The encryption company secretly owned by spies

The story

Crypto AG was a Swiss company that made encryption machines. Switzerland’s reputation for neutrality made it an easy choice for governments that wanted to keep their diplomatic and military messages private, and it sold equipment to more than 120 countries.

In 1970, the company was secretly bought by the American CIA and West Germany’s intelligence service, the BND. The owners were hidden even from many of the company’s managers. The machines were deliberately weakened so that the two agencies could read the messages their customers sent.

The arrangement, later called Operation Rubicon, ran for decades. Germany’s agency left around 1993 and the CIA stayed until about 2018. It became public in February 2020, through a joint investigation by The Washington Post and German and Swiss broadcasters.

Why it mattered

For decades, governments around the world trusted equipment that had been secretly weakened by the people selling it. It remains one of the clearest examples of why the supplier matters as much as the product: a security tool can only be trusted as far as its maker can.

The lesson today

Crypto AG’s customers did everything right by the standards of the day. They bought specialist security equipment from a respected supplier in a neutral country. The weakness was the supplier.

Most businesses will never face anything like this. The lesson still applies on a smaller scale: every vendor that holds your data or can reach your systems is part of your security. It is worth knowing who they are, what access they have and how you would switch away if you needed to.