M-209 was a light-weight portable pin-and-lug cipher machine, developed at the beginning of World War II by Boris Hagelin of AB Cryptoteknik in Stockholm (Sweden), and manufactured by Smith & Corona in Syracuse (New York, USA). The machine is designated CSP-1500 by the US Navy and is the US military variant of the C-38, which in turn is an improved version of the C-36 and C-37. A compatible motorised version – with keyboard – is known as BC-38 (later: BC-543). During WWII, the M-209 was known by German cryptanalysts as AM-1 (American Machine #1)). //

The cryptographic strength of the machine was reasonable for its time, but was not perfect. As of early 1943, it was assumed that German codebreakers were able to break an M-209 message in less than 4 hours. 1 Nevertheless, it was considered sufficiently secure for tactical messages which, due to their nature, would be meaningless after several hours. This is why the M-209 was later also used in the Korean War. The M-209 was succeeded in 1952 by the C-52 and CX-52. //

According to them, the effort to break it was impractically high.

It proved however, that American cryptologist William Friedman, had been right all along. He liked the Hagelin machines and had found them to be theoretically unbreakable, but knew that they could be setup in such a way that they became weak and vulnerable to cryptanalytic attacks [8]. British and American codebreakers were able to read the Hagelins from both enemies and allies.

After the war it became clear that the Germans were able to read 10% of the American Hagelin traffic: 6% from cryptanalysis, and 4% from captured keys. But due to the amount of work involved in breaking, the delay between intercept and decrypt was usually 7 to 10 days; too long to be usefull for tactical messages like the ones sent by the US Army. Apparently, the Japanese also understood many of the principles of Hagelin exploitation, but hardly broke Hagelin traffic [8].

For high-level messages, the Americans used a rotor machine — SIGABA — which was similar to Enigma, but much much more advanced. As far as we know, SIGABA was never compromised.

Cold War
Immediately after WWII, in 1947, the NSA started the development of a cryptanalytic machine named WARLOCK I — also known as AFSAF-D79 and CXNK — that was able to solve the Hagelin C-38/M-209 much faster than with hand methods. The machine became operational in 1951 and was used to read the traffic from many countries that were using M-209 or C-38 machines. The US had 'accidentally' released large batches of M-209 machines on the surplus market for as little as US$ 15 and even US$ 2 [8]. Many of these were purchased by South American countries.