The Long Life of Morse Code — and What It Still Teaches Security

Morse code is one of the oldest pieces of communications technology still in living use, and for a security audience it is unusually instructive: it is the clearest example of the difference between encoding and encryption, a window into how signals intelligence reads what it cannot decrypt, and a working model of the covert channel defenders still worry about today. Here is its long life, and the lessons that outlived it.

A short, general history for context — not a definitive account; dates are the commonly cited ones.

A very short lifetime of Morse

• Late 1830s–1844. Samuel Morse and Alfred Vail develop the electrical telegraph and the code of short and long marks that bears Morse’s name. In 1844 the line between Washington and Baltimore carries the famous first message.
• 1850s–1860s. The telegraph spreads worldwide; the International Telegraph Union forms in 1865 (today’s ITU). "International Morse" standardizes the variant used ever since.
• 1890s–1900s. Wireless telegraphy (Marconi and others) puts Morse on the airwaves — ships and shore stations can now signal without a wire.
• 1906. The Berlin Radiotelegraphic Convention adopts "SOS" as the international distress signal (in force 1908). Its unmistakable rhythm — three dots, three dashes, three dots — is chosen because it is easy to send and recognize under stress.
• World Wars. Morse (sent by hand key as continuous-wave, "CW") becomes the backbone of military radio. Crucially, it carried enciphered traffic — the secrecy came from the cipher, not from Morse. Signals intelligence flourished around it: even unbroken traffic yields intelligence through traffic analysis (who talks to whom, when, how much) and direction finding (where a transmitter is).
• 1999. The Global Maritime Distress and Safety System replaces Morse for maritime distress; official maritime Morse ends on 1 February 1999.
• Today. Amateur radio operators still use CW (the code-proficiency licensing requirement was dropped in the late 2000s, but enthusiasts kept it), and it survives as a resilient low-bandwidth fallback.

How Morse helped — resilience and the SIGINT it created

Morse’s enduring value is robustness at the lowest possible bandwidth. A human ear can pull a Morse signal out of noise far below the threshold where voice is intelligible; a single operator with a key and a weak transmitter can get a message through when nothing else works. That is a property security engineers still prize under a different name — graceful degradation: a channel that keeps working, slowly, when the rich channel fails.

It also shaped the entire discipline of signals intelligence. Because Morse is an open encoding, the interesting secrets were in the cipher it carried and in the metadata around it. The lesson is permanent and current: you can learn an enormous amount from traffic you cannot read. Volume, timing, endpoints and patterns — traffic analysis — leak intent even under strong encryption. Every modern conversation about metadata privacy and encrypted-traffic analysis is the same lesson, a century on.

How Morse evaded — and the covert channel defenders still watch

Because Morse is just on/off keying — signal present or absent, short or long — it can ride any medium a person or sensor can observe: a lamp, a torch, a buzzer, a tapped pipe, the blink of an indicator light. That flexibility made it a tool for signaling when radios were jammed or forbidden. It is also, in the security sense, a covert channel: a way to move information across a boundary that was not meant to carry it.

The modern form is data exfiltration from isolated systems. Researchers have demonstrated slowly leaking data out of air-gapped machines by modulating status LEDs, speakers, fans and other emanations — conceptually the same on/off or timing keying as Morse. The bandwidth is tiny, but a cryptographic key is tiny too. This is a real concern only for genuinely high-security, isolated environments, and the defenses are physical and monitoring controls, not a software patch: control line-of-sight and audio near sensitive systems, disable or cover unneeded emitters, monitor egress and emanations, and alert on anomalous timing. We walk through the detection side — defensively, with no working exfiltration code — in the Covert Channel Awareness Lab.

The three lessons worth keeping

1. Encoding is not encryption. Morse (like Base64 or ASCII) makes a message transmittable, not secret. Confidentiality is always a separate layer. Mistaking one for the other is a recurring real-world mistake.
2. Low-bandwidth, resilient channels are a feature. The thing that keeps working when the rich channel dies is worth designing for — in comms and in incident response.
3. Anything that can blink can leak. On/off keying over an observable medium is a covert channel; in high-assurance environments that is a threat model, not a curiosity.

Play with the ideas directly: the Morse Code Studio encodes and decodes with real audio and light playback, the Morse & Signals History Timeline maps the milestones above to their security lessons, and the Morse Code Translator is the quick text converter. Morse has outlived nearly every technology that was supposed to replace it — partly because the lessons it teaches never went out of date.

Educational, general history and guidance. Covert-channel material is framed for detection and defense only.