A joint investigation by the Washington Post, German broadcaster ZDF, and Swiss broadcaster SRF revealed that the CIA and West German intelligence agency BND had secretly owned Swiss encryption company Crypto AG. The agencies used rigged devices to read the communications of governments that bought them.
What happened
- The CIA and BND bought the company in 1970; the BND left the arrangement in the early 1990s and the CIA continued until 2018.
- Crypto AG sold equipment to more than 120 countries over several decades.
- An internal CIA history called the operation ‘the intelligence coup of the century’.
- The Swiss government announced an inquiry, and a later parliamentary review found Swiss intelligence had known of the operation.
Why it mattered
It was one of the biggest surveillance revelations since the Snowden disclosures, showing how a trusted security supplier could be deliberately compromised. It also raised difficult questions for the Swiss government about neutrality and oversight of companies operating from Switzerland.
Lessons for organisations
Treat security products as part of the supply chain: assess vendor ownership and jurisdiction, prefer openly reviewed cryptography, and avoid relying on a single provider for critical security functions.
Source: Washington Post
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
