The Allied success at breaking the “unbreakable” Enigma cipher during the Second World War is a rousing story, and while told many times (for example, in The Imitation Game and Enigma) few have paid any attention to the German perspective on the matter.
The first question must be, How could they have been so foolish as to not even suspect their vaunted Enigma machine had been hacked? Why didn’t they just upgrade or change their cipher as U-Boat losses mounted or convoys were miraculously diverted around their patrol lines, obviously because the Allies were reading their intercepted signals?
Were they really that dumb? The short answer is No, so let’s look towards other explanations for their refusal to budge.
The Other Side of the Hill
The key to German behavior is that from top to bottom they resolutely believed that Enigma was unbreakable. The sacred cipher was a creation of German genius, a product of German science, a child of German mathematics, and to diverge from that orthodoxy was to question the nature of Germany itself.
So potent was this faith in its infallibility that even after the secret that the Allies had read Enigma decrypts (known as “Ultra”) was first revealed to a stunned public in the early 1970s—don’t worry, I’ll be posting about that—the former cryptographic head of the Naval War Staff still refused to believe that it had been cracked, at least continuously and reliably.
He was right, in some respects. For eleven almost unendurable months in 1942, Enigma’s Triton version (used by Atlantic U-boats) had been impregnable, while Tibet (Pacific U-boats) was only intermittently read, and Neptun, employed in fleet operations, never broken. Continuous and reliable: not quite.
Still, that’s splitting hairs. The real point here is that the Germans were on firm ground in thinking their cipher was too difficult to break. Theirs was an entirely reasonable assumption: An Enigma machine, operating at its highest security settings, had almost 159-quitillion possible combinations—far beyond human abilities to overcome.
Even so, they put theory to the test in 1943 during a “Hundred Day Project,” when the best German codebreakers were loosed on Enigma. Told to use any method they could think of, they failed to crack it, thereby reinforcing a sense of security, false or not.
Keep in mind (because so many forget) that the Germans were no slouches at cryptanalysis. At the beginning of the War they were able to read the Royal Navy code, RAF ground-to-air codes, American diplomatic codes, numerous Soviet and French ciphers, and maybe even the tough Japanese Purple code. In 1943, they were even reading the Allied convoy ciphers. So when they concluded that no one could read their communications it was counted as definitive.
Added to that, they took numerous precautions to protect their treasure, and these as a whole should have ensured a cryptological Fort Knox. Among other things, they upgraded the machines by increasing the number of rotors in use, changed settings several times a day, severely restricted the distribution of the highest-level ciphers, and forbade unnecessary radio transmissions to stop giving away information.
Perhaps most importantly, they added a supplementary code for the U-boats’ longitude and latitude coordinates so that in order to know the location of a submarine or its destination you had to break not only Enigma but the position code, as well.
All U-boat operators also had two things hammered into their skulls during training. First, do not use easily guessed keys like AAA to send messages, which was like choosing PASSWORD for your bank password.
And second, if there was any risk of the submarine being captured, their first priority—more important than saving their own lives—was to destroy the machine and its cylinders, key tables, code books, instructions, and procedural manuals.
The Fatal Flaw
It was this insistence that the machine and its documents not be physically compromised for fear of Allied boffins excavating their arcane secrets which lies at the heart of German failure.
During the War, the Americans and the British in fact captured a handful of machines but they did not significantly assist the effort to break Enigma—for it was already intellectually compromised by the fact that the Germans ignored the possibility of an analytical solution. Allied codebreakers, put another way, took shortcuts, looked for holes, and zagged when the enemy thought they’d have to zig.
So, no, they didn’t try to cycle through 159-quintillion combinations, even when aided by the giant electro-mechanical “computers” known as bombes, which automated much of the grind work. And neither did they actively pursue the traditional statistical methods of codebreaking, like letter-frequency analysis.
During the Hundred Day Project, the Germans tried all that conventional stuff and came up with nothing. What they failed to see was blazingly obvious only in hindsight, and that was that the Allies did not have to achieve 100 percent success in order to “read” the cipher.
Instead, they exploited human error and the machine’s design flaws to discern the gist of a given intercepted message, and then used their intuition, educated guesswork, and logical deduction to fill in any necessary details, like the grid-coordinate system, which would later be certified by the captured machines and documentation.
Known standard salutations (“Dear Commander,” “Merry Christmas”) and headers (From, To) attracted Allied codebreakers hunting for a chink in the armor. The machine’s quirk that no letter could be enciphered as itself, thereby reducing the number of possibilities for common letters like E, made for easy leverage.
A Coincidence Too Far
On a couple of occasions, Admiral Karl Dönitz, commander of the Kriegsmarine and U-boat supremo, asked for investigations into encounters that struck him as curious: A British submarine popping up at a prearranged U-boat refueling spot; an Admiralty intercept mentioning the whereabouts of several U-boats that had maintained an untrackable radio silence; a sudden swing away from U-boat successes against Allied shipping to a large number of submarine sinkings, as happened between December 1942 and January 1943.
These investigations were duly undertaken, but staffers at the Navy Intelligence Service (Marinenachrichtendienst, or MND) were blinded by their inability to think anything but conventionally. They were logical and diligent, but lacked imagination and the ability to put themselves in the enemy’s shoes. As a result, they attributed otherwise suspicious incidents to every cause but the real one. As they declared to the admiral, “a penetration of our ciphers does not come into question,” and so never was.
Instead, air reconnaissance, improved radar tracking, increased ship speeds, careless radio signaling by German captains, and deadlier destroyer tactics were all given as the reasons for higher U-boat losses and lower casualties among Allied merchantmen. Now, it is true that these factors did play hugely important roles in the submarine war—the centrality of Enigma to victory is always exaggerated—but in this case, focusing on them recused Enigma from cross-examination.
Thus, any incongruities and inconsistencies were explained away as merely the result of luck and randomness. It was as if they were looking for a reason, any reason, to reject the harsh reality that loomed before them.
To that end, investigators sought only specific tactical evidence that Enigma had been broken. To prove that Enigma was compromised, in other words, MND demanded documentary proof in the form of an intercepted message that an Allied vessel had been ordered to a precise grid coordinate at the exact same time as a U-boat was due to be there.
It was as if they were policemen who would be satisfied that a crime had been committed only if they found a smoking gun next to the body with the fatal bullet conveniently in it.
Now, it’s always good practice not to jump to conclusions, but the one time when MND actually had the gun and the body, and could have established a definitive link, the evidence was dismissed.
Thus in January 1943, when the British slipped up and signaled that two U-boats were to rendezvous with a supply boat at a remote location, MND pointed out that the original Enigma transmission had ordered the submarines to “circle” (schwabbern) there while the Admiralty said the U-boats were on their “voyage home” (Rückmarsch). Therefore, MND triumphantly concluded, the British could not have broken Enigma because if they had they wouldn’t have made such an elementary error.
At the same time as MND was winning the Thompson & Thomson awards for pedantry, the tide was decisively shifting against the U-boats in late 1943 and 1944. In seeking to explain the mounting losses, paranoia began to seep in to the reports. There were tales of a high-ranking Wehrmacht traitor passing secrets to the British, and of American spies monitoring submarine traffic in and out of their pens at Lorient. Most bizarrely, an onboard radar-detector machine called the Metox that allowed U-boats time to dive and escape was believed to be alerting super-advanced Allied anti-radar-detectors and so was ordered to be turned off.
Neither Judas nor OSS agents nor alien-tech actually existed, but by then it was too late.
The Sum Total
The question is, why didn’t the Germans ever put 2 + 2 together to come up with 5, the answer to all their travails?
Well, probably owing to a mental combination of confirmation bias and sunk-cost fallacy. So much time and effort had been invested in Enigma that it was impossible to imagine it was flawed, so no one tried to. And, to be fair, that Enigma was pristine was a reasonable assumption, because by any conventional measure, Enigma was unbreakable. But assumptions are very dangerous things, especially when they’re reasonable ones to make.
Worse yet, there was nobody who was prepared to question those reasonable assumptions. U-Boat Command was, at least until 1942, a kind of intimate eighteenth-century outfit trying to run a twentieth-century war. Dönitz ran the whole show from a seaside villa with a miniscule staff of thirty (including cooks and secretaries). There were just six officers attempting to control hundreds of submarines spread out across the world. Had there been a few smart cookies spare to ask impertinent questions, there might have been more pressure to probe more deeply into Enigma security.
But of course there wasn’t. Instead, Dönitz was served by a staff of mostly younger men, few of whom were confident enough to risk the adverse career consequences that would accompany telling the emperor that he was wearing no clothes.
And even if there was some courageous soul, there was no way Dönitz, a man always concerned about his position, would ever relay that information upstairs to High Command in Berlin so that the air force and army could also upgrade their cipher systems and prevent further security exploits.
The Navy always looked down its nose at its sisters’ lackadaisical security (it was particularly sloppy on the Eastern Front) and so severed most of its connections. In turn, to the soldiers and aviators of the Reich the Navy had always been a joke service and submarines were a frippery. These were people who had so little interest in seapower that when they heard the Japanese had bombed Pearl Harbor no one on the Führer’s headquarters staff knew where it was.
Everyone in Dönitz’s radius therefore kept silent—and wisely so. There would be no promotions for any skeptic who did not display the requisite National Socialist faith in unceasing aggression, a belief in the primacy of the will to overcome long odds, a reliance on “ingenious improvisation” (Geistreiche Improvisation) in the absence of material superiority, the routine acceptance of colossal risk, and the understanding that to question orders or “the system” was dangerous evidence of faltering commitment.
Together, these ideology-powered mental outlooks dismissed caution, planning, skepticism, and organizational coordination—the hallmarks of British and American antisubmarine efforts—in favor of spectacular feats of audacity using whatever tools and opportunities came to hand. In this light, worrying about possibly compromised ciphers when there were convoys to be ravaged and battleships sunk on the high seas simply did not demonstrate the expected faith in the superiority of moral over merely physical factors.
In the end, then, it was the Germans themselves who, so to speak, torpedoed their own cipher.
Further Reading: R. Erskine, “Naval Enigma: An Astonishing Blunder,” Intelligence and National Security, 11 (1996), 3, pp. 468-73; T. Mulligan, “The German Navy Evaluates its Cryptographic Security, October 1941,” Military Affairs, 49 (1985), 2, pp. 75-79; J. Muth, Command Culture: Officer Education in the U.S. Army and the German Armed Forces, 1901–1940, and the Consequences for World War II (University of North Texas Press: Denton, 2011); R.A. Ratcliff, “Searching for Security: The German Investigations into Enigma’s Security,” Intelligence and National Security, 14 (1999), 1, pp. 146-67; N.A.M. Rodger, “Skilled in the Tactics of 1870,” review of E. Mawdsley, The War for the Seas: A Maritime History of World War Two, London Review of Books, 42 (2020), 3 (February 6); D. Stahel, “The Wehrmacht and National Socialist Military Thinking,” War in History, 24 (2017), 3, pp. 336-61.
Such an intriguing take from the German perspective. Somehow never considered it that way!
I suspect similar phenomena are at work in public and private cybersecurity authority's offices today.