He was thirteen years old when he walked into a British intelligence office and told them they had a mistake in their coding system.

The receptionist laughed at him. A junior officer, passing through the lobby, decided on a whim to hear him out. He took Tommy to a small office, asked him to write down what he wanted to say, and offered him a biscuit.

What Tommy wrote was coherent. It was also correct.

His name was **Tommy Flowers Jr.** Born in 1930 in Camden Town, London. His father was a postal telegraph engineer. His mother was a seamstress. And from the time he could walk, it was clear to everyone around him that his mind did something unusual. He read entire books in a sitting. He memorised timetables for fun. By seven, he could multiply two five-digit numbers in his head. By nine, he was beating adults at chess. By eleven, he was working through university-level mathematics textbooks borrowed from a neighbour.

In 1942, with London still being bombed nightly by the Luftwaffe and his father serving in the Signal Corps, twelve-year-old Tommy spent a lot of time alone. His uncle, a telegraphist, sometimes brought home practice cipher sheets — training materials used to teach new operators how to encode and decode messages. He’d leave them on the kitchen table.

*Tommy started working through them. Just for something to do.*

He figured out the system in a few weeks. Within months, he had noticed something unusual — a structural flaw in the way the cipher’s key was generated. A mathematical vulnerability that, under certain conditions, would allow an attacker to predict parts of the key based on the length and timing of transmitted messages. He didn’t have the vocabulary of a modern cryptographer. He didn’t know he was describing what we now call a “key reuse attack.” But he could see the pattern clearly, and he could describe it in simple mathematical terms.

He told his uncle. His uncle told him to stop reading the practice sheets.

Tommy kept thinking about it.

In January 1944, with his father deployed to France in preparation for the D-Day landings, the thirteen-year-old boy decided the grown-ups needed to know. He took the bus to Whitehall. He walked into the first government building with a flag outside. He asked to speak to somebody who handled *”codes for the army.”*

The officer read what Tommy had written, went very pale, and made a phone call. **Within an hour, three senior analysts from Britain’s codebreaking service had arrived.** They questioned Tommy for two hours. They confirmed that the flaw he had described was real — and that, unknown to the public, the cipher had already been quietly phased out precisely because internal analysts had identified the same vulnerability six months earlier.

What shocked them wasn’t the discovery. *It was who had made it.*

They grilled Tommy about where he had learned cryptography. They searched his family’s flat. They interviewed his uncle, who was officially reprimanded. Tommy was given a very strict lecture about the Official Secrets Act. He was made to sign a document promising never to discuss the flaw, the cipher, the meeting, or his work with any civilian for the rest of his life.

Then they sent him home with a second biscuit.

And then — quietly — the British government kept an eye on him for the rest of his school career.

In 1946, at sixteen, Tommy was approached by representatives of what would become GCHQ and offered a position in their cadet programme. He accepted. In 1953, he joined the cryptography division full-time. He spent more than forty years as a professional codebreaker — working on Soviet signals intelligence during the Cold War, helping develop some of the earliest computerised cryptanalysis systems in the 1960s and 70s, writing training materials still used in modified form today.

Because of the nature of his work, he could not discuss any of it with his family. His wife knew only that he worked *”in government.”* His children believed he was a civil servant of some unspecified kind. When he retired in 1994, GCHQ gave him an internal farewell and a commemorative book he was not allowed to take home.

**Tommy Flowers Jr. died in 2019, at the age of eighty-eight.**

A heavily redacted GCHQ biography was released to his family after his death. That document is how we know about the 1944 incident at all. Tommy himself had kept his word — for seventy-five years.

Somewhere in the GCHQ archives is the original handwritten note. A thirteen-year-old boy’s precise, neatly lettered description of a cryptographic flaw that professional adults had found only six months before him.

They gave him a biscuit and told him to keep his mouth shut.

*And then, quietly, they waited for him to grow up.*


Source