The countries that trusted bugged Swiss encryption devices

As shockwaves continue to radiate from the Swiss Crypto spying affair, analysis of export licences reveals how, at the first sign of trouble, countries around the world put their trust in supposedly secure Swiss encryption technology. 

Orders for Swiss-made encryption technology was recently analysed by the Neue Zürcher Zeitung (NZZ) newspaper in the aftermath of the revelations that the Zug-based firm Crypto was at the heart of a vast CIA spying operation. The NZZ examined related export licences issued by the economics ministry between 1997 and 2019.

During this period, the State Secretariat for Economic Affairs (SECO) approved a total of 40,000 exports of civil and military goods. Around 2,600 of these exports concerned technologies that enable the secure exchange of information. The vast majority of these exports concerned encryption equipment, as SECO confirmed to the NZZ.

Referring to industry experts, the newspaper stated that three Swiss companies were the main exporters. These included Crypto AG in Zug, which has been in the headlines for around three weeks because of its links to worldwide espionage operations.

“No sooner had a new trouble spot erupted somewhere than orders for the supposedly tamper-proof technology followed,” wrote the NZZ. If the encryption devices were manipulated, then the US secret service had an easy job – it just had to sit back and listen.

The NZZ divided the years analysed (1997-2019) into four distinct periods:

1997-2000: Six months after Hugo Chávez was elected president of Venezuela in spring 1999 SECO approved encryption technology exports worth CHF18.9 million to the Latin American country. The US is said to have played an influential role in the unsuccessful coup against Chávez.

2001-2008: During this period, the US (CHF14.4 million) and Libya (just under CHF10 million) were among the largest buyers of Swiss encryption technology. The 9/11 terrorist attacks took place during this period, and while the US was interested in deliveries prior to the attack, demand in Libya increased, particularly in the years after the attack.

2009-2013: The Arab Spring occurred during this period. Countries in North Africa and the Arabian Gulf region were among the largest customers during this period: Following the outbreak of protests in Bahrain in 2011, SECO approved the export of encryption machines worth CHF19.5 million to the Persian Gulf country. This was followed in 2013 by authorisations to Morocco (CHF13.4 million) and Jordan (CHF16.6 million), two countries where there were no uprisings.

2014-2019: Recently, the most extensive approvals concerned countries linked to the war in Syria and the emergence of the terrorist organisation Islamic State. SECO approved a particularly large number of exports to Saudi Arabia. The NZZ said deliveries of encryption technology from Switzerland had collapsed since 2018.