05/05/2026
He was thirteen years old when he walked into a British intelligence office and told them they had a mistake in their coding system.
On January 20, 1944, Tommy Flowers Jr. handed a sheet of paper to the duty officer at a government building in London. “I think there’s a mistake in your coding system,” he said. “I’ve fixed it. Here’s the correction.”
The officer looked at the paper. Then looked at the boy. Then picked up the phone.
Within an hour, Tommy was sitting in a windowless room being questioned by three senior cryptographers from the Government Code and Cypher School — the same organization that housed Bletchley Park, Britain’s most secret installation.
They wanted to know how a child who had never been security cleared had found a flaw in one of the operational ciphers being used by British intelligence.
His name was Tommy Flowers Jr. — no relation to the famous Tommy Flowers who built Colossus, though history has sometimes confused the two. And his story is one of the most unusual footnotes of World War II codebreaking.
Tommy was born in 1930 in Camden Town, London. His father was a postal telegraph engineer. His mother was a seamstress. He was an only child, and by the time he could walk, it was clear to his parents that their son’s mind did something unusual.
He read entire books in a sitting. He memorized timetables for fun. He taught himself mental arithmetic so rigorous that by the time he was seven, he could multiply two five-digit numbers in his head. At nine, he taught himself the basics of chess and within six months was beating adults in local clubs. At eleven, he was reading university-level mathematics textbooks borrowed from a neighbor.
In 1942, when Tommy was twelve, London was still being bombed nightly by the Luftwaffe. His father was serving in the Signal Corps. His mother volunteered as an air raid warden. Tommy spent a lot of time alone in the family flat, or with his uncle, or in the underground shelters during raids.
His uncle worked as a telegraphist. He sometimes brought home practice cipher sheets — the training materials used to teach new operators how to encode and decode messages. He would leave them on the kitchen table. Tommy started working through them, just for something to do.
The cipher in question was a British military hand cipher — much simpler than Enigma, used for non-critical tactical communications in the field. But it was still a formal cryptographic system, taught only to authorized personnel, and not something a civilian child was supposed to know anything about.
Tommy figured out the system in a few weeks. Within a few months, he had noticed something unusual. There was a structural flaw in the way the cipher’s key was generated — a mathematical vulnerability that, in certain circumstances, would allow an attacker to predict parts of the key based on the length and timing of transmitted messages.
He didn’t have the vocabulary of a modern cryptographer. He didn’t know that what he was describing was what we now call a “key reuse attack.” But he could see the pattern clearly, and he could describe it in simple mathematical terms.
He told his uncle. His uncle told him to stop reading the practice sheets.
Tommy kept thinking about it. In January 1944, with the war at its most intense and his father deployed to France in preparation for the D-Day landings, the thirteen-year-old boy decided the grown-ups needed to know about the problem.
He took the bus to Whitehall. He walked into the first government building with a flag outside. He asked to speak to somebody who handled “codes for the army.”
He was initially laughed at by the receptionist. Then a junior officer, passing through the lobby, overheard the conversation and decided on a whim to humor the boy. He took Tommy to a small office, asked him to write down what he wanted to say, and offered him a biscuit.
What Tommy wrote was coherent. It was also correct.
The officer read it, went very pale, and made a phone call. Within an hour, three senior analysts from the codebreaking service had arrived. They questioned Tommy for about two hours. They confirmed that the flaw he had described was real — and that, unknown to the larger British public, the cipher in question was already being phased out precisely because internal analysts had identified the same vulnerability six months earlier.
What shocked the analysts wasn’t the discovery. It was who had made it.
They grilled Tommy about where he had learned cryptography. They asked him who his teachers were. They asked him if anyone had put him up to this. They searched his family’s flat. They interviewed his uncle, who admitted to bringing home practice sheets. The uncle was officially reprimanded, though not prosecuted.
Tommy was given a very strict lecture about the Official Secrets Act. He was made to sign a document promising never to discuss the flaw, the cipher, the meeting, or his work with any civilian for the rest of his life. He was then sent home with a second biscuit.
And then — and this is the part that most people don’t know — the British government quietly kept an eye on him for the rest of his school career.
In 1946, at age sixteen, Tommy was approached by a representative of the Government Communications Headquarters — what we now call GCHQ — and offered a position in their cadet program. He accepted. He trained as a signals analyst. In 1953, he joined GCHQ’s cryptography division full-time.
He spent the rest of his working life — more than forty years — as a professional codebreaker. He worked on Soviet signals intelligence during the Cold War. He helped develop some of the earliest computerized cryptanalysis systems in the 1960s and 1970s. He wrote training materials that are still used in modified form today.
Because of the nature of his work, he could not discuss any of it with his family. His wife knew only that he worked “in government.” His children believed he was a civil servant of some unspecified kind. When he retired in 1994, GCHQ gave him an internal farewell that involved a commemorative book he was not allowed to take home.
Tommy Flowers Jr. died in 2019, at the age of eighty-eight.
A brief GCHQ biography was published internally, and part of it — a heavily redacted version — was released to his family. That version is how we know about the 1944 incident at all. Tommy himself had kept his word, for seventy-five years.
Somewhere in the GCHQ archives is the original handwritten note — a thirteen-year-old boy’s precise, neatly lettered description of a cryptographic flaw that professional adults had found only six months before him.
They gave him a biscuit and told him to keep his mouth shut.
And then, quietly, they waited for him to grow up.
