How hard can it be? – Part 6: Flying blind

by Christian Rudolph

In Part 5 of this series I described the build of the Enigma-E kit and the manual decryption of the message I have been chasing since Part 1, with the caveat that the Enigma-E cannot decrypt messages encrypted with the UKW-D reflector, so Claude encrypted the message using UKW-C, based on the plaintext, and, expectedly but nevertheless excitingly, it came out precisely as Bletchley Park got it in November 1944. This scratched most of the intellectual itch that drove the entire project.

However, it now opened up something else. What had been an intellectual exercise is, of course, far more. This is a real message, sent by real people, after a real reconnaissance flight took place and had to be aborted due to engine trouble and bad weather. Are there things we can find out about this flight? What plane might have been used? Can we find out where it was stationed and perhaps even who the pilot was?

As this was specifically a reconnaissance flight in 1944, this narrows options down quite considerably. Typical reconnaissance planes were the Junkers Ju 88 and its successor Ju 188, the Messerschmitt Me 410A-3, the Focke-Wulf Fw 190 and the Messerschmitt Bf 109. These had different purposes, with the Bf 109 and the Fw 190 being mostly used for short-range/tactical reconnaissance, while the Me 410A-3 was used for fast long-range reconnaissance. Identifying the specific unit involved in the flight might help.

Once again I contacted Frode Weierud, who runs Crypto Cellar Research, and once again he exceeded my expectations. My initial assumption was that the "UDASO" at the end of the message was a call sign of the kind the Luftwaffe changed regularly – a rotating identifier designed to obscure the unit's identity. However, Frode told me that this was wrong. UDASO is an entry in a codebook: the Ersatzworte für den Funkverkehr – substitute words for radio traffic – a Luftwaffe codebook issued on 24 March 1944 and held at the Bundesarchiv. In that codebook, UDASO identifies a Nahaufklärungsgruppe: tactical close reconnaissance group. EINS ZWO is not ONE TWO, as I had initially assumed, but twelve. So, the unit the message came from is Nahaufklärungsgruppe 12 – NAGr. 12. A new version of the codebook was issued in December 1944; in that version, the same unit would have been identified as NOVIM. The November 1944 message uses the March version, which was still in force.

This is a detail that repays attention. The Enigma machine encrypted the content of the message. But the message also used a separate layer of encoding – the codebook – to obscure the identity of the sender. Breaking the Enigma cipher reveals the plaintext. Reading the plaintext still requires the codebook. Frode's identification gives us that second layer. The sender was NAGr 12: a short-range tactical reconnaissance unit, flying observation missions exactly like the one the message describes. In 1944, NAGr. 12 operated in the Balkans under Luftwaffenkommando Südost, with 1./12 at Mostar through October, and materials from the French defence archive from Mostar in spring 1944 specifically showed maintenance of a reconnaissance aircraft of I./NAGr. 12, which was a Messerschmitt Bf 109 G-6 or G-8. This makes perfect sense: the Bf 109 was commonly used for tactical short-range reconnaissance missions. NAGr. 12 moved from Mostar to Sarajevo-Butmir in October 1944. A Bf 109 G-6/8, despite a rather modest range, could readily have performed reconnaissance over the eastern Adriatic and returned – a mission that was, according to the message, cut short by engine trouble and bad weather.

There is an interesting problem here. When looking into the decryption of Enigma messages, many of the decrypted messages that are actively shown are highlights: messages with grave importance for the war. In fact, the first test message given in the Enigma-E manual – to verify that the machine is working correctly – is the infamous "DER FUEHRER IST TOT X DER KAMPF GEHT WEITER X DOENITZ X" message, which declared that Adolf Hitler was dead and that the military struggle should carry on under Dönitz, who briefly led the Flensburg government at the end of World War II in Europe. Measured against the importance of such messages, I interpreted the message of a reconnaissance flight over the Adriatic that lasted from 14:25 to 14:40 and was cut short due to engine trouble and bad weather as "someone had a bad afternoon" and paid no further attention to it, initially. And, to be clear, it is entirely possible that this is indeed all it was: someone really just had a bad afternoon.

However, there is a tantalisingly different interpretation. The message was displayed in one of the huts at Bletchley Park. It was not a facsimile; it was a constructed example of what an intercepted message would have looked like. But why this message? Was it selected at random? Or was it selected because it had played a specific role?

What was happening in the Adriatic on 1 November 1944

By the autumn of 1944, the German position in the Balkans was deteriorating rapidly. Partisan forces controlled much of the interior; the coastline was contested; withdrawal and evacuation had become priorities.

On this particular day, a substantial German operation was underway. Two corvettes – UJ 202 and UJ 208 – left Fiume at 16:00, sailing south. Simultaneously, a convoy known as Wikinger II was preparing to leave Šibenik heading north. Accounts differ on its departure time: some give 17:00, a more detailed German landing-craft chronology gives 17:45. The southbound escort and northbound convoy were intended to rendezvous.

The British were aware of it. Yugoslav Partisan intelligence had supplied Commander Morgan-Giles with information about German naval movements in the area. A British force including HMS Wheatland and HMS Avon Vale, with Coastal Forces craft, assembled at Ist. The operation was called Operation Exterminate.

It was not a simple intercept. Morgan-Giles deployed what was effectively a detection net: South African coastwatchers were landed on northern Rab, motor torpedo boats (MTBs) were sent into the Kvarner between Rab and Krk, and the remaining force was positioned further southwest near Premuda. The coastwatchers were landed at 19:50 – almost exactly the moment the MTBs first reported the southbound German corvettes.

By 20:15 the Germans had finally detected the British destroyers by radar, but it was too late. At 20:20, Wheatland and Avon Vale opened fire on UJ 202 and UJ 208, sinking both. Later that evening they encountered and sank the torpedo boat TA 20, another vessel of the Fiume-based escort force. Around 200 German sailors lost their lives.

One circumstance can be confirmed independently of any document: the weather was bad and getting worse. It subsequently became severe enough to prevent the British from recovering the coastwatchers from Rab for four days – consistent with the bad weather reported in the encrypted message.

The chronology

Assembling what can be stated with confidence:

• 14:25–14:40: NAGr 12 attempts reconnaissance in the Adriatic. Aborted after fifteen minutes: engine trouble and bad weather.
• 15:50 (local time, probably CET, so likely equivalent to 14:50 London time): The message reporting the abort is transmitted. Further reconnaissance is described as impossible.
• 16:00: UJ 202 and UJ 208 leave Fiume southbound.
• ~17:00: Morgan-Giles's force leaves Ist.
• 17:00–17:45: Wikinger II leaves Šibenik northbound (accounts differ).
• 19:50: British MTBs sight the two southbound German corvettes.
• 20:15: Germans detect the British destroyers by radar.
• 20:20: Wheatland and Avon Vale open fire.

When realising this timeline one question comes to mind immediately. Before the departure of a substantial naval movement, aerial reconnaissance of the route and surrounding waters would have made obvious operational sense. By timing and location it is entirely possible that the reconnaissance flight at 14:25 was meant to do just that. Not proof, of course. The orders for the flight would need to be examined to establish causation, but the timeline and location fit remarkably well. It would make the "someone had a bad afternoon" phrase an understatement, because the tactical implications might have been rather significant.

Three possibilities

The first is that the NAGr 12 sortie was directly connected to Wikinger II. The convoy was about to make a substantial northward movement; the Fiume-based corvettes were heading south to meet it. A reconnaissance of the Adriatic in advance of this movement would be operationally entirely logical. If the intended area included the convoy routes, the approaches to Ist, or the waters where Wheatland and Avon Vale were positioned, then the failure of the flight – and the grounding of further reconnaissance – was indeed consequential. The Germans sent ships into waters they had been unable to observe, and the British force was there waiting.

Nothing in the message establishes this. The message says Aufklärungsraum Adria – reconnaissance area: the Adriatic – which is a large body of water. It does not mention a convoy, a sector, or any specific objective.

The second possibility concerns what Bletchley Park might have done with the message, and here the cryptographic detail matters.

Frode Weierud's analysis of the message establishes that it used the pluggable Umkehrwalze D – the UKW-D reflector – rather than the standard UKW-B or UKW-C. What makes this significant is the nature of the security blunder involved, which Frode pointed out to me. The machine settings for this message – rotor order IV II V, Ringstellung G M Y, and all ten Stecker connections – were identical to those of regular messages sent under the standard daily key. The only difference was the reflector. The Germans were, in effect, treating the UKW-D as a simple add-on to the existing key: swap the reflector, keep everything else the same. Frode describes this as "almost unbelievable" as a security practice.

The practical consequence is this. The UKW-D wiring did not change daily. It was meant to change on the 1st, 11th and 22nd of each month. By late 1944, BP was processing approximately 3,000 Red network messages per day, and the Red key was broken so routinely that Hut 3 staff reportedly became irritated if the daily key was not available by breakfast. With that volume of traffic, cribs were abundant and the key was broken early. If BP had already broken the regular Luftwaffe key for that day – which was highly likely – then decrypting a UKW-D message required only the reflector wiring. The message was sent on 1 November, the first day of a new UKW-D wiring period, so the reflector wiring could in principle have introduced a delay. Whether BP had already recovered the new wiring by the time this message arrived is something I have not established, but it is entirely possible. However, what is not a possibility but a fact is that the message was decrypted in full by Bletchley Park. The plaintext is on the back of the sheet with the encrypted message, as per usual.

Once the message was decrypted, the question shifts to what happened next. BP's processing by this stage was industrialised. Messages passed to Hut 3, where the Air Section maintained extensive indexes of Luftwaffe units, locations, and operational activity, and a Watch assigned dissemination priorities – distinguishing routine administrative traffic from operationally significant material. A message concerning Adriatic reconnaissance, from a named unit, reporting current-day flying activity and an explicit statement that further operations were impossible, had exactly the kind of indexable content that could have been flagged quickly.

There is a prior condition, however. The Watch's ability to recognise the message's significance depended on knowing that a British naval force was operating in the Adriatic that evening. If BP had been briefed on Operation Exterminate, an Adriatic reconnaissance report transmitted the same afternoon would have had obvious operational relevance. If it had not, the same message might have been read, indexed, and filed – correctly processed but effectively invisible.

The message, once read, communicated something unambiguous: NAGr.12 had failed to obtain the intended current reconnaissance, and the message said that further sorties were impossible because of the weather. Importantly, this conclusion holds regardless of whether the flight was connected to the planned convoy movement or was pure coincidence.

The British operation was already underway on the basis of Partisan intelligence. But negative intelligence has its own value. Confirmation that this German reconnaissance effort had failed, and that no further sorties by the unit would be forthcoming, could still have been important. Whether this intelligence reached the people running Operation Exterminate in time is not established. The time zone matters here: if 15:50 local equates to 14:50 London, the window before Morgan-Giles's force sailed is somewhat longer than it appears. But this is where the evidence ends.

The third possibility is, as already pointed out, pure coincidence. NAGr 12 routinely flew reconnaissance missions over the Adriatic. The flight on 1 November was routine, unconnected to Wikinger II or any specific German operation. The weather happened to be bad. One mission failed. The message was intercepted and decrypted. None of it had any bearing on Operation Exterminate. The message is on display at Bletchley Park as an example of a Luftwaffe Enigma signal, interesting for its cryptographic content and nothing else. Somebody really just had a bad afternoon.

However, this brings me back to the fact that the message was selected to be on display in one of the huts at Bletchley Park. This does not prove that it was selected because of its connection to a specific operation. Documents are preserved and displayed for many reasons, and the message is genuinely interesting as a cryptographic exhibit regardless of any operational context. But the possibility remains open. A German reconnaissance unit attempted to observe the Adriatic on the afternoon of 1 November 1944, failed after fifteen minutes, and reported that further observation was impossible. About five hours later, a British naval force successfully intercepted the German escort force that was heading south to rendezvous with a northbound convoy in the same waters. The attack was a complete surprise.

A connection is, obviously, much more interesting than coincidence, even if coincidence cannot be ruled out. In scientific papers there is a lovely phrase for the explanation that currently seems to fit the observations best: the preferred hypothesis. Mine is that the flight, the convoy movement and the subsequent action are connected.

Preferred, however, is not the same as proven. At present the evidence gets me as far as an intriguing coincidence in time and place. To get any further, more information, such as the orders for that reconnaissance flight or evidence of what British intelligence made of its failure, would need to emerge. Until this happens it will simply remain my preferred hypothesis.

Similar and related blog posts:

• Part 1 of this series can be found here
• Part 2 of this series can be found here
• Part 3 of this series can be found here
• Part 4 of this series can be found here
• Part 5 of this series can be found here