Science fiction and crime thrillers would have us believe that a mysterious cabal of hackers and cyber-criminals exist on a level hidden beneath normal society. From there they can exercise massive amounts of influence over the world, toppling governments or stealing vast amounts of money.
For the most part, we believe these cyber-groups are confined to the world of fiction, the product of the over-exaggerated minds of script-writers. However, there is a mysterious internet phenomenon which appears to be taken straight from the pages of a cyber-thriller. Indeed, just like The Matrix's Neo, it invites hackers and cryptographical experts to 'follow the White Rabbit', sending them on a strange and still unexplained journey. The enigma first emerged in 2012 and since then it caught the attention of technophiles around the world. No one knows who's behind it, and even more mysteriously no one knows why it has failed to emerge in 2015.
The curiosity, named Cicada 3301, appears to be a series of linear puzzles which are designed to be solved by members of the public. The stated intention of these puzzles, it seems, are to recruit "highly intelligent individuals" from the public, for a currently unknown reason. The puzzles always begin with a simple Twitter post linked to the Cicada 3301 'organization' - from there the puzzles go on a winding, bizarre journey through classical literature, art, mathematics, cyberpunk fiction, philosophy, stenography, Mayan numerology, computer cryptology and other diverse fields.
How Does It Start?
Each Cicada puzzle starts with a simple image (like the one above), often posted to the 1231507051321 Twitter account and usually on the 4th or 5th of January. The image itself is often seemingly plain and consists of a simple, sometimes cryptic, statement. From this point on, it is down to individuals, often working with others in the community, to solve the puzzle and reach the next step.
Initially, the above message, from the first 2012 competition, was posted to the /x/ board on 4Chan - a site popular amongst amateur hackers and their ilk.
Since the post claimed there was a hidden message within the image, solvers tried different methods to gleam additional information from the picture. By opening the image file in a text editor they discovered the following message: TIBERIVS CLAVDIVS CAESAR says "lxxt>33m2mqkyv2gsq3q=w]O2ntk".
The mentioning of Caesar suggested to many this was some kind of Caesar cipher - a simple cryptology method which involves substituting one letter with another letter at a fixed point further down the alphabet. The random text also appeared to be a URL. When this was entered into a web browser, the following image appeared:
Although this might look like a dead end, the inclusion of the words 'guess' and 'out' led solvers to an old universal steganographic tool called OutGuess. Running the image through OutGuess led to another hidden message which included a 'book code' and directed the solver to a Reddit thread.
Things Start To Get Tougher
Up to this point, the amount of cryptological and stenographic skills required was relatively simple, however it was about to jump up in difficulty. The Reddit thread appeared to consist of a series of encrypted lines of text posted by CageThrottleUs, as well as two images titled "Welcome" and "Problems."
Passing these images through OutGuess also conjured up two more messages. The message within 'Welcome' stated:
-----BEGIN PGP SIGNED MESSAGE-----
- From here on out, we will cryptographically sign all messages with this key.
It is available on the mit keyservers. Key ID 7A35090F, as posted in a2e7j6ic78h0j.
Patience is a virtue.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
[Lengthy PGP SIGNATURE, which ensures authenticity of the sender]
-----END PGP SIGNATURE-----
The message within 'Problems' stated:
-----BEGIN PGP SIGNED MESSAGE-----
The key has always been right in front of your eyes.
This isn't the quest for the Holy Grail. Stop making
it more difficult than it is.
This directed solvers to the Reddit header which consisted of Mayan numbers represented by a sequence of lines and dots. The image (shown below) corresponded to the following string of digits: 10, 2, 14, 7, 19, 6, 18, 12, 7, 8, 17, 0, 19.
These digits acted as a key to be used against the Caesar cipher codes in the mysterious subreddit. After a lengthy process, a romantic Welsh poem involving King Arthur, titled The Lady of the Fountain, was discovered. Its introduction is pasted below, while more of the story can be read here.
King Arthur was at Caerlleon upon Usk; and one day he sat in his
chamber; and with him were Owain the son of Urien, and Kynon the son
of Clydno, and Kai the son of Kyner; and Gwenhwyvar and her
handmaidens at needlework by the window.
Things Start To Get Creepy
When the original book code is applied to this story, the following message is uncovered:
Call us at us tele phone number two one four three nine oh nine six oh eight
This is a Texas based phone number, which clearly had to be rung in order to continue. When you did so (it has since been deactivated) you heard the following synthesized message:
The phone message tells the solver to investigate the original image and look for prime numbers. An examination of the dimensions of the starting image resulted in the numbers 503 and 509. When these are multiplied with 3301, you get 845145127.
This led solvers to a website, 845145127.com, which included an image of a cicada insect and a countdown. When his image was passed through OutGuess, they were told to wait until 17:00 UTC on January 9, 2012.
Eventually, the countdown ended, and was replaced by a string of digits, which were clearly geographic coordinates.
This is where Cicada 3301 took the jump from a purely computer based puzzle to something much bigger. The coordinates referenced several points around the world, including the US, Australia, France, Russia, South Korea and Japan. At each location was a Cicada 3301 poster with a QR code. All of them appeared simultaneously, suggesting massive coordination.
This is when solvers realized this wasn't some basement dwelling computer nerd making a fun game, it was actually someone with a lot more funding, resources and organization - perhaps even a government agency.
How Does It End?
This is where we leave the first Cicada puzzle, however it continued for around a month with each solver receiving increasingly complex and personalized puzzles suggesting they are were being adapted as people 'played'.
When the final puzzle was completed, successful solvers were apparently contacted by an email asking them to fill out a personality test and answer questions related to their opinions on the freedom of information. A post was also added to the original reddit, announcing the end of the competition (above).
As far as we know, no official selected 'winners' have ever come forward. There have been occasional leaks in information, but in each case, they could not be confirmed as related to Cicada 3301.
There were additional Cicada competitions in 2013 and 2014, although as of yet, no one has been able to solve the 2014 Cicada contest. The image which began that competition can be seen below.
So, Who Is Behind It?
There have been various theories about who is behind these strange and bizarre series of puzzles. However, much like everything else related to Cicada, no one can ever be entirely sure about who is responsible, especially considering the great lengths Cicada has gone to ensure its anonymity. Despite this, there are the some popular theories, let's look at the pros and cons of each one below.
Government Intelligence Agency
One of the main theories is that Cicada 3301 is a recruitment program operated by a state intelligence and security agency, perhaps NSA, CIA or Britain's MI6 and GCHQ.
- The scale of the operations suggests major funding, organization and cooperation between many individuals.
- The lack of leaks and the maintenance of security, suggests professionalism and dedication to an authority.
- The skills tested are those which could be ulitized by state security and cryptology agencies.
- NSA and MI6 have used similar challenges in the past to recruit.
- The nature of the language and aesthetics of the test would be unusual for state agencies.
- The communities targeted by Cicada are not usually positive towards state surveillance agencies.
- Recruitment by state security agencies often requires extensive background checks. Those being tested are often equally as anonymous as the tests creators.
- Non-geographically specific. Former tests by the CIA and GCHQ were aimed at only American and British citizens.
- Following the popularity of Cicada 3301, the NSA and US Navy have released cryptographic challenges based on the Cicada model. This suggests they are imitating something they did not originally create.
Another popular theory is that Cicada is a recruitment program for a cyber-mercenary group with connections to hacking and maybe even cyber-crime.
- The communities targeted, and the real-world locations chosen, are popular with hackers.
- Many of the cultural references chosen, such Agrippa by William Gibson, The Marriage of Heaven and Hell by William Blake and The Book of The Law by Aleister Crowley suggest an intellectual, anti-establishment ideology.
- The nature of Cicada and its language is similar to the popular culture surrounding mysterious conspiratorial groups. A cyber-mercenary group might try to emulate this.
- Even with a large network of contacts, Cicada may be too ambitious for one small group to execute.
- Such groups often feature internal divisions that could lead to leaks. Cicada, if it does consist of many people, has maintain a surprising amount of security for a non-state actor.
- This might not be the safest recruitment method for such a group. Recruiting the wrong person into the organization could expose it to the authorities.
Cyber Advocacy Group
Perhaps the most supported theory is that Cicada 3301 is a recruitment program for an underground organization which advocates for freedom of information, anonymity and crypto-anarchy - all, supposedly, legally. Possible identities include the cyber-protest group Anonymous.
- The member of the communities targeted would be sympathetic to such ideologies.
- Many of the cultural references chosen, such as Agrippa by William Gibson, The Marriage of Heaven and Hell by William Blake and The Book of The Law by Aleister Crowley suggest an intellectual, anti-establishment ideology.
- The nature of Cicada and its language is similar to the popular culture surrounding mysterious conspiratorial groups. This would make it attractive to individuals supportive of crypto-anarchy.
- An unconfirmed 'leaked email' apparently sent to successful candidates appears to outline the nature of Cicada, it states:
You have all wondered who we are and so we shall now tell you we are
an international group we have no name we have no symbol we have no
membership rosters we do not have a public website and we do not
advertise ourselves we are a group of individuals who have proven
ourselves much like you have by completing this recruitment contest
and we are drawn together by common beliefs a careful reading of the
texts used in the contest would have revealed some of these beliefs
that tyranny and oppression of any kind must end that censorship is
wrong and that privacy is an inalienable right.
You are undoubtedly wondering what it is that we do we are much like
a *think tank* in that our primary focus is on researching and developing
techniques to aid the ideas we advocate liberty privacy security you
have undoubtedly heard of a few of our past projects and if you choose
to accept membership we are happy to have you on-board to help with future projects.
Although confirmed by some, others deny the veracity of this email.
- The scope of Cicada might be beyond even the best organized non-state groups, although arguably Anonymous might have the manpower.
- Even groups such as Anonymous would have difficulty maintaining this veil of secrecy.
Recruitment for a Private Corporation
Another theory is that Cicada is a recruitment tool for a bank or similar organization working on a cryptocurrency or in a related field, possibly BitCoin.
- Some major organizations, such as JP Morgan, have filed patents for cyber-currencies which would require such individuals.
- Cicada is an inventive way of targeting talented individuals who wouldn't naturally seek jobs with such corporations.
- The scale and scope of Cicada could be supported by a private corporation.
- The lack of a 2015 competition could be related to the decline of BitCoin and the general idea of cyber-currencies. There is now less demand for such individuals.
- Secrecy is maintained by a legally binding non-disclosure agreement.
- The nature, language and texts chosen in the competition seems unusual for a professional private organization.
- Despite interest, no other major crypto-currency has been announced since 2012.
Publicity Stunt for Corporation
Another theory is that it is a publicity stunt for a corporation. However, this seems unlikely considering no one has tried to monetize Cicada 3301 or admit ownership.
It's Just An Alternative-Reality Game
Cicada does have many elements in common with online alternative-reality games. These are essentially games which revolve around a fictional entity or universe, but are portrayed as real by the creator and players. Many thought Cicada 3301 was originally an ARG, however its scale means this is unlikely the case. Furthermore, none of the successful solvers have come forward to claim credit for successfully completing it.
As stated above, 2015 is unusual as it is the first year since 2012 that a Cicada 3301 competition hasn't been publicly announced. Some are suggesting it might be hidden even further into the fabric of the internet, and finding the beginning might be the first challenge. Others are suggesting Cicada has either found everyone it needs or has simply been cancelled after no one solved the 2014 puzzle.
It's worth nothing that some species of the cicada insect, which the competition uses as a symbol, only emerge from their underground burrows every 13 or 17 years. One theory is that this allows the cicada to stay out of sync with certain predator's life cycles. Perhaps this suggests Cicada 3301 will once again emerge in the future?