Rotors of M-209 cipher machine.

National Electronics Museum

National Electronics Museum

These are some pictures I took during a visit in the summer of 2004. The National Electronics Museum is next to BWI (Baltimore-Washington International) Airport, south of Baltimore. It's there because of the long Westinghouse (now Northrop-Grumman) presence in the area. It's staffed by volunteers, and is only open for limited hours. It used to be known as the Historical Electronics Museum. See: nationalelectronicsmuseum.org.

Leave the airport for the nearby cluster of hotels. Some large buildings on the left are labeled FANX. When the airport was much smaller and less busy, it was known as Friendship Airport. FANX stands for Friendship Annex, and the FANX buildings are NSA facilities. Turn right onto Nursery Road, away from the FANX buildings and going up the hill toward more of the hotels.

The museum is pretty obvious with the large antennas in the yard. It's at 1745 Nursery Road.

The antenna above the one holding the sign is a VHF array with 32 folded dipoles in front of a reflective screen.

The second antenna here is an interesting waveguide and slot array antenna.

VHF radar antenna at the National Electronics Museum near BWI airport.
Waveguide and slot microwave radar antenna.

Below is a more conventional air surveillance antenna and feed system.

I'm guessing that this is X-band (8-12 GHz) given the size of the waveguides.

Microwave air surveillance radar antenna and feed system.
AN/APY-1 radar antenna from an E-3A Sentry AWACS aircraft.

Above is the Westinghouse AN/APY-1 radar antenna from an E-3A Sentry AWACS aircraft. The radome is 30 feet in diameter and six feet thick, as this is a large antenna.

The AN/APY-1 has a range of more than 400 km for low-flying targets (basically the radar horizon at the E-3 operating altitude), and the pulse beyond-the-horizon radar has a range of approximately 650 km for vehicles at medium to high altitudes (above the radar horizon). This radar combined with a secondary surveillance radar subsystem eliminates ground clutter while providing a look-down detect, identify, and track capability on enemy and friendly aircraft.

The E-3 is based on the Boeing 707-320B Advanced commercial airframe. Just 68 E-3 aircraft were built in 1976-1991.

The USAF E-3 fleet was upgraded in 2001 in the Block 30/35 Modification Program with four enhancements:

First, Electronic Support Measures (ESM) for passive detection and identification of air- and surface-based emitters.

Second, the Joint Tactical Information Distribution System (JTIDS), an L-band (1-2 GHz) TDMA networked radio system for secure anti-jam communication for information distribution, position location and identification. It added high speed radar information exchange to TADIL-A Link-11, is also known as TADIL-J or Link-16.

Third, Increased computer memory for Link-16, ESM, and future enhancements.

And finally, GPS.

The same mission package has been built into the Boeing E-767 for the Japan Air Self Defense Forces.

The four engines also drive electrical generators providing one megawatt (!!) of electrical power required by the pulse Doppler radar and the crew life support system.

As equipped by USAF and NATO, the E-3 can fly for about eight hours or 6400 km without refueling. Newer models with CFM56-2 turbofan engines have a non refueled range of about 10 hours or 8000 km.

The eventual upgrade to the radar system provided computers programmed in high-level languages rather than assembler and, more significantly in terms of capability, a shift from 8-bit to 24-bit FFTs and 12-bit to 15-bit A/D converters.

Below are two AN/APG-68 radar units from F-16 fighters, and a look down one of the exhibit halls.

Two F-16 radar units.
National Electronics Museum display hall.

Below is a Hagelin M-209 cryptographic device with its cover opened, and another with the cover closed.

This was a portable, mechanical cipher machine used by the U.S. military in World War II, remaining in limited active use through the Korean War. It uses a wheel scheme similar to the Lorenz Cipher, a German system referred to by British cryptanalysts as "Tunny". It was therefore a stream cipher, generating a pseudorandom key stream that was XORed with the plaintext input.

Hagelin M-209 cryptographic device, used by the U.S. military in World War II.
Hagelin M-209 cryptographic device, used by the U.S. military in World War II.

The six adjustable key wheels each display one letter of the alphabet, specifying the key. This would superficially provide 266 = 308,915,776 possible keys.

However, the key wheels have different numbers of letters. From left to right they are:

  1. 26 letters: A-Z
  2. 25 letters: A-V, X-Z
  3. 23 letters: A-V, X
  4. 21 letters: A-U
  5. 19 letters: A-S
  6. 17 letters: A-Q

This provides the wheel sizes with a coprime nature, and the wheels only re-align in the same pattern with a period of every 101,405,850 enciphered letters (26×25×23×21×19×17). Moveable pins aligned with each letter on each wheel further increased the number of machine states.

Security was good for its time but imperfect. German cryptanalysts were able to break M-209 messages by early 1943. However, it was adequate for tactical use by the U.S. Army through the Korean War.

Dennis Ritchie of Unix and C/C++ fame collaborated on a 1970s ciphertext-only attack on the M-209 that could solve messages given only about 2000-2500 characters of ciphertext, but the NSA persuaded them not to publish it as foreign governments were still using Hagelin cryptosystems and the NSA wanted them to keep using that easily breakable system.

The M-138 manual cryptographic device is cryptographically equivalent to a disc-based system developed by Thomas Jefferson.

Click here to see Jefferson's device in the NSA museum and a description of its operation.

M-138 manual cryptographic device, cryptographically equivalent to Thomas Jefferson's disc-based system.
Enigma encryption device.

Of course they have the requisite Enigma device.

An array of early (1940s and before) aircraft radios fills one wall.

World War II aircraft radios.
APG-59 radar and DPN-53 BOMARC radar, the first use of airborne pulse Doppler technology.

The second picture above shows a Westinghouse APG-59 pulse Doppler fire control radar (at left) used in the F-4 Phantom II, and a DPN-53 CIM-10 BOMARC missile radar (at right), the first use of airborne pulse Doppler technology.

There are two Westinghouse AN/APG-68 radar units from F-16 fighters.

This is a pulse-doppler radar with a range of up to 300 km.

It has a main envelope frequency of about 9.86 GHz. The antenna provides a search cone of 120°×120°, with azimuth angular coverage of ±10° / ±30° / ±60°.

AN/APG-68 radar from an F-16.
AN/APG-68 radar from an F-16.

A waveguide feed system connects an AN/APG-68 radar from an F-16 fighter.

Also see my page of pictures from a visit to a World War II radar site in the U.K.

And, if you are interested in observations of the other side's radar, my minibus ride through a Syrian Air Force base.

Finally, the M.I.T. Radiation Lab Series on Radar System Engineering is available for free download as PDF here.

Other destinations: