It was posted by a shadowy organisation known only by its strange title: Cicada 3301.
The image of plain white text on a black background looked deceptively simple. It read: “Hello. We are looking for highly intelligent individuals. To find them, we have devised a test. There is a message hidden in this image. Find it, and it will lead you on the road to finding us. We look forward to meeting the few that will make it all the way through. Good luck.”
The message was signed: ‘3301.’
Only those directly involved know what the organisation is. The rest of the world is left to ponder whether it is some government agency, a global hacker collective, a terrorist or political group or a vast commercial enterprise. Shades of a super-rich 007 villain come to mind.
Perhaps there is a clue in the name Cicada 3301. The latter is a prime number while cicadas are moth-like insects that gather in multitudes like locusts. Cicadas disappear entirely for long periods, to reappear in vast numbers — amazingly — only in years containing prime numbers.
Cicadas are best known for their ear-piercing songs, which males use to attract females for mating. The ancient Chinese regarded them as powerful symbols of rebirth.
The most elaborate and mysterious puzzle of the internet age has attracted as many questions as answers. Was it an elaborate prank, a bit of fun, an ingenious PR stunt, a treasure hunt with booty supplied by a bored philanthropist or some recruitment test by the CIA or MI6?
Perhaps it was dreamed up by GCHQ, Britain’s intelligence agency that has already created an online codebreaking game in an attempt to find candidates with the right digital skills and mindset for 21st century espionage.
Almost immediately, encryption and IT security experts around the world went into overdrive. Many quickly identified the first hurdle as an example of steganography, the art of encoding hidden messages in such a way that no one — other than the sender and recipient — suspects its existence.
First employed by the ancient Greeks to warn of enemy advances, it has now taken digital form and is mostly used with image files. A skilled cryptographer can work out the code to produce a different image from the original.
It is sometimes used to concealing child pornography, drug dealing or other criminal activity. Al-Qaeda activists are suspected of using the device to plan the 9/11 attacks through the auction site eBay by hiding messages inside digital images.
The hidden message in this case turned out to be a JPEG image file. Those puzzle solvers who succeeded in breaking the code to alter the image were initially disappointed, being rewarded with nothing more than a picture of a rubber duck, and a message that read: “Woops, just decoys this way. Looks like you can’t guess how to get the message out.”
That may have been a decoy as Joel Eriksson, a 34-year-old computer analyst from Uppsala in Sweden, discovered. He encountered the duck after deducing that the puzzle might be a ‘Caeser cipher’, a code named after the Roman emperor Julius Caeser who used it to protect military correspondence.
It wasn’t. Surmising that a clue lay in the rejection message itself, he wondered why it contained the words ‘guess’ and ‘out’ — a combination that made the sentence clumsy.
He ran the duck’s teasing message through OutGuess, an encryption program, and discovered another hidden message linked to a message board on the popular Reddit news forum. Like peeling an onion, this led to more messages and clues that mutated hourly, making the challenge even tougher. It also posed a new riddle based on Mayan numerals.
By this stage, Eriksson was hooked. “If something is too easy or too routine, I quickly lose interest,” he says on his website www.clevcode.org.
This puzzle was neither.
For starters, unfathoming even the upper layers of the mystery demanded a knowledge of philosophy and classical music as well as an understanding of Mayan numerology, Welsh pagan poetry, the legend of King Arthur and the life cycle of the cicada insect.
Not for the fainthearted.
“I know that cicadas only emerge every prime number of years — 13, or 17 — to avoid synchronising with life cycles of their predators,” Eriksson explained to Britain’s Telegraph newspaper. “It was all starting to fit together.”
He believes that “by looking at the texts that were referenced, it is fairly obvious that they were not just randomly chosen. They seem to tell a story about the ideological grounds on which Cicada 3301 are based”.
Like Alice Through the Looking Glass, Eriksson and fellow cryptographers delved deeper and deeper into the labyrinth, discovering more clues, among them 14 GPS co-ordinates for locations in Warsaw, Paris, Seattle, Seoul, Arizona, California, New Orleans, Miami, Hawaii and Sydney.
Amateur sleuths discovered lo-tech posters pasted to lamp posts in each location, all bearing a QR bar code and a drawing of a cicada. When scanned by smartphones, the bar codes led to yet another web address.
If nothing else it proved that this was the product of a well-funded global organisation of brilliant people on a quest.
SO, who are these guys? Whoever they are, they’re extraordinarily talented, well-funded and organised. Some commentators have suggested that the whole exercise is an elaborate recruitment programme funded by commercial enterprise hunting for encryption and IT security experts.
Richard Rigby, director of intelligence at Cadre Consultants, a London-based IT security company, believes it comes down to virtual money.
“What cryptographic puzzles are out there right now that might be worth investing in?” he asks on the online journal Metro. His answer? “Bitcoins. That’s what Cicada 3301 is all about, and I would say that it’s funded by a large bank or private equity.”
Encrypted digital currency Bitcoin has surged in value this year. Individual bitcoins, of which only 21 million can ever be created, have to be extracted or ‘mined’. This has led to a digital gold rush among those keen to invest.
Rigby says: “Who can extract the most bitcoins before they all run out? Admittedly the race is expected to last 100 years, but what would be the value of that currency then compared to now?’
Bitcoins are created through a series of complex computations that, according to Rigby, are almost identical to Cicada puzzles. “It’s far too similar to be a coincidence,” he says.
“Now, if the top puzzle breakers in the world are found, it’s my belief that they are then recruited to become Bitcoin miners.”
The proliferation of wireless devices, mobile telephones, etc, means the demand for cryptologists has never been higher. If so, why choose 4chan, specifically ‘/b/’, the site’s infamous image-sharing board?
4chan was founded in 2003 by a 15-year-old named Christopher Poole, a New Yorker known online by the handle “moot”. Used mostly by teenage males or those in their early 20s, 4chan attracts more than 22 million page views a month and more than 1m unique visitors every day — almost as much as The New York Times website.
Signs are that millions of users of 4chan have already pooled their collective intelligence — and endless free time — to crack the puzzles.
The US National Security Agency is believed to use 4chan to scout for hackers.
A more sinister explanation may be that the anonymity of 4chan serves the interests of those behind Cicada 3301, suggesting that it may be an organisation controlling the route to the so-called ‘Darknet’, the hidden, murky underbelly of the internet that is said to be thousands of times larger than the ‘surface’ web.
It is the natural home of political activists and whistle-blowers as well as drug dealers, terrorists and human traffickers — all anxious to hide their digital tracks and keep their activities secret.
In the Darknet lurk credit-card scammers, currency and document forgers, weapons dealers, illegal gambling sites and marketplaces for every vice imaginable.
Some of those who have yet to make the code-breaking cut are poised for Jan 4 or 5 next when rumour has it they will be invited back down the rabbit hole with a new set of clues and given another chance at solving the puzzle.
Whether the nature and purpose of Cicada 3301 will then be revealed is anyone’s guess. “Maybe all will be revealed then,” says Eriksson. “But somehow, I doubt it.”