Secret Alliances Read online

  Mention should also be made of Russian diplomatic and intelligence traffic, which continued to be collected during this period, even though it was indecypherable. However, lengthy and painstaking work by American cryptologists working on the Venona project eventually discovered a vulnerability: wartime pressures caused by the German invasion of the Soviet Union caused the Soviet company making onetime pads to produce thousands of pages of key numbers which were duplicates. This enabled a proportion to be read. The successful decryption of several thousand messages after the war provided clues which led to the identification and arrest of a range of Soviet spies including the British diplomat Donald Maclean and the atom spies Julius and Ethel Rosenberg and Klaus Fuchs.8 They also provided details of instructions sent in June 1944 to Norwegian communist resistance leader Asbjørn Sunde, telling him to cease sabotage operations immediately and giving other details of Sunde’s activities.†

  Apart from the Soviet Union, at this time there was no country that had cyphers which were completely invulnerable. Britain had its weaknesses too. The Germans managed to break certain British naval cyphers both during the Norwegian campaign and afterwards, causing much damage. After the war Henry Denham, the British naval attaché in Stockholm who had sent the first report about the movement of the Bismarck through the Kattegat on 20 May 1941 (based on intelligence which he had obtained from Roscher Lund), was mortified to find in German archives a copy of a message from the Abwehr to the Kriegsmarine dated 21 May, giving details of this message which he had sent to the Admiralty just the day before.‡ 9 Similarly, GC&CS made a breakthrough with German Air Force cyphers in May 1940 and this series, known as ‘Red Enigma’, continued to be read with few interruptions until the end of the war.10 They were also able to make extensive progress in reading an Enigma key used during the Norwegian campaign but, as Hinsley points out, this did not have great practical value for British commanders because of the lack of effective communication, security procedures and expertise.11

  The value of Ultra (the signals intelligence obtained through the breaking of a range of the German Enigma cyphers) and the impact which it had in key areas of the war has been comprehensively documented, and the fragmentary way in which knowledge was acquired and exploited has been well described. Hinsley judges that its greatest contribution to the war at sea was obtained from the help it provided in enabling Britain to defeat German U-boats in the Battle of the Atlantic in late 1941, mainly by enabling the Admiralty’s Operational Intelligence Centre to direct convoys to take routes which avoided the waiting German patrols,12 although there were other later periods which also came close to matching that. Much of the work of GC&CS is outside the scope of this book, but there are two aspects which are of particular relevance to us.

  Successful cypher acquisition operations off the Norwegian coast

  The first concerns the extent to which Enigma naval codebooks and cyphers were acquired during ‘pinch’ operations, which, after some initial fortuitous successes, were mounted for the purpose in Norwegian waters in 1940 and 1941.§ The first success occurred on 26 April 1940 when the British destroyer Griffin intercepted what appeared to be a trawler, Polares, flying a Dutch flag near Åndalsnes, south-west of Trondheim. A boarding party discovered that it was a German ship carrying weapons and ammunition to Trondheim. The frightened crew did not resist and cooperated with the boarding party, who found some cypher tables and messages, and were also able to retrieve one of two weighted bags containing cypher materials which had been thrown overboard. These finds enabled the GC&CS cryptographers in Hut 8 at Bletchley Park, who dealt with German naval Enigma, to break the code for the first time and to read messages for the last few days of April.13

  There were other important Enigma-related acquisitions during this period, taken as a result of the sinking of two German U-boats, U-33 and U-110. The next success in Norwegian waters came during Operation CLAYMORE, a commando attack in the Lofoten Islands in March 1941. The raid destroyed some fish oil factories and substantial quantities of oil as well as sinking nearly 20,000 tons of shipping. However, a potentially greater prize was found by a boarding party from the destroyer Somali after she had attacked and disabled the German trawler Krebs. Crew members recovered two cypher machine wheels, along with – and even more significantly – the details of Enigma settings, which were the item the GC&CS cryptographers most needed. When these arrived at Bletchley Park, they enabled some Enigma messages from the previous month to be read almost straight away and, by developing knowledge of German processes, provided assistance for future work.14 But successes such as this did not have lasting benefits, because the tables which had been acquired were only valid for a limited period of time and when they were replaced, Enigma became unreadable again because the cryptographers had not yet developed a means of recreating the tables. So GC&CS asked the Admiralty for assistance, and suggested as a target for another pinch the Lauenburg, a German weather ship which was then operating further north off Jan Mayen Island. The Admiralty, while concerned at the danger that the Germans might conclude the capture of such ships was aimed at acquiring cypher material (a constant and prominent worry), decided that the risk was worthwhile. A small group of four ships set off in late June 1941, carrying Allon Bacon, a GC&CS cryptologist, a sensible step as on previous occasions potentially valuable documents had probably been overlooked during searches. The Lauenburg was located and some warning shots were sufficient to persuade the crew to abandon ship. Bacon oversaw the search, and his haul included some cypher wheel settings which were of critical importance, enabling German naval messages to be read within hours, rather than within days. When the settings from the Lauenburg ran out at the end of July 1941, the average time taken to read naval Enigma signals increased to about fifty hours.15

  In November 1941, changes in German operating procedures again hampered the work of the GC&CS cryptologists. It happened that further raids were being planned against the Norwegian coast. While the capture of German cyphers was only a subsidiary objective, Bacon was involved in the planning of both Operation ARCHERY against Måløy, and Operation ANKLET in the Lofoten Islands, in December. He identified some likely German ships as targets, and accompanied the fleet which sailed to Måløy as he thought that this, rather than Lofoten, offered the best chance of finding what they were seeking. His judgement was correct. First, during ARCHERY he accompanied a boarding party onto the Föhn, an armed trawler, and found a wealth of material including the tables which he was looking for as well as some Enigma settings and five cypher wheels. Soon afterwards, another German trawler, the Donner, was attacked and boarded. This time the booty included an Enigma cypher machine, as well as a further five wheels and another copy of the tables.¶ ANKLET also produced some worthwhile results, comprising another cypher machine, a further set of the much-prized tables and some code manuals. These finds gave GC&CS so much material that thereafter they were always able to deal with any German changes which might be made for security reasons. The settings used by German surface ships in home waters, and also by U-boats in the Arctic, were broken every day thereafter for the rest of the war.16

  A rather broader example of the effectiveness of GC&CS by this stage in the war is provided by a vivid report showing the most remarkably detailed description of German reactions to an Allied operation in Norway. Produced in mid-January 1942, it shows how much GC&CS had been able to establish about the way in which the German Air Force reacted to the Måløy raid: a composite report of this nature would have been of considerable value in facilitating planning for other attacks on the coast of German-occupied Europe. German Air Force units in southern Norway were under the command of Fliegerführer Nord (Flg. Nord) at Stavanger. The report explained that the Allied attack started at 0742, aircraft took off at 0820, and the first orders were issued at 0855. However, it became apparent that Flg. Nord did not know what was happening. He sent the main strike force to Vågsøy, but he instructed his reconnaissance aircraft to cover increasingly long st
retches of coastline. His instructions, and the increasingly frantic tone in which they were issued, indicate that he could not be sure that Vågsøy was the only point at which a landing had been made, and he seems to have assumed the worst. So at 0925, he sent a message to all the air and naval operational commands in the west, down to the English Channel, that British forces were landing between 59 and 64 degrees north.

  No signal from an outside station was intercepted before Flg. Nord issued instructions at 0855. GC&CS concluded that this suggested that the first intimation of an attack came from the observer post on Vågsøy. The fact that he could not be sure that there were no landings at other points suggested to them that he was relying on visual reports from shore stations. The general atmosphere of panic during the morning indicated that Flg. Nord had little faith in the reliability of his reporting service. Moreover, a German aircraft flying over Ålesund was fired on by the German anti-aircraft defence. The pilot understandably jumped to the conclusion that the vessels firing on him were British, and reported that Ålesund harbour was occupied by a British naval force. Flg. Nord may have known that this was nonsense, but the report can hardly have clarified the situation. During the afternoon of that day reinforcement squadrons were flown to Stavanger from Holland, though they did not arrive until after British forces had left, and they remained there for at least a fortnight afterwards.17

  ISOS and ISK, and their value

  One of the key patterns in the Abwehr’s use of communications was discovered by accident. In February 1940, when a Security Service radio operator was monitoring the traffic sent by Snow, their first double agent, he noticed that it was being received and forwarded to the Abwehr station in Hamburg by Theseus, a trawler which was sailing up and down off the coast of Norway. He observed that there was other traffic originating from Theseus around the time of his transmission periods. ‘After considerable disbelief and research, this led to the German agent wireless (or W/T) network being gradually detected and decyphered’ until GC&CS eventually picked up (by means of RSS stations|| at home and abroad) a network of German traffic channels which covered Europe, with strands going to Asia (as far as China), the United States and South America – of which GC&CS had previously been largely unaware.18 At this time, the Abwehr were using not only Enigma machines, but also the more old-fashioned and more familiar hand cyphers. In January 1940, GC&CS set up a special section under Oliver Strachey to break these hand cyphers and to report the decrypted material. They succeeded in doing so in March 1940.19 When they were first issued, the reports were called ‘IS1’ (Intelligence Series 1), and a total of 1,384 messages were distributed.20 On 20 October 1940, messages sent in the particular types of cyphers originally broken were renamed ISOS (Illicit Signals Oliver Strachey).21 The first ISOS reports were passed to SIS in July 1940. Section V of SIS, which dealt with counter-espionage, took over responsibility for their exploitation.** Although GC&CS continued to distribute the reports to service departments and to the Security Service, it was accepted that no action on them was permissible without reference to SIS. Dilly Knox was given responsibility for breaking the more difficult machine cypher used by the Abwehr for all its main European communications, and succeeded in December 1941, when the material produced was known as ISK (i.e. Illicit Signals Knox).†† For security reasons, to protect the fact that the complicated machine cyphers had become readable, both ISOS and ISK reports were circulated as ISOS and only a very few knew of the difference. They were described to customer departments as MSS (Most Secret Sources) rather than ISOS.

  Over time, a few other related categories such as ISOSICLE (relating to the hand cyphers of the SD, or Sicherheitsdienst, which took over the Abwehr in 1944), also became available in limited quantities. There appears to be a surprising discrepancy in GC&CS histories about the number of ISOS reports which were circulated. One record states that 270,000 such reports were circulated between April 1940 and May 1945, of which there were 100,000 messages reported in the ISOS series, 141,000 in the ISK series, 13,000 in the ISOSICLE series and 16,000 in minor categories.22 However, an entry in a file on the history of ISOS notes that over 500,000 reports were issued.23 This distinction is perhaps more one for the statisticians than it is for us, because the figure was in any case substantial and the reports provided a comprehensive picture of many significant Abwehr activities directed against Allied interests. Its systematic study was the task of specialists, for many of the messages were partial and incomplete (because of meteorological problems) or cryptic (because of code names). The card index system, patiently built up and collated from all these sources, was an essential tool for investigators.

  Once they were observed, the activities of the Theseus attracted considerable interest. On 30 March, Rear-Admiral Godfrey circulated a report about her, recommending that Theseus be left alone even if she departed Norwegian waters, because of her value. By 23 April, the Naval Intelligence Division (NID) were receiving, in the same cypher which was now being decrypted, reports from Abwehr HQ in Bergen on military operations in Norway and reports from other mobile stations as well as reports from Theseus. With the consent of SIS, these reports were passed in a camouflaged form to the War Office and also to the Admiralty. However at this stage, the organisation did not exist to enable the material to be passed to commanders in the field who could make effective operational use of it. Moreover, Hinsley judges that the significance of the intelligence derived from the earliest of these decrypted messages had been overlooked. He considered that the NID had failed to link the activities of the Theseus with other evidence for the German invasion of Norway, since for example some of the Abwehr messages contained enquiries about defences and troop dispositions.24

  As can be seen in Chapter 5 which considers German attempts to send their Norwegian agents to Britain, the effective exploitation by Section V of SIS and the Security Service of most of the Abwehr’s means of communications made it difficult for them to have any chance of mounting a successful operation in Britain. (It was only their land lines which could not be intercepted and these were not much used in Norway.) ISOS traffic provided advance information about most German attempts to send agents to the UK. Such activity was especially prevalent in late 1940 and the spring and summer of 1941. It continued in each ‘escaping’ season from then on, as a favourite Abwehr method was to mix the agents in with genuine escapers or to disguise them as a whole boatload of escapers. ISOS reports provided a developing picture of German planning, and also gave details about the vessels which were to be used. By April 1941, they had provided reports to NID containing detailed descriptions of five different fishing vessels which either had been used or were possibly going to be used, for the transport of agents to the UK. Some of these operations did not take place, but it enabled the Admiralty to be on the lookout to intercept vessels when they arrived in Scotland.

  An extract of a report based on ISOS from a slightly later period gives a flavour of the painstaking way in which information was collected and assessed:

  i. The mysterious ‘Fisherman O’ of the Reidar expedition has now been identified as Johan J Olsbø of Ålesund. He was the former owner of the Reidar and intended to come over to the UK in it, but withdrew at the last moment owing to fear of reprisals on his family. V-mann ‘Alex’‡‡ (Arnold Evensen) had not time to notify his German masters of the change of plan.

  ii. A rpt BEN/482 of 14.1.43 at the RVPS§§ by one of our interrogators enabled us to discover that V-person ‘Evelyn’ was identical with Sigrund Olsen. Sigrund Olsen @ Evelyn was responsible for penetrating an allied intelligence organisation in the Mosjøen area. This report is yet another instance of an interrogation by our RVPS staff tying up and elucidating the most secret material.

  iii. A Norwegian national called Henry Øverby arrived in the UK from Stockholm on 1.2.43. On arrival at the RVPS he named numerous prominent members of the Norwegian intelligence organisations with whom he had worked, and was aware of the names of P9 and Captain Turner.¶¶ Hi
s story however aroused some suspicion as a wireless operator by the name of Øverby figured in our MSS material in May 1942. This Øverby was given the cover name of Holte by the Germans. Henry Øverby is a wireless operator and is known to have used the alias of Erik Holtemoen in Norway. This name readily lends itself to the construction of Holte. This coincidence was pointed out to the Security Service and it has since transpired that Henry Øverby studied wireless engineering in Dresden and twice returned to Germany via Sweden since the invasion of Norway. He therefore had freedom of movement from the Germans. If Henry Øverby should prove to be the Holte of our MSS, the Abwehr has achieved penetration on a major scale. There is a chance that the whole thing is based on coincidence, but the Security Service agree with our suggestion that further enquiries are essential.25