CTI & OSINT

Secret Messengers (NSA/GCHQ, 2025)

by  • 

I had long wanted to examine the intelligence employed during the Second World War. Drawing on the training I received at the École de Guerre Économique (EGE), I present here a neutral, factual synthesis, accompanied by full references as well as the original document that served as my source.

This article synthesizes the report Secret Messengers: Disseminating SIGINT in the Second World War, jointly published by the NSA (Center for Cryptologic History) and GCHQ. It focuses on the dissemination and protection chain for Allied ULTRA/SIGINT during the Second World War rather than on cryptanalysis itself. All factual assertions below are drawn from the primary document (1) and, for bibliographic identification, from its official notice (2). Mentions of visuals and boxed inserts refer to PDF page numbers. (1)(2)

Purpose of the Work

The report explains how the British (Special Liaison Units, SLU) and the Americans (Special Security Officers, SSO) built, secured, and evolved an ULTRA dissemination infrastructure so that a carefully selected set of decision-makers received rapid, contextualized, and protected information on the enemy. The work emphasizes the availability/security trade-off and the mechanisms of compartmentation, indoctrination, and end-of-chain control within the intelligence cycle. (1)

Context and the Genesis of UK–US Cooperation

  • Pre-war: The United States possessed naval SIGINT strengths against Japan (exercises and training), while the Army decrypted the Japanese diplomatic system Purple and built a machine to aid exploitation (“Purple analog”). Distribution to readers was extremely limited (a few senior officials in Washington) and mainly via officer courier. (1)
  • February 1941: The Sinkov mission visited Bletchley Park (BP). Exchanges led to a division of labor: GC&CS took the lead on Germany; the United States on Japan. American adherence to British rules (strict control of access and dissemination) was formalized. (1)
  • Chronology: The timeline (PDF pp. v–vi) highlights key milestones—GC&CS move to BP (15 Aug 1939), creation of the first British mobile units (summer 1940), deployment of SSU1 to Cairo (June 1941), McCormack’s mission to the UK (April 1943), preparation of mobile units for OVERLORD (spring 1944). (1)

British Implementation: SLU/SCU and Concept of Employment

  • SLU (local dissemination) and SCU (secure communications) were established by SIS Section VIII (Whaddon Hall), with mobile teams (radio trucks, cipher truck, logistical autonomy). A closed list of authorized readers was maintained in each theater; ULTRA was accessible only to a few key billets (commander, chief of staff, G-2, operations, planning, signals). (1)
  • 1943 rules (reader briefing and security): no direct action on ULTRA without plausible cover (aerial reconnaissance or another source), no archival retention below army-group level, controlled admissions and confidentiality statements when taking/leaving post, very restricted telephone use (scrambler). (1)
  • Recruiting and training: On the British side, preference went to teachers, accountants, and code/cipher personnel, judged suitable for authority, rigor, and Typex usage. The work also addresses internal/external security (e.g., MI5 checks) specific to deployments in sensitive areas. (1)

American Implementation: Special Branch (G-2), SSO, and Operating Model

  • G-2 Special Branch (War Department), founded and structured by Alfred McCormack (later Carter W. Clarke), heavily recruited lawyers for analysis and dissemination owing to their ability to interpret and write under strict rules. (1)
  • Typical dissemination chain: ULTRA decrypts → Special Branch (synthesis and clarification) → theater SSO via dedicated SIGABA encrypted channel (15 rotors; no evidence of compromise) → verbal/annotated map briefs to a handful of authorized readers; four daily deliveries planned, urgent messages “at any time.” Ephemeral archiving and incineration of messages. (1)
  • SSOs operated within G-2, at times with non-ULTRA tasks to better contextualize the operational picture. Functional ambiguity was deliberate, with strong compartmentation from non-indoctrinated staff. (1)

Communications and Equipment

  • Typex (UK) and SIGABA/ECM (US) ensured confidentiality of ULTRA traffic between producers and SLU/SSO; one-time pads were used in certain fluid contexts (early North Africa) due to concerns over machine capture. (1)
  • American dissemination in the Pacific involved inter-service tensions (USN/US Army). The Navy used a distinct chain (CINCPAC/CINCPOA) with direct distribution to submariners when perishability of data required it. (1)

Theaters of Operations: Dissemination Dynamics

Mediterranean and Italy

  • Operation TORCH: Eisenhower, briefed by Churchill at Chequers, received ULTRA from an SLU at Gibraltar and then in Algiers; UK–US interoperability was tested as early as 1942. A system of cipher addresses (digraphs) structured routing (e.g., DB Gibraltar, PK Algiers). (1)
  • Sicily (HUSKY) and Italy: SLUs were positioned near senior HQs (Montgomery, Patton, Alexander, Clark), moving frequently and delivering multiple daily briefings. ULTRA’s value became evident to initially skeptical commanders through concrete predictions (e.g., ambush at Avranches). (1)

Western Europe (OVERLORD → Rhine)

  • At SHAEF, Eisenhower received a fused assessment (ULTRA + other sources) from G-2 Kenneth Strong; ULTRA usage and rules were reaffirmed by George C. Marshall in early 1944. (1)
  • In the US First/Third Army: initial organizational frictions (housing SSOs, non-explanation to non-indoctrinated staff) gave way to rapid maturation; morning briefs to a restricted “cabinet,” enemy OOB maps based on ULTRA and continuously updated. (1)
  • Pre-D-Day: formation of mobile stations (Guy 15-cwt trucks, US Dodge ambulances) for the 21st Army Group, First/Third US Army, First Canadian Army, USSTAF, etc. The table of stations open on 6 June appears on p. 28 of the PDF. (1)

US Army Air Forces in Europe

  • At USSTAF and the 8th Air Force (High Wycombe), ULTRA supported the oil campaign (targeting/damage) and fighter escort (locations of German fighter forces). Production included daily digests, reference files for Luftwaffe units, and wall maps kept in sync. (1)

Pacific

  • POA (Nimitz): frictions between JICPOA and G-2; a practical compromise had the senior SSO briefing authorized Army generals, while the Navy ensured downstream dissemination to Army units. (1)
  • XXI Bomber Command (B-29) at Saipan/Guam: ULTRA was essential to mining operations in Japanese waters and to industrial/urban raids (spring–summer 1945). (1)
  • SWPA (MacArthur): coexistence of ULTRA from SSA (US), Central Bureau Brisbane (CBB, AUS/US), and the Navy (Brisbane). Governance tensions (relations Willoughby/Fabian, directives from CoS Sutherland) were mitigated over successive relocations (Hollandia, Leyte, Manila). George Kenney leveraged ULTRA effectively for air interdiction. (1)
  • CBI/SEAC: extreme dispersion, multiple producing centers (BP, Washington, local). The senior SSO (Runnalls then Wyatt) had to contend with itinerant commanders (Stilwell) and the impossibility of completely isolating ULTRA spaces. Officer courier, encrypted radio, and pragmatism ensured continuity. (1)

Key Takeaways for Cyber Threat Intell

  1. Centralized control, decentralized execution: A restricted reader list and indoctrination rules preserved source integrity while maintaining speed of delivery. Contemporary analog: TLP/NDAs governance, consumer mapping, and dynamic need-to-know. (1)
  2. Cover and plausible deniability: Prohibition on acting “on ULTRA” without action cover (e.g., reconnaissance). CTI analog: exploitation playbooks separating tactical indicators (action) from sensitive observables (sensor protection). (1)
  3. Dedicated channels: SIGABA/Typex and SLU/SSO lanes were segregated from ordinary circuits. Application: isolated dissemination paths, end-to-end encryption, access auditing, and minimal retention. (1)
  4. Theater adaptation: Echelon proximity (SLU trucks at HQ), multi-daily integration, and cartography transformed raw flow into actionable intelligence. Application: embedded cells with operations/defense teams, situation boards, and cadenced briefs. (1)
  5. Interoperability and language: Differences in UK/US vocabulary (e.g., “disposed of”) and inter-service frictions required semantic smoothing and dedicated liaisons. Application: shared glossaries, inter-team agreements, and cross-review of requirements. (1)
  6. Document hygiene: Ephemeralization (incineration) and bans on low-level archiving reduced exposure. Application: TTL/expiration for sensitive products, version control, and secure deletion. (1)

Conclusion

The SLU/SSO system exemplifies the organizational discipline required to convert a cryptologic breakthrough into a durable operational advantage. In practice, success rested on strict reader selection, dedicated channels, contextualized presentation, and enforceable security rules—all adaptable by theater. For today’s CTI/security community, these foundations remain current: dissemination governance, usage segmentation, synchronization with decision-makers, and source protection. (1)

References (full URLs)

  1. Abrutat, D. & Hatch, D. (2025). Secret Messengers: Disseminating SIGINT in the Second World War (United States Cryptologic History, Series IV: WWII, Vol. 12). Official PDF (NSA/CCH via media.defense.gov): https://media.defense.gov/2025/Jul/25/2003761271/-1/-1/0/SECRET_MESSENGERS.PDF
  2. Official publication notice (NSA, Cryptologic History — Historical Publications): https://www.nsa.gov/History/Cryptologic-History/Historical-Publications/Historical-Publications-Lists/igphoto/2003761271/

Note: All reported facts—chronology, organization, procedures—derive from the main document (1), including the timeline on PDF pp. v–vi; numbers in parentheses in the text point to this source.