The SIGINT Background

by David A. Hatch with Robert Louis Benson

Table of Contents

Introduction .................................................................................................................................................. 2

The Korean War ............................................................................................................................................ 2

Background To U.S. Cryptology..................................................................................................................... 4

Cryptology in the Korean War National Priorities ....................................................................................... 6

The Initial Responses .................................................................................................................................... 8

The Language Problem ............................................................................................................................... 10

The Pusan Perimeter ................................................................................................................................... 11

The Chinese Enter the War ......................................................................................................................... 11

The Stalemate ............................................................................................................................................. 13

COMINT Innovations ................................................................................................................................... 14

Air Force Support ........................................................................................................................................ 15

War's End .................................................................................................................................................... 16

The Transition to NSA ................................................................................................................................. 16

Conclusions ................................................................................................................................................. 17

NOTES: ........................................................................................................................................................ 18

ACRONYMS ................................................................................................................................................. 19
Introduction
Since the revelation of the vital role of cryptology in World War II, the contribution of
communications intelligence (COMINT) and communications security (COMSEC) in
postwar conflicts has become a frequent question for many, particularly scholars and
veterans' groups.

This short summary of the cryptologic background to the Korean War is intended to
provide only a general overview of the conflict from a cryptologic perspective and give
initial answers to some of the more important questions about intelligence support.

This paper has been cobbled together from summaries prepared during or immediately
after the period of hostilities, some original documents, and the memories of some of
the participants. Some of the materials on which this history is based may not be
declassified by its publication date (June 2000). I have prepared the booklet in this
unusual manner in order to have a general history in time for the 50th anniversary of the
beginning of the war.

This booklet is therefore intended only as an introduction to the subject, an interim

history until further declassification allows the fuller history of cryptologic support during
the Korean War to be written. I would like to emphasize that much remains to be
researched and studied about cryptology in Korea and, in fact, I look forward to more
detailed studies of cryptology in the Korean War in the near future.

The Korean War

When it became clear in mid-August 1945 that Japan intended to surrender, U.S. policy
makers began to make arrangements for peripheral areas occupied by Japan. One of
the thorniest problems was the status of Korea.

The peninsula had been an independent nation for centuries before the Japanese took
it as a colony in 1910. In August 1945, Soviet forces were fighting the Japanese military
on the China-Korea border, and it appeared that the Red Army might occupy all of
Korea.

The U.S. solution was a temporary division of the country. Americans would take the
Japanese surrender in the southern sector, Soviet troops in the north. After a suitable -
but undefined - period in which Koreans would be prepared for self-rule, both armies
would withdraw. The Soviets agreed to this plan, and Korea was divided on either side
of the 38th parallel.

However, as the Cold War developed, the peninsula became a pawn in a larger,
international ideological struggle. After three years, the United States turned the
problem over to the United Nations, which mandated elections to decide on a unified

2
government in Korea. UN-sponsored elections led to the formation of the Republic of
Korea (ROK) on August 15, 1948, under President Syngman Rhee, with its capital in
Seoul. North Korea declined to participate in the UN elections and formed its own
government, the Democratic People's Republic of Korea (DPRK), with Kim Il-song as its
leader and its capital in Pyongyang.

The next two years were marked by struggle on many levels - military, political, and
ideological. Small unit clashes and armed incursions along the 38th parallel were
frequent. Both the ROK and the DPRK built military forces, but there was a difference:
the USSR supplied armor and aircraft to Pyongyang, while the U.S. denied them to
Seoul.

The USSR, as confirmed by the VENONA decrypts, which NSA released to the public in
1995-97, had stolen the secrets of the atomic bomb through espionage. Without
espionage it is inconceivable that the Soviets would have had their own atomic bomb by
the time of the Korean War. Several U.S. and British spies were able to keep the
Soviets abreast of U.S. and allied diplomatic, military, and intelligence activities well into
the Korean War period.1

The United States deliberately excluded South Korea from the defensive perimeter it
was drawing around the Pacific Ocean area. The ROK, said U.S. officials, should
depend on the United Nations for support.

Finally, in the early hours of June 25, 1950, the Korean People's Army (KPA) crossed
the dividing line in strength and began pushing southward toward Seoul. After some
initial resistance, the ROK Army gave way before the larger, stronger KPA, and retreat
became rout.

President Harry S. Truman and his advisers assumed the USSR had directed the attack
and that this was the opening move in a wider war. At that point, the U.S. reversed its
policy and intervened militarily to support the ROK. The U.S. persuaded the United
Nations to call for assistance in repelling North Korea's aggression, and a number of
other UN members sent troops or supporting forces.

After a period of retreat, General Walton Walker, in command of the U.S. Eighth Army,
stabilized the lines around a defensible area that came to be known as the "Pusan
Perimeter." Deployed largely along the meandering Naktong River, Walker moved his
forces quickly and astutely to blunt repeated North Korean attacks.

On 15 September 1950, a USMC/Army amphibious force, spearheaded by Marines,

striking according to General Douglas MacArthur's plans, conducted one of the greatest
feats of American arms ever, an amphibious landing behind North Korean lines at the
port of Inch'on. This operation, combined with a breakout from the Pusan Perimeter,
smashed the DPRK's military forces.

UN forces, primarily American and South Korean troops, crossed into North Korean
territory in pursuit of their retreating enemy, despite warnings from Communist China to
remain below the 38th parallel. In November, as U.S. and South Korean forces
3
approached the China-Korea border, the People's Liberation Army (PLA) struck them in
force, sending the UN army in a precipitous retreat southward.

In the spring of 1951, UN forces reestablished a stable line of resistance with the
communist armies at roughly the midpoint of the Korean peninsula. Both sides
entrenched. The Korean War continued for more than two years, but consisted largely
of limited offensive operations, characterized by only small gains and losses, to capture
or defend particular points of real estate. The strongpoints were designated officially by
their height in meters, but known popularly by colorful or poignant nicknames bestowed
by the GIs who fought over them - The Hook, Old Baldy, Pork Chop Hill, and Heartbreak
Ridge.

Once the lines had hardened, truce talks opened. The negotiations were first held in the
city of Kaesong, behind communist lines. This was unsatisfactory to the UN side, so the
meetings were moved to Panmunjom, an obscure village in "no-man's land."

The war ended in August 1953, after more than three years of combat, with the signing
of a truce agreement and the exchange of prisoners.

During the war and in postwar investigations, there were many charges that U.S.
intelligence had failed in the Korean War, not once, but twice. Critics charged that
American intelligence organizations had failed to give warnings of the initial North
Korean attack in June 1950 and failed again when the Chinese entered the war in
October 1950.

Background To U.S. Cryptology

In the late 1920s and early 1930s, the U.S. Army and Navy for the first time established
and operated permanent codemaking and codebreaking units. The cryptanalytic units
expanded at the outbreak of World War II, and the enhanced activity paid off in plentiful
and high-quality information on the Germans and Japanese - their location, armament,
and intentions. Working in close cooperation with Great Britain, U.S. military and civilian
decision-makers got accustomed to detailed inside information about their enemies (and
a few neutrals).

Allied exploitation of the German Enigma machine and other high-level German and
Japanese cryptographic systems is well known. Less known but also invaluable to the
war effort was U.S. and British exploitation of front-line systems to provide a wealth of
tactical information on their enemies' activities.

These decision-makers expected the same inside information after the war, but
encountered difficulties creating productive and cost-effective organizations. The
postwar period was characterized by contradictory problems - escalating requirements
for accurate information, rapid demobilization of skilled personnel, severe budget cuts,
the need for expensive processing machines, and a new adversary.

4
In the period prior to the Korean War, U.S. communications intelligence underwent
major structural and doctrinal changes. The Army Security Agency (ASA) had shared
the national COMINT mission with the Navy's Communications Supplementary Activity
(COMMSUPACT) - which became the Naval Security Group in June 1950. During and
after World War II, a portion of Army COMINT assets was dedicated to support of the
U.S. Army Air Corps, and, when the independent Air Force was created in 1947, these
cryptologic assets were resubordinated to the new organization as the Air Force
Security Service (AFSS).

Many officials favored centralization of cryptologic activities, and in 1949 the

Department of Defense created the Armed Forces Security Agency (AFSA) as a
national organization. AFSA, just by its existence, forced the Army and Navy to redefine
the organization and roles of their cryptologic services. The cryptologic agencies of all
three services began structuring themselves to provide direct COMINT support for
American fighting forces.

It was furthermore intended that AFSA eliminate duplication of effort among the Service
Agencies and get an economy of scale in research and purchasing. As it turned out,
however, AFSA did not have sufficient legal authority to provide central direction to
cryptologic work.

Because there had been no advance budgeting for AFSA in 1949, its financial needs
were met initially by reductions in the cryptologic budgets of the armed services.
Proposals for increases to AFSA's budget or personnel allocations were not approved.

In those lean budget times, even general requirements for support met with disfavor. In
April 1949, the U.S. Communications Intelligence Board (USCIB) requested $22 million
in funds, including 1,410 additional civilian employees, to expand the COMINT effort.
The secretary of defense returned the proposal for additional study. In June, the USCIB,
noting that intercept and processing resources were already overburdened even as the
military required more support, requested an interim supplement of $11.6 million, which
would include 705 additional civilian employees; this was endorsed by the Joint Chiefs
of Staff. The proposal, however, was disapproved by the secretary of defense because
of budget limitations.

This situation changed with the coming of war. Within a month of the North Korean
invasion, the Joint Chiefs of Staff approved the transfer of 244 officers and 464 enlisted
men to AFSA. They also recommended a large increase in civilian positions. In August,
the Department of Defense comptroller authorized an increase of 1,253 additional
civilian COMINT positions.

Given the administration's belief that the conflict in Korea was merely a part of what
could soon be a wider war, only a portion of the increase would go to direct support of
the conflict in Korea. But the increase would allow significant expansion of the effort to
support the war.

5
Cryptology in the Korean War
National Priorities
The Monthly Intelligence Requirements issued by the U.S. Communications Intelligence
Board reflected the generally low level of government interest in information on Korea.
The country was, after all, outside the U.S. defense perimeter in the Pacific region.

USCIB maintained two requirements lists. The first consisted of subjects of "greatest
concern to U.S. policy or security," such as "Soviet intentions to launch an armed
attack." On the second list were items of "high importance"; for the month prior to the
war, Japan and Korea were item number 15 on the second list, but this did not focus on
Korea itself. The specific requirements were "Soviet activities in North Korea," "North
Korean-Chinese Communist Relations," and "North Korean-South Korean relations,
including activities of armed units in border areas."

Intercept facilities in the Pacific region were relatively few. All were directed toward
higher priority targets, primarily Chinese Communist activities, but also including the
Philippine Huk rebellion. Only by diverting collection from existing ones could they cover
other intercept targets. Customers often gave no specific guidance to AFSA about
target priorities, and, left to its own devices, AFSA sensibly concentrated on those of
obvious great importance, primarily the USSR and the PRC.

AFSA directed an expanded effort against the People's Republic of China in early 1950.
This included increased intercept and cryptanalytic study.

ASA in the post-World War II period had broken messages used by the Soviet armed
forces, police and industry, and was building a remarkably complete picture of the
Soviet national security posture. It was a situation that compared favorably to the
successes of World War II. Then, during 1948, in rapid succession, every one of these
cipher systems went dark. Although the loss of these systems occurred over several
months (and none happened at the end of a week), U.S. cryptanalysts tended to lump
the disasters together under the dire designation "Black Friday."

Soviet intelligence had had an agent inside AFSA who had revealed the extent of U.S.
penetration of Soviet cipher systems. This was William Weisband, who had been
recruited by the KGB in 1934. During and after World War II, Weisband was involved in
the U.S. COMINT efforts, working (as a native speaker of Russian) in the Russian
section in ASA and, later, AFSA. Although in 1950 the FBI uncovered information
alleging espionage activities by Weisband in the early 1940s, he was never charged
with espionage - Weisband lost his job with AFSA and served a year in prison for
contempt of a grand jury.2

The U.S. cryptologic agencies took steps to recover, but this dreary situation continued
up to the Korean War, denying American policymakers access to vital decrypts in this
critical period. This was perhaps the most significant intelligence loss in U.S. history.

6
Some North Korean communications were intercepted between May 1949 and April
1950 because the operators were using Soviet communications procedures. Coverage
was dropped once analysts confirmed the non-Soviet origin of the material. These
messages, it should be noted, were not positively identified as originating from the
DPRK until after the war began and there was a basis for comparison with confirmed
Korean traffic.

In April 1950, ASA undertook a limited "search and development" study of DPRK traffic.
Two positions were assigned intercept of internal North Korean communications, and
approximately 200 messages were on hand at the time the war began, although none
had been processed.

COMMSUPACT monitored communications from some North Korean naval bases in

the period before 1950, but only because these were occupied by the Soviet navy.

As it happened, prior to 1950 there were two COMINT hints of more than usual interest
in the Korean peninsula by communist bloc nations, but neither was sufficient to provide
specific warning of a June invasion. In the spring of 1950, a Soviet network in the
Vladivostok area greatly increased its targeting of communications in South Korea.
Soviet targeting of South Korea was quite low until early February, then rose
dramatically after the 21st. This coverage continued at a very high level until 15 May,
when it ceased altogether.

In the second case, as revealed in COMINT, large shipments of bandages and

medicines went from the USSR to North Korea and Manchuria, starting in February
1950.

These two actions made sense only in hindsight, after the invasion of South Korea
occurred in June 1950.

COMINT, supported by information from other open and secret sources, showed a
number of other military-related activities, such as VIP visits and communications
changes, in the Soviet Far East and in the PRC, but none was suspicious in itself. Even
when consolidated by AFSA in early 1951, these activities as a whole did not provide
clear evidence that a significant event was imminent, much less a North Korean
invasion of the South.

In 1952, when personnel levels and a more static war allowed some retrospective
analysis, AFSA reviewed unprocessed intercept from the June 1950 period. Analysts
could not find any message which would have given advance warning of the North
Korean invasion. One of the earliest, if not the earliest, messages relating to the war,
dated 27 June but not translated until October, referred to division level movement by
North Korean forces.

7
The Initial Responses
The outbreak of the Korean War spurred significant increases in funding and personnel
for the U.S. national security establishment as a whole. The cryptologic agencies were
no exception.

In June 1950, prior to the beginning of the war, AFSA had had the equivalent of two
persons working North Korean analysis, two half-time cryptanalysts and one linguist. By
November 1950, AFSA had 36 people on the problem, 49 by early 1951, and 87 people
by March 1953. Prior to the Korean War, AFSA employed 83 analysts against the PRC;
by November 1950, the number was 131, and by February 1951 it was 156, plus
additional part-time assistance.

AFSA's chief of the Office of Operations, Captain Redfield Mason, USN, put the
processing units for Korean materials on a twenty-four-hour basis. He also enhanced
other operational areas that might produce information to support the war.

All available intercept positions in Japan were redirected to Korean collection. Some
Navy intercept operators in Japan worked with ASA Far East on Korean collection.
Even the 50th Signal Service Detachment, whose mission was to monitor U.S. forces to
ensure communications security, was diverted to wartime support.

A small advance ASA unit arrived in Korea in mid-September 1950 and was assigned to
combat support. The 60th Signal Service Company, based in Fort Lewis, Washington,
considered the best prepared of the existing tactical ASA units in the Far Eastern
Command, was dispatched to the war zone. It did not arrive, however, until early
October, three months after hostilities had commenced.

Initial COMINT product was the result of plain text intercepts and traffic analysis. In fact,
at many points in the conflict, traffic analysis, that is, the examination of message
externals, often constituted the only form of COMINT for Americans. Because of
problems with mountainous terrain, there was no steady or reliable information from
direction finding (D/F), which had been an important source of intelligence in World War
II.

COMINT production was hampered by supply shortages, outmoded gear, a lack of

linguists, difficulties in determining good intercept sites, and equipment ill-suited to
frequent movement over rough terrain. Until late in the war, most ASA trucks and radio
receivers were of World War II vintage. The U.S. military fought much of the Korean
War with equipment from the last big one; it is not surprising that intelligence
organizations also would have to make do.

In the earliest period, the intelligence produced was not appreciated by Eighth Army
officers. COMINT produced by AFSA or ASA was subject to restrictions on distribution
which prevented full exploitation of the information. Officers preferred COMINT
produced locally by Korean units which they took into service (see below). The
distribution problems were slowly rectified.

8
COMINT units moved in support of the fighting forces. The First Communications
Reconnaissance Company, which had arrived in Korea in October 1950, advanced into
North Korea with the Eighth Army. It became one of the last American units out of
Pyongyang during the Chinese counteroffensive. It eventually established a location for
itself in Seoul in early 1951.

The Air Force Security Service (AFSS) also responded rapidly to the crisis in Korea.
The AFSS had only been in existence less than two years, and had concentrated
primarily on organizational and doctrinal development; its field activities were minimal. It
had two mobile squadrons; the one in the Far East concentrated almost exclusively on
targets in the USSR and was configured to provide early warning of hostile activity
rather than provide tactical support in time of war.

AFSS instructions to its headquarters in Japan on 25 June were to devote two intercept
positions to the air activity in the conflict in Korea and increase reporting. On 27 June,
AFSS instructed its field office to "go into a full war alert status," with special attention
paid to Soviet actions, particularly any Soviet movement against Japan.

As soon as war broke out in Korea, AFSS headquarters in Japan dispatched a team to
recruit trusted South Koreans and establish a forward support unit in Korea. They found
that U.S. Air Force personnel in Seoul had already appropriated the services of a South
Korean COMINT unit (see below), the unit was already productive, and there was
nothing for the team to do. The crew returned to Japan.

During the Korean War, the Naval Security Group primarily monitored the activities of
Soviet forces in the Far East. Since the Soviets intervened in the war with air support,
there remained the possibility they might deploy ground or naval forces, or take
advantage of U.S. preoccupation to seek advantage elsewhere in Asia. The possibility
of Soviet intervention seemed great in the first days of the war, when elements of the
South Korean Navy fired upon a Soviet auxiliary vessel from Vladivostok.

Navy intercept also monitored Soviet reactions to U.S. ferret flights in the North Korean
region. This information was passed to U.S. Air Force units.

The Marines who fought in the Pusan Perimeter, landed at Inch'on, and advanced
deeply into northeast Korea did not have their own tactical COMINT support. Although
senior commanders likely had access to COMINT available at higher headquarters, it
appears, pending further research, that COMINT did not filter down to the Marines who
moved northward.

The Marine Corps had deployed tactical COMINT units for combat intercept late in the
Pacific campaigns of World War II, but these were demobilized or "downsized" after the
war. A Marine Radio Company, trained for COMINT support in wartime, was in
existence at Camp Pendleton in 1950, but was not deployed to Korea because it lacked
equipment and was not considered combat ready.

9
The Korean campaigns led to improvements in the 1950s. A USMC study of its Korean
War experience recommended enhancement of the Corps' tactical COMINT
capabilities. This was done in the years following the war.

The Language Problem

At the time the war began, only two Korean linguists were available to the Army Security
Agency, Youn P. Kim and Richard Chun, both assigned to the Army Language School
in Monterey, California. Y.P. Kim was from California, the son of Korean immigrants,
while "Dick" Chun had grown up in Hawaii. Both had served in World War II and had
been hired by ASA initially because of their Japanese language abilities.

Neither possessed a security clearance in June 1950. Y.P. had served as a cryptanalyst
and translator for the Army at Arlington Hall prior to 1945, but had relinquished his
clearance when assigned to occupation duty in Japan in the late 1940s. Dick Chun, as a
transportation sergeant in the Hawaiian National Guard - with service in Italy and the
South Pacific - had never had a security clearance and, in fact, knew nothing about
communications intelligence.

Dick Chun was sent to ASAPAC, first in Japan, then on to the Korean Peninsula. He
tipped ASAPAC off to Lieutenant Y.P. Kim, who was the more experienced linguist, so
when Y.P. arrived in Tokyo, expecting to join General Dean's headquarters, he was
diverted instead to ASA. (This was personally fortunate: the North Koreans mauled
General Dean's forces, and the general himself was taken prisoner).

AFSA began a vigorous training program in the Korean language. A few linguists,
stimulated by the emergency, taught themselves the language.

At the beginning of the war, not only linguists were in short supply, so were Korean-
language dictionaries. For that matter, no dictionaries had listings of North Korean
military terms - few linguists knew them, either. Working aids were developed over time
by contextual analysis and by comparison with Japanese and Chinese cognate words.

One solution to the problem for U.S. forces was to attach South Korean COMINT units
which had lost their parent organizations during the disorganization in the early period of
the war. The U.S. Army sponsored an ROK Navy unit, known from its leader's name as
the Kim Unit. The U.S. Air Force Security Service sponsored a similar unit from the
ROK Air Force, known also from its leader, the Cho Unit.

The Kim and Cho Units worked to support the U.S. military for the duration of the war;
they were given rations and military supplies in exchange for intercept and translation
work. The Americans at first drew on these units as language resources, but soon were
impressed with their discipline in collection and often were pleasantly surprised by their
cryptologic capabilities.

10
It was not until mid-1951, a year after the outbreak of war, that larger numbers of
Korean linguists arrived from the Army Language School. The problem of linguists,
however, was never adequately solved.

The Pusan Perimeter

Although UN forces equaled or outnumbered the North Koreans by July 1950, American
and South Korean troops were spread thinly over a wide defensive perimeter. Since the
KPA could choose the place and time of its attacks, initially it could put local superiority
of force into any battle. More than once the North Koreans came close to breaking
through American lines.

At this crucial stage, COMINT identified North Korean airfields, including timely
information on their construction and the disposition of aircraft, located distribution
centers for artillery ammunition, and reported the status of the North Korean supply
system. COMINT often gave General Walton Walker adequate warning of KPA
movements, allowing the Eighth Army Commander to move his own troops to meet
threats.

As UN forces pressed the KPA northward, COMINT followed the progressive collapse
of Army and other networks and the relocation of many air operations. By late October,
air force and coastal defense network activity had been reduced to "callups." Police
networks handled almost all the rest of DPRK government and military communications.
It appeared from COMINT that Supreme Headquarters had moved to Sinuiju, near the
Manchurian border.

The Chinese Enter the War

ASA and then AFSA had worked the Chinese Communist "problem" since 1945, but, prior to
the intervention of the People's Liberation Army in the Korean War, the effort was largely
confined to traffic analysis. With lives at stake, the need to provide new kinds of tactical and
strategic information, and provide it faster, led to greatly enhanced effort.
The cryptologic services had begun enhancing coverage of mainland Chinese targets
following the establishment of the PRC in October 1949. In March 1950, USCIB authorized an
increase in collection and processing against PRC communications, but it required nearly two
years to develop effective processing of PRC military messages.
Although it took time to develop capabilities against the People's Liberation Army (PLA), one
area of exploitation was available. In the postwar period, a team of Chinese linguists and
analysts at AFSA, under the leadership of Mr. Milton Zaslow, exploited Chinese civil
communications, i.e., general traffic which included personal cables as well as unencrypted
official messages. This effort was to assume unexpected importance as the possibility of
Chinese entry into the war loomed.
Based on translation and analysis of Chinese civil communications, in July 1950 AFSA
reported that elements of the Chinese Fourth Field Army had moved from Central China to
Manchuria in April and May. In early September, AFSA, again basing its reporting on Chinese
civil communications, stated that the PRC had continued to deploy major military units from

11
southern or central China to Manchuria. Throughout September and October AFSA noted
continued movement of these and additional forces toward the Sino-Korean border areas.
A message datelined Shanghai in mid-July identified General Lin Piao as the commander of
PLA forces which would intervene in Korea. Messages of late September 1950 told how Chou
En-lai, the PRC foreign minister, had warned diplomats from neutral nations that the PLA
would intervene in Korea if UN forces crossed the 38th parallel, the original dividing line
between the two countries. In a radiotelephone call, an East European reported from Beijing
in early November that orders had been issued allowing every Chinese soldier to volunteer to
fight in Korea, saying, "we are already at war here."
It has long been known that military and intelligence officials, in possession of considerable
warning from non-COMINT sources (usually referred to by COMINT-cleared readers as
"collateral"), decided either that the PRC was bluffing or that it did not matter, because the
time when Chinese intervention could be effective had passed. The reactions of U.S. leaders in
Washington, Tokyo, and Seoul to the COMINT indications of PRC intervention are not known
at this writing, and deserve closer study.
The PLA forces in North Korea attacked UN units on 25 October, then unaccountably broke off
contact for a month, despite large concentrations of Chinese troops in North Korea and along
the border. Many believe that the initial attack was a warning to UN forces to pull back.
COMINT does not shed light on this question.
However, COMINT in the month between the first Chinese attacks and their all-out offensives
which began in late November showed additional movement of Chinese troops toward
Manchuria. Messages in November continued to show Beijing in a state of emergency.
Messages from PRC civil communications of early to mid-November disclosed an order for
30,000 maps of Korea to be sent from Shanghai to the forces in Manchuria. Officials in the U.S.
Army's Military Intelligence calculated that many maps would supply thirty divisions. In late
November, the PLA attacked U.S. and allied forces with thirty divisions.
COMINT reports of early July 1950 noted that the Soviet air forces had established a
communication net in China to serve military and civilian aircraft at airfields in Korea and
Manchuria. After March 1951, intercept showed Soviet control of fighter activity in the
northernmost regions of Korea, as communist aircraft challenged UN air operations.
While in Pyongyang, General Walton Walker visited an ASA Company (where First Lieutenant
Dick Chun mistook him in the dark for another lieutenant - Walker made light of the error). As
Chun remembered, Walker was intrigued to read raw intercept; he requested that it be sent to
him instead of the summaries he had been receiving.
The 60th ASA, which was accustomed to operating out of trucks, mobilized its vehicles and
departed Pyongyang ahead of the Chinese. One team was sent ahead to Seoul to begin
operations before the other departed, so there would be no break in coverage. The second
team spent three days in the winter weather retreating southward to the capital city, then
further south as the Chinese pushed U.S./UN forces back.
Traffic analysis enabled U.S. analysts to follow the reestablishment of North Korea's armed
forces, first as they centralized at Pyongyang, then as headquarters moved elsewhere. By early
January, U.S. analysts believed the North Korean Air force had achieved operational levels
comparable to those in existence before it evacuated Pyongyang in October 1950.
UN forces recovered from the Chinese drive and by spring 1951 had reestablished a defensible
line in the waist of the Korean peninsula. The line of battle remained there for the rest of the
war.
12
The Stalemate
As the line stabilized in mid-1951, and COMINT support became more institutionalized, ASA
headquarters was established in the western suburbs of Seoul on the campus of Ewha College,
the largest women's school in Asia.3 The college was selected because it was on the periphery
of the capital, had Western-style buildings, and had suffered comparatively little damage in
the liberation of Seoul. Other COMINT activities were conducted in the neighboring Choson
Christian College (now Yonsei University).
Advance warning of impending attacks often was derived through analysis of
communications associated with PLA artillery preparations. Much of the initial
reconstruction of the PLA's order of battle (OB) came from traffic analysis. In May 1952,
intercept of a plaintext message allowed ASA analysts to reconstruct an almost complete PLA
OB.
In one instance, COMINT answered an important OB question. Senior commanders of the
Eighth Army wanted to confirm reports that the Chinese 40th Army, composed largely of
combat veterans, had crossed into Korea during the winter of 1951. The presence and location
of the PLA unit were confirmed by a North Korean message reporting that farmers had
complained about soldiers from the 40th Army stealing their rice! It is believed that this
message was couriered immediately to the Eighth Army commander, General Matthew
Ridgway.
The entrance of the Chinese armies in Korea renewed the language problem for the COMINT
units. Neither ASA nor AFSS had enough Chinese linguists. AFSS began training airmen in
Chinese through a program at Yale University.
It might seem that the large Chinese population of the United States would be a natural
source of linguists for ASA, but this did not work out as hoped. One particular problem was the
difference in dialect between PLA radio operators and American-born Chinese. Some help in
intercept and translation was obtained by hiring a limited number of Chinese Nationalists
from Taiwan as Department of the Army civilians. Some special training was needed here,
also, due to differences in military vocabulary between the Communists and the Nationalists.
The new war in Korea in 1951 was actually a Sino-Soviet intervention. Soviet pilots fought in
the skies over North Korea, although no Soviet infantry were committed to the conflict. This
created the need for Russian linguists with the ability to intercept tactical communications.
These individuals also were in short supply in AFSA and AFSS in 1951.
Once the battle line stabilized, U.S. forces instituted a rotation policy under which soldiers
earned "points" for service at variable rates according to their job and proximity to combat.
This rotation policy included ASA personnel and created a constant need to find replacements
and conduct training for linguists as well as other specialties.
Despite the problems, COMINT production continued and was appreciated. In encouraging
measures to enhance linguistic support, the Far Eastern Command told AFSA, "Korean
COMINT remains outstanding intel [sic] source here for MacArthur and Ridgway."
As the war settled into relatively static front lines and truce talks began, both KPA troops and
the People's Liberation Army improved their communications security procedures. This
resulted in a significant decrease in the quantity and quality of information available to UN
commanders, although the flow never ceased entirely.
COMINT supported the UN Command when truce negotiations began in July 1951. For
example, intercepts helped identify North Korean personalities who were participating in the

13
initial talks in the city of Kaesong. The support from these communications included
summaries of meetings and communist propaganda statements.
Some reports concerned the frontline situation and routine administrative matters. Typical
was a message to General Nam Il on defensive activities by UN forces.
On the other side of the world from the combat zone in Korea, COMINT assisted the war effort
by exposing Soviet spies in key positions. In Washington and London, Donald Maclean and Guy
Burgess, British diplomats, and some colleagues were able to provide the Soviets with detailed
information from the highest levels about U.S. atomic bomb stockpiles, U.S. and British policy
prior to the Korean War, war plans, and - perhaps most important of all - the restrictions on
U.S. commanders in Asia which prevented them from carrying the war to Soviet or Chinese
territory.
Maclean was exposed when cryptanalysts working on the VENONA project recovered and
translated enough messages about his work to identify him. Harold "Kim" Philby, a co-
conspirator with access to VENONA, warned him and Burgess; the two then fled to the USSR.
Despite the failure to arrest the conspirators, the leak of vital policy and intelligence secrets
was stanched.4

COMINT Innovations
The decline in more traditional methods of COMINT production forced the services into trying
new ideas, or, in one case, reverting to an older one.
In late 1951, in conditions reminiscent of France in 1917, ASA personnel inadvertently
rediscovered an intercept technique used extensively in World War I.5 UN forces in Korea
commonly planted sound detecting devices forward of their bunkers to give warning of
approaching enemy troops; it was found that these devices also picked up telephone calls. This
"ground-return intercept," using the principle of induction, enabled collection of some Chinese
and Korean telephone traffic.
The bad news was this intercept had to be conducted much closer to enemy positions than
normal intercept, sometimes as close as thirty-five yards. This risk was assessed carefully and
accepted.
Ground-return intercept (GRI) gave UN forces access to information on Chinese or North
Korean patrols, casualty reports, supply problems, and evaluations of UN artillery strikes.
One colonel who participated in the GRI program was heard to remark that the information
was so well appreciated by his soldiers that he had little trouble getting volunteers to go out
at night and implant the equipment to make intercept possible.
A second innovation in COMINT production became one of the foremost producers of tactical
intelligence for the U.S. military. This was low-level intercept (LLI).
Low-level teams initially consisted of an officer, driver, and one to three operators/translators
working out of a jeep; over time the number of operators increased. Although the mobile
operations were productive, the jeeps were considered too vulnerable, and operations were
"dug in" in bunkers near the main line of resistance, as it was then called. The product was
disseminated directly to combat units, usually at regimental level.
The first attempt at front-line LLI in July 1951 proved only partially successful, but, after some
changes in equipment, the program began in earnest in August. Seven LLI teams were fielded
by November 1951. By the following May, ten LLI teams were in operation, with planning for

14
more. The success of the program is attested by the fact that by October 1952, fifteen LLI
teams were at work, and by the end of the war, twenty-two LLI teams were active.
It was estimated that the tactical value of LLI product lasted from twenty minutes to three
days at best - but, however perishable, it paid off. In early September, units in the U.S. 1st
Cavalry Division area successfully repelled a heavy attack by the PLA. One important element
in this victory was the advance warning given by the 1st Cav's LLI team.
Because the LLI teams dealt in perishable and current intelligence, not much long-term
analysis was done - or possible. It thus became difficult to keep continuity on opposing units.
These problems were eased somewhat with the creation of an LLI "control section" at ASA
headquarters in Seoul in late 1951. This section collated reports from the field and service as a
reference source on language problems and OB questions.

Air Force Support

The Air Force Security Service continued support to the air during the period of stalemate.
The AFSS also adopted a number of innovations to provide new kinds of support for the air
war.
A good example of AFSS support occurred in June 1951. Analysts at an Air Force intercept site
were able to accurately predict a North Korean bombing raid on UN-held islands. This
intelligence enabled the commanding general of the U.S. 5th Air Force to ensure that the raid
was met with ample defense. One YAK and two IL-10 bombers were downed, several others
were damaged, and two MiG fighters were also damaged. It is believed that the commander of
the 5th Air Force may have been aware of the impending raid before the commander of the
North Korean attacking unit had received his orders.
In late April 1951, AFSS personnel intercepted messages that indicated aircraft of the 4th
Fighter Squadron were being boxed by Soviet aircraft. The quick relay of this information to
the flight enabled it to avoid the trap. This kind of warning continued through the war.
Soviet Bloc Air defense doctrine called for control of local fighter pilots by their tower. These
ground control intercept (GCI) communications were vulnerable to eavesdroppers.
At various periods during the air campaign, COMINT units from the AFSS were intercepting
North Korean, Chinese, or Soviet instructions to their pilots. These were disguised as "radar
plots" and forwarded in near-real time to U.S. pilots operating over North Korean territory.
When this source was exploited, the U.S. "kill ratio" over MiGs was quite high; during periods
of nonexploitation, the ratio was much lower.
Monitoring of North Korean, Chinese, and Soviet air communications was done from listening
posts in South Korea, but there were hearability problems for certain areas at different times
of the day. To solve these problems, in mid-1951 the AFSS established an intercept site on
Paengyong-do - commonly known as "P-Y-do" by Americans - a UN-held island close to the
west coast of North Korea. Since this was close to enemy territory, the security regulations
had to be relaxed, and 5th Air Force had to provide special evacuation service. Eventually the
Americans abandoned their effort on the island.
Once this activity on P-Y-do proved successful, in the spring of 1952 a similar operation was
undertaken on Cho-do, a UN-held island off the east coast of Korea, near Wonson. Lieutenant
Delmar Lang organized teams of linguists and personnel from the Tactical Air Control Center
to provide near-real-time information to pilots operating over North Korea. Del Lang, by the
way, used this operation as a model for similar activity during the Vietnam War.

15
Security Service also conducted airborne collection operations. In addition to support of the
war effort, these flights were useful in testing intercept equipment and general concepts of
operations.

War's End
Hill 395 was located at a strategic point in central Korea, and its loss would have endangered
other UN positions in that region. In October 1952, the Chinese attacked the hill, which was
defended largely by ROK Army units, with U.S. artillery and air support and French infantry. A
standard history of the Korean War notes that "pre-battle preparation, made possible by
effective intelligence, added to well-trained troops, skillfully employed, and backed by
coordinated air, armor, and artillery support, demonstrated what might be accomplished on
defense."6
The standard history could not say how good the intelligence really was.
Warning of the battle came first from an intercepted Chinese message, prompting ASA to
establish a field intercept site for tactical COMINT during the battle. Prior to the battle, this
site identified the Chinese units assembled for the attack, then accurately predicted the date
and time of the first wave. Low-level intercept kept the UN forces informed of the location of
Chinese units during the battle, and artillery fire was targeted on the basis of COMINT.
Hill 395 changed hands several times, but, at the end, the ROK Army 9th Division held it.
According to ROKA legend, the victors thought that war's devastation had reshaped the hill to
look like a White Horse, and Hill 395 acquired the nickname by which it is best known.
In March 1953, intercept revealed Chinese planning for offensives at Old Baldy and Pork Chop
Hill, two UN-held positions in central Korea. COMINT revealed troop movements and buildups
several days prior to the attack. On "D-Day" itself, a low-level intercept gave the defenders
warning that the attack would commence in five minutes. During the battle, intercept
continued to provide information for U.S. decision-makers.
Similar warnings and battle COMINT were received concerning the all-out attack on Pork
Chop Hill in July 1953.
COMINT provided warning of the final Chinese Communist Forces offensive of the war, at
Kumsong, directed primarily against ROK positions.

The Transition to NSA

AFSA's role in the Korean War was severalfold. It first did sophisticated processing not
available in the field, conducted long-term studies, and provided technical assistance. AFSA
also coordinated official tasking with the services to eliminate duplication of effort in
collection and analysis. Finally, AFSA worked with the services to standardize cryptologic
terminology and reporting vehicles.
The central cryptologic organization had been established in May 1949, just a year before the
Korean War began. AFSA's rapid response to wartime needs showed the professionalism of its
people and its commitment to the war effort. However, it should be remembered that at the
outbreak of war in Korea, AFSA was still in the process of sorting out its relationship with the
Service Cryptologic Agencies. It is not surprising the relationship was somewhat uneasy and
had some duplication of effort or other inefficiencies.
Despite excellent COMINT support to combat units, senior commanders, particularly those
who had enjoyed access to COMINT in World War II, were dissatisfied. AFSA, which was

16
supposed to be setting and maintaining standards of performance, came in for much of the
blame. General James Van Fleet, commander of the U.S. Eighth Army, one of the principal
ground units in the war, put it in writing:
It has become apparent, that during the between-wars interim we have lost, through neglect,
disinterest and possibly jealousy, much of the effectiveness in intelligence work that we
acquired so painfully in World War II. Today, our intelligence operations in Korea have not
yet approached the standards that we reached in the final year of the last war.
Much of this dissatisfaction centered on AFSA. At the same time, the senior officials of the
State Department and the Central Intelligence Agency also felt AFSA was less responsive to
their needs than it should have been.
Dissatisfaction over AFSA's performance in the Korean War was not the only reason for the
decision to reorganize American cryptology, but it clearly constituted one of the major
factors.
Based on the perceived problems, President Truman created a committee, headed by New
York lawyer George Brownell, to study the question of proper COMINT organization. The
Brownell Committee Report, submitted in June 1952, noted that
AFSA is dependent on the services for all of its direct interception of COMINT … and on Service
communications for all of its communications channels. However, none of the three Service
units is subject to AFSA control, except for the intercept positions under AFSA's operational
direction' by negotiated agreement, and AFSA has no power to compel elimination of
duplication of effort between them or to restrain them from engaging in activities that could
better be centralized in AFSA itself….7
The Brownell Committee suggested that the creation of AFSA could be seen as a "step
backward," and recommended that the power of the director, AFSA, to centralize COMINT be
increased.
In October, Harry Truman authorized a reorganization and renaming of AFSA, and in
November, the secretary of defense authorized the replacement of AFSA by the National
Security Agency.

Conclusions
The Korean War affected the U.S. cryptologic community in profound ways. When the war
began, the U.S. government had just established its first central cryptologic organization, the
Armed Forces Security Agency. This forced a sweeping reexamination of doctrine by the
service agencies, followed by changes to structure and procedures.
Even though five years had passed since the highly successful cryptologic activities of the
Second World War, little modernization had occurred in tactical support. In a time of lean
budgets, priorities were given to development and deployment of sophisticated machine
systems for making ciphers and for breaking them.
In the short term, after June 25, 1950, all four cryptologic agencies had to scramble to provide
what the fighting man needed. At the beginning of the war, this was done through the tested
methods from the Second World War. As more was needed later in the conflict, military and
civilian analysts innovated and discovered new ways to skin old cryptologic cats.

17
The Air Force Security Service was also a relatively new organization, but set a high standard
for support to the effort in its first war.
All the SCAs, plus AFSA, benefited from the presence of a nucleus - in some cases, a large
nucleus - of cryptologists who had seen service in World War II. They knew what was expected
of them and worked hard to deliver it.
In the long term, all four cryptologic agencies were the beneficiaries of the significant budget
increases to all sectors of the national security apparatus which the Korean War engendered.
And each of the agencies profited from the experience in this war.
The cryptologic agencies relearned the techniques and skills developed during World War II.
They also observed and revised their operational doctrines based on the needs of limited war.
Finally, perhaps a little sooner than officials might have liked, the concept of a centralized
cryptologic agency was tested under the direst of conditions. The policymakers were able to
observe strong points as well as weaknesses in AFSA and, eventually, create a newer, more
effective institution.
As Admiral Joseph Wenger, one of the architects of centralized cryptology, put it,
I firmly believe that had it not been for the invaluable experience we gained under the joint
coordinating plan in effect prior to the creation of AFSA and in the operation of the latter
agency, we would have had far more trouble in solving the early problems incident to NSA's
establishment than was actually the case. At the beginning of NSA's existence, we at least
knew, fairly certainly, what had to be done.
As in all of America's wars, however, the story of cryptology is not the story of brilliance in
collecting or processing messages, nor even about determining the most effective
organization. The purpose of wartime cryptology is to support the nation's objectives and to
save American lives. As in World War II, cryptology in Korea accomplished these critical goals,
and its contribution to the Korean War still shines and inspires.

NOTES:

1. These and subsequent paragraphs on espionage were written by Robert Louis Benson. For
further information on Soviet espionage, see Verne W. Newton, The Cambridge Spies (New
York: 1991) or Alan Weinstein, The Haunted Wood (New York: 1999).

VENONA is a coverterm of unknown derivation for the ASA/AFSA project to decrypt Soviet
espionage communications. The Soviet communications occurred during World War II and
were exploited in the late 1940s and early 1950s. They provided initial clues that allowed U.S.
law enforcement authorities to arrest a number of important Soviet spies before and during
the Korean War.

18
2. Robert Louis Benson and Michael Warner, VENONA: Soviet Espionage and the American
Response, 1939-1957 (NSA/CIA Publication, 1996).

3. Interestingly, during World War II, both the Army and Navy cryptologic organizations
established their headquarters in former girls' schools.

4. Yuri Modin, My Five Cambridge Friends (New York: Farrar Straus Giroux, 1994); Verne W.
Newton, The Cambridge Spies (New York, 1991).

5. For the World War I application of this intercept technique, see Ernest H. Hinrichs,
Listening In: Intercepting German Communications in World War I (Shippensburg, Pa.: White
Mane Books, 1996).

6. Walter G. Hermes, United States Army in the Korean War: Truce Tent and Fighting Front
(Washington: Office of the Chief of Military History, U.S. Army, 1966), 307.

7. Report to the Secretary of State and the Secretary of Defense, commonly referred to as the
"Brownell Committee Report," Special Research History 123, National Archives and Records
Administration, Record Group 457.

ACRONYMS
AFSA - Armed Forces Security Agency, founded in 1949
AFSS - U.S. Air Force Security Service, the U.S. Air Force COMINT organization
ASA - U.S. Army Security Agency, the U.S. Army COMINT organization
ASAPAC - Army Security Agency Pacific
COMINT - Communications intelligence (now known as SIGINT, i.e., signals intelligence)
COMMSUPACT - Communications Supplementary Activity, the U.S. Navy COMINT organization
DPRK - Democratic People's Republic of Korea
KPA - Korean People's Army
LLI - Low-level intercept
NSA - National Security Agency, successor to AFSA
OB - Order of Battle
PLA - People's Liberation Army
ROK - Republic of Korea
ROKA - Republic of Korea Army

19
SCA - Service Cryptologic Agency, i.e., ASA, NSG, AFSS
USCIB - U.S. Communications Intelligence Board

20