warned the F.B.I.—who promptly complained to the telephone company that their confidence had been breached. Mayfield, fearful that the commotion would disclose his own telephone surveillances and that such disclosure would give the Japanese an excuse for almost any action, pulled his taps. His recording operator jotted a wistful farewell under his final notes. “At 4 p.m. Honolulu time in the 1941st year of Our Lord, December 2 inst., I bade my adieu to you my friend of 22 months standing. Darn if I won’t miss you!! Requiescat in Peace.” The F.B.I., however, maintained its other taps.

Earlier that day, the consulate had received Circular #2445 in J19, relayed by Washington from Tokyo:

Take great pains that this does not leak out.

You are to take the following measures immediately:

1. With the exception of one copy each of the o [PA-K2] and the L [LA] codes, you are to burn all telegraph codes (this includes the codebooks for communication between the three departments [HATO] and those for use by the Navy).

2. As soon as you have completed this operation, wire the one word HARUNA.

3. Burn all secret records of incoming and outgoing telegrams.

4. Taking care not to arouse outside suspicion, dispose of all secret documents in the same way.

Since these measures are in preparation for an emergency, keep this within your consulate and carry out your duties with calmness and care.

The codes were duly burned, including the TSU, or J19, in which the circular was transmitted. That evening Kita sent HARUNA. Henceforth the consulate code secretary, Samon Tsukikawa, would have to transmit the spy messages of Yoshikawa, alias Morimura, in the simpler PA-K2.

The first such message arranged four signaling systems by which a spy might report on the condition of the ships in Pearl Harbor. The arrangement had been submitted to Yoshikawa by an Axis spy in Hawaii, Bernhard Julius Otto Kühn. Nazi Propaganda Minister Josef Goebbels had transferred him to the islands in 1935 after a contretemps with Kühn’s daughter Ruth, who had become Goebbels’ mistress when she was 16. In his signaling system, Kühn stipulated that numbers from 1 to 8 would mean such things as A number of carriers preparing to sortie (which was 2) and Several carriers departed between 4th and 6th (which was 7). Then he arranged that bonfires, house lights shown at certain times and places, or want ads broadcast over radio station KGMG would mean certain numbers. For example, 7 would be represented by two lights shown in the window of a house on Lanikai Beach between 2 and 3 a.m., or by two sheets between 10 and 11 a.m., by lights in the attic window of a house in Kalama between 11 and 12 p.m., or by a want ad offering a complete chicken farm for sale and listing P.O. Box 1476. If all these failed, a bonfire on a certain peak of Maui Island between 8 and 9 p.m. would indicate 7. The purpose of the system was to eliminate dangerous personal contacts between Kühn and the Japanese. Kühn tested it on December 2, found that it worked, and passed it to Yoshikawa. He had it encoded (in PA-K2) and sent to Tokyo in two long parts on December 3.

It was now the third day of the month in which the Japanese consulate gave its cable business to R.C.A. Following Sarnoff’s instructions, George Street, district manager of the firm, had had the Japanese consulate messages copied on a blank sheet of paper with no identification of the sender or addressee. About 10 or 11 a.m., December 3, Mayfield called at the branch office and Street slipped him a blank envelope containing the messages. As soon as Mayfield returned to the District Intelligence Office, he had a messenger bring them down to Rochefort.

In Washington that Wednesday, the Signal Intelligence Service solved a PURPLE message from Tokyo—and the readers of MAGIC, who only two days earlier had been lulled by the supposition that Japan might temporarily spare the United States, were stunned by the realization that the arrow of war might be loosed momentarily. For the message ordered the Washington embassy to “burn all [codes] but those now used with the machine and one copy each of o code [PA-K2] and abbreviating code [LA]…. Stop at once using one code machine unit and destroy it completely … wire … HARUNA.” Under Secretary of State Welles saw it and felt that “the chances had diminished from one in a thousand to one in a million that war could then be avoided.” When the President’s naval aide, Beardall, brought the message to Roosevelt, he said in substance, “Mr. President, this is a very significant dispatch.” After the Chief Executive had read it carefully, he asked Beardall, “When do you think it will happen?”—referring to the outbreak of war. “Most any time,” replied the naval aide, who thought that the moment was getting very close.

Consul Nagao Kita sends the codeword HARUNA to report his codes destroyed

At the Japanese embassy at 2514 Massachusetts Avenue, the code clerks were executing these destruction orders. The code room stood at the southeast corner of the embassy, with windows overlooking the embassy parking lot and another legation next door. Half a dozen desks clustered in the middle of the room. Two cipher machines waited on desks against the west wall and a third, broken, rested in the walk-in safe. In utter disregard of the regulations promulgated for the security of communications, the embassy had hired an elderly Negro janitor named Robert to dust and clean the code room and its supersecret furnishings each day. The code clerks did make some obeisance to the security regulations by not allowing him in the room unless some Japanese were in it. But the situation was, to say the least, ironical. While the Japanese Foreign Office was exercising almost superhuman security precautions and American cryptanalysts were suffering nervous breakdowns to solve the PURPLE machine, an American citizen was running his duster over tables on which stood the intricate machines that were the vortex of this silent struggle.

But just as the Japanese seemed not to have given serious thought to the possibility of Robert’s being a spy, so the Americans seemed to have given no serious thought to the possibility that a spy might have been insinuated into the Japanese embassy to ease their cryptanalytic burden. Of course, even if they had thought about it, they might have rejected the idea, for discovery of the spy would have meant an automatic change of codes. The danger of this was much less if the systems were read through cryptanalysis.

The paper codes of the Japanese consisted of folders whose four or six pages could be opened into a single long sheet. Embassy Counselor Sadao Iguchi, who was in charge of the code room, directed telegraph officer Masana Horiuchi and code clerks Takeshi Kajiwara, Hiroshi Hori, Juichi Yoshida, Tsukao Kawabata, and Kenichiro Kondo in the burning of the paper codes. Demolition of the code machine was more complicated, and followed the guidelines transmitted recently by the Foreign Office. The machines were dismantled with a screwdriver, hammered into unrecognizability, and then dissolved in acid from the naval attaché’s office to destroy them thoroughly. Some of these operations were carried out in the gardens of the embassy; so when Bratton, who had read the code-destruction intelligence, sent an officer to the embassy to check, he obtained immediate confirmation.

Now the American officials realized the ominous meaning of the HARUNA messages that had been intercepted as they were sent from New York, New Orleans, and Havana and that had been received just that day in S.I.S. The Army and Navy high command universally regarded the destruction of codes as virtual certainty that war would break out within the next few days. As Stark’s deputy put it: “If you rupture diplomatic negotiations you do not necessarily have to burn your codes. The diplomats go home, and they can pack up their codes with their dolls and take them home. Also, when you rupture diplomatic negotiations you do not rupture consular relations. The consuls stay on. Now, in this particular set of dispatches they not only told their diplomats in Washington and London to burn their codes, but they told their consuls in Manila, in Hong Kong, Singapore, and Batavia to burn their codes and that did not mean a rupture of diplomatic relations; it meant war.”

A few hours after the code-destruction MAGIC reached Stark, he dispatched the electrifying news to Kimmel and Hart:

Highly reliable information has been received that categoric and urgent instructions were sent yesterday to Japanese diplomatic and consular posts at Hongkong X Singapore X Batavia X Manila X Washington and London to destroy most of their codes and ciphers at once and to burn all other important confidential and secret documents X

He followed this five minutes later with another message:

Circular twenty four forty four from Tokyo one December ordered London X Hongkong X Singapore and Manila to destroy PURPLE machine XX Batavia machine already sent to Tokyo XX December second Washington also directed destroy PURPLE X all but one copy of other systems X and all secret documents XX British Admiralty London today reports embassy London has complied

In Washington urgency drove out all thoughts of security. The strict injunction against ever mentioning MAGIC was completely overlooked. When Kimmel got the message, he asked Layton what “PURPLE” was. So tight had security been that neither of them knew. They checked with Lieutenant Herbert M. Coleman, the fleet security officer, who told them that it was a cipher machine similar to the Navy’s.

Marshall authorized his intelligence chief, Brigadier General Sherman Miles, to direct the military attaché in Tokyo to destroy most of his codes and ciphers:

Memorize emergency key word # 2 for use of SIGNUD without repeat without indicators destroy document Stop SIGNNQ SIGPAP and SIGNDT should be retained and used for all communications except as last resort when these documents should be destroyed and memorized SIGNUD used Stop Destroy all other War Department ciphers and codes at once and notify by code word BINAB Stop Early rupture of diplomatic relations with Japan has been indicated State Department informed you may advise ambassador

Next day after lunch the Navy followed suit in advising its Far Eastern attachés:

Destroy this system at discretion and report by word JABBERWOCK Destroy all registered publications except CSP 1085 and 6 and 1007 and 1008 and this system and report execution by sending in plain language BOOMERANG

At 8:45 p.m. that night, Thursday, December 4, the watch officer of the F.C.C.’s Radio Intelligence Division telephoned the Office of Naval Intelligence to ask if it could accept a certain message. The O.N.I. officer was not sure and said he would call back. At 9:05 GY watch officer Brotherhood called the F.C.C. and was given a Japanese weather report that sounded like something the F.C.C. man had been told to listen for. He read it to Brotherhood: “Tokyo: today—wind slightly stronger, may become cloudy tonight; tomorrow—slightly cloudy and fine weather. Kanagawa prefecture: today—north wind cloudy; from afternoon—more clouds. Chiba prefecture: today—north wind clear, may become slightly cloudy. Ocean surface: calm.” Brotherhood was relieved that it included nothing about EAST WIND RAIN, which would have meant the United States, but in any case this message seemed to lack something that would have been required in a true execute. For one thing, the phrase NORTH WIND CLOUDY, which would have meant Russia, was not repeated twice. Nevertheless, Brotherhood telephoned Rear Admiral Leigh Noyes, director of naval communications, who remarked that he thought the wind was blowing from a funny direction. The consensus was that it was not a genuine execute, and the search continued.

In Tokyo, where it was December 5, Foreign Minister Togo received representatives of the Army and Navy general staffs. A general and an admiral wanted to discuss the delicate matter of the precise timing of Japan’s final note to the United States. Drafted in English by the director of the Foreign Office’s American bureau, the note had been approved by the Liaison Conference, a six-man war cabinet, at its meeting the day before. It rejected Hull’s offer of the 26th and concluded: “The Japanese Government regrets to have to notify hereby the American Government that in view of the attitude of the American Government it cannot but consider that it is impossible to reach an agreement through further negotiations.”

Article I of the 1907 Hague Convention governing the laws of war provides that “… hostilities … must not commence without previous and explicit warning, in the form either of a reasoned declaration of war or of an ultimatum with conditional declaration of war.” Togo had suggested to the Liaison Conference that the note was far stronger than an ultimatum and that to include a specific declaration of war would be “merely to reiterate the obvious.” The conferees had gratefully acceded to this casuistry, since it enabled them to comply with the prior-notification requirement without endangering the surprise of the attack. Since the Hague Convention does not specify how long in advance such notification must be given, Premier Tojo and the other conferees thought to shave the time as much as possible. Dawn in Hawaii was about noon in Washington. The Liaison Conference had tentatively set 12:30 p.m., Sunday, December 7 (Washington time), as the time of delivery of the note.

But when the two military men called upon Togo the next day to fix the exact time, Vice Admiral Seiichi Ito, vice chief of the naval general staff, told the foreign minister [Togo later wrote] “that the high command had found it necessary to postpone presentation of the document thirty minutes beyond the time previously agreed upon, and that they wanted my consent thereto. I asked the reason for the delay, and Ito said that it was because he had miscalculated…. I inquired further what period of time would be allowed between notification and attack; but Ito declined to answer this, on the plea of operational secrecy. I persisted, demanding assurance that even with the hour of delivery changed from twelve-thirty to one there would remain a sufficient time thereafter before the attack occurred; this assurance Ito gave. With this—being able to learn no more—I assented to his request. In leaving, Ito said: ‘We want you not to cable the notification to the Embassy in Washington too early.’ ” In this demand lay the seeds of Japan’s juridical culpability.

Yoshikawa, in Honolulu, had continued sending his ship-disposition reports after the switch to PA-K2. They were an odd melange of accuracy, error, and outright falsehoods. On December 3, for example, he correctly reported that the liner Lurline had arrived from San Francisco but stated that a military transport had departed when no such thing had occurred. The next day he informed Tokyo about the hasty departure of a cruiser of the Honolulu class; no such ship either entered or cleared the harbor on the 4th. Then, on the 5th, he cabled that three battleships had arrived in Pearl Harbor, making a total—which he reported with deadly accuracy—of eight anchored in the harbor. His messages, sent over Kita’s signature, were decoded in the Foreign Office and routed to the North American section, where Toshikazu Kase passed them immediately to the Navy Ministry. Here they were redrafted, encoded in a naval code, and transmitted on a special frequency not normally used by the Navy and without any direct address to the Pearl Harbor strike force. Commander Koshi decoded it and brought to his chief this latest information.

The communication-security precautions paid off. Whether or not the messages slipped by the American radio monitors in Hawaii mattered little. Mere interception would not have helped much. The messages bore no external indication of their intended recipient, and they could not have been read. Rochefort’s attack on Japanese naval codes had achieved some minor successes in late October and November, but he could read only about 10 per cent of the naval traffic, and much of this consisted of weather and other minor systems. The information obtained, Rochefort said, “was not in any sense vital.” Cavite was spottily reading JN25 messages—which revealed nothing about Pearl Harbor—until December 4, when the superencipherment was suddenly changed. As a message that moved on the COPEK channel put it: “Five numeral intercepts subsequent to zero six hundred today indicate change of cipher system including complete change differentials and indicator subtractors X All intercepts received since time indicated checked against all differentials three previous systems X No dupes.” Corregidor was not to get the initial break into the new superencipherment until December 8. And the only other system in which the Yoshikawa messages might have been forwarded—the flag officers’ system—remained unsolved.

A possibility of warning was opened at the source, however, when Yoshikawa’s original messages became available to Rochefort’s unit. Mayfield had picked up another batch of cables in the surreptitious fashion from Street on Friday morning and immediately sent them down to Rochefort’s unit by messenger. Solving them was not part of its duty,{7} but when a superior officer and colleague asks one to do a favor, it is hard to say no. Rochefort assigned the messages to Chief Radioman Farnsley C. Woodward, 39, who had had some experience with Japanese diplomatic codes at the Shanghai station from 1938 to 1940. He had some help from Lieutenant Commanders Thomas H. Dyer, Rochefort’s senior cryptanalyst, and Wesley A. Wright, Dyer’s assistant. Although the unit was not working on the diplomatic systems, it had information on them in the Navy’s R.I.P.s, or Radio Intelligence Publications, with which all radio intelligence units were supplied. The R.I.P. gave, however, only the PA code list, leaving the onerous reconstruction of the current K2 transposition to the cryptanalyst. The half-dozen or so dispatches, plus some in LA, reached Woodward about 1:30 or 2 p.m. Friday, and he immediately began the first of a series of 12- and 14-hour days to read them. He had no difficulty with the LA messages, which were translated into English by Marine Corps Captain Alva Lasswell, but these yielded “nothing but junk.” The K2, however, eluded him, and he worked on it far into the night.

At about 5 p.m. that day, a trans-Pacific telephone call came through to Mrs. Motokazu Mori, wife of a dentist prominent in Hawaii’s Japanese community. She was the Honolulu correspondent for the militaristic Tokyo newspaper Yomiuri Shimbun. Mrs. Mori had received a wire from her editor the previous day asking her to arrange a telephone interview with a prominent Japanese on conditions in Hawaii. She cabled an acknowledgment but, unable to get anyone, she took the call herself.

Yomiuri: Hello, is this Mori?

Mrs. Mori: Hello. This is Mori.

Yomiuri: I am sorry to have troubled you. Thank you very much.

Mrs. Mori: Not at all.

Yomiuri: … I would like to have your impression on the conditions you are observing at present. Are airplanes flying daily?

Mrs. Mori: Yes, lots of them fly around.

Yomiuri: Are they large planes?

Mrs. Mori: Yes, they are quite big.

Yomiuri: Are they flying from morning till night?

Mrs. Mori: Well, not to that extent, but last week they were quite active in the air.

There ensued Q-and-A about the number of sailors, relations between Japanese and Americans, factory construction, population growth, whether the airplanes carried searchlights, Hawaii weather, newspaper comment, and comparison of impressions made during stopovers in Hawaii by two ambassadors to the United States, Kurusu of Japan and Maxim Litvinoff of Russia. The interview continued:

Yomiuri: Do you know anything about the United States fleet?

Mrs. Mori: No, I don’t know anything about the fleet. Since we try to avoid talking about such matters, we do not know much about the fleet. At any rate, the fleet here seems small. I don’t [know if] all of the fleet has done this, but it seems that the fleet has left here.

Yomiuri: Is that so? What kind of flowers are in bloom in Hawaii at present?

Mrs. Mori: Presently, the flowers in bloom are fewest out of the whole year.

However, the hibiscus and the poinsettia are in bloom now.

The editor seemed a little confused about the hibiscus, but the interview continued with discussions about liquor and the number of first- and second-generation Japanese. Finally the editor thanked Mrs. Mori. She asked him to hold on for a moment, but he had already hung up.

Unknown to both of them, someone had been listening. And that someone thought that the talk about hibiscus and poinsettias sounded mighty suspicious—especially on an expensive transoceanic telephone connection, and especially at a time of extraordinarily tense relations.

In Tokyo it was a little after 1 p.m. on Saturday, December 6. The Japanese reply to Hull’s note of the 26th had recently been sent to the cable room of the Foreign Ministry for transmission to the embassy in Washington. Kazuji Kameyama, the cable chief, broke it into fourteen approximately equal parts to facilitate handling and ordered these enciphered on the 97-shiki O-bun In-ji-ki. He also enciphered a shorter “pilot” message from Togo alerting the embassy that the reply was on the way and instructing it “to put it in nicely drafted form and make every preparation to present it to the Americans just as soon as you receive instructions.” At 8:30 p.m., the pilot message was telegraphed from the cable room to Tokyo’s Central Telegraph Office, from where, 45 minutes later, it was radioed to the United States. Bainbridge Island intercepted it and relayed it to OP-20-G. By five minutes past noon on Saturday, December 6 (Washington time), OP-20-G had delivered the teletype copy to S.I.S., which promptly ran it through the PURPLE machine. By 2 p.m. Bratton had it, translated and typed. An hour later it was in the hands of the Army distributees. S.I.S. had officially closed at 1 p.m. and was not due to reopen until 6, when it was to go on 24-hour status. But this notification of the imminent receipt of the long-awaited reply to Hull’s note of the 26th led to telephoning employees Mary J. Dunning and Ray Cave about 2:30 and asking them to report to work. By 4 both were there.

In Tokyo, Kameyama had released the first 13 parts of the Japanese note to the Central Telegraph Office. Following the instructions of the American bureau, he retained the crucial 14th part, which broke off negotiations. Shortly after 10 p.m., commercial radio began sending the 13 parts to Washington. Most of them took less than ten minutes to transmit, but even though two transmitters were used, it was not until two minutes before 2 a.m. that the tail of the last part had gone. Bainbridge, of course, was listening, and it picked the parts up in this order: 1, 2, 3, 4, 10, 9, 5, 12, 7, 11, 6, 13, 8. One batch arrived by teletype at OP-20-G at eleven minutes before noon, Saturday, December 6, Washington time, and the other at nine minutes of 3 that afternoon. Though it was Saturday, December 6, an even date and hence an Army date of responsibility, the Navy handled the dispatches because it knew that S.I.S. was not expected to work that afternoon, and it considered the intercepts of great importance. Decryptment did not go very smoothly, however. Something seemed to be in error. GY knew the key, but it was producing garbles every few letters. The cryptanalysts tried to correct them.

Meanwhile, a decode into Japanese of the long PA-K2 message that Yoshikawa had sent concerning Kühn’s visual-signal system for Hawaii was placed on the desk of Mrs. Edgers in GZ. “At first glance,” she said, “this seemed to be more interesting than some of the other messages I had in my basket, and so I selected it and asked one of the other men, who were also translators working on other messages, whether or not this shouldn’t be done immediately and was told that I should and then I started to translate it. Well, it so happened that there was some mistake in the message that had to be corrected and so that took some time. That was at 12:30 or perhaps it was a little before or after 12:30; whatever time it was, we were to go home. It being Saturday, we worked until noon. I hadn’t completed it, so I worked overtime and finished it, and I would say that between 1:30 and 2 was when I finished my rough draft translation.” Mrs. Edgers left it in the hands of Chief Yeoman Bryant. But the message was still not entirely clear, and she had not yet had enough experience for her translations to be sent out without further checking. Kramer, busy with the 13 parts, did not examine it in detail.

To speed processing of the 13 parts, GY, learning that some people were in S.I.S., sent over parts 1 and 2. But when Major Doud of S.I.S. ordered Miss Cave to OP-20-G to help in the smooth typeups, the two parts were returned to GY for solution there, probably because of the garbles. But other messages also coming in were retained by S.I.S.

At 3 o’clock, Kramer, in GZ, had checked with GY to find out whether any more Tokyo traffic had come in before releasing his translators for the day. Since the critical matter of a diplomatic note is often found in the last sentences, GY broke down the last part intercepted for him. The first part of the first line indicated in Japanese that this was part 8 of a 14-part message. After about three lines of Japanese text in the preamble, the message came out in English, just as the Foreign Office had sent it. Kramer could let his translators go home. Interspersed throughout the English text were many of the three-letter codewords indicating punctuation, paragraphing, and numbering, but these posed no problem since they had been recovered long ago.

At 4 o’clock, when Linn took over the GY watch, the garbles still had not been cleared. He decided to start from the very beginning, to check the key, find what was wrong, and redecrypt the messages rather than to try to guess at the garbled letters and possibly make serious errors that would distort the sense. Discarding all the previous work caused a serious jam on the Navy’s one PURPLE machine, and about 6 p.m. GY again called on S.I.S. for help. Parts 9 and 10 were sent over; an hour later, the decrypts came back in longhand. By 7:30, the last of the 13 parts was being decrypted.

Not all the garbles had been scrubbed out. Part 3 had a 75-letter smudge that could not be read at all, Part 10 a 45-letter blur, and Part 11 one of 50 letters. Part 13 went awry in two patches. One deciphered as andnd and the other as chtualylokmmtt; GY thought the first should be and as and the second China, can but.{8}

In the Japanese embassy, about a mile away, the code clerks had completed deciphering the first seven or eight parts of the message by dinnertime. Then they all repaired to the Mayflower Hotel for a farewell dinner for Hidenari Terasaki, head of Japanese espionage for the western hemisphere, who had been ordered to another post.

While they were enjoying themselves, American code clerks at the Department of State were at work encoding a personal appeal for peace from the President of the United States to the Emperor of Japan. This had been off again, on again since October, Roosevelt apparently wishing to save it for a last resort. Now he decided that the time had come. The message was on its way by 9 o’clock. It traversed the 7,000 miles to Tokyo in an hour. But it took ten hours to get from the Central Telegraph Office to the American embassy.

As the President was addressing a message of peace to the Emperor, the men of the Japanese strike force were listening to a message of war. Shortly before, Admiral Nagumo had topped off the fuel tanks of his combat ships for the final dash. His crews waved farewell to the slow-moving tankers. Now the officers read a stirring message from Yamamoto to all hands: “The moment has arrived. The fate of the empire is at stake. Let every man do his best.” Banzais rent the air. Up the mast of Akagi fluttered the very flag that had flown at Japan’s great naval victory over Russia in 1905. It was a moment of great emotion. Nagumo altered course to due south and bent on 26 knots. Through a mounting sea, the battle force plunged toward its target.

Lovely, peaceful, that target lay “open unto the fields, and to the sky,” oblivious to the onrushing armada of destruction. But many people were seeking clues to Japanese intentions, particularly concerning sabotage, which was regarded as a serious threat. Among these was Robert L. Shivers, special agent in charge of the F.B.I.’s Honolulu office and the man who, under authority of the Attorney General, had ordered the tap on the overseas phone that picked up Mrs. Mori’s interview. By noon he had received a transcript in English of the call, and soon after 4 p.m. was conferring about it with May-field and the Army assistant G-2, Lieutenant Colonel George W. Bicknell, in his office on the sixth floor of the Alexander Young Hotel in Honolulu. Mayfield consulted with Lieutenant Carr, who had translated the Navy telephone taps and who happened to be duty officer that afternoon at the District Intelligence Office; both thought that Carr should listen to the original recording to see if any hidden meaning was concealed in the intonations. Shivers said he would have it by 10 the following morning. Bicknell, whose job included heading the Army’s counterintelligence in Hawaii, was convinced that the hibiscus and poinsettias smelled of espionage. He telephoned his boss, Colonel Kendall J. Fielder, the G-2, and said he wanted to see him and General Short immediately on a matter of importance.

They were both on their way to dinner at Schofield Barracks, and Fielder asked if it couldn’t wait until tomorrow. Bicknell said it was too important; Fielder agreed to see him. Bicknell drove hurriedly out to Fort Shafter, where Fielder and Short had their homes side by side, and at about 6 p.m. the three men discussed the message for a while, but though they considered it “very suspicious, very fishy,” Fielder said, “we couldn’t solve it, we couldn’t make heads nor tails out of it.” The flower references seemed totally out of place, as if they were indeed conveying secret military information by open code, but, on the other hand, the Japanese spoke quite openly about airplanes and the fleet. The whole thing was very baffling, and they never did reach a conclusion about it.

They did not know that the Yomiuri Shimbun was then being hawked on the streets of Tokyo with an atmosphere feature on Hawaii based on the Mori interview—complete with reference to flowers. Nor, apparently, did they realize that the Japanese did not need so weak and dangerous a system. They could send much more detailed reports by cable in their diplomatic code. And, in one of the most ironical of situations at Pearl Harbor, they were doing precisely that at that very minute. While the three American army officers were standing on Short’s porch worrying about the hibiscus, the R.C.A. office was time-stamping “1941 Dec 6 PM 6 01” on a message from the consulate. It was signed “Kita” but it came from Yoshikawa. It was brief (only 44 groups) and cheap ($6.82), but it reported that “(1) On the evening of the 5th, the battleship Wyoming and one sweeper entered port. Ships at anchor on the 6th were: 9 battleships, 3 minesweepers, 3 light cruisers, 17 destroyers. Ships in dock were: 4 light cruisers, 2 destroyers. Heavy cruisers and carriers have all left. (2) It appears that no air reconnaissance is being conducted by the fleet air arm.” Yoshikawa was, as usual, partly right and partly wrong. He mistook Utah for Wyoming. His figure on the battleships was correct, but in harbor that afternoon were 6 light and 2 heavy cruisers, 29 destroyers, 4 minesweepers, 8 minelayers, and 3 seaplane tenders. With this message Yoshikawa completed his assignment. It was the last cable sent by the Japanese consulate in Hawaii for many years.

By 8:45 p.m. in Washington, the 13 parts had been typed in smooth copies and put up in folders. Kramer began telephoning the recipients to find out where they were so he could bring the MAGIC to them. He also called his wife, Mary, who agreed to chauffeur him during his deliveries. They reached the White House first, at about 9:15. The naval aide, Beardall, had told the President that some MAGIC would be delivered that evening, and at about 4 p.m. he had ordered his communications assistant, Lieutenant Lester R. Schulz, to stand by and bring it to the President. Schulz was waiting in Beardall’s small office in the corner of the basement mail room in the White House when Kramer arrived. The Roosevelts had been entertaining at a large dinner party, but the President had excused himself. Schulz obtained permission to bring the MAGIC to the President, and an usher accompanied him to the oval study on the second floor and announced him. Roosevelt was seated at his desk. Only Harry Hopkins was with him. Schulz unlocked the briefcase with the key that Beardall had given him, removed the sheaf of MAGIC, and handed it to the President. He read the 13 parts in about ten minutes while Hopkins paced slowly up and down. Then Hopkins read them. The 13th part rejected Hull’s offer, and when Hopkins had passed the papers back to the President, Roosevelt turned to him and said, in effect, “This means war.” Hopkins agreed, and for about five minutes they discussed the situation, the deployment of Japanese forces, the movement towards Indochina, and similar matters. The President mentioned his message to Hirohito. Hopkins remarked that it was too bad that the United States could not strike the first blow and prevent any kind of surprise in the inevitable war.

On the eve of Pearl Harbor, Takeo Yoshikawa sends his final message over Consul Kita’s signature, using the PA-K2 code, to report that the U.S. fleet is still in port

“No,” the President said in effect, “we can’t do that. We are a democracy and a peaceful people.” He raised his voice: “But we have a good record.” He tried unsuccessfully to get Admiral Stark on the telephone, deciding against having him paged at the National Theater for fear of causing undue alarm.

The President then returned the papers to Schulz and, about half an hour after he had entered the study, Schulz left. He found Kramer seated at one of the long tables in the mail room. Schulz gave him the pouch and soon thereafter went home. Kramer, however, continued to the Wardman Park Hotel, where Secretary Knox had a suite. For about twenty minutes, while Kramer chatted with Mrs. Knox and the acting manager of Knox’s Chicago Daily News, the Secretary read the 13 parts. He agreed with Kramer that, even incomplete, it pointed to a termination of negotiations. He went into another room to make some telephone calls, and when he came out he told Kramer to bring the latest MAGIC to a meeting that had been arranged for 10 a.m. the next morning with Stimson and Hull in the State Department. (Bratton had delivered the 13 parts to the night duty officer at State at 10 p.m., admonishing him to get them to Hull at once.) Knox returned the intercepts to Kramer, who then went to the home of Rear Admiral Theodore S. Wilkinson, director of naval intelligence, where Beardall and Army intelligence chief Miles happened to be dinner guests. All three studied the intercept in a room away from the other guests, Beardall reading from an extra copy that Kramer had. They too seemed to feel that negotiations were coming to an end.

It was after midnight when Kramer left the Wilkinson house. His wife drove him back to the Navy Department, where he put the MAGIC back in his safe in GZ and checked to see if the 14th part had yet come in. It had not. Finally he went home himself.

In S.I.S., meanwhile, the new teletype that would expedite the forwarding of intercepts was being set up in the “cage,” the barred room where PURPLE traffic was processed. Monitor Post 2 was requested to send in some intercepts as a test. In San Francisco, Harold W. Martin, the noncom in charge, punched onto the teletype tape the intercepts that the post had picked up since airmailing in the bulk of the day’s material, as well as the earlier ones. Among the later ones was Yoshikawa’s final message, which thus became one of the first to move on the direct wire as a real, nontest item. S.I.S. received it a little after midnight. But PA-K2 was a low-priority system, and the message had originated in a consular office. It was set aside to be worked on later.

Besides, S.I.S. had more important things to worry about. Like OP-20-G, it was going frantic in a search for the 14th part. Captain Robert E. Schukraft, head of the intercept section, and Frank B. Rowlett, the civilian cryptanalyst in charge of the Japanese diplomatic solutions, checked and rechecked to see whether one of the stations had picked it up and had somehow neglected to forward it. The message preambles had said that it existed, but they could find no trace of it. Neither suspected that the Japanese Foreign Office had deliberately held up transmission of this final conclusive part for security’s sake.

Neither did the code clerks at the Japanese embassy. They had returned from Terasaki’s party about 9:30, and by midnight had completed deciphering of the 13 parts. While they waited for the final section, they busied themselves by disposing of the remnants of the cipher machine they had destroyed the night before. But they did nothing to fulfill the orders of the pilot message to prepare the dispatch for immediate presentation.

Finally, fourteen hours after the last part of the previous 13 parts had been transmitted, the Foreign Office released the crucial 14th part that broke off negotiations. At 4 p.m., Tokyo time, it ordered it transmitted via both R.C.A. and Mackay Radio & Telegraph Company to ensure its correct reception. An hour and a half later, it wired to the Central Telegraph Office the coded message ordering the 1 p.m. delivery of the 14-part note. This too was sent via the two companies.

As usual, the indefatigable ear of Bainbridge Island detected the ethereal pulses of both messages. It picked up the Mackay transmission of the 14th part between 12:05 and 12:10 a.m., December 7, local time, and the even briefer one o’clock message between 1:28 and 1:37 a.m. It teletyped them to GYin a single transmission, the 14th part as serial No. 380 of Station S, the one o’clock as No. 381. Brotherhood, who was GY watch officer, ran them through the PURPLE machine. He evidently had some trouble with the 14th part, for it took an hour to break. But by 4 a.m. he had it in English. The three-letter codegroups were quickly translated into punctuation; the message would need little more than typing. The one o’clock message, however, turned out to be in Japanese. He sent it to S.I.S. for translation, knowing that translators were on duty because S.I.S. was beginning its round-the-clock tours. It was a little past 5 a.m., Washington time.

In the embassy of Nippon, the code clerks who had waited all through the night for the 14th part were, on Counselor Iguchi’s advice, being sent home. Just as they were climbing wearily into their beds, the naval attach é arrived and found the mailbox stuffed with cablegrams. The duty officer telephoned the clerks at their homes about 8 a.m. and ordered them back to work.

A few hundred miles north of Oahu, the Japanese task force, bristling with guns, planes, and hate for Americans, bore down on the Pacific Fleet. A few hours earlier, a message had arrived from Tokyo that caused Commander Mitsuo Fuchida, the pilot who was to head the first wave of the air attack, to breathe a sigh of relief. It had been relayed from Yoshikawa, and it reported that no barrage balloons had yet been emplaced to protect the fleet from air attack. The same message also caused Commander Minoru Genda to sigh with relief. It stated that the battleships appeared not to be protected by torpedo nets. Genda had conceived the plan of shallow-water torpedo attack on the anchored American ships.

A little more than an hour after the hands of Honolulu clocks had snipped off December 6 and opened out into the first hours of December 7, the Pearl Harbor strike force received Tokyo’s relay of Yoshikawa’s final message. The American ships were still in harbor, awaiting the ax stroke with fat complacency. They were apparently not even protected by air search. Was it all a decoy? The strike force’s radio officer, Commander Kanjiro Ono, listened intently to Honolulu’s radio station KGMB for any inkling that the Americans knew of them. He heard only the soft melodies of the islands. On Hiryu, the flight deck officer slipped bits of paper between each plane’s radio transmitter key and its contact point to make sure that radio silence, so carefully preserved for almost two weeks, would not be accidentally broken in the last few hours to destroy the element of surprise.

As Yoshikawa’s final report was being decoded aboard Akagi, Kramer returned to the Navy Department he had left only seven hours before, and began working again. It was 7:30 on the morning of Sunday, December 7.

Brotherhood’s decryptment of the 14th part was on his desk when he arrived. It took him about half an hour to ready a smooth version, and at 8 o’clock he delivered the neatly typed copy to McCollum. Other copies went to S.I.S. for its distribution. Kramer then worked on other traffic in his office, interrupting himself only once, at 8:45, to bring a copy of the 14th part to naval intelligence chief Wilkinson on his arrival at the Navy Department. At 9:30 he set out to deliver the full 14 parts to the meeting of the three secretaries. He stopped at the office of the Chief of Naval Operations to make sure that Stark had been given the message, which he had, and then walked and trotted to the White House. He got there at about 9:45 and gave the MAGIC pouch to Beardall, who had assigned himself to duty that morning because he thought the 14th part of the message that he had seen at Wilkinson’s house the night before might be coming in.

Beardall brought the folder to the President, who was in his bedroom. Roosevelt said good morning to him, read the intercept, and commented that it looked like the Japanese were going to break off negotiations. Then he returned the MAGIC, and Beardall took it back to the Navy Department.

Kramer, meanwhile, had hurried across the west lawn of the White House to the ugly, ornate State Department building, arriving at about ten minutes of 10. The Army courier appeared at almost the same moment with the MAGIC for Hull and Stimson. Three State Department officials who saw MAGIC—Hornbeck, Ballantine, and Hamilton—were shown the 14th part by Hull’s aide, John Stone, and the group discussed the situation in general terms until the secretaries arrived a few minutes later. Kramer gave his pouch to Knox and headed back to the Navy Department.

Meanwhile, the translation of the one o’clock message had come up from S.I.S. It was placed in Bratton’s hands about 9 a.m. while he was reading the 14th part. It “immediately stunned me into frenzied activity because of its implications, and from that time on I was busily engaged trying to locate various officers of the general staff and conferring with them on the exclusive subject of this message and its meaning,” he said later. He tried first to get in touch with Marshall, calling him at his quarters at Fort Myer, and was told by an orderly that the chief of staff had gone on his customary Sunday morning horseback ride. Bratton directed the orderly:

“Please go out at once, get assistance if necessary, and find General Marshall, ask him to—tell him who I am and tell him to go to the nearest telephone, that it is vitally important that I communicate with him at the earliest practicable moment.” The orderly said he would. Bratton called Miles, told him of the message, and urged him to come down to the office at once. Between 10 and 10:30, Marshall called Bratton back. The colonel offered to drive out at once with the one o’clock message, but Marshall told him not to bother, that he was coming down to his office at once. Bratton obeyed.

Kramer arrived back in GZ at about 10:20, and found there the one o’clock message. It struck him as forcibly as it had Bratton. He at once had Yeoman Bryant prepare a new set of folders for immediate delivery of the intercept. Included in the new set were other messages which S.I.S. had decrypted, and on which Kramer had been working earlier in the morning: Tokyo serial No. 904, which directed the ambassadors not to use an ordinary clerk in preparing the 14-part ultimatum for presentation to the Secretary of State, so as to preserve maximum security; serial No. 909, thanking the two ambassadors for all their efforts; and serial No. 910, ordering destruction of the remaining cipher machine and all machine codes.

Kramer was about to dart out again when Pering, the GY watch officer, brought in a message in plain-language Japanese, ending with the telltale STOP that indicated it was an INGO DENPO message: KOYANAGI RIJIYORI SEIRINOTUGOO ARUNITUKI HATTORI MINAMI KINEBUNKO SETURITU KIKINO KYOKAINGAKU SIKYUU DENPOO ARITASI STOP TOGO. Kramer Recognized KOYANAGI as the codeword for England, and HATTORI as a codeword whose meaning he did not recall. He consulted his code list and saw that it meant Relations between Japan and (name of country) are not in accordance with expectation. But in his haste he overlooked that the common Japanese word minami, which means “south,” had an INGO DENPO meaning of U.S.A. He interpreted the message as “Please have director Koyagani send a wire stating the sum which has been decided to be spent on the South Hattori Memorial Library in order that this business may be wound up.” Consequently, he dictated a decode that omitted United States: Relations between Japan and England are not in accordance with expectation. Yeoman Bryant inserted this and three other minor messages that had come over from the Army into the folders. Kramer meanwhile made a navigator’s time circle that indicated that one o’clock in Washington was dawn in Hawaii and the very early hours of the morning in the Far East around Singapore and the Philippines, which everybody seemed to be watching. He shoved the folders into the briefcase and dashed out the door.

He went first to Stark’s office, where the officers were discussing the 14th part, summoned McCollum, gave him the pouch that included the final code-destruction and one o’clock messages, and mentioned to him the significance of the latter’s timing. McCollum grasped it at once and disappeared into Stark’s office. Kramer wheeled and hurried down the passageway. He emerged from the Navy Department building and turned right on Constitution Avenue, heading for the meeting in the State Department eight or ten blocks away. The urgency of the situation washed over him again, and he began to move on the double.

He half trotted, half walked to State, getting there at about 10:45. Hull, Knox, and Stimson were still meeting. Kramer saw them grouped around the conference table when the door to Hull’s office was opened briefly. He gave the MAGIC messages to Stone, explaining to him how the one o’clock time of delivery of the ultimatum tied in with the movement of a big Japanese convoy down the coast of Indochina, and mentioning in passing that the time in Hawaii would be 7:30 a.m. The final code-destruction message was self-explanatory. Kramer carried a MAGIC pouch to the White House, and then returned, perspiring, to the Navy Department, to busy himself with still more MAGIC. At about 12:30, he spotted the omission of United States from the INGO DENPO message. Because the one o’clock meeting was so close, he telephoned the recipients with the correction, a practice he had followed several times in the past, but reached only McCollum and Bratton. He told them that United States was to be inserted in file number 7148. The force of it had been considerably lessened by the one o’clock message, but Kramer, conscientious beyond the basic requirements of duty, nevertheless planned to send around a corrected version.

Safford later estimated that OP-20-G handled three times as much material that weekend as on a normal one; the GY log shows at least 28 messages in PURPLE alone handled that Sunday. And these messages were processed much more expeditiously than at any other time in the past, Kramer said. The cryptanalysts had done their duty, and had done it superbly. Events now passed out of their hands.

In Tokyo, the President’s message to the Emperor had finally been delivered to Grew after a delay often hours. The chief of the censorship office had ordered that all foreign cables be held up for five hours one day and ten hours the next. The order had been issued at the request of a lieutenant colonel on the general staff, who asked that this be done “as a precaution.” The President’s “triple priority” message arrived on one of the ten-hour days, was stalled for the required time, and was finally delivered at 10:30 p.m., Tokyo time.

Grew immediately arranged for a meeting with Togo and, when the message had been decoded, drove to Togo’s official residence at 12:15 a.m. He requested—as is the right of all ambassadors—an audience with the head of state to present the message, then read it aloud to Togo and gave him a copy. Togo promised to present the matter to the Throne and, despite the lateness of the hour, telephoned the Lord Keeper of the Privy Seal for an audience. Ministers of state would be received at any hour, and the audience was arranged for 3 a.m. Togo began having the message translated.

It was then about 5:30 a.m., December 7, in Hawaii. The Japanese task force was only 250 miles north of Pearl Harbor. More than 2,000 Americans with less than three hours to live slept or played in blissful ignorance of that fact. The hands of clocks in the Foreign Office in Tokyo, in the code room at the Japanese embassy in Washington, in the War and Navy departments, in Pearl Harbor, circled around and around, but not so quickly as the spinning propellers of Nagumo’s ships. At 5:30, two cruisers catapulted off a pair of scout planes to make sure the Americans were still there.

The clerks at the embassy had straggled back to work between 9:30 and 10. They began decoding the longer cables first, as experience had shown that these were usually the more important. At the same time, the embassy’s first secretary, Katzuso Okumura, was typing up the first 13 parts of the ultimatum. He had been chosen because the Foreign Office had forbidden the use of an ordinary typist in the interests of secrecy and he was the only senior official who could operate a typewriter at all decently. At about 11:30, code clerk Juichi Yoshida adjusted the Alphabetical Typewriter to the proper keys and typed out a short code message. To the consternation of the entire staff, it turned out to be an instruction to deliver the 14-part message to Secretary Hull at 1 p.m., Washington time. The 14th part had not even been decoded from the sheaf of incoming cables! And only one code machine was left to decipher all the messages!

A few blocks away, General Marshall had just arrived at the War Department. On his desk was the MAGIC folder with the 14-part message on top and the one o’clock message under it. He began to read the ultimatum carefully, some parts several times. Bratton and Brigadier General Leonard T. Gerow, the war plans chief, tried to get him to look at the one o’clock message, but it is rather difficult for subordinates to interrupt a four-star general, and he finished the ultimatum before finding the time-of-delivery message. It struck him with the same sense of urgency that it had the others, and he picked up the telephone to call Stark to see if he wanted to join him in sending a warning message to American forces in the Pacific.

At approximately the same time, Ambassador Nomura was calling Hull to request an appointment at 1 p.m. And 230 miles north of Hawaii, the first wave of Japanese planes was thundering off the flight decks of the carriers.

Stark was at that moment discussing the significance of the one o’clock message with Captain R. E. Schuirman, Navy’s liaison with State. He told Marshall that he felt that enough warnings had been sent and that more would just confuse the commanders. Marshall thereupon wrote out the dispatch he wanted sent:

Japanese are presenting at one p.m. Eastern Standard Time today what amounts to an ultimatum also they are under orders to destroy their code machine immediately STOP Just what significance the hour set may have we do not know but be on alert accordingly Stop

On his desk Marshall had a scrambler telephone with which he could have called Short in Hawaii. The scrambling apparatus stood in a room next to his office, thus obviating the possibility of tapping the conversation in unscrambled form, as was done with the Mori message. But Marshall knew that scramblers afforded protection merely against casual listeners; they could be penetrated by a determined eavesdropper with proper equipment. He had on several occasions warned the President about security on his transatlantic telephone conversations with Ambassador Bullitt in France and later with Churchill—a wise move, for, though he did not know it, the Nazis had already penetrated that scrambler. The Japanese had evidenced some interest in the San Francisco-Honolulu scrambler, and Marshall was acutely sensitive “that the Japanese would have grasped at most any straw” to suggest to the isolationists that the administration had committed an overt act that had forced the Japanese hand. Japanese interception of a scrambler warning might thus have sent the country to war divided. So Marshall shunned the scrambler telephone and relied on the slightly slower but much more secure method of enciphering a written message.

As he was completing the message, Stark called him back. He had reconsidered and wanted Marshall to add the usual admonition to show the message to the naval opposites. Marshall added: “Inform naval authorities of this communication.” Stark offered the Navy communication facilities, but Marshall said that the Army’s could get the message out as quickly.

Marshall gave the message to Bratton to take it to the War Department message center for transmission to the commanding generals in the Philippines, Hawaii, the Caribbean, and West Coast, after vetoing a suggestion that it be typed first. As Bratton was leaving, Gerow called out that if there was any question as to priority, to send it to the Philippines first. Bratton, greatly agitated, gave the message to Colonel Edward French in the message center and asked how long it would take to get it out. French told him that it would be encoded in three minutes, on the air in eight, and in the hands of the addressees in twenty. Bratton returned and reported to Marshall, who did not understand the explanation and sent him back for a clarification. He still was not sure and sent Bratton back a third time, after which he was finally satisfied with the answer.

Meanwhile, French had had the message typed anyway and then ordered it encoded on a machine that was operated from a typewriter keyboard. During the few minutes that this took, he checked his Honolulu circuit, and found that since early morning interference had been so bad that the small 10-kilowatt War Department radio could not “bust” through it. He knew that R.C.A. in San Francisco had a 40-kilowatt transmitter which would have no difficulty in getting through, and that Western Union in San Francisco had a tube running across the street from its office to this R.C.A. office. He had also learned on the previous day that R.C.A. was installing a teletype circuit from its office in Honolulu to Short’s headquarters at Fort Shafter. French figured that this would therefore be his most expeditious route; after the message had been encoded, he personally carried it over to his bank of six Western Union teletypes and, at 12:01 p.m. December 7, sent it on its way. Western Union forwarded it at 12:17, and 46 minutes later it was received by R.C.A. in Honolulu. Local time was 7:33 a.m. The first wave of Japanese planes was then only 37 miles away—so close that the Army radar operators at Opana Point, who had tracked the flight for several hours and had been told to “Forget it” when they first reported it, were about to lose it in the dead zone of the nearby hills. But though the teletype connection for Fort Shafter had been completed the day before, it was not in operation pending tests on Monday. R.C.A. put Marshall’s message in an envelope marked “Commanding General” for hand delivery.

In Tokyo, Togo had been received by the Emperor. He read the text of Roosevelt’s message, then a draft of the imperial reply that he and Tojo had prepared. It stated that the 14-part note was to be considered as Japan’s response. Hirohito assented, and at 3:15 a.m. Togo withdrew from the Divine Presence. Deeply moved, he recalled, “I passed solemnly, guided by a Court official, down several hundred yards of corridors, stretching serene and tranquil. Emerging at the carriage entrance of the Sakashita Gate, I gazed up at the brightly shining stars, and felt bathed in a sacred spirit. Through the Palace plaza in utter silence, hearing no sound of the sleeping capital but only the crunching of the gravel beneath the wheels of my car, I pondered that in a few short hours would dawn one of the eventful days of the history of the world.” Even as he pondered, Japanese planes were circling over Pearl Harbor.

In stark contrast to the calm stillness of Tokyo was the hectic bustle of the Japanese embassy on Massachusetts Avenue.

Soon after the one o’clock message had been decoded, Okumura finished typing the first 13 parts. But he decided that this rough draft did not suit the formality of a document to be delivered to the Secretary of State. He began retyping it from the very beginning, being assisted now by a junior interpreter, Enseki. His task was complicated by two messages sent up from the code room, one ordering the insertion of a sentence that had been accidentally dropped, one changing a word. This required the retyping of several pages, including one just completed with a great deal of trouble. At about 12:30, the code room finally gave him the 14th part of the ultimatum, but Okumura was nowhere near finished with the first 13. Nomura kept poking his head in the door to hurry him on. A few minutes after one, when it was evident that the document would not be finished for some time, the Japanese called Hull to request a postponement to 1:45, saying that the document they wished to present was not yet ready. Hull acquiesced.

At almost exactly the time that the call to Hull was being placed, Commander Fuchida and his flight of 51 dive bombers, 49 high-level bombers, 40 torpedo planes, and 43 fighters arrived over Pearl Harbor. He fired a “black dragon” from his signal pistol to indicate that the squadrons should deploy in the assault pattern for complete surprise. Nine minutes later, he wirelessed the message “To, to, to”—the first syllable of the Japanese word for “Charge!” and the signal to attack. As the planes moved into position for their runs, he felt so certain that he had achieved complete surprise that, at 7:53, two minutes before the first bomb even fell, he jubilantly radioed “TORA! TORA! TORA!” (“Tiger! Tiger! Tiger!”)—the prearranged codeword that indicated surprise. On Akagi, Nagumo turned to a brother officer and grasped his hand in a long, silent handshake. At 7:55, the first bomb exploded at the foot of the seaplane ramp at the southern end of Ford Island in the middle of Pearl Harbor.

Okumura was still typing. His fingers struggled with the keys as torpedoes capsized Oklahoma, as bombs sank West Virginia, as 1,000 men died in the searing inferno of Arizona. At 1:50 p.m. Washington time, 25 minutes after the attack had started, he reached the end of his typing marathon. The two ambassadors, who were waiting in the vestibule, started for the State Department as soon as it was handed to them.

The Japanese envoys arrived at the Department at 2:05 and went to the diplomatic waiting room [Hull wrote]. At almost that moment the President telephoned me from the White House. His voice was steady but clipped.

He said, “There’s a report that the Japanese have attacked Pearl Harbor.”

“Has the report been confirmed?” I asked.

He said, “No.”

While each of us indicated his belief that the report was probably true, I suggested that he have it confirmed, having in mind my appointment with the Japanese Ambassadors….

Nomura and Kurusu came into my office at 2:20. I received them coldly and did not ask them to sit down.

Nomura diffidently said he had been instructed by his Government to deliver a document to me at one o’clock, but that difficulty in decoding the message had delayed him. He then handed me his Government’s note.

I asked him why he had specified one o’clock in his first request for an interview.

He replied that he did not know, but that was his instruction.

I made a pretense of glancing through the note. I knew its contents already but naturally could give no indication of this fact.

After reading two or three pages, I asked Nomura whether he had presented the document under instructions from his Government.

He replied that he had.

When I finished skimming the pages, I turned to Nomura and put my eye on him.

“I must say,” I said, “that in all my conversations with you during the last nine months I have never uttered one word of untruth. This is borne out absolutely by the record. In all my fifty years of public service I have never seen a document that was more crowded with infamous falsehoods and distortions—infamous falsehoods and distortions on a scale so huge that I never imagined until today that any Government on this planet was capable of uttering them.”

Nomura seemed about to say something. His face was impassive, but I felt he was under great emotional strain. I stopped him with a motion of my hand. I nodded toward the door. The Ambassadors turned without a word and walked out, their heads down.

The warlords’ hopes of shaving the warning time to the closest possible margin had quite literally gone up in the smoke of attack, and Japan had started hostilities without giving prior notification. Later, this failure to declare war would be made part of the charges on which the Japanese war criminals were tried—and convicted, some of them paying with their lives. Togo would try to exonerate himself by throwing the blame on the embassy personnel for neglecting to decipher the cables promptly and to type the ultimatum at once. Perhaps some lawyer’s talking point might have been salvaged if the ambassadors had grabbed Okumura’s original copy, no matter how messy, and taken it to Hull at 1 p.m., or if they had taken the first few pages of the fair copy at 1 p.m. and directed the embassy staff to rush the other pages over as completed. But even if the entire document had been delivered on time, the 25 minutes that remained until the attack would not have been sufficient time for all the steps needed to prevent surprise: reading the document, guessing that a military attack was intended, notifying the War and Navy departments, composing, enciphering, transmitting, and deciphering an appropriate warning, and alerting the outpost forces. This was just what the shoguns intended. But just as a multitude of human errors on the part of Americans, cascading one atop the other, helped make tactical surprise perfect, so a series of similar human errors on the part of the Japanese deprived them of their last vestige of legality.

Shortly after the attack commenced, Tadao Fuchikama, a messenger for the Honolulu office of R.C.A., picked up a batch of cables for delivery. He knew that the war had started and that it was the Japanese who were attacking the ships in the harbor, but he felt he had his job to do anyway. He glanced at the addresses on the envelopes, including the one marked “Commanding General,” and planned an efficient route. Shafter was well down the list. His motorcycle progressed slowly through the jammed traffic; once he was stopped by National Guardsmen who had almost taken him for a paratrooper. At 11:45, almost two hours after the last attackers had vanished, Marshall’s warning message was delivered to the signal officer. It got to the decoding officer at 2:40 that afternoon and to Short himself at 3. He took one look at it and threw it into the wastebasket, saying that it wasn’t of the slightest interest.

The fourteenth part of the Japanese ultimatum, as distributed to MAGIC recipients

In Tokyo, Grew was awakened at 7 a.m. by the telephone, summoning him to a meeting at 7:30 with Togo. On Grew’s arrival, the Foreign Minister gave him the Emperor’s reply to the President. He thanked Grew for his cooperation and saw him off at the door. Four hours had elapsed since the attack had begun, but Togo never mentioned it. Shortly thereafter, Grew learned of the outbreak of hostilities from an extra of the Yomiuri Shimbun hawked outside his window. The Japanese soon closed the embassy gates and prohibited cipher telegrams. Grew ordered execution of the State Department regulation to destroy all codes. The embassy’s second and third secretaries, Charles E. Bohlen and James Espy, locked the code room from the inside and destroyed the several score documents. “No Japanese interrupted that process,” Grew wrote, “nor could he have, since the heavy door of the code room was securely locked. None of our codes, nor any part of them, nor any of our confidential correspondence fell into the hands of the Japanese.”

The last page of the Japanese note as typed by First Secretary Katzuso Okumura and handed to Secretary of State Cordell Hull while Pearl Harbor was being attacked

The Japanese themselves were not so smart. They did all right in Washington, breaking up their last code machine and burning all remaining codes after encoding a final message that they were so doing—the last message sent on the Washington-Tokyo circuit, and read, of course, by the American code-breakers. But in Honolulu, police guarding the consulate after the attack smelled papers burning and saw smoke coming from behind a door. Fearing a conflagration, they broke in and found the consulate staff burning its remaining documents in a washtub on the floor. The police confiscated what proved to be the telegraph file plus five burlap sacks full of torn papers. These reached Rochefort’s unit that evening. Woodward was still working long hours in an attempt to break the PA-K2 messages that Mayfield had brought. Since the attack, the fear of sabotage had swelled to enormous proportions. “Nothing coming to light,” his notes read, “so it was decided to reverse the process of deciphering, allowing for the encoding party to have either purposely encrypted the messages in this manner or possibly to have made an error in using the system employed due to confusion. This netted results.”

At about 2 a.m. on December 9, he cracked one of the messages picked up in the consulate. It was one sent from the Foreign Ministry to Kita on the 6th: “Please wire immediately re the latter part of my #123 any movements of the fleet after the 4th.” With this, he was soon able to unlock the other PAK2 messages—including the long one setting up Kühn’s light-signaling system. At about the same time in OP-20-GZ, Kramer, who had been too busy with the 13 parts on Saturday to work on this message, was breaking out charts of Oahu and Maui to help in degarbling the message, which was finally reduced to plaintext by Thursday. Marshall later said that it was the first message that clearly indicated an attack on Pearl to him—but this was, of course, after the fact. The information from it was immediately passed to counterintelligence units in Hawaii, where invasion was thought highly probable. Their agents interrogated residents in the neighborhood of the houses mentioned in the dispatch and listened to recordings of KGMB want ads, but found that the signal system had never been used. They arrested Kühn, who confirmed this. He was convicted on espionage charges and imprisoned at Leavenworth Penitentiary until after the war, when he was paroled to leave the country.

On December 7, while Honolulu was still reeling from the devastation of the attack, F.C.C. monitors there picked up a Japanese-language news broadcast from station JZI in Japan. The announcer boasted of a “death-defying raid” at Pearl, reported other events, and, about halfway through the broadcast, declared: “Allow me to especially make a weather forecast at this time: west wind clear.” The O.N.I, translator noted that “as far as I can recollect, no such weather forecast has ever been made before” and that “it may be some sort of code.” It was the long-awaited winds code execute, apparently sent indicating war with Britain to make sure that some Japanese outpost that had not reported destroying its codes by the codeword HARUNA would burn them.

Shortly after noon in Washington on the day after the attack, the President of the United States stood before a stormily applauding joint session of Congress and opened a black looseleaf notebook. When the cheers had subsided into a hushed solemnity, he began to speak:

Yesterday, December 7, 1941—a date which will live in infamy—the United States of America was suddenly and deliberately attacked by naval and air forces of the Empire of Japan.

He alluded to the fatal Japanese delay in delivering the ultimatum:

The United States was at peace with that nation and, at the solicitation of Japan, was still in conversation with its Government and its Emperor looking toward the maintenance of peace in the Pacific. Indeed, one hour after Japanese air squadrons had commenced bombing in Oahu, the Japanese Ambassador to the United States and his colleague delivered to the Secretary of State a formal reply to a recent American message. While this reply stated that it seemed useless to continue the existing diplomatic negotiations, it contained no threat or hint of war or armed attack.

The war was on. The most treacherous onslaught in history had succeeded. Japan had cloaked the strike force in absolute secrecy. She had dissembled with diplomatic conversations and with jabs toward the south. She had—in a precaution whose wisdom she but dimly realized—swathed her plans in a communications security so all-enveloping that not a whisper of them ever floated onto the airwaves.

But if the cryptanalysts had no chance to warn of the attack and save American lives before the war, they found ample opportunities to exert their subtle and pervasive talents during the struggle. In the 1,350 days of conflict in which an angry America turned Japan’s tactical victory at Pearl Harbor into total strategic defeat, the cryptanalysts, in the words of the Joint Congressional Committee, “contributed enormously to the defeat of the enemy, greatly shortened the war, and saved many thousands of lives.”

That, however, is another story.

The Pageant of Cryptology

2. The First 3,000 Years

ON A DAY nearly 4,000 years ago, in a town called Menet Khufu bordering the thin ribbon of the Nile, a master scribe sketched out the hieroglyphs that told the story of his lord’s life—and in so doing he opened the recorded history of cryptology.

His was not a system of secret writing as the modern world knows it; he used no fully developed code of hieroglyphic symbol substitutions. His inscription, carved about 1900 B.C. into the living rock in the main chamber of the tomb of the nobleman Khnumhotep II, merely uses some unusual hieroglyphic symbols here and there in place of the more ordinary ones. Most occur in the last 20 columns of the inscription’s 222, in a section recording the monuments that Khnumhotep had erected in the service of the pharaoh Amenemhet II. The intention was not to make it hard to read the text. It was to impart a dignity and authority to it, perhaps in the same way that a government proclamation will spell out “In the year of Our Lord One thousand eight hundred and sixty three” instead of just writing “1863.” The anonymous scribe may also have been demonstrating his knowledge for posterity. Thus the inscription was not secret writing, but it incorporated one of the essential elements of cryptography: a deliberate transformation of the writing. It is the oldest text known to do so.

As Egyptian civilization waxed, as the writing developed and the tombs of the venerated dead multiplied, these transformations grew more complicated, more contrived, and more common. Eventually the scribes were replacing the usual hieroglyphic form of a letter, like the full-face mouth representing /r/, by a different form, like a profiled mouth. Sometimes they used new hieroglyphs whose first sound represented the letter desired, as a picture of a pig, “rer,” would mean /r/. Sometimes the sounds of the two hieroglyphs differed but their images resembled one another. The horned asp, representing /f/, was replaced by the serpent, representing /z/. And sometimes the scribes used a hieroglyph on the rebus principle, as in English a picture of a bee might represent b; thus a sailboat, “khentey,” stands for another Egyptian word khentey, which means “who presides at”—this latter being part of a title of the god Amon, “he who presides at Karnak.” These procedures of acrophony and the rebus are essentially those of ordinary Egyptian writing; it was through them that the hieroglyphics originally acquired their sound values. The Egyptian transformations merely carry them further, elaborate them, and make them more artificial.

The transformations occur in funerary formulas, in a hymn to Thoth, in a chapter of the Book of the Dead, on the sarcophagus of the pharaoh Seti I, in royal titles displayed in Luxor, on the architrave of the Temple of Luxor, on stele, in laudatory biographic inscriptions. There is nothing meant to be concealed in all this; indeed, many of the statements are repeated in ordinary form right next to the altered ones. Why, then, the transformations? Sometimes for essentially the same reason as in Khnumhotep’s tomb: to impress the reader. Occasionally for a calligraphic or decorative effect; rarely, to indicate a contemporary pronunciation; perhaps even for a deliberate archaism as a reaction against foreign influence.

But many inscriptions are tinctured, for the first time, with the second essential for cryptology—secrecy. In a few cases, the secrecy was intended to increase the mystery and hence the arcane magical powers of certain religious texts. But the secrecy in many more cases resulted from the understandable desire of the Egyptians to have passersby read their epitaphs and so confer upon the departed the blessings written therein. In Egypt, with its concentration upon the afterlife, the number of these inscriptions soon proliferated to such an extent that the attention and the goodwill of visitors flagged. To revive their interest, the scribes deliberately made the inscriptions a bit obscure. They introduced the cryptographic signs to catch the reader’s eye, make him wonder, and tempt him into unriddling them—and so into reading the blessings. It was a sort of Madison Avenue technique in the Valley of the Kings. But the technique failed utterly. Instead of interesting the readers, it evidently destroyed even the slightest desire to read the epitaphs, for soon after the funerary cryptography was begun, it was abandoned.

The addition of secrecy to the transformations produced cryptography. True, it was more of a game than anything else—it sought to delay comprehension for only the shortest possible time, not the longest—and the cryptanalysis was, likewise, just a puzzle. Egypt’s was thus a quasi cryptology in contrast to the deadly serious science of today. Yet great things have small beginnings, and these hieroglyphs did include, though in an imperfect fashion, the two elements of secrecy and transformation that comprise the essential attributes of the science. And so cryptology was born.

In its first 3,000 years, it did not grow steadily. Cryptology arose independently in many places, and in most of them it died the deaths of its civilizations. In other places, it survived, embedded in a literature, and from this the next generation could climb to higher levels. But progress was slow and-jerky. More was lost than retained. Much of the history of cryptology of this time is a patchwork, a crazy quilt of unrelated items, sprouting, flourishing, withering. Only toward the Western Renaissance does the accreting knowledge begin to build up a momentum. The story of cryptology during these years is, in other words, exactly the story of mankind.

China, the only high civilization of antiquity to use ideographic writing, seems never to have developed much real cryptography—perhaps for that reason. Diplomats and military authorities relied mainly on oral statements, memorized and delivered by messenger. For written messages, the Chinese would often write on exceedingly thin silk or paper, which they rolled into a ball and covered with wax. The messenger hid the wax ball, or “la wan,” somewhere about his person, or in his rectum, or he sometimes swallowed it. This, of course, was a form of steganography.

Actual cryptography often involved open codes. If a man’s name included the ideogram for “chrysanthemum,” the correspondents would refer to him as“the yellow flower.” But for military purposes, the 11th-century compilation, Wu-ching tsung-yao (“Essentials from Military Classics”), recommended a true if small code. To a list of 40 plaintext items, ranging from requests for bows and arrows to the report of a victory, the correspondents would assign the first 40 ideograms of a poem. Then, when a lieutenant wished, for example, to request more arrows, he was to write the corresponding ideogram at a specified place on an ordinary dispatch and stamp his seal on it. The general could put down the same character with his own seal to indicate approval, or his seal without the character to indicate disapproval. Even if the message were intercepted, the code portion would remain secret.

Hieroglyphic encipherments of proper names and titles, with cipher hieroglyphs at left, plain equivalents at right

It is questionable, however, whether such methods were much used. The greatest conqueror of them all, Genghis Khan, seems never to have made use of cryptography. Nor do ciphers seem possible. The ideographic nature of the language precludes them. The cipher-like technique of altering the form of the ideograms by shifting lines or elements from one place to another in the pattern would be, one authority has said, neither practical nor effective. In fact, one of the apparently few cryptologic episodes in the history of China involves a Western alphabet.

In 1722, Yin-t’ang, ninth son of the late Emperor Shêng-tsu, lost out to his elder brother, Yin-chên, in a struggle for the throne. He was banished to Sining. With him went his supporter, a Portuguese missionary named João Mourão, who had taught him the Latin alphabet. Yin-t’ang used it for a code with his son. Early in 1726, a letter from the son in this alphabet was intercepted by agents of Emperor Yin-chên. Ever alert for such an opportunity, the emperor used it as evidence to condemn his brother’s activities as treasonable, expel him from the Imperial Clan, and remove him from Sining to Paoting, Chihli. Here Yin-t’ang was confined in a small house surrounded by high walls; he received his food by pulleys. Within a few months he was dead of dysentery. The emperor announced that his brother had been called to justice by the netherworld. Mourão himself died in confinement at about the same time.

Why did China, so far ahead of other civilizations in so many things, not develop cryptography? An astute comment by Professor Owen Lattimore of the University of Leeds may give the reason. “Although writing is extremely old in the Chinese culture, literacy was always restricted to such a small minority that the mere act of putting something into writing was to a certain extent equivalent to putting it into code.”

In China’s great neighbor to the west, India, whose civilization likewise developed early and to high estate, several forms of secret communications were known and, apparently, practiced. The Artha-śāstra, a classic work on statecraft attributed to Kautilya, in describing the espionage service of India as practically riddling the country with spies, recommended that the officers of the institutes of espionage give their spies their assignments by secret writing. The Lalita-Vistara, a work that extols the career and excellencies of the Buddha, tells how Buddha astounded the tutor who was to teach him writing by enumerating 64 different kinds. Some of these, such as the perpendicular writing, or the disordered writing, or the scattered writing, or the cross writing, are sometimes regarded as cryptographic, though many are fanciful and probably never existed.

Perhaps most interesting to cryptologists, amateur or professional, is that Vātsyāyana’s famous textbook of erotics, the Kāma-sūtra, lists secret writing as one of the 64 arts, or yogas, that women should know and practice. It is 45th in a list that begins with vocal music and runs through prestidigitation, solution of verbal puzzles, and exercises in enigmatic poetry. The yoga is called “mlecchita-vikalpā.” In his commentary on the Kāma-sūtra, Yaśod-hara describes two kinds of mlecchita-vikalpā. One is called “kautiliyam,” in which the letter substitutions are based upon phonetic relations—the vowels become consonants, for example. A simplification of this form is called “dur-bodha.” Another kind of secret writing is “mūladevīya.” Its cipher alphabet consists merely of the reciprocal one with all other letters remaining unchanged. Mūladevīya existed in both a spoken form—as such it figures in Indian literature and is used by traders, with geographical variations—and a written form, in which case it is called “gūdhalekhya.”

Beyond these unquestioned types of cryptography, ancient India made use of allusive language, a sort of impromptu open code called “sābhāsa,” and a finger communication, “nirābhāsa,” in which the phalanges stand for the consonants and the joints for the vowels. Deaf and dumb people still use it, as do traders and moneylenders.

Whether India owes this profusion of mentions of cryptography to actual use or to her great interest in grammar and language in general—the world’s first grammarian, Pānini, was an Indian—remains in question. That cryptology is not mentioned in the classic drama of political intrigue, the MudrāRāksasa, suggests that it was not widely used. On the other hand, the Arthaśāstra, which was written sometime between 321 and 300 B.C., recommended that ambassadors use cryptanalysis to obtain intelligence: “If there is no possibility of carrying on any such conversation (conversation with the people regarding their loyalty), he [the envoy] may try to gather such information by observing the talk of beggars, intoxicated and insane persons, or of persons babbling in sleep, or by observing the signs made in places of pilgrimage and temples, or by deciphering paintings or secret writings.” (One begins to wonder whether Kautilya, by putting cryptanalysis in the company of such sources, meant to praise or damn it.) Nevertheless, though he gives no suggestions on how to solve either paintings or secret writings, the fact that he knows that solution is possible bespeaks some cryptologic sophistication. His is, moreover, the first reference in history to cryptanalysis for political purposes.

The fourth great civilization of antiquity, the Mesopotamian, rather paralleled Egypt early in its cryptographic evolution, but then surpassed it, attaining a surprisingly modern level of cryptography. Its oldest encipherment appears in a tiny cuneiform tablet only about 3 by 2 inches, dating from about 1500 B.C. and found on the site of ancient Seleucia on the banks of the Tigris. It contains the earliest known formula for the making of glazes for pottery. The scribe, jealously guarding his professional secret, used cuneiform signs—which could have several different syllabic values—in their least common values. His method resembles George Bernard Shaw’s way of using the /f/ sound of GH in “tough,” the /i/ sound of o in “women,” and the /sh/ sound of TI in “nation” to write fish as GHOTI. The scribe also truncated sounds by ignoring the final consonant of several syllabic signs, and spelled the same word with different signs at different places. Interestingly, as knowledge of glaze-making spread, the need for secrecy evaporated, and later texts were written in straightforward language.

The Babylonian and Assyrian scribes sometimes used rare or unusual cuneiform signs in signing and dating their clay tablets. These ending formulas, called “colophons,” were short and stereotyped, and the substitution of the unusual signs for the usual were not intended to conceal but simply to show off the scribe’s knowledge of cuneiform to later copyists. Nothing precisely like this exists in the modern world, because literacy is so widespread and spelling so standardized. But comparable might be a businessman’s writing “We beg to acknowledge receipt of your communication of the 25th ult.” instead of “Thank you for your letter of May 25,” or a schoolboy’s using long words where short would do—both seeking to impress their readers with their learning.

In the final period of cuneiform writing, in colophons written at Uruk (in present-day Iraq) under the Seleucid kings in the last few score years before the Christian era, occasional scribes converted their names into numbers. The encipherment—if such it be—may have been only for amusement or to show off. Because colophons are so stereotyped, and because several of the enciphered ones have only one or two number signs among many plaintext, Assyriologists have been able to “cryptanalyze” them. For example, a tablet giving lunar eclipses for from 130 to 113 B. C. includes in its colophon “palih 21 50 10 40 la….” Comparing this with the identical formula in plaintext in another tablet, Otto Neugebauer determined that 21 = Anu, 50 = u, 10 40 = An-tu. The formula reads: “He who worships Anu and Antu shall not remove it [the tablet].” With the help of these equivalencies, Erie Leichty attacked the signature at the foot of a large tablet reciting a myth of the goddess Ishtar that might be an indirect source of the biblical story of Esther, whose name might be another version of “Ishtar.” The signature reads “tuppi ¹21 35 35 26 44 apil ¹21 11 20 42,” or “tablet of Mr. 21 35 35 26 44, son of Mr. 21 11 20 42.” Leichty suggested that the solution was “tablet of Mr. Anu-aba-uttirri, son of Mr. Anu-bel-su-nu,” whose father-son relationship is well known.

Other tablets employ the same numbers with the same values. No simple relationship between the equivalencies appears. “A check of the various lexical series shows that the numbers are not based on a counting of signs either forward from the beginning of the series, nor backward from the end,” wrote Leichty. “It is of course possible that a tablet of equations between numbers and signs existed.” He suggested that two little tablet-fragments from Susa (in present-day Iran) might comprise such a codebook, but added that they were too short to be certain. The broken pieces of clay list cuneiform numbers in order in a vertical column; opposite them stand cuneiform signs. Unfortunately, none of the numbers used in the cryptograms occur on these fragments (except for 35, whose cuneiform sign is blurred to illegibility), and so it is not possible to determine whether these tablets served as the codebook for the colophon cryptography. But if they are indeed codebooks, they are the oldest in the world.

The Holy Scriptures themselves have not escaped a touch of cryptography—or protocryptography, to be precise, for the element of secrecy is lacking. As with the hieroglyphics in the tomb of Khnumhotep or the colophons of the Mesopotamian scribes, the transformations are present without any apparent desire to conceal. Probably the main motives in the biblical transformations, as with the others, were the human ones of pride and a longing for immortality, attained here by making a textual alteration which, as later scribes faithfully copied it, would transmit a bit of one’s self down through the centuries. If this was in fact the idea, it most certainly succeeded.

Hebrew tradition lists three different transformations in the Old Testament (none are recorded for the New). In Jeremiah 25:26 and 51:41, the form SHESHACH appears in place of Babel (“Babylon”). The second occurrence strikingly demonstrates the lack of a secrecy motive, since the phrase with SHESHACH is immediately followed by one using “Babylon”:

A cuneiform tablet from Susa lists the numbers from 1 to 8 and from 32 to 35 opposite parallel columns of cuneiform signs in what might be the oldest codebook in the world

How is Sheshach taken!

And the praise of the whole earth seized!

How is Babylon become an astonishment

Among the nations!

Confirmation that SHESHACH is really a substitute for Babel and not a wholly separate place comes from the Septuagint and the Targums, the Aramaic paraphrases of the Bible, which simply use “Babel” where the Old Testament version has SHESHACH. The second transformation, at Jeremiah 51:1, puts LEB KAMAI (“heart of my enemy”) for Kashdim (“Chaldeans”).

Both transformations resulted from the application of a traditional substitution of letters called “atbash,” in which the last letter of the Hebrew alphabet replaces the first, and vice versa; the next-to-last replaces the second, and vice versa; and so on. It is the Hebrew equivalent of a = z, b = Y, C = x, … Z = A.

Consequently, in Babel, the repeated b, or beth, the second letter of the Hebrew alphabet, became the repeated SH, or SHIN, the next-to-last letter, in SHESHACH. Similarly, the I, or lamed, became the hard CH, or KAPH. The kaph of Kashdim reciprocally became the LAMED of LEB KAMAI. In this determination, the Hebrew letters sin and shin, which differ only by where a dot is placed, are regarded as the same letter. The only letters in Hebrew are consonants and two silent letters, aleph and ayin; vowels are represented by dots or lines, usually below the letters. What is a final i in the English LEB KAMAI is a letter YOD in Hebrew, whose atbash reciprocal is mem. The word “atbash,” incidentally, derives from the very procedure it denotes, since it is composed of aleph, taw, beth, and shin—the first, last, second, and next-to-last letters of the Hebrew alphabet.

Both SHESHACH and LEB KAMAI have considerably embarrassed biblical commentators. They have devised numerous ingenious explanations for why so odd a result as LEB KAMAI would be desired, or why secrecy was wanted. Some have even thought Sheshach the name of a Babylonian district. But the idea of simple scribal manipulation, which would mean that such desires never even existed, and which is advanced by modern authorities and bolstered by the similar examples from other cultures and by the predilection of scribes for amusing themselves with word and alphabet games, seems the best explanation.

The two transformations by atbash are straightforward and universally recognized. The third transformation in the Old Testament, which resulted from a different substitution system, is disputed. The system is called “albam.” It splits the Hebrew alphabet in half and equates the two halves. Thus, the first letter of the first half, aleph, substitutes for the first letter of the second half, lamed, and vice versa; the second of the first half, beth, for the second of the second half, mem, and vice versa; and so on. The term “albam” derives from the first four letters of this arrangement. According to the Midrash Rabbah (Numbers 18:21), the name TABEEL in Isaiah 7:6 is an albam transformation for Remala, or “Remaliah,” who figures in verses 1 and 4. But while the albam works for the first two letters (the third, lamed, retains its identity because it would otherwise be transformed into a silent aleph), the “solution” does not clarify the text. The Midrash Rabbah does not give any reasons for thinking it albam. Most authorities seem to regard “Tabeel” as a corruption or some form of contemptuous epithet, and not as albam. In this connection it might be noted that many authorities also think that the meaningless names Shadrach, Meshach, and Abed-nego represent distortions, deliberate or accidental, of the names of real kings or countries. Shadrach, for example, may stand for Marduk—Hebrew samekh and mem look alike, and the transposition of consonants is not an uncommon linguistic phenomenon.

Hebrew literature records a third traditional form of letter substitution. It is called “atbah,” and, like atbash and albam, its name stems from its system. This is based on Hebrew numbers, which, like Roman numbers, were written with the letters of the Hebrew alphabet. Within the first nine letters of the alphabet, the substitutes were chosen so that their numerical value would add up to 10. Thus, aleph, the first letter, would be replaced by teth, the ninth, and vice versa; beth, the second, by heth, the eighth, and vice versa. The remaining letters were paired on a similar system that would total to the Hebrew digital version of 100. In decimal notation, this means that the two letters will add up to 28. Thus mem, the 13th letter, and samekh, the 15th, replace one another. What happens to the 19th letter and those beyond is not clear. The 5th letter, he, and the 14th, nun, which under the system would represent themselves, are made to replace each other. This rather confusing system of atbah is not used in the Bible, though there is at least one use in the Babylonian Talmud (Seder Mo’ed, Sukkah, 52b). This example plays on the word “witness” and its atbah substitution “master” to make a moral point.

These three substitutes are used here and there throughout Hebrew writing, particularly atbash, which is the most common. Their importance consists, however, in that the use of atbash in the Bible sensitized the monks and scribes of the Middle Ages to the idea of letter substitution. And from them flowed the modern use of ciphers—as distinct from codes—as a means of secret communication.

While SHESHACH and LEB KAMAI are an imperfect cryptography because, although they are transformations, they lack the element of secrecy, another “cryptogram” in the Bible—perhaps the most famous in the world—is imperfect for the opposite reason. It was shrouded in secrecy, but it apparently involved no transformation!

This is the message of the handwriting on the wall. It appeared ominously at Belshazzar’s feast: MENE MENE TEKEL UPHARSIN. The real mystery is not what the words meant but why the king’s wise men could not read it. The Bible says nothing about secret or unusual writing, and the words themselves are ordinary roots in Aramaic (the language, related to Hebrew, in which the book of Daniel is written) meaning “numbered,” “weighed,” and “divided.” When Belshazzar summoned Daniel, the latter had no difficulty in reading the handwriting and interpreting the three words: “MENE, God hath numbered thy kingdom, and brought it to an end. TEKEL, thou art weighed in the balances, and art found wanting, PERES, thy kingdom is divided [perisa] and given to the Medes and Persians [paras],” with the extra play on PERES, which, in Aramaic, would be identical with UPHARSIN. The message may also reflect a series of pieces of money whose names stem from the Aramaic roots: a mina, a tekel (the Aramaic equivalent for shekel, which is 1/60 th of a mina), and a peres, which is a half-mina. Though the order is illogical, the series might symbolize the breaking up of the Babylonian empire and its wealth. Dr. Cyrus Gordon has devised an ingenious American equivalent that makes this clear: “You will be quartered, halved, and cent to perdition.”

With all these interpretations possible, it seems strange that the Babylonian priests could not read what was essentially a plain-language message. Perhaps they feared to give the bad news to Belshazzar, or perhaps God blinded them and opened the eyes of Daniel. Whatever the reason, Daniel alone penetrated the enigma and became, in consequence, the first known cryptanalyst. And just as there were giants in the earth in those days, so the biblical reward for cryptanalysis far exceeded any that has been given ever since: “They clothed Daniel with purple, and put a chain of gold around his neck, and made proclamation concerning him that he should rule as one of three in the kingdom.”

“Queen Anteia, Proetus’s wife, had fallen in love with the handsome youth,” the “incomparable Bellerophon … who was endowed with every manly grace, and begged him to satisfy her passion in secret.” So Homer begins the story in the Iliad that includes the world’s first conscious reference to—as distinct from use of—secret writing.

“But Bellerophon was a man of sound principles and refused. So Anteia went to King Proetus with a lying tale. ‘Proetus,’ she said, ‘Bellerophon has tried to ravish me. Kill him—or die yourself.’ The king was enraged when he heard this infamous tale. He stopped short of putting Bellerophon to death—it was a thing he dared not do—but he packed him off to Lycia with sinister credentials from himself. He gave him a folded tablet on which he had traced a number of devices with a deadly meaning, and told him to hand this to his father-in-law, the Lycian king, and thus ensure his own death.”

The Lycian king feasted Bellerophon for nine days. “But the tenth day came, and then, in the first rosy light of Dawn, he examined him and asked to see what credentials he had brought him from his son-in-law Proetus. When he had deciphered the fatal message from his son-in-law, the king’s first step was to order Bellerophon to kill the Chimera,” a fire-breathing monster with a lion’s head, a goat’s body, and a serpent’s tail. Bellerophon did. The Lycian king then tried one ruse after another to carry out the surreptitious instructions, but Bellerophon successively battled the Solymi, defeated the Amazons, and slew the best warriors of Lycia, who had ambushed him. In the end the Lycian king relented, realizing that the youth stood under the divine protection of the gods, and gave him his daughter and half his kingdom.

This is the only mention of writing in the Iliad. Homer’s language is not precise enough to tell exactly what the markings on the tablets were. They were probably nothing more than ordinary letters—actual substitution of symbols for letters seems too sophisticated for the era of the Trojan War. But the mystery that Homer throws around the tablets does suggest that some rudimentary form of concealment was used, perhaps some such allusion as “Treat this man as well as you did Glaucus,” naming someone whom the king had had assassinated. The whole tone of the reference makes it fairly certain that here, in the first great literary work of European culture, appear that culture’s first faint glimmerings of secrecy in communication.

A few centuries later, those glimmerings had become definite beams of light. Several stories in the Histories of Herodotus deal specifically with methods of steganography (not, however, with cryptography). Herodotus tells how a Median noble named Harpagus wanted to avenge himself on his relative, the king of the Medes, who years before had tricked him into eating his own son. So he hid a message to a potential ally in the belly of an un-skinned hare, disguised a messenger as a hunter, and sent him off down the road, carrying the hare as if he had just caught it. The road guards suspected nothing, and the messenger reached his destination. At it was Cyrus, king of Persia, whose country was then subject to Medea and who had himself been the target of a babyhood assassination attempt by the Medean king. The message told him that Harpagus would work from within to help him dethrone the Medean king. Cyrus needed no further urging. He led the Persians in revolt; they defeated the Medes and captured the king, and Cyrus was on his way to winning the epithet “the Great.”

Herodotus tells how another revolt—this one against the Persians—was set in motion by one of the most bizarre means of secret communication ever recorded. One Histiaeus, wanting to send word from the Persian court to his son-in-law, the tyrant Aristagoras at Miletus, shaved the head of a trusted slave, tattooed the secret message thereon, waited for a new head of hair to grow, then sent him off to his son-in-law with the instruction to shave the slave’s head. When Aristagoras had done so, he read on the slave’s scalp the message that urged him to revolt against Persia.

One of the most important messages in the history of Western civilization was transmitted secretly. It gave to the Greeks the crucial information that Persia was planning to conquer them. According to Herodotus,

The way they received the news was very remarkable. Demaratus, the son of Ariston, who was an exile in Persia, was not, I imagine—and as is only natural to suppose—well disposed toward the Spartans; so it is open to question whether what he did was inspired by benevolence or malicious pleasure. Anyway, as soon as news reached him at Susa that Xerxes had decided upon the invasion of Greece, he felt that he must pass on the information to Sparta. As the danger of discovery was great, there was only one way in which he could contrive to get the message through: this was by scraping the wax off a pair of wooden folding tablets, writing on the wood underneath what Xerxes intended to do, and then covering the message over with wax again. In this way the tablets, being apparently blank, would cause no trouble with the guards along the road. When the message reached its destination, no one was able to guess the secret until, as I understand, Cleomenes’ daughter Gorgo, who was the wife of Leonidas, discovered it and told the others that, if they scraped the wax off, they would find something written on the wood underneath. This was done; the message was revealed and read, and afterwards passed on to the other Greeks.

The rest is well-known. Thermopylae, Salamis, and Plataea ended the danger that the flame of Western civilization would be extinguished by an Oriental invasion. The story is not without a certain bitter irony, however, for Gorgo, who may be considered the first woman cryptanalyst, in a way pronounced a death sentence on her own husband: Leonidas died at the head of the heroic band of Spartans who held off the Persians for three crucial days at the narrow pass of Thermopylae.

It was the Spartans, the most warlike of the Greeks, who established the first system of military cryptography. As early as the fifth century B.C., they employed a device called the “skytale,” the earliest apparatus used in crypto-logy and one of the few ever devised in the whole history of the science for transposition ciphers. The skytale consists of a staff of wood around which a strip of papyrus or leather or parchment is wrapped close-packed. The secret message is written on the parchment down the length of the staff; the parchment is then unwound and sent on its way. The disconnected letters make no sense unless the parchment is rewrapped around a baton of the same thickness as the first: then words leap from loop to loop, forming the message.

Thucydides tells how it enciphered a message from the ephors, or rulers, of Sparta, ordering the too-ambitious Spartan prince and general Pausanius to follow the herald back home from where he was trying to ally himself with the Persians, or have war declared against him by the Spartans. He went. That was about 475 B.C. About a century later, according to Plutarch, another skytale message recalled another Spartan general, Lysander, to face charges of insubordination. Xenophon also records the skytale’s use in enciphering a list of names in an order sent to another Spartan commander.

The world owes its first instructional text on communications security to the Greeks. It appeared as an entire chapter in one of the earliest works on military science, On the Defense of Fortified Places, by Aeneas the Tactician. He retold some of Herodotus’ stories, and listed several systems. One replaced the vowels of the plaintext by dots—one dot for alpha, two for epsilon, and so on to seven for omega. Consonants remained unenciphered. In a steganographic system, holes representing the letters of the Greek alphabet were bored through an astragal or a disk. Then the encipherer passed yarn through the holes that successively represented the letters of his message. The decipherer would presumably have to reverse the entire text after unraveling the thread. Another steganographic system was still in use in the 20th century: Aeneas suggested pricking holes in a book or other document above or below the letters of the secret message. German spies used this very system in World War I, and used it with a slight modification in World War II—dotting the letters of newspapers with invisible ink.

Another Greek writer, Polybius, devised a system of signaling that has been adopted very widely as a cryptographic method. He arranged the letters in a square and numbered the rows and columns. To use the English alphabet, and merging i and j in a single cell to fit the alphabet into a 5 × 5 square: Each letter may now be represented by two numbers—that of its row and that of its column. Thus e = 15, v = 51. Polybius suggested that these numbers be transmitted by means of torches—one torch in the right hand and five in the left standing for e, for example. This method could signal messages over long distances. But modern cryptographers have found several characteristics of the Polybius square, or “checkerboard,” as it is now commonly called, exceedingly valuable—namely, the conversion of letters to numbers, the reduction in the number of different characters, and the division of a unit into two separately manipulable parts. Polybius’ checkerboard has therefore become very widely used as the basis of a number of systems of encipherment.

These Greek authors never said whether any of the substitution ciphers they described were actually used, and so the first attested use of that genre in military affairs come from the Romans—and from the greatest Roman of them all, in fact. Julius Caesar tells the story himself in his Gallic Wars. He had proceeded by forced marches to the borders of the Nervii, and

There he learned from prisoners what was taking place at Cicero’s station, and how dangerous was his case. Then he persuaded one of the Gallic troopers with great rewards to deliver a letter to Cicero. The letter he sent written in Greek characters, lest by intercepting it the enemy might get to know of our designs. The messenger was instructed, if he could not approach, to hurl a spear, with the letter fastened to the thong, inside the entrenchment of the camp. In the dispatch he wrote that he had started with the legions and would speedily be with him, and he exhorted Cicero to maintain his old courage. Fearing danger, the Gaul discharged the spear, as he had been instructed. By chance it stuck fast in the tower, and for two days was not sighted by our troops; on the third day it was sighted by a soldier, taken down, and delivered to Cicero. He read it through and then recited it at a parade of the troops, bringing the greatest rejoicing to all.

The garrison, heartened, held out until Caesar arrived and relieved them.

Later, Caesar improved on this technique and, in doing so, impressed his name permanently into cryptology as he did into so many other fields. Suetonius, the gossip columnist of ancient Rome, says that Caesar wrote to Cicero and other friends in a cipher in which the plaintext letters were replaced by letters standing three places further down the alphabet, D for a, E for b, etc. Thus, the message Omnia Gallia est divisa in partes tres would be enciphered (using the modern 26-letter alphabet) to RPQLD JDOOLD HVW GLYLVD LQ SDUWHV WUHV. To this day, any cipher alphabet that consists of the standard sequence, like Caesar’s:

is called a Caesar alphabet, even if it begins with a letter other than D. A later writer, Aulus Gellius, seems to imply that Caesar sometimes used more complicated systems. But Caesar’s nephew Augustus, first emperor of Rome and less able than his uncle in a number of ways, also employed a weaker cipher. “When Augustus wrote in cipher,” said Suetonius, “he simply substituted the next letter of the alphabet for the one required, except that he wrote AA for x” (the last letter of the Roman alphabet).

Cryptography seems to have been not at all uncommon in the Roman state. Suetonius’s phraseology implies that the two Caesars employed it habitually and not on a single isolated occasion. Cicero used SAMPSICERAMUS and ARABARCHES and HIEROSOLYMARIUS as mocking codenames for Pompey; they all allude to persons and places of importance in Pompey’s career. Many Latin writers mention rudimentary forms of secret communication. A grammarian named Probus, probably Valerius Probus, even wrote a treatise on the ciphers of Julius Caesar; this has not survived, and is the first of several Lost Books of Cryptology.

It must be that as soon as a culture has reached a certain level, probably measured largely by its literacy, cryptography appears spontaneously—as its parents, language and writing, probably also did. The multiple human needs and desires that demand privacy among two or more people in the midst of social life must inevitably lead to cryptology wherever men thrive and wherever they write. Cultural diffusion seems a less likely explanation for its occurrence in so many areas, many of them distant and isolated.

The Yezidis, an obscure sect of about 25,000 people in northern Iraq, use a cryptic script in their holy books because they fear persecution by their Moslem neighbors. Tibetans use a kind of cipher called “rin-spuns” for official correspondence; it is named for its inventor Rin-c’(hhen-)spuns(-pa), who lived in the 1300s. The Nsibidi secret society of Nigeria keeps its pictographic script from Europeans as much as possible because it is used chiefly to express love in rather direct imagery, and samples appear to be at least as pornographic as they are cryptographic. The cryptography of Thailand developed under Indian influence. An embryonic study of the subject even appears in a grammatical work entitled Poranavakya by Hluang Prasot Aksaraniti (Phe). One system, called “the erring Siamese,” substitutes one delicate Siamese letter for another. In another system, consonants are divided into seven groups of five letters; a letter is indicated by writing the Siamese number of its group and placing vertical dots under it equal in number to the letter’s place in its group. A system called “the hermit metamorphosing letters” writes the text backwards.

“The erring Siamese”—a form of Thai cryptography with plaintext in upper lines, cipher in lower

As isolated an area as the Maldive Islands in the Indian Ocean uses two kinds of secret writing. “Harha tana” involves reciprocal substitution between consecutive letters of their alphabet, the “gabuli tana,” so that h =RH and rh = H, and so forth, the first equivalent perhaps giving rise to the name of the system. “De-fa tana” effects substitutions between the halves of the gabuli tana. In Malaya, natives call their cryptographic alphabet the “gangga malayu”; it consists of the slightly altered or inverted characters of the Malayan Arabic alphabet, with some Javanese marks. In Armenia in the 16th century, two scribes employed a Polybius-like checkerboard to inject an air of special hidden knowledge into religious texts; a third composed his ciphertext by writing two letters whose numerical value equaled that of the plaintext letter—z, with value 6, became GG, each G having a value 3.

Persia, in the first half-millennium after Christ, apparently made use of cryptography for political purposes. A chronicler mentioned a “script called ‘shāh-dabīrīya,’ and the kings of the Persians used to speak it among themselves to the exclusion of commoners and prevent the rest of the people of the kingdom from [learning] it for fear that one who was not a king should discover the secrets of the kings.” He also referred to “another script called ‘rāzsahrīya,’ in which the kings used to write secrets [in correspondence] with those of other nations that they wished, and the number of its consonants and vowels is forty, and each of the consonants and vowels has a known form, and there is no trace in it of the Nabataean language.” Though the historian gave no examples, a 10th-century compiler of a handbook for secretaries, in setting down two monalphabetic substitutions, said that they were of Persian origin. One substituted the names of birds for the letters of the alphabet. The other equated the letters of the alphabet with the names of the 28 astronomical lunar mansions: the two horns of the ram, the ram’s belly, the Pleiades, and so on.

At the Coptic monastery of St. Jeremias in Saqqara, Egypt, perhaps just before it was abandoned late in the sixth century A.D., a man enciphered a message in monalphabetic substitution and scratched it on the wall inside the door to a courtyard in a curious bid for immortality. “In the name of God before all things,” the inscription calls out beseechingly across the centuries, “I, Victor, the humble poor man—remember me.” Victor’s encipherment of his plea gave him his wish. At the site of another Coptic monastery, the seventh-century one of Epiphanius at Sheikh-abd-el-Gourna in southern Egypt, there was found an unusual object in the cell of a priest named Elias. It was a dried-out piece of wood about a foot long and four inches high, bearing two lines of writing in black ink. The top line is a slightly garbled verse in Greek, notable not for its beauty but because it includes all the letters of the Coptic Greek alphabet. It spills over for five letters into the bottom line, which contains 21 letters of that alphabet, divided into four unequal sections that are reversed and shuffled. How Priest Elias used it is not known, but it does seem fairly certain that this wooden tablet, now in the Metropolitan Museum of Art in New York, is the oldest surviving cipher key (as distinguished from the codelike cuneiform tablets) in the world.

The hardy plant of cryptography sprouted not only in these sunblasted climes but also in the damp, chill lands to the north. Two non-Latin scripts of Europe, Teutonic runes and Celtic oghams, were occasionally enciphered.

Runes flourished in Scandinavia and in Anglo-Saxon Britain during the seventh, eighth, and ninth centuries. They were nearly always used for religious purposes. A stark, angular script, its alphabet was divided into three groups of eight runic letters each. The letter thorn, for example, which looked somewhat like a modern p and represented the initial sounds of “thin” and “then,” was the third letter of the first group. All systems of runic cryptography replaced runic letters by groups of marks indicating the number of a letter’s group and the number of its place in that group. Isruna used the short i rune, a short vertical stroke named “is,” to give the number of the group, and the long i rune to give the place number. Thus thorn—group 1, letter 3—would be replaced by a single short vertical mark and three longer vertical marks. Another system of runic cryptography, hahalruna, attached diagonal strokes representing these numbers to a vertical shaft, putting the group marks on the left, the place marks on the right. Sometimes shafts were crossed. Other variations on this theme were lagoruna, stopfruna, and clopfruna. Cryptographic runes occur in many places, most profusely on the Rök stone, a 13-foot-high slab of granite standing at the western end of the Rök churchyard in Sweden. It includes among its more than 770 runic letters a veritable catalog of runic cryptography.

The 13-foot-high Rök stone of Sweden, covered with enciphered runes

Three forms of enciphered ogham: head of quarreling, interwoven, and well-footed ogham as shown in the “Book of Ballymote”

Ogham survives chiefly in inscriptions on tombstones. Its alphabet consists of five groups of five letters, represented by one to five lines extending away from a horizontal line. In the first group, the lines extend above the horizontal line; in the second group, below it; in the third, perpendicularly above and below; in the fourth, diagonally above and below; the fifth group is heterogeneous. Methods for enciphering them are catalogued in the “Book of Ballymote,” a 15th-century compilation of historical, genealogical, and other facts of importance.

The most delightful thing about these systems is their names, the most charming in cryptology, which have been bestowed with all the Irish flair for poetry, blarney, and wit. There is, for an example, a system called “the ogham that bewildered Bres,” in which the name of the letter stands for the letter, as if one were to encipher who as DOUBLE-YOU AITCH OH. The name comes from a story that a message thus concealed was given to the ancient hero Bres as he was going into battle, and so confused him by its complications that he lost the battle while trying to figure it out. “Sanctuary ogham” puts a stroke between every pair of letters. “Serpent through the heather” runs a wavy line above and below the successive letters. “Great speckle” has a single mark of appropriate slant and length for the letter, followed by as many dots, less one, as there are strokes in the letter. In “twinned ogham” each letter is doubled; in “host ogham,” tripled. “Vexation of a poet’s heart” reduces the lines to short marks extending beyond an empty rectangle. In “point against eye,” the alphabet is reversed. In “fraudulent ogham” the letters are replaced by symbols one step further on. And a system in which the chaotic order of the substitutes seems to have resulted from an infuriated Irishman’s knocking them about with a shillelagh is called “outburst of rage ogham.” Probably none of these ever actually enciphered ogham. They seem to have been just dreamed up for fun. But the bottom of one of the pages of the “Book of Ballymote” is written in another system called “Bricriu’s ogham.” With some emendation, it can be interpreted as a fragment of an ancient Druidic liturgy —probably the only one known to the modern world, and, fittingly, the only place in which enciphered oghams were ever used.

In the Europe of the Latin alphabet—from which modern cryptology would spring—cryptography flickered weakly. With the collapse of the Roman empire, Europe had plunged into the obscurity of the Dark Ages. Literacy had all but disappeared. Arts and sciences were forgotten, and cryptography was not excepted. Only during the Middle Ages occasional manuscripts, with an infrequent signature or gloss or “deo gratias” that a bored monk put into cipher to amuse himself, fitfully illuminate the cryptologic darkness, and, like a single candle guttering in a great medieval hall, their feeble flarings only emphasize the gloom.

The systems used were simple in the extreme. Phrases were written vertically or backwards; dots were substituted for vowels; foreign alphabets, as Greek, Hebrew, and Armenian, were used; each letter of the plaintext was replaced by the one that follows it; in the most advanced system, special signs substituted for letters. For almost a thousand years, from before 500 to 1400, the cryptology of Western civilization stagnated. An “advanced” system is as likely to appear in the 600s as in the 1400s—though the really simple systems do fade away by the end of the period.

A few names glimmer through the mists. Tradition attributes to St. Boniface, the Anglo-Saxon missionary who founded monasteries in Germany in the eighth century, the importation to the continent of cryptographic puzzles based on a dots-for-vowels system. The brilliant monk Gerbert, who reigned as Pope Sylvester II from 999 to 1003 and whose learning became legendary, kept notes in a syllabic system called “tyronian notes,” a shorthand reputedly developed by Tullius Tyro, a freed slave of Cicero’s. He even wrote his name in it on two of his bulls. Hildegard von Bingen, an 11th-century nun who saw apocalyptic visions and was later canonized, had a cipher alphabet which she claimed came to her in a flash of inspiration. In the early 800s, an Irishman named Dubthach concocted a cryptogram while at the castle of the king of Wales as a kind of malicious IQ test for visiting compatriots. He apparently wanted to embarrass them in revenge for some humiliation he had suffered at home, and was confident that “no Irish scholar, much less British,” would be able to read it. But four clever sons of Eire—Cauncho-brach, Fergus, Domminnach, and Suadbar—turned the tables on him by solving the cryptogram, which consisted of a short Latin plaintext written in Greek letters. Then they prudently sent the answer back to their teacher, urging him to “give this information to such of our simple and unsophisticated Irish brethren as may think of sailing across the British sea, lest perchance otherwise they might be made to blush in the presence of Mermin, the glorious king of the Britons, not being able to understand that inscription.”

The only writer of the Middle Ages to describe cryptography instead of just using it was Roger Bacon, the English monk of startlingly modern speculations. In his Epistle on the Secret Works of Art and the Nullity of Magic, written about the middle of the 1200s, Bacon stated: “A man is crazy who writes a secret in any other way than one which will conceal it from the vulgar,” and then listed seven deliberately vague methods of doing so. Among them are the use of consonants only, figurate expressions, letters from exotic alphabets, invented characters, shorthand, and “magic figures and spells.”

A cryptogram composed and written by Geoffrey Chaucer

Far and away the most famous of all those who had an acquaintance with cryptology in the Middle Ages was an English customs official, amateur astronomer, and literary genius named Geoffrey Chaucer. In a work called The Equatorie of the Planetis, which describes the workings of an astronomical instrument and which appears to be a companion piece to his Treatise on the Astrolabe, Chaucer included six short passages in cipher. He enciphered them with a symbol alphabet in which, for example, a is represented by a sign resembling a capital V and b by one looking like a script alpha. One passage reads: “This table servith for to entre in to the table of equacion of the mone on either side.” The encipherments give simplified directions for using the equatorie—never mind about the complicated technical explanation, just do this and that and the answer comes out right. The cryptograms are in Chaucer’s own hand, making them some of the most illustrious encipherments in history.

During all these years, cryptology was acquiring a taint that lingers even today—the conviction in the minds of many people that cryptology is a black art, a form of occultism whose practitioner must, in William F. Friedman’s apt phrase, “perforce commune daily with dark spirits to accomplish his feats of mental jiu-jitsu.”

In part it is a kind of guilt by association. From the early days of its existence, cryptology had served to obscure critical portions of writings dealing with the potent subject of magic—divinations, spells, curses, whatever conferred supernatural powers on its sorcerers. The first faint traces of this appeared in Egyptian cryptography. Plutarch reported that “sundry very ancient oracles were kept in secret writings by the priests” at Delphi. And before the fall of the Roman empire, secret writing was serving as a powerful ally of the necromancers in guarding their art from the profane.

One of the most famous magic manuscripts, the so-called Leiden papyrus, discovered at Thebes and written in the third century A.D. in both Greek and a very late form of demotic, a highly simplified version of hieroglyphics, employs cipher to conceal the crucial portions of important recipes. For example, in a section telling how to give a man an incurable skin disease, the papyrus uses secret signs to encipher the words for “skin disease” and the names of the lizards: “You wish to produce a skin-disease on a man and that it shall not be healed, a hantous-lizard and a hafleele-lizard you cook them with oil, you wash the man with them.” The plaintext in most of the cipher sections (including one telling how to make a woman desire a man, which doesn’t work) is in Greek, and the cipher alphabet consists basically of Greek letter signs. Cryptology served magical purposes frequently throughout the Middle Ages, and even in the Renaissance was still disguising important parts of alchemical formulas. A manuscript compiled at Naples between 1473 and 1490 by Arnaldus de Bruxella uses five lines of cipher to conceal the crucial part of the operation of making a philosopher’s stone.

The association of magic and cryptology was reinforced by other factors. Mysterious symbols were used in such esoteric fields as astrology and alchemy—where each planet and chemical had a special sign, like the circle and arrow for Mars—just as they were in cryptology. Like words in cipher, spells and incantations, such as “abracadabra,” looked like nonsense but in reality were potent with hidden meanings.

A very important factor was the confusion of cryptology with the Jewish kabbalah, a mystical philosophy that also interested many Christians of an occultistic turn of mind. One of its basic tenets was that language, which comes from God, reflects the fundamental spiritual nature of the world, and so expresses creation itself. Kabbalists thus produced new revelations about existence by wringing hidden meanings from every word, every letter, even every vowel point and accent mark in the Torah. “Truth,” they would say, “stands more firmly than falsehood”—an assertion based on the fact that the letters of the Hebrew word for “falsehood” all balance precariously on one leg, somewhat like an English r, whereas those of the word for “truth” all rest solidly on two feet, like h. Among their devices was gematria, which gave the letters of Hebrew words their numerical values, added them up, and then interpreted the result, often by comparing it with other words having the same total. For example, Genesis 14:14 says that Abraham came to the aid of his nephew Lot with 318 servants. But 318 is the numerical value of the name of Abraham’s servant, Eliezer. Hence the 318 were really only one—Eliezer. Less important than gematria were notarikon, which regarded the letters of words as abbreviations for whole sentences, and temurah, an interchange of letters according to various rules, including atbash. These practices work upon the same raw material as cryptology, but unlike cryptology they are flexible and speculative. Some of their laxness seemed to infect cryptology, while their mystical pronouncements seemed to add further magical elements.

Later writers boasted of their ability to solve ciphers in the same breath that they bragged of their prowess in recording human voices, in telepathy, and in communicating with people far underground or miles away. One influential writer, an abbot who believed in magic, then under condemnation by the church, wrote about it under the guise of the more innocuous cryptology—and thus intensified the association between them. Later writers discussed the two together either because they believed they went together or to impress their readers with their own dread powers. Much of this supernatural claptrap besmirched cryptology.

But, important as all these were, the view that cryptology is black magic in itself springs ultimately from a superficial resemblance between cryptology and divination. Extracting an intelligible message from ciphertext seemed to be exactly the same thing as obtaining knowledge by examining the flight of birds, the location of stars and planets, the length and intersections of lines in the hand, the entrails of sheep, the position of dregs in a teacup. In all of these, the wizardlike operator draws sense from grotesque, unfamiliar, and apparently meaningless signs. He makes known the unknown. Of course the analogy errs. Augury, astrology, palmistry, haruspication, and the other divinatory techniques are all ultimately subjective and invalid, while cryptology is objective and perfectly valid. Nevertheless, the appearance often overwhelmed this reality. The simpleminded saw magic even in ordinary deciphering. Others, more sophisticated, saw it in cryptanalysis, whose drawing the veil from something concealed and buried seemed to them both mysterious and miraculous. They equated cryptology and magic.

All this stained cryptology so deeply with the dark hues of esoterism that some of them still persist, noticeably coloring the public image of cryptology. People still think cryptanalysis mysterious. Book dealers still list cryptology under “occult.” And in 1940 the United States conferred upon its Japanese diplomatic cryptanalyses the codename MAGIC.

In none of the secret writing thus far explored has there been any sustained cryptanalysis. Occasional isolated instances occurred, as that of the four Irishmen, or Daniel, or any Egyptians who may have puzzled out some of the hieroglyphic tomb inscriptions. But of any science of cryptanalysis, there was nothing. Only cryptography existed. And therefore cryptology, which involves both cryptography and cryptanalysis, had not yet come into being so far as all these cultures—including the Western—were concerned.

Cryptology was born among the Arabs. They were the first to discover and write down the methods of cryptanalysis. The people that exploded out of Arabia in the 600s and flamed over vast areas of the known world swiftly engendered one of the highest civilizations that history had yet seen. Science flowered. Arab medicine and mathematics became the best in the world—from the latter, in fact, comes the word “cipher.” Practical arts flourished. Administrative techniques developed. The exuberant creative energies of such a culture, excluded by its religion from painting or sculpture, and inspired by it to an explication of the Holy Koran, poured into literary pursuits. Storytelling, exemplified by Scheherazade’s Thousand and One Nights, word-riddles, rebuses, puns, anagrams, and similar games abounded; grammar became a major study. And included was secret writing.

Their interest appeared early. In the Arabic year 241, which is 855,{1} the scholar Abū Bakr Ahmad ben ‘Alī ben Wahshiyya an-Nabatī included several traditional cipher alphabets used for magic in his book Kitāb shauq al-mustahām fī ma‘rifat rumūz al-aqlām (“Book of the Frenzied Devotee’s Desire to Learn About the Riddles of Ancient Scripts”). One alphabet, called “dâwoûdî,” meaning “Davidian,” from the name of the king of Israel, was developed from Hebrew letters by changes in cursive form, by adding tails to letters, or by dropping parts of them. The copyist in 1076 of a treatise on magic operations enciphered such words as “opium” in dâwoûdî. It was considered the magic alphabet par excellence, and was sometimes called “rihani,” a form of a word meaning “magic.” Another classic substitution alphabet survived as late as 1775, when it was used in a spy letter to the regent of Algiers. This script was known in Turkey as “Misirli” (“Egyptian”), in Egypt as “Shāmī” (“Syrian”), and in Syria as “Tadmurī” (“Palmyrene”). In a manuscript on the art of war, probably of 14th-century Egyptian origin, cipher concealed the crucial ingredients of compounds to be hurled into besieged strongholds. Extremist sects in Islam cultivated cryptography to conceal their writings from the orthodox.

In rare cases, the Moslem states used ciphers—not codes, which they seem not to have known—for political purposes, perhaps deriving this practice from the Persian empire, upon which they modeled much of their administration. A few documents with ciphertext survive from the Ghaznavid government of conquered Persia, and one chronicler reports that high officials were supplied with a personal cipher before setting out for new posts. But the general lack of continuity of Islamic states and the consequent failure to develop a permanent civil service and to set up permanent embassies in other countries militated against cryptography’s more widespread use. Arabic writers occasionally allude to it. A genealogical tract said of an eighth-century secretary, Mullūl ben Ibrahim ben Yahzā as-Sanhā ğī, that “he was eloquent and quickly understood divers languages; he wrote in Syriac [perhaps meaning the classical Shāmī cipher alphabet] and in secret characters etc., and he excelled in this.” The monumental survey of history written in Egypt in the 14th century by ‘Abd al-Rahmān Ibn Khaldūn, The Muqaddimah, which Arnold Toynbee has called “undoubtedly the greatest work of its kind that has ever yet been created by any mind in any time or place,” noted that officials of the governmental tax and army bureaus “use a very special code among themselves, which is like a puzzle. It makes use of the names of perfumes, fruits, birds, or flowers to indicate the letters, or it makes use of forms different from the accepted forms of the letters. Such a code is agreed upon by the correspondents between themselves, in order to be able to convey their thoughts in writing.” The names of the birds recalls the Persian system that also used them, and points to a Persian origin for at least this cipher, and by implication for others.

The Arabic “Davidian” substitution cipher

The special cryptography of the tax officials, called “qirmeh,” simplified the forms of the Arabic letters, reduced the size of their bodies and elongated their tails, dropped diacritic points, ran words together and sometimes superimposed or intermingled them, and abbreviated many words. It first appeared in Egypt in the 16th century, and most of the financial records in Istanbul, Syria, and Egypt until the latter part of the 19th century were written in qirmeh. It was used only in documents pertaining to tax affairs, in order to keep revenue information secret.

The Arabic knowledge of cryptography was fully set forth in the section on cryptology in the Subh al-a ‘sha, an enormous, 14-volume encyclopedia written to afford the secretary class a systematic survey of all the important branches of knowledge. It was completed in 1412 and succeeded in its task. Its author, who lived in Egypt, was Shihāb al-Dīn abu ‘l-’Abbās Ahmad ben ‘Ali ben Ahmad ‘Abd Allāh al-Qalqashandi. The cryptologic section, “Concerning the concealment of secret messages within letters,” has two parts, one dealing with symbolic actions and allusions, the other with invisible inks and cryptology. The section falls under a larger heading, “On the technical procedures used in correspondence by the secretaries in eastern and western lands and in the Egyptian territories, ranging over the whole period from the appearance of Islam up to our own time,” which, in turn, is within a unit headed “On the forms of correspondence.”

Qalqashandi attributed most of his information on cryptology to the writings of Tāj ad-Dīn ‘Alī ibn ad-Duraihim ben Muhammad ath-Tha’ālibī al-Mausilī, who lived from 1312 to 1361 and held various teaching and official posts under the Mamelukes in Syria and Egypt. Except for a theological treatise, none of his writings is extant, but he is reported to have authored two works on cryptology. One was a poem, “Urjūza fi ‘l-mutarjam,” in a loose meter often used for didactic poems and perhaps chosen for mnemonic purposes. The other work consisted of a prose commentary on the poem “Miftāh al-kunūz fi īdah al-marmūz.” Though this must be included among the Lost Books of cryptology, most of its information was probably preserved in Qalqashandi.

Qalqashandi began by explaining that necessity sometimes compels concealment “because an enemy places some obstacle or similar thing between the sender and the addressee, e.g., between two rulers or two other persons. [It is used] when circumventory actions are of no avail, either because of interceptory ambushes or because of thorough probes into all letters coming from either of the two parties corresponding”—the latter remark a significant revelation of the need for cryptography and of the probable practice of cryptanalysis.

After explaining that one may write in an unknown language to obtain secrecy, Ibn ad-Duraihim, according to Qalqashandi, gave seven systems of cipher: (1) One letter may replace another. (2) The cryptographer may write a word backward. Muhammad (in the consonantal Arabic alphabet) would become DMHM. (3) He may reverse alternate letters of the words of a message. (4) He may give the letters their numerical value in the system in which the Arabic letters are used as numbers, and then write this value in Arabic numerals. Muhammad becomes 40+8+40+4, and the cryptogram looks like a list of figures. (5) The cryptographer may replace each plaintext letter with two Arabic letters, whose numerical value adds up to the numerical value of the plaintext letter. After giving some examples, Qalqashandi states that “other letters can be used, so long as they add up to the number of the original letter.” (6) “He may substitute for each letter the name of a man or something like that.” (7) The cryptographer may employ the lunar mansions as substitutes for the letters, or list the names of countries, fruits, trees, etc., in a certain order, or draw birds or other living creatures, or simply invent special symbols as ciphertext replacements. The similarity of this list to Ibn Khaldūn’s suggests that both writers took their information from a 10th-century manual for secretaries by Abū Bakr Muhammad ben Yahyā as-Sūlī, who gave both the bird and lunar substitutions, reporting that they are Persian in origin.

This list encompassed, for the first time in cryptography, both transposition and substitution systems, and, moreover, gave, in system 5, the first cipher ever to provide more than one substitute for a plaintext letter. Remarkable and important as this is, however, it is overshadowed by what follows—the first exposition on cryptanalysis in history.

It appeared in full maturity in Qalqashandi’s paraphrase of Ibn ad-Duraihim, but its beginnings are probably to be found in the intense and minute scrutiny of the Koran by whole schools of grammarians in Basra, Kufa, and Baghdad to elucidate its meanings. Among other studies, they counted the frequency of words to attempt a chronology for the chapters of the Koran, certain words being considered as having been used only in the later chapters. They examined words phonetically to see whether they were native Arabic or foreign loanwords. This led to generalizations about the composition of Arabic words. For example, one grammarian, referring to the lingual letters ra’, lām, and nūn, and the labials fā’, bā’ and mīm, declared: “Now when the six (labial and lingual) letters were pronounced and emitted by the tongue, they proved easy to form, and became common in speech-patterns. So no true quinquiliteral roots are free from them, or at least from one of them.” This very rule reappeared in Ibn ad-Duraihim’s work. Also of great importance in the discovery of linguistic phenomena that led to cryptanalysis was the development of lexicography. In making a dictionary, considerations of letter-frequency and of which letters go or do not go together virtually thrust themselves upon the lexicographer. For example, the Arabs recognized early that zā’ was the rarest letter in Arabic and, contrariwise, that the omnipresence of the definite article “al-” made alif and lām the most common letters in normal style.

It is therefore quite understandable that the Arab world’s first great philologist, the first man to conceive the idea of a comprehensive dictionary, a shining light of the Basra school of grammarians, wrote a “Kitāb al-mu‘ammā” (“Book of Secret Language”) relatively early in history. This was Abū ‘Abd al-Rahmān al-Khalīl ibn Ahmad ibn ‘Amr ibn Tammām al Farāhīdī al-Zadī al Yahmadī, who lived from the Arabic year 100 to between 170 and 175 (or A.D. 718/719 to between 786 and 791). Al-Khalīl was inspired to write the “Kitāb al-mu‘ammā”—which apparently is yet another Lost Book—by his solution of a cryptogram in Greek sent him by the Byzantine emperor. When he was asked how he managed to solve it, he said, “I said (to myself), the letter must begin ‘In the name of God’ or something of that sort. So I worked out its first letters on that basis, and it came right for me”

This description, and the fact that it took him a month before he could solve it, suggests that the Arabs had not yet formulated the more analytical techniques of cryptanalysis based upon letter-frequency. This makes sense—150 years or so after the Hegira they would probably still be in the early stages of their linguistic explorations. But by the time of Ibn ad-Duraihim, 600 years later, these studies would have ramified enough to stimulate some unknown genius to apply their findings to the solution of ciphers. Indeed, Ibn ad-Duraihim’s discussion of cryptanalysis, as reflected in Qalqashandi, is so mature that it implies a fairly long preceding period of development. The technique was at least moderately well known, for Ibn Khaldūn wrote in The Muqaddimah: “Occasionally, skillful secretaries, though not the first to invent a code [and with no previous knowledge of it], nonetheless find rules [for solving it] through combinations which they evolve for the purpose with the help of their intelligence, and which they call ‘solving the puzzle [cryptanalysis].’ Well-known writings on the subject are in the possession of the people. God is knowing and wise”

The Ibn ad-Duraihim-Qalqashandi exposition begins at the beginning: the cryptānalyst must know the language in which the cryptogram is written. Because Arabic, “the noblest and most exalted of all languages,” is “the one most frequently resorted to” (in that part of the world), there follows an extensive discussion of its linguistic characteristics. Lists are given of letters that are never found together in one word, of letters that rarely come together in a word, of combinations of letters that are not possible (“Thus tha’ may not precede shin.”), and so on. Finally, the exposition gives a list of letters in order of “frequency of usage in Arabic in the light of what a perusal of the Noble Koran reveals.” The writers even note that “In non-Koranic writings, the frequency may be different from this.” With these basics completed, Qalqashandi goes on:

Ibn ad-Duraihim has said: When you want to solve a message which you have received in code, begin first of all by counting the letters, and then count how many times each symbol is repeated and set down the totals individually. If the person devising the code has been very thorough and has concealed the word-divisions in the body of the messages, then the first thing to be worked out is the symbol which divides up the words. To do this, you take a letter and work on the assumption that the next letter is the word-divider. Then you go all through the message with it, having regard for the possible combinations of letters of which the words may be composed, as has been previously explained. If it fits, [then all right]; if not, you take the next letter after the second one. If that fits, [then all right]; if not, you take the next letter after that, and so on, until you are able to ascertain the division of the words. Next, look which letters occur most frequently in the message, and compare this with the pattern of letter-frequency previously mentioned. When you see that one letter occurs in the message more often than the rest, then assume that it is alif; then assume that the next most frequent is lām. The accuracy of your conjecture should be confirmed by the fact that in a majority of contexts, lam follows alif…. Then the first words which you try to work out in the message are the two-lettered ones, through estimating the most feasible combinations of their letters, until you are sure you have discovered something correct in them; then look at their symbols and write down the equivalents by them [whenever they occur in the message]. Apply the same principle to the message’s three-lettered words until you are sure you have got something, then write out the equivalents [all through the message]. Apply the same principle to the four- and five-lettered words, according to the previous procedure. Whenever there is any doubt, posit two or three or more conjectures and write each one down until it becomes certain from another word.

Qalqashandi follows this clear explanation with a four-page example of solution taken from Ibn ad-Duraihim. The cryptogram consists of two lines of verse enciphered with symbols of apparently arbitrary invention. At the end, he notes that eight letters were not used and that they are exactly the same eight that stand at the foot of the frequency list. “This, however, is pure chance: a letter may be somewhat misplaced from the position it has been assigned in the above-mentioned list,” he observes—an observation that argues a fair amount of experience in cryptanalysis. To nail everything down, Qalqashandi gives a second example from Ibn ad-Duraihim, with a rather longer message. With this three-page illustration, he concludes the cryptologic section of his work.

To what extent the Arabs used the abilities so brilliantly evident here in the solution of military or diplomatic cryptograms, and what effects they had upon Moslem history, is not known. What does seem certain is that, like the Arabic civilization itself, this knowledge fell into desuetude and was soon lost. An episode of 250 years later dramatizes the decline.

In 1600, the Sultan of Morocco, Ahmad al-Mansūr, sent an embassy headed by his confidential secretary, ‘Abd al-Wahid ibn Mas’ud ibn Muhammad Anūn, to Queen Elizabeth of England to ally himself with her against Spain. The ambassador reported back in a monalphabetically enciphered dispatch, which shortly thereafter apparently somehow fell into the hands of an Arab, evidently intelligent, but as evidently ignorant of his great cryptologic heritage. In a memorandum, he wrote:

Praise be to Allah! Writing of the secretary ‘Abd al-Wahid ibn Mas ‘ud Anūn. I found a note written in his hand in which he had noted in secret characters some information destined for our protector Abū I’ Abbas al-Mansūr. This information relates to the Sultana of the Christians (May God destroy them!) who was in the country of London in the year 1009. From the moment when the note fell into my hands, I never stopped studying from time to time the signs which it bore…. About 15 years more or less passed, until the moment when God (Glory to Him!) did me the favor of permitting me to comprehend these signs, although no one taught them to me….

Fifteen years! For what Ibn ad-Duraihim would have solved in a few hours! Yet that has always been the story of civilizations.

Analyzing the frequency and contacts of letters is the most universal, most basic of cryptanalytic procedures. A knowledge of it is requisite to an understanding of all subsequent techniques of substitution cryptanalysis. Hence it seems worthwhile to give in some detail, with an English plaintext, an example of such a solution, much as Qalqashandi did in Arabic.

Cryptanalysis rests upon the fact that the letters of language have “personalities” of their own. To the casual observer, they may look as alike as troops lined up for inspection, but just as the sergeant knows his men as “the goldbrick,” “the kid,” “the reliable soldier,” so the cryptanalyst knows the letters of the alphabet. Though in a cryptogram they wear disguises, the cryptanalyst observes their actions and idiosyncrasies, and infers their identity from these traits. In ordinary monalphabetic substitution, his task is fairly simple because each letter’s camouflage differs from every other letter’s and the camouflage remains the same throughout the cryptogram.

How would he go about doing this for the following cryptogram?

The cryptanalyst would begin by counting each letter’s frequency (how often it occurs in a text) and its contacts (which letters it touches, and how many different ones). The frequency count of this cryptogram is this:

A widely used frequency table of 200 letters of normal English is this:

But it is not possible to simply list the letters in the cryptogram in the order of frequency, and then, lining that list up with one giving the letters of normal text in their order of frequency, mechanically replace the cipher with the “plain.” In this case, the two lists are:

Brute substitution of letters of the upper row for those of the lower at the beginning of the cryptogram would give this “plaintext” oluueooanceihanpjatd … Obviously, the two frequency counts do not match. Which is not surprising, since they are based on different texts, using different words with different letters in them. But whereas the relative frequencies may shift slightly, making, say, i more frequent than a in a particular case, the letters generally do not stray very far from their home areas in the frequency table. Thus, e, t, a, o, n, i, r, s, and h will normally be found in the high-frequency group; d, l, u, c, and m in the medium-frequency group; p, f, y, w, g, b, and v in the lows, and j, k, q, x, and z in the rare group. Furthermore, a sharp break in frequency usually sets off the highs from the mediums; the lowest of the highs, h, is normally 6 per cent, while the highest of the mediums, d, is only 4 per cent. This step-down is quite visible in the cryptogram’s frequency count:

It is the drop between F and C. Though one of the usual nine highs has slipped out of its category, the remaining eight letters above the division are almost certainly all high-frequency letters, N probably represents e, which is outstandingly the most common letter (about one in every eight of normal text). Frequency alone cannot tell much more than this.

But contact can. Every letter has a cluster of preferred associations that constitute its most distinguishing characteristic. The cryptanalyst can spot these almost by eye if he sets up a contact chart for the high-frequency cipher letters like the one on the following page. In the chart, the letter being counted stands at the left, with the other letters strung out in order of frequency in a line to the right. Each tally above a letter in the line means that the letter in that line has preceded the subject letter in one instance, while each tally below means that it has followed the subject letter.

The chart shows that H has preceded N three times—in other words, that the digraph HN has occurred three times—and has followed it, to make NH, just once.

In a chart like this, plaintext e is about as hard to recognize under its cipher masquerade as a six-and-a-half-foot-tall man at a costume party. It is president of this republic of letters because it leads all the rest in frequency, yet it is democratic enough to contact more different letters more often than any other letter, including a goodly number in the low-frequency bracket. Indubitably, N here is President e.

Next most distinctive are the three high-frequency vowels, a, i, and o. Like rival dowagers at a society ball, they avoid one another as much as possible. A glance at the contact chart shows that ciphertext O, U, and A are the most mutually exclusive, (H, which rarely associates with U and A, is ruled out as a vowel possibility because it contacts O so often.) Thus, these three letters probably represent the three high-frequency plaintext vowels. Which is which can often be ascertained by the fact that the plaintext digraph io is fairly frequent while the other five combinations (oi, ia, ai, oa, ao) are fairly rare. The contact chart shows these frequencies: OA, 2; OU, 1; and UO, UA, AO, and AU, ail zero. If OA = io, then U would be a, and OU would be ia, which happens to be the most common of the other five digraphs. Better still, NU, which appears five times, would stand for ea, the most frequent of all the digraphs involving vowels, while UN, which does not exist in this message, would stand for ae, the rarest. This is a nice corroboration for the vowel identification. Even if identification of the individual vowels is not possible, it is nearly always wise to begin the analysis by determining which letters are the four high-frequency vowels.

What about consonants? The easiest to spot is plaintext n because four fifths of the letters that precede it are vowels. The contact chart shows that ciphertext T is preceded by ciphertext N, O, U, and A 17 times out of 23. It is a good bet for n.

The behavior of Y in the chart is striking. It runs before N (= e) like a herald and never follows it, while on the other hand it invariably tags along behind H and never precedes it. It behaves, in fact, just like plaintext h. The digraph he is one of the most common in English, while eh is very rare; th is the most common of all, and ht is also fairly rare. If Y = h, then ciphertext H must be t—an assumption that fits in well with its frequency. In telegraphic texts where the is deleted, plaintext h can usually be spotted because—just the opposite of n—it precedes vowels about ten times as often as it follows them.

The only two high-frequency letters remaining to be identified are r and s. The basic difference between them is that r, rather like a social climber, associates much more with the vowels—dowagers a,i, and o as well as President e—than does s, while s, a proletarian at heart, mingles with the consonants, the blue-collar laborers of the alphabet. These differences in their contacts hold both absolutely and relatively. In the chart, however, inspection of the contact bars for G and F, the only two high-frequency letters left, yields contradictory evidence: F contacts the identified vowels more often than G-21 times to G’s 17—but it also contacts the three high-frequency consonants (i, n, h) more—4 times to G’s 3—even though its frequency is lower.

It is not necessary to force the decision, for even without these identifications, 160 out of the 280 letters in the message have been given tentative plaintext equivalents. The acid test as to whether they are right, of course, consists in substituting them into the cryptogram and seeing whether they make sense. In doing so, many cryptanalysts use pencils of different colors for the plain- and the ciphertext to make them easier to distinguish. They also leave a lot of space between the lines of the ciphertext to allow for multiple hypotheses, erasures, underlining of repetitions, and so on.

Just this portion of the message will suffice for its solution. The cryptanalyst uses these tentative identifications to root out the meanings of other cipher letters. He does this by guessing at what the missing letters should be to make up intelligible text. For example, near the beginning the plaintext sequence--ith- appears. This could be a portion of the word with.

No cryptanalyst, if asked, could at this point give any proof that his assumption is correct. All it is now is a kind of guess, guided only by the porous laws of probability. Successive guesses will either increasingly confirm it or contradict it, causing the cryptanalyst to discard it. But each successive assumption is put forth at first upon the same slim basis as this. Eventually, the internal consistency of the final result piles up such an immense weight of probability that the validity of the solution becomes a virtual certainty. But the cryptanalyst who seeks proof absolute for each assumption as he makes it will never find it—and he will never solve the cipher.

Here, however, with seems likely. This assumption means that M = w, and this equivalence can be filled in wherever M appears in the cryptogram, to see whether it suggests any more new words. Just ten letters down the line, it forms the sequence with-n-nown-i-…, which suggests the phrase with unknown. The long plaintext sequence -int-ition- provides a check: the J = u identity fits right in to form the word intuition. The new plaintext letters are inserted and used to provide clues to still more letters. This process of reconstructing the plaintext—perhaps the easiest and the most fun in cryptanalysis—is called “anagramming.”{9}

It can be greatly speeded by a parallel reconstruction: that of the key alphabet. If the ciphertext letters are written under a normal alphabet that serves as the plaintext alphabet, their mere arrangement will often donate additional equivalences. The ciphertext listings thus far recovered are these:

Because it is difficult to remember an incoherent string of 26 letters that constitutes the set of cipher equivalents, cipher alphabets are often based on a single word that is easy to memorize. Various derivations are possible, but the simplest is just to write out the keyword, omitting repeated letters, then to follow it with the remaining letters of the alphabet. Thus the cipher alphabet springing from the keyword CHIMPANZEE would be:

The portion of the ciphertext alphabet following the keyword contains long alphabetical sequences. Often the cryptanalyst can complete segments that have been partially filled in, and thus recover more equivalencies. For example, if he sees QR-TU, he needs no great wit to realize that the missing letter must be S.

One such segment leaps to the eye in the partial alphabet recovered from the cryptogram: HJ-M. Only K or L can fit there, but since ciphertext K has already been assigned to plaintext k (from unknown), L must slide in to represent v, thereby giving the cryptanalyst a free identification. The technique can help in another way: to decide between F and G for r and s. If F = s and G = r, the sequence in the key alphabet under r and s would run backwards:

…rs…

…GF…

This is unlikely, so F = r and G = s. The cipher alphabet also gives ideas for plaintext equivalencies. For example, U = a in the alphabet, so if the cryptanalyst sees a V in the cryptogram, he may try b as one possibility for its plaintext to complete the UV segment under ab. In this case, it happens to work out right. With these new values inserted in the top two lines, the solution is virtually finished:

The two x’s must be two c’s to make success’, then B must be p to form ciphers; E must be f, for four; W, g for things and -ing; and so forth. At this point, hypotheses pour in literally faster than they can be written down. The plaintext (with punctuation supplied) reads: “Success in dealing with unknown ciphers is measured by these four things in the order named: perseverance, careful methods of analysis, intuition, luck. The ability at least to read the language of the original text is very desirable but not essential.” Such is the opening sentence of Parker Hitt’s Manual for the Solution of Military Ciphers.

The full key alphabet, including equivalents for plaintext j, q, and z, which did not appear, is based on the keyphrase NEW YORK CITY:

The careful examination of the propensities of the various plaintext letters may seem unnecessary. In the case of monalphabetic substitutions with word divisions, solution may often be obtained by taking a stab at common words (the, and), guessing at pattern words whose repeated letters form a distinctive configuration (WXYZY might be there), or comparing short words (HX, XH, HL, PL, and PX might be on, no, of, if, and in). But a knowledge of the characteristics of plaintext lies at the heart of the solution of more complex ciphers, where that plaintext is concealed more effectively. Naturally, in shorter cryptograms, solutions do not run quite as smoothly as the longer ones that allow the statistics of language enough play to become reliable. For these more difficult problems, expert solvers offer novices two tips: (1) make contact charts: the drudgery usually pays off in faster and more accurate identifications; (2) when stumped, and no likely plaintext values are visible, try something and see where it leads; even if it proves wrong, it has narrowed down the possibilities. No cryptogram was ever solved by staring at it. Finally, it should be noted that monalphabetic substitutions that use numbers or symbols as their ciphertext equivalents are solvable in the same way as those using letters. The difference in the camouflage does not alter the features of the underlying language.

3. The Rise of the West

WESTERN CIVILIZATION began the use of political cryptology that it has continued uninterrupted to the present as it emerged from the feudalism of the Middle Ages. The secret writing of that time was as embryonic as other elements of what was to become the world’s dominant civilization. Its use was at first infrequent and irregular; the systems were rudimentary, even in the church, still the greatest and most wide-ranging power of its day. But there were no longer any regressions, no thousand-year hiatuses. Cryptology only progressed. And from the earliest days there existed the two basic modern forms: codes and ciphers.

The substitutions of code stemmed in part from abbreviations, in part from obscure epithets and imagery used in oracles and magic half to reveal, half to conceal meanings. The oldest cryptographic document in the Vatican archives includes substitutions of both origins. This is a little list of name-equivalents compiled in 1326 or 1327 for use in the struggle between the propope Guelphs and the pro-Holy Roman Emperor Ghibellines in central Italy. It replaced the title official—evidently representing anyone of authority—by the single letter o. The Ghibellines became EGYPTIANS and the Guelphs the CHILDREN OF ISRAEL. A decade later, another list moved away from the jargon and introduced some secrecy to its abbreviations when it gave LORD A as the equivalent for our lord. Finally, on an undated slip of paper, perhaps a little later than the second list, appears the first modern code. It is very small but it manifests undiluted the essential attribute: the paramountcy of secrecy in its substitutions (though they secondarily enjoy the advantages of abbreviation): A = king, D = the Pope, S = Marescallus, and so on.

Ciphers, of course, had been used by monks all through the Middle Ages for scribal amusement, and the Renaissance knew from its study of such classic texts as Suetonius that the ancient world had used ciphers for political purposes. Hence the basic concept was already known. As early as 1226, a faint political cryptography appeared in the archives of Venice, where dots or crosses replaced the vowels in a few scattered words. A century and a half later, in 1363, the Archbishop of Naples, Pietro di Grazie, enciphered vowels fairly regularly in his correspondence with the papal curia and with cardinals. In 1379, the antipope Clement VII, who had fled to Avignon the previous year to begin the Great Schism of the Roman Catholic Church, in which two popes claimed to reign, saw the need of new ciphers for his new establishment. One of his secretaries, Gabrieli di Lavinde, a man from Parma who had perhaps worked in one of the chancelleries of the northern Italian city-states, compiled a set of individual keys for 24 correspondents of Clement, among them Niccolò of Naples, the Duke of Montevirdi, and the Bishop of Venice.

Lavinde’s collection of keys—the oldest extant in modern Western civilization—includes several that combine elements of both code and cipher. In addition to a monalphabetic substitution alphabet, often with nulls, nearly every key comprised a small repertory of a dozen or more common words or names with two-letter code equivalents. They constitute the earliest examples of a cryptographic system that was to hold sway over all Europe and America for the next 450 years: the nomenclator. the nomenclator united the cipher substitution alphabet of letters and the code list of word, syllable, and name equivalents; it is a cross between the two basic systems. Code and cipher were separated in the early nomenclators but were merged in the later. The nomenclator eventually expanded its word-substitution lists from the few dozen names of Lavinde to the 2,000 or 3,000 syllables and words of those of Czarist Russia in the 1700s.

The West’s earliest known homophonic substitution cipher, used at Mantua with Simeone de Crema in 1401

The first substitution alphabets provided only a single substitute for each plaintext letter. Later ones supplied multiple substitutes. The first known Western instance of multiple cipher-representations occurs in a cipher that the Duchy of Mantua prepared in 1401 for correspondence with one Simeone de Crema. Each of the plaintext vowels has several possible equivalents. This testifies silently that, by this time, the West knew cryptanalysis. There can be no other explanation for the appearance of these multiple substitutes, or homophones. The cipher secretary of Mantua introduced them to hinder anyone who might try to solve an intercepted dispatch, for each extra cipher symbol means that much more work, that much more that has to be dug out by the cryptanalyst. That the homophones were applied to vowels, and not just indiscriminately, indicates a knowledge of at least the outlines of frequency analysis.

Where did that knowledge come from? It probably developed indigenously. Though it is true that contact with the Moslem and other civilizations during the Crusades triggered the cultural explosion of the Renaissance, and that Arabic works of science, mathematics, and philosophy poured into Europe from Moorish centers of scholarship in Spain, it seems unlikely that cryptanalysis emigrated from there. It was considered more a branch of grammar than of science or mathematics; it was linked too closely in Arabic tradition to the language of the Koran; its importance was much less than that of medicine or algebra or alchemy; in any case, neither Ibn ad-Duraihim’s nor Qalqashandi’s works, the only ones known to give a full explanation of the technique, were translated. It is possible but improbable that a diplomat to one of the Arabic lands may have brought back a knowledge of cryptanalysis. But cultural diffusion such as this would probably leave some written records, and none exist for any transfer of cryptanalysis from Islam to Christendom. It is dangerous to infer something from nothing, but given two possibilities, the nothing may imply one possibility more than the other: and it would rather be expected that no written records would be created if cryptanalysis developed spontaneously. The bright chancellery official who succeeded in puzzling out the meaning of the enciphered words in a captured dispatch would be hardly likely to give away, either orally or in writing, the knowledge that could bring him extra money and prestige.

Though no known documents attest to such a genesis for Western political cryptanalysis—and none object to it, either—it seems the most probable. The official would have probably effected his solutions at first by guessing at words, much as did the four Irishmen who solved Dubthach’s cryptogram. As through repeated cryptanalyses he became more acquainted with the personalities of the letters, he might have eventually stumbled on the principle of frequency analysis. The same development may have taken place separately in several principalities, and it is not inconceivable that one new solver may have reasoned his way to frequency analysis by wondering why a cryptographer in another city used homophones for vowels!

What is certain is that, as the secular principalities of Italy began to use cipher regularly in the 1390s and early 1400s, their cipher alphabets gradually began to include homophones for vowels. So slow was cryptology’s development, however, that not until the mid-1500s did consonants begin to get homophones. Likewise, the code lists of the nomenclators did not expand much until well into the 1500s.

The growth of cryptology resulted directly from the flowering of modern diplomacy. In this, for the first time, states maintained permanent relations with one another. The resident ambassadors sent home regular reports—they have been called “honorable spies”—and the jealousy, suspicion, and intrigues among the Italian city-states made it often necessary to encipher these. As the practice implies, the reports were sometimes opened and read, and, if necessary, cryptanalyzed. By the end of the century, cryptology had become important enough for most states to keep full-time cipher secretaries occupied in making up new keys, enciphering and deciphering messages, and solving intercepted dispatches. Sometimes the cryptanalysts were separate from the cipher secretaries and were called in only when needed.

Perhaps the most elaborate organization was Venice’s. It fell under the immediate control of the Council of Ten, the powerful and mysterious body that ruled the republic largely through its efficient secret police. Venice owed her preeminence largely to Giovanni Soro, who was perhaps the West’s first great cryptanalyst. Soro, appointed cipher secretary in 1506, enjoyed remarkable success in solving the ciphers of numerous principalities. His solution of a dispatch of Mark Anthony Colonna, chief of the army of the Holy Roman Emperor Maximilian I, requesting 20,000 ducats or the presence of the emperor with the army, gave an insight into Colonna’s problems. So great was Soro’s fame that other courts sharpened their ciphers, and as early as 1510 the papal curia was sending him ciphers that no one in Rome could solve. In 1526, Pope Clement VII (not to be confused with the antipope of the same name) twice sent him intercepts for solution, and Soro twice succeeded—once with three long dispatches from Maximilian I’s successor, the Holy Roman Emperor Charles V of Spain, to his emissary at Rome, and once with letters addressed by the Duke of Ferrara to his ambassador in Spain. When one of Clement’s messages fell into the hands of the Florentines, Clement, exclaiming “Soro can decipher any cipher!” sent him a copy of the message to see whether it was secure. He was reassured when Soro reported that he could not solve it—but one wonders whether Soro was not simply lulling the pope into a false security.

On May 15, 1542, Soro, who was two years from the grave, was given two assistants, and from then on Venice had three cipher secretaries. Their office was in the Doge’s Palace above the Sala di Segret, and here they worked behind barred doors. When cipher dispatches of foreign powers fell into the hands of the Venetians, their translation was ordered at once. No one was allowed to disturb the cryptanalysts and, reportedly, they were not permitted to leave their office until the solution was obtained. It then had to be delivered without delay to the signory. The cryptologists’ usual salary was ten (later twelve) ducats a month, paid semiannually. The art was taught in a kind of school, which even held examinations each September. The cryptologists also wrote treatises explaining their techniques. That by Soro, written in the early 1500s on the solution of Latin, Italian, Spanish, and French ciphers, is another Lost Book of cryptology, for though he turned it over to the Council of Ten on March 29, 1539, no trace of it can be found in the archives. Fragmentary notes written by his successor, Giovanni Battista de Ludovicis, survive, and so do careful thorough surveys of the field by other cipher secretaries, Girolamo Franceschi, Giovanni Francesco Marin, and Agostino Amadi, whose manual is especially fine and whose work was so outstanding that Venice rewarded him by giving his two sons pensions of ten ducats a month for life. The Council of Ten held contests in ciphers, and advances in the art were rewarded: a Marco Rafael, later a favorite of Henry VIII of England, received 100 ducats in 1525 for a new method of invisible writing. If the cipher secretaries made valuable suggestions, they would get a raise. On the other hand, if they betrayed any of the state cryptologic secrets, they could be put to death.

The council was as alert to protect its own ciphers as it was to solve those of its rivals. It kept a number of nomenclators ready to replace compromised ones, and it did not hesitate to use them. For example, new ciphers were sent on August 31, 1547, to the Venetian envoys to Rome, England, France, Turkey, Milan, and the Holy Roman Emperor. On June 5, 1595, a returning ambassador reported that Venetian ciphers had been solved and on June 12, the council ordered a wholesale replacement of the ambassadorial nomenclators with new ones prepared by Pietro Partenio, then the most expert of the cipher secretaries. Earlier, Soro had instituted a “general cipher” (a nomenclator) to permit the ambassadors to communicate among themselves; this was in addition to the “special cipher” each ambassador held for messages to and from home.

But Venice was not the only locale of expert cryptanalysts during the Renaissance. In Florence, Pirrho Musefili, Conte della Sasseta, solved literally scores of messages during the decade from 1546 to 1557, reconstructing, among others, nomenclators used between Henry II of France and his envoy in Denmark, another between the same king and his emissary at Siena, a cipher of Cardinal di Mendoze of Naples. His expertise was so renowned that others came to him, as they had to Soro, to solve ciphers for them. A papal cryptologist, discussing contemporaries, said that to Musefili “is due first place and all honor.” Among his clients were the Duke of Alba and the King of England, who sent him a cryptogram that had been found in a sole of a pair of golden shoes from France. Musefili’s successor, Camillo Giusti, was reputed to be even more expert. They extended a fine tradition, since the ciphers devised by their predecessors for the ruling Medici family, particularly those of Lorenzo the Magnificent, display a lively appreciation of the methods of cryptanalysis. Further attesting to cryptology’s importance is its mention in a book, The Art of War, by another well-known Florentine—Niccolò Machiavelli.

The cruel, sinister, and resolute dukes of Sforza, oligarchs of Milan, were also well served in their cryptology. One of their secretaries, Cicco Simonetta, wrote the world’s first tract devoted entirely to cryptanalysis. In Pavia on July 4, 1474, he set down thirteen rules for solving monalphabetic substitution ciphers in which word divisions are preserved. The manuscript, on two narrow strips of paper, begins: “The first requisite is to see whether the document is in Latin or in the vernacular, and this can be determined in the following manner: See whether the words of the document in question have only five different terminations, or less, or more; if there are only five or less, you are justified in concluding that it is in the vernacular….” Nine years later, Milanese cryptology was boasting the clever trick of using two symbols to mark as nulls all the ciphertext signs between them. The greatest compliment to Milan came in a backhanded fashion from the cryptologists of Modena, who early in the 15th century provided a more elaborate nomenclator for their envoy to Milan than for any other.

Courts outside Italy had cryptanalysts as well. In France, Philibert Babou, sieur de la Bourdaisière, who held the post of first secretary of state, solved intercepted dispatches for Francis I. One observer saw Babou “oft-times decipher, without the alphabet, it must be understood, many intercepted dispatches, in Spanish, Italian, German, although he did not understand any of it, or very little,{10} with patience to work at it three weeks continually day and night, before getting a single word out of it: that first breach made, all the rest came very soon after, quite like in a demolition of walls.” While Babou was thus slaving for the king, it might be noted, the king was enthusiastically taking Babou’s pretty wife as his mistress. Babou received many

A typical early nomenclator, compiled at Florence, in 1554, during the reign of Cosimo de’Medici

England opened the letters of the Venetian ambassador to the court of Henry VIII—presumably those of other ambassadors as well—and undoubtedly solved or tried to solve their ciphers. The Venetian ambassador, however, well schooled by the excellent cryptologists of his city, paraphrased the enciphered sections of his instructions before communicating them to the English to prevent their serving as a massive crib to the key.

Among the more expert of the cryptologic experts of the Renaissance were those who labored in the service of His Holiness, the Supreme Pontiff, who in those days wielded as much temporal as spiritual power. The popes had long had their own cryptographers, and finally Paul III, who succeeded Clement VII, realized that it was not to the curia’s advantage to have to send to Venice for solutions. He delegated all cryptology to Antonio Elio, who was able to “decipher with much facility” and who later rose to pontifical secretary, Bishop of Pola, and finally Patriarch of Jerusalem. In 1555 the title of Cipher Secretary was created, and conferred upon Triphon Bencio de Assisi; it was in 1557, during his tenure, that cryptanalysts working for the pope solved a cipher of King Philip II of Spain, then warring briefly upon the pontiff. In 1567, the Great Vicar of St. Peter solved in less than six hours a cryptogram on “a large sheet of paper in the Turkish language, of which he did not understand four words.” Late in the 1580s, the cipher secretaryship finally came into the hands of a remarkable family of cryptologists who held it for less than 20 years, but left their impress upon cryptology.

These were the Argentis. Their forebears had come to Rome from Savona about 1475 in the hope of finding a sinecure under Pope Sixtus IV, a fellow townsman; the family lived in a house that they had built opposite the cloister of San Giacomo della Muratte in Rome, near the Fountain of Trevi. Giovanni Batista Argenti entered the papal service as a personal clerk to Antonio Elio, who taught him cryptology. Though Giovanni Batista burned to become papal secretary of ciphers, he had to give way before some nepotistic claims, and it was not until he was well into his fifties, after Sixtus V became pope, that Giovanni Batista finally got his wish. By then it was almost too late: when Pope Gregory XIV ascended the throne of St. Peter in 1590, he had to persuade Argenti to retain the office because of the irksome trips to France and Germany that it entailed. Giovanni Batista realized that he was weakening; he hastened to teach cryptology to his nephew, Matteo Argenti, and expired April 24, 1591.

Matteo, 30, succeeded to his uncle’s office. Five popes renewed his appointment. He taught cryptology to his younger brother, Marcello, who was cipher secretary to a cardinal, in the evident hope of perpetuating the family in the job. But Matteo was unexpectedly relieved of his office on June 15, 1605—apparently the victim of a power play in the curia, for the pope called him in to tell him that he was not at fault and to give him a pension of 100 ducats. Matteo used his new leisure to compile a 135-page, calf-bound manual of cryptology that lists many of the nomenclators devised by his uncle and that, out of his own experience, summarizes the best in Renaissance cryptology.

The Argentis were the first to use a word as a mnemonic key to mix a cipher alphabet, a practice that became widespread. They wrote out the keyword, omitting any repeated letters, then followed it with the remaining letters of the alphabet:

Knowing that the invariable sequence of u after q in plaintext advertises the identity of both letters, the Argentis merged the two into a single unit for encipherment purposes. Noticing that the frequent doubled letters within (Italian) words were always consonants, they deleted the second of such a pair: sigillo would be written sigilo. They realized, of course, that the basic method of solving ciphers using homophones, or homophonic substitutions, is to search for partial repetitions, such as:

If these result from the similar but not identical encipherments of the same word, then 49 stands for the same letter as 81. Given sufficient text, whole sets of these equivalencies can be built up, and the cryptogram then solved by the ordinary method of letter-frequency. To impede such comparisons, the Argentis ordered nulls larded throughout the cryptogram at a rate of no less than three to eight per line.

By prohibiting word separations, punctuation and accentuation, and words in clear, they eliminated all clues stemming from these highly fertile sources. They ran all the ciphertext digits together and, to make it difficult even to determine the proper ciphertext numbers, they mixed single digits with pairs, so that a cryptanalyst dividing the text into straight pairs would get a totally false picture. They prevented confusion in deciphering by making sure that digits used as singles were excluded from those composing the pairs. Moreover, they cleverly assigned the single digits to high-frequency plaintext equivalents that would raise the single digits’ frequency in the ciphertext high enough that they would not stand out by their rarity. For example, from a cipher by Matteo:

Thus Argenti might be enciphered 5128068285480377. They sometimes made use of polyphones—cipher symbols that have two or three plaintext meanings. These plaintext equivalents were chosen so as not to mislead the decipherer, but their mutual symbol, simultaneously reflecting two different letter personalities, would behave in a very schizoid manner, quite puzzling to the cryptanalyst.

The Argentis did not stop there, however. They fit the cipher to the occasion. If a cipher were to be used to encipher Italian, it would not waste cipher equivalents on plaintext k, w, and y, which Italian does not use. But ambassadors in Germany and Poland got alphabets with k and w, and those in Spain had y in their ciphers. Matteo remarked in a note that few dangers existed for the papal ciphers in Poland, Sweden, and Switzerland, and that the Germans knew so little of cryptology that they preferred to burn intercepted cryptograms instead of trying to solve them. Consequently he recommended—and used—only simple systems in those countries. But Matteo exercised great prudence in constructing ciphers intended for use in France, England, Venice, and Florence—states for whose cryptology he professed great admiration.

Cryptology was used quite as widely as Matteo Argenti’s comments indicate. The carefully guarded sheets of folio-sized paper on which the nomenclators were neatly engrossed were as much an instrument of war as the arquebus and, like any other weapon, they followed their flags to all parts of the world, multiplying in direct proportion to conquests. Nowhere is this more evident than with Spain. Her ascent to power can be traced in the proliferation of her ciphers, and these project an interesting image of the cryptology of the day, as practiced by the richest and mightiest nation in Europe.

Knowledge of cryptology had filtered into Iberia at just about the time that Ferdinand and Isabella expelled the Moors and set their unified country on the road to world supremacy. The first systems, introduced in 1480 by councilor Miguel Perez Alzamán, transformed plaintext into Roman numerals. These proved so clumsy that many decipherments bear such marginal notes as “Nonsense,” “Impossible,” “Cannot be understood,” and “Order the ambassador to send another dispatch.” It may have been in one of these systems that Christopher Columbus in the New World in 1498 reportedly wrote to his brother to fight off a governor sent from Spain—a cipher letter that was used as a reason for the governor’s sending Columbus back to Spain in chains. After Isabella died in 1504, simpler systems were instituted for the increasing number of Spanish envoys. Nothing much was done thereafter until the shrewd, morose, arrogant, and fanatic Philip II ascended the throne of Spain. On May 24, 1556, four months after he became king and three days after his 29th birthday, Philip, who personally supervised the minutest details of his administration, wrote his uncle, the Holy Roman Emperor Ferdinand I, king of Hungary, that he had decided to change the ciphers used during the reign of his father, Charles V, because they had fallen into disuse or had been compromised. He asked his uncle to use a new cipher that he was sending him together with a list of persons who held the key.

Philip’s first cipher, the new general cipher of 1556, was one of the best nomenclators of the day. It comprised a table of homophonic letter substitutions (two symbols for consonants, three for vowels), a list of equivalents for common digraphs and trigraphs (each digraph was represented by both a symbol and a two-digit number), a small code in which words and titles were represented by two- and three-letter groups, and a provision that symbols with a single dot above them were nulls and that those with two dots above them represented a doubled letter. It set the pattern for Spanish cryptography well into the 17th century, though the separate sections of the nomenclator tended to coalesce, the symbols to give way to numbers, and the code section to enlarge until repertories of 1,000 elements were not uncommon. Not every nomenclator was as complicated, for Philip, like Soro, divided his systems into two classes: the cifra general, used for intercommunication among ambassadors in many countries and with the king; and the cifra particular, used by Philip with an individual envoy. Ciphers were changed every three or four years: the cifra general of 1614 was replaced in 1618, for example, and the cifra particular of 1604 with the ministers in Italy indicated on its face that it was to serve only from 1605 to 1609. Numerous separate nomenclators were compiled for correspondence with the viceroys and governors of the new colonies in the Americas. They hid their reports of impending shipments of gold beneath ciphers to foil pirates who might capture a galleon and its dispatches. This practice began as early as the conquistadores. The oldest instance extant of New World cryptography is a letter from Hernán Cortés, dated June 25, 1532, from the Mexico he had recently subdued. Cortes used a small nomenclator, comprising a homophonic mon alphabetic substitution in which each letter was represented by two or three symbols, together with a few codewords for proper names.

The earliest New World cryptogram extant: a cipher message of Hernán Cortés, June 25, 1532

Spain administered its cryptography in the Despacho Universal, the nerve center of the government, from which couriers departed at all hours of the day and night for all parts of the world. When the capital was moved to Madrid in 1561, the Despacho was installed in the Alcazar with Foreign Secretary Gonzalo Perez in charge.

Decipherment in the intrigue-filled court of Spain did not rest solely on a mere mechanical operation of cryptographic rules. If an ambassador requested the payment of his salary or solicited a bishopric, and the deciphering secretary was not his friend, the passage might remain undeciphered. Philip himself ordered the deciphering secretaries to suppress passages that he did not want his council to know about. On top of these sins of omission were piled those of commission, sometimes so serious that in at least one instance the codeword for king of England was confounded with that for king of France !

The sweet smell of success in cryptanalysis never wafted through the Moorish chambers of the Alcázar. But Philip’s archfoes—Protestant England, France with its Huguenot king, and the rebellious Spanish provinces of the Netherlands—did not blind themselves to this providential source of information. Their cryptanalytic abilities had a pope and most of Europe snickering at Philip, played no small role in foiling his grandiose plans for the conquest and conversion of England, and helped ultimately to execute a sentence of death on that most romantic and captivating of royal ladies, Philip’s intended sister-in-law, Mary, Queen of Scots.

In 1589, Henry of Navarre, who was destined to become the most popular king in the history of France (he coined the slogan “A chicken in every peasant’s pot every Sunday”), ascended to the throne as Henry IV and found himself embroiled still more fiercely in his bitter contest with the Holy League, a Catholic faction that refused to concede that a Protestant could wear the crown. The League, headed by the Duke of Mayenne, held Paris and all the other large cities of France, and was receiving large transfusions of men and money from Philip of Spain. Henry was tightly hemmed in, and it was at this juncture that some correspondence between Philip and two of his liaison officers, Commander Juan de Moreo and Ambassador Manosse, fell into Henry’s hands.

It was in cipher, but he had in his government at the time one François Viète, the seigneur de la Bigotière, a 49-year-old lawyer from Poitou who had risen to become counselor of the parlement, or court of justice, of Tours and a privy counselor to Henry. Viète had for years amused himself with mathematics as a hobby—“Never was a man more born for mathematics,” said Tallement des Réaux. As the man who first used letters for quantities in algebra, giving that study its characteristic look, Viète is today remembered as the Father of Algebra. A year before, he had solved a Spanish dispatch addressed to Alessandro Farnese, the Duke of Parma, who headed the Spanish forces of the League. Henry turned the new intercepts over to him to see if Viète could repeat his success.

He could and did. The plaintext of the long letter from Moreo, in particular, was filled with intimate details of the negotiations with Mayenne: “… Your Majesty having 66,000 men in those states [the Netherlands], it would be nothing to allot 6,000 to so pressing a need. Should your refusal become known, all will be lost…. I said nothing about that to the Duke of Parma…. The Duke of Mayenne stated to me that it was his wish to become king; I could not hold back my surprise….” The message was couched in a new nomenclator that Philip had specially given Moreo when he departed for France; it consisted of the usual alphabet with homophonic substitutions, plus a code list of 413 terms represented by groups of two or three letters (LO = Spain ;PUL = Navarre’, POM = King of Spain) or of two numbers, either underlined (64 = confederation) or dotted (94 = Your Majesty). A line above a two-digit group indicated a null.

Moreo’s letter had been dated October 28, 1589, and despite Viète’s experience and the quantity of text, it was not until March 15 of the following year that Viète was able to send Henry the completed solution, though he had previously submitted bits and pieces. What Viète did not know was that, 110 miles from Tours, Henry had defeated Mayenne’s superior force at Ivry west of Paris the day before, making the solution somewhat academic.

Any chagrin that Viète felt did not deter him from extending his cryptanalytic successes. As he wrote to Henry in the letter forwarding the Moreo solution: “And do not get anxious that this will be an occasion for your enemies to change their ciphers and to remain more covert. They have changed and rechanged them, and nevertheless have been and always will be discovered in their tricks.” It was an accurate prediction, for Viète continued to read the enciphered messages of Spain and of other principalities as well. But his pride led him straight into a trap in which a shrewd diplomat drew confidential information from him as deftly as he elicited the secret meaning from elegant and mysterious symbols. Giovanni Mocenigo, the Venetian ambassador to France, said that he was talking one day with Viète at Tours:

He [Viète] had just told me that a great number of letters in cipher of the king of Spain as well as of the [Holy Roman] Emperor and of other princes had been intercepted, which he had deciphered and interpreted. And as I showed a great deal of astonishment, he said to me:

“I will give your government effective proofs of it.”

He immediately brought me a thick packet of letters from the said princes which he had deciphered, and added:

“I want you also to know that I know and translate your cipher.”

“I will not believe it,” I said, “unless I see it.”

And as I had three kinds of cipher—an ordinary which I used, a different one which I did not use, and a third, called dalle Caselle—he showed me that he knew the first. Then, to better probe so grave an affair, I said to him,

“You undoubtedly know our dalle Caselle cipher?”

“For that, you have to skip a lot,” he replied, meaning that he only knew portions of it. I asked him to let me see some of our deciphered letters, and he promised to let me, but since then he has not spoken further about it to me, and, having left, I have not seen him any more.

Mocenigo was reporting to the Council of Ten, and it was after hearing his remarks that they so promptly replaced their existing keys.

Meanwhile, Philip had learned, from his own interceptions of French letters, that Viète had broken a cipher that the Spanish—who apparently knew little about cryptanalysis—had thought unbreakable. It irritated him, and, thinking that he would cause trouble for the French at no cost to himself, told the pope that Henry could have read his ciphers only by black magic. But the tactic boomeranged. The pope, cognizant of the ability of his own cryptologist, Giovanni Batista Argenti, and perhaps even aware that papal cryptanalysts had themselves solved one of Philip’s ciphers 30 years before, did nothing about the Spaniard’s complaint; all Philip got for his effort was the ridicule and derision of everyone who heard about it.

One of those who must have been laughing the hardest was probably a 50-year-old Flemish nobleman who had himself just completed solving a cipher of Spain. This was Philip van Marnix, Baron de Sainte-Aldegonde, right-hand man of William of Orange, who led the united Dutch and Flemish revolt against Spain. Marnix, an intimate of John Calvin and composer of what is today the Dutch national anthem, was also a brilliant cryptanalyst. An adversary described him as “noble, wise, gracious, sagacious, eloquent, experienced and with a very acute understanding, knowing the finer points of dealing with people. He is learned in Greek, Hebrew, Latin; he understands and writes the Spanish, Italian, German, French, Flemish, English, Scottish, and other languages very easily—better than any other man of this country. He is about 40 years old, of medium height, of dark complexion, but ugly of face. He is the greatest and most constant anti-Catholic in the world, more than even Calvin himself.”

The Spanish cipher message that Marnix solved had been intercepted by Henry IV during his siege of Paris. The writer was, as withViète’s solution, the luckless Juan de Moreo; the addressee was, as before, King Philip. Marnix had joined Henry at the siege; his reputation had apparently preceded him, for the French king himself turned over the three-and-a-half page cryptogram to his Protestant ally. Marnix’s solution revealed some of the jealous Moreo’s vituperations against the Duke of Parma (who served also as the Spanish governor of the Low Countries), accusing him in venomous terms of subverting Philip’s programs there. Henry had Marnix send both the decrypt-ment and the substantiating ciphertext to the duke in August of 1590, in the faint hope of stirring up some discord; the duke, who knew of Moreo’s calumnies and considered them beneath his contempt, found Marnix’s solution of sufficient interest to preserve it, but took none of the hoped-for actions.

It was not the first time that Marnix had solved Spanish ciphers. Thirteen years before he had done it, and his demonstration of the value of cryptanalysis set in motion a train of events that culminated on a headsman’s block.

In 1577, Philip was ruling the Netherlands through his half brother, Don Juan of Austria, its governor. The ambitions of Don Juan, then the first warrior of Christendom by virtue of his crushing defeat of the Turks at Lepanto, were not to be circumscribed by those constricted borders. He dreamed of crossing the Channel into England with a body of troops, dethroning Elizabeth, then marrying the seductive Mary, Queen of Scots, and sharing a Catholic crown of England with her. Philip consented to the invasion and the marriage, both to be begun as soon as Juan had restored peace in the Netherlands.

But England did not sleep. Sir Francis Walsingham, Elizabeth’s satanic-looking minister, had built up an efficient organization for secret intelligence that reportedly had 53 agents in its pay on the Continent at one time. Walsingham first got wind that something was afoot when he heard of the marriage proposal. But his suspicions remained unconfirmed until the Huguenot general François de la Noue intercepted some of Don Juan’s enciphered letters in Gascony near the end of June, 1577. Since they presumably dealt with affairs in the Low Countries, they were sent to authorities there.

Somehow they reached Marnix. Within a month he had broken the cipher. It was a typical Spanish nomenclator of the period, with a total vocabulary of about 200 words, the usual syllabary, and an alphabet. A peculiarity was that each plaintext vowel was given, in addition to its one literal and two numerical substitutes, a swash symbol as a substitute. Then, if a consonant preceded a vowel, this flourish was joined to the consonant’s ciphertext number to form a single combined character representing the two letters.

The solutions seem to have all but disclosed Juan’s plan of landing his Spanish veterans in England under the guise of seeking refuge from storms that had blown him off course. William of Orange revealed the contents to Daniel Rogers, one of Walsingham’s agents, at a dinner at Alkmaar on July 11, in an attempt to persuade Elizabeth to come to his aid. Wrote Rogers in his report to Walsingham:

The Prince [William] told me this that her Majesty might perceive how this negotiation of Don John and the Pope’s Nuncio agreed with the letters written by Don John and Escovedo [Juan’s secretary] in April last, and now intercepted. With that he called for M. de Sainte-“Allagunde,” whom he would have to bring the letters with him…. Sainte-Aldegonde brought nine letters, written all in Spanish, the most part of every one in cipher, excepting one. Three of these were written by Don John, two of them to the King [of Spain], the third to the King’s Secretary, Antonio Perez. The rest were all written by Escovedo to the King; it appeared by the seals and signatures they were no forged letters. The Prince also showed me the letter of La Noue, in which were enclosed all the said letters, as he had intercepted them in France. I thought good to pick out of them notes of the chief things contained in them.

This report gave England tangible evidence of Philip’s aggressive intentions and perhaps provoked an increased watchfulness that served England in good stead when Philip finally did mount his invasion attempt in the Grand Armada eleven years later. Juan’s plot came to naught because he failed to negotiate peace with the rebels, which he needed before he could begin with England. But Walsingham, having learned of Marnix’s rare talent, induced the nobleman to solve messages for him. On March 20, 1578, he wrote to William Davison, an English agent in Flanders: “It is very important to her Majesty’s service to have this letter of the ambassador of Portugal deciphered with speed. Please therefore deal earnestly and speedily with St. Alagondye in that behalf. The cipher is so easy that it requires no great trouble.”

Philip van Marnix’s solution of a nomenclator used by Don Juan de Austria, in 1577

For once the sanguine expectations of a superior concerning the lack of difficulty of an assigned task proved correct. On April 5, Davison replied: “Sainte-Aldegonde is this day gone toward Worms…. His leisure before going did not suffice to decipher the letters you sent me with your last, but he procured me another to perform it. I send it herewith….” The lengthy letter revealed the ambassador complaining to his king about how Elizabeth feigned illness to avoid an audience he was seeking.

Walsingham must have been dazzled by possibilities he never suspected when he first received Marnix’s solutions, for he took steps to assure himself of the rich flow of information provided by cryptanalysis without having to depend on foreign experts. Later that very year he had a bright young man in Paris devouring enciphered messages. This was Thomas Phelippes, England’s first great cryptanalyst.

Phelippes was the son of London’s collector of customs, a not inconsequential post to which he himself later succeeded. He traveled widely in France, probably as a roving representative for Walsingham. On his return, he became one of the minister’s most confidential assistants. He was an indefatigable worker, corresponding tirelessly in his calligraphic hand with Walsingham’s numerous agents. His letters show a fair acquaintance with literary allusions and classical quotations, and he appears to have been able to solve ciphers in Latin, French, and Italian and, less proficiently, in Spanish. The only known physical description of him comes from the pen of Mary of Scots herself, who describes Phelippes, whose hair and beard were blond, as “of low stature, slender every way, eated in the face with small pocks, of short sight, thirty years of age by appearance.”

Mary’s unflattering comments betrayed her suspicions about Phelippes—suspicions that were well founded. For Phelippes and his master, Walsingham, were casting a jaundiced eye on Mary for reasons that, in their turn, were equally well founded. Mary was the heir apparent to the throne of England. She was also nominally queen of Scotland, though she had been ejected in a tangled series of events and had been prevented from returning by the opposition of the strong Protestant party there to her indiscretions. She was a remarkable woman: beautiful, possessed of great personal charm, commanding the loyalty of her subordinates, courageous, unshakably devoted to her religion, but also unwise, stubborn, and capricious. Various Catholic factions had schemed more than once to seat her on the throne of England and so restore the realm to the Church. The chief result had been to confine Mary to various castles in England and to alert Walsingham to seek an opportunity to extirpate once and for all this cancer that threatened to destroy his own queen, Elizabeth.

The opportunity arose in 1586. A former page of Mary’s, Anthony Babington, began organizing a plot to have courtiers assassinate Elizabeth, incite a general Catholic uprising in England, and crown Mary. A conspiracy that involved the overthrow of the government naturally had ramifications all over the country, and Babington also gained the support of Philip II, who promised to send an expedition to help, once Elizabeth was safely dead. But the plan depended ultimately on the acquiescence of Mary, and to obtain this Babington had to communicate with her.

This was no easy task. Mary was then being held incommunicado under house arrest at the country estate of Chartley. But a handsome former seminarian named Gilbert Gifford, recruited by Babington as a messenger, discovered a way of smuggling Mary’s letters into Chartley in a beer keg. It worked so well that the French ambassador gave Gifford all the correspondence that had been accumulating for Mary for the past two years.

Much of it was enciphered. But this was only part of the care that Mary took to ensure the security of her communications. She insisted that important letters be written within her suite and read to her before they were enciphered. Dispatches had to be sealed in her presence. The actual encipherment was usually performed by Gilbert Curll, her trusted secretary, less often by Jacques Nau, another secretary. Mary not infrequently ordered changes in her nomenclators, which were much smaller and flimsier than the diplomatic ones.

What neither Mary nor Babington knew was that, despite their elaborate precautions, their correspondence was being delivered to Walsingham and Phelippes as quickly as they wrote it. Gilbert Gifford was a double-agent, a ne’er-do-well who had offered his services to Walsingham. Walsingham, seeing an unparalleled opportunity to insinuate his antennae into Mary’s circles, employed Gifford to turn over to him all Mary’s letters, which he copied and then passed on. It included the two-year backlog entrusted to Gifford by the French ambassador, and the rapidly growing volume of traffic generated by Babington’s festering plot. These enciphered missives were being solved by Phelippes almost as quickly as he got his hands on them. As the conspiracy reached a crescendo of preparation in the middle of July, he was sometimes reading two or more in a day: two letters from the queen bear notations “decifred 18 July 1586,” two others are marked as deciphered July 21, and there are still other cipher letters in the same packet in the records that bear no notations.

During these three months, Walsingham cannily made no arrests, but simply let the plot develop and the correspondence accumulate in the hope that Mary would incriminate herself. His expectations were fulfilled. Early in July, Babington specified the details of the plan in a letter to Mary, referring to the Spanish invasion, her own deliverance, and “the dispatch of the usurping competitor.” Mary considered her reply for a week and, after composing it carefully, had Curll encipher it; she sent it off to Babington on July 17. It was to prove fatal, for in it Mary acknowledged “this enterprise” and advised Babington of ways “to bring it to good success.” Phelippes, on solving it, immediately endorsed it with the gallows mark.

But Walsingham still lacked the names of the six young courtiers who were to commit the actual assassination. So when the letter reached Babington, it bore a postscript that was not on it when it left Mary’s hands; in it Babington was asked for “the names and qualities of the six gentlemen which are to accomplish the designment.” Both the forgery and the encipherment in the correct key seem to be the work of Phelippes.

It proved unnecessary. Babington needed to go abroad to organize the invasion; at Walsingham’s suggestion, there was a mix-up in the passports. Babington, suspecting nothing, boldly came to the minister for help in cutting the red tape. While he was dining at the nearby tavern with one of Walsingham’s men, a note came, calling for his arrest. He caught a glimpse of it and, saying he was going to pay the bar bill and leaving his cloak and sword on the back of his chair, he slipped out and escaped. The hue and cry set up by his pursuers panicked the six young men. They fled for their lives, but within a month both they and Babington were caught and condemned to death after a two-day trial. Before they were executed, the authorities prudently extracted from Babington the cipher alphabets he had used with Mary.

Enciphered postscript to letter of Mary, Queen of Scots, forged by Thomas Phelippes

These, and Mary’s letters, served as thoroughly incriminatory evidence in the Star Chamber proceedings that convicted her of high treason. Mary received the announcement that Elizabeth had signed her death warrant with majestic tranquillity, and at eight on the morning of February 8, 1587, after eloquently reiterating her innocence and praying aloud for her church, for Elizabeth, for her son, and for all her enemies, mounted the platform with solemn dignity, knelt, and received the axeman’s three strokes with the courage that had marked every other action of her life. Thus did Mary, Queen of Scots, exit this transient life and enter the more enduring one of legend, as her motto had prophesied: “In my end is my beginning.” There seems little doubt that she would have died before her time, the politics of the day being what they were. But there seems equally little doubt that cryptology hastened her unnatural end.

4. On the Origin of a Species

“DATO and I were strolling in the Supreme Pontiff’s gardens at the Vatican and we got to talking about literature as we so often do, and we found ourselves greatly admiring the German inventor who today can take up to three original works of an author and, by means of movable type characters, can within 100 days turn out more than 200 copies. In a single contact of his press he can reproduce a copy of an entire page of a large manuscript. And so we went from topic to topic marveling at the ingenuity that men showed in various enterprises, till Dato gave expression to his warm admiration for those men who can exploit what are called ‘ciphers.’ ”

So wrote Leon Battista Alberti near the beginning of the succinct but suggestive work that earned him the title of Father of Western Cryptology. Alberti was the first of a group of writers who, element by element, developed a type of cipher to which most of today’s systems of cryptography belong. The species is polyalphabetic substitution.

As the name implies, it involves two or more cipher alphabets. Because the different alphabets use the same symbols (usually letters) for ciphertext, a given symbol can represent different plaintext letters, depending on which alphabet is being used. This naturally will confuse the cryptanalyst, which of course is the point. But it could also confuse the cryptographer, unless he knew which alphabet was then in use, and this knowledge implies some kind of rotation or rule for bringing the alphabets into play. All this differs from the simple use of homophones or their much rarer opposites, polyphones. A given homophone always represents the same plaintext letter, and a given polyphone always represents the same choice of plaintext letters, usually two or three at the most. Their relation to their plaintext elements remains fixed. In polyalphabetic substitution the relationship is variable. It thus marked a great stride forward in cryptology, though it did not supplant the nomenclator in political cryptography for more than 400 years. In the 20th century, the ways of varying the plain-to-cipher relationship reached such proportions of complexity as to afford cryptographers guarantees of extraordinary security.

It was the amateurs of cryptology who created the species. The professionals, who almost certainly surpassed them in cryptanalytic expertise, concentrated on the down-to-earth problems of the systems that were then in use but are now outdated. The amateurs, unfettered to these realities, soared into the empyrean of theory. There were four whose thought took wings: a famous architect, an intellectual cleric, an ecclesiastical courtier, and a natural scientist.

The architect was Alberti, a man who, perhaps better than anyone except Leonardo da Vinci, epitomizes the Renaissance ideal of the universal man. Born in 1404, the illegitimate but favored son of a family of rich Florentine merchants, Alberti enjoyed extraordinary intellectual and athletic aptitudes. His family cultivated these with lavish care, educating him in the law at the University of Bologna and sending him on a grand tour of Europe in his mid-twenties. A severe illness that caused a partial loss of memory interrupted a career which might have led to a bishopric, and Alberti turned his attention from law to arts and sciences. As an architect, he completed the Pitti Palace, erected the first Fountain of Trevi in Rome (since replaced in a renovation), and constructed, among many other buildings, the church of Sant’Andrea at Mantua, which served as the model for many Renaissance churches, and the temple of Malatesta at Rimini.

His talent was universal. He painted, composed music, and was regarded as one of the best organists of his day. He was given one of the leading roles in an imaginary philosophical dialogue. Writings poured from his pen: poems, fables, comedies, a treatise on the fly, a funeral oration for his dog, a misogynistic essay on cosmetics and coquetry, the first scientific investigation of perspective, books on morality, law, philosophy, family life, sculpture, and painting. His De Re Aedificatoria, the first printed book on architecture, written while Gothic churches were still being built, helped shape the thoughts of those who built such utterly non-Gothic structures as St. Peter’s Basilica in Rome. It stands as “the theoretical cornerstone of the architecture of the Renaissance.” Alberti was a superb athlete, supposedly able to fling a coin so it rang against the high vault of a cathedral and capable of riding the wildest horses. Jacob Burckhardt, author of the classic The Civilization of the Renaissance in Italy, singled out Alberti as one of the truly all-sided men who tower above their numerous many-sided contemporaries. And another great Renaissance scholar, John Symonds, declared that “He presents the spirit of the 15th century at its very best.”

Among his friends was the pontifical secretary, Leonardo Dato, one of the learned men of his age, who during that memorable stroll in the Vatican gardens brought the conversation around to cryptology. “You’ve always been interested in these secrets of nature,” Dato said. “What do you think of these decipherers? Have you tried your hand at it, as much as you know how to?”

Alberti smiled. He knew that Dato’s duties included ciphers (it was before the curia had a separate cipher secretary). “You’re the head of the papal secretariat,” he teased. “Could it be that you had to use these things a few times in matters of great importance to His Holiness?”

“That’s why I brought it up,” Dato replied candidly. “And because of the post I have, I want to be able to do it myself without having to use outside interpreters. For when they bring me letters in cipher intercepted by spies, it’s no joking matter. So please—if you’ve thought up any new ideas having to do with this business, tell me about them.” So Alberti promised that he would do some work on it so that Dato would see that it was profitable to have asked him, and the result was the essay that he wrote in 1466 or early 1467, when he was 62 or 63.

He implied that he thought up the idea of frequency analysis all by himself, but the conception that he set forth is far too matured for that. Nevertheless, his remarkably lucid Latin essay, totaling about 25 manuscript pages, constitutes the West’s oldest extant text on cryptanalysis. “First I shall consider the number of letters and the phenomena which depend on the rules of number,” he wrote at the start of his analysis. “Here the vowels claim first place…. Without a vowel there is no syllable. It follows that if you take a page of some [Latin] poet or dramatist and make separate counts of the vowels and consonants in the lines, you will be sure to find the vowels very numerous…. If all the vowels of a page were put together, to the number of, say, 300, the number of all the consonants together will be about 400. Among the vowels I have noticed that the letter o, while not less frequent than the consonants, occurs less often than the other vowels.” He continued in this vein through a detailed description of the characteristics of Latin: “When the consonants follow a vowel at the end of the word, this final consonant will never be any except t, s, and x, to which c may be added.” He touched briefly upon Italian and pointed out that if a cipher message has more than 20 different elements, nulls and homophones may be present because Latin and Italian use only 20 letters.

Only after he had explained how ciphers are solved did he proceed to ways of preventing solution—a wise procedure which is ordinarily neglected by the inventors of cipher systems. Alberti first reviewed different systems of en-cipherment: substitutions of various kinds, transposition of the letters within a word, placing dots above the letters of a cover text to spell out a secret message, and invisible inks. He capped his work with a cipher of his own invention that he called “worthy of kings” and, like all inventors, claimed was unbreakable. This was the cipher disk that founded polyalphabeticity. With this invention, the West, which up to this point had equaled but had never surpassed the East in cryptology, took the lead that it has never lost.

“I make two circles out of copper plates. One, the larger, is called stationary, the smaller is called movable. The diameter of the stationary plate is one-ninth greater than that of the movable plate. I divide the circumference of each circle into 24 equal parts. These parts are called cells. In the various cells of the larger circle I write the capital letters, one at a time in red, in the usual order of the letters, A first, B second, C third, and then the rest, omitting H and K [and Y] because they are not necessary.” This gave him 20 letters, since J, U, and W were not in his alphabet, and in the remaining four spaces he inscribed the numbers 1 to 4 in black. (The red and black seem to signify only that Alberti liked colors.) In each of the 24 cells of the movable circle he inscribed “a small letter in black, and not in regular order like the stationary characters, but scattered at random. Thus we may suppose the first of them to be a, the second g, the third q, and so on with the rest until the 24 cells of the circle are full; for there are 24 characters in the Latin alphabet, the last being et [probably meaning “&”]. After completing these arrangements we place the smaller circle upon the larger so that a needle driven through the centers of both may serve as the axis of both and the movable plate may be revolved around it.”

Leon Battista Albert’s cipher disk

The two correspondents—who, Alberti carefully pointed out, must each have identical disks—agree upon an index letter in the movable disk, say k. Then, to encipher, the sender places this prearranged index letter against any letter of the outer disk. He informs his correspondent of this position of the disk by writing, as the first letter of the ciphertext, this letter of the outer ring. Alberti gave the example of k being placed against B. “From this as a starting point all the other characters of the message will acquire the force and sounds of the stationary characters above them.”{11} So far nothing remarkable had happened. But in his next sentence Alberti placed cryptography’s feet on the road to its modern complexity. “After writing three or four words, I shall change the position of the index in our formula by turning the circle, so that the index k may be, say, under D. So in my message I shall write a capital D, and from this point on [ciphertext] k will signify no longer b but d, and all the other stationary letters at the top will receive new meanings.”

There is the crucial point: “new meanings.” Each new position of the inner disk brings different letters opposite one another in the inner and outer rings. Consequently, each shift means that plaintext letters would be replaced with different ciphertext equivalents. For example, the plaintext word NO might be enciphered to fc at one setting and to ze at another. Equally, at each shift a given ciphertext letter would stand for a different plaintext letter than it did at the previous setting. Thus, the fc that formerly represented NO might, at the new setting, stand for plaintext TU. This shift in both plain and cipher equivalents differentiates polyalphabetic from homophonic or polyphonic substitution. In homophonic substitution, plaintext E might be represented by 89, 43, 57, and 64—but those four numbers would always and invariably refer to the same plaintext, whereas in polyalphabetic substitution cipher equivalents have different plaintext meanings. Moreover, while E in homophonic substitution is limited to that group of cipher equivalents, in polyalphabetic substitution it may be replaced by any one of the ciphertext letters. In substitution using polyphones, ciphertext 24 may stand for both plaintext R and plaintext G. But it will invariably stand for just those two letters, whereas a ciphertext symbol in polyalphabetic substitution may stand for any one of all the plaintext letters. To a cryptanalyst, the quicksilver, impermanent nature of cipher symbols in polyalphabetic substitution, which mean one thing here and another there, can be exceedingly baffling; at the same time, the collapse of his expectations of seeing a plaintext A being again represented by the ciphertext symbol that he previously extracted for it can be very frustrating.

Each new setting of Alberti’s disk brought into play a new cipher alphabet, in which both the plaintext and the ciphertext equivalents are changed in regard to one another. There are as many of these alphabets as there are positions of his disk, and this multiplicity means that Alberti here devised the first polyalphabetic cipher.

This achievement—critical in the history of cryptology—Alberti then adorned by another remarkable invention: enciphered code. It was for this that he had put numbers in the outer ring. In a table he permuted the numbers 1 to 4 in two-, three-, and four-digit groups, from 11 to 4444, and used these as 336 codegroups for a small code. “In this table, according to agreement, we shall enter in the various lines at the numbers whatever complete phrases we please, for example, corresponding to 12, ‘We have made ready the ships which we promised and supplied them with troops and grain.’” These code values did not change, any more than the mixed alphabet of the disk did. But the digits resulting from an encoding were then enciphered with the disk just as if they were plaintext letters. In Alberti’s words, “These numbers I then insert in my message according to the formula of the cipher, representing them by the letters that denote these numbers.” These numbers thus changed their ciphertext equivalents as the disk turned. Hence 341, perhaps meaning “Pope,” might become mrp at one position and fco at another. This constitutes an excellent form of enciphered code, and just how precocious Alberti was may be seen by the fact that the major powers of the earth did not begin to encipher their code messages until 400 years later, near the end of the 19th century, and even then their systems were much simpler than this.

Alberti’s three remarkable firsts—the earliest Western exposition of cryptanalysis, the invention of polyalphabetic substitution, and the invention of enciphered code—make him the Father of Western Cryptology. But although his treatise was published in Italian in a collection of his works in 1568, and although his ideas were absorbed by the Argentis and so influenced the later development of cryptology, they never had the dynamic impact that such prodigious accomplishments ought to have produced. Symonds’ evaluation of his work in general may both explain why and summarize the modern view of his cryptological contributions: “This man of many-sided genius came into the world too soon for the perfect exercise of his singular faculties. Whether we regard him from the point of view of art, of science, or of literature, he occupies in each department the position of precursor, pioneer, and indicator. Always original and always fertile, he prophesied of lands he was not privileged to enter, leaving the memory of dim and varied greatness rather than any solid monument behind him.”

Polyalphabeticity took another step forward in 1518, with the appearance of the first printed book on cryptology, written by one of the most famous intellectuals of his day. He was born February 2, 1462, in Trittenheim, Germany, where his father, a wealthy winegrower, was known only as Johannes of Heidenberg, his former village. The father died a year later, and the son, also named Johannes, was raised first by his mother and then by a rather stern stepfather, who ridiculed the boy’s passion for learning. At 17, Johannes left home and sought entry to the University of Heidelberg, where its chancellor, Johannes of Dalberg, was so impressed by the youth’s brilliance that he granted him a pauper’s certificate exonerating the tuition fees. Soon thereafter, Johannes of Dalberg, one Rodolphe Huesmann, and the young Johannes formed the Rhenish Literary Society, each taking, according to custom, a Latin and a Greek name. The young man chose “Trithemius,” which, while having a certain consonance with the name of his native village of Trittenheim, indicated that he was the third link of the group. He has been known as Johannes Trithemius ever since.

In January, 1482, when the young Trithemius was on his way home from Heidelberg for a New Year’s visit, he sought shelter during a heavy snowstorm at the impoverished, 437-year-old Benedictine abbey of Saint Martin at Spanheim, Germany. He was very much attracted by the life of the monks and soon entered the novitiate. A year and a half later, only a little while after taking his final vows, he was elected abbot—either because the monks recognized his brilliance or because they thought that he would be too young to enforce discipline. He maintained his post, however, and at 24 published a book of sermons that gave him an instant fame. He was called upon to preach before princes and religious conventions. His reputation as a savant grew with his prolific writings—several histories, a biographical dictionary of famous Germans, one of famous Benedictines, a chronicle of the dukes of Bavaria and the Counts Palatine, a life of Saint Maximum and one of an archbishop of Mainz. Learned men corresponded with him. He knew the original Dr. Faustus well enough to consider him a charlatan. Powerful rulers like the Margrave of Brandenberg and the Holy Roman Emperor Maximilian I invited him to their castles. And posterity has honored him. His most important work, the Liber de scriptoribus ecclesiasticis, a chronological list of about 7,000 theological works by 963 authors that was published in 1494, earned him the title of Father of Bibliography. It was conferred by Theodore Besterman, compiler of the World Bibliography of Bibliographies, who said that Trithemius “was not the first to compile bibliographies, but he was certainly the first bibliographically-minded scholar to do so.”

These were all solid works. But Trithemius’ other writings were darkened by his intense interest, not to say belief, in occult powers. (Like others of his day, he could reconcile this with his pious Christianity because the leading treatises on esoterism, thought to have been written by an Egyptian priest called Hermes Trismesgistus, had actually been compiled by Christians in the second century A.D. and so contained nothing monumentally offensive to the church.) Trithemius wrote on alchemy, classified witches into four carefully defined categories, explained the twelve angelic hierarchies ruled by emperors related to the chief winds and points of the compass. He analyzed history in terms of the 354-year cycles of the seven planetary angels, bearing names like Orifiel and Zachariel, and fixed the creation of the world at 5206 B.C. These writings made him one of the great figures of occult science, and today books on the subject venerate him as a superlative alchemist and as the mentor of two other almost legendary occultists, Paracelsus and Cornelius Agrippa.

In 1499, Trithemius, who after long pondering had finally concluded that some things were unknowable, was said to have been visited in a dream by a spirit who taught him many of these very things. These he wrote down in a volume which he intended to comprise eight books and which he called “Steganographia,” from Greek words meaning “covered writing.” In the first two books he described some elementary reciprocal vowel-consonant substitutions and several variations on a system in which only certain letters of nonsense words signify the meaning, the other letters being nulls. For example, in the message beginning PARMESIEL OSHURMI DELMUSON THAFLOIN PEANO CHARUSTREA MELANY LYAMUNTO …, the decipherer extracts every other letter of every other word, beginning with the second word since the first indicates the specific system. The Latin plaintext begins Sum tali cautela ut…. But all this may have simply served as a cover for the magical operations described in the third book, which included no cryptography at all. Here Trithemius slipped again into the shadow world of spirits with names like Vathmiel, Choriel, and Sameron, and discussed methods that sound like telepathy. To convey a message to a desired recipient within 24 hours, for example, one needed simply to say it over an image of a planetary angel at a moment determined by complicated astrological calculations, wrap the image up with an image of the recipient, bury them under a threshold, say the proper incantations ending with “In nomine patris & filii & spiritus sancti, Amen,” and the message would arrive, Trithemius assured the reader, without words, writing, or messenger. Trithemius told how to use the network of angels for thought transference and for gaining knowledge of all things happening in the world. Involved is the Kabbalah-like computation of the numerical values of the angels’ names; Trithemius, like other hermeticists, regarded Moses as a kind of Jewish Hermes Trismesgistus.

He showed the “Steganographia” in its incompleted state to a visitor, who was so horrified at its barbarous names of seraphim, its obscurantism, its impossible claims, that he denounced it as sorcery. A letter which Trithemius wrote to a friend arrived after the friend had died; the prior of the abbey opened it, was likewise shocked, and passed it around. Trithemius fell under a cloud of working in magic, which the church even then frowned upon. He abandoned the book, but probably did not mind the reputation he was gaining as a wonder-worker, for Trithemius was more than a bit of the braggart and publicity hound. He had concluded his ecclesiastical bibliography with some of his own books—inserted, he said, “at the solicitation of my friends.” To a visitor, he boasted that he had taught an illiterate German prince Latin in an hour, and then, before the prince departed, withdrew all his knowledge. He offered to make a thief return everything that he had stolen from the visitor if only the visitor would have faith; of course he did not have enough. Trithemius maintained that he comprehended nothing less than wisdom itself. This sort of thing naturally attracted crowds of the curious and hopeful and started the wild rumors about his magic powers that were circulating even during his life. According to one, the abbot, finding himself at an inn where supplies had run short, tapped on a window and called out in Latin, whereupon a spirit passed in to him a broiled pike and a bottle of wine.

Believing sincerely that his own practices were devoutly Christian, Trithemius did not fight the legend, except to deny that there was anything demonic or un-Christian in his practices. His reputation for esoteric knowledge grew so great, in fact, that the “Steganographia” circulated in manuscript for a hundred years, being copied by many persons eager to suck out the secrets that it was thought to hold. Parts were transcribed for Giordano Bruno, among others. It became famous, and controversy flamed about it. In 1599, for example, the Jesuit Martin Antoine Del Rio called it “full of peril and superstition.” Not until 1606 was it printed, and this exacerbated the dispute. The opponents scored a great victory when, on September 7, 1609, the Roman Catholic Church placed it on its Index of Prohibited Books. It stayed there for more than 200 years, throughout numerous reprintings, the last as late as 1721. Many scholars attacked it, and others wrote whole books defending it. But the larger controversy over magic faded as the Age of Reason gained sway, and the book lost its interest.

Even during Trithemius’ lifetime, however, it had caused him trouble. In 1506, while he was away on a trip, the monks at Spanheim mutinied, apparently because his reputation as a magician, due in no small measure to the “Steganographia.” had brought odium to the monastery. He never returned, but obtained a transfer to the monastery of Saint Jacob in Wurzburg, where, on October 3, 1506, he was elected prior. Early in 1508, he addressed himself to a book carefully restricted to cryptology, as if to prove that that was what he meant all along. He called it the “Polygraphia” because of the multiplicity of ways of writing that it included. He perhaps began it on his 46th birthday, for he finished Book I on February 12, and he wrote each of its six books in an average of ten days. At that rate, he completed it quickly, probably by April 24, the date of its dedication to the Holy Roman Emperor Maximilian I. Like others of his writings, it was not published at once, and Trithemius turned to the composition of other texts. So he lived on quietly at Wurzburg, where he studied, wrote, corresponded, and received visitors, and where, on December 15, 1516, he died.

A year and a half later, the descendants of his old preceptor, Johannes of Dalberg, paid for the publication of the “Polygraphia,” which thereby became the first printed book on cryptology. It bore the title Polygraphiae libri sex, Ioannis Trithemii abbatis Peapolitani, quondam Spanheimensis, ad Maximilianum Caesarem (“Six Books of Polygraphy, by Johannes Trithemius, Abbot at Wurzburg, formerly at Spanheim, for the Emperor Maximilian”). Johannes Haselberg of Aia completed its printing in July, 1518. It is a handsome small folio of 540 pages in red and black, with a woodcut title page borrowed from an earlier book by Trithemius. It ends with a “Clavis Polygraphiae” which repeats the original woodcut title page and gives a resume of the preceding six books. It was reprinted in 1550, 1571, 1600, and 1613, and a French translation (heavily edited and modified) by Gabriel de Collanges appeared in 1561 and was reprinted in 1625. This became the subject of one of the world’s most notorious plagiarisms when in 1620 a Frisian named Dominique de Hottinga published Collange’s work as his own and even complained of how hard it was to do!

By far the bulk of the volume consists of the columns of words printed in large Gothic type that Trithemius used in his systems of cryptography. The first of the six books comprises 384 columns of Latin words, two columns per page, for Trithemius’ best-known invention, his Ave Maria. Each word represents the plaintext letter that stands opposite it. Trithemius so selected the words that, as the equivalents for the letters are taken from consecutive tables, they will make connected sense and will appear to be an innocent prayer. Thus abbot would be enciphered as DEUS CLEMENTISSIMUS REGENS AEVUM INFINIVET. Book II lists 284 similar alphabets. Book III has 1,056 numbered lines of three artificial words per line, arranged in columns. A typical column begins HUBA, HUBE, HUBI, HUBO, and so on down to the 24th word, HUBON. These were to be used like those of the Ave Maria—but just how this was to avoid suspicion is hard to see. Book IV lists 117 columns of artificial words whose second letter varied in each column from a to w (the last letter of the alphabet Trithemius used, following z): BALDACH, ABZACH, ECOZACH, ADONACH, … These served to construct a cover text in which only the second letters of each word would carry the secret message. Taking words from his first three alphabets in order, bad would become ABZACH HANASAR ADAMAI. Once again, this does not appear the height of innocence. Perhaps Trithemius just could not stay away from those incantatory words. Book VI gives supposed cipher alphabets of the Franks and Normans, as well as the first printed description of Tironian notes.

The woodcut title page of the first printed book on cryptology. Though taken from an earlier book by the same author, Johannes Trithemius, the illustration was apparently appropriate to this book as well. It shows the author wearing his Benedictine habit and, with his abbot’s miter on the floor before him, kneeling to present his book—padlocked, as befits its secret character—to the dedicatee, the Holy Roman Emperor Maximilian I. Seated upon his throne in the imperial castle at Augsburg and wearing the imperial crown and mantle, Maximilian holds his scepter in one hand and blesses Trithemius with the other. Behind Trithemius, another person—either another monk or the publisher—extends towards Maximilian two keys to the book, these symbolizing Maximilian’s spiritual authority and temporal power. In the background Trithemius’ chaplain, a young monk, holds his abbot’s crozier. At bottom, Trithemius reclines with a fruit-laden branch representing the motto “Ye shall judge the tree by its fruits” and implying that Trithemius’ many works make him worthy of acclaim. At upper left, arms of the Holy Roman Empire; at upper right, arms of the engraver; at lower left, arms of Trithemius (the two bass back to back symbolizing his Christianity; the shells, his religious state; the grapes, his father, a winegrower); at lower right, arms of the then Bishop of Würzburg. At sides, philosophers hold an armillary sphere, a sextant, a compass, and a square rule; others hold the banner ends.

The first page of Johannes Trithemius’ “Ave Maria” cipher

It is Book V that contains Trithemius’ contributions to polyalphabeticity. Here appears, for the first time in cryptology, the square table, or tableau. This is the elemental form of polyalphabetic substitution, for it exhibits all at once all the cipher alphabets in a particular system. These are usually all the same sequence of letters, but shifted to different positions in relation to the plaintext alphabet, as in Alberti’s disk the inner alphabet assumed different positions in regard to the outer alphabet. The tableau sets them out in orderly fashion—the alphabets of the successive positions laid out in rows one below the other, each alphabet shifted one place to the left of the one above. Each row thus offers a different set of cipher substitutes to the letters of the plaintext alphabet at the top. Since there can be only as many rows as there are letters in the alphabet, the tableau is square.

The simplest tableau is one that uses the normal alphabet in various positions as the cipher alphabets. Each cipher alphabet produces, in other words, a Caesar substitution. This is precisely Trithemius’ tableau, which he called his “tabula recta.” Its first and last few lines were:

Trithemius used this tableau for his polyalphabetic encipherment, and in the simplest manner possible. He enciphered the first letter with the first alphabet, the second with the second, and so on. (He gave no separate plaintext alphabet, but the normal alphabet at the top can serve.) Thus a plaintext beginning Hunc caveto virum … became HXPF GFBMCZ FUEIB…. In this particular message, he switched to another alphabet after 24 letters, but in another example he followed the more normal procedure of repeating the alphabets over and over again in groups of 24.

The great advantage of this procedure over Alberti’s is that a new alphabet is brought into play with each letter. Alberti shifted alphabets only after three or four words. Thus the ciphertext would mirror the obvious pattern of repeated letters of a word like Papa (“Pope”), or in English, attack, and the cryptanalyst could seize upon this reflection to break into the cryptogram. The letter-by-letter encipherment obliterates this clue.

Trithemius’ system is also the first instance of a progressive key, in which all the available cipher alphabets are exhausted before any are repeated. Modern cipher machines very often embody such key progressions. Naturally, they avoid the chief defects of Trithemius’ primitive system: its paucity of alphabets and the rigid order of their use.

Trithemius’ influence in cryptology was very great, owing in part to his reputation and in part to his having authored the first printed book on the subject. Letter-by-letter encipherment quickly became customary in polyalphabetic theorizing, and the tableau established itself as a standard item in cryptology. It formed the basis of innumerable ciphers, and so important did it become that some German authors attempted to enshrine their compatriot on this basis alone. But valuable as his contributions were, they do not justify that accolade.

If the first two steps in polyalphabeticity were made by men who were giants in their time, the third was taken by a man who was so unexceptional that he left almost no traces. This is Giovan Batista Belaso; the sum total of knowledge about him consists of the facts that he came from Brescia of a noble family, served in the suite of one Cardinal Carpi, and, in 1553, brought out a little booklet entitled La cifra del. Sig. Giovan Batista Belaso. In this he proposed the use of a literal, easily remembered, and easily changed key—he called it a “countersign”—for a polyalphabetic cipher. Wrote Belaso: “This countersign may consist of some words in Italian or Latin or any other language, and the words may be few or many as desired. Then we take the words we wish to write, and put them on paper, writing them not too close together. Then over each of the letters we place a letter of our countersign in this form. Suppose, for example, our countersign is the little versetto VIRTUTI OMNIA PARENT. And suppose we wish to write these words: Larmata Turchesca partira a cinque di Luglio. We shall put them on paper in this manner:

VIRTUTI OMNIA PARENT VIRTUTI OMNIA PARENT VI

larmata turch escapa rtiraac inque dilugl io”

The keyletter that is paired with a given plaintext letter indicates the alphabet of the tableau that is to be used to encipher that plaintext letter. Thus, / is to be enciphered by the V alphabet, a by the I alphabet, and so on. The system permits great flexibility: no longer did all messages have to be enciphered with one of a relatively few standard sequences of alphabets, but different ambassadors could be given individual keys, and, if it were feared that a key had been stolen or solved, a new one could be substituted with the greatest of ease. Keys caught on at once, and the Belaso invention laid the foundation for today’s exceedingly complex arrangements, in which not one but several keys are employed and are varied at odd intervals.

Belaso, however, like Trithemius, employed standard alphabets as his cipher alphabets. It remained for a young prodigy, who later organized the first scientific society of modern times, to revive the mixed alphabets of Alberti and to wrap Alberti’s notions together with those of Trithemius and Belaso into the modern concept of polyalphabetic substitution.

Giovanni Battista Porta was born in Naples in 1535, was raised by a cultured and intelligent uncle, and was composing essays in Latin and Italian by the time he was ten. After the usual grand tour, he returned to Naples and, at 22, published his first book, a study of oddities and scientific curiosa entitled Magia naturalis. Later, he brought together in his home in Naples a group of men similarly interested in natural magic—the study of the mysteries of nature by experimental means, as opposed to spirit magic like Trithemius’. Here they met periodically and performed experiments. This was the Acca-demia Secretorum Naturae, whose members called themselves the Otiosi (Men of Leisure). It was the first of all associations of scientists, and as such it began the transformation of scientific inquiry from an individual eccentricity to the organized and socially sanctioned pursuit that it now is. The Otiosi were soon suspected of dabbling in the occult, however, and Porta was called to Rome to explain reports of witches’ salves and necromantic arts. He cleared himself before Pope Paul V, returning cautioned but unblemished. In fact, his “magic” was only that of a parlor conjuror—tricks cloaked in mystery but easily explained. He also served as vice president of another early scientific society, the Accademia dei Lincei (Academy of Lynxes), one of whose members was Galileo.

Between 1586 and 1609, Porta produced books on the asserted relation of human physiognomy to animal characteristics, which influenced the Italian criminologist Cesare Lombroso in defining “the criminal type,” on meteorology, the refraction of light, pneumatics, the design of villas, astronomy, astrology, distillation, and the improvement of memory, as well as 14 prose comedies, two tragedies, and one tragicomedy. An expanded version of the Magia naturalis, in 20 books, recorded many of the experiments of the Otiosi and, as popular as the original, was translated and was reprinted no fewer than 27 times. Called the “most delightful and browsable of scientific books,” it includes such oddities as ways of making merry by turning women’s faces red, green, or pimply, and by using a juggler’s prank of burning hare’s fat to cause women to cast off all their clothes. (Not all of Porta’s tricks worked.) Book XVI gave numerous recipes for secret ink and for such tricks as writing invisibly on an egg and on human skin so that “messengers may be sent, who shall neither know that they carry letters nor can they be found about them,” and hiding missives in living creatures (by feeding a letter in meat to a dog, then killing him to retrieve it). Porta sometimes embroidered the truth a little in reporting the facts both of his experiments and of his life. But he was the first to recognize the heating effect of light rays and to expound an ecological grouping of plants. He died in 1615 at 80, leaving the memory of a mild-tempered and pleasant man.

Porta was only 28 when, in 1563, he published the book on which his fame as a cryptologist rests. De Furtivis Literarum Notis is an extraordinary book. Even today, four centuries later, it retains its freshness and charm and—remarkably—its ability to instruct. Its great quality is its perspective: Porta saw cryptology in the round. Its four books, dealing respectively with ancient ciphers, modern ciphers, cryptanalysis, and a list of linguistic peculiarities that will help in solution, encompassed the cryptologic knowledge of the time. He rehearsed the standard ciphers of his forefathers, but he did not hesitate to criticize: the venerable pig-pen, or Freemasons’, or Rosicrucians’ cipher, is used, he sneered, by “rustics, women and children.” Among the “modern” systems—many of which are probably Porta’s own—appeared the first digraphic cipher in cryptology, in which two letters were represented by a single symbol.

He classified systems into three kinds: the changing of a letter’s order (transposition), of a letter’s form (substitution by symbol), and of a letter’s value (substitution by a letter of another alphabet). This was one of the earliest, if crude, instances of the now standard division of ciphers into transposition and substitution. He urged the use of synonyms in plaintexts, noting that “It will also make for difficulty of interpretation if we avoid the repetition of the same word.” Like the Argentis, he suggested deliberate misspellings of plaintext words: “For it is better for a scribe to be thought ignorant than to pay the penalty for the detection of plans,” he wrote. The book included a set of movable rococo cipher disks, and at one point Porta explained how they may be converted to a square table. His grasping of this relationship illuminates more clearly than anything else his thorough comprehension of the subject. He spiced his book with some eyebrow-raising sample plaintexts. Perhaps the most startling is “I deflowered the object of my affections today,” used for six encipherments in a row. He gave the first published description in Europe of how to solve a monalphabetic cipher with no word divisions or with false word divisions, at a time when cryptanalysts often depended on the presence of word divisions.

The earliest known digraphic system: Giovanni Battista Porta replaced each pair of letters with the sign at the intersection of their row and columns

Porta anticipated all other writers on the subject by describing what is regarded today as the second major form of cryptanalytical technique—that of the probable word—and, furthermore, by specifically differentiating it from linguistic analysis: “… when the subject matter is known,” he wrote, “the interpreter can make a shrewd guess at the common words that concern the matter in hand, and these can without much labor be discovered by observing for each word in the passages in question the number of characters and the likeness and difference of the letters in their positions…. In each subject there are several common words which go with it as it were of necessity; for example, in love, love, heart, fire, flame, to be burned, life, death, pity, and cruelty have place, and in war, soldier, leader, general, camp, arms, to fight, etc.… Thus, a form of interpretation which is not based on consideration of the documents themselves or on the attempt to distinguish vowels and consonants therein may lighten the task.”

He proffered some sapient advice on work techniques, as valid today as it was in Renaissance Italy:

There is required the most complete concentration, the most perfect diligence, so that the mind, free from all distracting thoughts, and with everything else put aside, may devote itself entirely to the single task of carrying the whole undertaking to a successful conclusion. Still, if the task sometimes requires unusual concentration and expenditure of time, this concentration should not go on uninterrupted; the brain should not be racked over-anxiously. For excessive pains and prolonged mental effort bring on brain-fag, so that the mind is afterwards less fit for these things, and accomplishes nothing…. This has often been my experience at such times as I came upon particularly involved ciphers, in the working-out of these. For after spending the whole day in this task (scarcely seven or eight hours seemed to me to have gone by), I hardly thought it was more than one or two o’clock, so that I was not aware of the approach of evening except through the shadows and the failing of the light.

Finally, Porta unconsciously revealed some practical experience in one sentence: “It will be found of no small importance besides for the message to have been written by the hand of the author, or a skilled scribe, for if, after it has been intercepted, it be copied wrong, or if it have started off from the hands of someone who was ignorant of the art of cipher, it will readily result that, since the writing is confused, every way of interpreting it will be blocked.” Knowledge like that comes only from wrestling with the dropped or transposed or altered letters that appear so regularly in the transmission of real cryptograms, since the problems one finds in books are invariably letter-perfect and highly susceptible to solution. It may be that he did some crypt-analysis for the papal curia.

One of Giovanni Battista Porta’s cipher disks

But what of Porta’s contribution to polyalphabeticity? It consists essentially of a lamination of existing elements—the letter-by-letter encipherment of Trithemius, the easily changed key of Belaso, and the mixed alphabet of Alberti—into a modern system of polyalphabetic substitution. Unfortunately for Porta, though he specifically stated that “The order [of the letters in the tableau … may be arranged arbitrarily, provided no letter is omitted,” he illustrated the system only with standard alphabets, and a lazy posterity, while naming this trivial system for him, cheated him of full recognition of his contribution. He wisely used a long key—CASTUM FODERAT LUCRETIA PECTUS ALGAZEL—and advised the choice of “irrelevant words” for keys, because “The further removed they are from common knowledge, the greater safety do they afford to the writing.” No great originality may be claimed for Porta’s contribution to polyalphabeticity, but it remains the first time that the modern concept of polyalphabeticity was enunciated.

Perhaps the full measure of Porta’s remarkable abilities may best be taken by his brash tackling of the toughest problem of Renaissance cryptology—the solution of polyalphabetic ciphers. Despite the high esteem in which these ciphers were then universally held, Porta refused to admit their invincibility and thought out some methods of attack. These are rather artificial, but their importance lies not in their intrinsic value, which is low, but in the bold attitude that engendered them—the only attitude that leads to any success in cryptanalysis.

In his first solution, Porta mounted an assault on a progressive-alphabet cipher with mixed alphabets. It was produced by a cipher disk with a normal plaintext alphabet clockwise on the fixed portion and a series of fantastic cipher signs on the mobile portion, which turned one space clockwise after the encipherment of each letter. Porta observed that if three letters appear in alphabetical sequence in a plaintext word (as def in deficio or stu in studium) the one-space progression of the disk would bring the same cipher sign successively opposite each of them, resulting in a threefold repetition of that sign in the ciphertext. Using this as a basis, Porta solved a contrived cryptogram and reconstructed the symbol alphabet. In his second solution, given in a chapter added in the 1602 edition of De Furtivis, Porta modified his first method to solve another trick polyalphabetic cryptogram that had standard alphabets but that used a literal key. Here, a threefold repetition of a ciphertext letter signaled that a key with three letters in normal alphabetical order had enciphered a plaintext that had three letters in reverse alphabetical order. During his discussion, he came within a hair’s breadth of achieving the true general solution he sought: “Since there are … 51 letters between the first three MMM and the same three letters repeated in the thirteenth word, I conclude that the key has been given three times and decide correctly that it consists of 17 letters.” He never capitalized on this observation. Had he done so, he would have kept the polyalphabetic cipher from ever gaining the exaggerated reputation for security that glowed like a protective aura around it for 300 years.

De Furtivis, like Porta’s other books, went through several editions and, in 1591, it received the ultimate accolade: it was pirated by an unscrupulous printer of London, John Wolfe, who counterfeited the original 1563 edition almost to perfection. A legitimate 1593 edition, published under the title of De Occultis Literarum Notis, included at the rear cryptology’s first set of synoptic tables. These showed in graphic form the path the cryptanalyst must follow in his analysis of a given cryptogram, with the forks he must take if the message shows one characteristic as opposed to another. Porta’s overall rank in the cryptology of his day was well stated by Dr. Charles J. Mendelsohn,who has delved more deeply into this period than any other scholar: “He was, in my opinion, the outstanding cryptographer of the Renaissance. Some unknown who worked in a hidden room behind closed doors may possibly have surpassed him in general grasp of the subject, but among those whose work can be studied he towers like a giant.”

Though Porta had molded together the three basic elements that are essential to a modern concept of polyalphabeticity, refinements were always possible, and two other men of the 16th century devised improvements upon Belaso’s key procedure.

It is clear that a key that changes with each message provides more security than one that is used over and over for several messages. The ultimate, of course, is a key that changes with each message. The two men devised an exceedingly clever way to ensure this change: use the message itself as its own key. This is called an “autokey.” The first system was flawed and consequently unusable; the inventor is remembered chiefly for a contribution to steganography. The second worked perfectly. But though it afforded guarantees of security far above those of simple keywords, and though the author described it with clarity, and though his book is one of the most famous in cryptology, the system fell into utter oblivion and its inventor owes his fame to a crude and degenerate form of polyalphabetic substitution with which he had nothing to do and which he would have spurned.

The inventor of the first and imperfect autokey system was Girolamo Cardano, a Milanese physician and mathematician who is known today chiefly as one of the first popularizers of science and as author of the world’s first text on the theory of probability.

Born in 1501, Cardano had an overwhelming desire simply to be remembered—not even caring whether the memory was of good or of ill. He tried to assure himself a place in posterity by a stupendous volume of writing. In the 131 books that he published during his lifetime and the 111 that he left behind in manuscript, he discussed mathematics, astronomy, astrology, physics, chess, gambling (which included his pioneering investigation of probability), the immortality of the soul, consolation, marvelous cures, dialectics, death, Nero, gems and colors, the zeal of Socrates, poisons, air, water, nourishment, dreams, urine, teeth, music, morals, and wisdom. Somehow he did not give cryptology a book of its own, but inserted his information in his two best-selling popularizations of science. The first was De Subtilitate, a collection of illustrations and attempted explanations of scientific phenomena that included such topics as suggestions for teaching the blind to read and write by touch. Published in 1550, De Subtilitate embodied both the soundest physical learning of its time and its most advanced spirit of speculation. The public liked Cardano’s anecdotal exposition and his bizarre illustrations so much that he followed it six years later with a sort of continuation entitled De Rerum Varietate. Both books were translated and pirated by printers throughout Europe.

In his two discussions of cryptology, Cardano described the classic methods of antiquity, attempted a classification which leads to an unfortunate self-contradiction, gave directions for surreptitiously opening letters, laid down some elementary rules for solving messages and for developing secret ink, and offered a few methods of his own, accompanied by the usual laud: “In the case of the methods that we give, [cryptanalysis] would require an Apollo.” One of these is his autokey.

He employed the plaintext as a key to encipher itself, starting the key over from the beginning with each new plaintext word:

But while the autokey was a brilliant idea, Cardano formulated it defectively. First, it allows plural decipherments. With Cardano’s (standard) alphabets, cipher N could stand for a plaintext f keyed with an F as well as for plaintext s and key S. Second, and worse, the decipherer is in exactly the same position as the cryptanalyst in trying to figure out the first plaintext word. This, once obtained, unlocks the rest of the message.{12} Consequently this formulation has been justly neglected, and the immortality that Cardano so desperately sought he achieved in cryptology with a system of steganography, which bears his name.

The Cardano grille consists of a sheet of stiff material, such as cardboard, parchment, or metal, into which rectangular holes, the height of a line of writing and of varying lengths, are cut at irregular intervals. The encipherer lays this mask over a sheet of writing paper and writes the secret message through the perforations, some of which will take a whole word, others a single letter, others a syllable. He then removes the grille and fills in the remaining spaces with an innocuous-sounding cover message. Cardano prescribed copying the message three times to smooth out any irregularities in the writing that might give the secret away. The decipherer simply places his grille on the message he receives and reads the hidden text through the “windows.” The method’s chief defect, of course, is that awkwardness in phrasing may betray the very secret that that phrasing should guard: the existence of a hidden message. Nevertheless, a number of countries made use of the Cardano grille in their diplomatic correspondence in the 1500s and 1600s.

Cardano also achieved the dubious renown of being the first cryptologist to cite the enormous number of variations inherent in a cryptographic system as “proof” of the impossibility of a cryptanalyst’s ever reaching a solution during his lifetime. After describing a monalphabetic substitution in which the 27 permutations of three-letter groups (AAA, AAB, AAC, ABA, … CCC) stand for the 24 letters of the alphabet and three common words, he stated: “The [number of possible] arrangements of alphabets will require 28 digits” and “such a number of arrangements could not be contained in many books.” He meant that the number of ways in which the 27 plaintext elements could be mated to possible ciphertext equivalents in trial solutions would require 28 digits to write out. As a matter of fact, it would require 29 digits, since the number of combinations is:

27 × 26 × 25 × … × 2 × 1, or 10,888,869,450,418,352,160,768,000,000. Cardano heads a long line of cryptographers in erroneously placing cryptographic faith in large numbers—a line that stretches right down to today. His own example refutes his argument. Cryptanalysts do not solve monoalpha-betics—or any ciphers for that matter—by testing one key after another. With a 26-letter alphabet, 26 × 25 × … × 1, or 403,291,461,126,605,635,584,000,000, different cipher alphabets are possible. If the cryptanalyst tried one of these every second, he would need six quintillion years, or longer than the known universe has been in existence, to run through them all. Yet most monoalphabetics are solved in a matter of minutes.

The comedy of errors and neglect that constitutes so much of the historiography of cryptology reached a climax of irony when it came to the inventor of the second and acceptable autokey system. It ignored this important contribution and instead named a regressive and elementary cipher for him though he had nothing to do with it. And so strong is the grip of tradition that, despite modern scholarship, the name of Blaise de Vigenère remains firmly attached to what has become the archetypal system of polyalphabetic substitution and probably the most famous cipher system of all time.

Vigenère was not a nobleman. The “de” in his name simply indicates that his family came from the village of Vigenère or Viginaire. He himself was born in the village of Saint-Pouçrain, about halfway between Paris and Marseilles, on April 5, 1523. At 17, he was taken from his studies and sent to court and, five years later, to the Diet of Worms as a very junior secretary. This gave him his initiation into diplomacy, and his subsequent travels through Europe broadened his experience. At 24, he entered the service of the Duke of Nevers, to whose house he remained attached the rest of his life, except for periods at court and as a diplomat. In 1549, at 26, he went to Rome on a two-year diplomatic mission.

It was here that he was first thrown into contact with cryptology, and he seems to have steeped himself in it. He read the books of Trithemius, Belaso, Cardano, and Porta, and the unpublished manuscript of Alberti. He evidently conversed with the experts of the papal curia, for he tells anecdotes that he could have heard only in the shoptalk of these cryptologists. There was, for example, the one about the fellow who was not at all embarrassed to ask the Cardinal du Bellay to give him the enormous sum of 2,000 écus for a cipher he had devised—but was redfaced to learn that his system had been solved in less than three hours. Vigenère left the court at 39 to pursue his interrupted studies, but in 1566 he was sent again to Rome as secretary to King Charles IX. Here he renewed his acquaintance with the cryptologic experts, and this time he appears to have been admitted to their secret chambers, for it is he who reports having seen the Great Vicar of St. Peter solve a Turkish cryptogram in six hours. Finally, in 1570, at 47, Vigenère quit the court for good, turned over his annuity of 1,000 livres a year to the poor of Paris, married the much younger Marie Varé, and devoted himself to his writing.

He turned out some 20-odd books before he died of a throat cancer in 1596. Most of his translations and historical works have fallen into oblivion, though his Traicté des Comètes has been credited with helping to destroy the superstition that comets are fireballs flung by an angry God to warn a wicked world. But the book which is constantly cited by workers in its field is his Traicté des Chiffres, which was written in 1585 despite the distraction of a year-old baby daughter and which appeared, elegantly rubricated, in 1586, and was reprinted the following year.

It is a curious work. In its more than 600 pages, it distilled not only much of the cryptologic lore of Vigenère’s day (with the major exception of crypt-analysis, which he called, in a quaint phrase, “un inestimable rompement de cerveau”—“a worthless cracking of the brain”), but a hodgepodge of other topics. It contained the first European representation of Japanese ideograms. It digressed into the foundations of alchemy, licit and illicit magic, the secrets of the kabbalah, the mysteries of the universe, recipes for making gold, and philosophic speculations. “All the things in the world constitute a cipher,” its author declared. “All nature is merely a cipher and a secret writing. The great name and essence of God and his wonders, the very deeds, projects, words, actions, and demeanor of mankind—what are they for the most part but a cipher?” And so on. There may be some allegorical truth to this—Pascal himself was to say that the Old Testament was a cipher—but it hardly advanced the science of cryptology.

Despite these ramblings, the Traicté is reliable in its cryptologic information. Vigenère was scrupulous in assigning credit for material from other authors, and he quoted them accurately and with comprehension. He relished a good story, such as the one about the practical joke played on one Paulo Pancatuccio. Pancatuccio, Vigenère said, had been employed by the pope to solve documents in cipher, “in which in truth he was fairly well versed, and performed several minor miracles of the lesser kind.” Certain “bons compagnons,” wishing to humble his pride, contrived to have a letter in cipher, marked “most important,” fall into Pancatuccio’s hands. The opening words were in a very simple transposition cipher, and Pancatuccio solved it readily, only to read: “O poor wretched slave that you are to your decipherments, on which you waste all your oil and your pains, what does it profit you to eat out your heart in the quest of these vain curiosities, presuming by your laborious researches to be able to attain to the discovery of the secrets of others, which are reserved to God alone?” More in the same vein followed, ending with a challenge to see if Pancatuccio could get at the meaning of “one little letter” of the succeeding message. It was written in a complicated cipher; Vigenère thoroughly described it, but never said whether the indignant Pancatuccio even bothered to try solving it.

Among the numerous ciphers that Vigenère discussed (such as concealing a message in a picture of a field of stars) were polyalphabetics. Each of his used a Trithemius-like tableau, though Vigenère provided for mixed alphabets at the top and the side. He listed a variety of key methods: words, phrases, lines of poetry, the date of the dispatch, progressive use of all the alphabets. He then put forth his autokey system. Like Cardano’s, it used the plaintext as the key. But it perfected Cardano’s in two ways. First, it provided a priming key. This consisted of a single letter, known to both encipherer and decipherer, with which the decipherer could decipher the first cryptogram letter and so get a start on his work. With this, he would get the first plaintext letter, then use this as the key to decipher the second cryptogram letter, use that plaintext as the key to decipher the third cryptogram letter, and so on. Secondly, Vigenère, unlike Cardano, did not recommence his key with each plaintext word, which is a weakness, but kept it running continuously.

The system works well and affords fair guarantees of security; it has been embodied in a number of modern cipher machines.

Vigenère also described a second autokey in which the cryptogram itself serves as the key after a priming key:

This has the advantage of being an incoherent key but has the great disadvantage of leaving the key in full view of the cryptanalyst.

In spite of Vigenère’s clear exposition of his devices, both were entirely forgotten and only entered the stream of cryptology late in the 19th century after they were reinvented. Writers on cryptology then added insult to injury by degrading Vigenère’s system into one much more elementary.

The cipher now universally called the Vigenère employs only standard alphabets and a short repeating keyword—a system far more susceptible to solution than Vigenère’s autokey. Its tableau consists of a modern tabula recta: 26 standard horizontal alphabets, each slid one space to the left of the one above. These are the cipher alphabets. A normal alphabet for the plaintext stands at the top. Another normal alphabet, which merely repeats the initial letters of the horizontal ciphertext alphabets, runs down the left side. This is the key alphabet. Both correspondents must know the keyword. The encipherer repeats this above the plaintext letters until each one has a keyletter. He seeks the plaintext letter in the top alphabet and the key-letter in the side. Then he traces down from the top and in from the side. The ciphertext letter stands at the intersection of the column and the row. The encipherer repeats this process with all the letters of the plaintext. To decipher, the clerk begins with the keyletter, runs in along the ciphertext alphabet until he strikes the cipher letter, then follows the column of letters upward until he emerges at the plaintext letter at the top. For example:

This system is clearly more susceptible to solution than Vigenère’s original. Nevertheless, a legend grew up that this degenerate form of Vigenère’s work was the indecipherable cipher par excellence, a legend so hardy that as late as 1917, more than half a century after it had been exploded, the Vigenère was being touted as “impossible of translation” in a journal as respected as Scientific American!

The cryptanalysts of the time did not create the legend. They knew very well that the cipher was not “impossible of translation”—because they themselves had occasionally translated it. “I may at this point mention,” wrote Porta, “a letter of this sort sent me a while ago by a dabbler in ciphers who lived at Rome. To his surprise, I interpreted it within the very hour I received it—because the key of the message was the proverb OMNIA VINCIT AMOR, which is familiar to almost everybody.” And Giovanni Batista Argenti noted under a Porta-like cipher in his book of cipher keys:

Qaetepeeeacszmddfictzadqgbpleaqtacui.

(In principio erat) such is the motto or key{13} with which the Illustrious and Excellent Signor Iacomo Boncampagni [nephew of Pope Gregory XIII], Duke of Sora, my patron, wrote the above line in cipher and gave it to me Sunday 8 October 1581 in the Tusculana villa, telling me that it was not possible to find it out, and I quickly found out the countercipher which was of 10 alphabets and the motto. The line written above means and is this:

Arma virumque cano troie qui primus ab oris.

Matteo Argenti also boasted of solving a test polyalphabetic, but he may simply have been claiming his uncle’s success as his own.

The modern Vigenère tableau

Both the Porta and the Argenti solutions owe their success to the easily guessable nature of their keys—a common proverb in one, the first words of the Gospel of St. John in the other. The Argenti solution was further simplified by a plaintext consisting of the first line of Vergil’s Aeneid. Even without these aids, polyalphabetics might occasionally have been solved if several other conditions obtained: if the cryptograms retained original word divisions, if the cipher alphabets were normal, and if the cryptanalyst recognized that keys repeat. He could then guess at words in the plaintext and recover part of the key that would have been used; if it made sense, he would try to guess the rest of it or, failing that, try to decipher other portions of the cryptogram. Such hit-or-miss solutions were not entirely beyond the reach of the Renaissance. Porta recognized key repetition in his artificial solution: “I conclude that the key has been given three times and decide correctly that it consists of 17 letters.” And Vigenère hints at such knowledge when he comments that “the longer the key is, the more difficult it is to solve the cipher.”

Yet the mere elimination of word divisions would greatly reduce the possibility of striking the right plaintext, and simply mixing the cipher alphabets would deny the Renaissance cryptanalyst any opportunity whatever for solution. The cryptographers of the time ran words together as standard practice, and they knew of techniques for mixing alphabets. Hence they had the power to make polyalphabetics unbreakable to their contemporaries. This explains Matteo’s paean: “The key cipher is the noblest and the greatest in the world, the most secure and faithful that never was there man who could find it out.”

Why, then, did the nomenclator reign supreme for 300 years after Porta? Why did cryptographers not use this “noblest” and “most secure” cipher instead?

Apparently because they disliked its slowness and distrusted its accuracy. Encipherment in a polyalphabetic system, with its need to keep track of which alphabet was in use at every point and to make sure that the ciphertext letter was taken from that alphabet, could not compare in speed with a nomenclator encipherment. A former ambassador of Louis XIV, François de Callières, declared in 1716 in his classic manual of diplomacy, De la Manière de Negocier avec les Souveraens, that unbreakability could be attained by “an infinite number of different keys” based upon “a general Model.” “I do not speak,” he added, in an apparent reference to polyalphabetics, “of certain ciphers, invented by professors in a University and upon rules of Algebra or Arithmetick; which are impractical by reason of their too great Length, and of the Difficulties in using them; but of common Cyphers which all Ministers make use of, and with which one may write a Dispatch almost as fast as with ordinary Letters.” The well-informed author of an anonymous 17th-century “Traitté de I’art de deschiffrer” in the Royal Archives at Brussels stated that chancelleries do not use polyalphabetics because it takes too long to encipher them and because the dropping of a single ciphertext letter garbles the message from that point on. In 1819, William Blair, in a superb encyclopedia article on cryptology, likewise argued that polyalphabetic substitution “requires too much time” and that “by the least mistake in writing is so confounded, that the confederate with his key shall never set it in order again.”

One might think that cipher clerks might have corrected such garbles by trial and error, especially in those more leisurely days. But they were not cryptanalysts and may not have known, or have wanted to know, how to make the necessary trials. Serious garbles would thus render the dispatch unreadable until a courier went out and returned with a correction; thus the cipher would have prevented communication instead of safeguarding it. Garbles of just this type, so bad that messages could not be read, compelled two highly intelligent Americans, both Framers of the Constitution, to abandon the use of a polyalphabetic system.

Although a lack of speed and a proneness to error kept polyalphabetics from supplanting the nomenclator, they cropped up now and again. The author of the “Traitté” says that they were used in Holland from time to time. On October 12, 1601, the Jesuits sent a numerical polyalphabetic with keyword CUMBRE to Peru for communications with Rome. And, despite the myth of their unbreakability, polyalphabetics were broken occasionally. The Argentis, who would not use them for regular traffic, sometimes gave them to cardinals for personal use. One such was the “cifra con mons. revmo Panicarola apresso l’illmo signor [Enrico] cardinal Caetano legato in Francia, 3 Ottobre 1589. ” Pope Sixtus V had dispatched Caetano to France to further Holy League efforts against Henry IV. The cipher’s first two alphabets, with their key letters at left, were:

The Argentis made its two keys prudently long (FUNDAMENTA EIUS IN MONTIBIS SANCTIS and GLORIOSA DICENTUR DE TE QUIA POTENTER AGIS), assigned K, X, and Y as nulls, and attached a small nomenclator of letters with dots, macrons, or circumflexes over them. They had considered giving Panicarola a polyalphabetic whose alphabets included the ten digits and so might be considered mixed, but instead settled on this normal-alphabet one—“easier and more secure,” they said.

It was the cipher’s undoing. The curia used it to tell Caetano in the middle of the following year that Sixtus had died—obviously news of the greatest importance. One of Henry’s Huguenot commanders, chronicling the interception of the messages, wrote that “because the letters were in double cipher{14} and very difficult, it was necessary to put them in the hands of Chorrin, who disentangled all that had stopped the others and in his time has not had his equal in this perfection.” Chorrin, who was a contemporary of Viète and who, from this feat alone, would appear to be his equal in ability if not in fame, also solved some other letetrs for Henry’s minister of finance, Sully.

At about the same time, the cipherers of Elizabethan England set sail upon the uncharted seas of polyalphabeticity with Drake-like daring. They employed a Porta-like tableau to correspond with several envoys, and a Vigenère for a Mr. Asheley. Another system comprises the oldest device of its type in the world. It consists of a vertical strip of stout cardboard on which is written a normal plaintext alphabet. Slits were cut in the cardboard down both sides of the alphabet, and through these slits was inserted a sheet of paper on which ten different cipher alphabets were vertically inscribed. The paper could be moved through the slits so as to bring the desired cipher alphabets against the plaintext one. This facilitated the reading of ciphertext equivalents.

Writers on cryptology in the 1600s occasionally referred to the solution of polyalphabetics. They did so in vague terms, probably reflecting their own indefinite thinking and the loss of knowledge that let the myth of unbreakability take root. Thus Antonio Maria Cospi, secretary to the grand duke of Tuscany, mentioned in his 1639 La interpretazione delle cifre “two kinds of ciphers, some simple and some composite … the latter practically impossible to discover and decipher.” And later he wrote that “The present method may not be at all useless for the interpretation of the more difficult simple ciphers … no more than for that of double and composite ciphers.” The author of the Brussels “Traitté,” who demonstrated his capability when he solved a French royal cipher for Spain in 1676, floundered when he came to polyalphabeticity. He could only suggest the almost useless technique of trying one probable plaintext letter after another until a coherent combination appeared in the key he derived. Understandably, he did not illustrate his protracted method; the number of combinations is so great that he would be at it yet. His failure contrasts markedly with the technical mastery displayed in the rest of the treatise.

The time and place of the writing of that “Traitté,” the author’s failure with polyalphabeticity, and his allegiance to Spain make it probable that he was a cryptanalyst named Martin, who figured in an incident that shows how rare and fortuitous was the solution of a polyalphabetic. The Cardinal de Retz, that liberal and popular French prelate-politician, narrated in his Mémoires how he escaped from the chateau of Nantes on August 8, 1654, after two years of political imprisonment. He digressed to discuss ciphers:

I had one with Madame La Palatine, which we called The Indecipherable, because it always seemed to us that no one could penetrate it without knowing the word that had been agreed upon. We placed such complete confidence in it that we never hesitated to write freely and to send the most important and the most confidential secrets by ordinary courier. It was in this cipher that I wrote to the Premier President [of the Parlement of Paris] that I would escape on August 8 … The Prince [of Condé], who had one of the best decipherers in the world, named, it seems to me, Martin, held this cipher six weeks with me in Brussels.{15} And he told me that Martin had confessed to him that it was indecipherable…. It was broken down sometime afterwards by [Guy] Joly [a counselor to the Châtelet tribunal in Paris and one of Retz’s followers], who, though not a professional decipherer, hit upon its key while reflecting on it and brought it to me at Utrecht, where I was at the time.

Retz was trying to show “how little confidence one can place in ciphers,” but the fact that it took a lucky guess by an intimate to effect the only solution in six years seems rather to enhance the cipher’s value.

The most interesting polyalphabetic solution of the nomenclator years came a century later. Its interest derives from a cryptanalyst who has become a very prototype in a field utterly removed from cryptanalysis, and whose obsession with that field was such that he even turned cryptanalysis to account in it.

It all happened in 1757, when he was talking about magic, alchemy, and chemistry with his friend, the wealthy Madame d’Urfé. She showed him a cipher manuscript describing the transmutation of baser metals into gold, and told him that she did not need to keep it locked up because she alone held the key. She gave it to him, remarking that she did not believe in cryptanalysis. “Five or six weeks later,” he stated in his memoirs, “she asked me if I had deciphered the manuscript which had the transmutation procedure. I told her that I had.” But Madame d’Urfé, still skeptical, replied:

“Without the key, sir, excuse me if I believe the thing impossible.”

“Do you wish me to name your key, madame?”

“If you please.”

I then told her the word, which belonged to no language, and I saw her surprise. She told me that it was impossible, for she believed herself the only possessor of that word which she kept in her memory and which she had never written down.

I could have told her the truth—that the same calculation which had served me for deciphering the manuscript had enabled me to learn the word—but on a caprice it struck me to tell her that a genie had revealed it to me. This false disclosure fettered Madame d’Urfé to me. That day I became the master of her soul, and I abused my power. Every time I think of it, I am distressed and ashamed, and I do penance now in the obligation under which I place myself of telling the truth in writing my memoirs.

But this did not stop him at the time from amazing the lady with some hocus-pocus in producing the keyword (NABUCODONOSOR, an Italian spelling of “Nebuchadnezzar”), and then taking his leave “bearing with me her soul, her heart, her wits and all the good sense that she had left.”

The cryptanalyst? Casanova.

Less dramatic solutions of polyalphabetics occurred early in the 1800s before a retired German infantry major published the general solution in 1863. It may seem that so many solutions should have dispelled the myth of polyalphabetic unbreakability. But they were isolated instances, scores of years apart, so unusual that standard works on cryptology do not mention them. Polyalphabetics remained freaks of cryptologic usage. The professionals avoided them. Their very unpopularity protected them. Had they been used more, perhaps the coincidences that lit the way to the general solution would have forced themselves upon cryptologists. But the world fixated upon the nomenclator, and so the legend of unbreakability flourished.

It was fed by the lesser writings of the time. These books shed no new light on polyalphabetics and none on the political cryptology of their day. They are divorced from the realities, and generally content themselves with commentaries on earlier works, chiefly Trithemius, and with describing a few trivial inventions. Neglect justly entombs most. A few are of minor interest.

The Florentine Jacopo Silvestri published the second printed book on cryptology at Rome in 1526. His Opus novum … begins with a Dantesque scene of the author fleeing the plague at Rome to a small country estate near the Tiber. There he received a visit from an Etruscan friend, who, discoursing with him on ancient modes of writing, discussed cryptology. Silvestri’s friend begged him to write down his knowledge of it for universal advantage. But most of the 88 pages of the Opus novum are merely given over to a vocabulary that can serve as the basis for a small code.

In 1624, Augustus II, Duke of Braunschweig-Lüneberg (afterwards Hanover) in Germany, issued his Cryptomenytices et Cryptographiae libri IX under the pseudonym Gustavus Selenus. This was a play on his name, GUSTAVUS being an anagram (with the interchangeable u and v of the time) of Augustus, and Selene, the Greek goddess of the moon, which is “luna” in Latin, standing for Lüneberg. The duke, who was cousin to the grandfather of George I of England, is probably the highest ranking author of a book on cryptology; both he and the present queen of England descend from Ernest the Confessor, of the house of Guelph. He prefaced the almost 500 small-folio pages of his volume with 17 pages of tributes from his courtiers (“As, what night in dusty cloak conceals, bright Cynthia soon with torch full-flaming shows,/So, too, Gustavus now, Selenus called, uncovers things that time has long in shadow held”). One such, a particularly laudatory one entitled a “Sportive Poem,” was contributed to this volume of the supposedly unknown Selenus by none other than the gracious Duke Augustus himself! But the work, while containing some cipher systems, mainly defends the occultism of Trithemius.

The most celebrated scholar of his day, the Jesuit Athanasius Kircher, who had won fame by his “solution” of hieroglyphics and by his having been lowered into the crater of Vesuvius to study underground forces (a feat that, with a book on the subterranean world, won him the title of Father of Vulcanology), published his Polygraphia nova et universalis at Rome in 1663. The book contains chiefly processes of encipherment, as well as a multilingual, cross-indexed code which is one of the earliest essays at a universal language. Two years later, his student, Gaspar Schott, a Jesuit physicist, brought out Schola steganographia at Nuremberg. Schott’s book, like his teacher’s, is largely a compilation of cipher systems.

Only two English works of the period merit attention. The first book in English on cryptology appeared anonymously in 1641, but Mercury, or the Secret and Swift Messenger was the offspring of John Wilkins, a “lustie, strong growne … broad shouldered” young chaplain who later married Oliver Cromwell’s sister and became Bishop of Chester and a founder and first secretary of the Royal Society. A succinct volume, very well grounded in the classics, Mercury introduced the words cryptographia (defined by Wilkins as “secrecy in writing”) and cryptologia (“secrecy in speech”) into English. The author reserved the term cryptomeneses, or “private intimations,” for the art of secret communication in general. In addition to summing up the knowledge of the time, Wilkins depicted three kinds of geometrical cipher, a mystifying system in which a message is represented by dots, lines, or triangles. The letters of the alphabet, in normal or mixed order, were written out at known spatial intervals; this served as the key. This line of letters was held at the top of a sheet of paper, and the message was spelled out by marking a dot for each plaintext letter underneath that letter in the key alphabet, each dot lower than its predecessor. The dots could then be connected by twos to form lines, by threes to form triangles, or all together to form what would look like a graph—or they could be left as dots. The receiver, who had an identically proportioned key, noted the positions of the dots, the ends of the lines, or the apexes of the triangles against the alphabetical scale to read the plaintext.

The second English book on the subject excelled. Cryptomenytices Patefacta was written by John Falconer, about whom nothing is known except that he was a distant relative of the Scottish philosopher David Hume, was reportedly entrusted with the private cipher of the future King James II, and died in France while following James into temporary exile there. The book came out posthumously in 1685, with its author listed only as “J.F.” It proved so popular that it was reissued in 1692 with a new title page that clearly indicates just what its 180 pages comprise: Rules for Explaining and Decyphering all Manner of Secret Writing….

Falconer’s cryptanalytical bias sharpened his comments on the standard systems, and led him to make a praiseworthy assault on that old bugbear, polyalphabetic substitution. He suggested guessing at the short words in a cryptogram, deducing the keyletters (these were standard alphabets), and seeing whether “they can be joyned to make up part of the Key.” Knowing the number of letters in the key is a great help, he says, “since thereby you have the several Returns of each Alphabet.” The technique is quite valid for cryptograms with word divisions, and bespeaks an acute mind. Falconer also gave what seems to be the earliest illustration of keyed columnar transposition, a cipher that is today the primary and most widely used transposition cipher, having served (with modifications) for French military ciphers, Japanese diplomatic superencipherments, and Soviet spy ciphers.

These five books, plus the even less important ones that were also published at this period, have—with the possible exception of Falconer’s—a certain air of unreality about them. There is good reason for this. The authors borrowed their knowledge from earlier volumes and puffed it out with their own hypothesizing, which seems never to have been deflated by contact with the bruising actuality of solving cryptograms that they themselves had not made up. The literature of cryptology was all theory and no practice. The authors did not know the real cryptology that was being practiced in locked rooms here and there throughout Europe, by uncommunicative men working stealthily to further the grand designs of state.

5. The Era of the Black Chambers

RÉALMONT was under siege. The royal army, under Henry II of Bourbon, Prince of Condé, had invested it at dawn Wednesday, April 19, 1628. But the Huguenots, inside the battlements of the little town in southern France, were putting up a stiff defense. They cannonaded Condé from a tower and contemptuously rejected his demands that they surrender, saying that they would die instead. Condé brought up five big cannon from Albi, a dozen miles away, and on Sunday ranged them in an ominous line facing Réalmont.

That same day his soldiers captured an inhabitant of the town who was trying to carry an enciphered message to Huguenot forces outside. None of Condé’s men could unriddle it, but during the week the prince learned that it might be solved by the scion of a leading family of Albi who was known to have an interest in ciphers.

Condé sent him the cryptogram. The young man solved it on the spot. It revealed that the Huguenots desperately needed munitions and that, if they were not supplied, they would have to yield. This was news indeed, for despite the destruction of a number of houses by the Catholic batteries, the town was continuing to resist stoutly with no sign of surrender. Condé returned the cryptogram to the inhabitants, and on Sunday, April 30, 1628, though its fortifications were still unbreached and its defenses still apparently adequate for a long siege, Réalmont suddenly and unexpectedly capitulated. With this dramatic success began the career of the man who was to become France’s first full-time cryptologist: the great Antoine Rossignol.

When word of the incident reached Cardinal Richelieu, the astute and able Gray Eminence of France, he at once attached this useful talent to his suite. Rossignol proved his worth almost immediately. The Catholic armies under Richelieu surrounding the chief Huguenot bastion of La Rochelle intercepted some letters in cipher, which the young codebreaker of Albi read with ease. He told His Eminence that the starving citizens were eagerly awaiting help that the English had promised to send by sea. When the fleet arrived, the primed guardships and forts so intimidated it that it stood off the port’s entrance and made no serious attempt to force a passage. A month later, the city capitulated in full sight of the English vessels—and the great French tradition of expertise in cryptology had been founded.

Rossignol very quickly established himself in the royal service. By 1630, his solutions had made him rich enough to build a small but elegant chateau at Juvisy, 12 miles south of Paris, later surrounding it with a charming informal garden designed by Le Nôtre, the gardener of Versailles. Here Louis XIII stopped to visit the young cryptanalyst in 1634, 1635 and 1636 on his returns to Paris from Fontainebleau.

In the swashbuckling court of that monarch, and then in the resplendent one of Louis XIV, Rossignol served with an extraordinary facility. The stronghold of Hesdin surrendered a week sooner than it otherwise would have because he solved an enciphered plea for help, and then composed a reply in the same cipher telling the townspeople how futile their hopes were. How many other towns he compelled to surrender, how many diplomatic coups he made possible, how many betrayals he uncovered among the great nobles in those days of shifting allegiances, he never discussed. This reticence caused some at the court to charge that he never actually solved a single cipher, and that the cardinal spread inflated rumors about his abilities to discourage would-be conspirators. But in fact Richelieu was frequently telling his subordinates such things as, “It is necessary to make use, in my opinion, of the letters of the man who has been arrested by the civil authorities at Mézières, that is to say, have them put into Rossignol’s hands to see if there is something important in them.” Or, eight years later, in 1642, writing to Messieurs de Noyers and de Chavigny: “I saw, in some extracts, that Rossignol sent me, a truce negotiation of the King of England with the Prince of Orange; I do not think that it can have any effect, but … it is up to you, gentlemen, to keep your eyes peeled.”

Louis XIII, on his deathbed, recommended Rossignol to his queen as one of the men most necessary to the good of the state. Two years later, on February 18, 1645, Richelieu’s successor, Cardinal Mazarin, named him a master of the Chamber of Accounts and a counselor of state. Like Richelieu, Mazarin himself sometimes sent him intercepts. In 1656, for example, he forwarded a letter of the Cardinal de Retz instructing Rossignol to solve it. Under Louis XIV, Rossignol often worked in a room next to the king’s study at Versailles. From here issued the streams of solutions that helped the Sun King direct the polity of France.

Rossignol had, at 45, improved his social position by marrying 23-year-old Catherine Quentin, the daughter of a nobleman and the niece of a bishop. Their marriage was a happy one, full of playfulness and endearments, and they had two children, Bonaventure and Marie.

One of their best friends was the poet Boisrobert, who originated the idea of the Académie Française. He loved to hold forth at the excellent Rossignol table, which he liked for its fine wines and Madame Rossignol’s charm as a hostess. (In a 13-line poem to her, he declared her friendship “sweeter than sugar with cream.”) When he found himself out of favor at court, he complained about his unhappiness in a poem to his influential cryptologist-friend. Rossignol showed it to Mazarin, who singled out Boisrobert at the next audience and praised the poem loudly. Boisrobert, delighted at this sign of favor, addressed a paean of thanks to Rossignol. Perhaps out of gratitude, he later praised him extravagantly in the first poem ever written to a cryptologist. Some of the choicer of the 66 lines of the untitled Épistre 29 in his Épistres en Vers read:

II n’est plus rien dessous les Cieux
Qu’on puisse cacher à tes yeux;
Et crois que ces yeux de Lyncée{16}
Lisent mesme dans la pensée.
Que ton service
est éclatant
Et que ton Art est important!
On gagne par luy des Provinces,
On sçait tous les secrets des Princes,
Et par luy, sans beaucoup d’efforts,
On prend les
villes & les forts.

Certes j’ignore ton adresse,
Je ne comprends point la finesse
De ton secret; mais je sçay bien
Qu’il t’a donné beaucoup de bien;
Tu le mérites, & je gage
Qu’il t’en
donnera davantage;
Tousjours fortune te rira,
Et, tant que guerre durera,
Bellone{17} exaltera tes Chittres
Parmy les tambours & les fiffres.

31 There’s not a thing beneath the skies;
That can be hidden from thine eyes;
Those Lynceus eyes, which, I believe,
Our most internal thoughts perceive.

35 How marvelous thy skill, and bright,
And how important thine art’s might!
For with it provinces are gained,
All princes’ secrets ascertained,
And by it, with an effort small,

40 Are towns and forts compelled to fall.

57 Indeed, thy art’s beyond my ken
And 1 shall never comprehend
secret; but I now can tell

60 That it hath served thee very well.
Thou dost deserve it. Have no fears—
Thy skill shall prosper thee for years.
Too, Fortune will upon thee smile
, And long as wars the land defile

65 Bellona shall, in strife to come,
Thy cipher praise, ‘midst fife and drum.

Rossignol’s work gave him access to some of the greatest secrets of the state and the court, and consequently made him a figure of some prominence in the glittering court of Louis XIV. He appears in some of the major memoirs of that period. Tallement des Réaux tells some unflattering stories about him and calls him “a poor species of man” in his Historiettes. But the Duke of Saint-Simon, whose Mémoires are a monument of French literature, wrote that Rossignol was “the most skillful decipherer of Europe…. No cipher escaped him; there were many which he read right away. This gave him many intimacies with the king, and made him an important man.” Rossignol also became the first person to have his biography written solely because of his cryptologic abilities. Charles Perrault, who is better known as the formulator of the Mother Goose tales, included a two-page sketch of Rossignol’s life, complete with engraved portrait, in his “Illustrious Men Who Have Appeared in France During This Century,” in the company of such as Richelieu. Mazarin regarded his good will as important enough to write a letter of regret in 1658 for some injury done to Rossignol at Paris—and to follow it up two months later with a note to a court official pressing him to do justice to the cryptanalyst “for the insult and violence that has been done him.” A more particular sign of importance appears in the largesse that the king showered upon him: 14,000 écus in 1653, 150,000 livres in 1672, and an annuity, late in his life, of 12,000—to name just some of his payments.{18}

All the power, wealth, flattery, and royal favor that came to Rossignol at court quite turned his small-town head. To pace the galleries of the Louvre with haughty dukes and princes of France, to wear rich lace-trimmed coats with enormous cuffs, and stockings of whitest silk, to play at that new game, billiards, with the king himself—and to have this publicized in an engraving—to run up bills at the wigmaker’s, to learn before the rest of the world did who had become the king’s new mistress, best of all, to return home to Albi exuding the aura of the court. “Monseigneur,” he gloated one day to Richelieu about his former neighbors, “they do not dare to approach me. They regard me as a favorite—me, who lives with them just as before. They are amazed at my civility.” Richelieu could only shrug his shoulders.

Nevertheless, Rossignol’s abilities were undeniable. And they served France not only in cryptanalysis but in cryptography, where they wrought the most important technical improvement that nomenclators underwent in their 400-year reign.

When Rossignol began his career, nomenclators listed both their plain and code elements in alphabetical order (or alphabetical and numerical order, if the code was numerical). Plain and code paralleled one another. This relatively simple arrangement had existed since nomenclators emerged during the early Renaissance. The only deviation occurred in occasional small nomenclators when short lists of names were written down haphazardly; the code elements, however, always ascended in alphabetical order. Rossignol must have soon observed in his cryptanalyses that parallelism of plain and code assisted him in recovering plaintext. If, for example, he ascertained in an English dispatch that 137 stood fox for and 168 for in, he would know that 21 could not represent to because codenumbers for words beginning with t would have to stand higher than those for words beginning with i. Moreover, he would know that the codenumber for from, which comes alphabetically between for and in, would have to fall between their codenumbers 137 and 168, and he could search accordingly.

From here, it was a simple step to depriving other cryptanalysts of such clues by destroying the parallel arrangement. This he did, mixing the code elements relative to the plain. Two lists were now required, one in which the plain elements were in alphabetical order and the code elements randomized, and one to facilitate decoding in which the code elements stood in alphabetical or numerical order while their plain equivalents were disarranged. These two lists soon came to be called “tables à déchiffrer” and “tables à déchiffrer,” and the mixed type of nomenclator became a “two-part” nomenclator to contrast it with the older “one-part” type. The two-part nomenclator has been compared to a bilingual dictionary. In the first half, the native words are listed alphabetically and the foreign appear in mixed order; in the second half, the foreign words progress alphabetically and the native words are jumbled.

This innovation apparently began to go into service about the middle of Rossignol’s stewardship. Circumstances probably deserve most of the credit for his getting the idea first. At that time, other countries employed different people for making nomenclators and for breaking them. The cryptanalysts were called in only when needed; clerks compiled the nomenclators. France alone was rich and active enough to need and support a full-time cryptanalyst, who could also apply his knowledge to improving France’s secret communications.

The two-part construction spread rapidly to other countries. At the same time, nomenclators continued to grow. The greater the size the greater the security, for it meant just that many more elements that the cryptanalyst had to recover. By the 1700s some nomenclators ran to 2,000 or 3,000 elements. But these were very expensive to compile in two-part form, and so, for reasons of economy and to the detriment of security, some nomenclators regressed to a modified two-part form. The code elements paralleled the plain in segments of a few dozen groups, but the segments themselves were in mixed order. For example, a Spanish nomenclator, a cifra general of 1677, has the syllables from bal to ble represented by the numbers from 131 to 149, but bli, following ble, is encoded by 322. This series continues to Bigueras at 343, while 150 reappears farther down the list as the codegroup for c.

As he grew old, Rossignol retired to his country home at Juvisy though he reportedly continued to perform his special magic to the end of his life. His last days were brightened by an unmistakable demonstration of royal esteem: the Sun King made à detour in a progress back to Fontainebleau to visit him at Juvisy—this in an age when courtiers vied for the privilege of removing the king’s pajamas at grand and petit levees each morning! Rossignol died soon after, in December of 1682, only a few days short of his 83rd birthday on January 1.

He had been the cryptologist of France in that incomparable moment when Molière was her dramatist, Pascal her philosopher, La Fontaine her fabulist, and the supreme autocrat of the world her monarch. Rossignol was, like them, a superlative practitioner of his art at the foremost court of Europe in the very splendor of its golden age.

His work was carried on by his son, whom he had tutored. Bonaventure succeeded to his father’s 12,000 livres a year, and in 1688 was raised from counselor to the parlement to president of the Chamber of Accounts. A contemporary describes him as an “intriguer, very ugly, who has gained great well-being from deciphering letters.” He numbered among his friends the great letter writer, Madame de Sévigné. When he died, in 1705, the Marquis de Dangeau remarked in his Mémoires that he was the finest decipherer in Europe. The Mercure Galant likewise praised him, saying that “the King himself admitted being vexed by his death: which alone may suffice for his eulogy.” Saint-Simon would only concede that “he became adept at it, but not to the point of his father. They were,” he summed up, “honest and unassuming men, who both waxed fat on the king, who even left a pension of 5,000 livres for those members of the family who were not old enough to decipher.” Bonaventure’s eldest son had been killed in an accident, and his second son, Antoine-Bonaventure, who had been destined for a career in the church, switched to what had become the family trade. He inherited the Rossignol acuity in cryptanalysis, and eventually succeeded his father as president of the Chamber of Accounts.

One of the most important contributions of the Rossignols was to make crystal clear to the rulers of France the importance of cryptanalyzed dispatches in framing their policy. So effectively did their work demonstrate this that the war minister, Louvois, vigorously encouraged anyone who could provide such intelligence. On July 2, 1673, while Antoine Rossignol was still alive, Louvois ordered 200 écus remitted to one Vimbois “for having found the cipher,” and, four days later, 600 livres to one Sieur de La Tixeraudière for his solution. The next year, he thanked the Count of Nancre at the Flanders frontier for sending him an enemy cipher table, saying “that if the man of whom you speak can help you succeed [in solving some enciphered letters], you may assure him that His Majesty will grant him what he asks.” Still another of Louvois’ cryptanalysts was named Luillier. All these endeavors coalesced into a central black chamber, or Cabinet Noir, which regularly read the ciphered dispatches of foreign diplomats throughout the 1700s.

These successes quickened the French appreciation of the need to prevent cryptanalysis of their own systems. Their precautionary measures included frequent changes and an ironclad control. In 1676, Louvois sent a dozen two-part nomenclators to the provincial governors, and a few months later followed them up with a detailed order of the king about how they were each to be placed into individual packets and carefully marked. In 1690, when Louis XIV again ordered a change in the chiffre général, Louvois instructed the governors to return the old tables and reminded them to use the homophones in the new nomenclator and not always to repeat the same cipher character. And in 1711, Louis, though a crabbed and tired old man then only four years from his grave, was ordering still another set of nomenclators sent to these governors. Extant records of the ministry of war for the reign of his successor, Louis XV, comprehend nomenclator after nomenclator, all of several hundred number groups in thoroughly disarranged fashion, for use with various individuals. One of several special “Canada Tables” was for the Marquis de Montcalm; it is dated 1755, just before that general sailed to defend New France against the British and to die a hero’s death in battle with Wolfe on the Plains of Abraham. In the repertory of a 1756 nomenclator, destined for France’s colonial efforts in Asia, the proper names of the East glow like rubies: the Mogul, the Nabob, Pondichéry, India itself. A note on another nomenclator, intended for use among ten persons, demonstrates the care with which they were used: “Suppressed,” reads the notation, “M. de Marainville having lost his.”

The prudence was not excessive. One day near the end of Louis XV’s reign in 1774, a marshal of France brought a package from Vienna into the king’s presence. When Louis undid it, he was astonished to see not only dispatches of the king of Prussia to secret agents in Paris and Vienna, but also plaintext copies of his own most secret enciphered correspondence, and messages between the head of his spy organization and his ambassador in Stockholm, who participated in the coup that set up the strongly pro-French Gustavus III as absolute monarch of Sweden. Louis was told that the package had come from the Abbot Georgel, secretary to France’s ambassador to Austria. Georgel had met a masked man at midnight in Vienna and had been given the packet in return for 1,000 ducats. When he opened it in his room, he found that he could obtain twice weekly all the discoveries of the black chamber of Vienna, in which the correspondence of all powers was surreptitiously opened, solved, and read. Georgel made the deal, and continued to meet the mysterious agent at midnight, sending the documents to Louis twice a week by special courier.

Black chambers were common during the 1700s, but that of Vienna—the Geheime Kabinets-Kanzlei—was reputed to be the best in all Europe.

It ran with almost unbelievable efficiency. The bags of mail for delivery that morning to the embassies in Vienna were brought to the black chamber each day at 7 a.m. There the letters were opened by melting their seals with a candle. The order of the letters in an envelope was noted and the letters given to a subdirector. He read them and ordered the important parts copied. All the employees could write rapidly, and some knew shorthand. Long letters were dictated to save time, sometimes using four stenographers to a single letter. If a letter was in a language that he did not know, the subdirector gave it to a cabinet employee familiar with it. Two translators were always on hand. All European languages could be read, and when a new one was needed, an official learned it. Armenian, for example, took one cabinet polyglot only a few months to learn, and he was paid the usual 500 florins for his new knowledge. After copying, the letters were replaced in their envelopes in their original order and the envelopes resealed, using forged seals to impress the original wax. The letters were returned to the post office by 9:30 a.m.

At 10 a.m., the mail that was passing through this crossroads of the continent arrived and was handled in the same way, though with less hurry because it was in transit. Usually it would be back in the post by 2 p.m., though sometimes it was kept as late as 7 p.m. At 11 a.m., interceptions made by the police for purposes of political surveillance arrived. And at 4 p.m., the couriers brought the letters that the embassies were sending out that day. These were back in the stream of communications by 6:30 p.m. Copied material was handed to the director of the cabinet, who excerpted information of special interest and routed it to the proper agencies, as police, army, or railway administration, and sent the mass of diplomatic material to the court. All told, the ten-man cabinet handled an average of between 80 and 100 letters a day.

Astonishingly, their nimble fingers hardly ever stuffed letters into the wrong packet, despite the speed with which they worked. In one of the few recorded blunders, an intercepted letter to the Duke of Modena was erroneously resealed with the closely similar signet of Parma. When the duke noticed the substitution, he sent it to Parma with the wry note, “Not just me—you too.” Both states protested, but the Viennese greeted them with a blank stare, a shrug, and a bland profession of ignorance. Despite this, the existence of the black chamber was well known to the various delegates to the Austrian court, and was even tacitly acknowledged by the Austrians. When the British ambassador complained humorously that he was getting copies instead of his original correspondence, the chancellor replied coolly, “How clumsy these people are!”

Enciphered correspondence was subjected to the usual cryptanalytic sweating process. The Viennese enjoyed remarkable success in this work. The French ambassador, who was apprised of its successes through Georgel’s purchases from the masked man, remarked in astonishment that “our ciphers of 1200 [groups] hold out only a little while against the ability of the Austrian decipherers.” He added that though he suggested new ways of ciphering and continual changes of ciphers, “I still find myself without secure means for the secrets I have to transmit to Constantinople, Stockholm, and St. Petersburg.”

The Viennese owed at least some of their success to their progressive personnel policies. Except in emergencies, the cryptanalysts worked one week and took off one week—apparently to keep them from cracking under the intense mental strain of the work. Though the pay was not high, substantial bonuses were given for solutions. For example, bonuses totalling 3,730 florins were disbursed between March 1, 1780, and March 31, 1781, for the solution of 15 important keys. Perhaps the most important incentive was the prestige accorded to the cryptanalysts by direct royal recognition of their value. Karl VI personally handed the cryptanalysts their bonuses and thanked them for their work. Empress Maria Theresa conferred frequently with the officials of the black chamber about the cipher service and the cryptanalytic ability of other countries; that remarkable woman demonstrated her grasp of the principles involved by inquiring whether any of her ambassadors had corresponded too much in a single nomenclator and ought to be given a new key. The cryptanalysts sometimes even got paid for not solving a cipher: if a key was stolen from an embassy, the codebreakers would get a kind of unemployment compensation because they had no opportunity to win their bonus. In 1833, for example, the cabinet got three fifths of the solution bonus when the key of the French envoy was stealthily removed, copied, and replaced in a cupboard in the bedroom of the secretary of the French legation within a single night.

The cryptanalysts’ training likewise aimed at stimulating extra effort. Young men about 20, of high moral caliber, who spoke French and Italian fluently and knew some algebra and elementary mathematics, were assigned to cryptanalysts as trainees. They were kept ignorant of the real work going on while they learned to construct keys, and then tested as to whether they could break the systems they had constructed. If they failed, they were transferred to another civil service job. If they proved competent, they were introduced to the secrets of the black chamber and sent to other countries for linguistic training. The starting salary was 400 florins a year, and this was doubled when they solved their first cipher. Their instructors were paid extra for the tutelage. Since all directors had to be cryptanalysts, this was the way for a young man to become director of the black chamber—a high-status post which paid salaries varying between the extraordinarily good rates of 4,000 and 8,000 florins, which often brought awards of such medals as the Order of St. Stephan, and which gave direct and frequent access to the monarch, with all that that privilege implied.

A good glimpse into the achievements of the Geheime Kabinets-Kanzlei is afforded by the letters of one of its best directors, Baron Ignaz de Koch, who served from 1749 to 1763 with the cover-title of secretary to Maria Theresa. On September 4, 1751, he sent to the Austrian ambassador in France some cryptanalyzed correspondence which “makes one see more and more the main principles that direct the cabinet in France.” Two weeks later, in referring to some other cryptanalyses, he wrote, “This is the eighteenth cipher that we have got through during the course of the year; … we are regarded, unhappily, as being too able in this art, and this thought makes the courts that fear that we can engross their correspondence change their keys at every instant, so to speak, each time sending ones more difficult and more laborious to decipher.” Among letters solved during its existence were those of Napoleon, Talleyrand, and a host of lesser diplomats. These solutions were often made the basis of Austrian strategy.

England, too, had its black chamber. Its origins may be found in the cryptanalyses of a young man who stumbled into cryptology at the same age and at about the same time that Rossignol did, and who may be considered his counterpart. This was John Wallis, better known as the greatest English mathematician before Newton.

He was born on November 23, 1616, in Ashford, Kent, where his father was rector. He studied at Emanuel College, Cambridge, became a fellow of Queen’s College there, and was ordained a minister. He was known to divert himself with arithmetical problems, and one evening early in 1643, when he was serving as chaplain to the widowed Lady Vere, a gentleman brought him a letter that had been found after the capture of Chichester by a parliamentary army during the Puritan Revolution. Wallis told him that he could not tell whether he could solve it or not, “Adding withall, that if it were nothing but barely a new Alphabet, as at the first Sight it seemed to bee, I thought it might possibly bee done. The Gentleman,” Wallis wrote afterward, “who did not expect such an answer, told mee Hee would leave it with all his Heart, if I had any Thought of reading it: And accordingly did so. After Supper (for it was somewhat late in the Evening when I first saw it) having a while considered what Course to take, I set about it, and within a few Houres (before I slept) I had overcome the Difficulty, and transcribed the Letter in a legible Character. This good Successe upon an easy Cipher (for so it was) made me confident, that I might with the like ease read any other, which was no more intricate than that.”

But the next one, a numerical, was so much more difficult than the first, which was a long monalphabetic with word divisions, that Wallis turned it down. His career would have been nipped before it had budded—except that, soon thereafter, Wallis was somehow prevailed upon to try a cryptogram that had lain about for two years because no one could be found to solve it. The cipher numbers in this letter ranged beyond 700, and, wrote Wallis, as the first cryptogram “was one of the easiest, so this second was one of the hardest that I have ever met with.” Several times he gave it up as “desperate,” but after about three months, “I did at last overcome the Difficulty.”

This feat made his fortune. At the behest of Parliament, he solved in 1643 some of the dispatches of Charles I during the civil war, and was rewarded, first, with the living of St. Gabriel’s Church in London, and then with the place of secretary to the Westminster Assembly. Additional solutions for Parliament led to his appointment in 1649 as Savilian professor of geometry at Oxford at the age of 32. In 1660, Charles II’s negotiations with Presbyterian ministers in London for his Restoration were “made known to mee,” said Thomas Scot, director of intelligence for Parliament, “first by one Mr Harvy, since dead and after by Major Adams, who kept them daily Company here, but very much more by letters intercepted which commonly were every word & syllable in Cypher, and decyphered by a learned gentleman incomparably able that way, Dor Wallis of Oxford (who never concerned himself in the matter, but only in ye art & ingenuity); it is a jewell for a Princes vse and service in that kind.” Though Charles knew of Wallis’ parliamentary services through Scot’s confession, he found him so valuable that soon after he ascended the throne he was employing the man who had recently worked against him. Indeed, so indispensable did Wallis prove that Charles compensated him not only with small sums of bounty but eventually with an appointment as a chaplain to the king.

Wallis seems to have been largely self-taught. He studied the works of Porta and others, but learned little from them because, he says, they chiefly treated of methods of encipherment. “So that I saw, there was little Help to bee expected from others; but that if I should have further occasions of that Kind, I must trust to my owne Industry and such observations as the present Case should afford. And indeed,” he continues perceptively, “the Nature of the Thing is scarce capable of any other Directions; every new Cipher allmost being contrived in a new Way, which doth not admit any constant Method for the finding of it out.”

The mind that, without aid, could find its way so unerringly through the labyrinth of cryptology could also blaze new trails in the unexplored fields of mathematics. This Wallis did. His Arithmetica Infinitorum arrived at results that Newton used as a springboard to develop the calculus and that contained the germ of the binomial theorem. Wallis invented the symbol ∞ for infinity, and he was the first to give the value of π by interpolation—a term, incidentally, that he coined. In later years, he taught himself to calculate mentally to while away sleepless nights, performing such astounding feats as extracting the square root of a number of 53 digits and dictating the answer (which proved correct) to 27 places.

Hale and vigorous of body, of medium height with a small head, he was set down by that vivid chronicler John Aubrey as “a person of reall worth” who “may stand very gloriously upon his owne basis, and need not be beholding to any man for Fame, yet he is so extremely greedy of glorie, that he steales feathers from others to adorne his own cap; e.g., he lies at watch at Sir Christopher Wren’s discourses, Mr. Robert Hooke’s, Dr. William Holder, &c; putts downe their notions in his Note booke, and then prints it, without owneing the author. This frequently, of which they complain.” Wallis helped found the Royal Society, but despite his accomplishments, Samuel Pepys, who met him on December 16, 1665/6, noted in his diary, “Here was also Dr. Wallis, the famous scholar and mathematician; but he promises little.”

Wallis’ most active period, cryptologically, came late in life, when he was employed as cryptanalyst to William and Mary. In 1689, he reported to William’s Secretary for War, the Earl of Nottingham, that in the past two weeks he had forwarded three packets of solutions and now had lying before him five letters in three or four different ciphers, all new to him. He told Nottingham, who was always pressing him for solutions, that he could not yet give the plaintext of some cryptograms, though, he went on, “I have already employed about seven weeks on them, and have studied hard thereupon eight or ten hours in a day, or more than so very often, which, in a business of this nature, is hard service for one of my years [then more than 70] unless I would crack my brains at it.” Nottingham, in fact, was once so anxious to have a solution to letters from Louvois to one of his generals that he told Wallis that he had ordered the messenger who brought the cryptograms to wait until Wallis had solved them. Wallis managed to break the nomenclator in four days and, on returning the plaintext, tactfully apprised Nottingham of a few cryptologic realities to explain why he had let the messenger go.

John Wallis’ solution of a dispatch of Louis XIV of France of June 9, 1693

His solutions—nearly all nomenclators, a few monalphabetics—had a considerable impact on current events. In the summer of 1689, he solved the correspondence between Louis XIV and his ambassador in Poland. In one dispatch, Louis was caught urging the King of Poland to declare war against Prussia with him; in another, he was discovered promoting a self-serving marriage between the Prince of Poland and the Princess of Hanover. Wallis described the value of this work in a letter asking for a raise: “The deciphering of some of those letters having quite broke all ye French King’s measures in Poland for that time; & caused his Ambassadors to be thence thrust out with disgrace. Which one thing,” he adds pointedly, “was of much greater advantage to his Matie & his Allies, than all that I am like to receive on that account.”

Though Wallis entreated Nottingham not to publicize his solutions for fear France would again change her ciphers, as she had done nine or ten times before (probably under the expert Rossignol tutelage), word of his prowess somehow spread. The King of Prussia gave him a gold chain for solving a cryptogram, and the Elector of Brandenburg a medal for reading 200 or 300 sheets of cipher. The Elector of Hanover, not wanting to depend on a foreign cryptanalyst, got Wallis’ fellow intellectual, Baron Gottfried von Leibnitz, to importune him with lucrative offers to instruct several young men in the art. When Wallis put off Leibnitz’ query as to how he did these amazing things by saying that there was no fixed method, Leibnitz quickly acknowledged it and, hinting that Wallis and the art might die together, pressed his request that he instruct some younger people in it. Wallis finally had to say bluntly that he would be glad to serve the elector if need be, but he could not send his skill abroad without the king’s leave.

The shrewd old cryptanalyst, who was frequently asking for more money for his solutions, then used Leibnitz’ arguments to his own advantage in successfully urging the secretaries of state to pay for his tutoring of his grandson in cryptanalysis. They agreed in 1699, but it was not until Wallis wrote to the king in 1701, saying that the young man had made such good progress that he had solved one of the best English ciphers and a very good French one, that they were jointly granted £100 a year, retroactive to 1699.

Wallis’ career thus strikingly parallels Rossignol’s. The two men were approximately contemporaneous (Rossignol was not quite 17 years older). Both made their first cryptanalyses in their late twenties on ciphers stemming from civil warfare in their countries. Both had a mathematical bent, and both were largely self-taught in cryptology. Both owed their worldly success to this unusual talent. Both lived into their eighties. And both became their countries’ Fathers of Cryptology in a literal as well as a figurative sense. There were differences, of course. Rossignol had to assist at the more autocratic French court; Wallis seems to have done most of his work at Oxford and in other country places far from London. Rossignol probably supervised French cryptography, but Wallis apparently prescribed an English cipher only once, and that very informally. It is therefore unlikely that these cryptologic titans of the two most powerful and most contentious countries of Europe ever clashed cryptologically. Thus the problem as to who might have been the better must remain—unlike the cryptograms to which they addressed themselves with such success—forever unsolved.

On Wallis’ death on October 28, 1703, the grandson whom he had tutored, William Blencowe, an undergraduate at Magdalen College, assumed the cryptanalytical duties, though he was only 20 years old. His grandfather’s tutorial fee of £100 reverted to him as Decypherer, and he thus became the first Englishman both to bear that title officially and to be paid a regular salary for cryptanalysis. Blencowe did so well that six years later this salary was doubled, and he stood high in the royal favor: Queen Anne intervened in his behalf during a dispute with All Souls College at Oxford, where he was a fellow. But he shot himself in a fit of temporary insanity during his recovery from a violent fever in 1712. He was succeeded by Dr. John Keill, 50-year-old professor of astronomy at Oxford, who, though a fellow of the Royal Society, proved totally incompetent. On May 14, 1716, Keill was replaced by Edward Willes, a 22-year-old minister at Oriel College, Oxford.

Willes embarked at once upon a career unique in the annals of cryptology and the church. He not only managed to reconcile his religious calling with an activity once condemned by churchly authorities, but also went on to become the only man in history to use cryptanalytic talents to procure ecclesiastical rewards. Within two years, he had been named rector of Barton, Bedfordshire, for solving more than 300 pages of cipher that exposed Sweden’s attempt to foment an uprising in England. He virtually guaranteed his future when he testified before the House of Lords in 1723. Here, Francis Atterbury, Bishop of Rochester, was being tried by his peers for attempting to set a pretender on the English throne.

The pretender’s cause exhorted the allegiance of many in England, and the nation’s attention focused on Atterbury’s trial. Most of the facts about the alleged conspiracy had come from his intercepted correspondence, and the most inculpatory evidence had been extracted from the portions in cipher by Willes and by Anthony Corbiere, a former foreign service official in his mid-thirties who had also been appointed a Decypherer in 1719. The Lords “thought it proper to call the Decypherers before them, in order to their being satisfied of the Truth of the Decyphering.” To demonstrate this, Willes and Corbiere deposed,

That several Letters, written in this Cypher, had been decyphered by them separately, one being many Miles distant in the Country, and the other in Town; and yet their Decyphering agreed;

That Facts, unknown to them and the Government at the Time of their Decyphering, had been verified in every Circumstance by subsequent Discoveries; as, particularly, that of H-----’s Ship coming in Ballast to fetch O----- to England which had been so decyphered by them Two Months before the Government had the least Notice of Halstead’s having left England;

That a Supplement of this Cypher, having been found among Dennis Kelly’s Papers the latter End of July, agreed with the Key they had formed of that Cypher the April before;

That the Decyphering of the Letters signed Jones Illington and 1378, being afterwards applied by them to others written in the same Cypher, did immediately make pertinent Sense, and such as had an evident Connexion and Coherence with the Parts of those Letters that were out of Cypher, though the Words in Cypher were repeated in different Paragraphs, and differently combined.

The two Decypherers appeared before the Lords on several occasions to swear to their solutions. Atterbury twice objected and was twice overruled. But on May 7, as Willes was testifying to the cryptanalysis of the three most incriminatory letters of all, and the bishop felt the noose tightening around him, he persisted in questioning Willes on the validity of the reading though the House had supported Willes’ refusal to answer. He raised such a commotion that he and his counsel were ordered to withdraw, and the Lords voted upon the proposition, “that it is the Opinion of this House that it is not consistent with the public Safety, to ask the Decypherers any Questions, which may tend to discover the Art or Mystery of Decyphering.” It was resolved in the affirmative, the solutions were accepted, and Atterbury, largely on this evidence, was found guilty, deprived of office, and banished from the realm.

Willes, on the other hand, became Canon of Westminster the next year. His salary more than doubled to £500. He succeeded to ever more important posts every four or six years thereafter, and finally, in 1742, when the oldest of his three sons, Edward, Jr., obtained a patent as a Decypherer, he was created Bishop of St. David’s, being translated the next year to the more prestigious see of Bath and Wells. The bishop and his son shared the substantial salary of £1,000 a year. In 1752, he brought another son, William, into the business at an eventual £200, and six years later a third son, Francis, who for some reason served without pay.

Bishop Willes died in 1773 and was buried in Westminster Abbey. His sons Edward, Jr., and Francis inherited a large share of his fortune and landed property and, living as wealthy squires at Barton and Hampstead, continued their cryptanalytic work. Their brother William had retired in 1794, but his three sons, Edward, William, and Francis Willes joined the Decyphering Branch in the 1790s.

Though the Willes family dominated the cryptanalytic branch, others worked in it. Corbiere was paid through such sinecures as his appointment as naval officer at Jamaica, though he never stirred from England, and as Commissioner of Wines Licenses, which sounds like the cushiest of posts. He rose to Under Secretary of the Post Office but continued his cryptanalytic work, which ended after 24 years only with his death in 1743, when he was receiving £800. The other cryptanalysts at various times were James Rivers, Frederick Ashfield, John Lampe, George Neubourg, John Bode, Jr., one Scholing, and a Boelstring.

These men received their foreign interceptions from the Secret Office and their domestic ones from the Private Office, both subdivisions of the Post Office. The Secret Office was quartered in three rooms adjoining the Foreign Office and entered privately from Abchurch Lane. Fire and candles burned constantly in one room; the staff lodged in the others. It included men who made their life’s work the specialty of unsealing diplomatic packets with such deftness that they could be resealed without evidence of tampering; one such opener was J. E. Bode, father of John Bode, Jr. He regularly spent three hours on the dispatches of the King of Prussia, opening them and then resealing them with special wax and carefully counterfeited seals. Perhaps surprisingly in a bastion of human rights, its interceptions enjoyed full legality. The statute of 1657 that established the postal service declared outright that the mails were the best means of discovering dangerous and wicked designs against the commonwealth. Leases of 1660 and 1663, confirmed by the Post Office Act of 1711, permitted government officials to open mail under warrants that they themselves issued. They sidestepped this bothersome procedure by promul gating all-inclusive general warrants.{19} The Secret Office sent interceptions en clair to the king and those in cipher to the cryptanalysts.

They were known collectively as the Decyphering Branch. Unlike the Secret Office, the branch had no specific location. Its tiny staff of experts worked largely at home, receiving their material by special messenger. Nor had it any formal organization, the senior Decypherer being merely first among equals. More secret than the Secret Office, the branch’s funds came from secret-service money issued to the Secretary of the Post Office from Parliament’s surplus revenue. Security was tight—in all of England probably only 30 people knew what diplomatic correspondence was being read at any given moment. Nevertheless, most men of affairs were aware of the practice of opening private letters, and they often enciphered their correspondence or entrusted it to private messengers when secrecy was essential.

After the Elector of Hanover succeeded to the English throne as George I in 1714, retaining the rule of the German state, the Decyphering Branch collaborated with the black chamber maintained at Nienburg by the Hanoverian government. Cryptanalysts Bode, Lampe, and Neubourg had even been imported from there—an ironic development in view of Wallis’ refusal to divulge his techniques to Hanover a few years earlier. Mail opening became habitual. George and his successors took a constant personal interest in the work, often encouraging talent with royal bounty. Correspondence was closely watched for cribs that were passed to the Decyphering Branch.

During the 1700s, the branch’s output averaged two or three dispatches a week, and sometimes one a day. Its cryptanalysts solved the dispatches of France, Austria, Saxony and other German states, Poland, Spain, Portugal, Holland, Denmark, Sweden, Sardinia, Naples and other Italian states, Greece, Turkey, Russia, and, later, the United States. The record of French interceptions covers two centuries and comprises five volumes of intercepts totaling 2,020 pages plus three volumes of keys. Perhaps more typical is the Spanish dossier—three volumes of intercepts from 1719 to 1839 totaling 872 pages. Not all of the messages were solved at the time of their interception. Many were held either until enough had accumulated for a successful attack or until a need arose for their solution.

The solutions were read by the king and a few of the top ministers. They warned the government of the intrigues of foreign rulers and ambassadors and of impending war. An intercepted message between the Spanish ambassadors in London and Paris clearly suggested that Spain had allied herself with France against England in the Seven Years’ War. It was read at the British cabinet meeting of October 2, 1761. The Great Commoner, William Pitt the Elder, cited it as support for his proposal that England take the initiative, declare war before Spain did, and capture the fleet of treasure ships then transporting gold to Spain from her American possessions. His counsel was rejected, and he resigned. The war came anyway—after the immense cargo of bullion had been unloaded at Cadiz.

Solution of a 1716 French dispatch by England’s Decyphering Branch

The success of the cryptanalysts of France and England was undoubtedly due in large measure to their skill. But, as always, there was another side to it which François de Callières pointed out in his superb little work on diplomacy. The cryptanalysts, he said, “owe the Esteem they have gain’d solely to the negligence of those who give bad Cyphers, and to that of Ministers and their Secretaries, who make not a right use of them.”

He omitted the important factor of economics. In England in the 1700s, the Decyphering Branch at first tested and, after 1745, prepared England’s diplomatic nomenclators. These generally had four-figure codegroups and numerous homophones; they were printed on large sheets and pasted on boards for the cipher clerks’ use. The cryptanalysts, who should have known, thought that it was “little less than impossible to find them out.” But their initial strength, which was due to the extent of the lexicon and the many homophones, eventually proved a weakness: the foreign service was reluctant to change a nomenclator that, in the late 1700s, cost £150, or to order separate nomenclators for separate countries. Thus some remained in use for a dozen years or more, and some simultaneously served several embassies. For example, in 1772 and 1773, Paris, Stockholm, and Turin had Ciphers and Deciphers K, L, M, N, O, And P; Florence had K, L, O, and P; Venice, K and L for use with Florence and M and N for other purposes; Naples, M and N; and Gibraltar, O and P.

But Callières correctly remarked failures to make a “right use” of ciphers. Time and again, diplomats enciphered documents handed to them by the governments to which they were accredited, giving those governments’ cryptanalysts ideal cribs. They repeated in clear dispatches sent in cipher. Because of language difficulties, they used foreigners in secret work. And often their chiefs simply did not want to believe in cryptanalysis because it meant more work for them. In 1771, for example, the French ambassador to England complained that he had only two old ciphers and that there was in London “a bishop [Willes] charged with the decipherment of the dispatches of foreign ministers who succeeds in finding the key of all ciphers.” His superior replied that not even a bishop could translate French ciphers, “which have no kind of system and of which it is not possible to find the key because one does not exist.” Then, after rather heavy-handedly pointing out that ciphers are sometimes compromised through the indiscretions of those who hold them, he added, “I do not believe in decipherers any more than in magicians.”

This sentiment found its most pointed expression in Voltaire’s remark that “those who boast of deciphering a letter without being instructed in the affairs of which it treats, and without having any preliminary help, are greater charlatans than those who boast of understanding a language which they have not even studied.” For once, one of his epigrams rang false.

Across the Atlantic, cryptology reflected the free, individualistic nature of the people from which it sprang. No black chambers, no organized development, no paid cryptanalysts. But this native cryptology, which had much of the informal, shirtsleeve quality of a pioneer barn-raising, nevertheless played its small but helpful role in enabling the American colonies to assume among the powers of the earth their separate and equal station. Indeed, the first incident occurred even before those colonies had declared their independence.

It started in August of 1775. A baker named Godfrey Wen wood was visited in Newport, Rhode Island, by a girl whom he had formerly known intimately. She asked him for help in getting in touch with some British officers so that she could give them a letter. Wenwood, a rebel patriot, grew suspicious. He persuaded her to give him the letter for delivery and to depart before his fiancée learned of her visit. But he did not forward it.

Instead, he consulted a schoolmaster friend. The friend broke the seal and found inside three pages covered with line after neatly printed line of small Greek characters, odd symbols, numbers, and letters. Unable to penetrate the mystery, he handed the missive back to Wenwood, who tucked it away while he considered the matter further. But soon thereafter he received a letter from the girl, who complained that “you never Sent wot you promest to send.” His suspicions now thoroughly aroused, Wenwood went up through channels and at the end of September was standing in the headquarters of Lieutenant General George Washington, showing him the letter.

The commander in chief could not read the cryptogram either, but he could question the girl. She was brought in that evening, and though, Washington said later, “for a long time she was proof against every threat and persuasion to discover the author,” intensive interrogation wore her down. The next day, she finally revealed that the letter had been given to her by her current lover, Dr. Benjamin Church, Jr. Washington was astounded. Church was his own director general of hospitals. A prosperous Boston physician who was a leader in the Massachusetts Congress and a colleague of Samuel Adams and John Hancock in the new House of Representatives, he had just asked to resign as hospitals chief. Washington had turned down his request because of his own “unwillingness to part with a good officer.” Could so distinguished a man be engaged in a clandestine and possibly traitorous correspondence? But he was brought in under guard.

Last lines of the cipher message of the Tory spy, Dr. Benjamin Church

The letter was his, he readily admitted, intended for his brother, Fleming Church, who was in Boston—though it was addressed to “Major [Maurice] Cane in Boston on his majisty’s service.” If deciphered, it would be found to contain nothing criminal. But though he repeatedly protested his loyalty to the Colonial cause, he did not offer to put the contents of his letter into plain language.

Washington cast about for someone who could solve it. He located the Reverend Mr. Samuel West, 45, a rather absentminded pastor who was, ironically, a Harvard classmate of Church’s. West, who later served as a delegate to the Constitutional Convention of 1787, was interested in alchemy and became convinced that prophetic portions of the Bible predicted the course of events of the American Revolution.

When Washington’s need for a cryptanalyst became known, Elbridge Gerry, 31, chairman of the Massachusetts committee of military supply, volunteered his help. Gerry went on to greater fame as fifth Vice President of the United States and concocter of the political grotesquery known today as the “gerrymander.” He also suggested the name of Colonel Elisha Porter of the Massachusetts militia, who had been a year ahead of him at Harvard. Gerry and Porter teamed to attack the message, and West worked by himself through the night.

Washington received the two solutions of what proved to be a monalphabetic substitution on October 3. They were identical. Church was reporting to Thomas Gage, the British commander, on American ammunition supply, on a plan for commissioning privateers, on rations, recruiting, currency, a proposed attack on Canada, artillery that he had counted at Kingsbridge, New York, troop strength in Philadelphia, and the mood of the Continental Congress. It ended: “Make use of every precaution or I perish.”

This, to Washington, refuted Church’s protestations that he had deliberately transmitted the information to the redcoats to impress them with patriot strength and so deter them from attacking just when American ammunition was low. It also convinced most Colonial leaders of his guilt. “… what a complication of madness and wickedness must a soul be filled with to be capable of such perfidy!” ejaculated an angry Rhode Island delegate. And the paymaster general of the Continental forces commented, “I have now no difficulty to account for the knowledge Gage had of all our Congress secrets, and how some later plans have been rendered abortive.” It also developed that information furnished by Church caused Gage to send troops to Boston to capture American stores at Concord—a move that resulted in the historic clash at Lexington that began the American Revolution.

Church was imprisoned. The Massachusetts legislature expelled him. When he was paroled briefly, a mob assailed him. Congress rejected a British proposal to exchange him. Finally, in 1780, Massachusetts exiled him to the West Indies under pain of death should he return. But the small schooner in which he sailed was never heard of again, and the first American to have lost his liberty as a result of cryptanalysis evidently lost his life because of it as well.

Cryptology served another traitor much better. No mere monalphabetic substitution for ambitious Benedict Arnold. He played for much higher stakes and his systems excelled in security. The correspondence between Arnold, in charge at West Point, and John Andr6, an engaging young British major whose gallantry caused some to call him the “English Nathan Hale,” was conducted in several types of code. Arnold apparently handled his own cryptographic duties, but encoding and decoding at the Tory end devolved largely upon Jonathan Odell, a Loyalist clergyman of New York, and upon Joseph Stansbury, a Philadelphia merchant also partial to the Crown.

At first they employed a book code based on volume I of the fifth Oxford edition of the legal classic, Blackstone’s Commentaries. “Three Numbers make a Word,” André instructed Stansbury, “the 1st is the Page the 2d the Line the third the Word.” Words not in the book were to be spelled out, and these codenumbers distinguished from the others by drawing a line through the last number, which then represented the position of a letter in that line instead of a word.

They promptly ran into unsuspected practical difficulties. Only a very few of the encoded words (the messages were encoded only in part) could be found whole, such as general (35.12.8) and men (7.14.3). Arnold managed to find the word militia, but he had to search to page 337 to find it, whereas the other words in his message of June 18, 1779, came from pages 35, 91, and 101. Most of the words and the proper names had to be spelled out in an enormously cumbersome fashion that required tedious counting for each letter and then the writing of four digits as its ciphertext equivalent. Sullivan, for instance, became (with a stroke through the final number of each group) 35.3.1 35.3.2 34.2.4 35.2.5 35.3.5 35.7.7 35.2.3 35.5.2. Arnold consequently abandoned the system after sending one message in the Blackstone code, and receiving only one from Stansbury to Odell.

The conspirators switched to the best-selling Universal Etymological English Dictionary of Nathan Bailey as a codebook; the words, being listed alphabetically, were considerably easier to locate. Then they turned to a small dictionary, which has not been identified. Through its pages sifted the bulk of the clandestine correspondence relating to Arnold’s betrayal of West Point to the British in return for money, security, and honor. Both sides enciphered their codenumbers by adding 7 to each of the three figures—including the middle digit which, representing the column, always appeared as 8 or 9 in what would have been a giveaway to the system. But the security of the system was never put to the test of Colonial cryptanalysis, for the attempted betrayal was blocked by the capture of André before any of the missives were intercepted. He was hanged; Arnold escaped—to a life of ignominy.

British spy cryptography was surpassed by that of the two most important American agents. Samuel Woodhull of Setauket, Long Island, and Robert Townsend of New York City supplied Washington with reams of information about the redcoat occupation of New York during 1779. They wrote their reports in a one-part nomenclator of about 800 elements that had been constructed by one of Washington’s spymasters, Major Benjamin Tallmadge of the Second Connecticut Dragoons. Tallmadge extracted the words he thought would be needed from a copy of John Entick’s New Spelling Dictionary, wrote them in columns on a double sheet of foolscap, and assigned numbers to them. Personal and geographic names followed in a special section. Thus, 28 = appointment, 356 = letter, 660 = vigilant, 703 = waggon, 711 = George Washington, 723 = Townsend, 727 = New York, 728 = Long Island. In addition, the following semimixed alphabet permitted the encipherment of words not in the code list:

Benedict Arnold’s dictionary-code message of July 15, 1780, to Major John André, reading, in part, “If I point out a plan of cooperation by which S[ir Henry Clinton] shall possess him self of West Point, the garrison &c &c &c, twenty thousand pounds sterling I think will be a cheap purchase for an object of so much importance….” Arnold’s code signature, 172.9.192, stands for his codename, MOORE.

Tallmadge provided copies of these pocket codes to both spies and to Washington, and kept one himself. A typical letter from Woodhull, dated at Setauket, August 15, 1779, began: “Sir: Dqpeu Beyocpu agreeable to 28 met 723 not far from 727 and received a 356, but on his return was under the necessity to destroy the same, or be detected….” (DQPEU BEYOCPU was Jonas Hawkins, a messenger.) The spies further masked their identity under codenames, Woodhull being CULPER SR. and Townsend CULPER JR.

The CULPERS used invisible ink extensively. Washington supplied them, getting it from Sir James Jay, who had been a physician in London and was the brother of John Jay, the American statesman who became the first Chief Justice. Sir James recounted the story of the ink in a letter he wrote years later to Thomas Jefferson:

When the affairs of America, previous to the commencement of hostilities, began to wear a serious aspect, and threatened to issue in civil war, it occurred to me that a fluid might possibly be discovered for invisible writing, which would elude the generally known means of detection, and yet could be rendered visible by a suitable counterpart. Sensible of the great advantages, both in a political and military line, which we might derive from such a mode of procuring and transmitting intelligence, I set about the work. After innumerable experiments, I succeeded to my wish. From England I sent to my brother John in Newyork, considerable quantities of these preparations….In the course of the war, General Washington was also furnished with them, and I have letters from him acknowledging their great utility, and requesting further supplies…. By means of this mode of conveying intelligence, I transmitted to America the first authentic account which Congress received, of the determination of the British Ministry to reduce the Colonies to unconditional submission; the ministry at the time concealing this design, and holding out conciliatory measures. My method of communication was this: To prevent the suspicion which might arise were I to write to my brother John only, who was a member of Congress, I writ with black ink a short letter to him, and likewise to 1 or 2 other persons of the family, none exceeding 3 or 4 lines in black ink. The residue of the blank paper I filled up, invisibly, with such intelligence and matters as I thought would be useful to the American Cause…. In this invisible writing I sent to [Benjamin] Franklin and [Silas] Deane, by the mail from London to Paris, a plan of the intended Expedition under Burgoyne from Canada.

By July, 1779, Washington was writing CULPER SR.: “All the white Ink I now have (indeed all that there is any prospect of getting soon) is sent in phial No. 1 by Col. Webb. The liquid in No. 2 is the counterpart which renders the other visible by wetting the paper with a fine brush after the first has been used and is dry. You will send these to C-----R, JUNR., as soon as possible, and I beg that no mention may ever be made of your having received such liquids from me or anyone else.” But though Washington urged the use of a cover-text in black ink, the CULPERS customarily wrote their message on a blank sheet of paper, inserting the sheet at a predetermined point in a whole package of the same letter paper.

Numerous letters in this “stain”—as Washington and the CULPERS generally called the secret ink—successfully eluded British inspection and transported considerable information to the American commander in chief. The reports of the CULPERS were filled with detail on such matters as how many troops were stationed where, what warships were anchored in New York harbor, what provisions were entering the town, and so forth. Washington found their reports “intelligent, clear and satisfactory” and said of CULPER JR. that “I rely upon his intelligence.”

The redcoats used invisible ink even earlier than the Americans. Only a few days after the Battle of Lexington, British headquarters in Boston received a secret-ink letter which revealed some of the military plans of the New England patriot forces. “… the first movement will be to make a feint attack upon the Town of Boston,” the invisible portion read in part, “& at the same time to attempt the castle with the main body of their Army.” The handwriting shows the document to be from Benjamin Thompson, a hated Tory, who, after a series of colorful adventures, became Count Rumford of the Holy Roman Empire and a widely known scientist. He used gallotannic acid for his ink, which the British developed by ferrous sulphate—a procedure described by Porta, from whose Natural Magick Thompson, who had been avid for science since his teens, had probably borrowed it.

When it came to ciphers, the British provided themselves with a veritable menagerie of systems. Sir Henry Clinton, British commander in New York, had a small one-part nomenclator; he also had a monoalphabetic substitution in which a = 51, b = 52, c = 53, and so on. He had a truncated alphabet tableau of twelve lines. He even had a pigpen cipher. Still other specimens inhabited this cryptographic zoo, but the only one Clinton is known to have used in the early part of the war is a degenerate form of grille called the dumbbell cipher, from the hourglass shape of its one large hole.

In the summer of 1777, Clinton had to inform General John Burgoyne, driving south down the Hudson in an attempt to cut the colonies in two, that he would have trouble pushing north to a meeting because his superior, Sir William Howe, had taken most of his troops to Philadelphia. On August 10, Clinton wrote as part of his secret message a heartfelt Sir W’s move just at this time the worst he could take. His cover-text for this portion, which necessarily had to include many of these words, stated just the opposite: SIR W’S MOVE JUST AT THIS TIME HAS BEEN CAPITAL; WASHINGTON’S HAVE BEEN THE WORST HE COULD TAKE IN EVERY RESPECT. But it was patently absurd for a commander to assert that the loss of his troops was “capital”; the example throws a sharp light on the weakness of the grille. Whether the message got through or not, and if it did whether it disheartened Burgoyne, is unknown. It is known that, deprived of the help of Clinton’s column from the south, he lost the Battle of Saratoga, which helped determine the ultimate outcome of the Revolution.

While code and cipher systems proliferated throughout the Revolution, cryptanalysis hibernated. The basic reason seems to be that, with the exception of an infrequent episode like that of the Church cipher, no cryptograms were intercepted. It was not until the war neared its end that enough messages were captured to make recurrent cryptanalyses possible. Most of the messages were solved by James Lovell, a member of the Continental Congress who may be called the Father of American Cryptanalysis.

Lovell, born in Boston on October 31, 1737, graduated from Harvard in 1756 and then taught for eighteen years in his father’s South Grammar School in Boston. His father was a fervid Loyalist, but James was named as the first orator to commemorate the Boston Massacre, and in 1775 was arrested by the British as an American spy. After his exchange, he was elected a delegate to the Continental Congress. He took his seat in 1777, and promptly distinguished himself for zeal and industry, particularly on the Committee on Foreign Affairs. It is said that he never once in the next five years visited his wife and children. He offered a design for the Great Seal of the United States, which, however, was rejected. He quit Congress in April of 1782 and was appointed receiver of continental taxes in Boston, and, in 1789, naval officer for the district of Boston and Charlestown, the post he held until his death in 1814.

He was regarded as gifted in intrigue and as a lover of mystery. Where he learned cryptology is not known, but as early as 1777, he was endorsing Arthur Lee’s proposal that the Committee of Secret Correspondence use a dictionary as a codebook. Two years later, he urged Major General Horatio Gates, whom he preferred over Washington as commander in chief, to “Ask Dr. Joseph Gardner, one of my best earthly friends, to let your clerk copy an alphabet which he had from me.” The system was a Vigenère using numbers instead of cipher letters; Lovell keyed a letter in it to Gates with the name JAMES. The same system, with key CR, served him in enciphering letters to John and Abigail Adams in 1781. The following year, after a mail robbery had compromised the nomenclator of 846 elements used by Virginia’s delegates to Congress, one of them, the acid-tongued Edmund Randolph, proposed to another, James Madison, that they employ “the cypher which we were taught by Mr. Lovell. Let the keyword be the name of the negro boy who used to wait on our common friend Mr. Jas. Madison.” This name was CUPID, the system a numerical Vigenère. It is significant that Lovell was here popularizing a system that was relatively obscure and little used, but that was then the only type that lay beyond the known limits of cryptanalysis. Later, however, errors compelled its abandonment.

Lovell’s successes in solution came at the most opportune time. In the fall of 1781, Lord Cornwallis, Britain’s second-in-command in America, had moved his troops north from the Carolinas to Virginia. He was convinced that that colony had to be taken before the southern colonies could be held, and he marched down the James River toward the coast in the hope of receiving reinforcements by sea from his chief, General Clinton, in New York. He planned to reduce Virginia, conquer the Carolinas, and quell the revolution for His Britannic Majesty, King George III.

It was at this juncture that the American commander in the South, Nathanael Greene, sent to Congress, as he had done before, some intercepted redcoat cryptograms that no one in his headquarters could read, enclosing them in a general report. The British correspondence was among Cornwallis and several of his subordinates.

Greene’s report was read in Congress September 17. Four days later, Lovell had solved the enclosures. A few were in a simple monalphabetic substitution, but most were in a bastard system that combined the poorest features of mon- and polyalphabeticity. A single numerical cipher alphabet enciphered four to ten lines monalphabetically, and then shifted to provide new ciphertext equivalents. For example, the positions were as follows for lines 1, 10, and 14 of the first page of the first letter:

Any number above 30 was a null, and these were sprinkled freely throughout the message. Changes in alphabets were signaled by both a bracketlike mark and a series of four to seven nulls. No pattern appeared in the shifting; presumably it followed a list prearranged by the correspondents.

Unfortunately, the tactical situation had changed too much for the information in the Carolina intercepts to be of much good. But the keys that Lovell had recovered might possibly prove valuable some time in the future, and so he took the precaution of writing Washington: “It is not improbable that the Enemy have a plan of cyphering their letters which is pretty general among their Chiefs. If so, your Excellency will perhaps reap Benefit from making your Secretary take a Copy of the Keys and observations which I send to General Greene, through your Care.”

Lovell could not have been shrewder. The system that he had solved was, as he had guessed, also in service between Cornwallis and Clinton, who was the commander in chief of all British forces in America. Cornwallis had by now retired to Yorktown to await Clinton’s reinforcements. But Washington had encircled the town with 16,000 men, while the French admiral, the Count de Grasse, with 24 French ships of the line, barred relief by sea. On October 6, just after the French and American allies had driven a parallel close to the British lines, Washington wrote Lovell, “My Secretary has taken a Copy of the Cyphers, and by the help of one of the Alphabets has been able to decipher one paragraph of a letter lately intercepted going from L’d Cornwallis to Sir H’y Clinton.” The letter presumably gave Washington insight into conditions inside the British fortifications.

Clinton, meanwhile, managed to maintain contact with Cornwallis by small boat. But the vessels that he sent out from New York on September 26 and October 3 were captured by the rebels. One of them had been driven ashore near Little Egg Harbor, where the Tory who was carrying one set of dispatches hid them under a large stone before he was captured and brought to Philadelphia. “By means of a little address and a promise of a pardon,” as one American put it, he was persuaded to recover them. The search took at least two days, either because “the beach is so extensive and so many places like each other,” as the president of Congress, Thomas McKean, wrote Washington, or because the man was delaying. He still had not returned with them to Philadelphia by 3 p.m. October 13, nor, apparently, by the next morning. At that time, Lovell sent to Washington through a French officer what appears to have been a supplementary British system: “I found, as I had before supposed, that they sometimes use Entick’s Dictionary marking the Page Column and Word as 115.1.4. Tis the Edition of 1777 London by Charles Dilley.”

James Lovell’s solution of a 1781 letter to Lord Cornwallis

The Tory returned with the dispatches some time during October 14. Lovell attacked them at once and with immediate success, since he found to his joy that they were written in the same alphabets as the rest of the Clinton-Cornwallis correspondence. The more important message of the two that were apparently intercepted was the one sent in duplicate by Clinton on September 30 and received by Cornwallis on October 10. “My Lord,” it began, “Your Lordship may be assured that I am doing every thing in my power to relieve you by a direct move, and I have reason to hope, from the assurances given me this day by Admiral Graves, that we may pass the bar by the 12th of October, if the winds permit, and no unforeseen accident happens: this, however, is subject to disappointment, wherefore, if I hear from you, your wishes will of course direct me, and I shall persist in my idea of a direct move, even to the middle of November…”

By the evening of October 14, Lovell was writing to Washington: “Since I wrote that Letter [of the morning], I have been happy in decyphering what the President of Congress sends by this Opportunity. The use of the same Cypher by all the British Commanders is now pretty fairly concluded. The Enemy play a grand Stake, May the Glory redound to the Allied Force under your Excellency’s Command!”

This went out with a letter of the president of Congress, who told Washington: “My intelligence was true: the inclosed copies of two original letters from Sir Henry Clinton to Lord Cornwallis which I have in cyphers, and which have been faithfully decyphered by Mr. Lovell (whose key I had the honor to forward to you about a fortnight ago) more than prove the fact.”

At the same time, McKean also sent the solutions to de Grasse, whose ships were to prevent Graves and Clinton from relieving Cornwallis. “The British General and Admiral seem to be desperate, and willing to risque all on the intended attempt,” he wrote de Grasse, adding prophetically, “If they fail it appears here that they are disposed to give up the contest for North America.” De Grasse continued to blockade Cornwallis and to watch for the British fleet. Five days after Lovell had completed his cryptanalytic exposure of British plans, Cornwallis surrendered. But victory was not quite complete. Washington recognized this when, on the following day, October 20, he received the copies of the solutions that McKean had sent him and lost “not an instant” in forwarding them to de Grasse. Doubly warned, the French admiral prepared for the British attack. On October 30, he scared off the English fleet and set the seal of final victory on the American War for Independence.

With the coming of victory, the difficulties attendant upon the establishment of a new nation compelled the Founding Fathers not only to continue their secret communications, but to extend and improve them. In the fall of 1781, Robert A. Livingston, Secretary of Foreign Affairs, had forms printed that bore on one side the numbers 1 to 1700 and on the other an alphabetical list of letters, syllables, and words. They served as a convenient basis for correspondents to produce individual nomenclators by assigning the code numbers to the plaintext elements in whatever order they wished.

They were widely used. Madison and Thomas Jefferson constructed a code on one of them in 1785, using it at least until 1793. It was in that year that Madison, vacationing in Fredericksburg, found himself staring at this enÃ‚Âlightening passage in a letter from Jefferson because he had left his key in Philadelphia: “We have decided unanimously to 130 … interest if they do not 510 … to the 636. Its consequences you will readily seize but 145 … though the 15…. ” Another code composed on the Livingston forms, endorsed “Mr. Monroe’s cypher,” was used by Monroe in 1805 when he was minister to England, by James A. Bayard in 1814 when he helped negotiate the treaty that ended the War of 1812, and as late as 1832 by President Andrew Jackson in letters to a diplomatic agent. It therefore seems to have been one of the first official codes of the United States under the Constitution.

The nomenclator compiled in 1785 by Jefferson for use with Madison and Monroe

Other emissaries used systems of secret communication while the America that they were representing was still little more than thirteen united colonies. Benjamin Franklin, in France in 1781, assigned consecutive numbers to each of the 682 letters and punctuation marks in a long passage in French to concoct a homophonic substitution cipher:

One message began, I HAVE JUST RECEIVED A 14, 5, 3, 10, 28, 76, 203, 66, 11, 12, 273, 50, 14, … the numbers deciphering to neuucmiissjon. The double u was necessary because the French passage has no w. Plaintext e was represented by more than 100 different numbers. Another early representative, William Carmichael, minister in Madrid, seems to have made the first recorded suggestion for a standard American diplomatic cryptography. In a letter to Jefferson in Paris on June 27, 1785, he wrote: “It has long been my surprise that Congress hath not instructed those they employ abroad on this head [ciphers]: For this purpose a common cypher should be sent to each of their Ministers and Chargé Des Affaires.”

Still other systems were used. Before they settled on the Livingston-form nomenclator, Jefferson and Madison agreed to use a French-English lexicon as a codebook. The Lee brothers, Arthur, Richard Henry, and William, corresponded from 1777 to 1779 in a dictionary code, probably the same Entick’s of 1777 that Clinton had used and Lovell discovered.

The most far-reaching cryptogram in domestic American history used not one but three systems of cryptography. It served as evidence in the sensational trial for treason of the man who had lost the Presidency by a single vote in 1800 and who became Vice President instead—Aaron Burr.

After killing Alexander Hamilton in a duel in 1804, Burr headed west, fired with his dream of carving out a colonial empire in the Southwest at the expense of Spain, with whom war then seemed imminent. Whether this empire was to be the United States’ or Burr’s was never clear. His military accomplice in this grandiose scheme was General James Wilkinson, who, unknown to Burr, was a paid Spanish agent. Though Burr had used a cardboard cipher disk with numbers for polyalphabetic substitution in 1800 and in a letter to his son-in-law in 1804, he and Wilkinson decided to combine into a single system of cryptography for their great work a symbol code in which, for example, a circle stood for “President,” a symbol cipher in which a dash represented a, and a dictionary code based on the 1800 Wilmington edition of the ubiquitous Entick’s. On October 8, 1806, as Wilkinson waited in camp at Natchitoches, Louisiana, a messenger arrived with a cipher letter in this system from Burr dated July 22, in which he outlined his final plans for the great adventure.

Its exact wording will never be known. Wilkinson erased, altered, and redeciphered it time and again to suit his varying conveniences. In its final version, it began: “Your letter post marked 13th May is received. I have at length 263.13ed 176.3. and have 35.3 93.10ed….” It went on to tell how Burr was planning to move westward down the Ohio and the Mississippi with about 500 or 1,000 men to meet Wilkinson and “there to determine whether it will be expedient in the first instance to seize on or pass by Baton Rouge.” Wilkinson used it, not to meet Burr, but to double-cross him. He sent one of the decipherments to President Thomas Jefferson, who promptly ordered the breakup of Burr’s expedition.

The former Vice President was arrested and tried for treason, with Chief Justice John Marshall presiding. The letter formed one of the chief exhibits. Under cross-examination, Wilkinson brazenly admitted that he had changed the document to save himself from implication. At one point he averred that the decipherment was hasty, inaccurate, and done piecemeal; at another, that it was a careful, tedious, and lengthy bit of work. This sort of vacillation by the chief prosecution witness threw a reasonable doubt on Burr’s guilt, and the jury acquitted him. But the court of public opinion, roused by the evidence of the cryptogram, convicted him. For the remainder of his life Burr could never expunge the stain on his name that his enciphered message had helped place there.

During these formative years, the black chambers of Europe did not disdain to read the communications of the fledgling nation just because it was weak and far away. As early as 1777 Britain’s black chamber was developing American letters in secret ink: the British chemists marked two of them, apparently sent between Paris and London, with “all written in white ink” and “R15th.” One has Benjamin Franklin’s name in the margin.

The following year, a letter from an American businessman in London to Franklin’s secretary in Paris was solved. In 1780, Francis Willes, Bishop Willes’ son, solved a packet of letters from the Marquis de Lafayette, then in Philadelphia, to France’s Minister of Foreign Affairs, the Count de Vergennes. One dispatch, of May 20, in an extensive two-part nomenclator, proved to be a long and informative report summarizing the overall situation as Lafayette saw it—the Continental currency has greatly depreciated, New York can be taken if the French troops arrive in time, Washington is thinking of conquering Canada, and the ability, honesty, and constancy of “mes amis Améri cains.” The packet had been thrown overboard when the vessel carrying it was captured by the British, but some tars jumped in and retrieved it. The solutions were shown to King George III, who may have obtained thereby some valuable clues as to how to conduct his American war.

Later the Decyphering Branch read correspondence between American ministers in London, The Hague, and Berlin—in the latter city a future President named John Quincy Adams—between July, 1798, and February, 1800. The letters, enciphered in a homophonic substitution, seem to have been solved in retrospective solutions. In 1841, Britain lifted the flap of a two-part U.S. nomenclator and peeked at the American minister to Spain reporting on the successful conclusion of financial negotiations with that country.

By then the Decyphering Branch had only two members. Of the three grandsons of Bishop Willes who had joined in the 1790s, just one, Francis Willes, carried on the family tradition. His brother William had assisted only briefly, and his other brother, Edward, had died in 1812, the last to hold the title of Decypherer. Francis became so overworked that he enrolled his nephew, the Reverend Mr. William Willes Lovell (apparently no relation to James Lovell) as assistant.

Nor was France idle. On September 26, 1812, the American minister, writing to President Madison, carefully enciphered the names of two French officials who were backing his claims against Napoleon and made a point of asking the President to keep them confidential. But the cryptologic descendants of the Rossignols had their own way of finding out for the Little Emperor that the two were Cambacérès and Talleyrand.

These were the dying gasps of the black chambers. The winds of change, stirred up in part by the example of the nation whose codes were being solved, in part by the machines of the Industrial Revolution, freshened into the political gales of the 1840s which blew down most of Europe’s remaining absolution and the totalitarian agencies that propped it up. Europe’s new birth of freedom tolerated no government opening of mail. In England, a tremendous public and parliamentary outcry over the surreptitious opening of letter forced the government to discontinue the interception of diplomatic correspondence in June of 1844. That October the government dissolved the Decyphering Branch, pensioning off Willes and Lovell. In Austria the Geheime Kabinets-Kanzlei closed its doors in 1848. In France, the Cabinet Noir, which had been withering ever since the Revolution, passed away as well in that convulsive year. And in that same decade, the same vast social forces that ended the era of the black chambers simultaneously fostered an invention that transformed cryptography.

Decyphering Branch solution of a 1798 diplomatic dispatch to John Quincy Adams, American Minister in Berlin

6. The Contribution of the Dilettantes

THE TELEGRAPH made cryptography what it is today. Samuel F. B. Morse sent “What hath God wrought!” in 1844. The next year his lawyer and promotional agent, Francis O. J. Smith, published a commercial code entitled The Secret Corresponding Vocabulary; Adapted for Use to Morse’s Electro-Magnetic Telegraph, in whose preface he declared that “secrecy in correspondence, is far the most important consideration.” This was provided by a superencipherment. Nine years later, an article on telegraphy in England’s Quarterly Review likewise emphasized the primacy of security:

Means should also be taken to obviate one great objection, at present felt with respect to sending private communications by telegraph—the violation of all secrecy—for in any case half-a-dozen people must be cognizant of every word addressed by one person to another. The clerks of the English Telegraph Company are sworn to secrecy, but we often write things that it would be intolerable to see strangers read before our eyes. This is a grievous fault in the telegraph, and it must be remedied by some means or other…. At all events, some simple yet secure cipher, easily acquired and easily read, should be introduced, by which means messages might to all intents and purposes be “sealed” to any person except the recipient.

As the most exciting invention of the first half of the century, the telegraph stirred as much interest in its day as Sputnik did in its. The great and widely felt need for secrecy awakened the latent interest in ciphers that so many people seem to have, and kindled a new interest in many others. Dozens of persons tried to dream up their own unbreakable ciphers. Nearly all were amateurs, the professionals (except for a few code clerks) having lost their jobs when the black chambers were abolished. A surprising number of these dabblers were intellectual and political leaders of the day who beamed their powerful and original minds on the engrossing field of cryptology. Their contributions enriched it with dozens of new cipher systems.

As businessmen and the public used the telegraph more and more, they found that their fears about lack of privacy were exaggerated. The clerks dealt impersonally with the messages. The telegraph companies respected their confidentiality. And commercial codes like Smith’s, which replaced words and phrases by single codewords or codenumbers to cut telegraph tolls, afforded sufficient security for most business transactions by simply precluding an at-sight comprehension of the meaning. The brokers and traders soon realized that the main advantage of these codes was their economy.

Smith’s pioneering venture was followed by dozens, then scores, then hundreds of commercial codes. Though a few had as many as 100,000 entries and some specialized ones only a few hundred, considerations of optimum manageability and selling price concentrated most in the neighborhood of Smith’s 50,000-entry size. They improved on his in two ways. They provided dictionary words as codewords instead of the letter-and-number groups that he had used. It was easier, cheaper, and more reliable to send ALBACORE to mean alone than the A. 1645 of Smith’s Vocabulary, And they greatly increased the number of phrases, thereby raising their toll-saving potential. Smith listed only 67 phrases, collected on a single page, compared to his 50,000 words; later codes had 10 or 20 times as many phrases as individual words.

Government ministries used the telegraph, too. At first they must have encoded with their nomenclators. But although secrecy was paramount for them, they liked the telegraphic economy of a large code—especially as they telegraphed more and more. So when the time arrived to compile a new nomenclator, they abandoned that form, copied the commercial form, and produced a full-fledged code. The nomenclators had had their 1,-or 2,000 codenumbers in mixed order, but the war and foreign ministries balked at the expense of drawing up a 50,000-entry code in two parts, and they had no professional cryptanalysts to warn them of the danger of the one-part format. They relied for security upon small editions, big safes, extensive lexicon (large codes are harder to break than small ones, other things being equal), and superencipherment, retaining codenumbers to facilitate this instead of switching to codewords. This evolution was essentially complete by the 1860s. The large, one-part code had replaced the small, two-part nomenclator in high-level military and diplomatic cryptography.

Meanwhile, the telegraph, author of this development, was creating something new in war—signal communications, or voluminous command and reconnaissance messages. Of course such messages had existed before, with torches, pigeons, and couriers, but in so rarefied a form that they were not even called “signal communications.” The telegraph enabled commanders, for the first time in history, to exert instantaneous and continuous control over great masses of men spread over large areas. It filled a need, for universal military conscription had begun to raise such armies to fight the nationalistic warfare of democracies (as contrasted with the small, professional armies that fought the dynastic wars of kings), the new railroad transported these large forces rapidly over great distances, and the industrial society supported them. These developments, together with the breech-loading gun, brought about the era of modern warfare.

No longer could a general sit horseback atop a hill and survey the battle, like Napoleon or Hannibal, sending messengers to hand-carry instructions to wheel or to counterattack. The forces engaged were too numerous, the field too vast. He had to work from a command post far in the rear, following the progress of the battle by telegraph on maps that showed more than his naked eye could ever see. He could issue orders by telegraph that would coordinate the movement of one out-of-sight wing with that of another, bring up reserves to block an enemy charge, order up food and ammunition in a hurry. The number of messages grew correspondingly. The command post became virtually a communications center.

These tactical messages required protection: telegraph wires could be tapped. Neither the old nomenclator nor the new code would do. They were too easy to capture in combat, too hard to reissue quickly and frequently to the numerous and widespread telegraph posts. Signal officers turned away from them. They looked instead to that neglected child of cryptography, the cipher. Ciphers could be printed cheaply on a single sheet of paper and distributed with ease. Secrecy was based upon variable keys, so capture of the general system and even of one of the keys would not compromise all an army’s secret messages. Solutions would be prevented by rapid key changes. Ciphers were ideal for battle-zone messages, and the first of the modern wars, the American Civil War, used them for just that. Thus was born a new genre in cryptography: the field cipher.

The first one was waiting in the wings. This was polyalphabetic substitution, in the form of the straight-alphabet Vigenère with short repeating keyword. The old objections to its use, which boiled down to the impossibility of correcting a garbled dispatch quickly enough, vanished with the telegraph. It fulfilled the requirements of noncompromisability of the general system and of ease of key changes. Moreover, it had the reputation of being unbreakable—which, if its cryptograms were not divided into words, it largely was. The military adopted it at once.

Then, in 1863, a retired Prussian infantry major discovered the general solution for the periodic polyalphabetic substitution. At one stroke he demolished the only impregnable structure in cryptography. Signal officers, compelled to provide secure communications, hunted frantically for new field ciphers. They found many good ideas in the writings of the dilettante cryptographers who had proposed ciphers for the protection of private messages. Soon some of these systems were serving in the various armies of Europe and the Americas. More ideas came from army officers who had studied cryptography in the courses in signal communication that the national military academies, such as St. Cyr, had added in the mid-1800s. Inevitably, crypt-analysts—who were either amateurs or soldiers with a professional interest, for full professionals there were none—replied with new techniques for breaking the new ciphers. From the slow crawl of nomenclator days, when the introduction of a special group meaning Disregard the preceding group would constitute a remarkable technical advance, the race between offense and defense in cryptology accelerated to its modern pace.

The history of cryptology from the decade that saw both the death of the black chambers and the birth of the telegraph to World War I is thus a story of internal development. Without Rossignols or Willeses, and without major wars or diplomatic struggles, cryptology could not influence world events, and, except for one or two unusual cases, it did not. The telegraph launched this evolution of cryptology. It broke the monopoly of the nomenclator. The nomenclator had reigned for 450 years as a general, all-purpose system, but it could not meet the new requirements either of high-level diplomatic or military communications or of low-level signal communications, which the telegraph had engendered. Each called for its own kind of cryptosystem, a specialized one. Signal officers ranked these systems in a hierarchy, rising from the simple and flexible and easily solved to the extensive and hard to solve. The telegraph thus stimulated the invention of many new ciphers and, by reaction, many new methods of cryptanalysis, and compelled their arrangement in a scale of complexity.

Many of these ciphers and techniques have become classic and are in use today. Moreover, cryptography still functions through a hierarchy and employs a multitude of special systems. The telegraph thereby furnished cryptography with the structure and the content that it still has. It made it what it is today.

All these things have antecedents, and just as the telegraph itself did, so were there precursors of the cryptographic systems that it engendered. What may be the earliest printed forerunner of the codes of today appeared at Hartford in 1805. A Dictionary; to Enable Any Two Persons to Maintain a Correspondence, With a Secrecy, Which Is Impossible for Any Other Person to Discover was a small book listing words and syllables in alphabetical order; these were to be numbered serially by the correspondents, omitting one number in every ten so that no two sets of correspondents would have the same code equivalents.

One cipher system invented before the telegraph was so far ahead of its time, and so much in the spirit of the later inventions, that it deserves to be classed with them. Indeed, it deserves the front rank among them, for this system was beyond doubt the most remarkable of all. So well conceived was it that today, more than a century and a half of rapid technological progress after its invention, it remains in active use.

But then it was invented by a remarkable man, a well-known writer, agriculturalist, bibliophile, architect, diplomat, gadgeteer, and statesman named Thomas Jefferson. He called it his “wheel cypher,” and it seems likely that he invented it either during 1790 to 1793 or during 1797 to 1800. During the first period he was America’s first Secretary of State, and the responsibilities of conducting foreign policy, the need to protect communications from England and France, the divided American cabinet, the spirit of invention that he found as administrator of the patent law, all spurred his own natural inventiveness; he was then also in contact with Dr. Robert Patterson, a mathematician of the University of Pennyslvania and vice president of the American Philosophical Society, who was interested in ciphers. During the later period, he was again in close contact with Patterson, who in 1801 sent him a cipher. Jefferson’s explanation of the wheel cypher is characteristically clear and economical:

Turn a cylinder of white wood of about 2. Inches diameter & 6. or 8.1, long, bore through it’s center a hole sufficient to recieve an iron spindle or axis of 1⁄8 or 1⁄4.I. diam. divide the periphery into 26. equal parts (for the 26. letters of the alphabet) and, with a sharp point, draw parallel lines through all the points of division from one end to the other of the cylinder, & trace those lines with ink to make them plain. then cut the cylinder crosswise into pieces of about 1⁄6 of an inch thick, they will resemble back-gammon men with plane sides, number each of them, as they are cut off, on one side, that they may be arrangeable in any order you please. on the periphery of each, and between the black lines, put all the letters of the alphabet, not in their established order, but jumbled & without order, so that no two shall be alike. now string them in their numerical order on an iron axis, one end of which has a head, and the other a nut and screw; the use of which is to hold them firm in any given position when you chuse it. they are now ready for use, your correspondent having a similar cylinder, similarly arranged.

Suppose I have to cypher this phrase. “Your favor of the 22d. is recieved.” and so on till I have got all the words of the phrase arranged in one line, fix them with the screw, you will observe that the cylinder then presents 25. other lines of letters, not in any regular series, but jumbled, & without order or meaning. copy any one of them in the letter to your correspondent. when he recieves it, he takes his cylinder and arranges the wheels so as to present the same jumbled letters in the same order in one line. he then fixes them with his screw, and examines the other 25. lines and finds one of them presenting him these letters: “your favor of the 22 is recieved.” which he writes down. as the others will be jumbled & have no meaning, he cannot mistake the true one intended. so proceed with every other portion of the letter. numbers had better be represented by letters with dots over them; as for instance by the 6. vowels & 4. liquids. because if the periphery were divided into 36. instead of 26. lines for the numerical, as well as alphabetical characters, it would increase the trouble of finding the letters on the wheels.

When the cylinder of wheels is fixed, with the jumbled alphabets on their peripheries, by only changing the order of the wheels in the cylinder, an immense variety of different cyphers may be produced for different correspondents. for whatever be the number of wheels, if you take all the natural numbers from unit to that inclusive, & multiply them successively into one another, their product will be the number of different combinations of which the wheels are susceptible, and consequently of the different cyphers they may form for different correspondents, entirely unintelligible to each other….

Jefferson went on to say that if the cylinder be six inches long (“which probably will be a convenient length, as it may be spanned between the middle ringer & thumb of the left hand, while in use”) the number of wheels would total 36, and the number of ways in which they can be strung on the spindle to form different ciphers for different correspondents would come to 36 factorial, or 1× 2×3×… ×35×36, which Jefferson calculated almost exactly as “372 with 39 cyphers [zeros] added to it.” In fact, 36 factorial is 371,993,326,789,901,217,467,999,448,150,835,200,000,000.

The U.S. Army form of Jefferson’s wheel cypher

Jefferson’s wheel cypher was far and away the most advanced devised in its day. It seems to have come out of the blue rather than as a result of mature reflection upon cryptology. Jefferson continued to use the nomenclator while he was Secretary of State, and the only indication of any cryptographic originality is his selection of a Vigenère as the official cipher for the Lewis and Clark expedition. Moreover, on March 22, 1802, he wrote Dr. Patterson, who had submitted a cipher to Jefferson as president of the American Philosophical Society, that “I have thoroughly considered your cypher, and find it so much more convenient in practice than my wheel cypher, that I am proposing it to the Secretary of state for use in his office,” a month later adding that “We are introducing your cypher into our foreign correspondences.” Patterson’s cipher was a columnar transposition with nulls at the heads of the columns, of a security in no way comparable to Jefferson’s. That Jefferson did not see this does not speak too highly of his cryptologic perceptions.

Had the President recommended his own system to Secretary of State James Madison, he would have endowed his country with a method of secret communication that would almost certainly have withstood any cryptanalytic attack of those days. Instead he appears to have filed and forgotten it. It was not rediscovered among his papers in the Library of Congress until 1922, coincidentally the year the U.S. Army adopted an almost identical device that had been independently invented. Later, other branches of the American government used the Jefferson system, generally slightly modified, and it often defeated the best efforts of the 20th-century cryptanalysts who tried to break it down! To this day the Navy uses it. This is a remarkable longevity. So important is his system that it confers upon Jefferson the title of Father of American Cryptography. And so original is it that it sets Jefferson upon a pedestal far more prominent than those accorded to men like Vigenère and Cardano, whose names are usually thought to be household words in the history of secret writing.

In 1817, another American constructed a cryptograph that, like Jefferson’s, introduced a new principle into cryptology. Colonel Decius Wadsworth, then 49, was a Yale graduate who twice quit the Army (once to seek his fortune in the fur trade) and twice rejoined when wars with France and Britain threatened; how and why he became interested in secret writing remains unknown. But his attraction to mechanical devices may well have fostered his friendship with Eli Whitney, whose cotton gin he admired and whose muskets with interchangeable parts he inspected and approved for use by the Army. When, in 1812, he became the first chief of ordnance of the U.S. Army, he again backed Whitney strongly. Illness forced him to resign this post and his commission in June of 1821, and Whitney, remembering, brought him to New Haven. Here Whitney could visit him daily and ensure his good care. But on November 8 Wadsworth died.

His innovation was to make the plaintext and ciphertext alphabets different lengths. The device in which he realized this is a brass cipher disk set in a polished wooden case six and a half inches in diameter and almost three inches high. It may have been built for him by Whitney. Its outer alphabet consists of the 26 letters plus the digits from 2 to 8 for a total of 33 elements; the inner alphabet consists of just the 26 letters. A little brass plate marks the one point around the two rings of alphabets at which they are in exact conjunction; two apertures in this plate expose the two letters, one on each ring, that are to be taken as plaintext and cipher equivalents. (No records indicate which alphabet Wads worth meant to serve as plain and which as cipher; this account assumes the inner to be the plain alphabet.) These two rings of the disk, both of which revolve, are connected to one another inside the case by two gears, one with 33, the other with 26 teeth. The letters and numbers of the outer ring are stamped on brass plugs which may be assembled in any order. Before enciphering, the correspondents agree on a mixed sequence for the ciphertext ring and on a starting juxtaposition for the two sections, such as, say, R in the outer disk opposite V in the inner; the gears may be disengaged to permit this setting.

Suppose, now, that the correspondents are in the Peruvian wool trade and that their message begins with llama—a word admirably suited to demonstrate the cryptographic workings of their device. The encipherer will spin the inner disk by means of a little knob on it until the first l appears in the inner aperture of the brass plate; he will write down the letter in the outer aperture as the first cipher letter. Then he will turn the inner disk until l appears again in the inner aperture. The gears will have transmitted this motion to the outer ring, but because of the difference in the size of the alphabets, the outer disk will have gone through only 26⁄33rds of a revolution while the inner has completed a full revolution. Consequently, the second ciphertext letter will stand seven places farther forward in the outer alphabet than the first, even though both represent the same plaintext letter. If this process is kept up, the cipher equivalents for l would not begin to repeat until all 33 letters and digits of the outer alphabet had been used. This is because 26 and 33 have no factors in common to bring them into conjunction earlier.

The encipherment thus constitutes a progressive system in which all the cipher alphabets are used, like Trithemius’ original polyalphabetic encipherment. But the disparity in length between the plain and the cipher alphabets results in two crucial differences. One is that the Wadsworth device employs 33 cipher alphabets instead of the 24 of Trithemius. The other is that these alphabets are brought into play, not one right after another, but in an irregular manner—a manner that depends on the letters of the plaintext. This irregularity defends the cipher much better than Trithemius’ regular progression.

Knowledge of Wadsworth’s device, which could not have been widely disseminated even while he lived, faded completely soon after he died. Consequently, credit for the discovery of the principle of sliding two alphabets of different lengths against one another has usually been awarded to a widely known British scientist who independently devised a mechanism based on it.

Charles Wheatstone had a remarkably fertile mind. He constructed an electric telegraph before Morse did, invented the concertina, improved the dynamo, studied underwater telegraphy, produced some of the first stereoscopic drawings, published half a dozen papers on acoustics, discussed phonetics and hypothetical speaking machines in print, conducted numerous electrical experiments, and popularized a method for the extremely accurate measurement of electrical resistance now in frequent use and called the “Wheatstone bridge.” His work was highly enough regarded for him to be elected a fellow of the Royal Society and to be knighted. He was nominally professor of experimental philosophy at King’s College, London, but was so excessively shy that he hardly ever actually lectured. Around 1860, in his late fifties, he solved a long cipher letter of Charles I. It consisted of seven folio pages filled with numerals, each page signed at the top by the king; it proved to be instructions in French for the Sieur de Goffe, enciphered in a small one-part nomenclator (a = 12, 13, 14, 15, 16, 17; b = 18, 19; France = 478).

Wheatstone first displayed his Cryptograph at the Exposition Universelle at Paris in 1867. It differed only in detail from Wadsworth’s. The Wheatstone apparatus had an outer plaintext alphabet of 27 elements—the 26 letters in normal order plus a blank for a word space—and an inner, mixed ciphertext alphabet of the 26 letters. Over these alphabets swung two clocklike hands, which were connected by gears. “At the commencement [of encipherment],” Wheatstone’s instructions read, “the long hand must correspond with the blank of the outer circle and the short hand be directly under it. The long hand must be brought successively to the letters of the despatch (outer circle), and the letters indicated on the inner circle by the short hand must be written down. At the termination of each word the long hand must be brought to the blank, and the letter indicated by the short hand also written down. By this arrangement, the cipher is continuous, no intimation being given of the separation of the words. Whenever a double letter occurs, some unused letter (as, for instance, q) must always be substituted for the repeated letter; or the latter may be omitted.” The variation in the length of the two alphabets means that as the larger hand is completing a revolution, the smaller is already one cell into its second.

The Wheatstone cipher machine, with plaintext alphabet outside, cipher inside

The device’s simplicity, automaticity, apparent insolubility, and compactness impressed many visitors to the exposition. One of them was Colonel Laussedat of the French commission that looked for military possibilities among the exhibits; he reported favorably on the Wheatstone Cryptograph, even to the point of stating that it “assures the most absolute secrecy.”

In fact, a cryptogram produced by this instrument is less secure than a Wadsworth because the Wheatstone difference in alphabet sizes amounts to only one unit. As a result, a doubled ciphertext letter can mean only that their two plaintext letters represent letters in reverse alphabetical order, such as the common digraph on or ts. These may afford a break into the system. Indeed, this very observation was made, and a solution elucidated by attacking sentences as probably starting with the, in an extremely perceptive article signed only “C.P.B.” and published in Macmillan’s Magazine just four years after Wheatstone exhibited his apparatus.

It is another of the many ironies of cryptologic history that Wheatstone’s name adheres to a device that owes its priority to another and that never achieved importance, while a cipher that he did originate, and that served with distinction for many years, bears the name of another. Wheatstone invented the cipher for secrecy in telegraphy, but it carries the name of his friend Lyon Playfair, first Baron Playfair of St. Andrews. A scientist and public figure of Victorian England, Playfair was at one time or another deputy speaker of the House of Commons, postmaster general, and president of the British Association for the Advancement of Science. As a commissioner on the public health of towns, he helped lay the foundations of modern sanitation. He lived across London’s Hammersmith Bridge from Wheatstone. Because both were short and bespectacled, they were frequently mistaken for one another—once even by Lady Wheatstone. They walked together on Sundays and amused themselves by solving the enciphered personal messages in the London Times. They easily read the correspondence of an Oxford student with his young lady in London, and when the student proposed an elopement, Wheatstone inserted an advertisement in the same cipher remonstrating with her. There followed a frantic “Dear Charlie: Write no more. Our cipher is discovered!”—and then silence.

Playfair demonstrated what he called “Wheatstone’s newly-discovered symmetrical cipher” at a dinner in January, 1854, given by the president of the governing council, Lord Granville. One of the guests was Queen Victoria’s husband, Prince Albert; another was the Home Secretary and future Prime Minister, Lord Palmerston. Playfair explained the system to him, and, while in Dublin a few days later, received two short letters in the cipher from Palmerston and Granville, showing that both had readily mastered it.

The earliest known description of the Playfair cipher, signed by its inventor, Charles Wheatstone, March 26, 1854

The cipher is the first literal one in cryptologic history to be digraphic{20}—that is, to encipher two letters so that the result depends upon both together. Wheatstone recognized that the cipher would work as well with a rectangle as with a square, but it soon petrified into the latter form. Wheatstone also employed a thoroughly mixed cipher alphabet, which he generated by a keyword transposition—one of the earliest instances of such a method. Beneath a keyword he would write the remaining letters of the alphabet, and then derive the mixed alphabet by reading the columns vertically:

Which yields: MBPYADQZGFRNHSEJUTKVILWCOX. This important feature soon slipped out of the picture as the cipher fell to the lowest common denominator, just like Vigenère’s. The keyword was instead inscribed directly into a 5 × 5 square with the remaining letters of the alphabet following. (I and J are merged in a single cell.) The practice lessened security but facilitated operation. It may well have been the way Playfair hastily constructed a keysquare based on PALMERSTON to illustrate the cipher at Granville’s dinner:

To encipher, the plaintext is divided into pairs. Double letters occurring together in a pair must be separated with an x, so that balloon would be enciphered as ba lx lo on; i and j are regarded as identical, so that adjacent will be enciphered as if it were adiacent. Now the letters of each pair may stand in only three relationships to one another with the key square: the two may appear in the same row, in the same column, or in neither. Letters that fall in the same row are each replaced by the letter to its right. Thus, am = LE, hi = IK, os = NT. Each row is considered cyclical, so that the letter to the right of the last letter in a row is the first letter at the left of that row. Thus, le = MP, ui = HK. Letters that appear in the same column are each replaced by the letter beneath it; the cyclical provision holds. Thus, ac = SJ (or SI, as the encipherer wishes); of = FQ, wi = AW, br = HB.

If the plaintext letters appear in neither the same row nor the same column, each is replaced by the letter that lies in its own row and stands in the column occupied by the other plaintext letter. For example, to encipher sq, the encipherer first locates them in the square. Then he runs across the row of the first plaintext letter (s) until he meets the column in which the second plaintext letter (q) stands:

The letter at the junction of row and column (o) becomes the first cipher letter. Then the encipherer traces across the row of the second plaintext letter (q) until he intersects the column in which the first plaintext letter stands:

The letter at the intersection (I) becomes the second cipher letter. Thus sq = OI. Other encipherments are af = MC, at = LS, ed = LG. The letter in the row of the first plaintext letter is always taken first to preserve the order of the letters, so that cl = DA and not AD, which would stand for lc, and we = ZA.

Decipherment in this is precisely the same as encipherment: if ow = SY, then sy = OW. In the other two cases, the plaintext letters are found to the left or above the ciphertext letters. Thus, using the same square, a ciphertext reduces as follows:

The z at the end is a null to complete the final digraph.

Wheatstone and Playfair explained the cipher to the Under Secretary of the Foreign Office, no doubt pointing out its chief advantage—that two plaintext pairs that have a letter in common may not display the slightest resemblance in ciphertext, as le and te above were enciphered to MP and NL. Further, once mastered, it rolls along with remarkable ease and rapidity. When the Under Secretary protested that the system was too complicated, Wheatstone volunteered to show that three out of four boys from the nearest elementary school could be taught it in 15 minutes. The Under Secretary put him off. “That is very possible,” he said, “but you could never teach it to attachés.”

Playfair, reasoning that this reflected more on the diplomats than on the cipher, remained enthusiastic about it. There were good grounds for enthusiasm. In the first place, the cipher’s being digraphic obliterates the single-letter characteristics—e, for example, is no longer identifiable as an entity. This undercuts the usual monographic methods of frequency analysis. Secondly, encipherment by digraphs halves the number of elements available for frequency analysis. A 100-letter text will have only 50 cipher digraphs. In the third place, and most important, the number of digraphs is far greater than the number of single letters, and consequently the linguistic characteristics spread over many more elements and so have much less opportunity to individualize themselves. There are 26 letters but 676 digraphs; the two most frequent English letters, e and t, average frequencies of 12 and 9 per cent; the two most frequent English digraphs, th and he, reach only 3¼and 2½ per cent. In other words, not only are there more units to choose among, the units are less sharply differentiated. The difficulties are doubly doubled.

These properties elevated the cipher above most of its contemporaries purely on cryptographic considerations; it was, probably, regarded as unbreakable. Its many practical excellences—no tables or apparatus required, a keyword that could easily be remembered and changed, great simplicity of operation—commended it as a field cipher. Playfair suggested that it be used as just that in the impending Crimean War when he brought it up at the dinner with Prince Albert. No evidence exists that it was used then, but there are reports that it served in the Boer War. Britain’s War Office apparently kept it secret because it had adopted the cipher as the British Army’s field system. Playfair’s unselfish proselytizing for his friend’s system unwittingly cheated Wheatstone of his cryptographic heritage; though Playfair never claimed the invention as his own, it came to be known in the War Office as Playfair’s Cipher, and his name has stuck to it to this day.

In England in 1857, a 4×5-inch card with an alphabet square printed in red and black went on sale for sixpence. It was a new system of secret writing “adapted for telegrams and postcards,” the latter an even newer form of communication than the telegraph. Admiral Sir Francis Beaufort, R.N., creator of the Beaufort scale with which meteorologists indicate wind velocities by numbers from 0 (calm) to 12 (hurricane), had originated the cipher, and his brother had published it a few months after the admiral’s death. The envelope for the card carried the directions: “Let the key for the foregoing table be a line of poetry or the name of some memorable person or place, which cannot easily be forgotten…. Now look in the side column for the first letter of the text (t) and run the eye across the table until it comes to the first letter of the key (v), then at the top of the column in which v stands will be found the letter c,” which would be the ciphertext.

The alphabet square is essentially the same as the Vigenère, except that it repeats the normal alphabet on all four sides, so that the square extends 27 letters across and 27 down and has A at all four corners. Its encipherment equals that of a Vigenère with reversed alphabets. The system had been originally proposed almost 150 years before Beaufort by one Giovanni Sestri, in a book published in Rome in 1710 that had been widely ignored. But under Beaufort’s name the cipher became a standard in the repertory of cryptology, though its theoretical importance is minor.

It has also given rise to a system called the Variant Beaufort. In this, the encipherer starts, not with the plaintext letter but with the keyletter, traces in to the plaintext letter, and then turns upward to emerge at the ciphertext. Actually, the system might better be called the Variant Vigenère, for to decipher it the clerk must perform the operation that constitutes a Vigenère encipherment: find the keyletter on the side and the ciphertext letter at the top, and run into the tableau from both until the plaintext letter is located at the junction. Vigenère and Variant Beaufort thus invert one another—the encipherment of one serves as the decipherment of the other. True Beaufort, on the other hand, is reciprocal within itself, since the same operation of starting with the known letter, tracing in to the keyletter, and rising to find the unknown works for both encipherment and decipherment.

Two years later, an American who at the time was working for a stove and foundry firm gave, like Beaufort, the merest glance to cryptology. Like Beaufort, the result was a single short piece of work. But unlike the admiral’s, this work opened important new vistas into untrodden lands, and then sank immediately into a cryptologic obscurity as undeserved as Beaufort’s renown.

The inventor was Pliny Earle Chase, then 39, who, after entering Harvard as a prodigy at 15, taught in Philadelphia for seven years until his health forced him into less tiring work in business. In 1861 he resumed teaching, becoming professor of natural science and then professor of philosophy and logic at Haverford College near Philadelphia. He was an absorbing lecturer, particularly in astronomy, and he collaborated on an arithmetic textbook with Horace Mann. But perhaps his most notable accomplishment was his writing more than 250 articles for scholarly magazines. Among them was the one that he penned in 1859 which covered barely three pages in the new Mathematical Monthly, but which constitutes the first published description of fractionating, or tomographic, cipher systems.

The basis of these ciphers stretches back across the millennia to Polybius, the Greek historian of the second century B.C. who distributed the alphabet in what is even today sometimes called a “Polybius square,” but more often a “checkerboard.” Numbers at the side and top indicate the row and the column of a given letter. Similar systems have cropped up throughout cryptography. Some replace the alphabet by three symbols in groups of three (a = 111, b = 112, c = 113, d = 121, etc.), some by two in groups of five (a = 00000, b = 00001, c = 00010, etc.). But no one seems to have seen the symbols as manipulable entities instead of just as an unalterable part of the whole.

Until Chase. He severed the coordinates from one another and subjected the resulting fractions to various cryptographic treatments. He began with a checkerboard filled out to ten columns with Greek letters:

Chase wrote his coordinates vertically, so that his sample plaintext, Philip, appeared like this:

He then multiplied the lower line by 9, obtaining the result:

This he restored to literal form by resubstituting back in his checkerboard, 8 (by itself) = L, J, or T, then 16 = N, 33 = S, 39 = I, and so on, with the final ciphertext LNSIΦIX.

Chase proposed other means of transforming the bottom row, such as adding a repeating key or giving the logarithm of the row, and pointed out that even more intricate processes might be used. “But the simpler cypher, provided it is effectual, is the better,” he wisely concludes. The Chase systems grant a fairly hermetic security; they are, besides, relatively simple to operate. Yet cryptologic history shows no one ever having used them, even though they are far superior to many systems that have seen service.

Most remarkable of the Victorian congregation of cryptologists was the Lucasian Professor of Mathematics at Cambridge, the pioneer who enunciated the principles on which today’s huge electronic computers are based and who himself built their prototypes: Charles Babbage. Most of his cryptologic work was never published and hence never played a role in the science, but it was astonishingly advanced. He was among the first to use mathematical notations and formulas in cryptanalysis; he solved polyalphabetics at a time when the system was still regarded as “le chiffre indéchiffrable;” he appears to have been the first to solve an autokey. The few words that he wrote on the subject are pregnant with observations that bespeak an extraordinary grasp of it.

Born in 1792, he inherited a considerable fortune from his father, a banker. This financed his many interests—studies of railways, archaeology, submarine navigation, occulting lighthouses, tree rings as an indicator of ancient climate, lock picking (for scientific purposes only), what is now known as operational research, and his long, bitter, and totally unavailing campaign against his pet hate—organ-grinders in the streets of London. Babbage was fascinated by statistical phenomena, compiling tables of mortality and logarithms, counting the proportion of letters in various texts, and measuring the pulse and breathing rate of any animals he encountered. Cryptology may have been an offshoot of his statistical interest, which also led to his lifelong attempt to apply machinery to the calculation of mathematical tables. A paper on this at 30 brought him the first gold medal of the Astronomical Society, and Babbage spent the rest of his life trying to realize his vision in his Difference and Analytical Engines. He even resigned his Cambridge professorship after seven years to devote himself more completely to them.

His problem was that he never finished anything. With his two mathematical machines, he was forever getting new ideas and scrapping all that he had done. The government’s exasperated withdrawal of financial support (which he had largely matched out of his own pocket) because nothing concrete had been accomplished turned Babbage later in life from a social fellow of interesting conversation and a good sense of humor into a bitter man. Though he took his disappointment to the grave at 78, his ideas ultimately triumphed and, in particular, the logical structure of his Analytical Engine remains fully visible in the big electronic computers of today.

The opening words of the short essay he published on cryptology will ring a familiar bell in the minds of amateurs who have worked until 3 a.m. on a teaser: “Deciphering is, in my opinion, one of the most fascinating of arts, and I fear I have wasted upon it more time than it deserves.” Like his acquaintances Wheatstone and Playfair, Babbage delighted in solving the enciphered personal advertisements that abounded in the newspaper “agony columns;” this may account for his further observation that “very few ciphers are worth the trouble of unravelling them.”

Babbage is also the only person known to have suffered corporally for his cryptanalyses. It happened at school: “The bigger boys made ciphers, but if I got hold of a few words, I usually found out the key. The consequence of this ingenuity was occasionally painful: the owners of the detected ciphers sometimes thrashed me, though the fault lay in their own stupidity.”

His reputation for cryptanalytic ability did not wane in later life, though its rewards became less punishing. In July of 1850, he solved a cipher of Henrietta Maria, queen of Charles I, though he turned down the task of solving the seven-page cryptogram of the king, instead recommending Wheat-stone, who succeeded. He solved a note in a kind of shorthand that threw some light on a historical point for the author of a life of John Flamsteed, England’s first Astronomer Royal. On April 20, 1854, barrister S. W. Kinglake wrote Babbage from Lincoln’s Inn asking for help in solving some cryptic correspondence of importance in a case. Babbage undertook the task himself, solved a sheaf of monalphabetically enciphered letters, and read such intimacies as Where is it to end and You have had warnin[g] long ago of what I wished.

During these years he was also solving polyalphabetics. The messages retained their word divisions, and Babbage seized on these to make his entries. For example, in 1846, he broke an enciphered letter from his nephew, Henry, by guessing that it began Dear Uncle and ended with nephew and Henry. The cryptogram was in Vigenère, the key SOMERSET. He demonstrated a lively appreciation of periodicity—the repetition of the key—and, replying to a public challenge, even managed to extricate the two primary keys TWO and COMBINED from a complicated invented cipher that amounted to a double encipherment in Vigenère, first-by one key, then by the other.

“One of the most singular characteristics of the art of deciphering,” he declared in his autobiography, Passages from the Life of a Philosopher, “is the strong conviction possessed by every person, even moderately acquainted with it, that he is able to construct a cipher which nobody else can decipher. I have also observed that the cleverer the person, the more intimate is his conviction. In my earliest study of the subject, I shared in this belief, and maintained it for many years.

Charles Babbage uses mathematics to solve a cipher

“In a conversation on that subject which I had with the late Mr. Davies Gilbert, President of the Royal Society,” he continued, “each maintained that he possessed a cipher which was absolutely inscrutable. On comparison, it appeared that we had both imagined the same law.” This proved to be the use of each cipher letter as the key for the following plaintext letter. Both Babbage and Gilbert had independently reinvented, with a mixed alphabet, the autokey of Cardano and Vigenère—though Babbage readily admitted that “I am not sure that it may not be found in the Steganographia of Schott, or even of Trithemius.” Years later, while explaining the cipher to a friend, “an indistinct glimpse of defeating it presented itself vaguely to my imagination.” He went on to solve it, aided, no doubt, by word divisions, but achieving nevertheless the first autokey solution in history. The mixed cipher alphabet raises this to the level of a substantial accomplishment indeed.

Babbage most strikingly demonstrated his originality of thought when he applied algebra to cryptology. His papers are filled with formulas which he used to help him solve ciphers and see their underlying structure more clearly. Unfortunately his notes are too scrappy and incomplete to give any more than a tantalizing glimpse of what he was trying to accomplish. His most imposing formula, which he jotted down on worksheets dealing with a numerical cryptogram sent him by Gilbert, is this:

It may have been as efficacious as it is formidable, but neither an index to its symbolism nor any clue to its purpose exists.

Babbage’s talents in cryptology appear to have been as exceptional as they were in other fields, and they were crippled by the same defect: the inability to leave off improving and to finish a work despite its imperfections. Had he published any specifics of his cryptanalyses, their insights might have upended the science. But his flaw robbed him of this distinction.

Of the man who did explode the bomb that gouged new channels for cryptology, little more is known than the bare outline provided by his service record. This is complete if not detailed, for Friedrich W. Kasiski spent his entire professional career as an officer in East Prussia’s 33rd Infantry Regiment. Born November 29, 1805, in what was then Schlochau, West Prussia, and is now Czluchow, Poland, he enlisted in the regiment at 17. He won his commission as a second lieutenant three years later, in 1825—and did not budge out of that rank for 14 years. But he remained a first lieutenant only three years before he was promoted to captain and company commander, a post he held for nine years. He retired in 1852 with the rank of major, and though he served from 1860 to 1868 as the commander of a National Guard-like battalion, he found sufficient leisure to devote some to cryptology, for in 1863 his short but epochal book was published in Berlin by the respected house of Mittler & Sohn.

Three quarters of Die Geheimschriften und die Dechiffrir-kunst concentrates on answering the problem that had vexed cryptanalysts for more than 300 years: how to achieve a general solution for polyalphabetic ciphers with repeating keywords. (One chapter zeros in on “The Decipherment of French Writing”—a rather ominous portent in a book dedicated to the Count Albrecht von Roon, the Prussian minister of war who molded the army that humbled France only seven years later.) The polyalphabetic solution opened the doors to the cryptology of today. But the 95-page volume seems to have stirred almost no comment at the time. Kasiski himself lost interest in cryptology. He became an avid amateur anthropologist, joining the Natural Science Society of Danzig, unearthing prehistoric graves, and reporting on his work to learned journals. (One of his scholarly articles was cited in the Encyclopaedia Britannica.) Kasiski died on May 22, 1881, almost certainty without realizing that he had wrought a revolution in cryptology.

That revolution had begun when Kasiski seized upon a phenomenon that Porta and perhaps others had observed but not recognized. This is that the conjunction of a repeated portion of the key with a repetition in the plaintext produces a repetition in the ciphertext:

Each time that the key RUNR engages the repeated plaintext to be, the repeated ciphertext tetragraph KIOV results. Like causes produce like effects. Similarly, when the repeated key-fragment UN operates upon the repeated th’s, the ciphertext registers repeated NU’s.

Clearly, the keyword must repeat one or more times for a given part of it to encipher two identical bits of plaintext several letters distant from one another. The number of letters between the two resultant ciphertext repetitions will record the number of times that the keyword has repeated. The count of the interval “between” the two repetitions actually includes repeated letters. Thus the interval between the first KIOV and the second is 9, figured like this: 5 letters not repeated and 4 that are. This interval of nine results from the fact that the keyword has three letters and has repeated three times. These repetitions betray the movements of the keyword beneath the surface of the cryptogram just as the ducking of a fishing cork tells of a nibble. Analysis of the intervals between the repetitions can disclose the length of the keyword.

Obviously, not all plaintext repeats will show up as ciphertext repetitions. The two ti’s of that is and question do not because they are enciphered by different key digraphs, nor do the st’s of is the and question. Furthermore, repetitions sometimes appear that are no more than the result of coincidence. For example, th keyed by CO will become vv in Vigenère, but so will ir keyed by NE. Two appearances of vv thus do not indubitably reflect a repetition of plaintext th. These spurious indications are usually called “accidental” repetitions in polyalphabetic cryptanalysis to distinguish them from the “true” repetitions, like KIOV.

Accidental repetitions will naturally give some false clues about the length of the keyword. But since their effect is diffused, whereas that of the true repetitions is concentrated, the real keyword length usually shows up fairly clearly. Knowledge of how many letters are in the keyword tells how many alphabets were used in the polyalphabetic encipherment. This information permits the cryptanalyst to sort the letters of the cryptogram so that all those enciphered with the first keyletter are brought together in one group, all those enciphered with the second keyletter in another group, and so forth. Since all of the, say, e’s in the first group were converted under the influence of a single keyletter to the same ciphertext letter, all of the a’s to one ciphertext letter, and so on, each of these collections of letters constitutes a monalphabetic substitution cipher and so can be solved like one.

An example using the following cryptogram should make this clear:

Repetitions of three letters or more have been underlined; bigraphic ones have been ignored here as too frequent, though in shorter cryptograms they are quite valuable. The monoliteral frequency count is:

It differs strikingly from the count of a monalphabetic substitution. All 26 letters appear several times, while several would be missing from an equally long monalphabetic cryptogram. No one letter stands out remarkably; the two most frequent reach only 7.7 and 6.3 per cent, compared to the 12 per cent in a monalphabetic substitution. The profile shows no plateaus of high-, medium-, low-, and rare-frequency letters. Instead it descends in a gentle, even slope. These characteristics result from the dispersal of individual letter-frequencies among the several alphabets.

With the repetitions located, Kasiski advised the cryptanalyst to “calculate the distance separating the repetitions from one another…. and endeavor to break up this number into its factors…. The factor most frequently found indicates the number of letters in the key.” Cryptanalysts usually perform this operation—now called a “Kasiski examination”—in tabular form.

positions
repetition	first	second	interval	factors
YVGYS	3	283	280	2×2×2×5×7
STY	7	281	274	2×137
GHP	28	226	198	2×3×3x11
ZUDLJK	52	148	96	2×2×2×2×2×3
LEEBMMTG	99	213	114	2×3×19
SEZM	113	197	84	2×2×3×7
ZMX	115	163	48	2×2×2×2×3
GEE	141	249	108	2×2×3×3×3	The most frequent factor is 2, which appears in every instance. But since 2 must be a factor in every even interval, and since keys as short as 2 or 3 letters are extremely unlikely, cryptanalysts usually consider only lengths of and above. In the above list, 4, or 2×2, occurs in five of the eight intervals, in only one, 6 in six, 7 in two, 8 in two, 9 in two, 12 in four, and all others except multiples of these (as 18 and 24) occur but once. At first, 6 seems to be the proper choice on the basis of frequency. On second thought, however, 12 makes an even better showing, considering that a repetition has only half as many chances to show up in a period of 12 as in one of 6. But then the cryptanalyst, checking, sees that the period of 12 would make the 2×3×19 interval of LEEBMMTG an accidental one, which is exceedingly unlikely, and that a period of 6 would keep it as a key-caused repetition. He therefore returns to the period of 6. The behavior of the YVGYS repetition can only be ignored for the moment.

The cryptanalyst then writes out the cryptogram in lines six letters wide, thus setting beneath one another all the letters presumed enciphered with the same keyletter. He segregates each column and attempts to find the plaintext equivalents of the letters in each one. With the above cryptogram, he finds the following 48 letters in the first column. These represent all the letters homogeneously enciphered by the first keyletter (if the period of 6 is correct) and constitute the 1st, 7th, 13th, 19th, 25th, 31st, and so on, letters in the cryptogram: ASLKVHUWZLJUKHMSGMSZKUWWSLHZWUTJAZSJ MVEWUYJGJJSY.

Meager though its frequency count is, it indubitably reflects a monalphabetic substitution; a polyalphabetic count would be much smoother:

This is an encouraging sign to the cryptanalyst, for only if his deduction about the period is correct will such a count be monalphabetic.

To the experienced eye, the little hills and dales of that frequency count limn one thing: the normal profile. This is the outline made by the standard frequency count (of English). It does not have to start at a; it preserves its shape even in cyclical form, and, when dealing with the Caesar alphabets of the Vigenère family, this is the form in which the cryptanalyst will most often meet it. The single most durable and detectable feature of the normal profile is the long, low peneplane of uvwxyz, which extends almost a quarter of the profile and is extremely depressed. This basin is sharply walled off by the rst cordillera at one end and the single peak of a at the other. The other features of the profile are more easily eroded by decreases in size of sample. The pinnacle of e normally soars midway between a and the double tower of hi, which is followed by the severe drop to jk. High-frequency n and o also rise to twin peaks. In short samples, however, the troughs of the profile are often more reliable indicators than the crests.

This physiognomy appears, in stunted form, in the count above. The low-frequency depression is unmistakable at NOPQR. The rst group cannot bematched with KLM, for then high-frequency J would represent q and the high-frequency S would represent z. It must thus coincide with JKL, and though this gives plaintext u a slightly disproportionate frequency, it is one well within the allowable limits. Plaintext c also has too high a frequency, but this is one of the normal abnormalities that the cryptanalyst must expect. In general, then, the match is satisfactory. If both the plain and cipher alphabets are known, as they are here, being both normal alphabets, the identification of a single plaintext letter will align the cipher alphabet with the plain alphabet and thus instantaneously yield the identification of every other cipher letter. In this case, the cryptanalyst fixes the alignment of the plain and the cipher components at the “point” uvwxyz = MNOPQR, with this result:

This can be cycled to bring the plaintext a to the head, which is the more usual arrangement, but the plain-to-cipher equivalencies will remain the same. These equivalents are, for the 48 letters enciphered by the first keyletter:

This is quite an acceptable aggregation of plaintext letters, and the solution picks up momentum.

Perhaps the most important thing that the cryptanalyst learned from the identification of the alphabet as the normal profile was that the cipher belonged to the Vigenère family. This opens the door to a whole variety of special techniques. These are based on the fact that the alphabet, in this family of ciphers, is known. The techniques would work as well for any other polyalphabetic cipher in which the cipher alphabet is known to the cryptanalyst, but such situations arise far more frequently with the Vigenère family because the standard A-to-Z arrangement that it employs is universally known and extensively applied.

One of these special techniques identifies plaintext letters mechanically. It employs cardboard strips with the alphabet printed on them twice, the nine high-frequency letters (e, t, a, o, n, i, r, s, h) in red, the others in black. The cryptanalyst aligns the strips under one another to bring the ciphertext letters into a column. The other columns that are automatically formed out to the right represent all the possible solutions for that aggregation of ciphertext letters. The cryptanalyst scans them to see which one is the reddest by virtue of having the most high-frequency letters. Probability theory can predict how likely it is that the reddest column will be the correct one: with nine cipher-text letters, 42 per cent; with twelve, 61 per cent; with fifteen, 74 per cent. If the next-to-reddest column is included, the probabilities that either it or the reddest will prove the correct plaintext rise to 74, 85, and 90 per cent, respectively.

A practical drawback is that since nine letters comprise fully a third of the alphabet, most columns will look fairly red. It is easier to cast out the wrong columns than to choose the right one, and the best criterion for rejection is the presence of too many rare letters. The color principle may be applied to them: blue for the five low-frequency letters. This technique illustrated in printed form in the accompanying table by using boldface for j, k, q, x, and z. The ciphertext letters shown are the first ten that have been enciphered by the second keyletter (the 2nd, 8th, 14th, 20th, 26th, and so on, letters of the cryptogram). Now the five low-frequency letters combined have a frequency of about 2 per cent. In a text of 48 letters like this, then, the five should have a total frequency of one letter. The cryptanalyst will be playing it safe if he passes over any full column with three or more boldface letters.

On this basis, only the column beginning flop is acceptable. When these letters are paired with those that would precede them in the plaintext, the correctness of both choices becomes incontrovertible:

From this point on, the cryptanalyst can complete the solution by guessing at words and seeing what effects they produce. For example, the he screams for a t to precede it; this would be the E in column 6. A test decipherment with the alphabet in which t = E, which, in Vigenère, is the alphabet of keyletter L, proves eminently satisfactory: e, e, n, t, a, r, m, ….

In the end, the key turns out to be SIGNAL and the plaintext to be as follows: If signals are to be displayed in the presence of an enemy, they must be guarded by ciphers. The ciphers must be capable of frequent changes. The rules by which these changes are made must be simple. Ciphers are undiscoverable in proportion as their changes are frequent and as the messages in each change are brief. From Albert J. Myer’s Manual of Signals.

The longest repetition, LEEBMMTG, resulted from the coincidence of the repeated frequent with the key GNALSIGN, and the next longest, ZUDLJK, from the coincidence of the two must be’s with the key NALSIG. On the other hand, the threefold repetition of ciphers and the fourfold repetition of change did not pole through the fabric of the ciphertext because each encountered different sections of the key. The accidental repetition YVGYS resulted from a freak situation in which the key GNALS enciphered signa and then the key SIGNA enciphered gnals. Accidental repetitions longer than trigraphs are extremely rare, though they have been known to occur.

What if the alphabets used in the repeating-key system are unknown? The cryptanalyst is faced with the problem of quarrying out plaintext letter after letter, since a single identification will not carry all with it. Usually he conducts a linguistic analysis, and on the basis of contacts, frequency, and so forth, makes a few tentative assumptions. These follow the lines laid down for monalphabetic substitutions. He substitutes these assumptions back into the cryptogram and reconstructs the plaintext bit by bit, often aided by a recovery of the key and reconstruction of the cipher alphabets. The process usually requires 40 to 60 letters per keyletter for success.

7. Crises of the Union

SHORTLY AFTER the fateful guns spoke at Fort Sumter, a 36-year-old telegrapher was summoned to the Cincinnati house of the commander of the military Department of the Ohio. Anson Stager had risen rapidly to become the first general superintendent of the newly formed Western Union Telegraph Company; on mobilization, he had been given charge of the Department of the Ohio’s military telegraphs. He had previously devised a cipher for Ohio’s Governor Dennison that had worked just fine in communication with his gubernatorial colleagues in Indiana and Illinois, and Major General George B. McClellan wanted Stager to draw up a military cipher along these lines.

Stager complied. Soon McClellan was relying on the cipher to protect his communications during his successful campaign in West Virginia, and Major General John C. Frémont, commander of the Western Department, transmitted orders for his operations in it. One of its very first users was the detective Allan Pinkerton, founder of the agency that bears his name. The key of the cipher was so short that one colonel carried it on the back of a business card. Its brevity and dependability endeared it to McClellan, who brought it with him later in 1861 when he came east to assume command of the Army of the Potomac. From there it spread rapidly throughout the Union forces, becoming the best as well as the best-known cipher of the Civil War. It was the first military cipher to be used extensively, largely because the Civil War first employed the telegraph on a large scale.

The cipher was a word transposition. Stager’s telegraphic experience evidently led him to a system in which the ciphertext consisted—as in the new telegraph codes—of ordinary words, which are far less subject to dangerous garbles than groups of incoherent letters. The system also had an appealing simplicity: the plaintext was written out in lines and transcribed by columns, up some and down others in a specified order. As the war progressed, some simple improvements noticeably strengthened it. Nulls ruffled the transcription. Routes traced mazes of diagonals and interrupted columns through ever larger rectangles. Samuel H. Beckwith, Ulysses S. Grant’s cipher operator, suggested that important terms be represented by codewords which he carefully chose to minimize telegraphic error. The cipher expanded from one that could be contained on a single card to one that, at the end of the war, required 12 pages to list routes and 36 for the 1,608 codewords. This was Cipher No. 4, the last of a series of 12 that the North employed at various times.{21}

A good example of the system is given by the encipherment of this message sent by Abraham Lincoln on June 1, 1863: “For Colonel Ludlow. Richardson and Brown, correspondents of the Tribune, captured at Vicksburg, are detained at Richmond. Please ascertain why they are detained and get them off if you can. The President.” Cipher No. 9 was in use, and it provided the following codeword substitutions: VENUS for colonel, WAYLAND for captured, ODOR for Vicksburg, NEPTUNE for Richmond, ADAM for President of U.S., and NELLY for 4:30 p.m., the time of dispatch. The encipherer chose to write out the message in seven lines of five words each with three nulls to complete the rectangle:

For	VENUS	Ludlow	Richardson	and
Brown	correspondents	of	the	Tribune
WAYLAND	at	ODOR	are	detained
at	NEPTUNE	please	ascertain	why
they	are	detained	and	get
them	off	if	you	can
ADAM	NELLY	THIS	FILLS	UP

The route for this configuration ran up the first column, down the second, up the fifth, down the fourth, up the third. Nulls were inserted at the end of each column. With the keyword GUARD heading the message to indicate the size of the rectangle and its route, this ciphertext resulted: GUARD ADAM THEM THEY AT WAYLAND BROWN FOR KISSING VENUS CORRESPONDENTS AT NEPTUNE ARE OFF NELLY TURNING UP CAN GET WHY DETAINED TRIBUNE AND TIMES RICHARDSON THE ARE ASCERTAIN AND YOU FILLS BELLY THIS IF DETAINED PLEASE ODOR OF LUDLOW COMMISSIONER.

This particular telegram was sent from the War Department over the signature of Major Thomas T. Eckert, the general superintendent of military telegraphs, who later became chairman of the board of the Western Union Telegraph Company. Because the flow of orders and reports through Eckert’s office gave a more detailed and up-to-the-minute picture of the war than any other source, Lincoln paid it frequent visits. He virtually lived there during battles. The telegraph office and its adjunct, the cipher quarters, were located in a converted library and its anteroom, respectively, on the second floor of the War Department building, which stood next to the White House. Here Lincoln relaxed and chatted daily with the three young telegrapher-cipher-operators, David Homer Bates, Charles A. Tinker, and Albert B. Chandler. Bates, who was only 18 when the war started, told about it years later:

“Outside the members of his cabinet and his private secretaries, none were brought into closer or more confidential relations with Lincoln than the cipher-operators,… for during the Civil War the President spent more of his waking hours in the War Department telegraph office than in any other place, except the White House…. His tall, homely form could be seen crossing the well-shaded lawn between the White House and the War Department day after day with unvaried regularity.” When Lincoln entered the cipher room he would open a little drawer in one of the desks and read the carbon copies of messages that the operators had made on lettersize tissue paper and placed, unfolded, in that drawer for the President’s information.

“It was his habit to read from the top down,” Chandler wrote, “and when he came to those which he had already read, with a smile he said, ‘Well, I guess I have got down to the raisins.’ As I seemed in doubt as to what that might mean, he explained that a little girl, having eaten improperly both in quantity and quality, beginning with a lot of raisins, was made quite ill, and could find relief only in the process which a sick stomach is likely to compel. After an exhausting siege she gave an exclamation of satisfaction that the end of her trouble was near, for she had ‘got down to the raisins.’ ”

Once when Lincoln entered the telegraph office on a day of national fasting, he noticed that all the operators were busy, and he remarked: “Gentlemen, this is fast day, and I am pleased to observe that you are working as fast as you can; the proclamation was mine, and that is my interpretation of its bearing on you.” When a battle was in progress, the President would look over the shoulders of the young cipher operators as an especially important message was being deciphered. Sometimes he would read the dispatches aloud, and when he reached such codewords as HOSANNA and HUSBAND, both of which meant Jefferson Davis in one cipher, or HUNTER and HAPPY, both meaning Robert E. Lee, he would invariably translate them as “Jeffy D” or “Bobby Lee.”

War is hell, Sherman said, but he didn’t know Confederate cryptography. In contrast to the close-knit Union organization, the South apparently extended the states’ rights principle into the realm of cryptography and let each commanding officer choose his own codes and ciphers. Thus, just before the Battle of Shiloh, on April 6, 1862, that excellent officer but indifferent cryptographer, General Albert S. Johnston, agreed with his second-in-command, General Pierre Beauregard, upon a Caesar substitution for military use! Two weeks earlier President Jefferson Davis had sent Johnston “a dictionary of which I have the duplicate…. the word junction would be designated by 146. L. 20,” meaning, respectively, page number, left-hand column, and word number. Beauregard, in turn, sent Major General Patton Anderson a monalphabetic cipher to assure the secrecy of their communications. The Secretary of the Navy, Stephen B. Mallory, instructed Lieutenant John N. Maffitt, then in Mobile readying the cruiser Florida for its spectacularly destructive cruise against Northern shipping, to buy two identical copies of a dictionary for use as a codebook. His colleague, the dashing Commander Raphael Semmes, likewise bought copies of Reid’s English Dictionary for the same purpose as part of his preparation for his harassment of merchantmen in Sumter, the Confederacy’s first warship.

A Confederate cipher telegram, in Vigenère

The rebels reposed their major trust, however, in the Vigenère, sometimes using it in the form of a brass cipher disk. In theory, it was an excellent choice, for so far as the South knew the cipher was unbreakable. In practice, it proved a dismal failure. For one thing, transmission errors that added or subtracted a letter (American Morse was peculiarly susceptible to this kind) unmeshed the key from the cipher and caused no end of difficulty. Once Major Cunningham of General Kirby Smith’s staff tried for twelve hours to decipher a garbled message; he finally gave up in disgust and galloped around the Union flank to the sender to find out what it said. For another, it could be solved by intuitive techniques. And if the South had difficulty reading Dixie cipher messages, the North did not. “It would sometimes take too long to make translations of intercepted dispatches for us to receive any benefit from them,” Ulysses S. Grant wrote. “But sometimes they gave useful information.”

During the siege of Vicksburg, Grant’s troops captured eight rebels who were trying to slip into the beleaguered city with 200,000 percussion caps. On one of them the Federals found the following cryptogram, which Grant sent to Washington “hoping that someone there may be able to make it out”:

Jackson, May 25, 1863

Lieutenant General Pemberton: My XAFV. USLX was VVUFLSJP by the BRCYAJ. 200000 VEGT. SUAJ. NERP. ZIFM. It will be GFOECSZOD as they NTYMNX. Bragg MJTPHINZG a QRCMKBSE. When it DZGJX. I will YOIG. AS. QHY. NITWM do you YTIAM the IIKM. VFVEY. How and where is the JSQMLGUGSFTVE. HBFY is your ROEEL.

J. E. Johnston

Lincoln’s three young cipher operators—Tinker, Chandler, and Bates—soon solved it. It proved to be a Vigenère, key MANCHESTER BLUFF, and its clear (after corrections) read as follows (with the two words not solved by the trio in brackets);

J. E. Johnston

Lieutenant General Pemberton: My [last note] was captured by the picket. 200000 caps have been sent. It will be increased as they arrive. Bragg is sending a division. When it joins I will come to you. Which do you think the best route? How and where is the enemy encamped’? What is your force?

This was only one of a number of Confederate cryptograms solved by this triumvirate, who, being barely out of their teens, were probably the youngest wartime cryptanalysts in history. The solution did not help Grant take Vicksburg, but it provided the three young men with a Confederate keyword, of which the South apparently used only three during the war. Early in 1865, J. B. Devoe, acting master of the United States Navy, was reporting to the Assistant Secretary of the Navy the two known keywords—MANCHESTER BLUFF and COMPLETE VICTORY (a phrase the Confederates clung to long after that cherished hope had dissipated)—and confessing that “the new key is not known.” But the youngsters’ most important solution dealt not with military but with political affairs.

In December of 1863, Postmaster Abram Wakeman of New York spotted an envelope addressed to Alexander Keith, Jr., in Halifax, Nova Scotia, who was known to be in frequent communication with rebel agents. Wakeman turned it over to the Secretary of War, who found that the letter inside was written in a complicated mixture of symbol ciphers. After War Department clerks puzzled over the mysterious signs in vain for two days, the cryptogram was given to the “Sacred Three,” as Bates, Chandler, and Tinker liked to call themselves. They determined to do what the clerks could not.

They ascertained that the unknown encipherer had intermingled five different kinds of signs plus ordinary letters as substitutes in the letter. But he had imprudently marked off the words with commas and confined himself to a single set of signs within each word. The letter patterns of the plaintext consequently showed through. One 6-letter word repeated its second and sixth letters. It was followed by a 4-letter word that in turn was followed by the cleartext phrase reaches you. The three deduced that the sequence should read before this reaches you. Bates recognized the ciphertext signs involved as those of the pigpen cipher, which had been used as a price marker in the Pittsburgh store in which he had worked as a boy. This permitted prompt reconstruction of the entire pigpen alphabet, driving a substantial wedge into the cryptogram. The identification of signs in the dateline as standing for “N.Y. Dec. 18, 1863” yielded further values, and, working in this way, the three—with the President hovering about anxiously—unlocked the cipher in about four hours. It read:

The Confederate agents’ message, solved by Tinker, Chandler, and Bates

N Y Dec 18 1863

Hon J P Benjamin Secretary of State Richmond Va

Willis is here The two steamers will leave here about Christmas Lamar and Bowers left here via Bermuda two weeks ago 12000 rifled muskets came duly to hand and were shipped to Halifax as instructed We will be able to seize the other two steamers as per programme Trowbridge has followed the Presidents orders We will have Briggs under arrest before this reaches you Cost $2000 We want more money How shall we draw Bills are forwarded to Slidell and rects recd Write as before

J H C

A special cabinet meeting was called, and by 7:30 that evening Assistant Secretary of War Charles A. Dana had started for New York to take charge of an investigation. Two days later, another cryptogram addressed to Keith was intercepted and promptly solved. “Say to Memminger,” it read, “that Hilton will have the machines all finished and dies all cut ready for shipping by the first of January The engraving of the plates is superb.” Christopher G. Memminger was the Confederate Secretary of the Treasury; the letter made it clear that plates for printing rebel currency were being made in New York. Hilton, the engraver, was easily located in lower Manhattan, and on the last day of the year the U.S. marshall raided his plant, seizing the plates, machinery, dies, and several million dollars worth of already-printed bonds and money. The plot was broken up, the Confederacy deprived of badly needed plates for printing its paper money. For their central role in all this, the three junior cryptanalysts each received the handsome raise of $25 a month.

The men in gray, who sometimes could not read their own messages, could never solve the Union’s. The ravings of the Delphic oracle must have seemed more clear than messages in the federal route transposition. Though many of the North’s estimated 6,500,000 telegrams were in cipher, though the Confederates tapped the Union wires, though their cavalry raids must have captured parallel plain and cipher copies of messages, though the system had intrinsic weaknesses—though they had all these clues, the rebels never sorted out the Yankee word-thicket. This would be incredible if they had not vouched for it themselves by publishing a number of messages in their newspapers with a general request for solution. Even the capture of two of the ciphers themselves—No. 12 in July of 1864 and No. 1 in September—failed to help. The Yankees simply got out a new list of routes and jargon words, and the result was always more than the rebels could handle.

Appomattox itself did not still the cryptologic reverberations of the Civil War. In the trunk of John Wilkes Booth, found in his room at the National Hotel after he was shot, officials discovered a Vigenère tableau. This was introduced into evidence at the trial of the eight Southern sympathizers charged with conspiring to assassinate the President in an obvious attempt to link them with the actual killer, though no one testified to their use of the cipher. The prosecution then sought to show that the crime had been instigated by the Confederate government by exhibiting a rebel “cipher reel,” which Major Eckert averred to be identical with the Booth cipher. This curiosity, captured on a shelf in the Richmond office of Judah P. Benjamin, Confederate Secretary of State, simply consisted of a Vigenère tableau wrapped around a cylinder; over this, an arm supported two indicators that presumably pointed out the letters. It deciphered no messages at the trial. The burlesque reached a climax when a North Carolina pile-driver named Charles Deuel described how he and a friend solved a cipher that he found floating in the water near where he was working. The plaintext, signed “No. 5,” began: “I am happy to inform you that Pet has done his work well. He is safe, and Old Abe is in hell.” What connection all these displays had with the accused was never made clear, but they were hanged anyway.

At about the same time that Booth and others were being hunted down and captured, Jefferson Davis was using the third Vigenère key to compose the last official cryptogram of the Confederacy. Sent to his secretary on April 24, almost two weeks after Lee’s surrender, it was a message of futile defiance ordering “active operations to be resumed in forty-eight hours.” No one knows who chose this final key of the Confederacy, or why, but in view of Davis’ own impending fall and the black days of Reconstruction that lay just ahead, it gleams as the most somberly prophetic in the whole history of cryptology: COME RETRIBUTION.

On the morning of Monday, October 7, 1878, the New York Tribune trumpeted forth one of the great scoops of American journalism. Under the two-column headline “The Captured Cipher Telegrams,” the lead story of the day blared the plaintext of cryptogram after cryptogram that the Tribune had solved. The messages, which hearkened back to the most famous electoral dispute in American history, were the first to play a vital role in American politics.

After the popular votes were counted in the presidential election of 1876, the Democratic candidate, Samuel J. Tilden, held a clear lead of 250,000 ballots over his Republican opponent, Rutherford B. Hayes. But which way the deciding electoral college vote went depended on which of the double and conflicting returns from Florida, Louisiana, South Carolina, and Oregon were accepted as valid. Congress created a special electoral commission to settle the matter; by a straight party vote of 8 to 7, it awarded all 22 contested electoral votes to Hayes. This gave him a majority of 1 in the college—and the Presidency.

During the tumultuous legislative session that followed, a Congressional committee was appointed to look into persistent Democratic rumors of Republican purchase of electors’ votes. As part of its investigation, the committee subpoenaed 641 political telegrams out of the 29,275 that had clattered back and forth between politicians and their agents in the four states—the vast majority having been burned by Western Union to publicize the privacy of the correspondence entrusted to it. A large bundle of the impounded wires kicked around the committee room during the summer of 1878, and, through a complicated chain beginning with a committee messenger and ending with the Republican National Chairman, 27 of the telegrams in cipher were leaked to the Republican-leaning Tribune in the hope that they might embarrass the Democrats.

A few weeks earlier, Manton Marble, one of Tilden’s closest political advisors, had written an open letter to the New York Sun contrasting dark Republican practices with Tilden’s station in “the keen bright sunlight of publicity.” Whitelaw Reid, the Tribune’s brilliant editor, took a suggestion of the Republican chairman and inserted the cipher telegrams in editorials as subtle commentaries on Marble’s letter. The Democrats squirmed as the Tribune staff played impishly upon the ciphertexts. Was this cryptic mumbo-jumbo the vaunted Democratic candor? But as more and more dispatches poured in upon Reid from other G.O.P. sympathizers, he conceived a broader scheme. Reckoning that any negotiations that had to be conducted beneath the cloak of cipher would mightily discomfit the Democrats if drawn from under that cover, he set to work to get them read.

Prompted by hints in the editorials, numerous subscribers offered suggestions for their solution. Schuyler Colfax, who had been Vice President during Grant’s first term and had been interested in cryptology since his teens, referred Reid to several magazine articles on the subject, but they proved useless. William M. Evarts, the Secretary of State, had a good idea: get a student of mathematics to unearth the law on which the messages were based. But this only promised; it did not produce. Reid even tried the approach direct when he ran into Tilden at fashionable Saratoga that August: “I told him that we had all the cipher dispatches that went between his house and Florida, and asked him, laughingly, for the key. I told him we couldn’t make head or tail to them, and wanted him to help us. He smiled and blushed, innocent as a baby, and passed on.” Things were getting nowhere.

Meanwhile, the Detroit Post had learned from a former business partner of J. N. H. Patrick, one of the Democratic agents, that the Democrats had couched their electoral communications to Oregon in the same dictionary code that Patrick had used in his mining ventures. The encoder had looked up the word in the edition of the Household English Dictionary that was published at London in 1876, noted the word’s numerical position on the page, and took the corresponding word four pages to the front of the book as the code equivalent. The decoder had reversed the process. For instance, the most damning of the Oregon messages read, in codetext:

J. N. H. PATRICK

BY VIZIER ASSOCIATION INNOCUOUS TO NEGLIGENCE CUNNING MINUTELY PREVIOUSLY READMIT DOLTISH TO PURCHASED AFAR ACT WITH CUNNING AFAR SACRISTY UNWEIGHED AFAR POINTER TIGRESS CUTTLE SUPERANNUATED SYLLABUS DILATORINESS MISAPPREHENSION CONTRABAND KOUNTZE BISCULOUS TOP USHER SPINIFEROUS ANSWER

The first codeword, by, is on page 30 as word 29. The decoder counted towards the back to page 34, where the 29th word is certificate. The entire plaintext read:

Portland, Nov. 28, [1876]

W. T. Pelton, New York

Certificate will be issued to one Democrat. Must purchase Republican elector to recognize and act with Democrat and secure vote and prevent trouble. Deposit ten thousand dollars my credit Kountze Brothers, Twelve Wall Street. Answer.

J. N. H. Patrick

On September 4, one of the Tribune’s editors, John R. G. Hassard, basing his work on the Detroit Post’s revelation, set forth 3½ columns of cryptograms and translations that showed that the Democrats had sought to buy a Republican elector for $10,000 and that the deal had fallen through only through delays in transmission.

But the Household English Dictionary was not the key so urgently desired to the messages from the other three states. With no outside help forthcoming for their solution, Reid set his staff to work on the problem in earnest.

Hassard, then 42, had become managing editor in all but name on the death of Horace Greeley in 1872. A tall, lanky man with sandy hair, side-whiskers, and hazel eyes, always spruce, with a no-nonsense manner, he was gifted with a charm of style and breadth of culture that showed in his graceful editorials. He had converted to Catholicism at 15—a courageous act in the heyday of Know-Nothingism—and, after graduating from St. John’s College at the head of his class, abandoned his plans for the priesthood only because of ill health. He served as secretary to the first archbishop of New York, John Hughes, whose biography he later wrote. His dispatches to the Tribune from Bayreuth on the premiere of the Nibelungen Ring series in 1876 did more to bring Wagner’s music to America than perhaps anything else up to that time. Hassard took on the challenge of the cryptograms himself, and worked on them so uninterruptedly that a cold hung on and developed into tuberculosis. He spent the next ten years in search of health, but succumbed in 1888.

Soon after Hassard started his task, another member of the Tribune staff became interested and took up the puzzles independently. This was Colonel William M. Grosvenor, who had become economic editor of the Tribune in 1875, three years earlier. A burly, forceful man, then 43, with bristly eyebrows, long hair and beard, and a leonine head, he had demonstrated his statistical skill while editor of the St. Louis Democrat by making an elaborate comparison between the whisky production of the St. Louis distillers and the revenue accruing therefrom to the government. It clearly indicated fraud on the part of the liquor interest and led to exposure of the notorious Whisky Ring. A native of Massachusetts, he had commanded a regiment of Negro troops in the Civil War. Grosvenor later became editor of the prestigious Dun’s Review and was frequently consulted by government experts on tariff and currency legislation. His integrity in these matters was so great that on one occasion his advice cost him a fortune in the stock of a printing firm. He was gifted in mathematics and languages, was one of the most expert billiard players in New York, could carry on three games of chess simultaneously, and more than held his own at tennis and whist. He died in 1900.

Grosvenor and Hassard, each in his own home, wrestled with the riddles and obstinacies of an unfamiliar science. They could not have known it, but not only were they mastering a problem that had repulsed many, they were also breaking new ground in that science.

A cipher telegram offering the electoral votes of Florida for $200,000, solved and published by the New York Tribune

“They both did extremely well,” Reid said later, “worked independently, compared notes loyally and altogether cooperated in a charming way in a highly important piece of work. Hassard was a little earlier in the field, and to that extent deserves special credit; but Grosvenor was equally keen, and, as well as I can now remember it, about equally successful. Sometimes he and Hassard would attack the same despatch on different lines, and after being foiled again and again, would finally reach the solution the same evening, Hassard in Eighteenth Street and Grosvenor out at Englewood.”

Unknown to them, a young mathematician from the U.S. Naval Observatory in Washington had been solving some of the specimen ciphers that Reid had published in the Marble-baiting editorials. This was Edward S. Holden, 31, who had graduated third in the West Point class of 1870 and had gone to the Naval Observatory three years later. In 1879, the year following his work on the cipher telegrams, he was appointed librarian there. In 1885, he became president of the University of California and director of the Lick Observatory, relinquishing the presidency in 1888 on completion of the observatory. He founded the Astronomical Society of the Pacific, organized five eclipse expeditions, and edited the observatory’s publications. From 1901 until his death in 1914 he was librarian at West Point, adding 30,000 volumes to the collection, cataloging it, and issuing many bibliographies.

Holden had been attracted by the “novel and ingenious character” of the cryptograms. “By September 7, 1878,” he said later, “I was in possession of a rule by which any key to the most difficult and ingenious of these … could infallibly be found.” He approached the Tribune, which had liked Evarts’ idea of hiring a mathematician, and Hassard sent on a quantity of dispatches. But Hassard and Grosvenor had independently reached the theory of solution that Holden had, and furthermore had solved some messages before he did. None of Holden’s solutions reached the Tribune before Hassard and Grosvenor had solved those messages, Reid said, and in general his work was regarded as corroborative.

The most important messages, and those to which the new theory of solution applied, were enciphered in a form of word transposition grievously deteriorated from the excellent Civil War system that had evidently inspired it. Only four keys were employed, one each for telegrams of 15, 20, 25, and 30 words, with longer telegrams being enciphered in parts by two or more keys. Sometimes deciphering keys were used to encipher. Code disguised some of the proper names and important words. The enciphering key for 25 words (18, 12, 6, 25, 14, 1, 16, 11, 21, 5, 19, 2, 17, 24, 9, 22, 7, 4, 10, 8, 23, 20, 3, 13, 15) served to encipher this honest offer of corruption from Tallahassee:

In the code list, BOLIVIA stood for proposition, RUSSIA for Tilden, LONDON for canvassing board, FRANCE for Governor Stearns, MOSELLE for two, GLASGOW for hundred, EDINBURGH for thousand, and MOSES for Manton Marble. As transmitted to New York, the message read:

CERTIFICATE REQUIRED TO MOSES DECISION HAVE LONDON HOUR FOR BOLIVIA OF JUST AND EDINBURGH AT MOSELLE HAND A ANY OVER GLASGOW FRANCE RECEIVED RUSSIA OF

The reply to that is extant; it was both clear and in clear: “Telegram here. Proposition too high.”

The Hassard-Grosvenor-Holden theory of solution of messages like this fed upon the great quantity of dispatches in each key. It is now considered the general solution for all transposition ciphers, because it works on any transposition whenever two or more cryptograms of the same length in the same key are available for analysis. The method, which they developed empirically for the first time in cryptology, has become known as “multiple anagram-ming,” and though Holden did not use that term, he gave a good description of the technique: “There is one way, and only one way, in which the general problem can be solved, and that is to take two messages, A and B, of the same number of words, and to number the words in each; then to arrange message A with its words in an order which will make sense, and to arrange the words of message B in the same order. There will be one order—and only one—in which the two messages will simultaneously make sense. This is the key.”

Holden’s description makes explicit one requirement of successful operation of multiple anagramming (that the two messages be the same length) but presupposes the other (that their keys be the same). The technique rests on the fact that, if two messages of the same length are transposed in the same system with identical keys, their individual words will wind up in the same relative positions. To put it differently, if the first word of the plaintext becomes the 15th word of the cryptogram in the first message, the first word of the plaintext of the second message will equally wind up in the 15th position of the second cryptogram. This is transposition’s version of like causes producing like effects, and the principle holds for all transposition systems, letter as well as word, irrespective of their mixing process.

The principle may be illustrated with two five-letter cryptograms enciphered with the same key: GHINT and OWLCN. Suppose that the cryptanalyst begins trying to reconstruct the plaintext of the first message by assuming that it begins with th. This implies an encipherment key which moved the first plaintext letter (t, in this message) to the fifth position (in GHINT) and the second plaintext letter (h) to the second position (in GHINT). The cryptanalyst can determine that the same key would require the second message to begin with nw—hardly a promising beginning. If the cryptanalyst now tries to anagram the second message instead, he might try cl as a starter. The corresponding moves in the first cryptogram would bring n and i together at the head of the message. This gives good possibilities in both messages, which is, of course, more desirable. The cryptanalyst will continue juggling the two messages, checking one against the other, until he reconstructs them both as night and clown. The key he recovers will solve any other five-letter cryptograms enciphered by it. The process must be done individually for each key and each cryptogram of different length. Multiple anagramming cannot work with just a single message because without any control the single message could be anagrammed into too many equally likely texts. GHINT alone, for example, could be unscrambled to make thing as well as night, and there is no cross-check to tell which is right.

The word-transposition system carried the most explosive and the greatest number of messages sent by the Democratic politicians, but it was by no means the only one. Messages from Florida and South Carolina were evidently encoded by a dictionary, but the one used for the Oregon disclosures did not unlock them. The three tyro cryptanalysts had independently noticed that these dispatches included the word geodesy, which is a rather unusual term for the pocket dictionary that they reasoned would probably be used. Holden found the right one after an hour and a half’s search in the Library of Congress; he telegraphed the news to the Tribune just as a bleary-eyed staff member, who had examined 40 or 50 volumes without success, was about to go out and check the one that Hassard and Grosvenor rightly suspected—Webster’s Pocket Dictionary. It was used in the same way as the Oregon dictionary, though the number of pages turned to the front to select the codeword varied from one to five.

The Democrats also used pairs of numbers in a monalphabetic substitution. Hassard broke this system by guessing that the patterned ciphertext 84 66 33 87 66 27 27 mirrored canvass. He cracked a checkerboard substitution when he divined that ITYYITNS in a partially enciphered telegram from Florida stood for the name of the county of Dade. The coordinates of the checkerboard (which also served for the two-digit cipher) proved to be ten different letters that spelled a phrase of extraordinary suitability:

Of the 400 dispatches that were given to Hassard and Grosvenor, all but three (in a cipher not used elsewhere) were translated. The Democrats, unaware that their own machinations were being bared, raised the cry of fraud in the presidential election as the midterm campaign for Congress grew hot. On October 3, 1878, the Tribune reported that solution of the dispatches had been completed and published a few of them as a hint for the Democrats to confess. But they said nothing, and four days later the Tribune thundered out the story of Democratic intrigue in Florida and Louisiana. The first story detailed the operations of the ciphers; the second, next day, exposed the texts of the telegrams. On October 16, the South Carolina shenaningans came out. Their sum was that Colonel William T. Pelton, Tilden’s nephew and confidential secretary, had bargained through Marble and others for electoral votes.

“Cipher Mumm(er)y. Exhumed by the New York Tribune.” Cartoon of Samuel Tilden by Thomas Nast in Harper’s Weekly

The results were sensational. The public marvelled at the ingenuity of the cipher-solvers. Thousands of readers tested the keys and satisfied themselves as to the accuracy of the solutions. The Democrats argued that the telegrams were strictly for Pelton’s information, but it seemed clear that only Pelton’s hesitation at the price and the subsequent bungling and delay subverted his intentions. The Tribune had prepared its exposé thoroughly and presented it skillfully; even its Democratic rival, the Sun, was forced to a grudging tribute. The timing, too, was perfect: election was only a few weeks off. In that election, the G.O.P. made emphatic gains in Congress. New York, Pennsylvania, Massachusetts, and Connecticut voted, as the Tribune inferred with pardonable pride, to rebuke the cipher fraud.

But the effects did not stop there. The telegrams had been addressed to Pelton at 15 Gramercy Square, New York, Tilden’s home, and though Tilden, haggard and with his perpetual cold, swore before the Congressional investigating committee that he had no personal knowledge of what his nephew was doing in his house, and that anything that was done was done without his permission, his reputation was sullied. The disclosures ended his presidential aspirations. As his old supporter, the Sun, sadly conceded, “Mr. Tilden will not again be the Presidential candidate of any party.”

In fact he was not, and in the election of 1880, James A. Garfield, a personal friend of Reid’s, defeated Winfield S. Hancock, the Democratic candidate, by only 7,000 votes out of 9,000,000 in the popular tally but by an unchallengeable 214 to 155 in the electoral ballot. Even a sympathetic biographer of Tilden acknowledged that “As a result of the cipher telegrams the Republicans won an advantage which probably gave them the national election of 1880. Much of the public became convinced that the millionaire candidate for the Presidency had permitted his party directors to dip into his purse to win a decision for the party that was willing to pay the highest price.” Cryptanalysis had helped elect a President. The Tribune’s triumph stood forth as one of the first great journalistic exposés of governmental corruption, which helped elevate American newspapers to their role of public watchdog. It also carried the Tribune into the citadel of Republican power. Reid later banqueted at its tables when he was named ambassador to the Court of St. James’s. But perhaps the most lasting value of the Hassard-Grosvenor cryptanalysis and its dramatic disclosure by the Tribune was noted by Reid’s biographer: “It had pilloried once and for all the single manifestation in our annals of the idea that the Presidency was a purchasable honor.”

8. The Professor, the Soldier, and the Man on Devil’s Island

ONLY A FEW BOOKS in the history of any science may be called great. Some of these report a technical innovation that radically alters the content of the science. Through the 19th century, Alberti’s and Kasiski’s were the two great books of this kind in cryptology. Such books look inward.

Other great books look outward. They bring the science up to date—make it consonant with its time—and so renew its utility to men. This they do by assimilating developments in relevant fields (for example, improvements in instrumentation), by summing up the lessons of recent experience and deducing their meaning for the current age, and by reorganizing the concepts of the science according to this new knowledge. This does not mean simple popularization, though such a work usually does have an organic persuasiveness. Rather, it amounts to a reorientation, a new perspective.

For 300 years, the only great book of this kind in cryptology was Porta’s. He was the first to delineate a coherent image of cryptology. His ideas remained viable so long because cryptology underwent no essential change; communication was by messenger, and consequently the nomenclator reigned. But his views no longer sufficed after the invention of the telegraph. New conditions demanded new theses, new insights. And in 1883 cryptology got them in the form of its second great book of the outward-looking kind, La Cryptographie militaire.

Its author was born Jean-Guillaume-Hubert-Victor-François-Alexandre-Auguste Kerckhoffs von Nieuwenhof on January 19, 1835, at Nuth, Holland, son of a well-to-do landlord and a member of one of the oldest and most honorable families of the Flemish duchy of Limburg. He went to school at a little seminary near Aachen. Afterward, to improve his knowledge of English, he lived in Britain for a year and a half, then returned to the University of Liège, where he received two degrees, one in letters, one in science. After teaching modern languages for four years at two schools in Holland and joining a number of literary societies there, he accompanied a young American, Clarence Prentice, son of the founder of the Louisville Journal, through England, Germany, and France as traveling secretary, then went to Meaux, near Paris, where he again taught modern languages.

In 1863, he obtained the chair of modern languages at the high school at Melun, a large town 25 miles southeast of Paris. The next year he married a girl from the area and in 1865, when he was 30, they had their only child, a daughter, Pauline. He stayed at Melun for 10 years, teaching English and German. He supplemented his salary of about 1,600 francs by taking students in to lodge with him—a practice that was officially prohibited but winked at.

During these years he participated in a variety of activities that show the great diversity of his interests. He gave lectures on the formation of languages and on literature, founded a society for the encouragement of education in Melun, gave free courses in English and Italian, served as delegate of the local branch of the French Society of Archaeology to the international congress at Bonn in 1868, and got embroiled in some minor political difficulties after the French defeat of 1870. His learning was broad enough for him to fill in at different times for teachers of Latin, Greek, history, and mathematics.

By this time he had shortened his name to Auguste Kerckhoffs. Bearded, dignified, slow of speech, Kerckhoffs, despite an inability to maintain discipline in his classes and some eccentricities of character, was a “learned, zealous, capable” teacher who awoke his students’ interest in their work; his superiors said “his students like him and work with success.” Thus when a hostile official wanted to turn down Kerckhoffs’ request for a leave for further studies, he discovered that the teacher had “ardent protectors,” and the leave was granted.

Kerckhoffs went from 1873 to 1876 to the universities of Bonn and Tübingen, getting his Ph.D. He earned his living by teaching the young Count de Sao Mamede, who later became secretary to the king of Portugal; Kerckhoffs was made a commander of the Order of Christ for this. He then returned to Paris, where he worked as a private instructor, teaching two younger sons of the Sao Mamede family. He demonstrated an interest in things military by applying for the chair of German at the Ecole Militaire Superieure in 1878, losing it because a clerk failed to note that he had become naturalized as a French citizen in 1873. In 1881, Kerckhoffs became professor of German at the Ecole des Hautes Etudes Commerciales and at the Ecole Arago, both in Paris. It was during this time that, aged 47, he wrote La Cryptographie militaire. It was not his first book: he had already written a Flemish grammar, an English grammar, a German verb manual, a study (in German) on the origins of German drama, and a work examining the relation of art to religion.

His busiest years followed the publication of La Cryptographie militaire. A new international language called Volapük (“World-Speak”) had been invented by a German priest, Johann Martin Schleyer. About 1885, it caught on in France, and flashed with express-train speed all over the country, not only among intellectuals but among all classes: it was even heard in the streets. From France it radiated throughout the world. The most active propagandist of Volapük was Auguste Kerckhoffs, who, at the second Volapük congress in Munich in 1887, was acclaimed director (“Dilekel,” in Volapük) of the International Academy of Volapük. To this body were submitted questions of the grammar, vocabulary, and orthography of the expanding tongue.

As secretary of the French Association for the Propagation of Volapük, Kerckhoffs proselytized the artificial language with ability and vigor. In 1888, 182 textbooks on Volapük appeared—a publication rate of one every other day—and the Macy’s of Paris, the Grands Magazins des Printemps, sponsored courses in it. By 1889, 25 periodicals in or about the language were being published and 283 Volapük clubs were meeting all over the globe. When the third Volapük congress was held at Paris in May of 1889, with Kerckhoffs presiding, even the waiters and porters conversed in World-Speak. A new Golden Age of brotherhood, unencumbered by the chains of Babel, seemed to shimmer just ahead.

It was a mirage. For the congresses, which seemed to be the harbingers of that great day, were actually symptoms of critical tensions within the movement. Schleyer’s goal of creating the richest and most perfect literary language, in which he was supported by the German Volapükists, clashed with the desire of Kerckhoffs and the other active Volapükists to have the simplest and most practical language for commerce and science. From the beginning, Kerckhoffs had eliminated from his grammatical manuals some of the forms that Schleyer had carried over in Volapük from his native German, such as the endings for the jussive and optative moods of verbs. But the priest insisted that, as the father of Volapük, he should have the final decision on any changes. The tensions mounted, and when the Academy refused to grant Schleyer the full veto he wanted, the movement broke in two.

It splintered into bickering factions entirely unable to agree when Kerckhoffs submitted to the Academy, not individual questions, but a complete grammar, and other members of the Academy retorted with projects of their own. The movement crumpled with unbelievable swiftness: in 1889, it seemed as though it would conquer the world; in 1890, it was moribund. Kerckhoffs resigned as Dilekel in 1891, and, by 1902, of the estimated 210,000 enthusiasts the language had once had, only 159 remained on its List of Correspondents, and only four little clubs clung weakly to life. Kerckhoffs’ Cours complet de Volapük, his Dictionnaire Volapük-Français et Français-Volapük, his Vollstän-diger Lehrgang des Volapük remain only as forgotten monuments to a splendid dream.

Crushed and perhaps embittered by the collapse of what had seemed so needful and so certain, Kerckhoffs one day exploded with some intemperate criticisms of the handling of the state’s school examinations so that his contract at the Ecole des Hautes Etudes Commerciales was not renewed in 1891. It was only through the intervention of influential friends that he managed to get a post teaching German at the high school at Mont-de-Marsan, near Bordeaux. Here, his superiors reported on him: “Very diverse and extended knowledge taught with more method, exactness and precision than I would have expected in a spirit that embraces so many things. Highly regarded and highly appreciated.” The following year, trying to get closer to Paris, Kerckhoffs moved to the Brittany seaport of Lorient, where he again taught German. In the middle of that school year, his daughter died. He stuck it out for another year, but by 1895, then 60, his health failing, his spirit broken, but living in Paris not far from the Sorbonne, he applied for a year’s leave. He renewed it annually until his death in Switzerland, apparently while on vacation, on August 9, 1903.

But if his works on Volapük are defunct, his cryptologic ideas still flourish. La Cryptographie militaire first appeared as two installments in the Journal des Sciences militaires in January and February of 1883, being reissued later that year as a paperback book by the journal’s publisher. It is the most concise book on cryptology ever written. Kerckhoffs had the instinct for the cryptographic jugular, and he compressed into 64 pages virtually the entire known field of cryptology, including polyalphabetics with mixed alphabets, enciphered code, and cipher devices. The book is also one of the most scholarly on cryptology. Its footnotes cite most classical and many modern sources; comments such as “This is not the only historical or bibliographic error for which the Austrian writer must be reproached” show how carefully the author has studied those sources. And the book throbs with life. Kerckhoffs selected an enciphered news-service dispatch as the specimen for a demonstration solution. He discussed current German practice and contrasted it with what was then going on in France. He scrutinized the most recent ciphers, such as the Wheatstone device. He concentrated upon it all his extraordinary range of knowledge, and it is perhaps significant that at least three of the great books of cryptology—Kerckhoffs’, Alberti’s, and Porta’s—were written not by narrow specialists but by well-rounded men who had one foot in each of what C. P. Snow would later call “the two cultures” of science and humanities.

What makes Kerckhoffs’ book great, however, is that he sought answers to the problems thrust upon cryptology by new conditions, and that the solutions he proposed were valid, well-grounded, and meritorious. The major problem was to find a system of cryptography that would fulfill the requirements of the new signal communications created by the telegraph—a problem that still commands the interest of cryptologists. While other authors simply discussed various cipher systems rather as if the science of cryptology existed in a vacuum, Kerckhoffs addressed himself directly to the issue of the day. Indeed, it inspired his book: “I have therefore thought that it would be rendering a service to the persons who are interested in the future of military cryptography … to indicate to them the principles which must guide them in the contrivance or evaluation of every cipher intended for war service.” The principles which he enunciated guide cryptologists even now.

Kerckhoffs took field ciphers as a given; far from realizing that they were creatures of the telegraph, he thought that they had existed in the 1600s. But this historical error did not affect his understanding of current conditions. In considering the problem of finding a good field cipher, he saw that any one that was practical would have to withstand the operational strains of heavy traffic. “It is necessary to distinguish carefully between a system of encipherment envisioned for a momentary exchange of letters between several isolated people and a method of cryptography intended to govern the correspondence between different army chiefs for an unlimited time,” he wrote. In that one sentence, Kerckhoffs differentiates pre-telegraphy military communications from post-. The sentence is pregnant with most of the requirements that have come to be demanded of systems of military cryptography, requirements such as simplicity, reliability, rapidity, and so on. This clear recognition of the new order constitutes Kerckhoffs’ first great contribution to cryptology.

The second was to reaffirm in a modern context the principle that only cryptanalysts can know the security of a cipher system. Others had, of course, realized this before him: Rossignol invented the two-part nomenclator upon that principle, and the English Decypherers assessed and then compiled England’s nomenclators in the 1700s. But it was forgotten after the black chambers were closed, and in any case the simple criteria for appraising the cryptanalytic resistance of a nomenclator no longer applied to the more complex cipher systems then being proposed. The inventors of these systems, instead of submitting their ciphers to the empirical verdict of cryptanalysts, sought instead to evaluate them a priori. They would calculate how many centuries it would take to run through all the combinations necessary to solve their cipher, or would argue how it was logically impossible to break through a certain interlocking feature. Kerckhoffs observed and diagnosed the phenomenon:

… I am stupefied to see our scholars and our professors teach and recommend for wartime use systems of which the most inexperienced cryptanalyst would certainly find the key in less than an hour’s time.

One can hardly explain this excess of confidence in certain ciphers except by the abandon into which the suppression of black chambers and the security of postal communications have let cryptographic studies fall; it may likewise be believed that the immoderate assertions of certain authors, no less than the complete absence of any serious work on the art of solving secret writing, have largely contributed to give currency to the most erroneous ideas about the value of our systems of cryptography.

Reacting against this, Kerckhoffs demonstrated that cryptanalysis was the only way to enlightenment in cryptography, that only by climbing the steep and thorny path of cryptanalysis could one arrive at the truth about a system of cryptography. Only solution could validly test the security of a cipher. Kerckhoffs never quite stated this in so many words, though he came close. But his whole book cries it out. La Cryptographie militaire is essentially a tract on cryptanalysis; its whole bias and emphasis is cryptanalytic. Kerckhoffs established ordeal by cryptanalysis as the only sure trial for military cryptography. It is the form of judgment which is still used.

From these two fundamental principles for selecting usable field ciphers, Kerckhoffs deduced six specific requirements: (1) the system should be, if not theoretically unbreakable, unbreakable in practice; (2) compromise of the system should not inconvenience the correspondents; (3) the key should be rememberable without notes and should be easily changeable; (4) the cryptograms should be transmissible by telegraph; (5) the apparatus or documents should be portable and operable by a single person; (6) the system should be easy, neither requiring knowledge of a long list of rules nor involving mental strain.

These requirements still comprise the ideal which military ciphers aim at. They have been rephrased, and qualities that lie implicit have been made explicit. But any modern cryptographer would be very happy if any cipher fulfilled all six.

Of course, it has never been possible to do that. There appears to be a certain incompatibility among them that makes it impossible to institute all of them at once. The requirement that is usually sacrificed is the first. Kerckhoffs argued strongly against the notion of a field cipher that would simply resist solution long enough for the orders it transmitted to be carried out. This was not enough, he said, declaring that “the secret matter in communications sent over a distance very often retains its importance beyond the day on which it was transmitted.” He was on the side of the angels, but a practical field cipher that is unbreakable was not possible in his day, nor is it today, and so military cryptography has settled for field ciphers that delay but do not defeat cryptanalysis.

Perhaps the most startling requirement, at first glance, was the second. Kerckhoffs explained that by “system” he meant “the material part of the system; tableaux, code books, or whatever mechanical apparatus may be necessary,” and not “the key proper.” Kerckhoffs here makes for the first time the distinction, now basic to cryptology, between the general system and the specific key. Why must the general system “not require secrecy,” as, for example, a codebook requires it? Why must it be “a process that … our neighbors can even copy and adopt”? Because, Kerckhoffs said, “it is not necessary to conjure up imaginary phantoms and to suspect the incorruptibility of employees or subalterns to understand that, if a system requiring secrecy were in the hands of too large a number of individuals, it could be compromised at each engagement in which one or another of them took part.” This has proved to be true, and Kerckhoffs’ second requirement has become widely accepted under a form that is sometimes called the fundamental assumption of military cryptography: that the enemy knows the general system. But he must still be unable to solve messages in it without knowing the specific key. In its modern formulation, the Kerckhoffs doctrine states that secrecy must reside solely in the keys.

Had Kerckhoffs merely published his perceptions of the problems facing post-telegraph cryptography and his prescriptions for resolving them, he would have assured a place for himself in the pantheon of cryptology. But he did more. He contributed two techniques of cryptanalysis that, while not as wrenching to the science as Kasiski’s, play roles of supreme importance in most modern solutions.

The first of these is superimposition. It constitutes the most general solution for polyalphabetic substitution systems. With few exceptions, it lays no restrictions on the type or length of keys, as does the Kasiski method, nor on the alphabets, which may be interrelated or entirely independent. It wants only several messages in the same key. The cryptanalyst must align these one above the other so that letters enciphered with the same keyletter will fall into a single column. In the simplest case, that of a running key that starts over again with each message, he can do this simply by placing all the first letters in the first column, all the second letters in the next column, and so on.

Kerckhoffs demonstrated this procedure with 13 short messages enciphered with a long key. He superimposed his first five cryptograms like this:

Now, since all these messages were enciphered with the same keytext, all the hidden plaintext letters in the first column were enciphered by the same keyletter, which means that they have been enciphered in the same ciphertext alphabet. Consequently, all the plaintext a’s will have the same ciphertext equivalent, all the plaintext b’s will likewise have their own unvarying ciphertext equivalent, and so on. Likewise, each ciphertext letter represents only one plaintext letter. This holds true for each column. Each column may thus be attacked as an ordinary monalphabetic substitution, just like the columns in a periodic polyalphabetic.

In cases where the key does not start over again with each message, the cryptanalyst may line up repetitions in several messages to obtain a proper superimposition.

Superimposition does not ask that the alphabet in the first column bear any relation to that in the second. Thus it suits cryptanalysts of such systems as that of C. H. C. Krohn, who published in Berlin in 1873 a dictionary of 3,200 alphabets for secret correspondence; Kerckhoffs remarked scornfully of this number that “it is at once too many and too few.” But superimposition does depend for its success on a sufficient depth of column. Kerckhoffs realized this, and used examples to show that if two columns could be found to have been enciphered with the same keyletter, their effective depth was doubled. This is of especially great value with coherent running keys, whose cipher alphabets will be brought into play with the irregular frequency that their keyletters have in plaintext. If all the columns enciphered with the cipher alphabet governed by keyletter E can be recognized, collected, and solved together, about 12 per cent of the plaintext (in an English running key) will be recovered. Identically enciphered columns could be recognized, Kerckhoffs suggested, by finding columns with similar frequency counts.

Kerckhoffs also discerned another way to extort more plaintext from a paucity of ciphertext. Unlike most techniques of cryptanalysis, which ascertain plaintext, this technique determines ciphertext letters—which are, to be sure, immediately converted into plaintext. It may therefore be considered an indirect technique, but it is one of the most powerful in the cryptanalyst’s arsenal. Kerckhoffs called it “symmetry of position.”

How it works may be seen by looking at part of a tableau with mixed alphabets:

Now, it is evident that N and E stand next to one another in every cipher alphabet of this tableau (considering the alphabets as cyclical). Similarly, N is separated from Y by an interval of 3 in every cipher alphabet. Again, R stands 6 spaces, or cells, before B in every cipher alphabet. Relations like these may be fixed between any two (or more) ciphertext letters, and they will hold for every cipher alphabet in the tableau. So if the cryptanalyst determines the linear distance between two ciphertext letters in one alphabet, and then determines one of those letters in another alphabet, he can place the second letter in the second alphabet at the known distance. This contributes a ciphertext equivalent which he did not have before and which he can decipher throughout the cryptogram to add a few grains of plaintext to further his solution.

For example, suppose that the cryptanalyst has ascertained, in solving a message based on the above tableau, that K and H represent plaintext e and n. Consequently, K and H will stand 9 places apart in the ciphertext alphabet:

Then suppose that, in another alphabet, he has discovered that ciphertext K represents plaintext i. He may immediately count 9 spaces beyond K, thus:

and insert a ciphertext H at that point. He may now decipher all the ciphertext H’s in alphabet II into plaintext r’s. If he finds that, say, plaintext e is enciphered in this alphabet by W, he will measure the distance between K and W (four spaces forward), and will insert a W four spaces before K in the first cipher-text alphabet, giving him the identity of plaintext b in that alphabet. Since the intervals between the letters remain fixed for all the cipher alphabets of this tableau, the proper identification of a few letters in a few alphabets can lead to the determination of many others.

Kerckhoffs went no further than this—a patent symmetry of position. Cryptanalysts see it when they build up skeleton tableaux in solving polyalphabetics with a normal a-to-z plaintext alphabet. But modern cryptologists have discovered that skeleton tableaux for polyalphabetics with mixed plaintext alphabets will manifest a latent symmetry of position. It enlarges the principle of linear distances to include horizontal and vertical proportions. It is a complicated technique, but an enormously valuable one. Sometimes a chain reaction of placements will reconstitute an entire tableau. More often, it will donate important ciphertext equivalents to the cryptanalyst, or will notify him that a certain assumption contradicts its rules and hence is untenable. Because of today’s extensive use of polyalphabetics with both alphabets mixed, latent symmetry of position is an indispensable tool of the modern cryptanalyst.

Finally, Kerckhoffs rounded out his work by popularizing and naming the cryptographic slide, and demonstrating its identity with the polyalphabetic tableau. He called the slide the St.-Cyr system, after the French national military academy where it was taught. A St.-Cyr slide consists of a long piece of paper or cardboard, called the stator, with an evenly spaced alphabet printed on it and with two slits cut below and to the sides of the alphabet. Through these slits runs a long strip of paper—the slide proper—on which an alphabet is printed twice.

If both alphabets are normal, the device comprises a shorthand version of the Vigenère tableau, for any given alphabet of that tableau may be reproduced by finding its keyletter in the slide alphabet and setting this under the A of the stator. The stator alphabet will represent the plaintext alphabet and the slide alphabet the cipher alphabet. The alphabets do not have to be normal; if they are mixed, the slide (a term that sometimes encompasses the entire device) will represent a tableau with mixed alphabets. Any slide may be expanded into a tableau, and any tableau that is derived from the regular interaction of two alphabets, or components, may be compressed into the more convenient St.-Cyr form. Kerckhoffs also pointed out that a cipher disk was merely a St.-Cyr slide turned round to bite its tail, and he iterated Porta’s observation that a cipher disk could be developed into an equivalent tableau. He thus joined the tableau, the cipher disk, and the St.-Cyr slide into a family of related devices that differed only in form.

Such are the many excellences of La Cryptographie militaire. It stands perhaps first among the great books of cryptology. Its incisiveness, its clarity, its solid base of scholarly research, its invaluable new techniques, but above all its maturity, its wisdom, and its vision, elevate it to that rank. Perhaps it could only have been done by a man as well-rounded and as sensitive as Kerckhoffs.

It is ironic that the most lasting work of a man whose ideals were as cosmopolitan as Kerckhoffs’ should have had nationalistic results. Yet perhaps the most immediate consequence of La Cryptographie militaire was its giving France a commanding lead in cryptology, accruing benefits that were cashed during World War I. The Ministry of War bought 300 copies. Signal officers and amateur cryptographers read it, and, in reaction, invented or reinvented systems such as the autokey to circumvent the powerful superimposition technique. A whole literature poured off the presses. France flowered in a cryptologic renaissance.

Yet the French interest in cryptology was not due purely to the intellectual challenge of the subject. Much of the impetus must have come from the smart of France’s 1870 defeat by Prussia and her desire for revenge—the same desire that drove her to build up the largest army in Europe. It is significant that while almost two dozen books and pamphlets on cryptology were published in France between 1883 and 1914, to say nothing of scores of articles, only half a dozen appeared in Germany, all third-rate except for a few superb historical studies.

Probably several factors led to this indifference. The 1870 victory may have convinced the Germans that they were doing things right and did not need to change. Germans tend to be regimented and less apt to suggest new ideas to the authorities than the more individualistic French. And Germans seem to have a predilection for working things out in advance according to theory, for erecting elaborate structures based on pure reason. They sought, by the clarity of their logic and the unshakability of their assumptions, to do in cryptography what they did in philosophy—produce the ideal system. Kerckhoffs had shown that this approach is sterile, if not actually dangerous. But the Germans persisted, confident of the superiority of anything Teutonic. Their writers occupied themselves with cryptography to the virtual neglect of cryptanalysis. The French, more pragmatic, submitted their ciphers to the harsh judgment of actual solution.

The course of French prewar cryptology may be traced in its literature. Most of the books were second-rate, unoriginal, deriving their ideas from Kerckhoffs, whom they repeatedly laud. Typical is H. Josse, a captain of artillery who is chiefly noted for condensing Kerckhoffs’ six desiderata into a single guiderule that apparently governed the selection of French field ciphers up to World War I: “Military cryptography, properly called, must employ a system requiring only pencil and paper.” Josse quoted Kerckhoffs so often that he felt it necessary to insert an apologetic “M. Kerckhoffs, whose name recurs so often in cryptography” after an especially heavy flurry of references. But four fine writers helped make French cryptology the best in the world at the time: de Viaris, Valério, Delastelle, and Bazeries.

The Marquis Gaëtan Henri Léon Viarizio di Lesegno, whose name was gallicized to de Viaris, was born February 13, 1847, at Cherbourg. His father was an artillery captain. At 19, young de Viaris entered the famed École Polytechnique as 48th—and graduated as 102nd (out of 134). He enlisted in the Navy at 21, earning his commission as ensign two years later, but serving for only four years before resigning at 25. He later became an assistant police prefect and an infantry officer.

He apparently became interested in cryptology about the mid-1880s. He devised some of the first cipher machines to integrate a printing mechanism:{22} after enciphering, the cryptographer pressed a button which imprinted the cipher letter on a paper tape. He published for the first time in cryptology what he called “cryptographic equations.” (Babbage had employed such equations in his own work, but had never described them publicly.)

In articles in the scientific journal Le Génie Civil for May 12 and 19, 1888 (the first two parts of a series that was later collected into a book), de Viaris proposed that the Greek letter chi (χ) stand for any ciphertext letter, gamma (γ) for any keyletter and the lower-case c for any cleartext letter. He then proved that the algebraic formula c + γ = χ would produce a Vigenère en-cipherment no different from the standard manipulations of tableau, slide, or disk. If the letters of the alphabet be numbered from zero to 25,

the Vigenère may be duplicated mathematically by adding the values for plain and key together and then turning the sum (less 26 if it is 26 or above) back into letter form. For example, a standard tableau encipherment of plaintext d with key G yields cipher J. With the formula, these same letters give 3 + 6 = 9, or J. A different cipher will naturally have a different formula. Those for the Big Three of normal-alphabet polyalphabetics are (using the modern notation of P for plain, K for key and C for cipher):

Plan of the Marquis de Viaris’ printing cipher device

The symmetry of these formulas clearly shows almost graphically that Beaufort is a reciprocal substitution and that Variant and Vigenère are inverse operations. It is a striking demonstration of how mathematics floodlights the architecture of ciphers, revealing their framework in a glare of illumination.

Mathematics was just de Viaris’ bright idea in the 1880s. Nobody paid much attention to his formulas, and even he did not pursue the matter. But they testify to his originality. In 1893, he published another book that, like Kerckhoffs’, stressed the cryptanalytic. It included a fine solution of a difficult cipher proposed by a fellow cryptologist. During this time he had reorganized the Bureau du Chiffre of the Ministry of Foreign Affairs, instituting a new method of communication—probably his Dictionnaire ABC, published in 1898, which used a flexible band with numbers printed on it to facilitate superencipherment. De Viaris died on February 18, 1901.

The work of Paul Louis Eugène Valério, a captain of artillery, began appearing in the Journal des Sciences militaires in December, 1892, almost exactly ten years after Kerckhoffs’ first article. But where Kerckhoffs was concise, Valério was exhaustive. The last often installments was not published until May of 1895, by which time the work totaled 214 pages. More than two thirds was taken up by an exhaustive study of the phonological characteristics of the main European languages; Valério, who felt the drift of the times, concentrated heavily on German. The rest of the work—later assembled into book form as De la cryptographice—detailed the solutions of cipher systems and, for perhaps the first time in cryptology, of codes. Except for his exposition on code cryptanalysis, Valério added little that was new to the science, but his comprehensiveness filled in areas merely outlined by his predecessors and gave French cryptology a feeling of completion and solidity that it had lacked.

Félix Marie Delastelle was the only major writer on cryptology of the time who was not in the military. He was born January 2, 1840, at the Brittany seaport of Saint-Malo to a long line of seafaring ancestors—his father, master of an oceangoing vessel, was apparently lost at sea when Félix was three. After graduating from the College of Saint-Malo, Delastelle got a job as inspector with the government’s Tobacco Administration, with duties involving warehousing in cities as large as Marseilles, a post he held for forty years. After his retirement in 1900, the quiet bachelor moved into Ker Kador, an apartment hotel in Paramé, near Saint-Malo, where he devoted full time to writing a book on cryptology that would improve on the short one he had written seven years earlier. He signed the foreword at Paramé on May 25, and the book, Traité Élémentaire de Cryptographie, was published the following year by the respected house of Gauthier-Villars. But on April 2, 1902, while he was about to go to the home of his elder brother, Auguste Michel, who had just died, he was stricken with a heart attack, and died the same day.

His book’s 156 pages deal mostly with systems of encipherment. Delastelle accused most previous books with considerable justice of being “only catalogues, more or less complete and detailed, of various systems, of which none is studied in depth, even several that differ only in appearance. I therefore believe,” he wrote in his foreword, “that I have done something useful in classifying all these systems and in discussing how principles may be deduced from them.”

But while the individuality of cipher systems balked this plan, Delastelle’s good intentions rewarded him. While searching for a method of bigraphic encipherment that did not require cumbersome 26-by-26 enciphering tables (during which he reasoned his way to an independent invention of the Play-fair), Delastelle invented a fractionating system of considerable importance in cryptology. It differed from those of Pliny Earle Chase, who had subjected the letter fractions to substitution before recombining them. Delastelle transposed them. His cipher, the bifid, requires the fundamental bipartite substitution, which he somehow never wrote in checkerboard form:

The plaintext is written in groups of a specified length, say five letters, and the coordinates are written vertically beneath each letter. Delastelle set up his own plaintext, Attendez des ordres (“Wait for orders”), like this:

To form the ciphertext, the coordinates are paired horizontally group by group and reconverted into letters: 43 = Y, 33 = P, 12 = N, 55 = O, and so on. The complete ciphertext: YPNOA PYDZV FHIRB DJ. If a different alphabet serves for the recomposition, the system is called a bifid with conjugated matrices. If tripartite coordinates (a = 111, b = 112, c = 113, etc.) are decomposed, the elements shuffled and then recomposed in different combinations, the system is called a trifid.

Delastelle experimented to nullify Kerckhoffs’ symmetry of position by shifting the positions of key, plain, cipher, and index letters in St.-Cyr slides. The traditional arrangement regards the first letter of the stator alphabet as the index letter; the key is set under this; the plaintext is then located in the stator alphabet and the ciphertext on the slide beneath it. Delastelle burst the bonds and showed that other dispositions would serve as well. For example, the keyletter may be located in the stator alphabet and the plaintext set under it; then the letter designated as the index letter may be located on the slide and the ciphertext found on the stator above it. Because Delastelle did not move the index letter, he found only eight such dispositions. But there are actually twelve, and, despite Delastelle’s attempt, all show some kind of symmetry, whether latent or patent, vertical or horizontal, in the plain or in the cipher component.

Étienne Bazeries is the great pragmatist of cryptology. His theoretical contributions are negligible, but he was one of the greatest natural crypt-analysts the science has seen. Ciphers melted under the fierce intensity of his mental processes. Historical cryptograms, new inventions, official systems, the clandestine communications of plotters—all receded, abandoned their ramparts, and finally succumbed to his blazing onslaught. He was also the most opinionated cryptanalyst the science has known. His barbed pronunciamentos, hurled like Jovian thunderbolts, enraged his contemporaries and lashed the usually unruffled waters of cryptology into unwonted tempests.

He was born August 21, 1846, the son of a mounted policeman, in the little Mediterranean fishing village of Port-Vendres, which lies in the shadow of the mighty Pyrenees. Raised there, étienne learned Catalan at the same time he learned French. Five days after he turned seventeen, he enlisted in the Army’s 4th Supply Squadron to avoid the agricultural career his family had planned for him. He fought in the Franco-Prussian War and was taken prisoner of war when Metz fell, but escaped, disguised as a bricklayer. Promotions came slowly but steadily, despite a strong-willed individualism that refused to accept things as they are simply because they are: as a lieutenant, he nervily told a general that the regimental harness injured the squadron’s horses. He had been given his lieutenancy in 1874, and the next year was sent to Algeria on the first of three tours of duty there. On his return in 1876, he married Marie-Louise-Elodie Berthon, by whom he had three daughters.

He seems to have become interested in cryptology by solving the cryptograms in the newspapers’ personal columns, some of them setting up adulterous assignations, with whose sordid details he regaled his messmates. One day in 1890, while stationed at Nantes, he said aloud to his brother officers at the headquarters of the 11th Corps that the official French military cipher, a complicated form of transposition, could be read without the key. There was a general roar of laughter—but one who did not join the chorus was the corps commander, General Charles Alexandre Fay, one of the best-known officers of the time. He took Bazeries up on the implied challenge and sent him several cryptograms in the system. Bazeries solved them; his comrades and Fay were impressed; even the War Ministry took note, and readied a new system. Then Bazeries topped his own feat by reading the test messages in the new system before it even went into service.

Word of his ability had evidently spread beyond the parade ground, for early the next year a gentleman from Nantes, one Bord, who had invented a printing cryptograph that, Bazeries conceded, was “a jewel of an instrument,” submitted eight cryptograms enciphered with it to Bazeries. This was on January 8, 1891; by the 31st, Bord, attempting to salvage the system, was sending him five messages in a more complicated arrangement of the device. Bazeries read two more sets, of increasing complication if not difficulty, until, wanting to halt what had become for him a tedious repetition, he had Bord compose one in his ultimate system. Bazeries easily discovered that it read, “I want to be hanged if you decipher this,” hastily implored the inventor not to do anything rash, and observed later that if all those whose ciphers had been solved were to be hanged, the penalty would lose all meaning.

By now his reputation had reached the Quai d’Orsay in Paris, for in August of 1891 the Army placed him temporarily at the disposition of the Bureau du Chiffre of the Ministry of Foreign Affairs. He was promoted in 1892 to the command of his own supply squadron, and served again with the Foreign Ministry in 1894.

These years in and around Paris were his most active, cryptologically. As fast as new ciphers appeared, he smashed them. Among those he solved were the systems of La Feuillade, Hermann, and d’Ocagne, and the devices of Gavrelle and de Viaris—the latter feat one that was soon to boomerang. He became interested in historical ciphers when a commandant on the general staff asked him for help in reading some ciphered dispatches for a study of Louis XIV’s military campaigns. Bazeries solved that system, and then rifled the archives for others, succeeding in breaking down nomenclators of Francis I, Francis II, Henry IV, Mirabeau, and Napoleon. He found the campaign ciphers of the great military genius so feeble that he contemptuously put the word “ciphers” in quotation marks in the title of his monograph on them.

He bloodied his knuckles in the arena of real-life cryptanalysis, too. In 1892, French authorities arrested a group of anarchists and brought them to trial. Included in the evidence was a number of cryptograms that had been solved by Bazeries. They used a system called the Gronsfeld, a kind of truncated Vigenère named for the Count of Gronsfeld, who described it to the 17th-century author Gaspar Schott while they went together from Mainz to Frankfort. Its key consists of numbers, each of which indicates the number of letters forward in the normal alphabet that the encipherer is to count from the plaintext letter to the ciphertext letter. For example, with the anarchist key of 456327, the first word of the message of April 30, Demande, would be enciphered to HJSDPKI in this manner: counting four letters beyond d gives E, F, G, H—and H is the ciphertext letter; five letters beyond e stands J, and so on. Bazeries was not up to his usual standard here, however: the mere use of six nulls at the head and the tail of the cryptograms incomprehensibly delayed his solution for an entire fortnight. For some reason, he always considered this solution, which should have been his least distinguished, as his best.

After he retired from the Army in 1899, the Foreign Ministry hired him as a cryptanalyst. He worked partly at home, partly in the office, living much of the time at Versailles. That same year, the ministry recommended him to the police as the man who might solve a series of dispatches captured, with a numerical Beaufort table, in the quarters of one Chevilly, a supporter of the Duke of Orléans, pretender to the throne of France. The messages consisted of groups of four digits, none of which was smaller than 1111 or larger than 3737. This indicated to Bazeries that each pair of numbers stood for a letter, 11 representing A; 12, B; and so on up to 36 for Z and 37 again for A. He was put off for a good while by that rare but extraordinarily bewildering cryptologic mischance: long repetitions in a polyalphabetic cryptogram that result purely from chance and not, as Bazeries long thought, from the interaction of a periodic key with a repeated plaintext. For example, in a telegram of February 17, 1898, the digits 30 24 14 12 repeated at a distance of 21, indicating a period of 3 or of 7; when the cryptogram was solved, the first repetition proved to be the plaintext lesd enciphered by ERVE, and the second plaintext prou with key IERV. In another telegram, a false trigraphic repetition indicated a period of 8. Bazeries eventually broke the messages down by a series of inspired guesses as to probable words, and found them to fall into two sets, one enciphered with successive lines of the famous poem Nuit de décembre by Alfred de Musset, the other with the day and date on which the message was sent. Each message thus had its own key, which would have made it necessary for each to be attacked individually—except that Bazeries, after solving a few, deduced the key to the keys.

Thus he had the satisfaction of solving a message that could not be deciphered by the duke because it was loaded with errors—and of reading the duke’s short and pointed reply. The duke’s dispatch—3733 3737 1514 1224 2920 2524—was sent at 9:35 a.m. on Tuesday, December 13, 1898, after a long and fruitless night of trying to decipher the incoming message. Bazeries translated it with the key MARDI TREIZE D[ECEMBRE] and discovered one of the most heartfelt expressions of disgust ever vented by a cipherer who has received a garbled wire. Seven null q’s gave the message bulk, but the meaningful portion was monosyllabic: Merde. “The word,” the cryptanalyst remarked with uncharacteristic understatement, “is vigorous.” Bazeries later testified to these solutions at the trial of the conspirators in the High Court of Justice.

In 1913, Bazeries bought a house in Céret, a small town not far from his birthplace, in search of health for one of his daughters. Neighbors did not know that the bearded, gray-haired gentleman with the wide forehead and the piercing gaze was known as the Lynx of the Quai d’Orsay, the Napoleon of Ciphers, the Magician. They seldom saw him, for he came down from Versailles only when he had a major solution to prepare, and then he shut himself up in his house on the Place des Neuf Jets, where he would hire only illiterate servants, and, fortified with his pipes and pots of coffee, assailed the cryptograms that the Foreign Ministry sent down from Paris. Only when exhausted by a long bout would he emerge and head for a day of picnicking in the nearby mountains. His wife and three daughters, Césarine, Fernande, and Paule, dressed in the long, rustling skirts that were then the height of fashion, trailed their cane-swinging father through the village to an upland farm, where he would interrogate the farmers in Catalan and try to convince his daughters to like the local Roussillon wine that his wife could not stand. When World War I came, he assisted in solving German military cryptograms. He did not retire until 1924, when he was 78. He died at Noyon on November 7, 1931, aged 85.

But if he was continually successful in cryptanalysis, he was continually rebuffed in his years-long cryptographic battle to have the military establishment adopt the ciphers he proposed instead of the official ones which, he said, “offer little resistance to solution.” He had little trouble in demonstrating their frangibility: in addition to the Nantes solutions, he was given a test cryptogram in the army cipher by a general of artillery during one of his Algerian tours, and he solved it during a 250-mile train ride from Constantine to Philippeville. But, as he himself said, “to prove that a cipher that is being used is worthless is one thing, but it is another to propose something better in its place.”

His disdain for the official ciphers stung him into firing off two polyalphabetic systems of his own, both of which the general staff rejected on the ground that they were too complicated. A friendly officer at Nantes—perhaps General Fay—then suggested that he might have greater success if he devised an apparatus that a cipher clerk could use “without knocking his brains out.” Bazeries reworked one of his systems, which employed 20 different cipher alphabets, and came up with his “cylindrical cryptograph.” It was practically the same as Jefferson’s wheel cypher, except that it had 20 disks with 25 letters on their circumferences instead of 36 disks with a full alphabet. He offered it to the Ministry of War on February 12, 1891, backed by a recommendation from Fay, and described it on September 19 of that same year at a convention of the French Association for the Advancement of Sciences in Marseilles. The Army turned it down as too complicated. Bazeries simplified it, and resubmitted it at a meeting of the Military Cryptography Commission on February 9, 1893. Present, Bazeries relates, was the captain who had invented the system then in use, which Bazeries had solved. “We knew,” Bazeries wrote later, “that, as a foregone conclusion, he would be hostile to all inventors of cryptologic systems.” In fact the Bazeries cylinder—as it is commonly called—was not adopted, but the Marquis de Viaris, perhaps piqued by Bazeries’ shattering of his cipher device, exerted himself to solve a series of three messages sent him by Bazeries and thus rationalized the Army’s decision.

His method requires possession of the device. This presupposition was quite in line with Kerckhoffs’ principle that no military system should require the secrecy of the apparatus. Bazeries accepted the principle and contended that the key alone—the order in which the disks are placed on the spindle—assured the absolute unsolvability of the system. In the de Viaris method, the cryptanalyst begins by turning the disks so that only a’s stand on the “plaintext” line. Each successive line—called a “generatrix”—comprises all the ciphertext equivalents for a that could possibly exist on that generatrix. Furthermore, the array of equivalents on each generatrix differs from the array on any other generatrix. For example, the first two generatrices under a in the orginal Bazeries device were:

Étienne Bazeries’ drawing of his cylinder, with plaintext “I am indecipherable”

The patterning results from the peculiar way in which Bazeries constructed his alphabets to make them mnemonic. Some consisted of intercalations of vowels and consonants; others derived from keyphrases tending toward the patriotic (“God protects France,” “Honor and country”), the homiletic (“Avoid drafts,” “Instruct youth”), and the idiotic (“I like onion fried in oil”). Other alphabets would produce other patterns.

Now, these first two generatrices employ distinctive sets of letters as the substitutes for a:

The cryptanalyst now assumes that a probable word or word-fragment such as -ation has been enciphered wholly on one generatrix in the cryptogram before him. He then lists all the possible first-generatrix substitutes for a, for t, for i, o, and n in columns next to one another. These five columns he slides along under the cryptogram looking for a five-letter group whose first letter appears among the substitutes for a, whose second appears among the substitutes for t, and so on. Any such group obviously constitutes a possible first-generatrix substitute for -ation.

Suppose the cryptanalyst finds such a group. If the substitute for a in that group is v, the disk in use at that point must have been number 8. It is the only disk which substitutes v for a on the first generatrix. If the substitute were z, the disk in use must have been either 4, 5, or 6. The choices for the other letters will be similarly limited. The cryptanalyst then assembles a trial grouping of disks based on these choices, and, because the message was enciphered 20 letters at a time, makes trial decipherments at intervals of 20 letters. If little atolls of plaintext break the surface of the ciphertext sea, he obviously has found the right permutation of some of the disks. He can anagram to enlarge the islets into an archipelago, and to eventually merge them into an entire continent of clear. If no solid plaintext emerges, the cryptanalyst must move his list along under the cryptogram until another possibility appears. If none appears with the equivalents from the first generatrix, the cryptanalyst must try with those of the second, and so on. The whole process, de Viaris said, takes longer to explain than to carry out.

Despite this truly fine bit of cryptanalysis, Bazeries would not concede that de Viaris had done what he had in fact done: found a valid solution for the Bazeries cylinder. The inventor pointed out that the cryptogram presented in Marseilles remained unsolved, insisted that it never would be solved, reaffirmed his faith in his brainchild, and, in the words of a later commentator, generally displayed “a woeful lack of that intellectual generosity which a scientist must invariably display towards an antagonist when facing the collapse of his theory, even if a cherished one.”

Notwithstanding de Viaris’ solution or Bazeries’ inordinate faith, the system of simultaneous encipherment with multiple alphabets is a good one, and, with frequent key changes and some modifications, can serve as a quite effective military cipher. Though he probably never knew it, Bazeries was vindicated during his own lifetime when, in 1922, the U.S. Army adopted his system.

The rejection of his cylinder hardly stilled Bazeries’ fear that weak military ciphers imperiled his country. His fervent patriotism, his refusal to submit meekly to mere authority, his legitimate conviction that his crypt-analytic accomplishments qualified him to judge the merits of a cipher, all impelled him to put forward one final system. It conformed to the general staff requirement—possibly taken from Josse’s dictum—that it need only pencil and paper for its operation.

Basically, it consisted of a monalphabetic substitution that changed with each message combined with a transposition. Each message carried its own key at the head. The key consisted of two letters, which were turned into a number by means of the simple rule A = 1, B = 2, and so on, and this, written out as a phrase, formed the cipher alphabet. Using English, SF becomes 186, or ONE HUNDRED EIGHTY-SIX, giving a key alphabet of ONEHUDRIGTYSXABCFJKLMPQVWZ. After the plaintext was substituted by means of this alphabet, it was divided into groups of three letters and these groups reversed. Vowels could be interpolated as nulls before each such triplet; if such a group began with a ciphertext vowel, a null had necessarily to be inserted before it to prevent confusion. Bazeries felt that the change of key with each message effectively fortified his system, and he offered a sample cryptogram. Though the French cryptanalysts never solved it, the Ministry of War wrote him on April 19, 1899, that “the method does not present sufficient guarantees of security to be adopted.”

For once the bureaucrats were right; no monoalphabetic substitution can maintain security in heavy traffic. Bazeries, naturally enough, remained entirely unconvinced, and in 1901 he revenged himself in a bitter, scornful, episodic book called Les Chiffres Secrets Dévoilés (“Secret Ciphers Unveiled”). “May this revelation lead the War Department to change its locks,” he exclaims in the introduction of a book whose cover is subtly adorned with a photograph of the Bazeries cylinder. He flagellated the general staff for its “willful blindness” in matters cryptologic, rehearsed his tale of injured pride, argued anew for his ciphers, rebutted the official criticism of them. His pages rasp: “The French general staff, in adopting these methods, believed it made progress. It only retreated.” He sarcastically praised the Army’s “fine spirit of routine” and denounced its ciphers as “a public danger.”

The book is not entirely polemic. Bazeries outlined the major systems of cryptology, related some entertaining history, and disclosed how he solved the anarchist and Orléans messages. He surveyed the current literature with Olympian hauteur and convicted authors like Josse and de Viaris of “heresy” when they asserted views contrary to his own. The book exudes his personality. Bazeries invested even an arid technical discussion with his astringent tone: “To abandon the methods of substitution for those of transposition,” he pontificated, “is to change a one-eyed horse for a blind one.” That Bazeries lost his fight with the administration is cryptology’s gain, for the upshot was probably the most readable book in the whole of the science. The author’s victory is that in it he lives still.

It will be noted that, despite their differences, both Bazeries and the French general staff agreed almost axiomatically on ciphers for field operations instead of codes. The practice was almost universal during those years, and it testifies to the ascendancy of the field cipher. Spain employed a system in which a mixed plaintext alphabet slid over a list of two-digit ciphertext groups from 10 to 99; the position of the alphabet, and hence the homophonic equivalents for each letter, changed from message to message. The worthlessness of the system was exposed in 1894 by a lieutenant of infantry, Joaquín García Carmona, in his Tratado de Criptografia, the finest book on the subject in Spanish and one of the better ones in any language.

In Cuba, Jose Marti, that island’s great apostle of freedom, was using a numerical Vigenère to direct the revolutionary struggle during the early 1890s. For example, on December 8, 1894, he wrote from New York, in his famous plan for the rising in Cuba: “1. Todos los trabajos deberán dirigirse desde ahora con la idea de comenzar, todos unidos, 16, 3, 5, 10, 16, 7 17, 16, 7, 22, 19, 6, | 20, 19, 22, 6, 36, 6, | 23, 23, 7, 15, 20, 22.” He had applied the key HABANA to a tableau whose alphabets included the Spanish letters ll and ñ. Deciphered, this portion read, hbcia [hacia] fines del presente mes, making the entire clause: “1. All the work must be directed from now with the idea of beginning, all together, towards the end of the current month.” The revolt indeed broke out early in 1895. And even in faraway Ethiopia a polyalphabetic substitution with mixed alphabets played its role during the confused warfare of that ancient land to retain its independence against the colonial powers.

But while armies clung to ciphers, navies and foreign ministries employed codes. These swollen descendants of the nomenclators afforded—when kept secret—greater security than a cipher, and they saved cable tolls for diplomats and signal time for commodores. Most of the codes were one-part, and most listed both codenumbers and codewords as replacements for the plaintext. Each had advantages. The codewords were far less susceptible to transmission error than the codenumbers. The addition or omission of a single Morse dot in a cable could change a codenumber from 7261 to 7262 and alter the reading from he will to he will not, since the alphabet usually placed such phrases above their negatives in the code. This is less likely to happen with codewords, like MALSANIA and MALSANOS.

On the other hand, codenumbers were easier to handle in superencipher-ment Superencipherment consists of enciphering codenumbers or codewords to provide extra security. Straightforward substitution could be used. A sequence of codewords like PALMETO FEODALISER CONTABOR ANGROLLEN could be enciphered in monalphabetic substitution, or Vigenère, or any system, just as if it were ordinary language. (Transposition systems seem not to have been used because they would destroy the codewords. Code language did not regularize into five-letter groups until July 1, 1904, when new cable regulations went into effect.) Likewise, codenumbers could be transformed into letters by a key. Often a 10-letter word with no repeated letters, like REPUBLICAN, served to convert the numbers on the basis of 1 = R, 2 = E, and so on. But such superencipherments were used much less often than two others, based on codenumbers.

One transposed the codenumber digits. For example, 8264 could be shuffled to any of 23 other permutations. This method was proposed by F.-J. Sittler to attain secrecy in his best-selling commercial code, first published in 1868. In the Sittler code, the first two codenumber digits indicated the page, the second the line. The encoder could represent these mnemonically by PA and LI, the codenumber as a whole by PALI, and the encipherment by whatever combination was desired, as IPLA.

The second superencipherment was a form of substitution; the “alphabet” was the ordinary scale of numbers. This method added a keynumber, called an “additive,” to the original codenumber, called the “plain code,” or “placode.” The sum constituted the final cryptogram, called the “enciphered code” or “encicode.” In the late 19th century, a single keynumber usually served as the additive for all the codegroups of a message. For example, the placode 2726 7074 8471 might be enciphered with the additive 2898 to yield the encicode 5634 9972 1369—with the extra 1 that would precede 1369 dropped as being understood. A rudimentary form of this additive method had been used a century earlier by Benedict Arnold, who added a 7 to the digits of his dictionary code.

It was possible, however, to obtain the advantages of both easy superencipherment and transmission accuracy by utilizing the code’s parallel lists of codenumbers and codewords. The code clerk would note the numerical placode for his phrase, say 3043, mentally add the additive, which would have to be a simple figure like 800, and then take the codeword opposite the intermediate encicode, 3843, as the final encicode. (Somewhat the same thing had been done with dictionary codes in the United States in 1876 by J. N. H. Patrick in his telegrams concerning presidential electors for Oregon.) In this method, the conversion from codenumbers to codewords contributes a security bonus. Cryptanalysts would find it easier to determine the additive for numerical placode-encicode pairs, like 10053 and 12053, than for literal pairs, like CAVARONO and CIANICO, which furnish only the most generalized clue to the number of code elements between them.

This system, probably the most secure and advanced code system of the day, appears to have been used by the United States Navy at the time of the Spanish-American War. It marked the latest stage in Navy secret communications. In 1809, a simple monalphabetic had served for messages from the Navy Department to its future hero, Commander David Porter, at New Orleans. Responsibility for naval cryptography then rested, as it had since the Navy was founded, with the senior member of the Navy Board. In 1842, with the establishment of the bureau system, the cryptographic responsibility was assigned to the Bureau of Construction, Equipment, and Repair. In 1853, it was transferred to the Bureau of Ordnance and Hydrography, and in 1862 to the Bureau of Navigation, which retained it until 1917. In 1877, the Navy was using a Vigenère for at least some of its communications, and in 1887 it printed the Navy Secret Code, which was still in use in 1898, apparently with a superencipherment. Naval cryptography glinted briefly in the tumult surrounding the reception and decoding of one of the most thrilling code messages of the era.

As war approaches: Admiral Dewey gets a coded message from Navy Secretary Long warning Keep full of coal, the best that can be had

Ever since rumors had reached the United States of the momentousness of Admiral George Dewey’s victory over the Spanish fleet in Manila Bay on May 1, 1898, the country had been in a fever of anxiety to hear the official report. Elaborate preparations had been made to process it. Consul Wildman at Hong Kong, who was expected to get the first word by ship from Manila, was ordered to cable the message without delay. Officials remained on 24-hour duty at the State Department and in the Navy’s Bureau of Navigation, which would decode the cable. At 4:40 a.m. on the rainy morning of Saturday, May 7, the message “Hong Kong, McCulloch, Wildman” arrived, indicating that the revenue cutter McCulloch had arrived with Dewey’s report and that the Admiral’s dispatch would follow shortly. Within half an hour, Secretary of the Navy John D. Long was notified. Soon the whole city was wild with excitement.

About 9 :30, Mr. Marcan, manager of the Western Union office, appeared at the Navy Department with a sheet containing the mysterious jargon in which Dewey had coded his report. He handed it directly to Long, who looked hard at its 88 codewords, as if he would wrest their meaning from them by sheer force of personality. But all his straining anxiety could not draw an iota of sense from the message, which began:

CRAQUIEREZ REFRENANS VIJFVOETIG IMPAZZAVA PRESABERE INTRUSIVE REGENBUI EDIFIERS RETAPIEZ DECRUSAMES IMPAVIDEZ RIBOTIEZ GOLD-KRAUT RIONORAI SANSCRITO …

He handed it to Lieutenant (j.g.) Humes S. Whittlesey, one of the cryptographic officers, who disappeared with it into the Bureau of Navigation. Then Long pretended to transact other business at his desk.

Just after 10 o’clock, the Assistant Secretary of the Navy, Theodore Roosevelt, who had been in the Bureau of Navigation, stepped into the midst of the waiting newspapermen and announced, “Dewey has destroyed or captured all six cruisers.” Reporters rushed for the telephones; messenger boys pedaled furiously through the rain. Soon thereafter, Long came out and, standing in the corner window where the light was good, read out the plaintext: Squadron arrived at Manila at daybreak this morning. Immediately engaged the enemy and destroyed the following Spanish vessels: Reina Cristina, Castillia, Don Antonio de Biloa, Don Juan de Austria, Isla de Luzon, Isla de Cuba…. The list of names seemed to run on endlessly. When he finished, cheers rang through the room, and then swept the country. Not until much later did the nation decode the real meaning of the message: that the United States, having conquered possessions around the globe, had started on the road to international commitment.

At 9 a.m. on October 15, 1894, Captain Alfred Dreyfus of the French general staff reported to a meeting of several superior officers at the War Ministry on the Rue Saint-Dominique in Paris. They suspected him of having written a document that offered military information to Germany, the so-called bordereau, or memorandum. After the captain took some dictation to test his handwriting, which resembled that of the bordereau, Major Marquis Mercier du Paty de Clam arose, placed his hand on Dreyfus’ shoulder, and intoned, “Captain Dreyfus, in the name of the law I arrest you. You are accused of high treason.”

Though the arrest was kept secret at first, the anti-Semitic journal La Libre Parole scooped the rest of the Paris press on November 1 with the headline, “High Treason! Arrest of the Jewish Officer, A. Dreyfus!” The newspapers indicated that Dreyfus was in the pay of Germany or Italy, and that very day the Italian military attaché, Colonel Alessandro Panizzardi, wrote to his chief in Rome that neither he nor his German colleague knew anything of the prisoner, though he conceded that Dreyfus may have worked directly for the Italian general staff without Panizzardi’s own knowledge. As the clamor mounted in the press, Panizzardi next day felt it necessary to telegraph that, if Dreyfus had not been in contact with Rome, an official denial should be published to quell newspaper comments.

The message of November 2 went out in code and, like all other diplomatic cryptograms passing over the wires of the French Ministry of Posts and Telegraphs, an onionskin copy of Panizzardi’s text was sent to the Foreign Ministry for an attempt at solution. This cryptogram, which was to become the most sensational secret message of those gaslight years, read:

Commando stato maggiore Roma

913 44 7836 527 3 88 706 6458 71 18 0288 5715 3716 7567 7943 2107 0018 7606 4891 6165

Panizzardi

The ministry’s Bureau du Chiffre consisted of seven men.{23} Its chief, Charles-Marie Darmet, who was two weeks short of his 59th birthday when the Panizzardi telegram came in, had joined the ministry as an employee in the archives bureau 40 years previously, and had moved over to the cipher bureau three years later. He had served as a delegate to the Congress of Berlin in 1878, possibly with secret cryptanalytic duties. His rise through the ranks culminated in his appointment on January 22, 1891, as chief of the cipher bureau with a salary somewhere between 7,000 and 10,000 francs. His deputy chief was Albin-Chrysostôme Marnotte, 54, who had served in the cipher bureau for just under 37 years and had become deputy the same day that Darmet became chief. The others were Maurice-Edmé-Ludovic Gaillard, 53, with 23 years in the cipher bureau; Charles Dauchez, 46, also with 23 years’ service; Louis-Marie-Léonor Béguin-Billecocq, 29, seven years in the bureau; François Billecocq, 29, four years’ service; and Joseph-Gabriel-Claude-Hippolyte Mézière, 21, two years’ service. The three older men had all been made chevaliers of the Légion d’Honneur; the four younger, all with law degrees, seem to have been recruited directly into the cryptanalytic service.

Page 75 of the Baravelli commercial code, used in the Panizzardi telegram

The cryptanalysts recognized Panizzardi’s intermixture of one-, two-, three-and four-digit groups in a single message as that of an Italian commercial code published earlier that year in Turin by Paolo Baravelli, an engineer. This code, entitled Dizionario per corrispondenze in cifra, was constructed in four sections: table I, in which vowels and punctuation marks were represented by single digits from 0 to 9; table II, in which consonants, grammatical forms, and auxiliary verbs were represented by pairs of digits; table III, consisting of syllables indicated by three-digit groups; and a vocabulary proper, in which words and phrases were represented by four-digit groups. Some four-digit groups were left blank so the user could insert terms he found necessary.

The codebreakers furthermore remembered the Baravelli code from an amusing incident of a few months earlier. In June, a mysterious correspondence had been daily burning up the wires between the Count of Turin, a nephew of the king of Italy, and the Duchess Grazioli, a tall and voluptuous Italian living at the Hotel Windsor in Paris. Colonel Jean Sandherr, the dull and stolid head of French army intelligence, thought it smelled of espionage; Maurice Paléologue, an assistant to the Foreign Minister, whose duties included overseeing the cryptanalytic office, said that it gave off only the perfume of romance. (Paléologue was to become France’s World War I ambassador to Russia and a member of the Académie Française.) Soon Sandherr burst into Paléologue’s office with a small, flat, highly scented book. It was a Baravelli code. One of Sandherr’s agents had stolen it from beneath a packet of the duchess’s handkerchiefs while she was at the races. Two days later, Paléologue brought over the translations. They expressed, he said, nothing but “simple, elemental, natural feelings. However, one four-figure sequence which recurred in most of the telegrams remained indecipherable [presumably because it stood for a blank that the couple had filled in themselves]. All that our decoders were able to suggest was that the apocalyptic number stood for something extraordinary, unforgettable and sublime!”

This experience—in its own way extraordinary, unforgettable and sublime—had taught the cryptanalysts that, to achieve secrecy in a volume that was on public sale, the Baravelli employed an artifice common among commercial codes of the day. On each of the 100 pages devoted to the vocabulary, the words, phrases, and blank spaces were distributed in two columns of 50; each was assigned a printed number from 00 to 99. Each page was also numbered at its lower outside corner by two small printed digits that ran from 00 on the first page of the vocabulary to 99 on the last. The user could either superencipher these, or he could fill in his own page number following the large printed “Pag.” at the top of each page. He was to combine these two digits with the two digits for the words into the four-digit figure of the vocabulary section.

Similar arrangements were provided in the other sections. Table III (syllables) was set up in precisely the same way, except that the ten pages were given single instead of double digits. Table II (grammatical forms, consonants) was divided into ten groups of ten elements; the first number, indicating the group, was provided with a dotted line on which a substitute could be written; the second number, indicating the element in that group, was printed. The ten numbers of Table I (vowels, punctuation) were each preceded by a dotted line.

The Foreign Ministry cryptanalysts undoubtedly attempted to read Paniz-zardi’s message using all printed numbers—in other words, without any substitutes for the page or group numbers. The attempt yielded:

This gibberish showed that Panizzardi had made use of a superencipherment. It was the task of the French cryptanalysts to determine it—a task made more difficult by the fact that this message was the first sent by Panizzardi in this particular system.

They were abetted, however, by the peculiar construction of the Baravelli code, in which the portion of each placode number representing the line remains invariable because it is printed. With this as a start, and with the agitations of the Dreyfus disclosures, the cryptanalysts had little trouble in determining that the arrested man’s name figured in the cryptogram. The plaintext elements available in the Baravelli code permit the word Dreyfus to be broken up for encoding in only one way: dr, e, y, fus. Both dr and fus are found in Table III: page 2, line 27 for dr; page 3, line 06 for fus. The y is found in Table II, group 9, line 8; and the e in Table I, line 1. In placode form, then, Dreyfus would be 227 1 98 306.

Now the Panizzardi telegram includes a similar sequence of codegroups composed of three, one, two, and three digits: 527 3 88 706. Furthermore, the numbers in this sequence that presumably represent the lines—27, 8, and 06 (omitting the single digit from Table I)—are identical with those for Dreyfus. Obviously, then, the sequence 527 3 88 706 represented Panizzardi’s encicode for Dreyfus. From this, the cryptanalysts could see that the digits representing lines were not enciphered. They also had ascertained the encipherment of two of the Table III pages, of one group in Table II, and of a line of Table I.

With this as a start, the Foreign Ministry cryptanalysts produced—perhaps by the very next day—a preliminary decryptment that read: “Arrested [is] Captain Dreyfus who has not had relations with Germany…. ” This text, highly hypothetical, and in which the only certain word was Dreyfus, was shown to Sandherr, who was in intimate and frequent contact with the Foreign Ministry cryptanalysts. He was immediately interested, for the telegram bore on the guilt or innocence of the central figure of a sensational scandal involving his service. By Tuesday, November 6, the cryptanalysts had perceived that the group 913, which they had translated as part of arrestato in their first trial, was just Panizzardi’s serial number, and they had reached a solution which they considered exact, except for the ending: “If Captain Dreyfus has not had relations with you, it would be wise to have the ambassador deny it officially. Our emissary is warned.” These last words seemed to hint darkly at Dreyfus’ guilt, and, though that was the very part that was conjectural, Sandherr, who was disposed to think Dreyfus a traitor, borrowed the cryptanalyst’s worksheet, with its successive hypotheses stacked up beneath each codegroup and with question marks advertising the conjectural nature of the final four words, uffiziale rimane prevenuto emissario. He reported on it to his superiors, remarking to Charles Le Mouton de Boisdeffre, the chief of staff, “Well, General, here’s another proof of Dreyfus’ guilt.” Sandherr had a copy made of the worksheet, which du Paty de Clam studied with interest, and then returned the original to the Ministry of Foreign Affairs.

By the following Saturday, November 10, the cryptanalysts had finally cracked the system of encipherment used by Panizzardi, recovered the placode equivalents, and established the definitive text of the cryptogram. It read, with the placode equivalents:

first placode digit 0 1 2 3 4 5 6 7 89

second encicode digit 9 8 7 6 5 4 3 2 1 0

second placode digit 0 1 2 3 4 5 6 7 8 9

first encicode digit 1 3 5 7 9 0 2 4 68

Or, in English: “If Captain Dreyfus has not had relations with you, it would be wise to have the ambassador deny it officially, to avoid press comment.”

Panizzardi proved to have used a relatively simple system. Line digits were not touched. The two digits of the vocabulary’s printed page numbers were transposed and given substitutes according to these alphabets:

Thus the placode 1336 of capitano became 7836, and the 3306 of evitare became 7606. The second of the above two alphabets also served to encipher the page, group, and line numbers of Tables III, II, and I, respectively. Thus the placode page 3 of the 306 of fus became 7 to give encicode 706; the placode of 98 of y became 88; and the placode 1 for e became encicode 3.

This version, which in no way implicated Dreyfus, was communicated to Sandherr by Paul-Henri-Phillipe-Horace Delaroche-Vernet, a 28-year-old subordinate of Paléologue’s who served as liaison between the cryptanalysts and the Army (and who, in 1908, became chief of the Bureau du Chiffre, holding the post for five years). Sandherr was not pleased with this new version, and he transmitted it to his chiefs with the observation that “with Foreign Affairs, you can’t always be certain about these things—they lack a little precision.” Then one of his subordinates, Commandant Pierre-Ernest Matton, a 39-year-old artilleryman who was the army liaison with the Foreign Ministry, had an idea that would lay all skepticism to rest once and for all. He would trick Panizzardi into sending a telegram whose contents were known to the French; the solution of this would verify or refute the cryptanalysis of the Dreyfus message. Sandherr approved.

The Panizzardi telegram, with correct solution inserted

Matton framed a message with words chosen from pages in the Baravelli code whose numbers were critical in the encipherment and with proper names that could be divided in only one way. He artfully composed it to be so important that Panizzardi could not ignore it, and so perishable that he would have to telegraph it to Rome. It told how “A certain Y, who is now at X, will leave within a few days for Paris. He is carrying some documents relative to the mobilization of the army, which he obtained in the offices of the general staff. This person lives on Z street.” One of the proper names was Schlissenfurt, which the Baravelli can handle in only one way. Matton had a double agent slip it to the Italian attache. Panizzardi fell for the ruse, encoded the message almost verbatim and wired it to Rome at 8:10 a.m. November 13. The usual routine brought the onionskin copy to the cryptanalysts of the Quai d’Orsay. They, not knowing that the Army had the plaintext, solved the message and passed the translation to the Army because of its military import. When Delaroche-Vernet brought it over, Matton says he interrupted the young official and said:

“ ‘Will you permit me? I am going to get the original.’ I went into my office and got out the piece I had written. It was word for word the dispatch they had deciphered. I told him, ‘You may be sure now that you have the encipherment.’ ” The text that exonerated Dreyfus was irrefutably correct.

So conclusive a proof of the solution’s validity would seem to have been unchallengeable. But this would be to reckon without the persistence and tenacity of those who felt Dreyfus guilty, or who thought it better to convict Dreyfus wrongfully than to admit the Army had erred and open it to criticism. Boisdeffre and his fellow generals refused to allow the Panizzardi telegram into evidence at Dreyfus’ first trial, telling the prosecutor that the variations of the progressively more accurate solutions negated the telegram’s value as evidence. Dreyfus was found guilty of treason and interned on Devil’s Island.

But knowledge of the telegram could not be suppressed, and the anti-Dreyfus officers finally slipped a false and highly condemnatory version into the subsequent trials and appeals of the case: “Captain Dreyfus arrested; the Minister of War has proofs of his relations with Germany. Parties informed in the greatest secrecy. My emissary is warned.” This text appeared as No. 44 in the so-called Secret File; it had been dictated from memory by du Paty de Clam, who seems to have fabricated it from among the various hypotheses he saw on the original worksheet borrowed by Sandherr. This version invalidated itself by the simultaneous presence in it of both proofs and relations. Both of these stood on line 88 of different pages of the Baravelli code (provi on page 71, relazione on page 75), and so both obviously could not be the plaintext equivalent for the telegram’s encicode 0288.

Faced with such difficulties, Sandherr checked secretly with Commandant Munier, a former secretary of the Military Cryptography Commission, who obliged with some obscurantist professional cant to indicate that the wrong version was cryptologically correct. Finally, on April 27, 1899, Paléologue and two officers deciphered an authenticated copy of the original Panizzardi telegram for the Cour de Cassation. The result was, of course, the same as the final version decrypted by the Foreign Ministry cryptanalysts—the version in which Panizzardi by implication disclaimed any contact with Dreyfus. At last the correct solution entered the record. This alone did not exonerate Dreyfus; it was to take seven more years before he was to receive justice, reinstatement, and the Legion of Honor. (In the interim, the true author of the bordereau was found to be Major Ferdinand Walsin Esterhazy; among his papers, seized on his arrest, were a number of cardboard grilles, presumably for cipher communications with the German military attaché.) But the demonstration of how the false solutions had been used to bolster the trumped-up anti-Dreyfus case helped clear the man on Devil’s Island. Du Paty de Clam, the officer who long ago had arrested Dreyfus, himself exclaimed on the importance of the telegram, though he intended his words as a condemnation. “This telegram,” he declared, “is, for me, the pivot of the affair.”

When the Dreyfus case was finally closed in 1906, holocaust was less than a decade away. During those years, as the tensions increased and the world girded for battle, cryptology received degrees of attention that varied from country to country according to their individual cryptologic traditions. France had the strongest tradition. The published literature from Kerckhoffs on reflected that nation’s profound understanding of the subject. Practical applications were amply demonstrated by the Panizzardi telegram, by French solution of the Italian Foreign Office’s most secret codes three and five years after the Panizzardi solution, and by France’s possession of the German diplomatic code, which enabled her to read critical German messages on the very eve of World War I.

Army cryptology was better than Bazeries’ rough tongue gave it credit for. The Military Cryptography Commission, which consisted of approximately ten officers chosen from among all arms who had shown an aptitude for cryptanalysis, tested systems proposed for use by the Army and studied cipher systems used by other nations, particularly Germany. The commission’s president was, in 1900, the inspector-general of the military telegraph services, General François Penel, and in that year a 37-year-old engineer, a graduate of the école Polytechnique, was attached to the general staff as adjutant to Penel and secretary to the commission. This was Captain François Cartier, who was to become the chief of the French military cryptologic bureau in World War I. Before that war, Cartier had drafted a memorandum on how to solve German Army cryptograms on the basis of the drill messages, prefixed ÜBCHI, that French radio stations had intercepted during German maneuvers. The commission obtained other information from spies, deserters, and recruits to the Foreign Legion. The members, who did their cryptologic work in their spare time and received extra pay for it, formed a core of cryptologists with valuable experience. All this gave France a preponderant cryptologic superiority in 1914.

The Germans, on the other hand, seem to have disdained studying cryptology. The Junkers felt that their armies could, as in 1870, overrun the French by sheer force of arms. Cryptanalysis played a minor role in intelligence, since it required tapping telegraph wires to intercept texts. The Germans failed to foresee how much radio would be used and how much information would flow in its channels. Hence the general staff obtained what little it knew of other nations’ cryptography from its intelligence service and did not waste manpower on such frills as cryptanalysis. As for their own ciphers—were they not German? Which ended the discussion. And so German cryptology goose-stepped toward war with a top-heavy cryptography and no cryptanalysis.

Marching with them in the parade of cryptologic ignorance were most of the other armies of Europe. England had done little more than distribute field ciphers to its tiny Army; Italy was about as interested in cryptology as it was in, say, social reform. There was no organized military cryptanalytic bureau in any country except France—and Austria-Hungary.

Perhaps the Hapsburg background in cryptanalysis, stretching to the Geheime Kabinets-Kanzlei, had conditioned Austria-Hungary to think in those terms. In 1908, she intercepted Italian radiograms, and again in 1911, when they “rained” from the sky at the outbreak of the Italo-Turkish conflict over Tripoli. The alert Colonel Max Ronge, later head of the Nachrichtendienst, or intelligence organization of the general staff, saw the opportunity. In November of 1911, he instituted a cryptanalytic bureau with Captain Andreas Figl as its chief. The staff analyzed Russian cryptograms, which proved very difficult under peacetime conditions, and Ronge purchased some Italian ciphers as a headache-preventative for his cryptanalysts.

He was not the only buyer. In the E. Phillips Oppenheim world of prewar Eastern Europe, codes and ciphers were bid up and up like speculative shares in a stock-market boom. Heading the list were those of Austria-Hungary, which, as the crossroads of Europe, was a virtual ants’ nest of espionage.

According to one story, a young and remarkably attractive Italian “countess,” who had become friendly with a lieutenant in the Austro-Hungarian headquarters, sneaked a copy of a red-bound code from an open safe there and replaced it with a book that looked remarkably like it—but that had only blank pages! Some time later a code clerk pulled the book out to use it and discovered the substitution. Shock waves of consternation shook the general staff. Frenzied manhunts began. Not until the Russian attaché had laughingly told one of the staff officers that he had been offered the code, but had turned it down because the 400,000 rubles asked was too much, did the Austrians trace who had taken it.

Then there was the time a mysterious gentleman offered the Austrians a handwritten copy of the Serbian code, copied in snatched moments at the risk of life by his nephew, who worked in the Serbian code room. To prove its validity, he said, he would leave it with the Austrians, who would test it on the next two Serb telegrams. They came through the very next day and were duly decoded with the new key; they dealt with some matters of custom duties—the dull routine of embassy affairs. The gentleman got his 10,000 kronen and the Austrians a warm glow of self-satisfaction, especially when they reminded one another how a copied code was less likely to be changed than a stolen one. Soon more Serb messages trickled in. “We took our cipher out of the safe,” recalled one former staff member, “arranged our dispatches on the desk, and set to work. And we kept on working—perspiring, groaning, cursing—and could not get an intelligible sentence out of them—not a letter, a syllable, a punctuation point. With the exercise of some imagination we made one of them read, The male mother of the warship has been built.

“Then we had a bright idea. We composed a dispatch to the ambassador and put it into cipher with our 10,000-kronen key.” They marked it Urgent and sent it off. Soon an angry little Serbian secretary bounced into the Vienna central telegraph office and demanded that three hopelessly garbled telegrams be repeated. They were, of course, the two that the Austrians had first decoded with their new key and the one that they had made up with it. What had happened was that the code was a pure fake, written out by the mysterious gentleman himself, who had an accomplice send two telegrams in them to the Serbian embassy. The Serbs let them lay, undecoded, until the urgent wire shook them into action.

But the Austrians were not always on the losing end. Indeed, they showed no little ingenuity of their own at one time. Through cryptanalysis, they had identified about 150 words of the Italian code used between Rome and Constantinople. Then they bogged down. So they inserted a tidbit of military information into an Italian-language paper published at Constantinople. As they had hoped, the Italian military attaché picked up the item—verbatim, as it turned out—and sent it encoded to Rome. The Austrians began phrasing their paragraphs so as to enlarge their vocabulary, and within just three months they had a fairly workable Italian code of about 2,000 words.

As the tides of history flowed toward war, nations tightened their alliances and intensified their mobilization efforts. At a high-level meeting in London in 1911 to arrange for Anglo-French intercommunications in the event of war, it was decided, among other matters, to prepare an English-French codebook. Cartier, who was at the meeting, later returned for conferences with Britain’s Lieutenant Spiers on the code’s lexicon and its rules of service; in 1913, he checked the final draft before printing. Soon thereafter, Spiers brought three copies of the codebook to Paris—one for the French G.H.Q., one for the French Army that would have the English on their flank, a third for the French cryptologic section.

The minuteness of these preparations reflected that of War Plan w, which the British and French general staffs had completed by the spring of 1914 and which specified the billet of every battalion in the British Expeditionary Force, down to the places where the troops were to drink their coffee. The Central Powers were no less lax, and finally, in an obscure corner of the Balkans, someone helpfully slew an archduke, and the nations leaped recklessly into the bloody cockpit of war.

9. Room 40

BEFORE DAWN on the morning of August 5, 1914, the first day of a world war that was to convulse country after country and to end the lives of millions, an equipment-laden ship slid quietly through the black and heaving waters of the North Sea. Off Emden, where the Dutch coast joins the German, she dropped some grappling gear overboard with a dull splash, and shortly there rose dripping from the sea great snakelike monsters, covered with mud and seaweed. Grunts of men, chopping sounds—and soon they were returned, severed and useless, to the depths. These were Germany’s transatlantic cables, her chief communications lifelines to the world, and the vessel was the British cable ship Telconia. Though the Committee of Imperial Defence never dreamed of it when it planned the move in 1912, the cutting of these cables, England’s first offensive action of the war, forged the first link in a chain that helped to end it.

Germany was now forced to communicate with the world beyond the encircling Entente by radio or over cables controlled by her enemies. She thus delivered into the hands of her foes her most secret and confidential plans, provided only that they could remove the jacket of code and cipher in which Germany had encased them. It was an opportunity for which England was unprepared, but of which she promptly availed herself.

On that first day of the war, the director of naval intelligence, Rear Admiral Henry F. Oliver, walked to lunch with the only man at the Admiralty to take any interest in cryptology, the director of naval education, Sir Alfred Ewing. A few months before, Ewing had devised what he later called a “futile” ciphering mechanism, and he had spoken to Oliver about new methods of constructing ciphers. Oliver mentioned that some naval and commercial radio stations were sending to the Admiralty some messages in code that they had picked up and that these were accumulating on his desk. The Admiralty had no department to deal with enemy cryptograms, he said. Ewing was at once interested, and when he saw the messages that afternoon he recognized that they were probably German naval signals and that their solution could be of great value. He at once undertook the task.

Ewing was then 59, a short, thickset Scot with blue eyes beneath shaggy eyebrows, a quiet voice, and the manner of a benign physician. He had been knighted three years before for his contributions to science, which included pioneering studies of Japanese earthquakes, of magnetism, and of mechanical lagging effects in stressed materials (now known by a word he coined, “hysteresis”), and for his public services, notably his naval education directorship. He was to become president of the British Association for the Advancement of Science and perhaps his country’s greatest living expert on mechanical science. And now he was about to found a cryptanalytic bureau that was to become almost legendary and to exert a direct and noticeable effect upon the course of history.

He began by boning up on ciphers in the stacks of the British Museum library and on the construction of codes at Lloyd’s of London and at the General Post Office, where commercial codebooks were on file. He called in four teachers at the naval colleges at Dartmouth and Osborne, A. G. Denniston, W. H. Anstie, E. J. C. Green, and G. L. N. Hope, all friends of his with a good knowledge of German, and, sitting together around the table in his office, they inspected the incomprehensible lines of letters and numbers with only the feeblest general idea on how to begin.

Among those first messages was one which, had they been able to solve it, might have affected the entire course of the war. It may have been among the first batch that Oliver showed Ewing, for it had been issued at 1:35 a.m. August 4 by the German naval high command and transmitted by the powerful radio station at Nauen outside Berlin to Admiral Wilhelm Souchon, commander in the Mediterranean. Message 51 read: “Alliance with Turkey concluded August 3. Proceed at once to Constantinople.” Souchon started eastward from the central Mediterranean at once in the battle cruiser Göben and the light cruiser Breslau. The British Mediterranean squadron, convinced that Souchon would try to force the Strait of Gibraltar, patrolled the waters west of Sicily while Souchon coaled at Messina. When a British cruiser finally spotted him heading east out of the Strait of Messina, the squadron made a frantic effort to catch and destroy him, but he eluded them among the isles of Greece. On Sunday, August 10, Göben steamed into the Dardanelles, bringing, as Winston Churchill later acknowledged, “more slaughter, more misery and more ruin than has ever before been borne within the compass of a ship.” For Göben’s strength and its bombardments of Russian Black Sea ports brought Turkey into the war and sealed off Russia from her allies, contributing to her eventual capitulation and all that that would mean. Had the Admiralty been able to read Souchon’s orders then as they did retrospectively later in the war, England might have won the fateful game of hide-and-seek, with consequences perhaps greater than any other single exploit of the war.

Of all this, nothing was foreseen at Whitehall, where on that very Sunday Ewing was, he wrote to his family, “in the thick of office work, special work quite outside my ordinary lines.” The codebooks of several German commercial firms were being rounded up, but they proved of no help. Not much better was a mercantile signal-book used by German outpost vessels that had been taken from a German merchantman in Australia at the outbreak of war. Meanwhile, Russell Clarke, a barrister and a radio ham, set up the first low-frequency intercept station at Hunstanton to bring in the raw material, and soon, with the help of Clarke and another ham, Commander B. Hippisley, intercepts were trickling in by direct land line from 14 coast intercept stations to “Ewing Admiralty.”

None of the small band of pioneers had had any real previous knowledge of cryptanalysis, and they made only antlike progress in those first weeks. But Ewing was exhilarated by the job, and it was not until October 25 that he took a Sunday off. By then, England had had a stroke of fortune that gave such an impetus to its cryptanalytic work that it remained far ahead of its enemies through the rest of the war. What happened has best been told in his own style by the minister who then headed the Admiralty, the First Lord, Winston Churchill:

At the beginning of September, 1914, the German light cruiser Magdeburg was wrecked in the Baltic. The body of a drowned German under-officer was picked up by the Russians a few hours later, and clasped in his bosom by arms rigid in death, were the cypher and signal books of the German Navy and the minutely squared maps of the North Sea and Heligoland Bight. On September 6 the Russian Naval Attaché came to see me. He had received a message from Petrograd telling him what had happened, and that the Russian Admiralty with the aid of the cypher and signal books had been able to decode portions at least of the German naval messages. The Russians felt that as the leading naval Power, the British Admiralty ought to have these books and charts. If we would send a vessel to Alexandrov, the Russian officers in charge of the books would bring them to England. We lost no time in sending a ship, and late on an October afternoon Prince Louis [of Battenberg, First Sea Lord] and I received from the hands of our loyal allies these sea-stained priceless documents.

The date was October 13. Russell Clarke, who was as adept with a camera as with a crystal set, copied it by photography at his home. But even the astounding windfall of the Magdeburg codebook—perhaps the luckiest in the whole history of cryptology—did not enable Ewing’s team to read the German naval messages, for the four-letter codewords in that book did not appear in the dispatches. Finally, Fleet Paymaster Charles J. E. Rotter, a principal German expert, discovered that the code had been superenciphered with a monalphabetic substitution. Solution of such a superencipherment is not too difficult a problem with the codebook in one’s possession. As in ordinary plaintext, certain codewords recur more frequently than others and in familiar clusters, letters in one codeword reappear in others in different arrangements, and the codewords themselves possess some structural regularities: in the case of the German naval code, consonants alternated with vowels in the four-letter codewords. When these characteristics are known, the cryptanalyst can spot them almost as well as the more pronounced ones of ordinary language, and can exploit them to solve the superencipherment.

So green were the British cryptanalysts that it took them almost three weeks before they began reading portions of some German naval messages. These, Churchill says, “were mostly of a routine character. ‘One of our torpedo boats will be running out into square 7 at 8 p.m.,’ etc. But a careful collection of these scraps provided a body of information from which the enemy’s arrangements in the Heligoland Bight [bordering the northwest German coast] could be understood with a fair degree of accuracy.”

By this time, Ewing’s staff had grown to such an extent that they crowded his office, and they were continually irked by having to put their work out of sight when he had visitors on educational subjects. So about the middle of November the entire cryptanalytic group moved to Room 40 in the Old Buildings of the Admiralty. This was a large room with a small room adjoining, with a camp bed for tired staffers. Room 40, O.B., had the advantage of being out of the main stream of Admiralty traffic, yet being relatively handy to the Operations Division, which received its output. Though the cryptanalysts were later designated as I.D. 25 (section 25 of the Intelligence Division), “Room 40” was so convenient and so innocuous a name that it soon became the common identification for the organization. The name stuck even when I.D. 25 moved into larger quarters.

For it expanded rapidly. At the end of December an English trawler brought up a heavy chest containing a number of books and documents that had been jettisoned by one of four German destroyers which had been sunk in an action in the Heligoland Bight October 16. In it was found an important German codebook that was missing from the Magdeburg find. The cryptanalysts immediately used it to read signals to German cruisers harassing English shipping, but they did not discover for several months that it also served to encode messages between Berlin and German naval attaches abroad. The increase in traffic required five new men, which brought watches to two-man strength. As additional codes were discovered, more staff was enrolled, frequently in a casual British manner.

Francis Toye, a young war-prison administrator and interpreter who had worked in the British censorship and who later became a widely known music critic, attended a dinner one Thursday evening at the London home of financier Max Bonn. Among the guests was one of Room 40’s brighter members, Frank Tiarks, a partner in the banking firm of J. Henry Schroder & Co. and a director of the Bank of England.

“We talked a good deal,” Toye recalled, “and after dinner he took me aside and asked me whether I should like to come to the Admiralty. Registering proper—and wholly genuine—surprise, I answered that I could not see what use the Admiralty is likely to have for my services.

“‘Max has just told me that your German is very good,’ he replied; ‘you are obviously intelligent and presumably, from your record, trustworthy. There are hundreds of people with one of these qualifications, a number with two, but very few with all three. What about it?’

“‘What about my job, the War Office and all that?’ said I.

“‘If you’ll come you can leave everything in our hands.’

“‘But of course I’ll come if I’m really wanted.’

“‘Very well, I’ll check up on you and you’ll hear in due course.’… About a fortnight later the Commandant sent for me and silently handed me a War Office telegram: ‘Lieutenant-Interpreter Toye is to report as soon as possible to the Admiralty for special duty.’ So omnipotent and expeditious is the British Admiralty when its mind is once made up; think of the yards of red tape that must have been cut in those two weeks!”

Meanwhile, naval intelligence was building up activities concomitant to cryptanalysis. Major radio direction-finding stations were—largely thanks to Oliver’s foresight—set up at Lowestoft, York, Murcar, and Lerwick; they fed their readings into Whitehall, where they proved of immense help in locating the German fleets and the movement of the U-boats. There was no way of avoiding a fix except by maintaining radio silence. This fact was of course known to the Germans, and in view of it England made no attempt to keep its direction-finding activity secret, using it as a smokescreen for its less obvious and more valuable cryptanalytic work. Two other sources of radio intelligence were the identification of ships’ radio call-signs and the recognition of a radio operator’s “fist,” or characteristic way of sending Morse code. If the Admiralty knew that a call-sign heard under way in the North Sea belonged to the 12-gun battleship Westfalen, it would pursue tactics different from those if the call-sign was assigned to U-20. This radio intelligence, plus cryptanalysis, plus other information streaming into the Admiralty was correlated and interpreted by Admiral Sir Arthur Wilson, a former First Sea Lord and naval elder statesman who was charged by Churchill with advising the top war officials of its substance.

Thus it was that, at about 7 p.m. on December 14, 1914, Wilson came to Churchill to report that intelligence indicated a sortie of German vessels, possibly against British coasts. Less than three hours later the Admiralty ordered units of the British fleet to proceed at once to a “point where they can make sure of intercepting the enemy on his return.” So while the German First Cruiser Squadron hurled high-explosive shells into the seacoast towns of Hartlepool and Scarborough early on the morning of the 15th, four British battle cruisers and six of the most powerful battleships in the world were standing 150 miles to the eastward, cutting off their return. As the Germans headed back toward their base in the Jade River at Wilhelmshaven on December 16 after the bombardment, the weather thickened and heavy squalls reduced visibility. But the Admiralty intelligence had placed the light cruiser Southampton so precisely in the path of the German vessels that, at 10:30 a.m., Commodore W. E. Goodenough saw their shapes driving through the fog. He could not be sure that they were not British ships on station, however, so he flashed his recognition signal at them. They failed to reply; he opened fire, but soon lost contact. Two hours later, the heavy British forces sighted the enemy. But when the commander of the German light cruisers saw the giant forms of the British battleships looming up through the drizzle, he, with great presence of mind, blinked the recognition signal that Goodenough had made to him shortly before. Then he turned away and escaped behind the curtains of mist before the deception could be discovered and the 13.5-inch guns could blow him out of the water.

Disappointment was intense in the British Navy, which had been straining to test its mettle against the German High Seas Fleet. But opportunity recurred little more than a month later, when Wilson marched into Churchill’s office about noon on January 23, 1915, and announced:

“First Lord, those fellows are coming out again.”

“When?”

“Tonight. We have just got time to get Beatty there.” Wilson explained that the chief source of his intelligence was Room 40’s translation—undoubtedly with the Magdeburg codebook—of a message sent at 10:25 a.m. that morning to Rear Admiral Franz von Hipper, reading: “First and Second Scouting Groups, senior officer of destroyers, and two flotillas to be selected by the senior officer scouting forces are to reconnoiter the Dogger Bank. They are to leave harbor this evening after dark and to return tomorrow evening after dark.”

England elected the same tactics as before, and units under Vice Admiral Sir David Beatty sailed to block the German homeward trip. This time they were luckier. Contact was made at 7:30 a.m. next morning. When von Hipper saw the numerous English forces, he collected his ships and ran. The British, in their faster super-dreadnought class battleships, gave chase. By 9 a.m., Lion, carrying Beatty, could open fire at 20,000 yards. The action soon became general between the four British and the four German capital ships. Blücher was sunk, and Seydlitz and Derfflinger heavily damaged, but confusion in the British squadron after a shell had crippled the flagship allowed the German ships to escape. The Germans staggered into port, flames leaping above their funnels, their decks cumbered with wreckage and crowded with the wounded and the dead, not to stir again for more than a year.

This Battle of the Dogger Bank settled the confidence of the Admiralty in Room 40, and shortly afterwards the terrifying Lord Fisher, the new First Sea Lord, gave Ewing carte blanche to get whatever he needed for the betterment of his work. Ewing augmented his staff, installed improved equipment in his intercept and direction-finding stations, and increased their number to 50.

At about this time, the old German superencipherment failed to yield the correct codegroups. Room 40 was now more familiar with the quirks and characteristics of these codewords, and, after an all-night effort with all available staff, the new key was discovered. It seems to have been this:

This key was used in a message of February 19, 1915, directing the captain of the interned naval auxiliary Odenwald to act according to his judgment and to “avoid expenses for the empire”:

Vowels represented vowels, and consonants, consonants, to retain the pronounceability of the codewords. In the morning Churchill himself called to offer his congratulations.

Solution of the superencipherment—then worthy of a call from the First Lord—soon became routine. The Germans gradually accelerated their key changes from once every three months at the beginning of the war to every midnight in 1916. But by then Room 40 had become so proficient that the new key was sometimes solved as early as 2 or 3 a.m. and nearly always by 9 or 10 a.m.

Consequently, when Vice Admiral Reinhard Scheer, chafing under his enforced inactivity, decided to try to entice the British Grand Fleet to where his submarines could attack it and his High Seas Fleet fall upon a section of it without risking a general engagement, his orders lay at the mercy of British cryptanalysts. But it seems to have been noncryptanalytic intelligence that led the Admiralty to inform its Navy at 5 p.m. May 30, 1916, that the High Seas Fleet was apparently putting out to sea. On this news, virtually the entire Grand Fleet, that mighty armored pride of England, built up steam and sallied forth majestically from Scapa Flow, Invergordon, and Rosyth. It sought the major fleet action that would give England the undisputed control of the seas on which her strategy in the war so heavily depended.

Then there occurred one of those trifling errors on which history so often turns. On sailing, Scheer had transferred the call-sign DK of his flagship Friedrich der Grosse to the naval center at Wilhelmshaven in an attempt to conceal his departure. Room 40 was aware of this procedure, but when queried on May 31 as to where call-sign DK was, simply replied, “In the Jade River,” without mentioning the transfer. Whitehall radioed Admiral Sir John Jellicoe that directional wireless placed the enemy flagship in harbor at 11:10 a.m. Three hours later, with Jellicoe believing the Germans to be in port, the two fleets made contact in the middle of the North Sea. This rather shook Jellicoe’s faith in Admiralty intelligence. It was further jolted when he plotted the position of the German cruiser Regensburg as given by an Admiralty report and found that it appeared to be in almost the very same spot as he himself then was! No one then knew that the Regensburg navigator had made an error of ten miles in his reckoning and that the fault for the absurd result lay with the German officer and not with the cryptanalysts of Room 40.

After the brief flurries of action, inconclusive and unsatisfactory to both sides, that constituted the Battle of Jutland, Scheer at 9:14 p.m. ordered: “Our own main body is to proceed in. Maintain course S.S.E. 1/4 E; speed 16 knots.” At 9:46, he altered it slightly to S.S.E. ¾ E. Both messages were decrypted with almost unbelievable alacrity by Room 40, and by 10:41 a summary of them had been received aboard the flagship. But Jellicoe had had enough of Admiralty intelligence. Furthermore, the summary had omitted Scheer’s 9:06 call for air reconnaissance off the Horn Reefs, which would have confirmed his intentions, and thus there was nothing to contradict a battle report from Southampton that suggested a different enemy course. Jellicoe therefore rejected the Admiralty information, which this time was right. As a result, he steered one way, Scheer fled another, and Britain’s hope of a decisive naval victory evaporated in a welter of errors, missed chances, and distrust.

After Jutland, the German emphasis on submarine warfare intensified Room 40’s concentration on the U-boat messages. These were encoded in the four-letter code of the High Seas Fleet, but were superenciphered by columnar transposition. The Germans called the one for the regular U-boats “gamma epsilon” and that for the larger cruising submarines, whose keyword differed, “gamma u.” Keywords changed often but not daily. Three or four staffers specialized in this; they became so adept that they usually managed not only to restore the scrambled codewords to their original form but even to recover the keyword for the transposition tableau. The solutions greatly assisted British operations, and eventually the Germans could no longer chalk off as coincidental the repeated apparitions of substantial British units athwart their course. In August of 1916, they changed their code. But Room 40’s direction-finding and call-sign sections were so well oiled that they nevertheless maintained a fair flow of intelligence.

They did not have to bear the burden very long, however, for in September a badly burned but legible copy of the valuable new codebook was recovered from the Zeppelin L-32, which had been downed at Billericay. Nor did the Admiralty rely entirely on fortuitous circumstances. In an attempt to obtain whatever intelligence it could on new apparatus aboard the German submarines, the Admiralty had some months previously sent a diver into a U-boat sunk off the Kentish coast. He was Shipwright E. C. Miller, a thin, pale, but wiry young diving instructor possessed of an unusual courage and capacity to stand pressure at greater depths than most men. On his first descent, he entered through a hole in the U-boat’s hull and reconnoitered through a chill blackness with things bumping up against him—which his flashlight showed to be corpses. Pushing through them, he opened a small door aft of the officers’ quarters. Inside the compartment was an iron box, which was found to contain the vessels’ codes.

Miller brought up so much valuable material that he was sent down again and again. It was not pleasant work. The dogfish, he said, “are always about and will eat anything. In the mating season they naturally resent any intruder, and on lots of occasions when they chased me I offered them my boot, and they never failed to snap at it …. There were some pretty weird scenes inside the boats. … I found scores of conger eels, some of them seven to eight feet long and five inches or so thick, all busily feeding. They gave one a bit of a shock.” Despite the gruesome aspects of the job, Miller succeeded nearly every time in finding the now familiar iron box, and from one of the 25 U-boats that he explored—no Englishman was more familiar with their interior than he—he recovered the badly needed new German naval code. After the war, he was decorated at Buckingham Palace by the king.

Miller’s find helped the cryptanalysts in reading the increasing volume of enemy messages. Room 40 was now approaching the height of its power. Intercepts poured in through the pneumatic tube so fast that at times the discharge of its small containers sounded like a machine gun. (After the war it was estimated that from October, 1914, to February, 1919, Room 40 had intercepted and solved 15,000 German secret communications.) Work went on round the clock on the naval messages, even during the Zeppelin bombings, when the lights were dimmed behind the close-fitting dark blinds. The staff was further increased by wounded officers and by German university scholars, many of whom were commissioned in the Royal Navy Volunteer Reserve so that they could wear uniforms to forestall icy looks from the public. Women were enlisted to free cryptanalysts from clerical tasks. Separate sections were established for naval and political cryptanalysis. Heading the former was A. G. Denniston, one of Ewing’s original four musketeers, who proved exceedingly skillful at cryptanalysis, who came back to do similar work in World War II, and who in recognition was made a Companion of St. Michael & St. George and a Commander of the Order of the British Empire. The chief of the political cryptanalysts was George Young, who had a background of diplomacy that included posts in Washington, Athens, Constantinople, Madrid, Belgrade, and Lisbon, whence he quit a sinecure to work in Room 40, and who later succeeded to a baronetcy.

With the increase in traffic, Room 40 ceased simply passing edited intercepts to the Operations Division and began sending daily summaries that integrated the cryptanalytic with the direction-finding and other radio intelligence. Captain H. W. W. Hope was replaced as editor and correlator of the cryptanalyzed naval messages in May of 1917 by Commander William James, who later became administrative head of I.D. 25, or Room 40. Starting in November of 1916, Hugh Cleland Hoy, secretary to the director of naval intelligence, read through the hundreds of intercepts to sift the wheat from the chaff and to send the kernels on to the proper division of government—the Cabinet, the War Office, or Scotland Yard.

The staff included several men who already had or later would achieve a modicum of fame. In addition to Toye, Tiarks, and Ewing himself, there were Ronald Knox, who later became a Catholic priest and made a highly praised translation of the Bible; Dr. Frank Adcock, dean of Kings College, Cambridge, who was later knighted for his work as one of the three joint editors of the 11-volume Cambridge Ancient History, and who also served as a cryptanalyst in World War II; Desmond McCarthy, a widely known author and critic, later knighted, who, like Knox, joined only late in the war; the second Baron Monkbretton, who served as chairman of the London County Council from 1920 to 1930; and W. Lionel Fraser, later chairman of three substantial financial firms—Banque de Paris et des Pays-Bas, Cornhill Insurance Company, and Scandinvest Trust, Ltd.—and president of Babcock and Wilcox, Ltd.; Gerald Lawrence, the actor; and Professor E. Bullough, chiefly known as the son-in-law of the famous actress Eleanora Duse.

Less well known—sometimes unknown—to the public, but outstanding as cryptanalysts, were Ronald Knox’s older brother, Dilwyn, who is credited with having solved the three-letter German naval flag code in his bath, and who found cryptanalysis so to his taste that he made a career out of it in the War Office; Dr. John D. Beazley, then a tutor at Oxford and later professor of classical archaeology there, later knighted; Dr. Gilbert Waterhouse, professor of German at the University of Dublin, regarded as a “first-class performer”; Dr. Leonard A. Willoughby, lecturer in German at Oxford and later a Freeman of the City of London; Professor E. C. Quiggin, who enjoyed considerable success with the Austrian messages; and Dr. Douglas Savory, professor of the French language and Romance philology at the University of Belfast, later knighted, who, after Quiggin died, took over the Austrian traffic and produced some important solutions.

Not all in the Room 40 galaxy were cryptanalysts; in fact, in the entire personnel, there were only about 50 of this exalted breed. The others were support troops or worked on the other aspects of radio intelligence. Tiarks and Lawrence, for example, unraveled the directional bearings; the call-sign section, where Toye worked, was directed by W. F. Clarke, son of the attorney who had defended Oscar Wilde. Edward Molyneux, later a famous dress designer, came to work in Room 40 answering a telephone and sorting incoming messages as one of several wounded officers sent over by the War Office. The place was loaded with peers and social types and seemed to be sort of an Eton Alumni Club: McCarthy, Lord Monkbretton, Young, Knox, and others all had attended. The very typists had to be daughters or sisters of naval officers with a knowledge of at least two foreign languages! Their chief was Lady Hambro, who smoked cigars.

The most important personnel change came with the retirement of Ewing and his replacement as immediate overseer of Room 40 by the director of naval intelligence. On May 6, 1916, Ewing had been offered the principalship of the University of Edinburgh. It was an attractive offer, especially to one who had spent the 25 years before becoming director of naval education in 1903 as a professor of engineering or of applied mechanics. In addition, Ewing was by this time taking little part in actual cryptanalysis, for as his staff had grown, it had come to include persons whose talent for the work far exceeded his own. They would leap or fly to conclusions with an agility incomprehensible, he said, to his own pedestrian wits. He was mainly administrator of the department. He discussed the Edinburgh offer several weeks later with his chief, the new First Lord, Arthur Balfour, who also happened to be chancellor of the University. Balfour told him that he had organized Room 40 so well that he could safely delegate its supervision. Accordingly, Ewing accepted the offer as of October 1, 1916, the date on which he ceased to be director of naval education, a post he had held—not without a certain amusement—during his captaincy of Room 40. He continued to make weekly visits to Whitehall in an advisory capacity, but by the following year the claims of Edinburgh were becoming too insistent for double duty, and on May 31, 1917, he said goodbye to his Admiralty friends once and for all.

The reins of Room 40 had by then been long since in the firm grasp of a most remarkable man, a man who made an unforgettable impression on all those who met him and whose positive brilliance in espionage ably served his country just when it needed it most. He was Captain William Reginald Hall, R.N., director of naval intelligence. He had almost literally been born for intelligence work: his father had been the first director of the Admiralty’s intelligence division. Hall had joined the Navy at 14, had been promoted to captain at 35, and, after commanding a cruiser and a battle cruiser, had been appointed to the intelligence directorship in November, 1914. A dapper, alert man with a perfectly domed, prematurely bald head and a large hooked nose, Hall, then in his middle forties, looked like a demonic Mr. Punch in uniform.

But his eyes, with their penetrating, hypnotic quality, were his most remarkable feature. “Such eyes as the man has!” the American ambassador, Walter Hines Page, wrote to President Woodrow Wilson. “For Hall can look through you and see the very muscular movements of your immortal soul while he is talking to you.” A nervous tic caused one of his eyes to twitch incessantly, giving him the nickname “Blinker.” He burst with energy and confidence. “He was the most stimulating man to work for I have ever known,” Toye later wrote. “When … he spoke to you, you felt that you would do anything, anything at all, to merit his approval.” Page summed him up best: “Hall is one genius that the war has developed. Neither in fiction nor in fact can you find any such man to match him. Of the wonderful things that I know he has done, there are several that it would take an exciting volume to tell. The man is a genius—a clear case of genius. All other secret-service men are amateurs by comparison.” Hall and Page were soon to swirl together through a grave international gavotte of intrigue and propaganda that was to have the most crucial effects on the war. But neither of them guessed any of that when Hall took over officially from Ewing in the fall of 1916.

Despite its efficiency, England’s Room 40 held no monopoly on naval or diplomatic cryptanalysis during the war. In the cryptanalytic section of the French War Ministry, Lieutenant Paul Louis Bassières and the reserve interpreter Paul-Brutus Déjardin reconstructed a German U-boat code as the first triumph of their diplomatic-naval branch. Captain Georges Painvin solved the four-letter German naval code, superencipherment and all, and Commandant Marcel Givierge the three-letter flag code.

Later in the war, the French discovered that each midnight the Nauen station broadcast to U-boats in the Mediterranean the sailing times and itineraries of French ships departing Marseilles—information that had evidently been sent to the Germans by waterfront spies. French radio posts intercepted the coded messages and telegraphed them to the cryptanalytic bureau. Depending on the accuracy of the transmission, the French crypt-analysts took between 30 minutes and an hour to crack the messages. A messenger took the solutions to the Ministry of Marine by bicycle, and by 3 or 4 a.m. the harbormaster at Marseilles had been notified in time for him to alter schedules and foil the waiting submarines. Ships that had already sailed were radioed to change course. In one case, the transport Alger could not be contacted at sea because of an electrical storm. It was torpedoed and sunk with a loss of 500 soldiers and considerable matériel. The spies were later captured.

The French sent many of their naval solutions to London, but Room 40 reciprocated as minimally as possible. Hall apparently never sent the Magdeburg nor any other in-force naval codebooks to the French. His motives were understandable. England depended for her very existence on control of the seas, and every additional person who knew of the German solutions added to the danger of loss of this supremely valuable intelligence and, consequently, of the nation’s maritime mastery. But, in the opinion of Colonel François Cartier, head of the French cryptologic service, Hall exceeded all decent bounds in his jealous hoarding of his cryptanalytic secrets.

Once when Cartier was visiting Hall, he told the director of naval intelligence that his bureau was cryptanalyzing the German naval codes but had only progressed to partial solutions. Hall suggested that Cartier leave the naval traffic to the British, who had an actual copy of the German code, could read the German messages with ease, and would apprise the French of anything of importance to them. Cartier replied by telling Hall how one of the fragmentary French decryptments had enabled them to save one of their auxiliary cruisers from possible torpedoing; the English must have known of the danger from the same intercept, but they had not warned the French. The intelligence chief explained that it was better to lose the ship than to take precautionary measures that risked disclosing the cryptanalysis to the Germans. “Would you feel the same way if the cruiser had been English?” Cartier asked coldly. Hall dodged that one, and a change of code ended the negotiations.

Mutual need sometimes overrode these differences, however, and cryptanalytic collaboration continued among the Allies. England, for example, read the Berlin-Madrid diplomatic messages in both the Spanish and the German codes and offered them to the French; France managed to solve a superencipherment in this traffic the very day that it was put into service, and then sent the solution to Hall. It was in this code that the German naval attaché in Madrid radioed to Germany several times to ask for funds and instructions for agent H-21. The agent, a beautiful dancer better known by her stage name of Mata Hari, was ordered to Paris. But the French had read the messages, which were the first concrete evidence that they had been able to collect that Mata Hari was a German spy. They picked her up, and though she fiercely contended that the money was a payment from her lovers, the messages convicted her. A few months later, courageously refusing a blindfold, she was executed by a twelve-man firing squad.

The French also solved an Austro-Hungarian code, which they later got from Hall, and a naval code of the same country, which was superenciphered in a way that gave rise to such peculiar codewords as PLESDEPOTS, CODY-FIGARO, and OGNISEXUAL. The French discovered in May of 1916 that the first four digits of the ten underlying codenumbers were enciphered in two groups of two and the last six digits in two groups of three. The solution proved of great value to the Italians. The Austrians apparently later changed this code, for in the autumn of 1917, Hall learned that the Italians were having little success in obtaining information about the movements of the Austro-Hungarian fleet, despite its extensive use of wireless. He dispatched three of Room 40’s staff as a “special secret information service” to study the Austro-Hungarian signals, and the British ambassador to Italy later wrote the foreign secretary that this service “has been of great value to us to obtain rapid and sure information of what was going on on the other side of the Adriatic, and I do not think either we or the Italians would have had much if it had not been for the system which he [Hall] devised and induced the Italians to work.”

Just as the reading of secret naval and diplomatic messages was not restricted among the Allies to Room 40, so it was not restricted among the belligerents to the Allies. The Germans had finally set up a cryptanalytic section, with an intercept and transmission post at Neumünster. They succeeded in penetrating the British naval codes (whether by capture or by cryptanalysis is unknown), and during Jutland they read Jellicoe’s order massing his destroyers to his rear to shield from a torpedo attack. Neumünster passed this order to Scheer. This, together with other information, confirmed his position well astern of the British battle fleet. He therefore thought it was safe enough for him to cross his enemy’s wake—and he did, running safely for home without encountering the superior British dreadnoughts.

Room 40 intercepted and read this message. Whether it specifically motivated them to change or improve their naval systems is unknown, but it is certain that they ended the war with unquestionably the era’s finest code. This is Cypher SA, apparently invented by one J. C. F. Davidson, who received £300 for it. It went into force at noon August 1, 1918, replacing Cypher W.

Despite its name, it was a two-part code, bound in two volumes in the standard lead covers so it would sink when jettisoned in time of danger. The encoding section ran 341 pages and gave five-digit codenumbers for everything from A to Zwyndrecht, with up to 15 homophones for many plaintext expressions. Ship, for example, had that many, but the effective number was even larger because of the 35 phrases containing the word ship, as ship will be, which itself had three homophones, plus the separate entries for ships, shipping, shipped, and so on. The code included two pages of nulls, tables of digraphs and single letters for spelling words not in the vocabulary, separate sections for numbers, dates, message references, senior officers’ names, British navy warships, and names of foreign men-of-war, as well as indicators to shift to a separate “code index” with names of important merchantmen and steamship companies. The 536-page decoding section ran from 00100 (for Vathy) to 53698 (for Nought one four five), but many numbers were skipped in the codegroup series; at one point, for example, it ran 07401, 07403, 07404, 07406. The instructions called for the use of at least 25 per cent nulls in every message—which had to start with one.

The code’s major feature, however, was its extensive use of the polyphone, a codegroup that has multiple meanings. Obviously, if codegroup 07640 can mean either eight, or fifth April, or then North-ward, the task of the cryptanalyst becomes substantially more difficult. This situation prevailed in Cypher SA with a large percentage of the groups. How, then, could the legitimate decoder keep the meanings separate, so that he would not inadvertently select eight when fifth April is meant? The code distinguished between the three meanings by tagging the three polyphones with an A, a B, or a C both fore and aft of the codenumber. In encoding, the code clerk had to pick the codegroup that had the same letter in front of it as the codegroup preceding had behind it. In other words, a group ending with a B must be followed by one beginning with a B. The code was so constructed that wherever the clerk had to make this selection, a choice of codegroups was provided. All the polyphones, in other words, were homophones (but not vice versa). The code clerk dropped the letters before transmitting the cryptogram. The decoder could pick up the thread with the first group, a null, because all the nulls and many plaintext groups were prefixed with a dash. This meant that they did not have to follow any particular letter, and so could serve as the free end of a chain. The letter at their tail, however, forged the first link in this chain, which the decoder tracked through his codebook.

Polyphones are a powerful weapon for confusing a cryptanalyst, for a codegroup may not always be what it seems. This is not to say that Cypher SA was unbreakable; but it undoubtedly would have demanded considerably more time, more traffic, and more corollary information than others. The connoisseur may also revel in its exquisite ingenuity.

Hall’s supersession of Ewing roughly coincided with the end of the great sea battles. This was largely due to Room 40. “Without the cryptographers’ department there would have been no Battle of Jutland,” Churchill wrote, and Jutland bottled up the German fleet so effectively that it never ventured forth again. The closing of this phase of the war reduced the need for tactical intelligence, and Hall, as aggressive as any man, shifted the emphasis to the strategic. He gained access to the larger and more exciting arena of international affairs through Room 40’s diplomatic decryptments. This was usurpation of power, for his province was nominally just naval intelligence, and indeed, while the Foreign Office appreciated his information, it grudged him his powers. But it was helpless to stop him, for his control of Room 40 made him absolute master of the vital information it produced, from disclosures of the far-flung subversions and conspiracies and aggrandizements of the Central Powers to the coded squeakings of a minor spy. Though Hall did pass this information to other governmental departments (usually in a form that concealed the source), he also stuck his fingers into more than one political pie. Fortunately for Britain, he nearly always came out with plums.

A page of the encoding section of Admiralty Cypher SA, showing homophones

He was doing this even before Ewing left. There was, for example, the German plan for a revolt in Persia, bared by Room 40’s cryptanalysis of the plotters’ messages. In another case, Trebitsch Lincoln, an embittered former member of Parliament, sent military information to the German consul in neutral Rotterdam in one dictionary code and two jargon codes that were solved by Room 40. In one of the jargon systems, family names meant ships or ports; in the other, various petroleum products stood for them. A message that read CABLE PRICES FIVE CONSIGNMENTS VASELINE, EIGHT PARAFFIN really meant [At] Dover [are] five first-class cruisers, eight sea-going destroyers. Lincoln, unfortunately, evaded the British authorities and escaped to New York.

Room 40 also read coded messages involving Sir Roger Casement, the former British consul who, after failing to recruit an anti-English battalion among Irish prisoners-of-war in Germany, sought to raise rebellion in Ireland. Several of these cryptograms were passed between Berlin and German diplomatic posts in the United States. One urged German military support of the rebellion by “troops, arms, and ammunition”; another dealt with the transmission of $500 to Casement by John Devoy, an Irish agitator in America who had arranged for Germany’s delivery of 20,000 rifles and ten machine guns for the uprising. Another message read by Room 40 reported to Devoy that Casement’s sailing on a submarine was imminent and arranged that the codeword OATS would be cabled if the U-boat left with Casement aboard as scheduled and the codeword HAY if there was a hitch. On April 12, 1916, among the day’s usual batch of intercepts appeared one containing the word OATS. Ten days later, Casement landed near Tralee Bay—and was promptly arrested by waiting authorities. He remained cool, giving a false name and saying he was a writer, but on the way to Adfert Barracks he tried to discard a piece of paper on which was written a small code of phrases he might need, such as send more explosives. The police saw it and confiscated it for evidence. He was tried and convicted of high treason. Hall deflated the strong public pressure for a reprieve by surreptitiously circulating through London clubs and the House of Commons specimen pages of Casement’s homosexually-inclined “Black Diaries.” Casement was hanged on August 3.

A page of the decoding section of Cypher SA, showing poly phones

Not all Hall’s activities were so nefarious. Spy scares were rampant, so much so that when a bird flew up from near where a foreign-looking individual stood, a hysterical bystander called police, convinced that the “alien” was sending messages to the enemy by homing pigeon. One day a self-described “code expert” from the London financial district came to tell Hall that he had solved secret messages relating to the movement of troops that had been concealed as personal advertisements in newspapers. The head of naval intelligence listened attentively and invited him to return when he had further proofs. Then Hall, who was not without a sense of humor, composed a suspicious-sounding message and inserted it in the personal column of The Times. Next day the expert arrived, highly agitated, with a “solution” that disclosed that certain battleships were about to sail from the naval ports of Chatham, Portsmouth, and Plymouth. His reaction when Hall told him what had happened is, regrettably, not recorded.

At about half-past ten on the morning of January 17, 1917, the Reverend William Montgomery, a thin, gray-haired scholar of the early church fathers who was serving as a cryptanalyst in the diplomatic section of Room 40, came to tell Hall of what looked like an important message. Montgomery’s instincts were right. The cryptogram that he and a youthful colleague, Nigel de Grey, had partially read was to become the single most far-reaching and most important solution in history.

The message was a long one, consisting of about a thousand numerical codegroups. Dated at Berlin January 16, it was addressed to the German ambassador in the United States, Count Johann Heinrich Andreas von Bernstorff, and the two cryptanalysts recognized that it was encoded in a German diplomatic code known as 0075, upon which they had been working for six months. Room 40 knew from its analyses that 0075 was one of a series of two-part codes that the German Foreign Office designated by two zeros and two digits, the two digits always showing an arithmetical difference of 2. Among the others, some of which Room 40 had solved, were 0097, 0086, which was used for German missions in South America, 0064, used between Berlin and Madrid and perhaps elsewhere, 0053, and 0042. Code 0075 was a new code that the German Foreign Office had first distributed in July of 1916 to German missions in Vienna, Sofia, Constantinople, Bucharest, Copenhagen, Stockholm, Bern, Lugano, The Hague, and Oslo. Somehow the British obtained copies of enough of the telegrams in this code to enable Montgomery and de Grey, whose assignment it probably was, to make a start in breaking it. In November, Room 40 began intercepting messages to the German embassy in the United States in the same code, and if Hall guessed that the code and the keys to the superencipherment that it sometimes used had been sent across the Atlantic on the second voyage of the cargo U-boat Deutschland, which docked at New London on November 1, 1916, he would have been right.

Montgomery and de Grey could read only parts of the long message. But they could see that it was a double-decker, consisting of Berlin’s messages Nos. 157 and 158 to Bernstorff. They could read the signature of the German Foreign Minister, Arthur Zimmermann. As far as they could extricate its sense on the basis of their partial solution of 0075, the second message read:

Most secret for your Excellency’s personal information and to be handed on to the Imperial Minister in (? Mexico) with Telegram No. 1 (…) by a safe route.

We propose to begin on the 1st February unrestricted submarine warfare. In doing so, however, we shall endeavor to keep America neutral. (?) If we should not (succeed in doing so) we propose to (? Mexico) an alliance upon the following basis:

[joint] conduct of the war.

[joint] conclusion of peace.

(…)

Your Excellency should for the present inform the President [of Mexico] secretly (? that we expect) war with the U.S.A. (possibly) (…) (Japan) and at the same time to negotiate between us and Japan. (Please tell the President) that (…) or submarines (…) will compel England to peace in a few months. Acknowledge receipt.

Zimmermann.

Montgomery handed this fragmentary solution to Hall, who stared down at the phrases that seemed to jump off the page at him: “unrestricted submarine warfare,” “war with the U.S.A.,” “propose … an alliance.” He realized at once that here was a weapon of enormous potentiality. He urged Montgomery to hurry the solution, ordered all copies except the original message and a single solution burned, and, without a word to the Foreign Office, sat down by himself to contemplate the situation.

It was as bleak as that winter’s day. The war that everyone had expected would last only a few weeks had now dragged into its third year. Nor was there any prospect of an end. France had expended half a million lives at Verdun and only succeeded in restoring the battle line to where it was ten months before. England, which had lost 60,000 men at the Somme in a single day, struggled to gain a few yards of shell-blasted earth, then fell back exhausted. The Hindenburg line remained unbreached. Rumania, a new ally, had been quickly overrun, and Russia, the colossus of the east, was virtually defeated. The stepped-up U-boat campaign increased the economic pressure on the Allies. Worst of all, despite the provocation of the Lusitania sinking and despite the tug of ancient common ties, the United States, guided by a President who had just won reelection on the slogan “He kept us out of war,” remained obstinately neutral.

Things were no better in Germany. Her initial offensive had stalled at the Marne and her gray-coated troops had been locked in the futile trench slaughter ever since. Civilians were living on potatoes—a result of the stranglehold of the British blockade. Fifteen-year-olds were being conscripted. Greece and Portugal had recently entered the war against her. Like the Allies, she could see no immediate hope for victory.

Except one.

Unleash the submarines, the generals cried, and England would soon be “gasping in the reeds like a fish.” The blockaders would become the blockaded. For months the generals had hammered away on this theme, and, as the signs of exhaustion multiplied, they finally prevailed. Foreign Minister Zimmermann, who had long opposed the idea, fell in line. But this big jolly bachelor, the first to break the Junker barrier in the higher regions of the Kaiser’s officialdom, perceived that the repeated sinkings of American vessels would sooner or later torpedo American neutrality, and he bethought himself of a scheme to counter this danger. He proposed a military alliance with Mexico, then particularly hostile to the imperialistic Norteamericanos as a result of Pershing’s punitive expedition into Mexican territory. He sweetened the proposition with an offer of money and the possibility of support from Japan, standing at America’s back, and with still more anti-Yankee inducements.

Unable to deal through the Mexican ambassador, who was in Switzerland, Zimmermann sent his proposal to his minister in Mexico, Heinrich J. F. von Eckardt, by way of Washington. To ensure that it would get there, he routed it two ways, both monitored by Britain. The cruise of Telconia was paying off.

One way was called the “Swedish Roundabout” by the British. Sweden, which was neutral in favor of Germany, had since early in the war helped the German Foreign Office get messages past the British cable blockade by sending them as her own. British censorship detected this practice. When Sweden complained in the summer of 1915 that Britain was delaying her messages, Britain informed her that it had positive knowledge of the unneutral practice. The Swedish government admitted this and promised that it would no longer send any German messages to Washington. It did not. Instead, it sent them to Buenos Aires. Here they were transferred from Swedish to German hands and then forwarded to Washington. This was a circuitous route of about 7,000 miles, half of them in flat violation of the prerogatives of a nonbelligerent.

But the cable from Stockholm to South America touched at England. Germany feared that British censorship might recognize the German codegroups in the Swedish messages and would stop the dispatches. So the German Foreign Office disguised the codegroups by enciphering them. This was done with Code 13040 in messages to Latin America and to Washington. Unfortunately for the Germans, the superencipherment did not obliterate all traces of the underlying code, which employed a distinctive mixture of 3-, 4-, and 5-digit codegroups. These traces aroused the suspicions of the ever-alert Room 40; it resolved the superencipherment, and Code 13040 reappeared. Room 40 then looked closely at other official Swedish messages. Many of them proved to be German as well; concealed under one superencipherment, for example, they found Code 0075. But this time England entered no protest. Hall perceived that it was more advantageous to listen to what the Germans were saying than to stop them from talking.

The second route that Zimmermann used was of such simplicity, perfidy, and barefaced gall that it probably remains unequaled in the annals of diplomacy. It had its inception in the pompous mind of Colonel Edward M. House, President Wilson’s alter ego and a major exponent of personal diplomacy. On one of his missions to Europe in 1915, House arranged to have coded reports from the embassies cabled directly to him, bypassing the State Department. When, on December 27, 1916, Ambassador Bernstorff discussed a new peace attempt by Wilson with House, he pointed out that the chances would be improved if his government could communicate directly with Wilson through House. House checked with the President. The next day Wilson permitted the German government to send messages in its own code between Washington and Berlin under American diplomatic auspices—an arrangement that was, at best, simpleminded, and that, furthermore, contravened the accepted international practice of requiring the messages to be submitted in clear for transmission in American code.

Germany availed herself of this arrangement to make America seal her own doom by letters she herself bore. Under the aegis of American sovereignty, Zimmermann sent his message striking at that sovereignty. It was delivered to the American embassy in Berlin at 3 p.m. January 16. It could not go direct to Washington, but had to be sent first to Copenhagen—and then to London. Only from there could it go to Washington. Consequently Britain seized this copy as well. Room 40 was “highly entertained” at the sight of the German code in an American cable, but again did not protest.

With two copies of the same text helping to eliminate garbles, Montgomery and de Grey rammed into the cryptogram. De Grey, though at 30 the younger of the two, had been in Room 40 the longer. Slightly built, rather handsome, with dark hair and brown eyes and chiseled, movie-star features, an Eton graduate, he was descended from the peerage as the grandson of the fifth Baron Walsingham (no relation to Sir Francis Walsingham). He had worked for the prestigious publishing house of William Heinemann for seven years before the war, when he joined the Royal Naval Air Service. He came to Room 40 in 1915.

Soon after his work on the cryptogram that became known as the Zimmermann telegram, he left 40 O.B. to serve as head of the naval intelligence mission that Hall had sent to Rome. After the war, he became director of the Medici Society, a publishing house specializing in art prints. In 1939, his government remembered his World War I services, and he joined the cryptanalytic division of the Foreign Office, soon becoming deputy director. A man who listed as his recreations the odd threesome of shooting, gardening, and acting, he also enjoyed carpentry and was useful around the house. He died May 25, 1951, leaving two sons and a daughter.

Montgomery was 45 at the time of his work on the Zimmermann telegram. A Liverpool shipowner’s son who studied in private schools or under tutors in England, France, and Germany, he took a bachelor of divinity degree at Presbyterian College, London. But his health prevented an active pastorate and he became a member of St. John’s College at Cambridge University. He specialized in early church history, editing the Confessions of St. Augustine for the Cambridge Patristic Series and writing a study on the life and thought of the African father. His most memorable work, however, was as a translator. It was said of his translation of Albert Schweitzer’s The Quest of the Historical Jesus in 1910 that “no German work has ever been rendered into English so idiomatically and yet so faithfully.” A modest, reticent man, Montgomery entered the censor’s office in 1916, and later that year transferred to Room 40. Cryptanalysis so suited his aptitudes that after the war he continued the work in the Foreign Office, remaining there until his sudden death in October, 1930.

While in Room 40 his familiarity with Scripture unriddled a problem that had baffled most of the other staffers. A Sir Henry Jones had received a blank postcard from Turkey addressed to him at 184 King’s Road, Tighnabruaich, Scotland. Sir Henry knew that the card was from his son, who had been captured by the Turks, but Tighnabruaich is a small village, with no King’s Road and so few houses that no number would have been needed in any case. The card found its way to Room 40, where nobody seemed able to ascertain what Sir Henry’s son was trying to tell him. Finally Montgomery suggested a reference to chapter 18, verse 4, of one of the books of Kings. Second Kings shed no light, but First Kings revealed that “Obadiah took a hundred prophets, and hid them fifty in a cave, and fed them with bread and water.” Montgomery interpreted this to mean that Sir Henry’s son was safe with other prisoners but in need of food—and this proved to be the case.

But the solution of the Zimmermann telegram required more than a flash of inspiration. It demanded the reconstruction of Code 0075, a two-part code of 10,000 words and phrases numbered from 0000 to 9999 in mixed order. Since a code is, in a sense, a gigantic monalphabetic substitution, the establishment of plaintext equivalents is the “only” task involved. But where the cryptanalyst of cipher deals with only 26 such elements, the cryptanalyst of code must keep his eye on hundreds or thousands, whose characteristics, moreover, because of their reduced frequency, are much scantier and more diffuse than the sharply defined traits of letters.

Solution usually begins with the identification of the groups meaning stop. Groups that recur near the end of telegrams are likely candidates. The identification of stop or period is often aided because often only a few of the many code equivalents are employed. Code clerks, referring frequently to stop, come to memorize one or two of its codegroups; they then simply use these groups in encoding instead of hunting up a different one in the codebook. Indeed, cryptanalysts familiar with a given embassy’s messages can often tell when a new code clerk has been hired by the sudden efflorescence of new equivalents for stop!

The identification of the stops outlines the structure of the message. In English messages, nouns, as the subjects of sentences, will often appear directly after stops. In German, where the predicate often comes at the end of the sentence, the codegroup immediately preceding a stop may be a verb. Other clues come from the stereotyped expressions that diplomats so love in their dispatches: “I have the honor to report to Your Excellency….” Collateral information is of very great value.

The first tentative identifications are usually written in pencil for easy erasing, and such are called “pencil groups.” Eventually, further traffic confirms them and they become “ink groups.” Solution proceeds much more rapidly if a code is one-part. If codegroup 1234 represents a word beginning with d, then 5678 must represent one farther back in the alphabet; this both rules out some guesses and suggests others. Sometimes the meaning of a codegroup can be indicated rather precisely by its location between two ink groups. This is not possible with a two-part code, where the code and plain equivalents are matched in an absolutely arbitrary fashion. Code 0075 was of this type. It required more traffic for its solution than a one-part code, and the identifications came more slowly and with greater difficulty. It had been in service on the Continent for only half a year—not a very long time for a diplomatic code—and portions of many messages remained unreadable.

As more traffic came in (including now the messages to and from Bernstorff), Montgomery and de Grey, working night and day, filled in more and more groups, ever more rapidly. On January 28, de Grey brought Hall part of Bernstorff’s protest against Zimmermann’s plan of unrestricted submarine warfare, which, to the ambassador’s dismay, had been announced to him in message No. 157, the first part of the double-decker. Bernstorff argued vigorously against this plan, for he felt that it negated all his efforts to bring about a détente between the two countries and that it would drive the United States into the war on the side of the Allies.

And in fact, on February 3 Wilson announced to Congress that he was breaking diplomatic relations with Germany, as he had said he would the previous April if Germany continued its course of submarine warfare. Though he added that “only actual overt acts” on Germany’s part would make him believe that she really would sink neutral vessels on the high seas, it must have seemed to the war-weary Allies that now, at last, within a few days or a fortnight at most, the United States would enter the war. Day by day, they awaited the final inevitable step.

While waiting, Room 40 continued its work on Code 0075. De Grey had taken to Hall Bernstorff’s message giving details of his interview with Wilson severing relations. Recovered codegroups were substituted into the Zimmermann telegram, and on February 5 Hall was able to show a more fully solved version of it to Lord Hardinge at the Foreign Office.

Hall had realized from the first day that Montgomery had brought him the first sketchy solution of the Zimmermann telegram that he had in it a propaganda weapon of titanic proportions. Exposure of this German plot directed against the United States would, in the present circumstances, almost certainly compel that nation to declare war on Germany. This was an immensely strong argument for showing it to the Americans. But for the moment, at least, even stronger considerations militated against it. First, Room 40 and its cryptanalytic capabilities was one of Britain’s darkest secrets. How could she disclose the message without Germany’s guessing that her codes were being read? Britain might minimize the risk by hinting that the plaintext had been stolen, but the danger would still remain that Germany would suspect the truth, change her codes, and deprive Britain of her most valuable intelligence. In the second place, to reveal the message, Britain would have to admit that it had been supervising the code telegrams of a neutral: Sweden. It would not require much wit for the Americans to surmise that England might also be supervising the code telegrams of another neutral: the United States, which, like Sweden, was working as a messenger boy for the Germans and had, in fact, transmitted this very message. This realization would both embarrass and anger the United States and would not conduce to pro-Allied feelings. In the third place, the solution was still not complete. The missing portions would inevitably raise doubts about the validity of the solution and so weaken its impact. Perhaps the British had failed to solve a word like “not” that would completely alter the sense, the arguments would run. Perhaps the British had not even correctly solved the portion that they were offering as evidence of German duplicity. Moreover, the gaps would shout “codebreaking,” preventing any subterfuges about captured codes or a stolen message and exposing the very secret Britain sought to conceal.

But the most powerful argument against disclosure of the German plot, with all the attendant difficulties, was that events might make it unnecessary. Relations had been severed between Germany and the United States. American public opinion seemed to be turning increasingly against Germany. Shipping dared not sail; ports were congested; men were laid off; business languished. Bitterness was growing. It seemed only a matter of a short while until the declaration of war. And so the British continued to wait, and to hope.

Hall, however, while waiting for events to dictate, did not remain idle. His job was only half done if he merely solved the Zimmermann telegram without making it ready for use by his government. Consequently, he conceived a plan that at one-stroke might resolve the three difficulties connected with the telegram’s exposure, in what still appeared the unlikely event that that might be necessary. He reasoned that the telegram as received in Mexico would differ in small but significant details from the telegram as sent from Berlin. The date would almost certainly be different, and probably the serial number as well. The preamble addressed to Bernstorff ordering him to forward the message would of course be omitted. If Hall could produce the copy from Mexico, perhaps the Germans would spot these slight variations and infer that the plaintext had been betrayed on the American continent and would not change their codes. Other collateral details might confirm a tale of a Mexican theft to the Americans. Moreover, Room 40 perhaps knew, from its numerous solutions of German messages via the Swedish roundabout, that the German mission in Mexico had not used Code 0075 and probably did not hold it. Bernstorff might then have had to re-encode the Zimmermann telegram in another code, which Room 40 might have solved more completely than 0075 and which might therefore enable it to fill in the missing portions in its solution.

On February 5, therefore, Hall began trying to get a copy of the Zimmermann telegram as received in Mexico. An English agent known only as T obtained from the Mexico City telegraph office a copy of the message that Bernstorff had sent to Eckardt by Western Union. Soon Hall had it.

It proved him right in every one of his assumptions. Eckardt did not have Code 0075, and so Bernstorff had had to recode the dispatch in one that Eckardt did have. This was Code 13040, which was an older and simpler code than 0075 and whose superencipherment had led to the discovery of the Swedish roundabout. It had been distributed to German missions in Central and South America between 1907 and 1909 and to Washington, New York, Havana, Port-au-Prince, and La Paz in 1912. Its basic repertory contained about 25,000 plaintext elements with a fair number of homophones—Bernstorff’s telegram alone employed six different groups for zu—and proper names took up a huge section of 75,000 codenumbers. But Code 13040 was a cross between one-part and two-part codes. In the encoding section, blocks of several hundred codenumbers in numerical order stood opposite the alphabetized plaintext elements, but the blocks themselves were in mixed order. A skeleton code, made up from a few groups from Bernstorff’s encoding, will illustrate this:

Encoding	decoding
13605 Februar	5144 wenigen
13732 fest	5161 werden
13850 finanzielle	5275 Anregung
13918 folgender	5376 Anwendung
17142 Frieden	5454 ar
17149 Friedenschluss	5569 auf
17166 führung	5905 Krieg
17214 Ganz geheim
17388 Gebeit
4377 geheim
4458 Gemeinsame

The solution of such a hybrid code stands midway in difficulty between the two pure types: harder than a one-part code but easier than a two-part. The large orderly segments considerably help the cryptanalyst, though his guesses are not as delimited as in a one-part code. For example, the cryptanalyst could not assume, as he could in a one-part solution, that a codegroup for Krieg will be higher in number than the codegroup for Februar. But if he knows that Februar is 13605 and finanzielle is 13850, he will know that the codegroup for fest must almost certainly fall somewhere between the two. His identifications thus come with greater speed and certainty.

Owing to this weakness, and to the fact that they had had all of the war to work on a great volume of messages, the codebreakers of Room 40 had recovered most of Code 13040’s commonly used groups. They could consequently read all or nearly all of Bernstorff’s message to Eckardt, and in those few places where a rare proper name or syllable might have been used for the first time, the partial alphabetical arrangement afforded a strong check on their guesses. This eliminated the problem of having only a partial solution. In addition, it confirmed their almost-complete solution of the original Berlin-to-Washington message and added a few new values to their reconstruction of Code 0075.

The Zimmermann telegram as re-encoded in Washington into Code 13040 and forwarded to Mexico

The cryptanalysts also found the slight changes in heading that Hall had foreseen. Bernstorff had deleted the Foreign Office preamble and substituted one of his own: “Foreign Office telegraphs January 16: No. 1. Most Secret. Decode yourself.” He replaced the Berlin-Washington serial number with a Washington-Mexico City serial number, which was 3. And finally, his message was dated January 19, which, due to the numerous steps in the complicated transmission routes, differed from the January 16 date that the original German text bore.

Fairly early in February, it seems, Hall was ready. With a stroke bordering on genius, he had done his job. His must stand as one of the most subtly dissembling moves in the whole history of espionage. It was now possible to give the message to the Americans, should that prove necessary, with as little risk as possible to Britain’s intelligence sources. But though Hall had covered his tracks fairly well, it remained possible that the Germans might guess the truth. Events might yet make it unnecessary to chance this. So Britain held the message and waited.

And waited. The days passed. On the Western Front the lifeblood of the Empire and of the French republic trickled into the earth. The armies shuddered in mortal combat. Still there came no sign that America was going to enter the war. Though it seemed that Germany’s announcement of unrestricted torpedoings of American ships had made, as Bernstorff himself had warned in cables read by Room 40, “war unavoidable,” the American President seemed unable to do what the British thought that honor, self-respect, and the whole course of recent actions made obligatory. Even Ambassador Page, a long-time friend of the President and a wholehearted sympathizer with the Allied cause, was irked enough to note in his diary, “The danger is that with all the authority he wants (short of a formal declaration of war) the President will again wait, wait, wait—till an American liner be torpedoed! Or till an attack is made on our coast by a German submarine!” Evidently Wilson was waiting for the “overt acts” that he had mentioned in his address to Congress. But perhaps Germany would not actually be so rash as to torpedo American ships and thereby—Britain thought—cut her own throat. More days passed. The Germans did nothing. Tension mounted. The situation was, a British diplomat in America reported, “much that of a soda-water bottle with the wires cut but the cork unexploded.”

It exploded on February 22, 1917. Unable to wait any longer, the British gave the cork a push. Hall, with Foreign Office approval if not under its orders, showed the Zimmermann telegram to Edward Bell, a secretary of the American embassy who maintained liaison with the various intelligence offices of the British government. He read an astounding tale of German intrigue against his country:

We intend to begin on the first of February unrestricted submarine warfare. We shall endeavor in spite of this to keep the United States of America neutral. In the event of this not succeeding, we make Mexico a proposal of alliance on the following basis:

Make war together, make peace together, generous financial support, and an understanding on our part that Mexico is to reconquer the lost territory in Texas, New Mexico and Arizona. The settlement in detail is left to you.

You will inform the President [of Mexico] of the above most secretly, as soon as the outbreak of war with the United States of America is certain and add the suggestion that he should, on his own initiative, invite Japan to immediate adherence and at the same time mediate between Japan and ourselves.

Please call the President’s attention to the fact that the ruthless employment of our submarines now offers the prospect of compelling England in a few months to make peace.

Zimmermann.

Bell did not believe it. The notion that anyone in his right mind would consider giving away a chunk of the continental United States was simply too preposterous. But Hall convinced him of its authenticity, and the two went over to Grosvenor Square. When Page saw the message, he realized at once that the entry into war on England’s side, which he had so single-mindedly pursued and the President had so obstinately opposed, was at last delivered into his hands. Hall, Bell, Page, and Irwin Laughlin, first secretary of the embassy, spent the day trying to decide how best to instill confidence in the telegram’s genuineness, to minimize incredulity, and to maximize its impact. They decided that the British government should officially present the telegram to Page, and in his room at the Foreign Office the next day Arthur Balfour, now secretary of state for foreign affairs, formally communicated it to Page in a moment that Balfour later confessed was “as dramatic a moment as I remember in all my life.”

Page worked all night to draft a covering message explaining how the telegram was obtained. At 2 a.m. February 24 he cabled, “In about three hours I shall send a telegram of great importance to the President and Secretary of State,” but it was not until 1 p.m. that the Zimmermann telegram, with his explanation, was transmitted. He gave the President the collection of half-truths that Hall had given him—for Hall naturally withheld the deep secret of British cryptanalytic ability, particularly since it might start the Americans wondering whether Britain was reading their code messages as well:

Early in the war the British government obtained possession of a copy of the German cipher code used in the above message and have made it their business to obtain copies of Bernstorff’s cipher telegrams to Mexico, among others, which are sent back to London and deciphered here. This accounts for their being able to decipher this telegram from the German government to their representative in Mexico, and also for the delay from January 19th until now in their receiving the information. This system has hitherto been a jealously guarded secret and is only divulged to you now by the British government in view of the extraordinary circumstances and their friendly feeling toward the United States. They earnestly request that you will keep the source of your information and the British government’s method of obtaining it profoundly secret, but they put no prohibition on the publication of Zimmermann’s telegram itself.

Page’s pilot telegram rattled the Morse sounders at the State Department at 9 a.m. Saturday, February 24, but the “telegram of great importance” did not arrive until 8:30 that evening. Frank L. Polk, counselor of the department and acting secretary in the absence of Secretary of State Robert L. Lansing, telephoned to ask the President to expect him and carried the four typewritten yellow sheets across the street to the White House. Wilson, Polk reported, showed “much indignation” on reading it, and wanted to make it public at once. But he agreed to Polk’s suggestion to await Lansing’s return from a long weekend.

On Tuesday, February 27, Lansing came back from White Sulphur Springs. Polk told him about the Zimmermann telegram and showed him an exceptionally long cable of 1,000 codegroups that he had found in the State Department files. It had come for Bernstorff in an American cablegram of January 17 from Berlin and was, Polk felt, almost certainly the coded original. (It was, in fact, the double-decker, which included the Zimmermann telegram.) At 11 that morning, Lansing, armed with this, discussed the whole situation with the President, who exclaimed “Good Lord!” several times at the outrageous German abuse of the cable privileges he had extended them. He consented to Lansing’s plan to release the telegram through the press, which Lansing felt “would avoid any charge of using the document improperly and would attract more attention than issuing it openly.” Accordingly, at 6 p.m. the next day, E. M. Hood of the Associated Press was called to Lansing’s home, given the message and some background details, and pledged to secrecy on the greatest scoop of the war.

The story broke in eight-column streamers in the morning papers of March 1. “Profound sensation,” Lansing noted. The nation gasped. In Congress, the House orated patriotically and passed by 403 to 13 a bill to arm merchant ships. But the Senate, more deliberate, wondered whether the whole thing was not just a crude Allied plot. This reaction had been foreseen. Lansing had asked Page to “Please endeavor to obtain copy of German code from Mr. Balfour,” but the British had told him that the code was “never used straight, but with a great number of variations which are known to only one or two experts here. They can not be spared to go to America.” This was, of course, another half-truth—the 0075 message was probably superenciphered (the “variations”) but the 13040 one was not. Polk, meanwhile, exerted tremendous pressure on Newcomb Carlton, the president of Western Union, and finally managed to get a copy of Bernstorff’s telegram to Eckardt despite a federal law protecting the privacy of telegrams. Lansing appended this code-text to the wire he sent Page at 8 p.m. the day of the exposé:

Some members of Congress are attempting to discredit Zimmermann message charging that message was furnished to this government by one of the belligerents. This government has not the slightest doubt as to its authenticity but it would be of the greatest service if the British government would permit you or someone in the Embassy to personally decode the original message which we secured from the telegraph office in Washington, and then cable to Department German text. Assure Mr. Balfour that the Department hesitated to make this request but feels that this course will materially strengthen its position and make it possible for the Department to state that it had secured the Zimmermann note from our own people.

The message, No. 4494, was received the next day, and by 4 p.m. Page cabled back: “Bell took the cipher text of the German messages contained in your 4494 of yesterday to the Admiralty and there, himself, deciphered it from the German code which is in the Admiralty’s possession.” In fact Bell wrote only a dozen or so plaintext groups before letting de Grey do the rest in his neat handwriting. Page then sent the German text as decoded by Bell and de Grey. But Lansing and the President had already sent up to the Senate a statement that the government possessed evidence establishing the telegram as genuine, and that no further information could be disclosed.

Everyone already had his own pet theory of how the United States had gotten it. Most popular was the spy story. Most farfetched was that four American soldiers had found it on a German agent trying to cross into Mexico. Most plausible was that the telegram had been found among Bernstorff’s effects when his baggage was searched at Halifax after his dismissal. Most amusing were the attacks by the British press on the inefficiency of their secret service and its inferiority to the American. (At least one of these was instigated by Hall himself to throw the theorizers off the scent.)

Wilhelmstrasse, too, wondered where the leak had occurred. Though the message as published in the papers did not carry either Bernstorff’s heading or his serial number, it did bear the significant date January 19. “Please cable in same cipher,” the Foreign Office purred at a quivering Eckardt, who had already tried to blame Bernstorff for the betrayal, “who deciphered cable dispatches 1 [the Zimmermann telegram] and 11 [ordering Eckardt to negotiate at once for the proposed alliance], how the originals and decodes were kept, and, in particular, whether both dispatches were kept in the same place.” Six days later, it picked up the clue that Hall had carefully planted: “Various indications suggest that the treachery was committed in Mexico. The greatest caution is indicated. Burn all compromising material.”

Eckardt mustered impressive details to exculpate himself: “Both dispatches were deciphered, in accordance with my special instructions, by [Dr. Arthur von] Magnus [the legation’s corpulent secretary]. Both, as is the case with everything of a politically secret nature, were kept from the knowledge of the chancery officials…. The originals in both cases were burned by Magnus and the ashes scattered. Both dispatches were kept in an absolutely secure steel safe, procured especially for the purpose and installed in the chancery building, in Magnus’ bedroom, up to the time when they were burned.” Three days later, he sent in his reserves: “Greater caution than is always exercised here would be impossible. The text of telegrams which have arrived is read to me at night in my dwelling house by Magnus, in a low voice. My servant, who does not understand German, sleeps in an annex…. Here there can be no question of carbon copies or waste paper.” The shrieks of hilarity that this occasioned Hall, Page, and Room 40 were not heard in Berlin. Its last doubts swept away by the low voice, the steel safe, the scattered ashes, and the non-German-speaking servant, the Foreign Office capitulated. “After your telegram it is hardly conceivable that betrayal took place in Mexico. In face of it the indications which point in that direction lose their force. No blame rests on either you or Magnus.”

Nigel de Grey transcribes the Code 13040 version of the Zimmermann telegram into plaintext for the skeptical Americans

“Exploding in his Hands.” Cartoon by Rollin Kirby in The [New York] World just after the Zimmermann telegram was made public

Meanwhile, the problem of authenticity, which had so troubled the Anglo-American officials and stirred uneasy questioning in the Senate and the press, had been eliminated by Zimmermann himself. Completely unexpectedly, he confessed: “I cannot deny it. It is true.” Knowledge of the plot had been blandly disavowed by the Mexicans, the Japanese, and Eckardt, and to this day no one knows why Zimmermann admitted it. His acknowledgment buried the last doubts that the story might have been a hoax.

Suddenly, Americans in the middle of the continent who could not get excited about the distant poppings of a European war jerked awake in the realization that the war was at their border. Texans blinked in astonishment: the Germans meant to give away their state! The Midwest, unmoved because untouched by the submarine issue, imagined a German-officered army crossing the Rio Grande and swung over to the side of the Allies. The Far West blew up like a land mine at the mention of Japan. Within a month, public opinion crystallized. Wilson, who three months before had said that it would be a “crime against civilization” to lead the nation into war, decided that “the right is more precious than peace” and went up to Capitol Hill on April 2 to ask Congress to help make the world safe for democracy. He cited the Zimmermann telegram in his address:

“That it [the German government] means to stir up enemies against us at our very doors, the intercepted note to the German minister at Mexico City is eloquent evidence. We are accepting this challenge of hostile purpose…. I advise that the Congress declare the recent course of the Imperial German Government to be in fact nothing less than war against the government and people of the United States, that it formally accept the status of belligerent which has thus been thrust upon it.”

The Congress did. Soon the Yanks were coming. The fresh strength of the young nation poured into the trenches of the Western Front to rescue the exhausted Allies. And so it came about that Room 40’s solution of an enemy message helped propel the United States into the First World War, enabling the Allies to win, and into world leadership, with all that that has entailed. No other single cryptanalysis has had such enormous consequences. Never before or since has so much turned upon the solution of a secret message. For those few moments in time, the codebreakers held history in the palm of their hand.

10. A War of Intercepts: I

RADIO, envisioned by its inventor as a great humanitarian contribution, was seized upon by the generals soon after its birth in 1895 and impressed as an instrument of war. For it immeasurably magnified the chief military advantage of telegraphy: instantaneous and continuous control of an entire army by a single commander. By eliminating the need for physical linkage by wire, radio speeded communication between headquarters, joined through the ether units that could not connect by wire because of distance, terrain, hostile forces, or rapid movement, opened communications with naval and air forces, and eased the economic burden of producing immense quantities of wire.

But few blessings are unmixed. Just as the telegraph had made military communications much more effective but had also increased the possibility of interception over that of hand-carried dispatches, so radio’s vast amplification of military communications was accompanied by an enormously greater probability of interception. The public, omnidirectional nature of radio transmissions, which makes wireless communication so easy to establish, makes it equally easy to intercept. It was no longer necessary to gain physical access to a telegraph line behind the enemy’s front to eavesdrop upon his communications. A commander had only to sit in his headquarters and tune his radio to the enemy’s wavelength. Radio thereupon introduced two revolutionary factors in the interception of communications: volume and continuity.

Communications are intercepted, of course, so that they may be submitted to cryptanalysis. Now cryptanalysis has a potential that cryptography does not. Cryptanalysis can alter the status quo. Cryptography can at best conserve it. Cryptanalysis can bring countries into war, engender naval battles and win them, compel besieged cities to yield, condemn queens to death and prove innocent the unjustly accused. Cryptanalysis hammers upon the real world. Cryptography does not.

Consequently, the telegraph, which affected only cryptography, had had a wholly internal influence upon cryptology. That a hierarchy of special systems had arisen to displace the nomenclator interested only cryptologists; it did not matter to generals or statesmen. And although the telegraph greatly increased the volume of communications, wiretapping could produce intercepts only at rare and irregular intervals. Cryptanalysis could exercise only transient and haphazard effects. Its potential remained largely unfulfilled. Kerckhoffs accurately regarded it as an auxiliary to cryptography, a means to the end of perfecting military codes and ciphers. Cryptanalysis during the telegraph years was interesting but inconsequential, intriguing but academic—an ideal topic to pass a Victorian tea-time, perhaps, but not much more.

The radio, however, turned over to the commander a copy of every enemy cryptogram it conveyed. It furnished a constant stream of intercepts. And with these, cryptanalysis could bear continually upon operations, could be depended upon for information, could affect events decisively. The generals and the statesmen took notice. This was no longer a polite trifling discussion; this had become a weapon, a pursuit entailing all the savagery of warfare and life against death. Radio made cryptanalysis an end in itself, elevating it to an importance coordinate with that of cryptography, if not superior to it. Radio’s impact upon cryptology reverberated in the outside world.

Wire and wireless thus complemented one another. The telegraph created modern cryptography; the radio, modern cryptanalysis. The one developed cryptology internally, the other externally. The telegraph had given cryptology shape and content; now the radio carried it out into the arena of life. One gave it form; the other, meaning. The radio completed the work that the telegraph had begun. And so it was that radio, first widely used in the Great War of 1914 to 1918, brought cryptology to maturity.

On the Western Front, only France was ready. Her prewar activities, more extensive and better conceived than those of any other nation, had prepared her. Posts that had intercepted German radiograms in peace simply continued to do so in war. The cipher system approved by the Commission on Military Cryptography went into effect. The cryptologic section set up by Cartier at the War Ministry was quickly fleshed out with mobilized personnel. His assistant, Major Marcel Givierge, arrived alone at general headquarters to set up a cryptologic section—and a week later had six assistants working round the clock. For the first few days, there was little to do, but when the invading Germans crossed the frontier early in August, passing beyond the wires of their telegraph network, their messages filled the air.

The French hauled them in. At first the only intercept stations were in the great fortresses of Maubeuge, Verdun, Toul, Épinal, and Belfort and at three special posts at Lille, Rheims, and Bésançon. Later in the war France had an elaborate network, with the country divided into three zones centered on Paris, Lyons, and Bordeaux. The capital itself had one intercept station in the Eiffel Tower and another in a Métro station (Trocadéro). A line of six direction-finding stations extended behind the entire front. All these stations were connected by direct wire to the War Ministry at 14 Rue Saint-Dominique in Paris, where Colonel Cartier’s office stood next to the telegraph central. The French thus received German radiograms as quickly as the legitimate recipients. During the course of the war, Cartier estimated, they intercepted more than 100,000,000 words, or enough to make a library of a thousand average-sized novels.

At the start, however, the organization was so crude that the French even lacked direction-finders. They had to work instead on an assumption that all German stations emitted at the same strength and that the loudness of the intercepted signal roughly indicated the distance of the transmitter. Operators thus noted whether they heard German signals very loudly, loudly, medium loudly, weakly, or very weakly. By making quantities of such readings and drawing circles on the map with a radius equal to the estimated distance, the French less than two weeks after the outbreak of the war had diagrammed the probable locations of the German stations—a grouping that later proved in large measure correct.

The French also recorded call-signs, volume of traffic, and correspondents for all stations. These soon segregated themselves into four main networks, each of which, the French assumed, belonged to a combat group. The patterns of correspondence defined the headquarters stations, and volume soon differentiated the fast-moving and fast-sending cavalry stations from the infantry. Occasional cleartext signatures disclosed the commanders’ names. In this way, the French gradually built up a picture of the German forces facing them.

This was the first radio traffic analysis. It attained a high refinement later in the war. Traffic analysis aided in delineating the enemy order of battle, and frequently forewarned of important enemy activities by detecting an increase in message volume. It also made a preliminary sorting of messages for cryptanalysis. Different enemy armies may use different codes with the same codewords or different keys for a single cipher system, and only the pinpointing of the transmitter by direction-finding and call-sign will enable the cryptanalyst to separate messages in one cryptographic “language” from those in another. It is the modern version of looking at the seal and the signature of an intercepted letter so that cryptograms from Venice will not be mixed with those from Parma. The careful filing of every detail surrounding an intercepted radiogram—its sender, receiver, time, preamble, length—often yielded supplementary benefits.

Early in the war, for example, the French intercepted a German cleartext radiogram, “Was ist Circourt?” The elaborate cross-references permitted an easy identification of the cryptogram that gave rise to the query. Meanwhile, the geographic service furnished the information that the name “Circourt” showed in full on certain German general staff maps while the troop maps had only the initial C. Other characteristics of the cryptogram implied that it dealt with a troop movement, and when it was attacked on this basis and on the now highly probable supposition that it contained the plaintext word Circourt, it succumbed. The French then recovered the key and read all the traffic for the week or so that it remained in force.

The cipher was the ÜBCHI, the famous double columnar transposition that the Germans had used—and the French had known—since even before the war. It employed a keyword or keyphrase prescribed by the high command, which, before actual encipherment, had to be transformed into a numerical sequence. This was done—as is conventional—by numbering the letters of the keyword in their alphabetical order, numbering repeated letters from left to right. For example, with the keyphrase DIE WACHT AM RHEIN, the two A’s would be given numbers 1 and 2. There are no B’s, so the C would take number 3, the D number 4, the two E’s 5 and 6, and so on:

Actual encipherment of a plaintext—say Tenth division X Attack Montigny sector at daylight X Gas barrage to precede you—involved six separate steps. The encipherer (1) wrote the plaintext horizontally into a block beneath this numerical sequence:

He (2) transcribed the letters vertically by columns in order of the key-numbers: HKAAY, ITYG, DMTRO, and so on, and (3) inscribed them horizontally into another block under the same numbers. To this he (4) added as many null letters as there were words in the original keyphrase—four, in this case:

The encipherer then (5) again took out these letters by columns in key order: YNNER, GDTEA, IAGAB, and so on, and (6) divided them into the standard five-letter groups for transmission: YNNER GDTEA IAGAB HTDRA AGUIT RPXTT OOEET HEIKC RSAOI SVDNT IITOT NMYAG SYSEX KACOL C.

Decipherment was precisely the inverse of this process, except that the decipherer had first to determine the size of the transposition block so that he would know how deep his columns ran. He did this by dividing the number of digits in the key into the number of letters in the message; in this case, 15 into 71. The quotient—here, 4—gave the number of full lines in the block; the remainder—11—the number of letters in the final incomplete line.

Solution of a single message enciphered by double transposition constitutes an exceedingly difficult problem. Why this is so can best be understood from the cryptanalysis of a single columnar transposition. This is a cipher that would pass its plaintext through only one block, taking as its ciphertext the result of step 2 of the double transposition. Obviously, such a ciphertext is composed of segments that were originally the columns of the tableau. A cryptanalyst will cut up that ciphertext into what he thinks might be the columns and then will juxtapose one segment against another until he finds two that look as if they might have stood next to one another in the original block.

With the following 40-letter cryptogram, for example, the cryptanalyst might begin by assuming a keylength of five. The columns would then run eight letters deep, and the cryptanalyst would slice the cryptogram into groups of eight letters and pair the first group with the other four:

He can then either examine these by eye or use various mathematical techniques to see which two segments go together the best. One such technique is to give each assumed digraph its frequency in plaintext and then to add these frequencies; the combination with the highest total is most likely to be right. Thus, in the 1-2 pairing, EN has a normal frequency of 25 (per 2,000 English digraphs), IH of zero, and so on, with the eight digraphs totaling to 69. The other combinations come to 73, 143, 77, 77, 73, 62, and 78, respectively. The cryptanalyst would probably select the 1-4 combination with its 143 total, try to extend its digraphs into trigraphs on both right and left, and continue like that until he has reconstructed the entire block. If nothing looks good, he must modify his original guess as to the keylength and start over.

This process is greatly simplified if all the columns are the same length—a condition that obtains when the block is completely filled. This is called regular columnar transposition. In irregular columnar transposition, where the last line of the block is not full and the columns are consequently of two different lengths, the solution involves some jockeying up and down of the columns to get the proper matches.

This sort of reconstruction is, in exceptional cases, possible on a second-order basis to permit the solution of a single double-transposition cryptogram. In theory the cryptanalyst merely has to build up the columns of the second block by twos and threes so that their digraphs and trigraphs would in turn be joinable into good plaintext fragments. But this is far more easily said than done. Even a gifted cryptanalyst can accomplish it only on occasion; and even with help, such as a probable word like Circourt, it is never easy.

Solution becomes relatively simple, however, with several double-transposition cryptograms, all of exactly the same length and enciphered by the same keys. The cryptanalyst can then apply, on a letter-by-letter basis, the multiple-anagramming technique used in 1878 by Hassard, Holden, and Grosvenor on a word-by-word basis. Usually the two messages are written out one underneath the other on strips of paper, the paper is cut vertically so that two letters—one from each message—are on a single slip, and the slips tried one next to the other until plaintext appears on both top and bottom. The method very often succeeds, and French cryptanalysts accordingly sought cryptograms of identical length and key which they could subject to it. The Germans eased their search by keeping a single key in effect for eight or ten days over the entire Western Front. And as summer waned, the intercepts were fluttering onto French desks as thickly as the leaves of the war’s first autumn.

But the four or five cryptanalysts that Cartier had under him at the Ministry of War could not concentrate solely on them. They had to lend a hand with the naval traffic, because the Ministry of Marine had no cryptanalysts whatsoever, and with the Berlin-Madrid diplomatic correspondence, because the Foreign Office experts were too overloaded to solve them quickly enough to be useful. Their work was further disrupted when, on September 2, their office was evacuated to Bordeaux with the rest of the government in the face of the German threat to Paris. Despite these difficulties, they began to send daily solutions to general headquarters later that month, when the war had been in progress only a few weeks. Sometimes these consisted of only the gist of messages, for multiple anagramming sometimes restores only patches of plaintext. A complete solution, however, will permit reconstruction of the original transposition key. This reconstruction is a tedious task, but it is worth the effort, for the basic key would unlock all the cryptograms enciphered in it, irrespective of identical-length requirements. On October 1, Cartier and three of his cryptanalysts—Major Adolphe Olivari and Officer-Interpreters Henry Schwab and Gustave Freyss—made this breakthrough for the first time. They communicated the primary ÜBCHI key to the various headquarters for on-the-spot decipherment of local German cryptograms.

It promptly became the hottest topic of conversation in the French army. The news raced through the ranks, and telephone lines were clogged with excited calls about the key recovery. Soldiers chattered about the existence of the key and discussed the contents—real or imagined—of cryptograms. So serious was the breach of security that on October 3 G.H.Q. had to issue an order to try to stop indiscreet talk about it. It didn’t help. A few weeks later, after the Germans had changed their key, an officer asked loudly in the vestibule of headquarters whether it had been discovered again. The gossip swelled and expanded until it even reached civilian ears in Bordeaux.

The Germans seemed not to have heard it, however, for they continued to use their double transposition with their infrequent key changes. On October 17, a new key went into effect, but the French, more experienced now, recovered this one four days later. A new change at the beginning of November took only three days to solve; the next key was ascertained the very day it went into service. One of the new solutions enabled the French to bomb Thielt in occupied Belgium at the very moment that Kaiser Wilhelm II was entering it for a review. This story was too good for anyone to keep to himself; soon Le Matin published it, specifying the source of information. This time the Germans took notice. On November 18, they instituted an entirely new system.

It was a case of what cryptologists call “illusory complication.” For though on its face it appeared more intricate and harder to solve than the double transposition, it proved to be solvable with a single cryptogram instead of the two or more, limited to highly specific conditions, required for multiple anagramming. The cipher consisted of a Vigenère encipherment with key ABC—which could be done in the head—followed by a single columnar transposition. One weakness was that the ciphertext equivalents stood at most two places away from their plaintext in the normal alphabet. The errors of cipher clerks enabled Lieutenant Colonel Anatole Thévenin, a member of the Commission of Military Cryptography who was serving as a part-time cryptanalyst at his post as assistant chief of staff of the 21st Army Corps, to solve it by December 10.

A month later there arrived on Cartier’s desk a memorandum suggesting a simplified method of breaking this system, called the ABC by the French. It had been written by Georges Jean Painvin, a 29-year-old reserve lieutenant of artillery on the staff of the 6th Army. Painvin, who had a mind that flashed and cut like a rapier, was destined to become the Perseus of cryptologists in the epic struggle of World War I, slaying one German cryptographic Gorgon after another. Tall and slender, with dark, rather Spanish-looking features and piercing black eyes, Painvin worked with an intense concentration that gave no hint of either the lightning agility of his intelligence or his native charm and generosity. A high-ranking graduate of the famed École Poly-technique, he had taught paleontology at the École Nationale Supérieure des Mines in Paris. He was also an outstanding ’cellist and had once won first prize in this instrument at the Nantes conservatory.

When, after the Battle of the Marne, the fighting settled into the stagnation of trench warfare, Painvin found his afternoons unoccupied. He had become friendly with Captain Victor Paulier, a cryptanalyst who had been sent to the 6th Army from Cartier’s bureau, and from him learned about the ÜBCHI. Painvin took up multiple anagramming of the German intercepts much as one might do crossword puzzles, and soon his recreations were crowned with practical success. He recovered several keys which were reported to Cartier, who, after receiving the ABC memorandum, dispatched his congratulations to Painvin.

On several occasions during inspection visits to 6th Army headquarters at the Château de Montgobert near Villers-Cotterets, the Minister of War, Alexandre Millerand, asked the commander, General Michel-Joseph Maun-oury, to release Painvin for service at the Bureau du Chiffre. But Painvin had been through too much with the elderly Maunoury to feel able to leave him. Maunoury finally yielded to the pressure, however, and in March of 1915 told Painvin to go for two weeks and see whether he could be of more use with the cryptanalysts than with the 6th Army staff. Painvin went; soon thereafter, Maunoury was grievously wounded. There was now no one to recall the young cryptanalyst, and he remained in Cartier’s office for the rest of the war.

That office now headed the first echeloned organization in the history of cryptology. The Bureau du Chiffre, which had returned to the War Ministry building in Paris, employed several dozen people, of whom only about 10 were cryptanalysts. It worked in the cryptologic stratosphere—inter-Allied communications, enemy diplomatic and naval cryptograms, new military systems, and messages from distant fronts. Its chief, Cartier, also directed the intercept service. Under the Bureau du Chiffre was G.H.Q.’s Service du Chiffre, headed by Givierge. Its staff of 15 officers handled the cryptographic correspondence of the French headquarters and solved the strategic cryptograms of the German Army, usually with methods and keys supplied by the Paris bureau.

Beneath it in turn came the cryptologic offices that were attached to the various army and army group headquarters in the same way that those headquarters had their own intelligence, signal, and other specialized organizations for their own needs. Paulier constituted one such office. They had been inaugurated by an order of September 17, 1914, which attached a specialist to each major unit to enforce the cryptographic regulations for their own troops. France was preparing a general advance and did not want its cipher clerks making the blunders on the radio that they were then making on wire telegraphy. Eventually this one man became three, including cryptanalysts. Their presence near the front enabled them to garner many details helpful in solutions. If, for example, a message was sent to a German artillery unit, and two hours later that unit laid a barrage on a certain sector, the French cryptanalyst would have a number of probable words with which to rip open the message. These army bureaus generally solved low-level tactical communications.

The various branches of the decentralized French organization worked in close cooperation. Results or partial results were flashed from one to another as soon as a break was made: the War Ministry and G.H.Q. later communicated via a telautograph, which, since it was the only one in existence, they regarded as sufficiently secure to carry some of the most secret messages in France.

By May of 1915 the ABC cipher had vanished. The end of the war of movement greatly reduced the volume of German military radio messages, and for most of 1915 traffic was at a very low level. The lull gave the French a chance to attack other problems. Painvin, Schwab, Givierge, Olivari, and Paulier cudgeled naval dispatches. Officer-Interpreters Bélard and Trannoy struggled with Bulgarian, Greek, and Turkish cryptograms. The several codes used in the busy Berlin-Madrid and Vienna-Madrid diplomatic circuits were under attack, the German-language ones by Painvin, Olivari, and Paul-Brutus Déjardin, the Spanish by Lieutenant Pannier and Officer-Interpreter J. Périère.

The cryptanalysts also engaged in retrospective solution of some of the cryptograms of the first days of the war. These helped explain why the Germans had made the historic turn to the east that led to the crucial Battle of the Marne, where they were stopped, and shed light on the thinking of German commanders during the critical “race to the sea,” which established warfare’s first continuous front. The picture that emerged of the German way of conducting war was so helpful to the French staff that General Joffre, the commander in chief, wrote to the Minister of War: “I have, like all the army commanders, during the last few days learned to realize the value of the services which have been rendered by the cryptanalytic bureau of your department. Please transmit the thanks of all of us to Major Cartier and his group.”

The radio lull ended explosively at the start of 1916. This was the year in which the Germans oscillated wildly over the entire cryptographic spectrum in a frantic hunt for the ideal cipher. But the French kept up with them, and sometimes G.H.Q. received two or three solutions of a new problem within a few hours.

Every possible weakness was exploited in these solutions. Particularly oful were stereotyped messages. “Night calm; nothing to report” appeared with what Givierge called “terrible regularity” in German transmissions. One command required regular morning reports from its units in line. When the cipher changed, the practice did not, and the French promptly pried open the cipher with the leverage of a known plaintext. The French turned to similar advantage the thoughtless German practice of checking out new systems by enciphering proverbs as test messages. The German version of “The early bird gets the worm” was a particular favorite—but it was the French who profited.

Their familiarity with German habits of phraseology and transmission technique greatly helped. They had gained this insight during the very first days of the war, when the radio operators in General Georg von der Marwitz’ cavalry corps on the wheeling German flank became simultaneously intoxicated by their speedy conquests, overwhelmed by the volume of their traffic, and exasperated by the nuisance of ciphering. They began sending messages in clear. Soon, by a kind of cryptologic Gresham’s Law, everyone was doing it, while the French took copious notes. They bore down mercilessly on ciphering errors, studied captured notebooks with cryptographic worksheets, compared messages from different sectors that, individually, offered little but, conjointly, suggested much. They fished about wildly for keywords—and, given the German predilection for patriotic terms such as VATERLAND, KAISER, and DEUTSCHLAND, sometimes hooked the prize. They bombarded enemy trenches and feigned preparations for attacks just to get some badly needed probable words into enemy cryptograms. And, above all, they carved away at the ciphers with their keen, surgical minds, dissecting, discarding hypotheses, until at last they cut through to the heart of the system. Painvin in particular shone brilliantly in this pure cryptanalysis.

The first of the new German systems appeared with the outburst of new wireless activity. The French high command believed that these signs presaged a new German attack, and Painvin and Olivari fell upon the intercepts. They quickly decided that half of them were fake—mere meaningless strings of letters. But what messages were the real cryptograms carrying? Within two weeks, they discovered that the system consisted of an interrupted-key Vigenère with key ABCD followed by a single columnar transposition. The key interruptions were controlled by the numbers of the transposition key. The system was an elaboration of the old ABC; they called it the ABCD. The plaintexts proved to be nothing but simple ciphering exercises, portions of communiqués, extracts from newspapers, even trigonometrical formulas. This showed that the entire radio busyness was a German deception, and the cryptanalysts thereby relieved the French staff of some of its worries.

The cumbersome ABCD expired in April. It was replaced for the first time in German cryptography by pure substitution ciphers. These were numerous, but of two general kinds: monalphabetic substitution in which the choice of the 24 available alphabets was left to the encipherer, and polyalphabetic substitution with 12, 24, or 25 mixed alphabets. These grew ever more complicated, but as the development was progressive the French never lost cryptanalytic contact. Painvin solved one that spring thanks to a Bavarian prince’s telling his parents, the king and queen, that he had been wounded. The polyalphabetic systems culminated in one used between Berlin and Constantinople. It employed 25 alphabets, required 32 tableaux, and was so excessively complex that only cipher clerks comfortably ensconced in quiet, well-equipped headquarters offices could handle it. In fact, it was too elaborate, and the pendulum swung away from substitution to transposition. At the end of 1916, transposition messages again appeared in German military communications.

By January, 1917, the French cryptanalysts recognized these as turning grilles. About all that these grilles have in common with the fixed concealment grille of Cardano is the name and the openings in the mask. The turning grille is usually a square sheet of cardboard divided into cells; one quarter of these are punched out in a pattern such that when the grille is rotated to its four positions, all the cells on the paper beneath will be exposed and none will be exposed more than once. A 6 × 6 grille might look like this:

This is laid over a sheet of paper and the first nine letters are written through the apertures. Then it is turned 90 degrees, the next nine letters are written through the openings in their new position, and so on for two more turns. By then each of the 36 cells on the paper will have a letter inscribed in it, and the cryptographer can read it off in any pattern he chooses—usually by rows. Messages longer than 36 letters must repeat the process; in the last section of less than 36 letters, the unwanted cells can simply be blocked out.

The Germans provided their signal troops with a variety of sizes for different length messages. Each grille had a codename: ANNA for 25 letters, BERTA for 36, CLARA, 49, DORA, 64, EMIL, 81, FRANZ, 100. These codenames were changed weekly.

Grille systems are particularly susceptible to multiple anagramming—which is the general solution for transposition systems—because their sections are of necessity of equal length. But the system produces intriguing geometrical symmetries, and the French soon devised attacks exploiting this and other weaknesses. The grilles lasted four months.

Britain, too, had her military cryptanalytic bureaus. But she had made no more preparations for them before the war than she had done for Room 40, and her Army cryptanalysts, expert though they became, never achieved the proficiency of the French.

Her setup was essentially the same as France’s. The head organization, M.I. 1(b), was attached to the War Office. A field agency was established at British Expeditionary Force headquarters, and individual cryptanalysts were stationed with the several armies.

M.I. 1(b) was still a small, four-man section—1(b)—of the Military Intelligence Division in December of 1915 when Malcolm Vivian Hay of Seaton was placed in charge. Hay, then 34, was the grandson of the second son of the seventh Marquess of Tweeddale and had succeeded to the Seaton Estates near Aberdeen when he was 2. After an education at Beaumont College and abroad, he returned to supervise his farms; he joined the Gordon Highlanders as a captain at the outbreak of war. He was machine-gunned at the Battle of Mons and was captured by the Germans when he was left on the field by the British retreat. Partly paralyzed as a result of his head wound, he was repatriated in February, 1915, as unfit for military duty. After learning to walk with the aid of a cane, he was promoted to major and given command of M.I. 1(b).

He began at once to scour the universities for bright young men, preferably language scholars, to supplement the three original civilians on the staff: J. St. Vincent Pletts, a radio engineer from Marconi’s Wireless Telegraph Company; J. D. Crocker, a young Cambridge scholar, and Oliver Strachey of the Indian Civil Service, who liked cryptanalysis so much that he switched after the war from administering the East Indian Railway to codebreaking for the Foreign Office. Hay recruited a remarkable concentration of men who were later to achieve eminence, if listing in Who’s Who may be taken as an index. Among them were his chief assistant, John Fraser, 32, later professor of Celtic as a fellow of Jesus College, Oxford; Arthur Surridge Hunt, 45, then and later professor of papyrology at Oxford and one of the world’s most eminent authorities on ancient writing; David Samuel Margoliouth, 58, professor of Arabic at Oxford, later president of the Royal Asiatic Society and author of many works on Arabic literature and history; Zachary Nugent Brooke, 33, then lecturer in history at Cambridge, later professor of medieval history there and an editor of the Cambridge Medieval History; Edward Thurloe Leeds, 39, then assistant keeper of the department of antiquities of the Ashmolean Museum and, after the war, keeper of that first public museum in England; Ellis H. Minns, 42, then and later lecturer in paleography at Cambridge, later knighted; Norman Brooke Jopson of Cambridge, 26, later professor of comparative philology there; George Bailey Sansom of the consular service, 33, later knighted and commercial counselor of the British embassy in Tokyo and author of a Historical Grammar of Japanese and of a standard history of Japan; and Henry E. G. Tyndale, 28, later housemaster of Winchester College, one of England’s great public schools, an avid mountaineer, and editor of the Alpine Journal and of the classic Whymper’s Scrambles Amongst the Alps. The chief himself, Hay, became well known as a historian, writing half a dozen major historical works (most presenting the Catholic viewpoint on controversial questions) and almost as many on other subjects. His first study, A Chain of Errors in Scottish History, concerning early church history, was violently denounced and extravagantly praised. But subsequent works, such as The Enigma of James II, were received with more moderate but more extended applause, and his later The Foot of Pride, an erudite examination of European anti-Semitism, was universally lauded.

The staff of M.I. 1(b) was to number 84, including 30 women, by the end of the war. To shelter this growing organization, as well as to conceal it from the curious, the War Office requisitioned a largish private house at 5 Cork Street, several blocks from its own building in Whitehall and behind the fashionable Burlington Arcade. Hay immediately instituted a complicated entrance procedure that involved locking visitors in a room temporarily to prevent their wandering about the premises.

Early in the war, the French had provided the English with keys and techniques for the German military ciphers, and with this help, M.I. 1(b) was soon passing valuable information to the army command. Eventually a pool of skilled cryptanalysts was built up, including one who was familiar with Turkish. Perhaps the most brilliant at Cork Street was Captain G. L. Brooke-Hunt of the Royal Engineers, who had served in the Indian Army.

Among his most difficult problems was the “Für GOD” system, which was so-called because all messages in it bore that prefix to show that they were for the German wireless station whose call letters were GOD. These messages were sent irregularly about three times a week from POZ, the powerful German station at Nauen outside of Berlin. They began in 1916 and lasted until the fall of 1918, making the Für GOD the longest-lived German cipher. Because the dispatches bore no signature and no address beyond the call-sign, suspicion grew that the cryptograms concealed instructions to German secret agents.

Brooke-Hunt solved the Für GOD early in 1917. It proved to be a poly-alphabetic system using 22 mixed alphabets and 30 incoherent keys of from 11 to 18 letters. The messages were numbered serially from January to December in each year and the keywords repeated in cycles of 30. The dispatches were transmitted by the political section of the German general staff to an expedition sent to North Africa under Captain von Todenwart to foment uprisings by the Arab population. Some of the messages were orders, but many forwarded reports of the slaughter of colonial troops on the Western Front as a result of alleged French placement of them in the most dangerous positions in the line. Von Todenwart was directed to spread these reports as anti-Allied propaganda.

Among the messages were several arranging for a submarine to bring rifles and ammunition to Abd el Malek, a Moroccan nationalist. Hay was in the closest personal touch with Captain Hall at the Admiralty. Information was passed, wheels turned, air commands were notified, and shortly after the U-boat surfaced in the blue Mediterranean she had submerged again—this time involuntarily and for good, taking her cargo with her. Later in the war Brooke-Hunt read with mingled pleasure and regret a Für GOD message declaring that “For security reasons, U-boat arrival notifications will no longer be made.”

Hay, who was admired by his subordinates as “a very good chief” (they later gave him a silver loving cup and a book of photographs with cryptographic inscriptions and affectionate remembrances), was given charge of constructing codes and ciphers for British forces early in 1917. He took his responsibilities seriously enough to make a visit to Cartier’s office despite his own disability, and later in the war his office sent representatives to the Near East to coordinate cryptologic security there.

But M.I. 1(b) apparently had no hand in the development of perhaps the finest British cryptanalyst of the war. O. T. (for Oswald Thomas) Hitchings had been destined to be a schoolmaster like his father, but he loved music so much that he became an organist instead. Later he taught music in two preparatory schools, and while doing this learned French and German so well by correspondence that he won an honors degree in them from London University. In 1911 he went to Bridlington Grammar School as modern language master. Quiet, conscientious, he volunteered for the Army at the start of the war and went directly to France, where his knowledge of languages was put to use in the Field Censor’s Office. One day his colonel asked him if he would like to try solving the German messages that were being intercepted. He said he would, found he had a flair for the work, and by 1918, when he was 42, had risen to the rank of captain and the command of Intelligence E(c), 2d echelon—the Code and Cipher Solution Section of the British Expeditionary Force’s general headquarters.

This section was located in Le Touquet, a Channel-side resort town not far from British G.H.Q. at Montreuil, probably for reasons of security. Here the serious, earnest Hitchings was assisted by a debonair, kilted Scot, Duncan Campbell Macgregor. Under them worked the cryptanalysts at the several army headquarters; at one of these an American visitor was astonished to see a German prisoner of war, still wearing his uniform, puzzling over the intercepts of his native land! Hitchings’ solutions were so extraordinarily valuable that one colonel exclaimed that he was worth four divisions to the British.

With this superb background in cryptanalysis to instruct them, what systems did the Allies use? The British employed the Playfair with random keysquare. Its use extended even to Lawrence of Arabia. Behind the lines, the French corresponded in a four-digit superenciphered code; they changed it three times between August 1, 1914, and January 15, 1915. Series 65 of this code chiffré was a two-part code of about 2,300 four-digit groups. A tableau de concordance superenciphered number pairs into letter pairs with a straddling gimmick: the first digit was chopped off and enciphered separately, and the subsequent division into pairs straddled the gap between codegroups. This kept a codegroup from being always superenciphered the same way. A sample encoding and encipherment of the plaintext “The relief will take place tomorrow morning” in Series 65 would be:

The remarkable French acuity in matters cryptological is nowhere better shown than in the instruction accompanying this code: “Exceptionally, if you do not have the time to encipher entirely, transmit in clear.” The French knew that partial encoding, which offered quick and easy entries into a code (“Colonel seriously 6386” could have but one meaning, for example), posed a danger to the compromise of all communications that a single cleartext message, which at best disclosed a single piece of information, did not.

In the field, the French sometimes used a mixed-alphabet polyalphabetic with a running key. But the cipher they relied upon for three years was an interrupted columnar transposition that was, paradoxically, theoretically weaker than the German double transposition. It employed the usual transposition block with a key sequence in which the plaintext was inscribed horizontally. The vertical transcription, however, was preceded by a reading out of letters on certain diagonals. For example, with the message Enemy has brought up four howitzer batteries and three companies Stop We can hold but we need more fifty calibre machine gun ammunition Third Battalion (plus three nulls to complete the last five-letter group), and the key (the French used long ones) MADEMOISELLE FROM ARMENTIERES, with the rightward diagonals starting under 3, 5, 7, 8, and 10 to be taken off in that order, followed by the leftward diagonals under 16, 18, 21, and 26:

The transcription begins with EAPCH and continues with BEHET. The leftward diagonals skip over any letter previously transcribed; thus, diagonal 21 would read TLB and not TDLEB. Similarly, the vertical transcriptions ignore any letters taken by the diagonals: column 1 would read NRST and not NRSIT. The full transcription, which would naturally be divided into groups of five for transmission, is: EAPCH BEHET UOEA WNRN GDBHI YTII OETA TLB ZIOM NRST PRI BFI MOTO IAIR UAOA CNGA AM TU NM AEEA OPD RNBD OSR EESF TYN UHUL EEEN REUB HTWT TC HDAT FWNO IM SRCLI EE HMNC.

The diagonals break up the columnar segments that the cryptanalyst juxtaposes and adjusts to solve uninterrupted columnar transpositions. But the diagonals constitute segments of their own, and the columns, though fragmented, keep their constituent letters together instead of scattering them, as does the double transposition. The cryptanalyst can seize upon these weaknesses to reconstruct the tableau. The task is admittedly more difficult than with an ordinary columnar transposition, but it can be effected with a single message far more easily than with the German system.

Why, then, did the Germans not solve it for the three years that the French kept it in force?

The reason is absurdly simple: Germany had no cryptanalysts on the Western Front for the first two years of the war.

She had entered the war with no military cryptanalytic service. (An expected side effect appeared in the erratic development of German cryptography. The absence of the stabilizing influence of cryptanalysts resulted in the overcorrective swings from one field cipher to another in 1915 and 1916. The lack of cryptanalytic instruction also forced the Germans to attend the hard-knocks school of cryptography, learning through one painful experience after another the dangers of normal alphabets, patriotic keys, their inherent love of order, and the like.) But even if Germany had had well-trained cryptanalysts available at the start of the war, she would have had little opportunity to use them.

German victories drove the French back into their own territory, where they used their own wire network for communication and thus deprived the enemy of much chance of intercepting radio messages. The same situation freed the French radio for intercept work whereas the Germans had to use their wireless for communication. French cryptanalysis thus owed much of its success to the highly dubious advantage of having the war fought on French territory. One may wonder whether the French would have preferred solving enemy cryptograms or the nondesolation of dozens of villages, orchards, fields, and forests in their northern provinces.

As the war progressed, the French began using radio more and more. By 1916, the Germans awoke to their opportunities and set up the Abhorchdienst (“Intercept Service”). Its main station was at Neumünster, where cryptanalysts, many of them recruited from the ranks of mathematicians, were soon solving Playfairs within a day after a key change. Later, the Germans established a cryptanalytic center at their Western Front G.H.Q. at the Belgian resort of Spa. But they never caught up with the Allies, who had had the inestimable advantage of familiarity with German phraseology and idiosyncrasies, gained in the first chaotic days, and of preventative improvements in their own communications.

Both sides, however, were equally adept at picking up the enemy’s frontline telephone messages—an eavesdropping that was facilitated by the fixed nature of trench warfare. Conversations could be heard either by induction through earth pickups, or by actual taps of enemy wires by intrepid soldiers who crawled across no-man’s-land. Both sides obtained enormous quantities of intelligence from this source. Officers and men repeatedly violated the strict regulations against transmitting any important information over field telephones.

In 1916, for example, the British sustained casualties in the thousands in a fierce battle to take Ovillers-la-Boiselle on the Somme. Battalions were decimated as they went over the top. When the British finally captured their objective, they found in one enemy dugout a complete transcript of one of their operation orders. A brigade major had read it in full over a field telephone despite the protest of his subordinate that the procedure was dangerous. “Hundreds of brave men perished,” the British signal historian related, “hundreds more were maimed for life as the result of this one act of incredible foolishness.” The search for protection resulted in the ultimate cryptographic development of the First World War. These were the trench codes.

In February of 1916, General Auguste Dubail, the handsome and energetic commander of the French Army of Lorraine, requested some kind of code for telephone use because indiscretions had drawn so many heavy bombardments onto his reserves. The cryptographic office produced a carnet de chiffre (“cipher notebook”). Important words in telephone messages were to be spelled out in code form by replacing their letters with the two-digit groups of the carnet. Soon a table of 50 common expressions was added, and the carnet authorized for use by wireless telegraphy. This spurred its enlargement into a small code of three-letter groups for use by smaller units. This was called a “carnet réduit” (“condensed notebook”) in contrast to the larger headquarters codes.

The carnets were replaced from time to time. Each had a name—OLIVE, URBAIN, and so on—and the initial letter of that name, repeated three times, indicated the carnet that had encoded the message. The carnets were caption codes: the plaintext elements were arranged in categories, such as artillery, infantry, numbers, letters, common words, prepared phrases, place-names, verbs, and so forth. Though the codewords of the early carnets ran in alphabetical order, the topical distribution of the plaintext ruffled the one-part aspect of the code. Later carnets thoroughly mixed the codewords as well.

Germany did not start using codes until a year after France did, but then they evolved in roughly the same way.

The simple Befehlstafel (“command table”) came first. A small trench code in which bigrams represented common words or letters, it superseded the grilles in March of 1917. Some Befehlstafeln were in the form of notebooks with variable pagination; others were constructed as cipher disks, in which a change of position would give a change of equivalencies. In June these were supplemented on the regimental level by the Satzbuch (“sentence book”), the German version of the French code chiffré. The 2,000 (later 4,000) plaintext expressions of the Satzbuch were represented by thoroughly mixed three-letter codewords. It provided numerous homophones (anschluss fehlt, [“link-up missed”] = KXL, ROQ, UDZ) and many Blinde Signale, or nulls. Unlike the code chiffré, it was not superenciphered; it relied instead on planned obsolescence for security. At first a new codebook was issued about every month, but the interval was gradually cut down to about 15 days. This multiplicity of codes in time was matched by one in space. Where at first the entire front shared a single code, soon army groups and then individual armies had their own Satzbucher.

The French called these codes the “KRU” or “KRUSA” codes, because all their codewords began with one of those five letters. The first one disconcerted the Service du Chiffre, unaccustomed as it was to dealing with two-part German codes. But it recovered quickly and, with Déjardin playing a leading role, reconstituted it sufficiently to read most messages. As the number of codes multiplied, their successful solution depended increasingly on accurate traffic analysis—an accurate separation of the messages of one army from those of another. This was managed, and the French soon were straining to recover the first 100 or 150 groups of each code as quickly as possible, for with this entry the rapid filling out of the repertory was virtually assured. Most of the 30 German codes that France solved during the war must have been Satzbucher. The information obtained during the ten days from December 5 to 15, 1917, a period picked at random, illustrates the value of the cryptanalysis: discovery of four division movements, reconfirmation of the identity of 32 regiments, ascertainment of the presence of a counterattack division north of St. Quentin, and warning of a German surprise attack at the Abia farm, which the alerted French troops repulsed.

In March of 1918, the British predicted that the Germans would soon change their trench codes, probably in the direction of enciphered code. Painvin and Cartier were discussing this possibility with a visitor when Painvin was called to the telephone. French G.H.Q. informed him that what appeared to be that very switch had been made that day over the entire front, replacing the Befehlstafel trench code. The basis of the new system was the Schlüsselheft (“keybook”), a caption code of 1,000 three-digit groups. Only the first two digits of each codegroup were enciphered. This was done with a Geheimklappe (“secret flyleaf”), a 10 × 10 table with placode digits 0 to 9 as coordinates on the top and side and the encicode digits dispersed irregularly inside. Toward the end of the war, the Geheimklappe changed daily.

Though the cruel deadlock of the Western Front riveted the major attentions of the Entente and of Germany, its chief antagonist, battles on the Eastern and the Southern Fronts sacrificed their millions as well to the clash of national ambitions. Russia, isolated by the cruise of the Göben, hurled her mighty forces against the German and Austro-Hungarian empires time and again in noble resolution of her treaty obligations; her eventual downfall, in no small degree a matter of cryptology, is a story in itself. In May of 1915, Italy denounced its treaty with the Central Powers and joined the Allies; Rumania followed a year later. Bulgaria lined up with Germany; Greece and Portugal with the Entente. Fighting blasted the Holy Land. All Europe and the Near East flamed.

Thanks to its prewar training, the Austro-Hungarian Army’s Dechif-frierdienst handily unwrapped the Russian systems, aided by the innumerable confusions of mobilization. They had gained almost a year of invaluable wartime experience by the time hostilities broke out with Italy. Thus they achieved their first solutions of Italian cryptograms (of no tactical importance) on June 5, 1915, only 13 days after the declaration of war. These first four were followed by 16 others in June, most intercepted by the new station erected at Marburg. On July 5, the Austrians picked up their first dispatch in the cifrario rosso (“red cipher”), the Italian staff cipher, which intelligence chief Ronge had prudently acquired before the war. They had the odd pleasure of reading a reprimand from General Luigi Cadorna, the Italian commander in chief, to Lieutenant General Frugoni for not having pressed an attack vigorously enough.

Five days later, the cifrario rosso key changed. The Italian specialists among the Austrian cryptanalysts, spearheaded by the chief of the entire cryptanalytic section, Major Andreas Figl, cracked it only after considerable work. The number of solutions fell to 13 in July. But as the Austrians accustomed themselves to Italian methods, their successes waxed. By August 12, they had read 63 messages and could send the new key to the several army headquarters, where Figl had just stationed cryptanalysts. Captain Albert de Carlo was assigned to Bozen; Lieutenant Alfred, Baron von Chiari, went to the 11th Army at Adelsburg in the Tyrol and Lieutenant Hugo Scheuble to the 10th Army at Villach in Carinthia. Soon afterwards the Austrians captured the enemy’s field radio instructions, and thereupon the number of solutions mounted to 50 and sometimes 70 a day. Though these usually contained only administrative matters, they enabled Colonel Ronge to predict the course of impending offensives.

By now the Austrian cryptanalysts had become so expert that they hardly noticed the changing every six weeks of the key of the field cipher, the cifrario servizio (“service cipher”). In October, the Italians put into front-line service a new system, the cifrario tascabile (“pocket cipher”), and Ronge boasted that “it was another one of my peacetime purchases that was already paying for itself.” For once Ronge was wrong: it had been a complete waste of money. The cifrario tascabile was no more or less than a Vigenère with the digits 1 to 0 tacked on to the end of the plaintext alphabet and with cipher alphabets consisting of the digits 10 to 45 in normal order ! Passwords usually served as keys. It should have taken the experienced Austrian cryptanalysts perhaps three or four hours at the most to identify and solve the first message or two in the system.

This system was the brainchild of Felice de Chaurand de Saint-Eustache, an Italian colonel who before the war had laboriously solved a correspondence carried on alternately in two enciphered commercial codes, the Sittler and the Mengarini. Subsequently he “enhanced” his cryptologic reputation by devising the cifrario tascabile. It should have rather brutally exposed his ignorance—and it reflects badly on the poverty of prewar Italian cryptology that it did not. Anyone having the slightest acquaintance with the field would have seen the vulnerability of the cifrario tascabile, while anyone who had kept up with the literature would have known that de Chaurand could have solved his code correspondence in a few hours if he had applied Valério’s mechanical technique instead of requiring the two months of several hours’ work a day that he said, rather pridefully, it took him. Later, for some inexplicable reason, an Italian expeditionary force in Albania corresponded in this very same Mengarini code!

During the big Austrian drive in the spring of 1916, Austrian cryptanalysts preyed not only on the cifrario tascabile, which was an easy killing, but on the other systems as well. One radiogram was intercepted during the evening of May 20; by 3 the next morning Figl’s group had read of arrangements for a heavy counterattack with reserves; by 4 countermeasures had been ordered which checked the Italian onslaught. On June 1, the armies’ intercept-cryptanalytic posts—which Ronge had codenamed “Penkalas,” after a pencil factory’s trademark that showed a head with a mechanical pencil behind an oversized ear—detected a change in Italian call-signs and cipher key. Four days later, a new call-sign was heard which later proved to be that of a newly formed Italian 5th Army. On June 8, the Italian 1st Army cipher key changed, and the air force got its own code. The Nachrichtenabteilung put these indications all together and they spelled “attack.” Consequently the Austrians were prepared for the Italians’ summer offensives on the Isonzo River. The cryptanalysts soon became so expert that the now-daily Italian key changes caused less trouble to them than to the legitimate decipherers. And when a new system was introduced on August 20, they cracked it within 38 hours.

Cryptanalysis had thus become one of the major sources of Austrian intelligence, and by April of 1917, the organization that generated this information had burgeoned into a multisection outfit. Attached to the general staff’s Evidenzgruppe were Chiffrengruppe I, under Captain de Carlo, and Chiffrengruppe II, under Captain Richard Imme. Theoretically under the Evidenzgruppe, but, according to Colonel Ronge (who commanded both), the “real” Austrian intelligence service, was the Nachrichtenabteilung of G.H.Q. at Baden. One of its five divisions was the Kriegschiffregruppe (“War Cipher Group”), headed by First Lieutenant Hermann Pokorny, a brilliant cryptanalyst who had solved the first Russian cryptogram of the war, and who later became chief of the Evidenzgruppe. The Kriegschiffregruppe had three sections: an Italian under Major Figl (who later rose to colonel), a Rumanian under Captain Kornelius Savu, and a Russian under Captain Viktor von Marchesetti. Feeding intercepts to them were three major Penkalas: Austro-West, covering the Italian sector; Austro-Sud, the Rumanian; and Austro-Nord, the Russian. The entire complex was referred to by the unofficial title “Dechiffrierdienst.”

Savu’s group, incidentally, made little progress for a while after Rumania’s entry into the war in 1916, but then the ciphers caved in and proved a mine of information, giving the Austrians full warning, for example, of a planned counterattack on September 14. Captain Franz Jansa, in charge of Austro-Sud, and his assistant, Captain Konstantin Marosan, found themselves so overworked that a cryptanalyst had to be attached to 1st Army headquarters. Later the flood slackened, but on occasion the Austrians read messages that the intended recipients could not, showing that they had not lost their touch.

They did not capture all the laurels, however. Italy had made no prewar cryptographic purchases, but she was aided in her efforts to catch up to her enemy by some remarkably inept Austrian cryptography and some remarkably able Italian cryptanalysts.

The first and best of these was Luigi Sacco, an enthusiastic, 32-year-old lieutenant of engineers at the Supreme Command’s radio station. He had first become interested in cryptography in 1911, at the time of Italy’s war with Turkey. When, during the World War, France rebuffed his attempts to learn about Central Powers cryptography and then failed to send back solutions of the Austrian intercepts that Italy was giving her, Sacco, who had charge of the intercept service, began to attack the messages himself. Though he knew no German, he chipped away so energetically and acutely that he soon managed to hack out fragments of plaintext. These proved valuable enough for him to be placed in charge of a cryptanalytic office attached to the Supreme Command’s intelligence service. Called the “Reparto crittografico” (“cryptographic unit”), it was staffed at first with two engineers from Irredentist areas of Austria—Tullio Cristofolini of Trent and Mario Franzotti of Gorizia—and with a distinguished linguist, Professor Remo Fedi. It employed several score of people by the end of the war.

The cryptanalysts achieved their first complete solution of Austro-Hungarian radiograms during the Battle of Gorizia in August of 1917. What systems were then in use are unspecified. But up to that time the Austrians had not displayed any singular excellence in their cryptography. Among the systems in which they had reposed their trust and their lives was a Vigenère with alphabets normal except for the addition of ä, ö, and ü—a circumstance that perhaps explains Ronge’s vaunting of his purchase of the closely similar cifrario tascabile. There were also what the Italians called the AK and the SH, in which 50-odd ciphertext digrams represented a plaintext letter, number, or syllable. The AK was sent in its original two-letter groups, whereas the SH was divided into five-letter groups. Not till November, 1917, did the Austrians convert to codes, when they placed into service what the Italians called the cw and the Carnia codes, both of 1,000 groups and for use only within a single army. The Reparto crittografico solved them both.

It also solved a similar code on the basis of a single message in the crucial days just before the Battle of the Piave. As part of the preparations for their summer push, the Austrians had placed a two-part code of 1,000 groups into service on June 15, 1918. At first they used it correctly, but soon repetitions appeared that indicated letter-by-letter encoding, with groups exceeding the frequency of 4 or 5 per cent that would be the normal maximum for word-groups in such a code. On June 20, Italy intercepted two messages with virtually the same unusual ending:

492 073 065 834 729 589 255 073 255 834 729 264

The pattern of repetitions suggested the plaintext radiostation, with the two partial repeats 073 … 834 729 representing the repeated a-io and the two 255s standing for the repeated t. It checked out, and thus this one lazy Austrian code clerk, who found it easier to encode letter by letter than to hunt up the codegroups for radio and station, had enabled the Italians to read a goodly portion of his comrades’ code communications.

Italy’s growing cryptanalytic experience enabled it to solve increasingly difficult problems, such as the superenciphered Austrian diplomatic code (for which Sacco’s group had the aid of cleartext messages). The considerably larger naval cryptanalytic staff solved the Austrians’ superenciphered naval system. And gradually it dawned on the Italians that if they could read Austrian ciphers, perhaps the Austrians could read theirs. As early as January, 1917, an attempt was made to replace the old systems. It foundered on the complaint that the new methods required too much time for encipherment. Later, improvements were made to the cifrario rosso, but these were quickly nullified when a major army unit transmitted the new key variables in the old system. In June, the cifrario tascabile was replaced by a small codebook, and after the bloody Italian defeat at Caporetto, there was a wholesale change of army systems, to enciphered code. At about the same time, Cartier journeyed to Italy, visiting the intercept posts and talking with Sacco. The Allied military mission that bolstered Italy at the end of 1917 included some cryptologic personnel. All of this noticeably tightened Italian cryptologic practice.

As a result, Austrian cryptanalyses declined sharply in the latter half of the war. Nevertheless, Austria-Hungary had enjoyed the preponderance of cryptanalytic success on the Southern Front. Ronge always cherished as the greatest tribute to his Dechiffrierdienst an unintended one from the foe. A postwar commission of enquiry into the Caporetto disaster reported with anguish that “The enemy had known and deciphered all our codes, even the most difficult and most secret.”

11. A War of Intercepts: II

NINETEEN ELEVEN is not a momentous year in American history. The last two territories on the continent, New Mexico and Arizona, were preparing for admission to the Union. The large-girthed William Howard Taft lumbered about the White House, trying to ignore the pyrotechnics of his predecessor, Theodore Roosevelt. C. P. Rodgers made the first airplane flight across the country. Carry Nation died. Perhaps the most impressive event of the twelvemonth was Ty Cobb’s batting that incredible .420. The year was not outstanding, but it was the year in which the United States took its first faltering steps in official military cryptanalysis.

They were taken at Fort Leavenworth, Kansas. Here America’s tiny prewar Army had its Signal School. In 1911, the school began a series of technical conferences, and on December 20 portions of a paper on “Military Cryptography” by Captain Murray Muirhead of Britain’s Royal Field Artillery were read to Conference No. 4. The students responded with some papers of their own. Captain Alvin C. Voris showed how unsuitable the purely administrative War Department Telegraph Code was for troops in the field and proposed a tactical supplement for it. Lieutenant Frederick F. Black praiseworthily made an attempt to mechanize en- and deciphering by putting caps over typewriter keys. Lieutenant Karl Truesdell took a basic first step by compiling 10,000-letter frequency tables for English, German, French, Italian, Spanish, and Portuguese. A few months later, Lieutenant Joseph O. Mauborgne—who was to become Chief Signal Officer—whiled away the long hours of a trans-Pacific crossing by solving an 814-letter Playfair from Muirhead; he described his methods in 1914 in a 19-page pamphlet that is the first published solution of that cipher.

The Muirhead seed ripened best in the fertile mind of a 34-year-old captain of infantry named Parker Hitt. Hitt was the towering figure of American cryptology in those days, both figuratively and literally. Six feet four inches tall, a native of Indianapolis, he had left his studies in civil engineering at Purdue University in 1898 to join the Army. He served in Cuba, won a commission, and saw, if not the world, at least the Philippines, Alaska, and California. After graduating from the Signal School, he stayed on as an instructor. Hitt participated in the technical conferences and, among other things, demonstrated the insecurity of Black’s typewriter method by taking only 45 minutes to solve one of the automatic cryptograms.

He discovered that he was “very much interested in cipher work of all kinds” and that he had a real knack for it. When the border command began intercepting Mexican cipher messages as American friction grew with that troubled country, the messages found their way to Hitt. Soon he was solving transposition ciphers, monalphabetics, polyalphabetics (some with mixed alphabets) used by agents of Pancho Villa and others, and a homophonic substitution used by the Constitutionalists. This had four numerical cipher alphabets, all of which remained fixed during the encipherment of a single message, but whose positions were changed from one message to another. The key could be indicated by the letters above the lowest number in each alphabet, or by the four numbers under A. For example, the arrangement used for a message between Saltillo and Juarez, intercepted on November 26, 1916, was:

Hitt solved this, and many like it. The system later became more widely known under the name of the Mexican Army Cipher Disk when the four numerical alphabets were placed on revolving disks.

Hitt demonstrated his acuity in cryptanalysis nowhere more strikingly than with a subtle numerical system forwarded him by Lieutenant Colonel Samuel Reber of the Office of the Chief Signal Officer. Reber wrote him on September 21, 1915: “Some time ago while in conversation with the Assistant Chief Engineer of the Western Electric Company, I told him that a good cipher expert could work out almost any cipher, and his letter of August 3rd shows what he thinks in the matter. I am sending you the ciphers….” On the 24th, Hitt, then at the School of Musketry at Fort Sill, Oklahoma, received the cryptograms, which were two strings of unbroken numbers, and the next day, a rainy Saturday, analyzed them. That afternoon he wrote Reber:

“No. 1 consisted of 415 figures and the factors of this are 83 × 5. This led to the conclusion that I had five figure groups to deal with and this was checked affirmatively when I made out a list of these groups and found some duplicates and a few triplicates. The ratio of occurrence of these duplicates and triplicates led me at once to the conclusion that each group represented two let

“The groups ran in value from 00518 to 53339 with large gaps. I then the small graph of group values and found that I could roughly superim normal frequency table on the graph, but the scale, if I may so call larger at the A end than at the Z end. This suggested a logarithmic sca reached for a table of logarithms.

“00518 showed up as log 1012 and 53339 as log 3415 exactly. If A = 10, then 12 = C, 34 = Y and 15 = F. The rest of the solution merely involved the use of the logarithm table on these five figure groups and the reduction of the numerals so found to letters” In a few swift slashes of his mind he thus cracked an ingenious two-step cipher, to Reber’s pleasure (though he ungraciously said he could have done it himself if he tried) and to the chagrin of the Western Electric assistant chief engineer.

During 1915 Hitt was working on a project that he had mentioned in a letter to Reber on January 15: “I have a mass of material on cipher work, the accumulation of the last four years, and hope to put it into shape as a pamphlet before I leave here if time permits. Major Wildman has kindly suggested that I do this in order that the pamphlet be used as a basis for the course in cipher work.” He enriched his own experience—greater than that of any other person in the country at that time—with theory and new information from European books on cryptology that he borrowed from the Army War College. He finally completed his booklet late in 1915, and the next year the Press of the Army Service Schools at Fort Leavenworth published 4,000 copies of his Manual for the Solution of Military Ciphers, selling it at 35 cents the copy.

It was an excellent work. It naturally explained how to solve the standard ciphers, up to periodic polyalphabetics with mixed alphabets and—for perhaps the first time in the literature of cryptology—combined transposition-substitution. But its special merit lay in its practical tone. The book was imbued with a verisimilitude, an air of this-is-how-things-really-are, that stemmed largely from Hitt’s grounding in the realities of signal communication. This pragmatic approach cropped up, for example, in the book’s discussions of why cryptanalytic offices should be attached to field headquarters and how they should be organized, of the need for accurate intercept and recording procedures and how they may be achieved, and of how to correct errors in enciphering and transmission—a subject of the utmost practical importance and one almost invariably neglected in treatises. Hitt replaced the waxen examples of other books with real cryptograms, several with Spanish plaintexts, whose presence, in view of the Pershing punitive expedition, intensified the feeling of reality. As a military man, Hitt wrote with directness; as one with an extra measure of intelligence, he wrote with clarity; and as one with a touch of the poet, he flavored his 101 pages with a prairie tang all his own. “As to luck,” he observed when discussing the fourth of four factors that determine success in cryptanalysis (the others being perseverance, careful analysis and intuition), “there is the old miner’s proverb: ‘Gold is where you find it.’ ”

Yet the book was outdated at the moment of its birth. Events in Europe had far outrun its elementary notions. Cryptograms were no longer being solved on the basis of single messages, as in Hitt’s examples. Military ciphers had long since attained a complexity never hinted at in the Manual The French had anticipated his ideas on cryptanalytic organizations. The Spanish-language examples might better have been German. And in view of the trench codes which were then emerging as the dominant form of cryptography, one sentence was singularly inapt: “The necessity for exact expression of ideas practically excludes the use of codes for military work although,” he hedged, “it is possible that a special tactical code might be useful for preparation of tactical orders.”

All this is true. Yet it remains equally true that the book filled a real need. Many people, struck by the interest in these matters that war always enlarges, wanted to know about cryptology. But the United States was achingly devoid of information: Hitt’s was, in surprising fact, the first book on the subject published in America{24}—and indeed the first devoted to cryptanalysis in English since Philip Thicknesse’s 1772 A Treatise on the Art of Decyphering! Soldiers and civilians grabbed at it. A second edition became necessary, and this time 16,000 paperbound copies were run off, giving it a greater circulation than any previous book in the history of cryptology. Elementary it may have been, but for those who knew nothing of the subject, a basic work was what was needed. When the United States declared war, Hitt’s Manual served as the textbook to train future cryptanalysts of the American Expeditionary Forces. Some of this training was done at the Army War College in Washington under the auspices of MI-8, the cryptologic section (number 8) of the Military Intelligence Division, headed by Herbert O. Yardley, and some at the Riverbank Laboratories in Geneva, Illinois, where cryptologic research, mainly aimed at proving that Bacon wrote Shakespeare, had been carried on since before the war. Riverbank also had some texts of its own.

In doing the research for his book, Hitt ran across a military cipher that greatly impressed him as affording more security than any other that he knew. He, and probably all the other young cryptanalysts at the Signal School, stood aghast at what was then the “official” U.S. Army field cipher. This was the Signal Corps cipher disk, a celluloid device with a reversed cipher alphabet revolving inside a standard plaintext alphabet. The Army used it with a repeating keyword to produce a straight periodic Beaufort cipher. It was equivalent to the Confederate cipher disk of 50 years before and inferior to the cipher disk described by Porta three centuries before that—a record of retrogression unmatched, perhaps, by any science in the world. Even though the cipher disk was the “official” system, Hitt’s own 2nd Division used a then-popular cipher called the “Larrabee.” It was simply an ordinary Vigenère printed so that the plaintext alphabet was repeated for all 26 cipher alphabets. Neither it nor the cipher disk would have delayed an expert cryptanalyst for more than an hour. On May 19, 1914, Hitt had recommended that the Larrabee be replaced by the Playfair as the 2nd Division cipher, but was turned down. Undaunted, he proposed the new cipher that impressed him so much to the director of the Army Signal School on December 19, 1914.

“This device is based, to a certain extent, on the ideas of Commandant Bazeries, of the French Army,” he wrote in his memorandum. Hitt in effect peeled the alphabets off the disks of the Bazeries cylinder and stretched them out in strip form. He cut 25 long slips of paper, printed a mixed alphabet on each of them twice, numbered them, and then arranged them in a holder in the order given by a keynumber. To encipher, he slid the slips up or down until they spelled out the first 20 letters of the message in a horizontal line, and then selected any other line, or generatrix, as the ciphertext, repeating this process until the entire message was enciphered. Hitt’s first holder was 7 × 3¼ inches. He also made the device in its original Jefferson-Bazeries form by sawing disks off a cylinder of apple wood.

He requested that the device be forwarded to the Chief Signal Officer. About 1917, his old fellow student at the Signal School, Joseph Mauborgne, then in charge of the Signal Corps Engineering and Research Division, fixed the device in the cylindrical form for the Army and mixed the alphabets much more thoroughly than Hitt had, thereby making solution more difficult. In 1922, the Army issued its M-94, which strung 25 aluminum disks the size of a silver dollar on a spindle 4¼ inches long. The M-94 remained in Army service until early in World War II. Between the wars, both the Coast Guard and the Radio Intelligence Division of the Federal Communications Commission made use of it. In the 1930s, the Army reverted to Hitt’s slide form in its cipher device M-138-A, which improved on the Hitt device by providing 100 slides, 30 of which were used at a time. The State Department adopted the M-138-A in the late 1930s and early 1940s as its most secret method of communication. The Navy likewise used it very widely in World War II. It was commonly called the “strip system.” Thus Hitt’s few paper slides became one of the most widely used systems in the history of American cryptography.

In 1917, Hitt went to France with Pershing’s staff as assistant to the Chief Signal Officer. When the A.E.F’s 1st Army was formed, Hitt became its Chief Signal Officer. Though there was no cryptology involved in this job, his book had made him the American expert on the subject, and his advice was often sought. It was even followed, since Hitt was widely respected.

While he was overseas, his wife, Genevieve, who was operating the code room at Fort Sam Houston in San Antonio, struck up a friendship with a young lieutenant and his wife who lived across the way. Their names were Dwight and Mamie Eisenhower, and the friendship of the two families stretched across the years. One morning during World War II the Hitts stumbled across Ike, stretched out asleep in the living room of their home in Front Royal, Virginia, and in the 1950s Parker Hitt attended one of the famous and exclusive stag dinners given by the President at the White House.

When the United States entered the war, its Army had no official codemaking or codebreaking agency. Codes were occasionally compiled, of course, and each unit seemed to prescribe its own field ciphers, as Hitt found out when he tried to replace the Larrabee with the Playfair. Any cryptanalysis was on a strictly informal basis, like the messages that were sent to Hitt, often with a request like that from the acting intelligence officer of the Southern Department on March 7, 1917: “1. The inclosed cipher messages have been received from the Chief of the War College Division, General Staff. 2. It is requested that you decipher them as they are unable to do it in Washington. 3. The results obtained are desired at the earliest practicable date.” (Hitt returned these on March 10 saying that they appeared to be in code and that he could not read them.) Usually Hitt had to squeeze this work in among his regular duties. The Riverbank Laboratories also did some informal cryptanalysis for the War Department.

It was obvious, upon the arrival of the first token units of the American Expeditionary Force in France in the spring of 1917, that the A.E.F. would have both cryptographic and cryptanalytic work to do. Consequently, General Orders No. 8 of July 5, 1917, which established the A.E.F. headquarters organization, provided for these functions. It assigned “American codes and ciphers” to the Signal Corps but gave “policy regarding preparation and issue of ciphers and trench codes” to the Intelligence Division, probably because this was also charged with “enemy’s wireless and ciphers” and “examining of enemy’s ciphers.” Having the cryptanalysts supervise the cryptographers was excellent in theory—and it worked out fine in practice. The two organizations that came into being in accordance with this order collaborated closely throughout the war. One was G.2 A.6, the Radio Intelligence Section (the 6) of the Military Information Division (the A) of the Intelligence Section (the 2) of the General Staff (the G). The other was the Code Compilation Section of the Signal Corps. Both were stationed at American G.H.Q. at Chaumont, a town on the Marne about 150 miles east of Paris.

The Code Compilation Section was set up in December of 1917. There had been no real need for it before then because the United States had no troops in the line. In command was Howard R. Barnes, a 40-year-old Ohioan who had been commissioned a captain because of his ten years of experience in the State Department code room. Under him were three lieutenants and a corporal. The unit examined and discarded the three means of secret communications then authorized for the A.E.F.—the War Department Telegraph Code, which, as Voris had pointed out, was unsuited to tactical work, the cipher disk, whose security was nil, and the Playfair, which could not sustain security under regular use, but could and did serve as an emergency system.

Cryptography on the Western Front had evolved through ciphers to codes, and Barnes, bowing to this experience, began the task—never before attempted in the American Army—of compiling a codebook in the field. His section studied an obsolete trench code that the British had reluctantly turned over, made firsthand observations of communication needs at the front, and drew up The American Trench Code, of 1,600 elements, and the Front-Line Code, of 500. Both were one-part codes to be used with a monoalphabetic superencipherment. The 1,000 copies of the Trench Code were distributed only down to regimental headquarters, and the 3,000 copies of the Front-Line Code to companies. They served as the American cryptosystems during the first weeks of real A.E.F. participation in the war—the weeks of Château-Thierry and Belleau Wood.

But the system of enciphered code did not last long. Barnes frequently consulted with Hitt—“To him more than to any other officer of the American Army is due whatever success the American Codes may have obtained,” he later wrote—and Hitt suggested testing the superencipherment. G.2 A.6 lent Lieutenant J. Rives Childs. On May 17, 1918, Childs was given a copy of the codebook and 44 superenciphered messages. Within five hours—three of them spent just in making frequency counts—he had recovered the encipherment alphabet. At about the same time, Barnes and his men realized that a superencipherment imposed extra delay and extra work upon the encoders at the front, with all the dangers that that entailed. Superenciphered code would have to be junked. But what would the A.E.F. use?

Barnes was in close contact with Major Frank Moorman, chief of G.2 A.6, and it may have been Moorman who proposed that the A.E.F. use unenciphered two-part codes changed either before the Germans could solve them—a period estimated at from two to four weeks—or upon the capture of a book. On May 24, Hitt was writing to Moorman: “I concur in your ideas about the trench code book. I believe that we can republish it every two weeks….” Barnes, who was no cryptanalyst, acquiesced in the views of those who were. Frequent replacement was the principle of the Satzbuch, but the American codes were intended for service closer to the front. Thus the burden of augmenting security was lifted from the front-line soldiers and thrown, in the form of the more complicated two-part arrangement and the rapid replacement of codes, on the relatively undistracted personnel at headquarters.

On June 24, 1918, the Code Compilation Section published the first of the superb series of A.E.F. field codes—the Potomac. A 47-page booklet, it contained about 1,800 words and phrases for tactical needs (during the night = ANF, machine gun ammunition = APU). About 2,000 copies were printed and turned over to G-2 for distribution as far down as battalion headquarters. It went into service on July 15. The Potomac set the pattern for subsequent codes, which were printed and held in reserve, one set at army headquarters, a second at General Headquarters. Thus when, as expected, the Potomac Code was captured a few weeks after its publication, it took only two days to issue the Suwanee to the entire A.E.F. The Wabash moved into place as the back-up code and then, 16 days later, into service. It was followed by the Mohawk, Allegheny, Hudson, and Colorado codes at intervals of 3, 9, 21, and 22 days.

The rapid growth of the A.E.F. necessitated an increase in the number of copies printed to 3,200, but this also increased the danger of capture. So with the formation of the 2nd Army, a series of codes named for lakes was instituted on October 7 for the use of that army, while the river series was continued for the 1st Army. The Champlain, Huron, Osage, and Seneca codes were issued to the 2nd Army at intervals of 8, 13, and 9 days. At the Armistice, the Niagara Code was in press and the Michigan and Rio Grande codes in manuscript. In the five months between June and November, the section turned out nearly three codes a month—a noteworthy achievement, particularly in comparison with what the other belligerents accomplished.

Portions of the encoding and decoding sections of the A.E.F.’s Hudson Code

The Code Compilation Section printed its codes under conditions of tightest security at the Adjutant General’s printing office at Chaumont. Codes took priority over all other work except general orders and bulletins. Under favorable conditions, a field code would go from manuscript to binder in five or six days. Each code was proofread twice. “During the process of printing,” Barnes wrote, “the codes were under the constant supervision of an officer whose duty it was to destroy all spoiled sheets containing impressions even to the mats on the presses. All copies were counted and accounted for and the metal type melted down after the final impression. In many cases, two or three officers were on duty in the printing office keeping the various operations in sight.” The size of an edition was determined by G-2. Because the courier service refused to carry the heavy packages of codebooks, G.2 A.6, whose personnel realized the importance of secrecy in communications, took over the actual distribution of copies. Officers at the headquarters where the codes were kept in reserve were ordered to make frequent checks of the number of packages and the seals on them. A British officer was dumfounded when he heard that American codes could be prepared in ten days, saying that it would take his army at least a month.

Their cryptanalytic resistance was, as with the enciphered code, gauged by actual test. This time the results were positive. Members of G.2 A.6 reported that the system, while not insoluble, excelled that of the Germans. Coded messages had been sent to the British for further examination. Hay reported that “We have not been able to solve them or even to get any light. The security appears of a high order.” Hitchings wrote: “I am sending you a short survey of our observations on the 41 messages…. we have not succeeded in solving them, but you will see in the enclosed survey a few possible lines of attack.” And while Parker Hitt had not tried to solve any messages in the code, his general experience led him to say, “We believe that this code system will be better than anything now in use on either side.”

These field codes served primarily for communication within each division, though they also encoded messages between divisions and to higher headquarters. Battalions on the flanks of each army exchanged codebooks to permit intercommunication. The A.E.F. supplemented them with a variety of others needed by a modern army and prepared by the Code Compilation Section. Troops in the very first trenches used the Emergency Code List, a single sheet with about 50 common expressions represented in two-part arrangement by two-letter groups (CM = message not understood; PV =our artillery is shelling us). It resembled the carnet de chiffre. New editions were distributed at the same time as new editions of the field codes. For headquarters work Barnes’ section produced 1,000 copies of the massive Staff Code: 30,400 words and phrases, whose four-letter codewords, in one-part order, were superenciphered digraphically, with different tables for G-1, G-2, G-3, G-4, and G-5. It was probably the largest codebook ever printed in the field. There were also special codes for reporting casualties, for technical radio matters, for extra secrecy at six major telegraph posts in reporting troop movements, and for designating the names of organizations and officers over the telephone by using women’s names as jargon (28th Division = JENNIE: Chief of Staff = DOW; Chief of Staff of 28th Division = JENNIE DOW). In its ten months of active work, the section printed more than 80,000 codebooks and pamphlets, all numbered, recorded, issued and receipted for.

Front-line cryptography: an A.E.F. code list issued for use in the trenches

In addition to these official codes, many A.E.F. units cooked up their own unauthorized ones. In the 82nd Division, for example, officers said GREAT NECK for Grosreuves and BUZZARD for 1st Battalion, 326th Infantry. Some anonymous but avid baseball fan in the 52nd Infantry Brigade produced the gem of these unofficial systems. If we were under bombardment, it was WAGNER AT BAT; if the Germans simply lobbed over some enemy registration fire, WAGNER BUNTED; if we were under light bombardment, WAGNER DOUBLED, and if we were under heavy bombardment, WAGNER (whose nickname, it will be remembered, was “Hans”) KNOCKED A HOME RUN. Juvenile all this may be, but if codes are to delay enemy comprehension, this one no doubt served its purpose.

But the finest codes in the world, changed at the most rapid intervals, are worthless if wrongly used. Did the American doughboy fulfill his opportunity under these codes to achieve a superior security of communication? He did not. His irritation at the nuisance of encoding and his consequent unconcern for regulations could be matched against any combatant’s. Encoding delayed signaling, and combat officers bitterly resented this gumming of communications just when they were most needed. Aversion became so extreme that at one point a general actually gave his division specific orders to use no code before and during an important movement. The order was undoubtedly born of some unhappy experiences, and it was, in any case, less dangerous than any semicoding or other violations of coding regulations, such as sending messages to addressees not having the code, necessitating repeats either in clear or another system. The well-known American disregard for regulations—especially ones as persnickety as these—and the tendency to take the easiest way out caused G.2 A.6 chief Moorman to remark exasperatedly that “there certainly never existed on the western front a force more negligent in the use of their own code than was the American Army.”

Violations, in fact, became so numerous that a Security Service was set up to monitor American radio messages (later, telephone conversations as well). Its first station began operating at Toul on July 11, 1918; eventually the A.E.F. had four. The messages were sent to an officer in G.2 A.6 who studied them for practices that would help the Germans in solution. Letters pointed these faults out to commanders. One sent by the adjutant general to the commanding general of the 1st Army relating to a single message of September 17, pointed out that the plaintext Boche, spelled out by five code groups, could have been replaced by German or enemy, each a single codegroup, that two groups for day light could have been used instead of the 18 for almost before the crack of dawn, that work could have been written instead of business with a saving of seven groups, and so on.

Most of these rather fussy letters were ignored. “Only a few of these were answered,” Moorman complained, “and in these cases the action taken was entirely inadequate. In one case an officer was reprimanded by his commander. In others the excuse was made that officers did not know or were too busy or thought they were justified in their action…. in trying to check up and eliminate faults we have found great willingness and ability to refer us to someone else.” He proffered a unique solution of his own to end the vexing problem: “My idea would be to hang a few of the offenders. This would not only get rid of some but would discourage the development of others. It would be a saving of lives to do it.” Barnes’ more moderate idea of assigning a cryptographic control officer to each headquarters was preferred, but it did not go into practice until 20 years later.

Perhaps the most interesting thing about the entire American cryptographic operation was the attitude taken toward it by Barnes and his men. They did not regard their codes as immutable; rather they sought continually to improve them. Further, their efforts encompassed the physical as well as the cryptographic aspects. Paper, for example, was chosen so that it would stand up just long enough for the brief life of the book and would burn easily in case of danger. The typeface—named “Typewriter”—was picked for its legibility in the ill-lit dugouts of the front. The books continually shrank in size from the 7¼ × 9¾ inches of the Potomac to the 5½ × 7½ of the Colorado and subsequent books. In the later books, nulls were prominently bunched next to the encoding columns to encourage their use, and common suffixes, such as -ing, were listed conveniently at the bottom of each page. Homophones grew more abundant, and blanks were provided for special terms or names needed within the different divisions. A G-2 circular inviting suggestions brought in many requests to include certain phrases. To use them all would have swollen the book beyond easily manageable proportions, and Barnes winnowed out the many local and transitory ones. But the adaptability of the Code Compiling Section is shown by the fact that almost half of the 1,900 words and phrases in the Osage Code were new compared to those in the Potomac.

The section never satisfactorily resolved a continuing dispute over the relative merits of letters or numbers as codegroups, though it consulted many telegraphists, radio operators, code clerks, and experienced code officers. Opinion was almost equally divided. Most of the codes used three-letter codegroups, but a few were published with four-digit ones in an apparent experiment to see which actually worked best. The same undogmatic approach was demonstrated in the submission of the books for cryptanalytic tests, and in the testing of 50,000 telegraphic combinations to empirically select those resulting in the fewest errors as codegroups for the Staff Code.

In short, the Code Compiling Section was willing to learn, and it did learn a great deal that notably improved American codes. To an astonishing degree, it encapsulated “that practical, inventive turn of mind, quick to find expedients,” that historian Frederick Jackson Turner found the frontier had shaped as an American trait. Perhaps this is best epitomized—with the important addition of some American humor—by the codegroup to report that the code had been lost. The early codes did not even have one. The Hudson Code displayed in large type on its cover, “Memorize this Group: ‘2222—Code Lost.’ ” Then the codegroup for Code Lost was changed to DAM.

To the right of the imposing dark stone headquarters building at Chaumont stood an undistinguished, single-story barracks of glass and concrete. Sometimes called the “Glass House,” the caserne housed the other half of the American cryptologic effort, the Radio Intelligence Section, G.2 A.6.

Its chief, Moorman, 40, a native of Greenville, Michigan, was a blue-eyed, brown-haired Regular Army man who had worked his way up through the infantry ranks from private. He was a 1915 graduate of the Army Signal School and knew enough about cryptanalysis to devise an ingenious method for almost automatically determining the letters of a Playfair keyword. Hitt thought it valuable enough to include in his Manual. In France, however, Moorman did not engage in any actual cryptanalysis, except perhaps to help out, since his work as head of G.2 A.6 was administrative, not operative. As a boss he was well regarded by his men for his fairness and blunt honesty.

His organization began to take rudimentary shape in the fall of 1917 with a mere handful of men, the nucleus of what became a 72-man unit at the period of the A.E.F.’s maximum expansion. They came from the most varied civilian occupations. There were two New York lawyers, both lieutenants—Hugo A. Berthold, who was of Germanic extraction, knew the language well, and became Moorman’s chief assistant and head of code cryptanalysis, and Robert Gilmore. Childs, who had solved the superencipherment, had been a reporter on the Baltimore American before taking his M.A. at Harvard in 1915. Lieutenant Lee West Sellers was a New York music critic, and Lieutenant John Graham an instructor at Washington and Lee University, later a professor of Romance languages there. There was an architect who had studied Hebrew, Persian, and other Oriental tongues; one man was a chess expert, another an amateur archaeologist. About the only two who had had any experience at all with codes or ciphers were Corporal Joseph P. Nathan, who had worked in the code section of the Grace Line in New York, and one not unknown to later fame, Lieutenant William F. Friedman, who had become interested in the subject several years earlier. In addition to these men, six cryptanalysts were assigned to each army headquarters to decrypt intercepts from their front with keys from G.H.Q.

The work of G.2 A.6 divided into cryptanalysis and four minor areas—traffic analysis, intercepting enemy telephone conversations, following enemy air artillery spotters, and checking monitored American communications for security breaches. These minor functions made more important contributions than it would at first seem. Moorman, for example, originally did not consider the traffic analysis particularly necessary. But he saw its value when his men became skilled enough to draw a map of the German order of battle and to see through German fake messages. They even managed to discover two newly formed armies and thus help give warning of a new German drive. The aircraft teams eavesdropped on the planes as they signaled targets to their batteries and warned Allied troops that they were about to be fired upon; sometimes the G.2 A.6 experts even identified the battery that was about to fire, permitting Allied counterbatteries to shell them first.

The monitoring officer, Lieutenant Woellner, came up with some frightening object lessons. He deduced the entire American order of battle for the assault on the Saint-Mihiel salient from monitored telephone messages, missing the time of attack by 24 hours only because one speaker had misstated it! Most of his information came from a single switchboard operator who complained that certain lines had been broken by tanks and heavy artillery moving into a small woods near him all night. “Whether or not the Germans picked up this message we never learned,” Moorman commented disgustedly, “but it is certain that this one operator did all that could be reasonably expected of one man in the matter of telling the Germans when and where the attack would take place and the forces to be engaged.”

Like the other sections, the cryptanalysts got off to a slow start. Their training had been all in ciphers, whereas the Germans were using code. In November of 1917, Berthold went to the French cipher bureau, where he picked up some instruction and probably some current KRU solutions as well. With this help, G.2 A.6 discovered that certain nearby German stations radioed regular reports at regular hours—a habit that thenceforth proved fatal to many a Satzbuch. By the end of the first week of a code’s month-long life, Moorman said, “we were reading some of the routine messages…. At the end of the second week we were reading many of the messages, and at the end of the third week we practically controlled the code. This really meant that we had for one week a real control of each code.”

G.2 A.6’s first real victory in the war of the intercepts came with the introduction of the Schlüsselheft. The success was due in large measure to the alertness of the Signal Corps’ Radio Section, which operated the network of intercept stations that fed the cryptanalysts their raw material. The first stations were set up in the fall of 1917, and by the end of the war the five posts had snatched 72,688 German messages from the airwaves. Eight direction-finding stations took the astonishing total of 176,913 bearings. The radio operators, frequently working in damp and drafty shacks exposed to enemy fire, won high praise from the cryptanalysts for the accuracy of their interception of long strings of meaningless letters. Often they picked up messages that the other Allies had not heard, and this was what happened on March 11, 1918.

It was at midnight of that date that the Germans placed into service not merely a new code, but one that, from its numerical codegroups, appeared to be of a different breed entirely. The Allies were expecting a major German push, and the appearance of this code was considered another straw in the wind. Its solution would obviously be of importance in giving clues to German activities. Though the British had suggested that a superencipherment might be involved, the precise nature of the system had to be determined, the superencipherment stripped off, and the repertory then built up. This would have imposed much greater difficulties than just solving another Satzbuch edition—except for American alertness.

Forty minutes after midnight, the American intercept post at Souilly picked up one of the first messages in the new system. Station x2 was sending it to Station ÄN:

00:25 CHI-13 845 422 373 792 240 245 068 652 781 245 659 659 504

At 12:52 ÄN replied: CHI-13 OS RGV KZD. Five minutes later x2 sent a second message to ÄN:

00:25 CHI-14 UYC REM KUL RHI KWZ RLF RNQ KRD RVJ UOB KUU UQX UFQ RQK

When these appeared on the desk of Berthold, head of code cryptanalysis, he guessed at once what had happened: x2 sends a 13-group cipher message (CHI-13) in a new system, ÄN responds with OS, a well-known service abbreviation for Ohne Sinn (“message unintelligible”), and a reference to CHI-13, followed by two groups from the old KRU code. Whereupon x2 sends a second message, this time in KRU but with the original time group (00:25). The old KRU had been partially solved, and Berthold knew that the RGV of the short ÄN message meant “old.” He did not know the meaning of KZD, but it seemed likely in view of what happened that it meant “Send in code,” making the whole phrase “Send in old code.” Could the Germans have been so stupid as to compromise their new code within an hour after putting it into service by sending the same message in both the old and the new systems?

Berthold’s blue eyes fairly snapped and the few pale wisps of hair that lay against his bald pate almost stood up with excitement as he decoded the second x2 message with his reconstructed KRU. It read:

The KWZ and UOB appeared to be nulls, used—almost certainly in violation of regulations—as word dividers, and REM probably meant Kommandant. When Berthold checked this against the second message, he saw at once that it had the same plaintext. The repetitions of the plaintext i’s and t’s, which had been masked by the homophones and the lexicon of the KRU code, appeared clearly in the trinumeral message as the repeated 245s and 659s. With these four points as anchors, Berthold could set up the following equivalencies:

A staff airplane sped his result to the British cryptanalytic bureau, and Berthold telegraphed it in a special codebreakers’ code to the French. It was a Rosetta Stone for what turned out to be the new Schlüsselheft. The three bureaus cooperated closely, but it was largely due to Painvin’s genius that within two days they had neutralized the Geheimklappe superencipherment and dismembered much of the lexicon. By March 21, when the expected German blow fell, Allied cryptanalysts were reading Schlüsselheft messages better than the German code clerks themselves. Theoretically no important information was supposed to be carried in it, because it was intended only for low-level, front-line communications. But theory succumbed at times of great activity, when the information was most desirable, and the trinumeral messages were laden with valuable nuggets. “The sending of this one message must certainly have cost the lives of thousands of Germans,” Moorman said, “and conceivably it changed the result of one of the greatest efforts made by the German armies.”

As G.2 A.6 gained experience, it gained speed. Perhaps the most dramatic demonstration came at 9:05 p.m. April 28, when the Germans ordered an attack for 1 a.m. The message was intercepted, telegraphed to headquarters, cryptanalyzed, and employed to warn American troops half an hour before the Hun assault. Despite this rather sensational demonstration, the higher-ups seemed dissatisfied. They felt, Moorman protested, “that we were doing a lot of unnecessary work. What they wanted us to do was pick out the important messages, decode them, and let the rest go. They understood that the greater part of these messages were valueless and so thought what was the use of bothering with them. It was a matter of considerable difficulty to make them see that we had to work them out and that the Germans did not tag their important messages before sending them.”

During the summer of 1918 G.2 A.6 received considerable help from a source that was seeking to hamper it. Code discipline had grown lax among the signal troops of the German 5th Army, which faced the American forces, and one Lieutenant Jaeger was detailed to stiffen it. He knew what should be done and issued numerous orders to do it. Unfortunately, he overlooked the circumstance that the German codebooks did not include his name, which therefore had to be spelled out letter by letter every time he affixed it to an order. This was frequently. Its peculiar formation—the repetition of the high-frequency e, for example—permitted G.2 A.6 to identify it readily, and this in turn led to important clues concerning the superenciphering Geheimklappe and, in one case, to the identification of 40 groups in a new Schlüsselheft. Perhaps it was Jaeger who, before his assignment to the 5th Army, coined one of the unforgettable slogans of communication security—which was, fittingly enough, read by G.2 A.6: Weh dem der leugt und Klartext funkt (“Woe to him who lies and radios in clear”). Jaeger was beloved by his adversaries because he kept them up to date with code changes, and it was with genuine regret that they saw his name disappear from the German traffic.

The older, battle-wise cryptanalytic bureaus of France and England developed increasing respect for their younger protégé as it gradually proved itself, and the tendency was nurtured by the effective liaison work of Childs. A 25-year-old Virginian, he displayed enough diplomatic ability to later become American ambassador to Saudi Arabia, Yemen, and Ethiopia, and sufficient command of French to later write a book in it (on Nicolas Restif de la Bretonne, a bawdy French novelist on whom, along with Casanova, Childs became an international authority). On visits in the spring and summer of 1918, Childs built up friendly relations with Hay, Brooke-Hunt, Hitchings, and Cartier; he enjoyed a particular rapport with Painvin, under whom he studied for a week.

Childs headed the small group that concentrated on German ciphers, a post he had obtained because Moorman mistakenly thought he was an amateur cryptologist from New York with the same name. Moorman made him liaison officer because of his impressive showing with the American trench code superencipherment—though up to that time Childs, despite diligent application of the principles he had been taught, had not solved a single German message. His ignorance was so abysmal that in London Brooke-Hunt lost all interest in him as soon as he discovered it. As a sop he told Childs about the German Für GOD cipher and furnished him with the keys. Childs soon discovered that the apparently incoherent keys were actually monoalphabetically enciphered versions of words like INSTRUMENT-ENMACHER and GOLDARBEITER. It became his personal turning point.

On August 5, an American intercept station picked up a 456-letter message addressed to the German Foreign Office from General Kress von Kressenstein. He had recently been shifted from Syria to Tiflis to prevent the rich oil fields of the Caucasus from falling into Turkish hands. This question of friction between allies acutely interested Britain, for it affected not only her Mesopotamian campaign but also the whole future of Persia and the gateways to India.

The intercept began: PZÄVE PNÄJY GJCGB PZAV PFAVG BPFHG YZAN RPBBP GOWIB PCBPR OOBP XBEGH ÄVBRW …. Childs took his frequency count, found to his gratification that the immense frequency of ciphertext B could only mean that it represented plaintext e in a monoalphabetic substitution, and within an hour had broken the message. Von Kressenstein was reporting the unconfirmed capture of Baku, heart of the oil basin, by Turkey. The Turkish leader, Enver Pasha, had assured him that he was moving into Baku only to improve his sanitary arrangements, and von Kressenstein was reciprocating this obvious trust. “To make the Turkish advance more difficult,” he stated, “I have hampered every shipment of munitions from Batum via Tiflis up to the present time.” Childs’ solution was important enough to be included verbatim in a printed G-2 survey of the Caucasus and Central Asia. It demonstrated to the Allies that the Turco-German split had gone deep enough for one to deprive the other of the very essentials of combat in a struggle for national existence.

If Childs wondered in his elation why so important a message was being clothed in so flimsy a cipher, he discovered the answer a few days later when he read a message from Berlin in another and far more secure system. “The cipher method prepared by General von Kress was solved here at once. Its further use is forbidden.”

G.2 A.6 distributes its solutions of ADFGX cryptograms

Extremely alert, Childs pounced on the freaks of German encipherment and twisted them to American advantage. The Germans, for example, were still using a double transposition that they called the ALACHI as one of their systems of secret communication with their forces in Russian Georgia and the Near East. On July 24, two ALACHI messages were intercepted, one of 226 letters from Berlin to a small post at Tiflis, the other of 152 letters from Tiflis to Constantinople. The Berlin message resisted all attempts at solution, but Childs discovered that the encipherer at Tiflis had omitted the second transposition. He solved it as a simple columnar with a 22-number key. When he applied this key twice to the other message, he read it with ease. It proved to be a message signed by General Erich Ludendorff, the German chief of staff.

In another case, Childs noticed that the second part of a message from Berlin to Constantinople on November 1 was repeated the next day with the addition of only two letters. Using the slight difference as a fulcrum, Childs levered back and forth from one message to another like a bridge player working a ruff and within an hour and a half on the afternoon of November 2 had solved them both. At this time and on this front, German keys remained in effect for three days, and when he used them to read a long message of November 3 in 13 parts, he detonated a small bomb of excitement at G.H.Q.

“By reason of its length,” Childs wrote later, “I was persuaded before the message had even been reduced to German plaintext, a long and tedious task, that it was likely to contain information of more than ordinary interest…. Every available German translator of the Section was pressed into service, while I superintended the conversion of the ciphertext to German, of which language I was almost entirely ignorant save for that instinctive feel for the mechanics of it which any cryptographer acquires from such intimate daily contact with it as I had had.”

It turned out to be a highly revealing review of the situation in the Balkans as seen by the German commander there, Field Marshal August von Mackensen. The dynamite was in the twelfth part, where Mackensen proposed “that the army of occupation be withdrawn from Rumania at once.” The conqueror’s jackboots there were enforcing a particularly harsh peace treaty, and it was not beyond conjecture that the Rumanians would rise in fury as soon as the military restraint was removed and fall upon the Germans from behind. This possibility suddenly brightened for the Allies with the information extracted from the Mackensen telegram. Accordingly, as soon as it was deciphered and translated, Berthold grasped Childs by the sleeve and rushed with him and the telegram to the office of the assistant chief of staff. When the colonel there read it, he caught Berthold’s excitement, and he dashed out of the office carrying the telegram. He returned to say that its contents had been communicated to the Supreme War Council. A few days later, when Mackensen evacuated Bucharest to the hooting of the crowd, the Rumanian government denounced the peace treaty and declared war anew upon Germany.

The Mackensen message was in the ADFGVX system—probably the most famous field cipher in all cryptology. It was so named because only those six letters appeared in the cryptograms,{1} though just five were used (no V) when the system sprang into use on March 5, 1918.

The war in the West had by then become a stalemate of exhaustion. The young recruits who the Kaiser had promised in the glorious summer of 1914 would be “home before the leaves fall” had become veterans hardened by almost four years of battle—those few who survived. The flower of England’s youth had perished; in France, a generation had climbed out of the trenches and vanished forever.

During the winter, Germany had come to realize that she would have to win in the spring if she were to win at all. The U-boat had failed to starve England into submission, and the United States had entered the war against her. But the collapse of Russia had freed dozens of German divisions for service on the Western Front and, for the first time, Germany held a numerical preponderance there. This, however, was only until America could transport her strong young forces across the Atlantic. It was to be now or never, and the imperial government lashed its weary troops and hungry civilians for the supreme effort that was to bring final victory.

It was no less clear to the Allies that Germany planned to launch a climactic offensive in the spring. There were many signs—the new cipher itself was one. The question was: Where and when would the actual blow fall? The German high command, recognizing the incalculable military value of surprise, shrouded its plans in the tightest secrecy. Artillery was brought up in concealment; feints were flung out here and there along the entire front to keep the Allies off balance; the ADFGVX cipher, which had reportedly been chosen from among many candidates by a conference of German cipher specialists, constituted an element in this overall security, as did the new Schlüsselheft. The Allies bent every effort and tapped every source of information to find out the time and place of the real assault. But one of their most flowing founts—cryptanalysis—appeared to have dried up.

When the first ADFGX messages were brought to Painvin, the best crypt-analyst in the Bureau du Chiffre, he stared at them, ran a hand through his thick black hair with an air of perplexity, and then set to work. The presence of only five letters immediately suggested a checkerboard. Without much hope, he tried the messages as simple monalphabetics; the tests were, as he had expected, negative. He discarded a polyalphabetic checkerboard as too cumbersome, and was left with the hypothesis that the checkerboard substitution had been subjected to a transposition. On this basis he began to work.

Nothing happened. The traffic was too light for him even to determine by frequency counts whether the checkerboard key changed each day, and without this basic information he did not dare to amalgamate the cryptograms of successive days for a concerted assault. Cartier looked on over his shoulder as he braided and unbraided the letters and mused sadly, “Poor Painvin. This time I don’t think you’ll get it.” Painvin, goaded, worked harder than before. Meanwhile, Berthold achieved his Schlüsselheft entry and Painvin, shifting temporarily to that more fruitful field, completed it. But the enciphered code, used only for trench communications, provided no strategic insights. These would come, if they were to come at all, through solution of the ADFGX, which direction-finding showed was carrying messages between the higher German headquarters, chiefly those of divisions and army corps. Painvin strained even harder.

At 4:30 a.m. March 21, 6,000 guns suddenly fired upon the Allied line at the Somme in the most furious artillery cannonade of the war. Five hours later, 62 German divisions rolled forward on a 40-mile front. The surprise was complete and its success overwhelming. French and British troops reeled back day after day in stunned confusion. The head of intelligence at French G.H.Q. came into the cryptologic bureau three days later and told Major E.-A. Soudart, the replacement for Givierge, who had gone to the front, and his assistant Marcel Guitard: “By virtue of my job I am the best informed man in France, and at this moment I no longer know where the Germans are. If we’re captured in an hour, it wouldn’t surprise me.” Within a week the Germans had punched a hole 38 miles deep in the Allied lines, and it was not until the British and French troops fell back to Amiens that they collected themselves and halted the advance.

The furious advance was reflected in a dramatic upsurge in radio traffic. The first result was disappointment. Painvin’s frequency counts showed that the checkerboard key did change daily; presumably the transposition key did also. Solution would therefore require a goodly quantity of text from a single day, but until April 1 the interceptions were too meager. On that day, the French picked up 18 ADFGX messages totaling 512 five-letter groups. Two of them had been sent in three parts, none of the same length: the Germans had had their fingers burned by multiple anagramming early in the war and had learned their lesson.

Studying them, Painvin noticed on April 4 that the first parts of the two messages had identical bits and pieces of text larded in the same order in the cryptograms. This oddity could most likely have resulted from both cryptograms having identical beginnings transposed according to the same key; the identical fragments of text would then represent the identical tops of the columns of the transposition tableau. Sectioning the cryptograms so that each identical fragment started a new segment would yield the columns of the tableau, in the order of their transcription. Painvin did this to CHI-110, the 110-letter first part of a message from VI to B8, and to CHI-104, the 104-letter first part of a message sent 13 minutes later, also from VI but this time to BF:

The problem now was to discover the transposition key, or, to put it another way, to reconstitute the block. A beginning could be made on the principle that the long columns stood at the left. Painvin saw that in both cryptograms columns 3, 6, 14, and 18—meaning the columns headed by these keynumbers—were longer than the other columns. He moved them to the extreme left of the block. Columns 4, 7, 9, 11, 16, and 19 were short in CHI-104 and long in CHI-110; consequently they clustered in a zone to the right of the first four but to the left of the remaining ten columns. The remaining ten were short in both messages and thus pushed to the right. These three zones marked a first approximation to the key.

Unable to wrest any more information from the first parts of the messages, Painvin turned to their third parts in the hope of finding a common ending. Common repetitions showed him that they had indeed a common ending, and this enabled him to properly segmentize them into columns as he had the first parts. He partially divided up each of the three zones within themselves on the same basis of long and short columns. He thus made a second approximation to the transposition key. This showed conclusively that columns 5 and 8 huddled next to one another in the middle of the tableau and that 12 and 20 stood at the extreme right—though in neither case did Painvin yet know whether their order was 5-8 or 8-5, or 12-20 or 20-12.

He went back to the original 18 intercepts of the day, sliced them into 20 segments, and matched segment 5 to segment 8 in all of them. Sixty letter-pairs resulted from this juxtaposition, and Painvin took a frequency count of them—so many AA’s, SO many AD’s, so many AF’s, and so on. To his delight the count showed all the characteristics of a monalphabetic substitution. This indicated that the two columns indeed belonged together in the transposition block, for placing two wrong segments side by side would have resulted in a flattish count. It verified his original system assumptions as well as his transposition rough-out.

He made a similar test with the 12-20 combination, and found an equally monoalphabetic count. The most frequent pair was DG, with a frequency of 8, probably representing plaintext e. But DG in the 5-8 coupling had a frequency of zero—impossible for German e. On the other hand, GD had a frequency of 8. Since Painvin did not know the order of the columns within each pairing, his arbitrary 5-8 order for the frequency count had probably reversed the letter-pairs respective to 12-20. To correlate them, Painvin reversed 5-8 into 8-5, turning its GD into DG, which, with its frequency of 8, was a much better candidate for e. The former DG became GD, frequency zero. Painvin could now set up a skeleton checkerboard—which he did on the basis that the coordinates would be taken in the order side-top—and could insert his plaintext values in it as he recovered them:

How could the rest of the transposition block be reconstructed? Since the coordinates were taken repeatedly in the order side-top, side-top, side-top, and since the block had 20 columns, all the side coordinates would have fallen into the 1st, 3rd, 5th,… 19th positions during encipherment, and all the top coordinates into the even positions, thus:

If, Painvin thought, the side coordinates could be separated from the top ones, this would separate the odd positions from the evens. The coordinate separation might be effected on the basis of frequency characteristics. The frequency of the side coordinate D should differ from that of the top coordinate D because the total frequency of the five letters in the D row should differ from the total frequency of the five letters in the D column. The same should hold true for the other coordinates. Hence the top coordinates should manifest a different frequency profile than the side coordinates.

Painvin’s frequency counts showed that the columns of the cryptograms indeed separated into two groups: one with D as its maximum and G as its minimum, the other group with G as its maximum and F as its minimum. The first group, which included column 12, turned out to stand in the odd positions. Painvin then determined which odd went with which even by matching one with another; only correct pairings showed monalphabetic distributions. Simultaneously he began solving for actual plaintext and building up his checkerboard, and, after 48 hours of incredible labor, Painvin had cracked the first messages in the toughest field cipher the world had yet seen.

His feat shows the cryptanalytic mind at its finest. Painvin spotted opportunities that many would have missed, and when he worked with one, he did not leave it until he had wrung it dry. This technique of extracting every drop of information from each phase of solution before moving on served well, for the cipher prickles with many defenses. Most stem from its fractionating nature—the breaking-up of a plaintext letter’s equivalent into pieces, with the consequent dissipation of its ordinary characteristics. The transposition then scatters these characteristics in a particularly effective fashion, while the dissipation, in turn, dulls the clues that normally help reconstruct the transposition.

It is not surprising, therefore, that the Allies never developed a general solution for the ADFGVX. Cryptanalysis nearly always depended on the finding of two messages with identical beginnings or endings or some other quirk. This explains the apparent anomaly that although only ten keys covering as many days were ever recovered on the Western Front, approximately half the ADFGVX messages ever sent were solved: solutions were achieved only on the days of heaviest traffic. From the German point of view, the system was quick and easy, involving only two simple steps. Messages were doubled in length, but this disadvantage was somewhat offset by the presence of only six different letters in the cryptograms, making transmission faster and more accurate.

By the time Painvin had achieved his first solution, the first German offensive had spent its force, and the volume of traffic had diminished. He rummaged through the piles of intercepts to find others with common endings or beginnings and began working on the messages of March 29, which were relatively abundant. On April 26, after three weeks of work, he finally broke through. Meanwhile the Germans again struck with surprise and forced the English back almost to the sea. But Painvin was now getting his feet on the ground, and the subsequent key recoveries came with increasing speed. It took only nine and a half days to discover the key for the April 5 messages. On the morning of May 29, he started to work on the messages of the day before, and two days later had their key. He took up the messages of the 30th at 4 p.m. on May 31 and was reading them at 5 p.m. the next day.

By then the French had been dealt two unpleasant blows—one military, one cryptographic. Ludendorff had again managed to conceal the time and place of a major assault. Fifteen of his divisions fell by surprise on seven. A gray flood of Germans inundated the French positions in the heights of the Chemin-des-Dames and surged forward irresistibly until it lapped the banks of the Marne only 30 miles from Paris, almost submerging the Allied cause. At the same time, Painvin suddenly saw, on June 1, the ADFGX message complicated by the addition of a sixth letter, V. Probably the Germans expanded their checkerboard to 6 × 6. But why? For homophones to further blunt the frequency clues? Or to insert the ten digits? Painvin did not know.

“In short,” he said, “I had a moment of discouragement. The last two keys of the 28th and the 30th of May had been discovered under conditions of such rapidity that their exploitation was of the greatest usefulness. The offensive and the German advance still continued. It was of the greatest importance not to lose [cryptanalytic] contact and in my heart I did not want to brusquely shut off this source of information to the interested services of the armies, which had become accustomed to counting on its latest results.”

He opened his assault on the cryptograms of June 1 at 5 p.m. Three messages of that date all bore the same time group (00:05) and had all been sent from a transmitter with call-sign GCI. Painvin compared two of them, one to call-sign DAX, the other to DAK, that had almost identical texts of 106 letters each. But aside from indicating a keylength of 21, they led nowhere: they were too similar. He then compared the DAX cryptogram with the third from GCI, a message of 108 letters to DTD that closely resembled the others. These he cut into column segments as he had done with the messages of April 1. He obtained two roughed-out transposition blocks, whose key-order he still did not know.

Painvin assumed, however, that the two plaintexts were the same except for the addition of a single element to the internal address of the DTD message. This would have pushed the identical portion two notches further back in the DTD block than in the DAX one. He had only to seek an arrangement of columns that would produce such a result. Within an hour he had found it:

6 16 7 5 17 2 14 10 15 9 13 1 21 12 4 8 19 3 11 20 18

The solution of the checkerboard followed quickly:

The DAX plaintext read: 14 ID XX Gen Kdo ersucht vordere Linie sofort drahten XX Gen Kdo 7 (“14th Infantry Division: HQ requests front line [situation] by telegraph. HQ 7th [Corps]”). The DTD text was identical except for its being addressed 216 ID.

Painvin completed his solution at 7 p.m. on June 2, and sent it at once to G.H.Q. By then the French had managed to halt Ludendorff’s push, but they teetered precariously on the brink of defeat. The Germans were shelling Paris from 60 miles away with their long-range guns. The great German successes of March and May had driven two vast salients into Allied territory. They pointed like daggers at Paris. And the great question recurred: Where would Ludendorff strike next? The thin Allied lines could not hold against a massive piledriver blow concentrated on a single point. If Ludendorff could gain the same surprise that he had so successfully achieved in each previous assault, he could puncture the Allied defenses, overrun Paris, and perhaps end the war. The Allies’ only hope of stopping him was to absorb his thrust head-on with their reserves. But to do this they had to know where to send them.

The French discussed the possibilities. Would Ludendorff lunge out directly for Paris from the tip of one of his salients despite the danger to their flanks? Or would he first flatten out the large dent between those bulges and then drive forward from a consolidated position? If the latter, where in the huge pocket would he strike? No one knew.

Ludendorff, meanwhile, was having troubles of his own. German military doctrine called for a sudden, intense artillery bombardment to paralyze the defenders before the infantry attacked. This saturation technique required concentrating thousands of field pieces and tons of munitions at the battle-front. At a conference early in June, Ludendorff learned that this concentration was running behind the schedule he had set for his next assault. His successes had strained his lines of transport, and he had been moving his guns and shells only under cover of night to preserve the invaluable advantage of surprise.

And this advantage he had conserved superbly. The hints that drifted out to French G.H.Q. about his intentions were multiple, petty, and contradictory. Nothing would jell. Gloomy intelligence officers could reach no definite conclusions. Another attack was certainly in the offing, but unless they could ascertain its location, France might be lost.

Into this dismal atmosphere on the morning of June 3 burst Guitard of the Service du Chiffre, excitedly waving an intercept. One of the G.H.Q. cryptanalysts, applying the keys that Painvin had sent there, had just read a cryptogram sent at 4:30 a.m., only a few hours earlier:

CHI-126 FGAXA XAXFF FAFFA AVDFA GAXFX FAAAG DXGGX AGXFD XGAGX GAXGX AGXVF VXXAG XFDAX GDAAF DGGAF FXGGX XDFAX GXAXV AGXGG DFAGD GXVAX XFXGV FFGGA XDGAX ADVGG A

Direction-finders reported that it had been transmitted by the German High Command. The addressee, DIC, was known from traffic analysis and direction-finding to be the 18th Army’s general staff in Remaugies—a town situated just above the concavity in the German lines. Its plaintext read: Munitionierung beschleunigen Punkt Soweit nicut [error for nicht] eingesehen auch bei Tag (“Rush munitions Stop Even by day if not seen”).

Guitard and the intelligence officers recognized at once that the ammunition mentioned in the telegram was that intended for the usual German preassault bombardment, and the location of the addressee of the message told them where that attack would come. Jubilantly they communicated their information to the operations officers: Ludendorff was going to hammer out the dent, and the German sledge would crash down onto the French line between Montdidier and Compiègne, a sector about 50 miles north of Paris.

Aerial reconnaissance confirmed the daylight transport of munitions. Deserters reported that the onslaught would take place June 7. Foch, in supreme command, shifted his reserves into position, thinned out the front lines, upon which the brunt of the cannonade would fall, and braced his secondary defenses. On the 6th, officers were told that “the offensive is imminent.” Tension mounted. The 7th passed without enemy action, and the 8th: Ludendorff had postponed the attack for two days to bring up more guns and munitions because, he said, “thorough preparation was essential to success.” The French waited tensely but with confidence. At midnight on June 9 the front from Montdidier to Compiègne erupted in a fierce, pelting hurricane of high-explosive, shrapnel, and gas shells. For three hours a German artillery concentration that averaged one gun for no more than ten yards of front poured a continual stream of fire onto the French positions—and Ludendorff’s urgent demand for ammunition became clear. But this time, for the first time since Ludendorff began his stupendous series of triumphs, there was no surprise. Painvin’s manna had saved the French.

A little before dawn 15 German divisions charged forward. The French were ready. For five days, fighting seesawed back and forth. Initially the Germans took the little villages of Méry and Courcelles, but on June 11, General Charles Mangin counterattacked with five divisions and all the elan the French could muster. He stopped the German advance cold and then swept the gray tide out of the two villages. Again the Germans heaved forward in a great effort. They failed with heavy losses. For the first time that spring, Ludendorff suspended an operation before it had achieved its goal. Mangin, wearing his gold-brocaded képi, laughed beneath the guns of victory. Foch, who realized that other German assaults would come and that he would have to defend against them, knew at last that he would some day take the offensive. He knew then that the war was not lost, and could eventually be won. Within a few weeks, the final German thrusts did come, but they had run out of steam, and the French parried them. Soon the initiative passed to the Allies, bolstered by the Americans, and their powerful counterstrokes drove the German armies back and back until the Kaiser, his militaristic dreams wrecked, abdicated and fled while his generals signed the Armistice at Compiègne. The World War was ended.

For Painvin, who had lost 33 pounds while simply seated at his desk, there was a long leave of convalescence. Afterwards, he engaged in an immensely successful business career, becoming president and director general of Ugine, the chemical giant of France, president of a phosphate company, vice president of a commercial credit firm, administrator of a mortgage society, honorary president of the Union of Chemical Industries and of the central committee of the electrochemical trade, and president of the Chamber of Commerce of Paris. Yet, he said, none of these achievements ever gave him the satisfaction that his ADFGVX solutions did. They left “an indelible mark on my spirit, and remain for me one of the brightest and most outstanding memories of my existence.”

The First World War marks the great turning point in the history of cryptology. Before, it was a small field; afterwards, it was big. Before, it was a science in its youth; afterwards, it had matured. The direct cause of this development was the enormous increase in radio communications.

This heavy traffic meant that probably the richest source of intelligence flowed in these easily accessible channels. All that was necessary was to crack the protective sheath. As cryptanalysis repeatedly demonstrated its abilities and worth, it rose from an auxiliary to a primary source of information about the foe; its advocates spoke regularly in the councils of war. Its new status was exemplified in terms clear to every military mind when both Cartier and Givierge became generals. The emergence of cryptanalysis as a permanent major element of intelligence was the most striking characteristic of cryptology’s new maturity.

Another was the change in cryptanalysis itself. The science at last outgrew the mode of operation that had dominated it for 400 years. This was chamber analysis, in which a single man wrestles with a single cryptogram alone in his room; John Wallis epitomizes the genre. Chamber analysis began to fail the cryptanalysts in the first days of the war. The German double transposition required at least two messages of the same length for solution, but a great many messages had to be intercepted before the law of averages would hatch those two. As cipher systems grew increasingly complex, cryptanalysis relied more and more on special solutions like this, and so they required many more messages for success than the bewigged practitioners of chamber analysis would have ever thought necessary. They also depended more heavily on such auxiliary aids as traffic analysis and knowledge of surrounding events, because the more that is known about the circumstances in which messages are sent, the easier solutions by special case become. Cryptanalysts thus became much more intimately connected with the real world.

A third characteristic of the new maturity was the evolution of fields of cryptanalytic specialization. Systems of secret communication had ceased to be so few and so homogeneous that a single expert could subdue them all. Their multiplicity and heterogeneity, plus the volume of traffic in each, bred the specialist. Such, for example, was Childs, who worked exclusively on ciphers, while others in G.2 A.6 attacked codes. Perhaps the most interesting specialist of all was the chief of the cryptanalytic office himself. No longer could he seclude himself in a quiet little world of letters and numbers as just the foremost among a group of cryptanalysts, like the English Decypherers. The more active cryptology of the 20th century impinged on so many more areas that the chief had to devote his energies exclusively to learning from other branches of the services what intelligence was most needed, disposing his team of codebreakers to get it, and obtaining information in the form of battle reports, cleartext intercepts, prisoner-of-war interrogations, captured documents, and the like that would help them in their special solutions. The chief had become purely an executive, who himself never picked up a colored pencil or an eraser for an actual solution, though he necessarily needed a thorough knowledge of the technique. His new responsibilities, of course, stemmed in large measure from cryptology’s upgraded position. But they also reflected the specialization now required in the burgeoning field, and this division of labor is as much a sign of maturity in cryptology as it is in a society.

Still another sign of that maturity was the emotional apprehension of the role played by the blunders of inexperienced, indolent, and ignorant cryptographic clerks. Cryptologists had had an intellectual awareness of this danger at least since 1605, when Francis Bacon wrote that “in regards of the rawness and unskillfulnesse of the handes, through which they passe, the greatest Matters, are many times carryed in the weakest Cyphars.” But it was not until cipher key after cipher key, and code after code, had been betrayed by needless mistakes or stupidities or outright rule violations that the magnitude of the problem was borne in upon them. The problem had swollen to such proportions because so large a volume of messages had to be handled by so many untrained men—against whom were pitted the best brains of the enemy. The experts realized that to eliminate these is to strengthen cryptographic security more effectively than by introducing the most ingenious cipher. The great practical lesson of World War I cryptology was the necessity of infusing an iron discipline in the cryptographic personnel. Errors arising from ignorance can be reduced by explaining how enemy cryptanalysts take advantage of what appears to be the most trivial violation of the rules. Faults arising from laziness can be lessened by a monitoring service that finds and punishes offenders. Givierge enunciated the doctrine that must be impressed upon the cipherers: “Encode well or do not encode at all. In transmitting cleartext, you give only a piece of information to the enemy, and you know what it is; in encoding badly, you permit him to read all your correspondence and that of your friends.”

All these developments, however, resulted essentially from the inter-reaction between cryptology and the outside world; they were externally oriented. World War I originated no developments that were internally oriented, as, for example, was the emergence of the field cipher. On the contrary, two of the most central activities—the actual cryptographic operations, which were performed by hand, and the techniques of solution, which were brute frequency analysis—had exhausted their usefulness.

Manual systems sagged under message loads for which they were never designed. Not a few cryptographic clerks dreamed of machines that would lift the onerous burden from their shoulders. In a sense, the codes that became so popular might be regarded as a rudimentary form of mechanical device that does the work for the encoder: the phrases are prepared and equated with their code equivalents in advance, and the encoder has but to pick out the ones he wants. But the trench codes were to the printing cipher machines of later years as the taxis of the Marne were to the armored troop-carriers of Panzer columns.

At the same time, the classic principles of frequency analysis had been stretched to their utmost. They were applied with great subtlety, as in Painvin’s matching of frequency distributions to determine the odd and even columns of the ADFGVX transposition block. But no new principles had been evolved, and the old ones had barely coped with such concepts as fractionation.

In these two internal matters, which lie at the core of cryptology, World War I marked not a beginning but an end, had reaped not fulfillment but barrenness. So viable had the science become, however, that this very vacuum, this want, held promise.

12. Two Americans

THE MOST FAMOUS CRYPTOLOGIST in history owes his fame less to what he did than to what he said—and to the sensational way in which he said it. And this was most perfectly in character, for Herbert Osborne Yardley was perhaps the most engaging, articulate, and technicolored personality in the business.

He was born April 13, 1889, in Worthington, Indiana, and grew up in that little Midwestern town during the tranquil, sunlit years that preceded the First World War. A popular youngster, he was president of his high-school class, editor of the school paper, and captain of the football team, and though only an average student, he had a flair for mathematics. From 16 on he frequented the poker tables of the local saloons, learning the game that was to be a passion of his life. He had wanted to become a criminal lawyer, but instead landed at 23 as a $900-a-year code clerk in the State Department.

It was a case of purest serendipity, for the man and the subject were ideally matched. His romantic mind thrilled to the stream of history that daily poured through his hands in the form of ambassadorial dispatches, and cryptology fired his imagination. He had heard vague tales of cryptanalysts who could pry into secrets of state, and when a 500-word message from Colonel House passed over the wires to President Wilson one night, Yardley, with characteristic audacity, determined to see whether he could solve what must be the most difficult of American codes. He astonished himself by solving it in a few hours.{1} His success cemented his attachment to cryptanalysis, and he followed this demonstration of the low estate of high-level cryptography with a 100-page memorandum on the solution of American diplomatic codes. While absorbed in possible solutions for a proposed new coding method, he diagnosed what has ever since been known among cryptologists as the “Yardley symptom”: “It was the first thing I thought of when I awakened, the last when I fell asleep.”

Soon after the American declaration of war in April of 1917, he sold the idea of a cryptologic service to the War Department. He succeeded partly because the need was genuine, partly because he himself was an exceedingly convincing young man. Yardley had proven his cryptanalytic ability, and moreover had done well enough in his regular duties to have won raises to $1,400 in 43 months. Major Ralph H. Van Deman, later to be known as the Father of American Intelligence, commissioned the thin, balding 27-year-old as a lieutenant and set him up as the head of the newly created cryptologic section of the Military Intelligence Division, MI-8.

Like Topsy, MI-8 just grew. First to arrive, to take charge of the instruction subsection for training A.E.F. cryptanalysts, was Dr. John M. Manly, a 52-year-old philologist who headed the Department of English at the University of Chicago and was later president of the Modern Language Association; a longtime hobbyist in cryptology, he was to become Yardley’s chief assistant and one of his best cryptanalysts. Manly brought with him a bevy of Ph.D.’s clanking with Phi Beta Kappa keys, mostly from the University of Chicago: David H. Stevens, 32, an instructor in English, later director of the division for the humanities of the Rockefeller Foundation; Thomas A. Knott, 37, associate professor of English and later general editor of Webster’s Dictionaries, including the colossal 1934 Second New International Unabridged; Charles H. Beeson, 47, associate professor of Latin, later president of the Mediaeval Academy of America, who had gotten his doctorate at Munich and knew German well enough to write scholarly works in it; and Frederick Bliss Luquiens, 41, professor of Spanish at Yale University, general editor of the Macmillan Spanish Series, and author of An Introduction to Old French Phonology and Morphology.

The instruction subsection did its teaching at the Army War College. It advanced far enough to offer as Problem 20 “General Principles of attack on enciphered code when the book is known but the system of encipherment unknown.” Another subsection popped into being for code and cipher compilation; it produced a military intelligence code, two geographical codes for combat information from France, and a casualty code, which was never used. Soon a communications subsection was handling close to 50,000 words a week. As the organization expanded, it shifted to ever-larger quarters. Beginning in the balcony overhanging the library of the War College, MI-8 moved to the Colonial, an apartment house at 15th and M Streets barely ready for occupancy, and then to a building on the site of what is now the Capitol Theatre on F Street, all in Washington. For security, its offices were always on the top floor.

Growth continued apace. An intercepted letter in a German shorthand instigated a shorthand subsection that soon could read missives in more than 30 systems, most commonly Gabelsberger, Schrey, Stolze-Schrey, Marti, Brockaway, Duploye, Sloan-Duployan, and Orillana. A blank piece of paper discovered in the shoe heel of a woman suspected of working with German espionage in Mexico turned out to bear a message in invisible ink. Fortunately, it proved one of the simpler kinds, which can be developed by heat. But it sparked the establishment of a secret-ink subsection whose expert chemists could detect writing in an invisible ink disguised as a perfume with an actual odor and with only one part in 10,000 of solid matter.

The Germans later replaced inks in so bulky and conspicuous a form as liquids with chemicals that were impregnated into scarves, socks, and other garments. They had only to be dipped in water to create the writing fluid. These miracles of the test tube, called F and P inks by the British chemists who taught the Americans much of what they knew, were so precisely formulated that they would react with only one other chemical to form a visible compound.

Eventually, the Allied chemists discovered a reagent that brought out secret writing in any kind of ink, even clear water. Crystals of iodine, heated gently, sublimated into fumes of a beautiful violet hue that settled more densely in those fibers of paper that had been disturbed by any kind of wetting action, thus tracing the pen’s course. The Germans replied by writing in a sympathetic ink and then moistening the entire sheet. The Allies struck back with a chemical streak test that would show whether the paper surface had been dampened. This was almost as incriminating as actual development of a secret-ink letter, for who but a spy would wet a letter? The seesaw battle between the chemists of Germany, traditionally world leaders in that science, and those of the Allies reached a stalemate when both sides discovered the general reagent—one that would develop any secret ink at any time, even on moistened paper. Formulas differ slightly, but all use a mixture of iodine, potassium iodide, glycerine, and water, dabbed on with cotton. The liquid concentrates in the more disturbed fibers and reveals the writing. By the time this general reagent appeared, MI-8’s secret-ink subsection was testing 2,000 letters a week for invisible writing and had discovered 50 of major importance. Among them were letters that led to the capture of Maria de Victorica, a beautiful German spy who was planning to import high explosives for sabotage inside the hollow figures of saints and the Virgin Mary!

MI-8 also solved cryptograms. It read diplomatic telegrams of Argentina, Brazil, Chile, Costa Rica, Cuba, Germany, Mexico, Spain, and Panama. The Spanish-language texts constituted the bulk of its cryptanalytic work. The censorship office sent over intercepted cipher letters; most of these turned out to be merely personal notes in very simple systems, though some of the love letters were so torrid that Yardley said, “It rather worried me to see husbands and wives trust their illicit correspondence to such unsafe methods.”

Perhaps the most important of the MI-8 solutions was the one that largely resulted in the conviction of the only German spy condemned to death in the United States during World War I. This was Lothar Witzke, alias Pablo Waberski, who was suspected of setting off the Black Tom explosion. He was captured in January, 1918, by an American agent, who found in his baggage in the Central Hotel in Nogales, Mexico, a cipher letter dated January 15. It did not reach MI-8 until spring, and then it kicked about for a few more months while several men there tried and failed to solve it. Finally Manly took it up.

This quiet scholar, who never married and whose quiet, simple manner contrasted so sharply with his chief’s, was to become one of the world’s leading authorities on Chaucer. He and his collaborator, Edith Rickert, labored for 14 years to produce their monumental eight-volume work, The Text of the Canterbury Tales, in which, by a tedious collation of scribal errors and variant readings in more than 80 manuscripts of the medieval masterpiece, they reconstructed a text that is as close to the poet’s own original as the extant evidence allows. The cast of mind that can thus sort out, retain, and then organize innumerable details into a cohesive whole was just what was needed for the Gothic complexity of the 424-letter Witzke cryptogram. In a three-day marathon of cryptanalysis, Manly, aided by Miss Rickert, perceived the pattern of this 12-step official transposition cipher, with its multiple horizontal shiftings of three- and four-letter plaintext groups ripped apart by a final vertical transcription. He drew forth a message from Heinrich von Eckardt, the luckless German minister in Mexico whose very involvement with a cryptogram seemed to mean its cryptanalysis,{1} to the German consular authorities:

“The bearer of this is a subject of the Empire who travels as a Russian under the name of Pablo Waberski. He is a German secret agent. Please furnish him on request protection and assistance; also advance him on demand up to 1,000 pesos of Mexican gold and send his code telegrams to this embassy as official consular dispatches.” When Manly read this to a military commission of colonels and generals who were trying Witzke on spy charges in a hushed courtroom at Fort Sam Houston, San Antonio, the effect was condemnatory. The handsome young spy was sentenced to death. Wilson later commuted it to life imprisonment, however, and Witzke was released in 1923.

In August of 1918, Yardley sailed for Europe to learn as much as he could from America’s allies. He obtained entrance to M.I. 1(b) after demonstrating his abilities to Brooke-Hunt and there studied British methods for the solution of different codes and ciphers. The doors of Room 40 remained resolutely locked against him as against everyone else, though Hall did give him a German naval code and a neutral nation’s diplomatic codes. In Paris that fall, Yardley met Painvin, who gave him a desk in his office and invited him to his home many evenings. But he never gained access to the French Foreign Ministry cryptanalytic bureau.

He remained in Paris after the Armistice to head the cryptologic bureau of the American delegation to the Peace Conference. At first there was a tremendous rush to get organized, but then the pressure eased, and Yardley, Childs, who was assigned to assist him, and Lieutenant Frederick Livesey, who had been sent over from MI-8, enjoyed the life of playboy cryptologists. A practical soul, Yardley saw no need for the three officers assigned to the bureau to be present at once, and so a rotation of duties was arranged that permitted them to spend most of their time at the international cocktail parties and dancings that were then the rage of Paris.

When it ended, as it had to, Yardley, viewing with distaste a return to the State Department code room, and burning with evangelical fervor over America’s need for cryptanalysis, exercised his potent salesmanship on the State and War departments. He won the concurrence of Frank L. Polk, the acting Secretary of State; then, on May 16, 1919, he submitted to the Chief of Staff a plan for a “permanent organization for code and cipher investigation and attack.” Three days later the Chief of Staff approved it, and Polk brown-penciled an “O.K.” and his initials on it. The plan envisioned joint financial support by the two departments at about $100,000 a year, but actual expenditures never reached that sum. The State Department’s contribution of $40,000, which began on July 15, 1919, could not be legally expended within the District of Columbia, and so Yardley soon found himself moving the nucleus of a staff (largely recruited from MI-8) and the necessary paraphernalia—language statistics, maps, newspaper clippings, dictionaries—to New York City.

By October 1 the organization that was to become known as the American Black Chamber was ensconced in the former town house of T. Suffern Tailer, a New York society man and political leader, at 3 East 38th Street. It stayed there little more than a year, however, before moving to new quarters in a four-story brownstone at 141 East 37th Street, just east of Lexington Avenue. It occupied half of the ornate, divided structure, whose high ceilings did little to relieve the claustrophobic construction of its twelve-foot-wide rooms. Yardley’s apartment was on the top floor. All external connection with the government was cut. Rent, heat, office supplies, light, Yardley’s salary of $7,500 a year, and the salaries of his staff were paid from secret funds. Though the office was a branch of the Military Intelligence Division, War Department payments did not begin until June 30, 1921.

Among the twenty people who started with Yardley or joined him soon thereafter were Dr. Charles J. Mendelsohn from MI-8, a philologist who taught history at City College mornings and worked in the Black Chamber afternoons; Victor Weiskopf, also from MI-8, a former agent of and cryptanalyst for the Justice Department, which allowed him to join Yardley’s organization in New York but paid him $200 a month to solve ciphers for it on the side; Livesey, who had been with Yardley in Paris, a Harvard graduate and businessman who later became a State Department economic advisor; Ruth Willson and Edna Ramsaier (who was to become Yardley’s second wife), both specialists in Japanese ciphers; and John Meeth, Yardley’s chief clerk. Livesey, who became Yardley’s prime assistant, was paid $3,000, or about $60 a week.

One of the organization’s first assignments was to solve the codes of Japan, with whom friction had been growing. Yardley, in an access of enthusiasm, promised the solution or his resignation within the year. He regretted his impetuousness as soon as he plunged into the task, for he almost foundered in the Oriental intricacies of Japanese plaintext, to say nothing of codetext. After some preliminary study, assisted by Livesey, who had a great aptitude for languages, he ascertained that the Japanese employed a watered-down form of their ideographic writing called “kata kana” for telegraphic and—presumably—cryptologic communication, which was transmitted in Latin letters. Kata kana consists of about 73 syllables, each with a sign of its own which had been given a roman equivalent, and when Yardley had his typists compile frequency tables for the twenty-five plain-language kata kana telegrams he had, he discovered that this script obeyed rules of frequency just like any other. Specifically, the kana n, the only nonsyllabic kana, was most common, appearing often at the end of words, followed by i, no, o, ni, shi, wa, ru, and to, in that order. The list of most common syllables and words began with ari and continued with aritashi, daijin, denpoo, gai, gyoo, and so on. At the end of about four months, the typists had prepared elaborate statistics of frequency and contact for about 10,000 kana.

He then set them to work dividing the ten-letter groups of the Japanese code telegrams into pairs of letters and drawing up similar frequency and contact data for these pairs. He himself went through the approximately 100 code telegrams underlining with colored pencils all repetitions of four letters or more. But despite the most intensive scrutiny and study, no solution was forthcoming. Livesey’s linguistic abilities had meanwhile brought him a fair acquaintance with Japanese. He found in a bilingual dictionary that he had bought for 75 cents that the word owari meant “conclusion.” Could it be the plaintext of certain codegroups found frequently at the end of telegrams? The hypothesis, involving only three kana, proved barren. He examined the plain-language telegrams and pointed out probable words with conspicuous patterns to Yardley. Two of these, which played a vital role in the solution, were “Airurando dokuritsu” (“Ireland independence”), with the repeated do, and “Doitsu” (“Germany”), which used three of the same kana in a different order. This was a good clue, but it alone was not the answer. Night after night Yardley would climb the stairs to his apartment, weary, hopeless, discouraged, and fall into bed, only to wake up excitedly a few hours later with a brilliant idea—which invariably turned out to be just another blind alley.

By now [he wrote] I had worked so long with these code telegrams that every telegram, every line, even every code word was indelibly printed in my brain. I could lie awake in bed and in the darkness make my investigations—trial and error, trial and error, over and over again.

Finally one night I awakened at midnight, for I had retired early, and out of the darkness came the conviction that a certain series of two-letter codewords absolutely must equal Airurando (Ireland). Then other words danced before me in rapid succession: dokuritsu (independence), Doitsu (Germany), owari (stop). At last the great discovery! My heart stood still, and I dared not move. Was I dreaming? Was I awake? Was I losing my mind? A solution? At last—and after all these months!

I slipped out of bed and in my eagerness, for I knew I was awake now, I almost fell down the stairs. With trembling fingers I spun the dial and opened the safe. I grabbed my file of papers and rapidly began to make notes.

These promptly proved his intuitions correct. The repetitions of RE for do, BO for tsu, OK for ri, and UB for i in his equivalences confirmed it:

For an hour Yardley filled in these and other identifications and then, convinced that the opening wedge had been driven, went upstairs, awoke his wife, and went out to get drunk. Actually, considerably more work had to be done before the Black Chamber could read anything approaching sentences. Much of this was done by Livesey, who achieved an important secondary breakthrough when he identified the Japanese plaintext jooin (“Senate”) and jooyakuan (“draft treaty”).

Yardley encountered unexpected difficulties in finding a translator for the exotic language, but finally located a kindly, bewhiskered missionary. He looked jokingly incongruous in the Black Chamber, but he enabled Yardley to send the first translations of Japanese telegrams to Washington in February of 1920. He quit after six months when he finally realized the espionage nature of the work, but by then Livesey had accomplished the almost unheard-of feat of learning Japanese in that time.

Yardley called the first code “Ja,” the “J” for Japanese, the “a” a serial for the first solution. From 1919 to the spring of 1920 the Japanese introduced eleven different codes, having employed a Polish expert, Captain Kowalefsky, to revise their cryptologic systems. Kowalefsky taught the Japanese how to bi-, tri-, and tetrasect their messages: to divide them into two, three, or four parts, shuffle the parts, and then encipher them in transposed order to bury stereotyped beginnings and endings. Some of the codes contained 25,000 code groups.

During the summer of 1921, the Black Chamber solved telegram 813 of July 5 from the Japanese ambassador in London to Tokyo. It contained the first hints of a conference for naval disarmament—an idea that powerfully gripped the imagination of a war-weary world. Another indication came when Japan suddenly introduced a new code, the YU, for their most secret messages. On solution, it was dubbed “Jp”—the sixteenth solved since Yardley’s original break.

A few months before the November opening of the disarmament conference in Washington, daily courier service was set up between the Black Chamber and the State Department. An official grinningly remarked that State’s upper echelons were delighted with the cryptanalysts’ work and read the solutions every morning with their orange juice and coffee. The conference sought to limit the tonnage of capital ships, and as negotiations were proceeding toward its chief result—the Five-Power Treaty that accorded tonnages in certain ratios to the United States, Britain, France, Italy, and Japan—Yardley’s team was reading the secret instructions of the negotiators. “The Black Chamber, bolted, hidden, guarded, sees all, hears all,” he wrote later, rather melodramatically. “Though the blinds are drawn and the windows heavily curtained, its far-seeking eyes penetrate the secret conference chambers at Washington, Tokyo, London, Paris, Geneva, Rome. Its sensitive ears catch the faintest whisperings in the foreign capitals of the world.”

Each nation naturally tried to obtain the most favorable tonnage ratio for itself; the most aggressive in its efforts was Japan, which even then was dreaming expansionist dreams in Asia but feared to offend the United States. At the height of the conference, when Japan was demanding a ratio of 10 to 7 with the United States and Great Britain, the Black Chamber read what Yardley later called the most important telegram it ever solved.

“It is necessary to avoid any clash with Great Britain and America, particularly America, in regard to the armament limitation question,” the Japanese Foreign Office cabled its ambassador in Washington on November 28. “You will to the utmost maintain a middle attitude and redouble your efforts to carry out our policy. In case of inevitable necessity you will work to establish your second proposal of 10 to 6.5. If, in spite of your utmost efforts, it becomes necessary in view of the situation and in the interests of general policy to fall back on your proposal No. 3, you will endeavor to limit the power of concentration and maneuver of the Pacific by a guarantee to reduce or at least to maintain the status quo of Pacific defenses and to make an adequate reservation which will make clear that [this is] our intention in agreeing to a 10 to 6 ratio. No. 4 is to be avoided as far as possible.”

Each 0.5 in the ratio meant 50,000 tons of capital ships, or about a battleship and a half. With the information in this message telling the American negotiators that Japan would yield if pressed, all they had to do was press. This Secretary of State Charles Evans Hughes did, and on December 10 Japan capitulated, instructing its negotiator, in a cable read by the Black Chamber, that “there is nothing to do but accept the ratio proposed by the United States.” As signed, the Five-Power Treaty allotted capital ships to the United States, Great Britain, Japan, France, and Italy in the ratio of 10:10:6:3.3:3.3. It was considerably less than Japan had hoped for. Hughes sent Yardley a letter of commendation.

During the conference, the Black Chamber had turned out more than 5,000 solutions and translations. Yardley nearly suffered a nervous breakdown, and in February went to Arizona for four months to recover his health. Several of his assistants had already had trouble in this regard. One babbled incoherently; a girl dreamed of chasing around the bedroom a bulldog that, when caught, had “code” written on its side; another could lighten the enormous sack of pebbles that she carried in a recurring nightmare only by finding a stone along a lonely beach that exactly matched one of her pebbles, which she could then cast into the sea. All three resigned.

Security was a constant preoccupation. Mail was sent to a cover address; Yardley’s name was not permitted in the telephone book; locks were often changed. Nevertheless, some foreign government must have discovered the organization’s activities, for there was at least one attempt to subvert Yardley and, when this failed, the office was broken into and the desks rifled. After this the Black Chamber moved to a large office building at 52 Vanderbilt Avenue, where, by 1925, it had set up the Code Compiling Company as a rather unsubtle cover. The firm, with Yardley as president and Mendelsohn as secretary-treasurer, actually compiled the Universal Trade Code, which they sold, together with other commercial codes. Behind this front office, in a locked room, worked the cryptanalysts. Though each piece of paper was scrupulously locked away each night so that nothing was left on the desks, the cryptanalysts were allowed, in those more informal days, to take home problems on which they were working.

Yardley’s appropriation had been severely cut in 1924, and half the staff had to be let go, reducing the force to about a dozen. Despite this, Yardley said, the Black Chamber managed to solve, from 1917 to 1929, more than 45,000 telegrams, involving the codes of Argentina, Brazil, Chile, China, Costa Rica, Cuba, England, France, Germany, Japan, Liberia, Mexico, Nicaragua, Panama, Peru, San Salvador, Santo Domingo (later the Dominican Republic), the Soviet Union, and Spain, and made preliminary analyses of many other codes, including those of the Vatican.

Suddenly it all ended. Yardley, who had been obtaining the code telegrams of foreign governments through the cooperation of the presidents of the Western Union Telegraph Company and the Postal Telegraph Company, was encountering increasing resistance from them. Herbert Hoover had just been inaugurated, and Yardley resolved to settle the matter with the new administration once and for all. He decided on the bold stroke of drawing up “a memorandum to be presented directly to the President, outlining the history and activities of the Black Chamber, and the necessary steps that must be taken if the Government had hoped to take full advantage of the skill of its cryptographers.” He waited to see which way the wind was blowing before making his move—and found that it was not with him. Yardley went to a speakeasy to listen to Hoover’s first speech as President and sensed, in the high ethical strictures that Hoover expressed, the doom of the Black Chamber.

He was right, though its actual closing came from elsewhere. After Henry L. Stimson, Hoover’s Secretary of State, had been in office the few months that Yardley thought would be necessary for him to have lost some of his innocence in wrestling with the hardheaded realities of diplomacy, the Black Chamber sent him the solution of an important series of messages. But Stimson was different from previous Secretaries of State, on whom this tactic had always worked. He was shocked to learn of the existence of the Black Chamber, and totally disapproved of it. He regarded it as a low, snooping activity, a sneaking, spying, keyhole-peering kind of dirty business, a violation of the principle of mutual trust upon which he conducted both his personal affairs and his foreign policy. All of this it is, and Stimson rejected the view that such means justified even patriotic ends. He held to the conviction that his country should do what is right, and, as he said later, “Gentlemen do not read each other’s mail.” In an act of pure moral courage, Stimson, affirming principle over expediency, withdrew all State Department funds from the support of the Black Chamber.{1} Since these constituted its major income, their loss shuttered the office. Hoover’s speech had warned Yardley that an appeal would be fruitless. There was nothing to do but close up shop. An unexpended $6,666.66 and the organization’s files reverted to the Signal Corps, where William Friedman had charge of cryptology. The staff quickly dispersed (none went to the Army), and when the books were closed on October 31, 1929, the American Black Chamber had perished. It had cost the State Department $230,404 and the War Department $98,808.49—just under a third of a million dollars for a decade of cryptanalyis.

Yardley, whose job experience had been rather specialized, could not find work, and he went back home to Worthington. The Depression sucked him dry. By August of 1930, he had had to give up an apartment house and a one-eighth interest in a real estate corporation; indeed, he complained that he had to sell nearly everything he owned “for less than nothing.” A few months later he was toying with the idea of writing the story of the Black Chamber to make some money to feed his wife and their son, Jack. When his old MI-8 friend, Manly, with whom he had been in contact all during the 1920s, had to turn down his request for a $2,500 loan at the end of January, 1931, Yardley, in desperation, sat down to write what was to be the most famous book on cryptology ever published. He described the composition of it in a letter to Manly in the spring of 1931:

I hadn’t done any real work for so long that I told Bye, my agent, and the Sat Eve Post that I would need some one else to write the stuff. I showed a few things to Bye and Costain, the latter editor of POST, and both told me to go to work myself. I sat for days before a typewriter, helpless. Oh, I pecked away a bit, and gradually under the encouragement of Bye I got a bit of confidence. Then Bobbs Merrill advanced me $1000 on outline. Then there was a call to rush the book. I began to work in shifts, working a few hours, sleeping a few hours, going out of my room only to buy some eggs, bread, coffee and cans of tomatoe juice. Jesus, the stuff I turned out. Sometimes only a thousand words, but often as many as 10,000 a day. As the chapters appeared I took them to Bye who read them and offered criticism. Anyway I completed the book and boiled down parts of it for the articles all in 7 weeks.

The Bobbs-Merrill Company, of Indianapolis, published the 375-page book on June 1, but parts of it had already appeared in three articles at two-week intervals in The Saturday Evening Post, the leading magazine of the day, which thought so highly of them that it used the first of the series to lead its April 4 issue. Yardley was a superb storyteller, and his narrative skill did not desert him on paper. Largely owing to this and to his vigorous and pungent style, the book itself, The American Black Chamber, was an immediate success, and it instantly fixed itself in popular lore as the epitome of books on cryptology. Even today, it is invariably mentioned in any cocktail-party discussion of the subject, and copies remain in demand among secondhand-book dealers. Reviews of it were unanimously good. Critic W. A. Roberts, in a commendatory review, summed up the prevailing opinion: “I think it the most sensational contribution to the secret history of the war, as well as the immediate post-war period, which has yet been written by an American. Its deliberate indiscretions exceed any to be found in the recent memoirs of European secret agents.” Reporters hastened to governmental bureaus to inquire whether it was all true. The State Department, with masterfully diplomatic double-talk, was “disposed to discredit” Yardley’s statements. At the War Department, officials lied straightforwardly and said that no such organization had been in existence in the past four years.

But beneath this bland surface American cryptologists seethed. Friedman was incensed at what he regarded as an unwarranted slur on the A.E.F. cryptologic effort. Yardley had learned from a report by Moorman about Childs’s test-stripping of the superencipherment from the proposed but never used A.E.F. Trench Code and about the telephone monitoring of the messages that allowed the G.2 A.6 monitor to deduce the American attack on the St. Mihiel salient. He inadvertently combined them into a highly dramatic tale in which the Germans knew from cryptanalysis about the American effort to flatten the salient, which consequently “represents only a small part of what might have been a tremendous story in the annals of warfare, had the Germans not been forewarned. The stubborn trust placed in inadequate code and cipher systems had taken its toll at the Front.” Yardley was not entirely to blame, for Moorman’s report is extremely confusing and does not clearly separate the two episodes, but he ignored the frequent replacement of codebooks, unwarrantedly assumed that the Germans cryptanalyzed the messages, and in general did not check out his facts.

Friedman circularized his A.E.F. colleagues to ask their views. Moorman replied, “I started to read the

David Kahn

The Codebreakers The Comprehensive History of Secret Communication from Ancient Times to the Internet

[Front Matter]

[Title Page]

[Copyright]

Dedication

Preface To The Revised Edition