US government uses Swiss diplomatic network to communicate with Iran

(Updated: November 28, 2020)

A number of countries are connected to each other through bilateral hotlines in order to prevent misunderstandings and miscommunications in times of severe crisis. But what when there's a crisis between two countries that don't have a hotline?

Such a situation occurred after the United States killed the Iranian general Qassem Soleimani on January 3. Because there's no hotline between these countries, the US government used the Swiss diplomatic network urging Tehran not to escalate the crisis, as was reported by the Wall Street Journal.

The Swiss embassy in Tehran
(photo: FDFA - click to enlarge)

Intermediary since 1980

Already since 1980, when Iranian revolutionaries had seized the US embassy in Tehran and took 52 Americans hostage, the Swiss acted as a messenger (or briefträger) between the American and the Iranian government. The US appointed Switzerland as its "protecting power" in Iran and a special United States Interest Section was established in the Swiss embassy for handling informal contacts.

After the American invasion of Iraq in 2003, Swiss diplomats transmitted messages with Iran to prevent direct clashes and under president Obama Switzerland hosted the talks that led to the Iran nuclear deal from 2015. The Swiss ambassador in Iran regularly visits Washington to explain Iran's politics to officials from the Pentagon, the State Department and US intelligence agencies.

The Swiss embassy in Washington DC
(photo: keystone - click to enlarge)

The Soleimani crisis

Details about the informal contacts between the US and Iran have now been revealed by the Wall Street Journal (WSJ): immediately after Washington confirmed the death of general Soleimani on January 3, the US government sent a first urgent message to Tehran asking not to escalate the situation.

The Swiss ambassador delivered the American message by hand to the Iranian foreign minister Javad Zarif early on Friday morning, as the WSJ learned from US and Swiss officials. But Zarif apparently responded to the message with anger, saying that "[U.S. Secretary of State Mike] Pompeo is a bully" and that "The U.S. is the cause of all the problems."

Two days later, on January 5, Zarif called the Swiss ambassador asking to relay his response to the US government, which appeared more restrained. This was followed by a range of back and forth messages, "far more measured than the fiery rhetoric traded publicly by politicians", which for now seem to have helped prevent a military clash between both countries.

The Swiss diplomatic network

The message from the US government to Iran "arrived on a special encrypted fax machine in a sealed room of the Swiss mission" and the WSJ adds that this "equipment operates on a secure Swiss government network linking its Tehran embassy to the Foreign Ministry in Bern and its embassy in Washington. Only the most senior officials have the key cards needed to use the equipment."

Using the secure diplomatic communications network of a third party is a good option for exchanging sensitive messages between two countries, because it's not always possible to set up a direct communications link. One of the difficulties is that in order to encrypt such communications, both parties have to use the same algorithms and, obviously, countries don't like to share their crypto systems with others.

Similar to an official direct bilateral hotline, the back channel through the Swiss diplomatic network appears to be effective, because both parties "can trust a message will remain confidential, be delivered quickly, and will reach only its intended recipients. Statements passed on the back channel are always precisely phrased, diplomatic, and free of emotion" - according to the WSJ report.

The west wing of the Federal Palace (Bundeshaus) in Bern, Switzerland,
home of the Federal Department of Foreign Affairs (FDFA)
(photo: Mike Lehmann/Wikimedia Commons - click to enlarge)

Swiss crypto manufacturers

Switzerland's neutrality is not only useful for diplomatic negotiations, but was also an advantage for the manufacturers of crypto equipment.

One of the oldest companies was Gretag AG, which goes back to 1947. In 1987 most of its cryptographic business was split off and transferred to Omnisec AG, which had been founded especially for this purpose. However, the civil encryption machines as well as those for the Swiss government were sold to AT&T in 1991. Under a new owner, this product line was renamed to Safenet Data Systems, but the company declined rapidly and was liquidated in 2004.

Most of the business had already been taken over by Omnisec AG, which had become one of the most trusted crypto-companies in the world, selling its voice, fax and data encryptors to governments, armies and intelligence services. But gradually the market for proprietary Swiss encryption technology became smaller and smaller and so the company was dissolved in February 2018.

Another Swiss crypto manufacturer is Crypto AG, which was established in 1952 by Boris Hagelin for the activities of his original Swedish company AB Cryptoteknik. Crypto AG became one of the most famous companies in the crypto business, but there were also several allegations that it cooperated with intelligence agencies like the NSA and the German BND.

Update I:

On February 11, 2020, American and German news outlets revealed that in 1970, the CIA and the German foreign intelligence agency BND took over the ownership of Crypto AG, which provided them an easier access to the encrypted diplomatic and military communications of over 100 countries (the Swiss government always got the secure versions of Crypto AG's equipment though). In 1993, the BND sold its share to the CIA, which continued to run the company until 2018, when Crypto AG was sold to a Swedish entrepreneur.

Update II:

In November 2020, the Swiss broadcaster SRF reported that one of the largest competitors of Crypto AG, the Swiss manufacturer Omnisec AG, did the same and sold less secure fax and e-mail encryption devices from their 500-series even to Swiss federal agencies (including the secret services!) as well as to the UBS bank.

The Crypto AG Fax Encryption HC-4221
(photo: Crypto AG brochure)

Swiss fax encryption systems

Both Omnisec AG and Crypto AG produced devices for encrypting fax transmissions. Omnisec had the Omnisec 525 Fax Encryptor, which was available in 2007, while Crypto AG manufactured the Fax Encryption HC-4220, which was succeeded by the HC-4221 and was still available in 2011.

These aren't secure fax machines in the strict sense, but separate crypto devices, which encrypt the signals from a commercial fax machine before being transmitted through the public switched telephone network (PSTN). As can be seen in the photo, the HC-4220 was designed to put the actual fax machine on top of it.

Currently, Crypto AG offers the HC-9300 Crypto Desktop, which is a futuristic looking touchscreen device that performs the encryption of telephone, fax, VoIP and e-mail communications. This device is available at least since 2015 and is approved by the Technical Secretariat of the OPCW to be used for inspections for example.

Maybe the Swiss diplomatic network already uses the HC-9300 to secure its fax messages, but in general, government agencies tend to be rather conservative and stick to older versions, also because new crypto equipment has to undergo rigorous testing before it may be used to protect classified information.



See also:
- The hotline between Washington and the former German capital Bonn
- The Washington-Moscow Hotline

US military and intelligence computer networks

(Updated: September 12, 2025)

From the Snowden revelations we learned not only about NSA data collection projects, but also about many software tools that are used to analyze and search those data. These programs run on secure computer networks, isolated from the public internet. Here we will provide an overview of these networks that are used by the US military and US intelligence agencies.

Besides computer networks, they also use a number of dedicated telephone networks, but gradually these are transferred from traditional circuit-switched networks to Voice over IP (VoIP). This makes it possible to have only one IP packet-switched network for both computer and phone services. It seems that for example NSA's NSTS phone system is now fully IP-based.

US national networks    US multinational networks

An old NSTS telephone and a KVM-switch which enables switching between physically
separated networks, in this case two Unclassified (green labels), one Secret
(red label) and one Top Secret/SCI (orange and yellow label) network
(National Security Operations Center, 2006 - Click to enlarge)

US national networks

The main US military and intelligence computer networks are (of course) only accessible for authorized personnel from the United States. Special security measures are in place to prevent interception by foreign intelligence agencies. Most of the tools and programs used by NSA run on JWICS and NSANet, but here we only mention them when this is confirmed by documents.

DNI-U (Director National Intelligence-Unclassified)

- Until 2006: Open Source Information System (OSIS)
- Classification level: Sensitive But Unclassified (SBU, color code: green)
- Access: US intelligence users
- Controlled by: DNI-CIO Intelligence Community Enterprise Services office (ICES)
- Purpose: Providing open source information; consists of a group of secure intranets used by the US Intelligence Community (IC)
- Computer applications: Intelink-U, Intellipedia-U, EViTAP, etc.

Page of the Unclassified version of Intellipedia
This one from the CIA's AIN network
(Click to enlarge)

NIPRNet (Non-secure Internet Protocol Router Network)

- Classification level: Sensitive But Unclassified (SBU, color code: green)
- Secured by: Network traffic monitored by the TUTELAGE program and QUANTUM-DNS at the 18 gateways to the public internet *
- Address format: http://subdomains.domain.mil
- E-mail format: john.doe@mail.mil
- Access: US military users, via Common Access Card smart card *
- Number of users: ca. 4,000,000
- Controlled by: STRATCOM
- Purpose: Combat support applications for the US Department of Defense (DoD), Joint Chiefs of Staff (JCS), Military Departments (MILDEPS), Combatant Commands (COCOM), and senior leadership; composed of the unclassified networks of the DoD; provides protected access to the public internet.
- Computer applications: E-mail, file transfer and web services like the Joint Deployable Intelligence Support System (JDISS)
- Video Teleconferencing (VTC)

Cyber security officers in an operations center room at Barksdale Air Force Base
There are screens connected to NIPRNet (green background/border)
and SIPRNet (red background/border)
(Photo: U.S. Air Force/Tech. Sgt. Cecilio Ricardo - Click to enlarge)
More about this photo on SecurityCritics.org

SIPRNet (Secret Internet Protocol Router Network)

- Classification level: SECRET (color code: red)
- Secured by: TACLANE (KG-175A/D) network encryptors
- Address format: http://subdomains.domain.smil.mil
- E-mail format: john.doe@mail.smil.mil
- Access: users from multiple US intelligence agencies and government departments (and some foreign partners)*, via SIPRNet Token smart card
- Number of users: ca. 500,000 *
- Controlled by: STRATCOM (or JCS, NSA, DIA and DISA *)
- Purpose: Communications backbone for passing tactical and operational information, supporting the Global Command and Control System (GCCS), the Defense Message System (DMS), collaborative planning and numerous other classified warfighter applications, and as such DoD's largest interoperable command and control data network.
- Computer applications: Intelink-S, Intellipedia-S, TREASUREMAP, Joint Deployable Intelligence Support System (JDISS), Defense Knowledge Online, Army Knowledge Online, InfoWorkSpace (IWS), etc.
- Phone service: VoSIP (Voice over Secure IP) as an adjunct to the DRSN for users that do not require the full command and control and conferencing capabilities.
- Secure Video Teleconferencing (VTC)

Computers in the White House Situation Room, with a yellow screensaver,
indicating they are connected to a TOP SECRET/SCI computer network
(Screenshot from a White House video)

JWICS (Joint Worldwide Intelligence Communications System)

- Classification level: TOP SECRET/SCI (color code: yellow)
- Secured by: TACLANE (KG-175A/D) network encryptors *
- Address format: http://subdomains.domain.ic.gov
- E-mail format: john.doe@agency.ic.gov
- Access: users from multiple US intelligence agencies and government departments, for intelligence users via an IC PKI certificatie and for military users via a DoD PKI certificate.*
- Number of users: ca. 200,000 *
- Controlled by: DIA, with management delegated to AFISR
- Purpose: Collaboration and sharing of intelligence data within the US Intelligence Community (IC)
- Computer applications: ICE-mail, Intelink-TS, Intellipedia-TS, GHOSTMACHINE, ROYALNET, TREASUREMAP, ICREACH, Joint Deployable Intelligence Support System (JDISS), etc.
- Phone Service: DoD Intelligence Information System (DoDIIS) VoIP telephone system
- Secure Video Teleconferencing (VTC)

Web-browser with a JWICS address for the ROYALNET tool

These various military and intelligence networks run on a world-wide physical infrastructure that is called the Defense Information Systems Network (DISN), which is maintained by the Defense Information Systems Agency (DISA) and consists of landline, mobile, radio and satellite communication links.

Most of these communication links are not connected to the public internet, but because radio and satellite transmissions can easily be intercepted by foreign countries, the security of these networks is assured by encryption. This encryption can also be used to run higher classified traffic over communication links with a lower classification level through Virtual Private Network (VPN) tunnels.

Classified communications have to be protected by Suite A Cryptography, which contains very strong and classified encryption algorithms. On most networks this is implemented by using Type 1 certified TACLANE (KG-175A/D) in-line network encryptors made by General Dynamics:

(Diagram: General Dynamics)

As long there's the appropriate strong link encryption, only the end points with the computer terminals (where data are processed before they are encrypted) need strict physical and digital security requirements in order to prevent any kind of eavesdropping or interception by foreign adversaries.

Most American military bases are connected to the SIPRNET backbone, but for tactical users in the field, the SIPRNet and JWICS networks can extend to mobile sites through Satellite Communications (SATCOM) links, like for example TROJAN SPIRIT and TROJAN SPIRIT LITE, which consist of a satellite terminal that can be on a pallet, in a shelter, on a trailer or even connected to a transit case.


Other US goverment departments and intelligence agencies also have their own computer networks at different classification levels:

White House
- TNet (the main platform for White House aides to do their jobs; Top Secret; connected to JWICS)
- NICE (NSC Intelligence Collaboration Environment, a subdomain of TNet, managed by the Directorate for Intelligence Programs of the National Security Council; Top Secret/SCI)


FBI
- LEO (Law Enforcement Online; Unclassified, for law enforcement communications)
- FBINet (Federal Bureau of Investigation Network; Secret)
- SCION (Sensitive Compartmented Information Operational Network; FBI designation for Intelink-TS, Top Secret/SCI)


DHS
- HSIN (Homeland Security Information Network; Unclassified)
- HSDN (Homeland Secure Data Network; Secret)


State Department
- OpenNet (Unclassified)
- ClassNet (Secret; address format: http://subdomain.state.sgov.gov)
- INRISS (INR Intelligence Support System; Top Secret/SCI)


Department of Energy
- DOENet (DOE Corporate Network; Unclassified)
- ECN/U (Emergency Communications Network/Unclassified)
- ECN/C (Emergency Communications Network/Classified)


CIA
- AIN (Agency InterNet; Unclassified)
- CWE (Common Work Environment; Top Secret/SCI)
- ADN (Agency Data Network?; Top Secret/SCI)
- RDINet (Rendition, Detention, and Interrogation Network; for sharing classified information with SSCI staffers, est. 2009) *


NRO
- GWAN (Government Wide Area Network, also known as NRO Management Information System (NMIS); Top Secret)
- CWAN (Contractor Wide Area Network; Top Secret)


NGA
- NGANet (National Geospational intelligence Agency Network; Top Secret/SCI)

Finally, there's the Capitol Network (CapNet, formerly known as Intelink-P, with P for PolicyNet), which provides Congressional intelligence consumers with connectivity to Intelink-TS and CIASource, the latter being the CIA's primary dissemination vehicle for both finished and unfinished intelligence reports.

Overview of major Homeland Security computer networks
From a briefing for Congress, July 2004

US multinational networks

Besides the aforementioned networks that are only accessible for authorized military and intelligence personnel from the United States, there are also computer networks set up by the US for multinational coalitions, and which therefore can also be used by officials from partner countries.

The group of countries that have access to such coalition networks is often denoted by a number of "Eyes" corresponding with the number of countries that participate.

> See also: Five Eyes, 9-Eyes and many more

NSANet (National Security Agency Network)

- Classification level: TOP SECRET/SCI (color code: yellow)
- Secured by: TACLANE network encryptors *
- Address format: http://subdomain.domain.nsa (since 2007 replaced by nsa.ic.gov)*
- E-mail format: john.doe@nsa (see above)
- Access: US, UK, CAN, AUS, NZL signals intelligence users, requires polygraph examination *
- Number of users: ca. 30,000 *
- Controlled by: NSA, with management delegated to CSS Texas
- Purpose: Sharing intelligence among the Five Eyes partners
- Computer applications: InfoWorkSpace (IWS), WikiInfo, Tapioca, JournalNSA, SpySpace, Giggleloop, RoundTable, Pidgin, SIDToday, TREASUREMAP, MAILORDER, MARINA, TURBINE, PRESSUREWAVE, INTERQUAKE, CATAPULT, Cellular Information Service (WCIS), GATC Opportunity Volume Analytic, etc.
- Phone service: NSTS (National Secure Telephone System); newer NSTS phones are connected by fiber optic modems to a fiber backplane that interfaces with the NSANet service delivery point router.* In 2006, 45 NSTS phones were installed at the Department of Justice.

Web-browser with NSANet address for the INTERQUAKE tool, used by NSA's
Special Collection Service (SCS, organizational code: F6) units
(Click for the full presentation)

Besides NSANet as its general purpose intranet, NSA also operates several other computer networks, for example for hacking operations conducted by the TAO-division. We can see some of these networks in the following diagram, which shows how data go (counter-clockwise) from a bot in a victim's computer on the internet, through a network codenamed WAITAUTO to TAONet and from there through a TAONet/NSANet DeMilitarized Zone (DMZ) to data repositories and analysing tools on NSANet:

Diagram showing the data flow for TAO botnet hacking operations
(Source: NSA presentation - Click to enlarge)

PEGASUS

- Until 2010: GRIFFIN (Globally Reaching Interconnected Fully Functional Information Network)
- Classification level: SECRET//REL FVEY
- Access: US, UK, CAN, AUS, NZL military users
- Controlled by: DIA(?)
- Purpose: Information sharing and supporting command and control systems
- Applications: Secure e-mail, chat and VoSIP communications


STONEGHOST (also: Quad-Link or Q-Lat)

- Classification level: TOP SECRET//SCI
- Access: US, UK, CAN, AUS, NZL(?) military intelligence users, planned to be expandable to other coalition countries by 2024.
- Controlled by: DIA
- Purpose: Sharing of military intelligence information
- Applications: Intelink-C, etc.


SIGDASYS (Signals Intelligence Data System)

- Classification level:
- Access: SIGINT Seniors Europe (SSEUR/14-Eyes) members and their SISECT counterterrorism Analytic Working Group (AWG)
- Controlled by: SIGDASYS Committee
- Purpose: Shared communications system for
- Applications: Exchange of SIGINT information, including call chaining diagrams* and language files*


LOCE (Linked Operational-Intelligence Centers Europe)

- Classification level: SECRET//REL NATO
- Access: US and NATO forces and other national allied military organizations, with ca. 400 remote sites in the year 2000.
- Controlled by: European Command (EUCOM)
- Purpose: Sharing near-real-time, all-source, correlated situation and order of battle information in support of theater operations.
- Applications: Database and repository services, automatic sensor report correlation, electronic mail, imagery dissemination, graphical situation displays, and secure voice communications, but with limited bandwidth capability in the late 1990s.
- Initially named as Limited Operational Capability Europe.*


COSMOS (Coalition Secure Management and Operations System)

- Classification level:
- Access: US, Australia, Canada, Great Britain and Singapore members
- Controlled by: European Command (EUCOM) and Pacific Command (PACOM).
- Purpose: Set up around 2008 during Operation Iraqi Freedom (OIF) for rapid, secure release and protection of critical command and control (C2) information to and among coalition partners on a single and secure integrated coalition network to reduce confusion, uncertainty and delay in combat and crisis operations.*
- Applications:


CENTER ICE (since 2005)

- Classification level: TOP SECRET/SI
- Access: Afghanistan SIGINT Coalition (AFSC) members
- Controlled by:
- Purpose: Exchange of tactical intelligence, as well as tipping and threat information related to the war in Afghanistan *
- Applications:


CRUSHED ICE (since 2007)

- Classification level: SECRET
- Access: SIGINT Seniors Pacific (SSPAC) members
- Controlled by:
- Purpose: Exchange of counter-terrorism related information primarily derived from SIGINT
- Applications: Voice, binary-file/email exchanges, analysis and reporting, graphics and mapping, communities of interest, collection management, and other applications as needed.*


CFBLNet (Combined Federated Battle Laboratories Network)

- Classification level: Unclassified and SECRET
- Access: US, UK, CAN, AUS, NZL, and at least nine European countries Research & Development institutions
- Controlled by: MultiNational Information Sharing (MNIS) Program Management Office
- Purpose: Supporting research, development and testing on command, control, communication, computer, intelligence, surveillance and reconnaissance (C4ISR) systems.
- Applications: Communications, analytic tools, and other applications

The CFBLNet countries in 2009, with three of the Five Eyes countries (yellow line),
six European NATO countries and the NATO organization (black line),
six NATO guest nations (dotted line) and two non-NATO countries.
(source: NATO Education and Training Network (pdf), 2012)

CENTRIXS

For communications among the members of multinational coalitions, the United States provides computer networks called Combined Enterprise Regional Information eXchange System (CENTRIXS). These are secure wide area network (WAN) architectures which are established according to the specific demands of a particular coalition exercise or operation.

CENTRIXS enables the secure sharing of intelligence and operational information at the level of "SECRET REL TO [country/coalition designator]" and also provides selected centralized services, like Active Directory/DNS Roots, VoIP telephony, Windows Server Update Services (WSUS) and Anti-Virus Definitions.

There are more than 40 CENTRIXS networks and communities of interest (COIs) in which the 28 NATO members and some 80 other countries participate. The best-known CENTRIXS networks are:

CENTRIXS Four Eyes (CFE or X-Net)

- Classification level: TOP SECRET//ACGU
- Secured by: TACLANE network encryptors *
- Address format: http://subdomains.domain.xnet.mnf
- Access: US, UK, CAN, AUS military users
- Controlled by: DIA
- Purpose: Operational coordination through sharing and exchange of intelligence products
- Applications: Various services


CENTRIXS-ISAF (CX-I)

- Classification level: TOP SECRET//ISAF
- Secured by: TACLANE network encryptors *
- Access: ca. 50 coalition partners
- Controlled by: ?
- Purpose: Sharing critical battlefield information; US component of the Afghan Mission Network (AMN).
- Computer applications: Web services, instant messaging, Common Operational Picture (COP), etc.
- Voice over IP


CENTRIXS-M (Maritime)

- Classification level: SECRET ?
- Purpose: Supporting multinational information exchange among the ships of coalition partners of the US Navy to provide access to critical, time-sensitive planning and support data necessary to carry out the mission
- Computer applications: E-mail, Chat messaging, Webpages, etc.

Report from the Afghanistan Regional Command Southwest (RC(SW))
with a SIPRNet and a CENTRIXS e-mail address and webpage
(Full document in pdf format - Click to enlarge)

Some other CENTRIXS networks are:

CENTRIXS-GCTF
- Classification level: SECRET/REL TO [...]
- Secured by: TACLANE network encryptors *
- Address format: http://subdomains.domain.gctf.cmil.mil
- For the ca. 80 Troop Contributing Nations of the Global Counter-Terrorism Force (GCTF)

CENTRIXS-CMFC
- Classification level: SECRET/REL TO [...]
- For the Combined Maritime Forces, Central Command (CMFC)

CENTRIXS-CMFP
- Classification level: SECRET/REL TO [...]
- For the Combined Maritime Forces, Pacific (CMFP)

CENTRIXS-J
- Classification level: SECRET/REL TO [...]
- For the United States and Japan

CENTRIXS-K
- Classification level: SECRET/REL TO [...]
- For the United States and South-Korea

These CENTRIXS networks are part of a Mission Partner Environment (MPE), which is provided by the US Department of Defense to enable Mission Partners to share their command & control as well as operational information with all participants within a specific partnership or coalition.

INDOPACOM Mission Network (IMN)
- Classification level:
- Number of users: ca. 29,000 *
- Purpose: Initiated in 2023 for hosting command & control and mission applications to support joint, multi-domain operations with missions partners and allies. The first network with a native zero trust architecture (NZTA) and data centric security.*
- Controlled by: US Indo-Pacific Command (INDOPACOM)
- Applications: Email, Active Directory, web browsing, voice-over IP, video teleconferencing, real-time command and control, Palantir Mission Data Platform, Maven Smart System (MSS).*

The planned Mission Partner Environment (MPE) architecture for 2021
(source - click to enlarge)

Links and Sources
- Sofrep.com: Computers with Access to Classified Material Stolen from Capitol (2021)
- Department of Defense: Mission Partner Environment - LEXICON (2016)
- US National Intelligence: A Consumer's Guide (2009)
- Paper about How to Use FASTLANEs to Protect IP Networks (pdf) (2006)
- A NATO perspective on CENTRIXS (2005)