by DAVID KAHN
The French hauled them in. At first the only intercept stations were in the great fortresses of Maubeuge, Verdun, Toul, Épinal, and Belfort and at three special posts at Lille, Rheims, and Bésançon. Later in the war France had an elaborate network, with the country divided into three zones centered on Paris, Lyons, and Bordeaux. The capital itself had one intercept station in the Eiffel Tower and another in a Métro station (Trocadéro). A line of six direction-finding stations extended behind the entire front. All these stations were connected by direct wire to the War Ministry at 14 Rue Saint-Dominique in Paris, where Colonel Cartier’s office stood next to the telegraph central. The French thus received German radiograms as quickly as the legitimate recipients. During the course of the war, Cartier estimated, they intercepted more than 100,000,000 words, or enough to make a library of a thousand average-sized novels.
At the start, however, the organization was so crude that the French even lacked direction-finders. They had to work instead on an assumption that all German stations emitted at the same strength and that the loudness of the intercepted signal roughly indicated the distance of the transmitter. Operators thus noted whether they heard German signals very loudly, loudly, medium loudly, weakly, or very weakly. By making quantities of such readings and drawing circles on the map with a radius equal to the estimated distance, the French less than two weeks after the outbreak of the war had diagrammed the probable locations of the German stations—a grouping that later proved in large measure correct.
The French also recorded call-signs, volume of traffic, and correspondents for all stations. These soon segregated themselves into four main networks, each of which, the French assumed, belonged to a combat group. The patterns of correspondence defined the headquarters stations, and volume soon differentiated the fast-moving and fast-sending cavalry stations from the infantry. Occasional cleartext signatures disclosed the commanders’ names. In this way, the French gradually built up a picture of the German forces facing them.
This was the first radio traffic analysis. It attained a high refinement later in the war. Traffic analysis aided in delineating the enemy order of battle, and frequently forewarned of important enemy activities by detecting an increase in message volume. It also made a preliminary sorting of messages for cryptanalysis. Different enemy armies may use different codes with the same codewords or different keys for a single cipher system, and only the pinpointing of the transmitter by direction-finding and call-sign will enable the cryptanalyst to separate messages in one cryptographic “language” from those in another. It is the modern version of looking at the seal and the signature of an intercepted letter so that cryptograms from Venice will not be mixed with those from Parma. The careful filing of every detail surrounding an intercepted radiogram—its sender, receiver, time, preamble, length—often yielded supplementary benefits.
Early in the war, for example, the French intercepted a German cleartext radiogram, “Was ist Circourt?” The elaborate cross-references permitted an easy identification of the cryptogram that gave rise to the query. Meanwhile, the geographic service furnished the information that the name “Circourt” showed in full on certain German general staff maps while the troop maps had only the initial C. Other characteristics of the cryptogram implied that it dealt with a troop movement, and when it was attacked on this basis and on the now highly probable supposition that it contained the plaintext word Circourt, it succumbed. The French then recovered the key and read all the traffic for the week or so that it remained in force.
The cipher was the ÜBCHI, the famous double columnar transposition that the Germans had used—and the French had known—since even before the war. It employed a keyword or keyphrase prescribed by the high command, which, before actual encipherment, had to be transformed into a numerical sequence. This was done—as is conventional—by numbering the letters of the keyword in their alphabetical order, numbering repeated letters from left to right. For example, with the keyphrase DIE WACHT AM RHEIN, the two A’s would be given numbers 1 and 2. There are no B’s, so the C would take number 3, the D number 4, the two E’s 5 and 6, and so on:
Actual encipherment of a plaintext—say Tenth division X Attack Montigny sector at daylight X Gas barrage to precede you—involved six separate steps. The encipherer (1) wrote the plaintext horizontally into a block beneath this numerical sequence:
He (2) transcribed the letters vertically by columns in order of the key-numbers: HKAAY, ITYG, DMTRO, and so on, and (3) inscribed them horizontally into another block under the same numbers. To this he (4) added as many null letters as there were words in the original keyphrase—four, in this case:
The encipherer then (5) again took out these letters by columns in key order: YNNER, GDTEA, IAGAB, and so on, and (6) divided them into the standard five-letter groups for transmission: YNNER GDTEA IAGAB HTDRA AGUIT RPXTT OOEET HEIKC RSAOI SVDNT IITOT NMYAG SYSEX KACOL C.
Decipherment was precisely the inverse of this process, except that the decipherer had first to determine the size of the transposition block so that he would know how deep his columns ran. He did this by dividing the number of digits in the key into the number of letters in the message; in this case, 15 into 71. The quotient—here, 4—gave the number of full lines in the block; the remainder—11—the number of letters in the final incomplete line.
Solution of a single message enciphered by double transposition constitutes an exceedingly difficult problem. Why this is so can best be understood from the cryptanalysis of a single columnar transposition. This is a cipher that would pass its plaintext through only one block, taking as its ciphertext the result of step 2 of the double transposition. Obviously, such a ciphertext is composed of segments that were originally the columns of the tableau. A cryptanalyst will cut up that ciphertext into what he thinks might be the columns and then will juxtapose one segment against another until he finds two that look as if they might have stood next to one another in the original block.
With the following 40-letter cryptogram, for example, the cryptanalyst might begin by assuming a keylength of five. The columns would then run eight letters deep, and the cryptanalyst would slice the cryptogram into groups of eight letters and pair the first group with the other four:
He can then either examine these by eye or use various mathematical techniques to see which two segments go together the best. One such technique is to give each assumed digraph its frequency in plaintext and then to add these frequencies; the combination with the highest total is most likely to be right. Thus, in the 1-2 pairing, EN has a normal frequency of 25 (per 2,000 English digraphs), IH of zero, and so on, with the eight digraphs totaling to 69. The other combinations come to 73, 143, 77, 77, 73, 62, and 78, respectively. The cryptanalyst would probably select the 1-4 combination with its 143 total, try to extend its digraphs into trigraphs on both right and left, and continue like that until he has reconstructed the entire block. If nothing looks good, he must modify his original guess as to the keylength and start over.
This process is greatly simplified if all the columns are the same length—a condition that obtains when the block is completely filled. This is called regular columnar transposition. In irregular columnar transposition, where the last line of the block is not full and the columns are consequently of two different lengths, the solution involves some jockeying up and down of the columns to get the proper matches.
This sort of reconstruction is, in exceptional cases, possible on a second-order basis to permit the solution of a single double-transposition cryptogram. In theory the cryptanalyst merely has to build up the columns of the second block by twos and threes so that their digraphs and trigraphs would in turn be joinable into good plaintext fragments. But this is far more easily said than done. Even a gifted cryptanalyst can accomplish it only on occasion; and even with help, such as a probable word like Circourt, it is never easy.
Solution becomes relatively simple, however, with several double-transposition cryptograms, all of exactly the same length an
d enciphered by the same keys. The cryptanalyst can then apply, on a letter-by-letter basis, the multiple-anagramming technique used in 1878 by Hassard, Holden, and Grosvenor on a word-by-word basis. Usually the two messages are written out one underneath the other on strips of paper, the paper is cut vertically so that two letters—one from each message—are on a single slip, and the slips tried one next to the other until plaintext appears on both top and bottom. The method very often succeeds, and French cryptanalysts accordingly sought cryptograms of identical length and key which they could subject to it. The Germans eased their search by keeping a single key in effect for eight or ten days over the entire Western Front. And as summer waned, the intercepts were fluttering onto French desks as thickly as the leaves of the war’s first autumn.
But the four or five cryptanalysts that Cartier had under him at the Ministry of War could not concentrate solely on them. They had to lend a hand with the naval traffic, because the Ministry of Marine had no cryptanalysts whatsoever, and with the Berlin-Madrid diplomatic correspondence, because the Foreign Office experts were too overloaded to solve them quickly enough to be useful. Their work was further disrupted when, on September 2, their office was evacuated to Bordeaux with the rest of the government in the face of the German threat to Paris. Despite these difficulties, they began to send daily solutions to general headquarters later that month, when the war had been in progress only a few weeks. Sometimes these consisted of only the gist of messages, for multiple anagramming sometimes restores only patches of plaintext. A complete solution, however, will permit reconstruction of the original transposition key. This reconstruction is a tedious task, but it is worth the effort, for the basic key would unlock all the cryptograms enciphered in it, irrespective of identical-length requirements. On October 1, Cartier and three of his cryptanalysts—Major Adolphe Olivari and Officer-Interpreters Henry Schwab and Gustave Freyss—made this breakthrough for the first time. They communicated the primary ÜBCHI key to the various headquarters for on-the-spot decipherment of local German cryptograms.
It promptly became the hottest topic of conversation in the French army. The news raced through the ranks, and telephone lines were clogged with excited calls about the key recovery. Soldiers chattered about the existence of the key and discussed the contents—real or imagined—of cryptograms. So serious was the breach of security that on October 3 G.H.Q. had to issue an order to try to stop indiscreet talk about it. It didn’t help. A few weeks later, after the Germans had changed their key, an officer asked loudly in the vestibule of headquarters whether it had been discovered again. The gossip swelled and expanded until it even reached civilian ears in Bordeaux.
The Germans seemed not to have heard it, however, for they continued to use their double transposition with their infrequent key changes. On October 17, a new key went into effect, but the French, more experienced now, recovered this one four days later. A new change at the beginning of November took only three days to solve; the next key was ascertained the very day it went into service. One of the new solutions enabled the French to bomb Thielt in occupied Belgium at the very moment that Kaiser Wilhelm II was entering it for a review. This story was too good for anyone to keep to himself; soon Le Matin published it, specifying the source of information. This time the Germans took notice. On November 18, they instituted an entirely new system.
It was a case of what cryptologists call “illusory complication.” For though on its face it appeared more intricate and harder to solve than the double transposition, it proved to be solvable with a single cryptogram instead of the two or more, limited to highly specific conditions, required for multiple anagramming. The cipher consisted of a Vigenère encipherment with key ABC—which could be done in the head—followed by a single columnar transposition. One weakness was that the ciphertext equivalents stood at most two places away from their plaintext in the normal alphabet. The errors of cipher clerks enabled Lieutenant Colonel Anatole Thévenin, a member of the Commission of Military Cryptography who was serving as a part-time cryptanalyst at his post as assistant chief of staff of the 21st Army Corps, to solve it by December 10.
A month later there arrived on Cartier’s desk a memorandum suggesting a simplified method of breaking this system, called the ABC by the French. It had been written by Georges Jean Painvin, a 29-year-old reserve lieutenant of artillery on the staff of the 6th Army. Painvin, who had a mind that flashed and cut like a rapier, was destined to become the Perseus of cryptologists in the epic struggle of World War I, slaying one German cryptographic Gorgon after another. Tall and slender, with dark, rather Spanish-looking features and piercing black eyes, Painvin worked with an intense concentration that gave no hint of either the lightning agility of his intelligence or his native charm and generosity. A high-ranking graduate of the famed École Poly-technique, he had taught paleontology at the École Nationale Supérieure des Mines in Paris. He was also an outstanding ’cellist and had once won first prize in this instrument at the Nantes conservatory.
When, after the Battle of the Marne, the fighting settled into the stagnation of trench warfare, Painvin found his afternoons unoccupied. He had become friendly with Captain Victor Paulier, a cryptanalyst who had been sent to the 6th Army from Cartier’s bureau, and from him learned about the ÜBCHI. Painvin took up multiple anagramming of the German intercepts much as one might do crossword puzzles, and soon his recreations were crowned with practical success. He recovered several keys which were reported to Cartier, who, after receiving the ABC memorandum, dispatched his congratulations to Painvin.
On several occasions during inspection visits to 6th Army headquarters at the Château de Montgobert near Villers-Cotterets, the Minister of War, Alexandre Millerand, asked the commander, General Michel-Joseph Maun-oury, to release Painvin for service at the Bureau du Chiffre. But Painvin had been through too much with the elderly Maunoury to feel able to leave him. Maunoury finally yielded to the pressure, however, and in March of 1915 told Painvin to go for two weeks and see whether he could be of more use with the cryptanalysts than with the 6th Army staff. Painvin went; soon thereafter, Maunoury was grievously wounded. There was now no one to recall the young cryptanalyst, and he remained in Cartier’s office for the rest of the war.
That office now headed the first echeloned organization in the history of cryptology. The Bureau du Chiffre, which had returned to the War Ministry building in Paris, employed several dozen people, of whom only about 10 were cryptanalysts. It worked in the cryptologic stratosphere—inter-Allied communications, enemy diplomatic and naval cryptograms, new military systems, and messages from distant fronts. Its chief, Cartier, also directed the intercept service. Under the Bureau du Chiffre was G.H.Q.’s Service du Chiffre, headed by Givierge. Its staff of 15 officers handled the cryptographic correspondence of the French headquarters and solved the strategic cryptograms of the German Army, usually with methods and keys supplied by the Paris bureau.
Beneath it in turn came the cryptologic offices that were attached to the various army and army group headquarters in the same way that those headquarters had their own intelligence, signal, and other specialized organizations for their own needs. Paulier constituted one such office. They had been inaugurated by an order of September 17, 1914, which attached a specialist to each major unit to enforce the cryptographic regulations for their own troops. France was preparing a general advance and did not want its cipher clerks making the blunders on the radio that they were then making on wire telegraphy. Eventually this one man became three, including cryptanalysts. Their presence near the front enabled them to garner many details helpful in solutions. If, for example, a message was sent to a German artillery unit, and two hours later that unit laid a barrage on a certain sector, the French cryptanalyst would have a number of probable words with which to rip open the message. These army bureaus generally solved low-level tactical communications.
The various branches of the decentralized French organization worked in close cooperation. Results o
r partial results were flashed from one to another as soon as a break was made: the War Ministry and G.H.Q. later communicated via a telautograph, which, since it was the only one in existence, they regarded as sufficiently secure to carry some of the most secret messages in France.
By May of 1915 the ABC cipher had vanished. The end of the war of movement greatly reduced the volume of German military radio messages, and for most of 1915 traffic was at a very low level. The lull gave the French a chance to attack other problems. Painvin, Schwab, Givierge, Olivari, and Paulier cudgeled naval dispatches. Officer-Interpreters Bélard and Trannoy struggled with Bulgarian, Greek, and Turkish cryptograms. The several codes used in the busy Berlin-Madrid and Vienna-Madrid diplomatic circuits were under attack, the German-language ones by Painvin, Olivari, and Paul-Brutus Déjardin, the Spanish by Lieutenant Pannier and Officer-Interpreter J. Périère.
The cryptanalysts also engaged in retrospective solution of some of the cryptograms of the first days of the war. These helped explain why the Germans had made the historic turn to the east that led to the crucial Battle of the Marne, where they were stopped, and shed light on the thinking of German commanders during the critical “race to the sea,” which established warfare’s first continuous front. The picture that emerged of the German way of conducting war was so helpful to the French staff that General Joffre, the commander in chief, wrote to the Minister of War: “I have, like all the army commanders, during the last few days learned to realize the value of the services which have been rendered by the cryptanalytic bureau of your department. Please transmit the thanks of all of us to Major Cartier and his group.”