FBI wants help cracking code in murder case

Crytoanalysts have struggled for 12 years on "encrypted notes" found on murder victim.

In June 1999, 41 year old Ricky McCormick's body was found in a field in St Louis, Missouri. On the victim were two notes in his pocket, written as some kind of code, that have so far defeated the Federal Bureau of Investigation (FBI) and others who have tried to crack them.



McCormick's family said that this was common for him, as he used to write coded notes since he was a boy and never revealed the secret to decipher them. The FBI believes the contents of the notes might have information about his whereabouts and activities in the days leading up to his murder, and are appealing to the public for help.

It is looking for "left-field" ideas on how McCormick may have encrypted the note that they never thought of, or samples of other notes written using unconventional methods. "We are really good at what we do," said Cryptanalysis and Racketeering Records Unit (CRRU) chief Dan Olson, "but we could use some help with this one."

Note 1

Note 2

For more Information: FBI.gov



Written by: James Delahunty @ 30 Mar 2011 16:00

• Previous article

• UK Gov-backed start-up website directs users to malware

• Next article

• Baidu deletes 2.8 million copyrighted works from online library

• 25 comments

• jmex89

  throw it into google translate and tah da!
  they are the lyrics to lady gaga's born this way
  

  30.3.2011 16:38 #1

• A5J4DX

  Originally posted by jmex89: throw it into google translate and tah da!
  they are the lyrics to lady gaga's born this way lmao that literally made me laugh
  

  30.3.2011 19:14 #2

• DXR88

  they cant figure it out because there missing the cipher...the other piece of paper that tells what is what....or the intended recipient of the said note.
  
  it could be a mixed language note scrambled P=T and what not
  
  1/2 is obvious.

  31.3.2011 01:07 #3

• Schmick

  Numbers don't seem to be part of the cipher. Working out the significance of the numbers in the second note could be revealing of the general content.
  

  ^ PEBKAC ^

  31.3.2011 03:31 #4

• plazma247

  Originally posted by Schmick: Numbers don't seem to be part of the cipher. Working out the significance of the numbers in the second note could be revealing of the general content. Actually I think its is probably most likely an ofset code, but possibly much more complicated than just char = + 5 step offset = new char however I think the decode cypher is there, look at both notes top right, both have 4 digit codes. Its a stab in the dark but my guess is this is the decode reference and the most logical place to put in for the decoder.
  
  However it all depends on the lookup chart that was created, essentially if you created a really mixed up lookup chart and then ran 4 stage rolling offset or even took the 4 digit offset code and say added the first two references and added the second two and used those two new references to cycle char 1 then 2 and so on, maybe in blocks of two, three maybe alternating.
  
  Another example would confirm if the 4 digits on both two rights of the notes was part of the decode key, does 4 digits always appear separated from the rest ?
  
  The really interesting part for a decoders point of view is the relevance of the repeat of the code ncbe on page 1 it appears to indicate the end of a line termination as most lines have it in common.
  
  Assuming that the most logical assumption would be ncbe resents a full stop, or that cbe or simply be represents a full stop and n or nc my represent a space in note one.
  
  Note two it then appears where you would expect a full stop to normally be, you are getting SE as the most common line termination.
  
  This again gives weight to the note also uses a unique decode for lookup and the possibility a real character is represented at points in pairs, at least for what you would expect as a line termination.
  
  And lastly like Schmick looking at the codes i don't believe that numbers were included as part of the lookup or at least in the not the same way the character references were formed, this is given weight to be the use of the 1/2 reference in my mind.
  
  Also 99.84.5 in note 2 (think its a 5 not an S) if so where on earth do numbers appear in this format xx.xx.x, the code clearly replaces spaces for a letter, but not here in the numbers...
  
  Ummmm code cracking, got me interested now hehe :)

  31.3.2011 06:52 #5

• plazma247

  Just looking again, if it is a 4 digit refrence code and we know that some lines are odd and some even, one logical explanation for this if it is a lookup system is it alternates between a 3 and 1 or a 3 and a 2 character encode, or something to the effec. Hence the number of actual characters in the line could produce either odd or even numbers.
  
  Also possibly explains
  
  Instead of a two digit reference system which or 4 or two digit reference (representation) system would always make even lines once encoded.
  
  Additionally the encoder appears to have coded the notes top to bottom and using their right hand and writing left to right, so i don't believe the code is actually that sophisticated.
  
  More lines in common note page 1 PRSEON appears 3 times, looking for prse it starts line 3 as well right at the start.
  
  The other thing is the relevant of the over written characters, was this person just bad at writing their own code and randomly got some wrong, or could this be indication that not all characters are encoded alike from the fact they dont appear to be struggling to get the reference characters wrong, although at the moment i can find a correlation to the over written characters.
  
  LOL anyway.... I think until another or more examples comes to light to see if there is a continuation of the repartitions or pasterns already show it will make it possibly to try a decipher.
  
  But with two notes this short it makes it close to impossible to decode as without being able to draw more comparisons, your building one guess from another and nothing to test and substantiate it against.
  
  Another good question that needs to be asked of his family is how long did it take him to write the notes, if he had to do the offsets purely in his head, instead of carry around a decode lookup chart (which was only made useful by knowing how the unique decode check/refrence/encode digits play a part and made the chart work.

  31.3.2011 07:23 #6

• lissenup3

  "CALLING ALL NERDS"

  31.3.2011 09:56 #7

• shortybob

  rot13
  

  31.3.2011 12:59 #8

• plazma247

  Originally posted by shortybob: rot13 Yeah i dont think so chap.
  
  http://en.wikipedia.org/wiki/ROT13

  31.3.2011 13:06 #9

• dEwMe

  The guy was right though...they really were out to get him...
  
  

  Just my $0.02,
  
  dEwMe

  31.3.2011 13:37 #10

• hermes_vb

  Looks like MS Windows activation keys. I say Microsoft did it.
  

  If I always hear voices surrounding me, does it mean I'm crazy or that I hear in Dolby 5.1?
  
  

  1.4.2011 12:57 #11

• dbminter

  Quote:Cryptanalysis and Racketeering Records Unit
  What do cryptanalysis and racketeering have in common?!

  1.4.2011 14:51 #12

• Cawthorne

  Originally posted by lissenup3: "CALLING ALL NERDS"
  
  Lol exactly XP
  

  Xbox 360 rules!

  1.4.2011 18:45 #13

• WierdName

  Isn't it obvious? It's the PS3 METLDR keys. He was going to release them so Sony off-ed him.
  

  Doesnt expecting the unexpected make the unexpected expected and therefore mean youre expecting the expected which was the unexpected until you expected it?
  "Opinions are immunities to being told were wrong." - Relient K

  1.4.2011 23:36 #14

• dgsdgsdfgsdf (unverified)

  This does not need to be a proper code. If the only person meant to read it is the person who wrote it, then a lot of information could be left out. I sometimes just just write down enough to remember what I was thinking.
  
  Lines 9, 10 11 could simply be a memory jogger for "First person", "Second person", "Third person" in the first note
  
  The is the apostrophe on the last line of the first note. 194 WLD's just seems odd.
  
  Both notes seem to end oddly. The first with TRFXL the second with TDRLX
  
  Though the really odd thing is that line 1 of note 1 and line 6 of note 2 look the same to me. Couldn't those lines say the same thing?

  3.4.2011 07:35 #15

• pmshah

  Lets say its a shift code. It may not be a regular type or something that can be derived by some algorithm. If for example he has say a 20/25 digit number thoroughly embedded in his memory. He can simply use that number to shift the characters chronologically by that number. The trick would be to do it entirely in memory and that too quite quickly.
  
  A few years back I read somewhere that if you created a password protected zip file using something like 20/25 character alphanumeric + symbols password it would take several years for the then fasted Super computer to crack the code by brute force method.

  4.4.2011 04:28 #16

• plazma247

  Umm but if he was remembering a 25 char master de-code key him self it would be useless having one so long as crypting and de-crypting would take forever.
  
  However what could be possible maybe master code + possibly a short ref code from each crypt would then create a unique but short key to used for the offset.
  
  However if it was just an offset code it would have been cracked now, so i can only conclude it probably does one of two things.
  
  He had spoof charicters intended to confuse any de-cypher and he knew an alogorithem to introduce and remove them.
  
  The offset system uses a modulating offset, however if this was the case the chance the numerious repitions shouldnt mathmatically happen in the frequency or length they do.
  
  Its clear a space was either removed or replaced with a charcter or a number of characters.
  
  Here is an idea, im going to try and type in the code so that i can try some stuff with running into a configurable script to test a few ideas, i will post back the text, if anyone could double check it for spelling haha :) then maybe we could actually try some of these de-code ideas.

  4.4.2011 06:21 #17

• plazma247

  NOTE 1
  
  (MADMKNEARSE-N-S-M-KNARE_ (ALSM)
  0TRNENPLNSENPBSERCBBNSENPRSEINC
  PRSENMRSE0PREHLDCNLDNCBE (TFXLFTCXLNLBE)
  AL-PRPPITXLYPPIYNCBEMGKSEWLDRCBRNSEPRSE
  WLDRCBRNSE NTOSNENTXSE-CRSLE-CLTRSEWLDNCBE
  ALNCPNCBETSMELRSERLSEURGLSNEASNNLDNCBE
  (NOPFSENLSRENCBE) NTEGDDMNSENCURERCBRNE
  (TENE TFRNE NCBRTSE NCBE ING)
  (FLRSE PRSE ONDE 71 NCBE)
  (CDNSE PRSE ONFE 74 NCBE)
  (PRTSE PRSE ONREDE 75 NCBE)
  (TFNRCMSPSOLEMRDELUSETOTEWLDNWLDNCBE)
  (194 WLD'S NCBE) (TRFXL)
  
  
  NOTE 2
  
  ALPNTE GLSE-SE ERTE
  VLSE MTSE-CTSE-WSE-PRTSE
  PNRTSEONPRSENLD NCBE
  NWLDXLRCMSP NEWLDSTSMEXL
  DULMT6TUNSENCBEXL
  
  (MUNSARSTENM6NARSE)
  KLSE-LRSTE-TRSE-TRSE-MRSRM-MRSE
  (6AE6NSESENMRSE)
  NMNRCBRNSEPTE2PTEWRCBRESE
  36MLSE74SPRKSE29KCNO6OLE173RTSE
  35GLECLGSEUKNUTREDKRSE PSESHLE
  651MTCSEHTLSENCUTCTRSNMRE
  99.84.5 ZUNEPLSENCRSEAOLTSENSRSENBSE
  NSREONSEPUTSEWLDNCBE(JXORL)
  ANMSENRSE1N2NTRCERCBRNSENTSRCRBNE
  LSPNSENGSPSEMKSFRBSENCBEAUXLR
  HMCRENMRENCBE 1/2 MUNDDLSE
  D-W-M-YHPL XDRLX
  
  
  corrections please :) ive tried to observe spaces where possible, typing it in makes me feel more like part of the decypt has to be a inserting code or replacement code due to the shear number of repeated things like NCBE in note 1 and note 2.
  
  This means its likely he has a standard crypt for all notes and puts weight to the argument the cypher is not note unique.
  
  I really wish we knew how long a note took him to write as it could give a real indication to how the notes were encoded based on the time to encode them.
  
  I think someone said this above but like last line in note 1 its also good indication that even after de-cypher its likely abbreviation were the actual original text so even after decipher that didn't make to much sense.
  
  However the relevance of NCBE starts me to think the actual content of information of notes maybe a fraction of the length of the encoded note, as single character insertions as replacement characters is a high possibility.

  4.4.2011 06:58 #18

• MrZoolook

  Forgive my obvious straw clutching here, but...
  
  Am I the only one who thinks it might be significant that the very last line "D-W-M-YHPL XDRLX" could have an extra W inserted to help keep the code from prying eyes, which if removed leaves D-M-Y (date-month-year). Maybe even with the W, it could be day-week (or wednesday) -month-year! Any idea the exact date and weekday he was killed?
  
  Also, the line with "99.84.5" starts with 99, the year he was murdered. The 8 or 4 could be the month (April or August) while the other digit could be extra masking, making the 5 the date... perhaps he suspected or was told he was going to be killed and on a specific date (which we know is in June but murderers can't really be trusted ya know).
  
  "1/2 MUNDDLSE" Muddles or unmuddles perhaps - indicating possibly an easier anagram based readable method for certain keywords (I agree, knowing he wrote these in minutes or hours could be crucial) - And lets be honest here, pretty much everyone is assuming that "PRSE ON" used repeatedly is PERSON (no need for complicated cryptanalysis to visualise that also). Which again brings us to numbers - 71, 74 and 76 - birth years for his attackers maybe?
  
  Also, the "WLD'S" is intriguing for me too. Someone writing a cryptogram "generally" tries to avoid punctuation, and the fact that the 's is used on the end of word and the ' is "only" used there indicates for my money that the 's shows possessiveness. The three letters preceding it are WLD, which are used fairly frequently in the cipher (8 times), so could be a common sequence of 3 letters that could also be a name - or a nickname - such as "RED".
  

  9.4.2011 13:48 #19

• Zeveroth

  It's the code needed to travel through time and space. Great now 32 more yrs of waiting to travel back in time lol

  18.4.2011 18:09 #20

• plazma247

  Nooo its not Fry had it tattooed on his ass in Futurama's Bender's Big Score, its:
  
  10110101011111....<POP> lol

  19.4.2011 08:15 #21

• Zeveroth

  Fry also became his own grandfather, which is a bit perplexing seeing how that is near impossible lol
  

  Dare to dream of a dream. Then wake up in a dream. There we will find our true destiny.

  19.4.2011 09:01 #22

• plazma247

  Its a Bootstrap paradox : http://en.wikipedia.org/wiki/Bootstrap_paradox

  19.4.2011 09:45 #23

• Zeveroth

  After reading that Wiki, I have come to the conclusion that Adam and Eve were time travelers what somehow ended up at the beginning of time and started a slew of incest. We are now all screwed and the only way to get time corrected is to crack that FBI code, lol. Insert belief here, help us! Damn if I'll be a inbred from the swamps of someones experiment gone bad. LMAO
  
  On a serious note: how long before I become a member and not just a noob?
  

  Dare to dream of a dream. Then wake up in a dream. There we will find our true destiny.

  19.4.2011 09:56 #24

• ddp

  Newbie to Junior Member -- 25 posts
  Junior Member to Member -- 100 posts
  Member to Senior Member -- 500 posts
  Senior Member to Addict -- 2500 posts
  anyone to Moderator -- determination and bribes to admins
  anyone to Admin -- decent six-figure (euros or dollars, they are not picky) lump sum to AfterDawn's Swiss bank account
  
  Also,posts made in the safety valve do not count.
  

  19.4.2011 23:50 #25