The BROWN Story

Traffic Analysis is fundamentally the study of how adversaries use the communications available to them. Military forces need a structured system of communications to ensure that orders can be passed downwards, and information can be passed upwards. It is only by understanding how those communications are structured that a Sigint organisation knows when to tune a receiver to what frequency to intercept messages of interest.

But even this is an oversimplification. Management of communications is handled at a state level; the state allocates portions of the electromagnetic spectrum to its armed forces who then divide those allocations up between themselves according to their requirements. They juggle their use according to the needs of individual users, the different atmospheric conditions which can affect communications (for example time of day, season of the year, the activity of the sun), and a host of other considerations: Are people from other countries trying to use the same frequencies as I am? Do I have a set of reserve frequencies I can start using when we go to war to confuse enemy traffic analysts? Is there redundancy in the system to allow me to expand it?

Our adversaries have to manage their communications in a sophisticated manner, and we have to be as sophisticated if we are to understand how that management works. But that value of that understanding goes beyond merely directing intercept, important as that is.

Traffic Analysis began during the First World War as intercept sites learned how to predict when messages would be sent but also as analysts in the cryptanalytic bureaus in the Admiralty and War Office learned how to sort and categorise the undecipherable messages which were being sent to them.

For example, they learned to distinguish between the messages sent by the German Admiralty to individual ships and those sent to collective address groups: messages which looked as though they had been sent to one addressee, but had in fact gone to an address serving multiple users: a destroyer flotilla, perhaps, or all minesweepers in the Bight.

Separate from the contents of these messages, our forebears began to understand that the pattern of message activity was a source of intelligence in itself. A message sent to a destroyer flotilla in Wilhelmshaven, copied to minesweepers in the Bight might be an indication that the minesweepers were clearing a channel to allow the destroyers to reach the North Sea.

By mid-1916 MI1(e) had been set up in the War Office to provide the Sigint input to an integrated air defence system almost exclusively through TA and it is perhaps in MI1(e) that we see clearly for the first time what military Sigint can and can’t do.

It is rare for Sigint to provide the intention of the adversary: it provides information about its dispositions, its capabilities, its order of battle, and uses its understanding of all these elements to develop a structure of Indicators and Warnings.

Cryptanalysis might produce a message giving the order for tomorrow’s attack: it might equally inform us that the wife of the enemy commander has been safely delivered of twins; but a sudden increase across a section of the front of messages from division level to subordinate brigades is an indicator that something abnormal is happening, and, depending on how the messages are answered, or retransmitted to lower levels, might be a warning of impending attack.

So, while TA serves interception management, and can also serve cryptanalysts by providing information that supports the decryption of individual messages, it is an intelligence resource in its own right.

The lessons about TA as an intelligence source were largely forgotten in inter-war GC&CS. It’s not surprising: it had little need to do any sort of military Sigint before 1935 and was swamped with diplomatic traffic anyway; but it was a surprise to the First World War veterans who rejoined Sigint at the start of the Second, not least because they saw it as a natural way in to understanding enough about German networks to support the attacks on Enigma that were being developed. Although it took a while—the intelligence divisions of the service ministries didn’t see TA, indeed didn’t see anything other than cryptanalysis, as part of the GC&CS remit at first—TA became as important a producer of intelligence as cryptanalysis at Bletchley Park.

And so to BROWN. BROWN was the codename given to the Enigma key used by the German Air Force’s radio and research regiment. It was anomalous for such a relatively small unit to have its own key and a significant effort went into breaking it, something achieved in the autumn of 1940.

It remained important for the whole of the war, as new electronic equipments were always trialled by this regiment, so by continual monitoring, the development of radio communications six or more months hence could be inferred which meant that not only could intercept sites keep track of their targets, but also that the Royal Air Force could be warned of new electronic counter-measures developed for use against them.

The Regiment also had a significant involvement in the development of the directional beams used during the Blitz and of the V1 flying bombs and V2 missiles used in the last year of the war.

TA was immensely important in producing intelligence from BROWN (the Enigma key designator became the codeword for the whole of the BROWN network) for two reasons:

First, because only a small proportion of the encrypted material sent on the network was enciphered by Enigma: various medium and low-grade systems were used, many of which could be broken by the operators at stations. This meant that BROWN became much more of a team sport than most elements of Sigint against the German military, where the fragility of the successes meant that strict need-to-know was enforced on all involved. The BROWN TA team at Bletchley was a centre receiving inputs from all the different stations involved in intercepting the traffic.

The second reason, and one which made the input from operators at intercept sites so important, was that the operators on this highly sensitive German network were, individually and collectively, as insecure as any in the whole of the German Armed Forces, interspersing their activity with copious chat, discussing encryption in plain language, and, anyway, using easily breakable encryption for operational traffic.

This is the final part of TA: I described above the way communications systems are organised but at the heart of all of them is the individual operator, and the individual operator’s idiosyncrasies can be as valuable to the analyst as the result of direction finding, the radio-fingerprinting of his receiver, or the analysis of the callsigns used on the network.

Even today it is breath-taking to realise how insecure the operators were: using the first two letters of their surnames as part of their call sign; using the word KOPERNICUS to encrypt frequency information (K=1, O=2, P=3 etc)—this word was in use for three years—in a misguided belief that it offered some security; and, because the operators tended to be the same people who had encrypted (sometimes the ones who had composed) the messages they were sending, helping out their colleagues by telling them what the hidden indicators in the messages might be.

The importance of the intelligence being produced from the BROWN network meant that the response at Bletchley was comprehensive. At all times, one of the analysts on duty would be significantly experienced in the target and able to help, advise and develop newer members of the team. This is, perhaps, the final part of the BROWN jigsaw; a number of British analysts at Bletchley Park immersed themselves in the German network, and got to know the German operators, their idiosyncrasies, their practices, and even their personal lives, in sufficient detail that this knowledge became part of the attack on BROWN.

Collating all the material needed for TA was complex. At its heart was the Daily Story, some examples of which have appeared on our Twitter feed. These tabulated on a daily basis the activity of each group within the network, listed each active station, its location, the callsigns used (both the underlying basic callsign and its encrypted version, which changed daily), the frequencies, the times of activity (both scheduled and unscheduled), details of traffic passed, and the names and identifiers of operators along with their chat. Very unusually, these reports were circulated to intercept sites and ADI (Science) in the Air Ministry: elsewhere these ‘TA Notes’ would normally be retained within the analytic section itself.

Other records were kept as well: each edition of the Daily Story was indexed; a personality index was also kept; a separate ‘Hotel Register’ which indexed individuals at each location (important as operators were regularly deployed around the network on detached duty); a callsign book, which predicted the daily changing encryption of basic callsigns; a Frequency Index, which recorded frequency usage (and the referencing systems used for frequencies by the Germans) across the network; and a Regimental list, sorted as far as possible into companies, listing all identified personnel.

Unusually, most editions of the Daily Story from 1941 have survived. This is unusual because TA notes cease to have any value when the networks they describe are disbanded. It is the intelligence derived from them that has permanent value. I believe that the BROWN records survived (most other TA records were destroyed in autumn 1945) because it was thought possible that the Russians, who had captured BROWN-associated sites, equipment and personnel, might simply re-establish BROWN as a going concern to exploit German research.

Of course they didn’t, and the BROWN records, having survived destruction, followed the rest of GCHQ’s archives from Bletchley to Eastcote, from Eastcote to Benhall, from Benhall to Oakley. And when The National Archives in Kew made its decision about which part of the BROWN collection was of record value, and excluded the Daily Story, we loaned that part to the Bletchley Park Trust, where it is currently being digitised.

There is one last twist to this story. In 1945, Mrs Winifred Evans, writing up the BROWN Story for the SIXTA History (released last year to The National Archives) said:

“It should be realised that, to take only one example, all the information on the performance of (the) V1 which was possessed by the Cabinet Committee on Flying Bombs before the operational launchings was derived from low-grade cipher and TA on the Baltic Group … The significant cover on this group was at intercept stations not controlled by 3L and was obtained elsewhere by the personal influence of the Heads of SDE and 3G(N). This is a disquieting thought.”

The editors commented:

“The Sixta editors cannot completely agree with Mrs Evans’ lively and controversial conclusions. It is not strictly true that Enigma decodes contributed nothing substantial to intelligence after June 1942. 3(G)N are definite that there were many Enigma messages of great importance to the progress of their research, while it is quite clear that TA deduction and cryptographic success on low-grade traffic were both considerably assisted by the insight given by decodes of Enigma BROWN. 

“The Editors completely endorse, however, Mrs Evans’ final paragraph (ie the one above) to the BROWN Group’s History, and find the implied criticism of Control at once true and extremely disquieting."

This isn’t just a petty squabble being played out as people were waiting to be demobbed. What Mrs Evans meant was that as it carried relatively little Enigma traffic, Intercept Control at Bletchley Park, which controlled all intercept assets available, tried several times to detask BROWN even though the low-grade encryption was producing vital intelligence.

As early as 1942 the near-fetishization of cryptanalysis, a cast of mind in which people conclude that the level of encryption applied to a message is a direct reflection of its importance, was already rife: you can imagine people saying “If the Germans really thought BROWN was that important, they would have encrypted its communications with Enigma”.

BROWN survived because the links between the BROWN team and intercept sites meant that receivers could be “borrowed” at times when Intercept Control thought it wasn’t being collected at all, allowing team members to approach the Air Ministry and get high level support for collection to be resumed.

And it is another reminder that at its heart Sigint is about people: individual German communicators, working to plans drawn up by German communications managers, and sometimes disobeying regulations; individual British analysts swimming in the same sea as the German communicators and learning not only what they were saying but what they meant; and the individuals in authority at Sigint Headquarters trying to impose a structure onto the haphazard group of individuals who want to produce intelligence from their targets.

Today we can look back seventy-five years and see, as our predecessors saw, not just VE Day as Nazi Germany surrendered, but also a German Lieutenant, the last man standing on BROWN, who is out of cigarettes, and who, just as he is about to surrender to the British forces who are outside his building, closes down his network for ever.

"British troops entered Cuxhaven at 1400 on 6 May. From now on all radio traffic will cease - wishing you all the best. Closing down for ever - all the best - goodbye"