You’re settled down in front of the TV to watch the news after a long day of being retired,
when you see a headline you never expected.
Crypto AG, the company that employed you for the majority of your career, has been outed
for conspiring with the CIA.
More precisely, they were owned by the CIA for almost their entire history.
Your first reaction is denial.
What do these reporters know that you don’t?
You worked there for more than twenty years – they’ve probably been researching the
topic for about twenty minutes.
And we all know the media don’t always get it right.
The amount of fake news out there these days is absurd…
You’re barely even paying attention to what this lousy presenter is saying; your brain
is just telling you that they must be mistaken.
How could you have helped to create products designed not for security, but for spying
– and not even have realized it?
It’s ridiculous.
Your wife even has the audacity to look at you expectantly, as if you have been in on
this all along.
You mutter to her that it’s probably just another rumor, like the one that went around
a few years ago.
You didn’t believe it then; why should you believe it now?
So, you switch off the news; it’s giving you a headache, and you can’t stand the
voice of that smug reporter who thinks he knows everything.
But as you slump back on the couch in disbelief, a niggling thought enters your mind: what
if the rumors are true?
A few hours later, the phone rings.
It’s one of the few ex-workmates you’re still in contact with, and he’s asking if
you’ve heard the news.
You say you have, but you’re not sure where the allegations have come from or whether
they’re true.
There’s dead silence.
“It’s all true, David,” he says slowly.
It turns out that he’s been in contact with more people in the company, including a couple
of guys much higher up, and managed to figure out what’s going on.
But Crypto AG was always such a respected company, known for selling some of the best
cryptography products in the world.
You loved working for them.
What’s going on?
Your friend takes a deep breath and begins to explain…
Crypto AG may have been a Swiss company, but its background didn’t exactly match the
customers’ expectations of political neutrality and secrecy.
The founder, Boris Hagelin, was a previous employee of the Central Intelligence Agency,
or CIA, and the National Security Agency, or NSA.
Hagelin was also in close contact with William Friedman, an esteemed cryptology expert living
in the US.
Shortly after he founded Crypto AG in the 1940s, the two men made an agreement one day
in a gentlemen’s club: the company would only sell equipment to countries approved
by the US.
Basically, this meant Crypto AG were going to work with the US intelligence agencies
unofficially.
Things started to get dodgy quickly.
At this point, cryptography technology was moving from mechanical to electronic, which
should have made decrypting codes harder – different methods would have to be used.
Having a cryptography company on your side was a smart move from the CIA.
So, to begin with, Crypto AG made two versions of their products – the rigged one, and
the standard.
Guess who got which?
As if colluding with the CIA unofficially wasn’t enough, Boris eventually took things
to the next level.
In the 70s, he was coming close to retirement, and wanted to sell his company.
No prizes for figuring out who wanted to buy the stakes..
Yep, it was the CIA.
Along with the BND, the intelligence agency of Western Germany.
You know, the non-Communist one.
Of course, it didn’t exactly go down on company records that a cryptography company
was owned by intelligence agencies of two Western nations.
Instead, it was bought by a front company from an unassuming nation everyone forgets
about, Liechtenstein.
However, the Liechtenstein company was owned by the CIA and BND.
Also in on the program were the NSA, or National Security Agency, who lead cryptography in
the US government.
It’s a pretty damning revelation.
You’ve got a company from Switzerland – the perfect beacon of neutrality, secrecy, and
trustworthiness, to the point where over one hundred countries buy their encryption equipment
from the country.
So, they’re trusted by companies and militaries all over the world.
Yet they’re literally owned by two intelligence agencies, who could potentially read everything
that was communicated using the cryptography equipment.
Wow.
It’s a lot to take in.
So many questions swimming through your mind – and you’re still not sure if this all
makes sense.
Who were we supposedly spying on?
How did the whole thing work?
What did Crypto AG gain from working with the CIA?
Why did nobody find out?
Now your wife is looking at you real suspicious – as if she thinks you’re on the phone
with the CIA right now, or maybe the police.
Looking down, you realize your hand is shaking, so maybe you shouldn’t be surprised at her
reaction.
But anyway, it’s time to get to the bottom of this.
You need to know what really happened.
None of this will ever make sense before you know that.
Your friend explains that the whole thing was called Project Rubicon….
Crypto AG became officially owned by the CIA and BND during the Cold War, when fear was
at an all-time high and all countries were nervous about what other countries were doing.
Are they building an atom bomb?
Are they planning to wipe our nation out?
Who are the double agents?
Spying was high on the priorities list.
Normally, spying would involve the recruitment and training of numerous agents on the ground,
who then needed to be promoted to the highest offices.
Even after all that, the spies could be found out or taken down at any moment, and everything
would fall apart.
But by simply reading the messages between top officials of other countries, the intelligence
agencies could take minimal risk for maximum reward.
It was the perfect bulletproof plan.
Meanwhile, Crypto AG was being paid handsomely by two sides.
The geopolitical events also meant many governments needed to buy cryptography products, and they’d
pay Crypto AG good money to have what they believed were top-of-the-range products.
It might have been ethically questionable, but it was pretty smart.
You interrupt your friend right there.
You don’t care about the context and all this wishy-washy stuff.
After all, you lived through most of them.
You just want to know what on earth Crypto AG did to these machines to rig them.
Your friend clears his throat.
At first, countries were worried that there was a back door, meaning the machines had
been intentionally weakened.
Some rumors had been going around about this for a while, like me and you both know.
Actually, that wasn’t quite the case.
But the CEO was passing the full tech spec of the machines straight on to the NSA, which
was just as bad, if not worse.
All the “codes” could be cracked extremely easily.
Imagine what a satisfying job that would be.
All the glory of uncovering a top-secret code, without any of the hassle or hard work.
Even a second-rate cryptographer would feel like a genius.
Plus, there may have been some weakening of equipment too.
There’s evidence that there were different tiers of customers too – some customers
likely had machines with higher-strength encryption.
Double sneaky.
And it worked.
About 40% of intel interceptions the US carried out were due to Project Rubicon, and a whopping
90% of the interceptions by West German intelligence.
It’s hardly surprising – why even go to the bother of going through some high-tech
or high-risk way to gather information when you can just sit back and have it all spoon-fed
to you?
Well, your friend sure sounds like he thinks he knows what he’s talking about.
But where is all this supposed evidence coming from, anyway?
The documents have been released, he explains.
Remember William Friedman, the cryptography expert who made a deal with the owner of Crypto
AG?
We’ve found in print the details of their agreement in the early days, and the cooperation
with the CIA, BND, and NSA.
The proof of the ownership is there too, and the different tiers of customers.
There’s no longer any room for doubt.
So maybe he’s right.
Maybe you really were involved in a huge spying coup.
How many countries did the company dupe?
Well, you’d expect the Soviet Union to be the biggest target of the US, but they never
actually purchased any of Crypto AG’s products.
Neither did China.
But plenty of other countries did – the pull of buying from a neutral, non-Nato country
was pretty attractive to them.
62 other countries bought products from Crypto AG, to be precise.
I won’t bore you by naming all of them, but amongst the suckers are reportedly Iran,
Egypt, Yugoslavia, and Libya.
It’s crazy, isn’t it?
All those people, unaware their most private messages were being read by multiple other
countries.
Wait – multiple other countries?
But wasn’t it just Western Germany and the US doing this?
Nope, as if spying in such a shameless, sneaky way wasn’t enough, they also shared the
information with other nations.
The cheek of it!
A group known as the Five Eyes intelligence-sharing agreement also included the UK, Canada, Australia,
and New Zealand.
Jeez.
With that scale of operations, it just seems incredible nobody found out.
For six countries to be spying on the information of 62 other countries…it just seems impossible
that it’s only just being revealed now.
Well, they almost did find out.
Numerous times.
One engineer working for the firm in the 1970s figured that the equipment he’d provided
to Syria was, ahem, faulty.
So, he flew to Damascus to fix it.
And how did he respond to this honest, capable gentleman?
The CIA complained they were no longer able to decipher the messages and he was fired.
Similarly, a Crypto AG salesman in Iran was arrested by his government for installing
back doors into encryption machines.
Although the man was eventually freed after proclaiming to be innocent, Crypto AG proceeded
to fire him, which led to the man asking more questions about what Crypto AG was doing.
Maybe they were up to something after all?
In the 80s, some countries had become suspicious, too.
Argentina said they’d been hacked during the Falklands War, and other nations had similar
ideas.
To combat this, Crypto AG hired a renowned and respected Swedish academic to personally
reassure any client who was suspicious, telling them that the machines were unbreakable.
And it worked like a charm – why wouldn’t you trust a famous Swedish academic representing
a Swiss firm?
Surely the CIA couldn’t be playing a role in that?
This plan kind of worked, but the rumors continued to snowball.
Even Ronald Reagan had his suspicions, commenting in a speech that he suspected CryptoAG were
involved in a Berlin bombing interception.
So, don’t feel too bad that you didn’t know what was going on – even the President
of the USA didn’t know.
But the big reveal happened back in 1995 when the first documents were uncovered.
Proof emerged that the NSA and Crypto AG had discussed the design of the machines in meetings
together, but we didn’t know much more.
Crypto AG claimed it was all a rouse set up by bitter former employees, saying their equipment
was never tampered with.
Even though nothing had been proven, the majority of countries stopped buying from Crypto AG
at this point.
But, bizarrely, Iran continued their loyalty.
In 2001, further suspicious news broke.
The buzzwords that trigger the spying program of the US, Echelon were leaked to the public.
One of them turned out to be ‘Crypto AG,’ up there along with ‘Kill the President’
and ‘nuclear.’
Not a good look…
Wow.
You ignored the rumors before, but now the evidence is laid out in front of you, it’s
hard to deny.
You wonder how many scandals you’ve obliviously, unintentionally, been involved in.
This is the problem.
It’s all very well spying on the enemies, but the uncomfortable truth is that the CIA
probably ended up knowing about all kinds of crimes against humanity and human rights
abuses, but couldn’t say or do anything because of the questions it would raise.
Assassinations, genocides, torture…
Or maybe they just didn’t care or bother to read about those things, and stuck to things
containing phrases like ‘kill the president’.
We now know we were spying on Egypt during the Camp David Accords, a peace treaty between
Israel and Egypt that took place in the US.
We also intercepted the communication of Libyan officials celebrating after a terrorism incident
in a Berlin nightclub, and during the 1979 hostage crisis in Iran.
What else did we know about?
All this came as a shock to those who inherited the company.
In the 90s, the Germans became fearful the truth would be exposed, so the Americans bought
them out, but the company didn’t disband until 2018.
Slightly confusingly, Crypto AG and their logotype were then acquired by the Crypto
International Group, a Swedish company.
So, imagine how they felt when just two years later they found out what Crypto AG had been
up to behind closed doors.
It’s not a great look, is it?
Or maybe they secretly knew all along and were continuing the legacy…
So, the moral of the story is that you can’t trust anyone with your secrets, not even a
cryptography company.
Good luck trying to keep your personal data safe.
For more secrets about the CIA, check out our video about how the CIA stole a Soviet
submarine, and whether you can crack the CIA’s impossible secret code.
Clue: it’s harder to crack than anything made by Crypto AG.