The NSA is good at keeping secrets, and its museum is here to tell you all about it.

National Cryptologic Museum

Annapolis Junction, Maryland

"You're looking at machines that changed history and this is the only place on earth where you can see them," said Vince Houghton, director of the National Cryptologic Museum. Humanity's course-diverging machines are not the airplane or the alarm clock, but boxes with toggle switches and names such as the Russian Fish, the Cryptanalytic Bombe, and the Biscuit-Maker. They created secret codes, or broke secret codes created by others.

Russian Fish: it spent years snooping on the Soviets.

The Cryptologic Museum -- which should not be confused with the very different Cryptozoology Museum -- is run by the National Security Agency (NSA). It opened to the public in 1993, closed, was gutted, then reopened on October 8, 2022. Its existence sometimes surprises people in the national intelligence community, who usually prefer to work in the shadows. But the NSA wanted to polish its image -- which has on occasion been tarnished -- and it had a giant (and still secret) warehouse packed with old equipment.

ENIGMA cipher machine: built by the Germans, broken by the Americans.

Vince -- an NSA employee with top secret clearance -- was given the task of going through that warehouse and creating a museum from the declassified machines that he found; a museum that the public would want to visit.

DARPA car: battles hackers to keep its driver on the road.

"We don't talk about the math," said Vince, stressing that the museum avoids codebreaking minutia and emphasizes the historical importance of the artifacts. "It's not about the machine. It's about what surrounds it," said Vince. "The vast majority of things in this museum are not just examples of things, they're the thing."

Despite the significance of these things, they were secret devices, never meant to be seen -- which meant that no effort was put into making them stylish or attractive. When you're staring at something that looks as if it belongs in an early 20th century shoe factory, you have to perform mental gymnastics to appreciate it: Hmmm... this metal box with dials and toggles may have saved the USA from falling to the Commies or the Nazis!

Top secret machines don't need to look pretty.

Take, for example, the Russian Fish, an ugly brick of a machine built by the Germans in World War II to intercept coded signals sent by the Soviet Union. It worked, but the Germans buried it when they lost the war. "We dug it up and said, 'What the hell is this?'" said Vince. "Then we grabbed some POWs from a nearby camp and said, 'Show us how to use this.'" For many subsequent years the Soviets believed that their transmissions were private, but in fact the Russian Fish was busily buzzing away, revealing their secrets.

Biscuit-Maker: churned out nuclear codes, not bakery products.

A more recent one-of-a-kind machine is the Biscuit-Maker, which produced little cards ("biscuits") that contained America's always-changing top secret nuclear launch codes. "You had to go through 15 different security checkpoints to get to it," said Vince. The Biscuit-Maker is topped by a rotating red light -- an odd accessory, we thought, for a secret machine. "That was so people's hands wouldn't get sucked in when it was operating," said Vince. "The last thing you needed was a nuclear code biscuit with part of someone's finger."

One uncharacteristically flashy artifact in the Cryptologic Museum is the DARPA car, built by the Defense Advanced Research Projects Agency. It's essentially a multi-million-dollar arcade game -- a stationary car with a video screen for a windshield -- pitting its cyber defense systems against a hacker who's trying to disrupt it. "He can take over your brakes, take over your steering, and all of a sudden you're driving off a cliff," said Vince. "It used to be that bad guys could only get in through your desktop computer; now it's through half the things in your house." The idea that hackers could kill us by commandeering our refrigerators (or automobiles) is unnerving, but Vince said that the lesson of the DARPA car is that the car (often) wins. "What this demonstrates is that there are people working on this," said Vince. "I think people walk away from this feeling better."

Depth Finder: cracked Imperial Japan's JN-25 code.

Can cryptology be fun? Among the museum's hands-on exhibits are two captured German ENIGMA cipher machines that visitors can use to exchange coded messages -- very popular with the public, according to Vince. And he labeled an empty showcase "NSA secret cloaking device" as a way to bring some levity to the displays. You'd think it would be difficult to create an entertaining attraction about one of the most clandestine organizations on the planet, but Vince said that the NSA only cared that he wasn't revealing any secrets. "Once it was clear that I wasn't, they said, 'Well, do whatever you want.'"

Vince noted that the NSA has a process to "sanitize" anything put on display, which made us wonder: how can visitors be certain that what they see in the National Cryptologic Museum is real? Wouldn't a spy agency have a plan in place to not only scrub, but alter the machines in its museum -- changing a gear here, a dial there -- so that any visitor with bad intentions would be tricked into believing something that wasn't true?

"We can neither confirm nor deny," said a chuckling Vince, slipping into the collective we. "There is no plan that we can tell you about."