AfterDawn: Tech news

FBI wants help cracking code in murder case

Written by James Delahunty @ 30 Mar 2011 4:00 User comments (25)

FBI wants help cracking code in murder case Crytoanalysts have struggled for 12 years on "encrypted notes" found on murder victim.
In June 1999, 41 year old Ricky McCormick's body was found in a field in St Louis, Missouri. On the victim were two notes in his pocket, written as some kind of code, that have so far defeated the Federal Bureau of Investigation (FBI) and others who have tried to crack them.

McCormick's family said that this was common for him, as he used to write coded notes since he was a boy and never revealed the secret to decipher them. The FBI believes the contents of the notes might have information about his whereabouts and activities in the days leading up to his murder, and are appealing to the public for help.

It is looking for "left-field" ideas on how McCormick may have encrypted the note that they never thought of, or samples of other notes written using unconventional methods. "We are really good at what we do," said Cryptanalysis and Racketeering Records Unit (CRRU) chief Dan Olson, "but we could use some help with this one."

Note 1



Note 2



For more Information: FBI.gov



Tags: FBI
Previous Next  

25 user comments

130.3.2011 16:38

throw it into google translate and tah da!
they are the lyrics to lady gaga's born this way

230.3.2011 19:14

Originally posted by jmex89:
throw it into google translate and tah da!
they are the lyrics to lady gaga's born this way
lmao that literally made me laugh

331.3.2011 01:07

they cant figure it out because there missing the cipher...the other piece of paper that tells what is what....or the intended recipient of the said note.

it could be a mixed language note scrambled P=T and what not

1/2 is obvious.

This message has been edited since its posting. Latest edit was made on 31 Mar 2011 @ 1:19

431.3.2011 03:31

Numbers don't seem to be part of the cipher. Working out the significance of the numbers in the second note could be revealing of the general content.

531.3.2011 06:52

Originally posted by Schmick:
Numbers don't seem to be part of the cipher. Working out the significance of the numbers in the second note could be revealing of the general content.
Actually I think its is probably most likely an ofset code, but possibly much more complicated than just char = + 5 step offset = new char however I think the decode cypher is there, look at both notes top right, both have 4 digit codes. Its a stab in the dark but my guess is this is the decode reference and the most logical place to put in for the decoder.

However it all depends on the lookup chart that was created, essentially if you created a really mixed up lookup chart and then ran 4 stage rolling offset or even took the 4 digit offset code and say added the first two references and added the second two and used those two new references to cycle char 1 then 2 and so on, maybe in blocks of two, three maybe alternating.

Another example would confirm if the 4 digits on both two rights of the notes was part of the decode key, does 4 digits always appear separated from the rest ?

The really interesting part for a decoders point of view is the relevance of the repeat of the code ncbe on page 1 it appears to indicate the end of a line termination as most lines have it in common.

Assuming that the most logical assumption would be ncbe resents a full stop, or that cbe or simply be represents a full stop and n or nc my represent a space in note one.

Note two it then appears where you would expect a full stop to normally be, you are getting SE as the most common line termination.

This again gives weight to the note also uses a unique decode for lookup and the possibility a real character is represented at points in pairs, at least for what you would expect as a line termination.

And lastly like Schmick looking at the codes i don't believe that numbers were included as part of the lookup or at least in the not the same way the character references were formed, this is given weight to be the use of the 1/2 reference in my mind.

Also 99.84.5 in note 2 (think its a 5 not an S) if so where on earth do numbers appear in this format xx.xx.x, the code clearly replaces spaces for a letter, but not here in the numbers...

Ummmm code cracking, got me interested now hehe :)

631.3.2011 07:23

Just looking again, if it is a 4 digit refrence code and we know that some lines are odd and some even, one logical explanation for this if it is a lookup system is it alternates between a 3 and 1 or a 3 and a 2 character encode, or something to the effec. Hence the number of actual characters in the line could produce either odd or even numbers.

Also possibly explains

Instead of a two digit reference system which or 4 or two digit reference (representation) system would always make even lines once encoded.

Additionally the encoder appears to have coded the notes top to bottom and using their right hand and writing left to right, so i don't believe the code is actually that sophisticated.

More lines in common note page 1 PRSEON appears 3 times, looking for prse it starts line 3 as well right at the start.

The other thing is the relevant of the over written characters, was this person just bad at writing their own code and randomly got some wrong, or could this be indication that not all characters are encoded alike from the fact they dont appear to be struggling to get the reference characters wrong, although at the moment i can find a correlation to the over written characters.

LOL anyway.... I think until another or more examples comes to light to see if there is a continuation of the repartitions or pasterns already show it will make it possibly to try a decipher.

But with two notes this short it makes it close to impossible to decode as without being able to draw more comparisons, your building one guess from another and nothing to test and substantiate it against.

Another good question that needs to be asked of his family is how long did it take him to write the notes, if he had to do the offsets purely in his head, instead of carry around a decode lookup chart (which was only made useful by knowing how the unique decode check/refrence/encode digits play a part and made the chart work.

731.3.2011 09:56
lissenup3
Inactive

"CALLING ALL NERDS"

831.3.2011 12:59

rot13

931.3.2011 13:06

Originally posted by shortybob:
rot13
Yeah i dont think so chap.

http://en.wikipedia.org/wiki/ROT13

1031.3.2011 13:37

The guy was right though...they really were out to get him...

111.4.2011 12:57

Looks like MS Windows activation keys. I say Microsoft did it.

121.4.2011 14:51

Quote:
Cryptanalysis and Racketeering Records Unit

What do cryptanalysis and racketeering have in common?!

131.4.2011 18:45

Originally posted by lissenup3:
"CALLING ALL NERDS"


Lol exactly XP

141.4.2011 23:36

Isn't it obvious? It's the PS3 METLDR keys. He was going to release them so Sony off-ed him.

153.4.2011 07:35
dgsdgsdfgsdf
Unverified new user

This does not need to be a proper code. If the only person meant to read it is the person who wrote it, then a lot of information could be left out. I sometimes just just write down enough to remember what I was thinking.

Lines 9, 10 11 could simply be a memory jogger for "First person", "Second person", "Third person" in the first note

The is the apostrophe on the last line of the first note. 194 WLD's just seems odd.

Both notes seem to end oddly. The first with TRFXL the second with TDRLX

Though the really odd thing is that line 1 of note 1 and line 6 of note 2 look the same to me. Couldn't those lines say the same thing?

164.4.2011 04:28

Lets say its a shift code. It may not be a regular type or something that can be derived by some algorithm. If for example he has say a 20/25 digit number thoroughly embedded in his memory. He can simply use that number to shift the characters chronologically by that number. The trick would be to do it entirely in memory and that too quite quickly.

A few years back I read somewhere that if you created a password protected zip file using something like 20/25 character alphanumeric + symbols password it would take several years for the then fasted Super computer to crack the code by brute force method.

174.4.2011 06:21

Umm but if he was remembering a 25 char master de-code key him self it would be useless having one so long as crypting and de-crypting would take forever.

However what could be possible maybe master code + possibly a short ref code from each crypt would then create a unique but short key to used for the offset.

However if it was just an offset code it would have been cracked now, so i can only conclude it probably does one of two things.

He had spoof charicters intended to confuse any de-cypher and he knew an alogorithem to introduce and remove them.

The offset system uses a modulating offset, however if this was the case the chance the numerious repitions shouldnt mathmatically happen in the frequency or length they do.

Its clear a space was either removed or replaced with a charcter or a number of characters.

Here is an idea, im going to try and type in the code so that i can try some stuff with running into a configurable script to test a few ideas, i will post back the text, if anyone could double check it for spelling haha :) then maybe we could actually try some of these de-code ideas.

184.4.2011 06:58

NOTE 1

(MADMKNEARSE-N-S-M-KNARE_ (ALSM)
0TRNENPLNSENPBSERCBBNSENPRSEINC
PRSENMRSE0PREHLDCNLDNCBE (TFXLFTCXLNLBE)
AL-PRPPITXLYPPIYNCBEMGKSEWLDRCBRNSEPRSE
WLDRCBRNSE NTOSNENTXSE-CRSLE-CLTRSEWLDNCBE
ALNCPNCBETSMELRSERLSEURGLSNEASNNLDNCBE
(NOPFSENLSRENCBE) NTEGDDMNSENCURERCBRNE
(TENE TFRNE NCBRTSE NCBE ING)
(FLRSE PRSE ONDE 71 NCBE)
(CDNSE PRSE ONFE 74 NCBE)
(PRTSE PRSE ONREDE 75 NCBE)
(TFNRCMSPSOLEMRDELUSETOTEWLDNWLDNCBE)
(194 WLD'S NCBE) (TRFXL)


NOTE 2

ALPNTE GLSE-SE ERTE
VLSE MTSE-CTSE-WSE-PRTSE
PNRTSEONPRSENLD NCBE
NWLDXLRCMSP NEWLDSTSMEXL
DULMT6TUNSENCBEXL

(MUNSARSTENM6NARSE)
KLSE-LRSTE-TRSE-TRSE-MRSRM-MRSE
(6AE6NSESENMRSE)
NMNRCBRNSEPTE2PTEWRCBRESE
36MLSE74SPRKSE29KCNO6OLE173RTSE
35GLECLGSEUKNUTREDKRSE PSESHLE
651MTCSEHTLSENCUTCTRSNMRE
99.84.5 ZUNEPLSENCRSEAOLTSENSRSENBSE
NSREONSEPUTSEWLDNCBE(JXORL)
ANMSENRSE1N2NTRCERCBRNSENTSRCRBNE
LSPNSENGSPSEMKSFRBSENCBEAUXLR
HMCRENMRENCBE 1/2 MUNDDLSE
D-W-M-YHPL XDRLX


corrections please :) ive tried to observe spaces where possible, typing it in makes me feel more like part of the decypt has to be a inserting code or replacement code due to the shear number of repeated things like NCBE in note 1 and note 2.

This means its likely he has a standard crypt for all notes and puts weight to the argument the cypher is not note unique.

I really wish we knew how long a note took him to write as it could give a real indication to how the notes were encoded based on the time to encode them.

I think someone said this above but like last line in note 1 its also good indication that even after de-cypher its likely abbreviation were the actual original text so even after decipher that didn't make to much sense.

However the relevance of NCBE starts me to think the actual content of information of notes maybe a fraction of the length of the encoded note, as single character insertions as replacement characters is a high possibility.

This message has been edited since its posting. Latest edit was made on 04 Apr 2011 @ 7:05

199.4.2011 13:48

Forgive my obvious straw clutching here, but...

Am I the only one who thinks it might be significant that the very last line "D-W-M-YHPL XDRLX" could have an extra W inserted to help keep the code from prying eyes, which if removed leaves D-M-Y (date-month-year). Maybe even with the W, it could be day-week (or wednesday) -month-year! Any idea the exact date and weekday he was killed?

Also, the line with "99.84.5" starts with 99, the year he was murdered. The 8 or 4 could be the month (April or August) while the other digit could be extra masking, making the 5 the date... perhaps he suspected or was told he was going to be killed and on a specific date (which we know is in June but murderers can't really be trusted ya know).

"1/2 MUNDDLSE" Muddles or unmuddles perhaps - indicating possibly an easier anagram based readable method for certain keywords (I agree, knowing he wrote these in minutes or hours could be crucial) - And lets be honest here, pretty much everyone is assuming that "PRSE ON" used repeatedly is PERSON (no need for complicated cryptanalysis to visualise that also). Which again brings us to numbers - 71, 74 and 76 - birth years for his attackers maybe?

Also, the "WLD'S" is intriguing for me too. Someone writing a cryptogram "generally" tries to avoid punctuation, and the fact that the 's is used on the end of word and the ' is "only" used there indicates for my money that the 's shows possessiveness. The three letters preceding it are WLD, which are used fairly frequently in the cipher (8 times), so could be a common sequence of 3 letters that could also be a name - or a nickname - such as "RED".

This message has been edited since its posting. Latest edit was made on 09 Apr 2011 @ 2:00

2018.4.2011 18:09

It's the code needed to travel through time and space. Great now 32 more yrs of waiting to travel back in time lol

2119.4.2011 08:15

Nooo its not Fry had it tattooed on his ass in Futurama's Bender's Big Score, its:

10110101011111....<POP> lol

2219.4.2011 09:01

Fry also became his own grandfather, which is a bit perplexing seeing how that is near impossible lol

2419.4.2011 09:56

After reading that Wiki, I have come to the conclusion that Adam and Eve were time travelers what somehow ended up at the beginning of time and started a slew of incest. We are now all screwed and the only way to get time corrected is to crack that FBI code, lol. Insert belief here, help us! Damn if I'll be a inbred from the swamps of someones experiment gone bad. LMAO

On a serious note: how long before I become a member and not just a noob?

This message has been edited since its posting. Latest edit was made on 19 Apr 2011 @ 9:57

2519.4.2011 23:50

Newbie to Junior Member -- 25 posts
Junior Member to Member -- 100 posts
Member to Senior Member -- 500 posts
Senior Member to Addict -- 2500 posts
anyone to Moderator -- determination and bribes to admins
anyone to Admin -- decent six-figure (euros or dollars, they are not picky) lump sum to AfterDawn's Swiss bank account

Also,posts made in the safety valve do not count.

Comments have been disabled for this article.

News archive