If a cipher seems to be a substitution cipher, the examining officer should look over the frequency of occurrence of each of the fifteen letters counted. If some letters (it is of no importance at present which ones) occur much more frequently than others and some occur rarely or not at all, we may safely decide on Case 4, 5 or 6 and let the clerk proceed to finish the frequency table for the message. On the other hand, if all the fifteen letters examined occur with somewhere near the same frequency--for example, the most common letter occurring not over three or four times as often as the least common letter--we may at once eliminate the first three cases and let the clerk proceed to examine the cipher for recurring pairs and groups, counting the intervening letters, so that the examining officer may decide whether Case 7, or some more complicated case, should be chosen. If something more complicated than Case 7 has been used and other ciphers are on hand awaiting examination, the cipher should go into the unsolved file to be worked on when other work permits, unless the contents of the cipher are believed to be very important. Every opportunity should be taken to clean up the unsolved file and, whenever a message is solved, the methods should be tried, if applicable, to everything remaining in the file. The first few days or weeks after the establishment of an examining office will be the most trying time. When solved ciphers begin to pile up, the methods of the enemy will be more and more apparent and it will often be possible to determine the method from knowledge of the name of the sender and receiver. When a cipher has been solved, the solution should be prepared in triplicate and given the serial number of the cipher. Any parts which are not clear, through errors in enciphering or in transmission, should be underlined or otherwise made conspicuous, so that the head of the Intelligence Section may note them and, possibly, from other sources, supply the deficiency. One of the copies of the cipher and report of examination, with a copy of the solution, should be turned over at once to the head of the Intelligence Section or to the Chief of Staff. The other copies of the solution should be filed with the original cipher, the report of examination, and all work done on the cipher. Periodically, say once a week or even daily at the beginning of active operations, there should be an interchange between all examining offices of solved messages involving new methods used by the enemy. All the examining offices will thus be kept in touch. It may also be possible to assign certain hostile radio stations to each examining office to prevent duplication of work. CHAPTER IV CLASSES OF CIPHERS There are, in general, two classes of ciphers. These are the transposition cipher and the substitution cipher.