Schneier on Security

This seems to be the usual chain letter which likes to reference a real-world incident. Referencing real-world incidents is an attempt to fool the reader.

It seems to show security folks who do not work in corporate security and a day-to-day basis can easily get caught as well.

Right, Bruce?

Hoax or no hoax, you must admit the challenge of it all is tempting. The skeptic in me says that the solution, if it exists, reveals that the whole thing is just a ruse. The intellectual in me says, "Bring it on".

Donald,

I have never received a chain letter that contained a cryptogram. I wish I did, it would make spam much more fun.

p

Surely deciphering this would be easier with a lot more background information not to mention the other items to begin to peice all this together?

This just seems more like someone mentally ill who has murdered people and tried to leave some kind of film-plot type legacy, or a bizarre chain mail ...

@p (re: spam would be more fun)

I'd hate to spend the time to decrypt the cryptogram in an e-mail, only to find it says "Be sure to drink your Ovaltine"...

Here's a little more context.

http://www.boston.com/news/local/massachusetts/articles/2004/02/05/killings_suicide_baffle_authorities/

No idea if it's a hoax or not, but it's notable that only lowercase characters are intersected by underscores, and non-letter characters only occur on the sides.

If I knew it was real, I might invest more time.

At the very least it would be helpful to know about David Rayburn's background.

Did you have an interest in cryptography? Is he known to have read books on cryptography, and if so, which ones? Was he mathematically inclined? Was he more of an artistic type of person? Is there reason to believe he was schizophrenic?

I wonder what's under the white-out on the left-hand side of the page? The shapes don't look like mere scanner artefacts.

Also, note that the boxed letters have the same number of letters as the name of the protagonist, David Rayburn (or his wife, Linda Rayburn).

Decryption could be complicated by the spelling - note that "ampersand" is mis-spellde.

Are those white marks on the side of the page? Looks like someone has tippex-ed out a few symbols.

(Or have my eyes just gone funny?)

Drawing the rectangle seems a very strange thing to do. Anyone know why?

The "white out" areas are probably where somebody did a simple decoding of non-alphabet symbols, then erased their work. I'm guessing this was done by a family member.

I'd echo the comments of others - mor context could really help... A forensics analysis of the original (indicating, for example, whether the lines or letters were written first; which letters were written with rapid vs. slow strokes of a pen; etc.) might reveal something about the cipher method used. A history of the author and his knowledge of cyphers/cryptology would be especially handy.

I'd find out more about the perp's habits before proceeding. If he had just completed three marathon sessions of "Close Encounters" or similar sci-fi, this could be nothing more than an attempt to connect with a world he had invented, which has no meaning in ours. He clearly wasn't thinking rationally, so it has to help to get some background on the purpose of the writing. There should be a plethora of related evidence to dis/prove a worthwhile context (unlike a 1,000 year old puzzle). Maybe those are just the passwords he used to login to his computer.

Odd that it seems to be overdetermined; more symbols used to specify fewer (presumably) alpha-numerics... or some sort of ASCII character permutation?

Maybe he's not the one who wrote this letter.

Maybe he is the one who decrypted it... With the knowledge of the plain-text, he quickly erased what he scribbled on the paper... Went crazy and we know the rest of the story!

Seeing the circled "a" at the bottom of the page I think it might be only the first of several pages. I would be interested to know if this was the only page found.

@ChrisW:

I think it is more interesting that only certain characters are offset below the line for lower-case characters.

There are (super|sub)script characters between the last four lines; are these significant?

Is the last character of the last line offset to a new line significant?

I agree that it would be an interesting challenge to try and solve this, but there may not be enough information on hand to solve the puzzle, especially considering mentally stable individuals usually don't kill their family and then commit suicide.

Then again, the geniuses I know would be considered unstable....

Just guessing here... that last character on the bottom might be a lowercase 'd' for david, i.e., a signature.

Perhaps this is based on an 8x8 grid. He seems to have selected 64 characters for his alphabet - 26 upper and lowercase letters, upper and lowercase numerals 3,4,5,7, and 8, the question mark, and one other that appears unused (maybe the '/', the lower-case question mark?). He might have skipped '6' because the caret looks too much like a V.

So, maybe the two vertical strings of eight chars describe how his 8x8 grid is scrambled. Just a thought...

[C&C]
I think I have seen this before. it is a special message, which translates as follows:

"This message is from the NSA. While illegally spying on Al Quaeda terrorists and US residents communicating with them on orders from our god, the Great One Who is Named 'W43of9', we noticed that your PC has been accessing illegal web sites. Please provide us your PayPal userid and password, along with all your credit card numbers and PINs, at the following link: (link removed). Now, issue the following command on your PC - format c:\ /q/u", and then go down to your local DHS office and turn yourself in.

Resistance is Futile. You Will Be Assimilated.

Have a Nice Day :)"

-EdT.

It is interesting that symbols and numbers (%4@*&7#3?) appear on the sides, but not in what appears to be the body on the message.

@phil

given the sample of the writing, and the "a" characters on lines 2, 9, and 10, I think that is a more likely a "d", not an "a". The tie on the circled letter is clearly a separate stroke, which is not consistent with the other letters.

That said, the circled letter is not consistent with the other letters on the page, and as a result may have been a notation that was added by someone else.

My mistake - he's using the '@', suggesting that the numeral 2 is also used. That's enough characters to give him his 64 letter alphabet. Dunno what that question mark is all about...

Anyone check this against recently (relative to the incident that is) published 8x8 puzzles? Maybe it's something innocent that he was working on and unrelated to the event.

Lou the troll

first of all, bruce schneier should query the sender, not so much to gather context for solving this, but just to establish his bona fides. was this thing actually found at the murder scene, and how do we **know** this?
i squinted at it for a minute. eight characters on each side of the text, oriented perpendicularly, all seeming to come from the top line of the keyboard (not counting function keys), the suggestion that they operate on the text somehow would be even stronger if there were eight lines of text instead of at least ten (eleven if you count the dropped o at the end). weenerdog's suggestion of an ascii permutation is plausible.
starting from the other end, what could this fellow possibly want to tell us that he would resort to crypto, and the related question of what could he possibly tell us that would be worth our time to figure out?
"i killed them because....."
here's a quarter, call someone who cares.
"the treasure is located....."
there would have to be a foundation laid that this guy knows where the bearer bonds/solid gold pre-columbian artifacts/money from the armored car heist is.
whatever story this is is a story in only 64 characters of principal text, not counting the three tiny letters between characters in the lower left corner, which suggests that a nutball is trying to screw around with people's heads.

There is an interesing detail: the digit 7 in the left column is crossed. It's not usual thing for an American to do...

@lkv : I wouldn't say it's that's anything of note, beyond establishing a handwriting match with his previous correspondence.

Hi!

I'm not a trained cryptanalyst, so it may be nonsense what I'm writing, but perhaps it could help mentioning about some things:
- the lines don't have the same length;
- the line lengths in the horizontal ones are (5, 7, 3, 7, 7, 5, 7, 8, 7, 8) - perhaps an unlikely sequence for continuous text, but perhaps not for single words
- the max. line length is 8 chrs.
- there are 10 horizontal lines plus two vertical ones
- the vertical lines both have 8 characters
- the upper-case letters are not striked out
- four Characters are not on a line: m, r, H and the encircled one
- Special chars and numbers are only used in the side rows
- "&" ist the only char with its Name written beneath
- the first 5 lines keep the column order, the others seem a bit squeezed. this may be beacuse the two outer text lines were written first
- the last char (O, lower right) ist out of line, but not due to space limitations (would easily have fitted in line)
- the notice seems unlikely to be written hastily, as the "q" are carefully drawn - but the "*" and the "?" are not so carefully written

hope this helps a bit
steve

@another_bruce

I rather doubt that it decodes to "the treasure is located..." (or at least would lead you to a real treasure) since economic problems seem to have had some part in this guy becoming unhinged...

Assuming that the cryptogram does have some connection with the murders and suicide.

The cryptogram may be deciperable, but the context won't fly. The Boston Globe article about the murder/suicide mentions nothing about the note being cryptic, they said:

"MacKay said the suicide note made no mention of financial troubles."

That sounds like they were able to read it. If there were a juicy angle ("undecipherable note") then the newspaper would surely have played it up.

@Kevin Davidson

true, but only if they had a look at the note, and haven't asked someone ("does it say sth about fin. probs?" "no" - ok, unlikely) and if there wasn't another note.

steve

Several people have noted that lowercase letters have a line through the middle, but not uppercase.

I don't think this is cryptographically significant - it is just a way of disambiguating characters such as w and W.

http://www.boston.com/news/local/massachusetts/articles/2004/02/05/killings_suicide_baffle_authorities/

unemployed "Internet technician"

It looks like the message was transcribed from someplace else because the note was written in three passes: underlines, uppercase, and lowercase.

Maybe it's just a list of passwords?

Based on the number of letters in each word, and the circustances surrounding the note, I suggest that the first few words are:

Linda
Rayburn
and
Michael
Rayburn
Berry
....

After that, I think that the note breaks from the one word per line rule. Given the above assumptions, the note might be decipherable.

Hello, and thank you for reading this letter. You see, there is a starving little boy in Baklaliviatatlaglooshen who has no arms, no legs, no parents, and no goats. This little boy's life could be saved, because for every time you pass this on, a dollar will be donated to the Little Starving Legless Armless Goatless Boy from Baklaliviatatlaglooshen Fund.

However, if you solve the attached cryptogram it will lead him to his family's lost fortune. Hist story is covered here: http://www.goatse.blah/virus.pif

Oh, and remember, we have absolutely no way of counting the emails sent and this is all a complete load of bull. So go on, reach out. Send this to 5 people in the next 47 seconds.

Oh, and a reminder - if you accidentally send this to 4 or 6 people, you will die instantly.

Thanks again!!

I'd say... the horizontal lines were drawn first, because he knew how many letters per word he needed to write, then he started to code the words and filled in a letter on each _ (maybe because the coding he used forced him to write the letters down in a different order than the original text). I think the characters written sideways are the key.

Snopes returns nothing relevant on the words: cryptogram, Rayburn, code, coded message.

Google likewise turns up nothing helpful in solving or confirming the message origins.

I was thinking the vertical lines were drawn first. All of the lines slant upwards. On the horizontal part, the first letter starts right next to the left horizontal line. But if you look at the end of each line, the bottom rows go further out to the right. The writer had extra room there because the vertical line on the right side slanted up when it was written...

Clarification - meant to say "on the horizontal part, the first letter starts right next to the left *vertical* line."

@Bruce

Since this was an e-mail, did you receive the "handwritten" cryprogram via jpeg format attached to the e-mail?

Bruce:

I guess the comment that the rectangle was added later on was indicated in the e-mail (just as the indicator that the characters were keyboard keys)?

May or may not be significant, but both of the vertical lines have the same pattern to the first four characters. 1) lowercase letter 2) character 3) uppercase letter 4) number. Characters 5-8 don't fit that pattern though, so it may just be coincidence.

Clarification to my prev post:

"the horizontal lines were drawn first"
should be read as:
"the lines where drawn before the letters were written,"

The lower-case letters written half-way below their lines seem to be unimportant-- looks like an indicator that says "yes, this is lower-case". There would potentially be confusion with the author's 'k' and 'c' letters without this indicator. Also, there's a letter 's' that could be a '5', except that it's written in this lower-case letter style.

Assuming this was authored by the murderer, then the crime is that of a deeply sick individual rather than someone who was depressed over a weekend -- he took plenty of time to plan his actions including enciphering a complex note.

Based on this [highly speculative] assumption, and other information, I'm on board with the hoax theory. Seems to me the police would have mentioned a "cryptic note" sooner, wvwn if they couldn't release it to the public. However I do believe there's a message here ... but probably a dissappointingly bland one.

s/wvwn/even/g

damn keyboard....

This piece of paper looks like a hangman game. Maybe he was playing hangman with himself and lost.

Filias - good catch. Which brings about an interesting point: the lines were almost certainly filled in prior to the letters.

One must imagine, then, that whatever this note was (a mysterious cryptogram or a meager password cheatsheet) - it originally looked like a large "hangman" puzzle before the letters were filled in.

Perhaps he was a bad hangman player, and took the game a bit too literally

:-)

That said, I would wager my money on this being a password cheatsheet. The ex-internet professional probably carried around this sheet of pseudo-random characters with his own personal mnemonic system for gererating new and old passwords from it. The characters are too high in entropy and too uniformly distributed to be a simple substitution cipher - and if it *is* a more advanced subst cipher, then there's too little information to crack it via statistical methods.

I counted the characters of the "body" of the message (i.e. the part that is not written on the side) and excluding the fifth character in the line that starts with Efbd... because I was unable to identify it - I also excluded the super-/subscripts:
(A, 2), (B, 1), (C, 1), (D, 2), (E, 1), (F, 1), (H, 1), (I, 1), (L, 1), (M, 1), (O, 1), (P, 2), (Q, 1), (R, 2), (U, 1), (V, 1), (W, 1), (X, 3), (Y, 2), (Z, 1), (a, 3), (b, 2), (c, 2), (d, 1), (e, 1), (f, 3), (g, 1), (h, 1), (i, 2), (j, 1), (k, 2), (m, 1), (n, 1), (o, 2), (q, 1), (r, 1), (s, 2), (t, 1), (u, 2), (w, 2), (y, 1), (z, 3)

Note that it spans both the upper and lower case alphabet pretty evenly.

"the magic words are squeamish ossifrage."

If this is the only cipher text found in that household with these, this can be something like a simple encryption scheme that he and his girlfriend in highschool had invented years ago. It shouldn't be difficult to crack provided that the deceased didn't misspell anything or misapply the transformations.
To be honest, it looks bogus to me.

These could, indeed be passwords. Notice that there are 12 lines in total and this could have been the 'cheat sheet' to remember them.

Or maybe this was written in octal?

the uppercase "i" at the end of the fifth line seems unique in that the upper and lower bars of this "i" are broader, suggesting the stylus may have traced back and forth over this part of the sheet several times; everything else there appears to be the product of a single trace.
i don't know if this is significant. it doesn't look like he was changing another character to "i". there might have been a subconscious emphasis on writing the pronoun which represents the writer, more so than if the "i" actually represented some other letter.
we need vanna white to come in here and turn over two or three of those to help us!

Has anyone looked at this from an ASCII point of view?

question: as we don't have many ciphertext and very little Information about the structure and content of the cleartext, the only breakable ciphers would be very simple ones as for more complex ones the unicity distance would exaggerate our ciphertext length, wouldn't it?

steve

s/exaggerate/exceed/
sorry
steve

Don't anybody blurt the answer:

How many people who use the construct "s/?/?/" when correcting their text know that construct's origin?

I've been seeing it more and more frequently, so I'm wondering if people are just copy-catting or if they've actually used the construct in question.

Please, don't take insult to my wondering!

I may be totally off here, but it looks like a recitation cheat sheet.

It is a method for helping you remember a long passage by writing down the first letter of each word. You put the capital letters in as capital letters to help you remember the difference between proper names and the beginning of sentences (i.e. where to pause).

Ed (ha!),

I would imagine most do--I've only ever seen it on techie forums, and it's a minority even there. I'd say it's rare enough that people actually know what they're doing.

Of course, I usually use s/tyop/typo/g -- otherwise I might not correct all of the errors!

s/?/?/ is extremely common in web programming, and web programming is huge. I would expect that most people know the context.

I would also agree that it looks like a password cheatsheat on first glance. Does anyone know if that fist with the profile of the guy who left it?

please
forgive
me
because
i love you
always
something
something
something
something

Why does it need to be anything? This is the myth of the dying clue, that Rayburn managed to leave behind some cryptic clue or insight that has puzzled investigators for over a year.

And, given the chain-letter dissemination approach, we have no confirmation of Rayburn having left this note. (I would expect some mention of 'a suicide note filled with cryptic symbols.') If it were a family member looking to solve a cryptogram, wouldn't it make more sense to be posted on the web, with an archive of comments? And if privacy were a concern - that is, the message were to reference family matters, why distribute it in a chain letter?

If it is a password cribsheet, it does not seem to make sense. I would imagine that investigators had already checked Rayburn's bank accounts, even computer(s) for any protected files.

For all we know, it's a secret mandate of death from the Jovian High Command.

someone just exploited bruce's computer :P

@Knowler: It doesn't look like a recitation cheat sheet to me - half the letters are uppercase, distribution is very different from first-letters-of-English-words, where we'd expect lots of Ss.

@Ed: I can think of four programs which use s/././, I've frequently used two of them and occasionally another (when emacs is missing.) Are you using a subtle pseudonym here?

OK, here are the case-insensitive frequencies of initial letters of words of a substantial English text (Pride and Prejudice, plus the Project Guttenburg boilerplate, as I was too lazy to remove it.) Given the source, some letters, such as D, E and M, are liable to be overrepresented.

A: 13848
B: 6190
C: 4834
D: 3929
E: 3423
F: 4236
G: 1876
H: 10641
I: 8684
J: 584
K: 686
L: 3114
M: 6861
N: 3504
O: 7254
P: 3214
Q: 253
R: 2497
S: 9549
T: 16348
U: 1057
V: 885
W: 9185
X: 0
Y: 2393
Z: 1

@grif: "I counted the characters of the "body" of the message (i.e. the part that is not written on the side) and excluding the fifth character in the line that starts with Efbd... because I was unable to identify it - I also excluded the super-/subscripts:
(A, 2), (B, 1), (C, 1), (D, 2), (E, 1), (F, 1), (H, 1), (I, 1), (L, 1), (M, 1), (O, 1), (P, 2), (Q, 1), (R, 2), (U, 1), (V, 1), (W, 1), (X, 3), (Y, 2), (Z, 1), (a, 3), (b, 2), (c, 2), (d, 1), (e, 1), (f, 3), (g, 1), (h, 1), (i, 2), (j, 1), (k, 2), (m, 1), (n, 1), (o, 2), (q, 1), (r, 1), (s, 2), (t, 1), (u, 2), (w, 2), (y, 1), (z, 3)"

Looks like Scrabble tiles to me, except, I think Q is worth more than that.

What is the possibility that this might be a rotating cypher? Not as in "ROT-##" but as in potentially each line is encoded differently, based in the line before or based on the verticals.

Why does everyone call this a "chain letter" type distribution? Crypto-Gram takes up 2 of the top 3 Google hits for "cryptogram", and scanning the column for a bit reveals that sometimes Bruce posts items sent in by readers, so he's obviously not averse to unsolicited mail. Sounds like a pretty well-targetted one-off mail to me.

@ Joe Mason:

The 'chain-letter' attribution is perhaps premature, but fits with the 'close friend of victim' reference, plus the appeal for help. While it falls short of 'send this to everyone you know,' it isn't far removed from 'school project' style chain-letters (surveys, touring cartoons, etc.).

Still, I find it odd that no wide mention of the cipher was made (i.e., it didn't show up in the newspaper). If it *were* the suicide note, it would be retained by the police, not the family. (Which could account for some of the artifacts on the image, possibly from a poor photocopy/scan/fax.)

In the short story, 'The Pointing Finger,' Isaac Asimov has a character express his distaste and innate distrust of the 'dying clue' - that someone who is dying (or, in this case, in a frame of mind to commit murder/suicide) produces a clue that takes healthy minds days, if not weeks, to unravel.

If this is just a piece of paper from Rayburn's belongings, and not the actual suicide note or portion thereof, then assuming it is connected to the murder is a bit of a stretch.

The context is important, yet we have none. Was it in Rayburn's pocket? In his car? At home? Received in the mail the next day? What was Rayburn's condition in terms of medication? Did he hold opinions about space aliens or secret conspiracies that might be involved?

It's not like 'Hey, the Germans are transmitting these signals on a regular basis,' and we can follow traffic patterns as well as land an educated guess as to the content.

Without being able to authenticate the original sender's identity it is hard to believe that this is not a fake. If I were the sender with serious intention I would have provided some mechanism for feed-back inside the message body (for if people pass it on). Whom shall I tell if I solved the puzzle?

So Bruce, do you know the sender, do you have a reply address? Or was it just a test...

And, don't the authorities, FBI, CSI or whoever have the specialsts for such a job? Anyway, looks rather psychotic to me, that note.

Josh: It's got to be. At least, I find it extremely unlikely that each character is encoded with the same key. Why? There are no symbol pairs. It's quite unlikely for that to happen in a 64-character message. I'm sure someone's got the exact statistics handy :-)

If someone wants another RL unsolved cryptogram, some of the Zodiac killer letters from 1970s are still unsolved: and .

The MT ate the links to zodiac stuff, here they are again: http://members.aol.com/Jakewark/album.html and http://www.zodiackiller.com/Letters.html .

................................................................
Raw transcription (assuming O is final letter in last line):

d%K4q@h*
yV$3?

WjuPD
qXoRwis
Mmg
HkcFBfe
XnLoyuI
wAzQY
bUktPsq
AcZfiYzD
CRVhXqz
EfbdqarO
................................................................
Grouped transcription:

d%K 4q@h* y V$3?

WjuP DqXo Rwis MmgH
kcFB feXn Loyu IwAz
QYbU ktPs qAcZ fiYz
DCRV hXqz Efbd qarO
................................................................
16 Characters used in the two vertical lines:

#$%&*347?@KVdhqy
................................................................
64 Characters used in the horizontal lines:

AABCDDEFHILMOPPQRRUVWXXXYYZabbccdefffghiijkkmnooqqqqrsstuuwwyzzz
................................................................
42 Unique characters used in the horizontal lines:

ABCDEFHILMOPQRUVWXYZabcdefghijkmnoqrstuwyz
................................................................
Unique characters used throughout:

@#$%&*?347ABCDEFHIKLMOPQRUVWXYZabcdefghijkmnoqrstuwyz
................................................................

The white-out is interesting. It appears to annotate the symbols going down the sides. This is a bit forced, but the white-out adjacent to the $ looks a lot like an 'M'. If we trace that up in alphabetical order, we get the somewhat 'J'-ish symbol next to the #, all the way up to the possible 'A' next to the %. This doesn't really make sense, but I thought I'd throw it out there.

I go along with the guess it's a password cheat sheet. How many of us use a simple encryption scheme on the passwords we write down? When the plaintext is essentially random garbage (i.e., good passwords), even a rudimentary cryptosystem is mighty hard to crack.

The CIAC maintains a fairly comprehensive list of known email hoaxes, chain letters, etc. A search at their Hoaxbusters web site (http://hoaxbusters.ciac.org/HBSearch.html) doesn't find any relevant hits on Rayburn, suicide, nor crypto.

So I would venture to say that the email Bruce received is either genuine, or a fairly new hoax that hasn't made it onto the CIAC site yet.

I'm going to tread in waters I have no business going into. I keep hearing of a suicide note. Were there two messages, one suicide and one crypto? How many modifications have been made to the crypto? Already a box has been added, and there seems to be whiteout on it. We can't be sure the whiteout was added after the message like the box. The only thing I can add is if there were two messages, perhaps this crypto one is a cypher for the plaintext note. Maybe info is hidden in the plaintext. Right now I think we can all agree there is some data missing. Even an easy sustitution (a=1, b=2) would be difficult, or impossible, if a few sheets were missing.

Perhaps the vertical columns represent a key in some sort of keyboard typing pattern. The first column includes the letters 'd' 'k' 'g' and 'h'. If you examine a keyboard, those keys represent, in order, your left middle finger, right middle finger, left index finger, right index finger. These keys are all on either side of the "home" keys (the keys with the little nubs on them). Haven't gone any farther than this, but it's another angle to look at.

Regarding the use of s/foo/bar/g, it's been a 'Net idiom since at least the late 80's when I came around. Of course, back then the net was still mostly techies and semi-techies, and UNIX was a major factor in its growth. I rarely use it "publically", precisely because it's an "in-joke" that many readers won't understand.

"He left behind a number of disturbing items." Would be good to have some idea of what those disturbing items were. Also if these items (including the cryptogram) were actually a part of the crime scene, or if they happened to be discovered later among his posessions. It seems unlikely that it was at the crime scene or that it has anything to do with the crime.

Also interesting is that the box that was supposedly drawn later by a different person appears that it might have been done with the same pen. Would need the original to determine that, but the color, width, and quality of the line matches the rest of the note. Wonder if the pen pressure is also the same.

Also how do we know *he* was the author of the cryptogram? Has a handwriting analysis been done? Where exactly was the note found?

I agree with jammit that it also makes a difference that we do not know what all might have been added later. Perhaps the floating v, m, and H were also added later by someone attempting to decrypt it. And did the author use the whiteout, or did someone else use it later?

Just a few things to consider.

@ac, Filias:

Pseudoynm? Yeah, my real name is Stuart Earl Dangerfield.

Are was it Peter Ebert Roger Longfellow?
Maybe it was Violet Imes?

I'm sure there's plenty of other names I could be, but which one came first?

The reason I asked the original question was that I was seeing it on gaming bulletin boards, used by people that I would think had no experience using it based on some of the questions they asked. *shrug* I guess this is really the wrong forum to ask in if I were expecting a "no, I don't know what it is" answer.

Well, it's a joke that will never get old in my book.

@ed, et al.

s/this/that/[g] is in some way related to regular expressions. Anyone who uses regex has probably gained experience with this particular construct. I was unable to find an historical timeline or any such beast.

Personally, I learned it while experimenting with Violet Imes in my late teens. I still visit with her occassionally. What a woman...

This looks more to me like a good case of graphomania to me, like that professor in Proof. I wouldn't doubt that he has tons of hidden notebooks stashed away with similarly indecipherable text. I say indecipherable because it looks like he made up a code in his head so complicated that it is indistinguishable from noise, and that it probably didn't make sense when he made it up, much like other people who suffer from that condition. I think that one would learn more from the psychoanalysis of the murderer what the message means than an analysis of the scribblings that make up the message.

i think the reason for the horizontal lines is that he used transposition in the cipher. If it was merely a substitution cipher, he would not need the lines as place holders.

I would hope Bruce and us readers could do better on this than we have...

What do people make of the odd "m" and "H" that are off-line?

I figured the m, H and r were stating what the letter they accompany are.

No one is questioning the man's sanity. He is clearly insane because he's murdered his family with a hammer and sane poeple do not do this. Anyone who has a friend or family member with profound Schizophrenia or Bi-Polar disorder will tell you that people with mental health issues can create nonsense like this as part of their delusion. The note's meaning may only be that this poor guy was totally gone.

It seems quite unlikely that this is a genuine cryptogram. For a start, it is extremely short for any cryptogram meant to be anything but a puzzle, and quite short even for that. Further David Rayburn's profession and the number of types of characters involved (53) suggests that if it is a cipher at all it is probably a modern computer based one, making it odd to find it handwritten.

My first thought was to agree that it's a password list. Probably not even a "cheat sheet" so much as a simple list, because so many lines are roughly equal to typical password lengths. Plus it fits with what little we know about David Rayburn.

Two factors made me think twice though:
* Line "Mmg" is very short for a password;
* If these passwords were randomly generated from the set of all printable characters, then digits and punctuation marks are seriously under-represented, to the point of being statistically improbable.

However, the second of these issues resolves if we notice that ALL of the non-alphabetic characters appear in the two lines written sideways on the left and right edges of the page. Since these lines are written sideways rather than simply vertically, and since the characters in them do not align with the other rows, it strikes me that they have been written this way simply because the writer ran out of room. If that is the case, then they are also the last two entries. Additionally, they are both exactly 8 characters long, a very typical length for maximizing the strength of old style Unix passwords. So, it may be that if these are passwords, all the entries but the last two were generated by a random character generator which outputs only alphabetic characters, while the last two, intended to be extra strong, also allowed digits and punctuation marks.

Checking the stats again, this hypothesis matches: the distribution of symbols in the last two entries is similar to that expected by random selection from all characters. However, at this point by eyeball Mk I analysis I noticed another pattern, in the line "yV$3?". Its pattern of shifted and unshifted characters goes ".>>.>>.>". Not impossible by chance alone, but made me wonder if it wasn't generated by banging randomly on a keyboard. In this respect, it is also interesting to note:
* All but two symbols are from the top two rows of the keyboard (half of them from the top row), and the two exceptions are from the bottom row;
* All but one symbol is left of a line on the keyboard joining 7 to n. This is not quite the same as "left hand keys" for a touch typist, but pretty close;
* In the 8 symbols in this string, only 6 keys were used, the 7/& key and 3/# key being reused;
* That & is very close to y, and $ is very close to 3;
* That V on the bottom row is exactly halfway between 7 and $ on the top row;
In short, this does look an awful lot like the sort of distinctly non-random stuff you get when someone is trying to type randomly.

What about "d%K4q@h*"? It is also quite non-random, though not in quite the same way:
* The pattern of shifted and unshifted characters is ".>>..>.>" which is nearly identical to the previous one, except that q "should have been" capitalised;
* Every character but one comes from either the top row or "home row".
* If we label the rows 1 (top), 2, 3 ("home") and 4, then the pattern of rows is very regular: 31312131. Note that the obvious "error" in this pattern is the same character which disrupted the shift key pattern;
* Once again, there is a tendency to the left side of the keyboard, though a little weaker with 2 characters from the right side and one on the borderline;
* In terms of distances, we get d closish to %, big jump to K, 4 is right back to near %, then closish to q, @ right next to q, then big jump to h but it is very close to that K we had earlier, then * closish to h. Thus this kind of looks like a left hand sequence of small jumps partially overlapping with a right hand sequence of small jumps.

Once again, this "random" string is actually quite structured on a keyboard, although in a quite different way to the previous one. Actually, I would hypothesise that the string "yV$3?" was generated by someone typing one-handed with his left hand whilst pressing the shift key with his right hand, while the string "d%K4q@h*" was generated by a touch typist trying to type randomly with both hands, but somewhat favouring the left hand. Question: was David Rayburn left handed?

Continuing the same analysis now with the purely alphabetic patterns, one finds that much the same thing happens for nearly all of them: each string consists of either one or two clusters of keys which are very close together on the keyboard, usually with the direction of movement within sequence being roughly fixed. The sequence of shift key usage is not totally predictable but differs a long way from randomness. For example, (unless we count running off one line and continuing on the next), from these 64 characters the longest sequence of consecutive shifted characters is 3, when we expect about 6, and the probability of it being as low as 3 (if chosen truly randomly) is about 0.006.

My conclusion is that most likely, all or at least most of these strings were generated by banging randomly on a keyboard, with the last two (sideways) strings intended to be "more random". The typist is possibly left-handed, and there is some chance that two typists were involved, one of whom touch types while the other does not. Most likely, the strings are intended for use as high security passwords and have been written down as an aide-memoire, although of course it is also possible they are random junk intended to confuse an investigator.

Presumably, a genuine investigator or relative will have access to password protected systems used by David Rayburn, and may be able to test if any of these passwords work on them. On the other hand, as Rayburn was unemployed at the time of death, the passwords might also refer to a former employer's systems. If still available, it might also be useful to check the web cache of any computers he used to determine if they may be website passwords.
==============
Appendix: Machine readable version
The following version might help anyone else wanting to do an analysis. Please correct it if you see any errors. This list uses the assumption that the lines are mainly to distinguish between capital and lower case letters. Letters in parentheses were not on the lines, but written above the letter which they follow in this list. The two lines separated from the rest by a blank space are the two written sideways. The character on the second last line which gets butchered by Bruce's HTML filter, should be an ampersand.

WjuPD
aXoRwis
Mmg
HkcFBfe
XnLoyuI
wAzQY
bUktPsq
AcZ(r)fiYzD
C(m)RVhXaZ
Ef(H)bdqarO

yV$3?
d%K4q@h*

This was my thinking too.

When I tried typing all these items in on my keyboard, the keystrokes were arranged in the sort of groupings I am familiar with from making up passwords by randomly typing stuff on the keyboard.

Other thoughts:
The O could be a sometimes-used suffix for the last password (or a reminder of sorts.)
The other small notations could indicate the usage of the password (eg H for Hotmail.)
The last two entries (written sideways) are most recent ones, probably for a system that didn't accept simple alpha passwords.

I guess he carried this with him, and added to it as necessary.

Actually looking at it again, I think the whole lot has been transcribed from another piece of paper. The dashed underlines are uniformly slanted the same way, and the paper is square in dimension and then folded in half and half again (with a small overlap) so I figure this is a pocket copy of the passwords.

The square paper would also explain why the two passwords with non-alphas didn't fit on the paper.

All in all, it really looks like a worn password list to me. I am interested to know if the fold in the paper existed when found or made later. There is no mention of the dimensions of the artifact to explain if it is a pocket-sized piece of paper or something kept in a binder – also there is no mention to where this artifact was found as it was only mentioned to be “one of the disturbing items left behind� (by the deceased) - for all we know this could have been found in a storage facility far from the crime scene.

I think it is unlikely that someone went to such trouble to encode a message to appear like a password list.

Israel Torres

@peri:
Sorry, I didn't notice your transcription before I did my own. I just compared them, and find we disagree on just 2 letters; in both line 2 letter 1, and line 9 letter 6, you read "q" while I read "a".

Going back over them, I still believe my version more likely to be correct, for the following reasons:
1. Look at the 3 "q" we agree on. Notice that all of them are formed with a very distinct hook (North American style) at the end of the descender? This is missing on the two disputed letters, which barely have a descender at all.
2. Look at the one "a" that we agree on, notice that the bow is very similar to the "q" next to it, but the descender stops much shorter, and obviously has no hook. The two disputed letters are the same, but the descenders are just a fraction longer -- but not nearly as long as the "q"s, and no hooks.
3. Also, your transcription makes the frequency distribution much less flat, putting a single spike at "q", with more than triple the average frequency. Mine makes it only double the average frequency and makes the whole thing look much more like a flat distribution with the typical random variations.

What do you think?

@Dylan:
I tend to agree it is probably transcribed. For one thing, the formation of some of the letters generally give an impression of having been written hastily (although could just be generally careless handwriting), and for another some repeated letters are formed with the same idiosyncrasies each time they appear (e.g. A, R, q but see above re q and a) while others get much sloppier further into the page (e.g. D, r, f). Also, looking at the three letters which don't sit on base lines -- the ones I rendered as (r), (m) and (H) -- I am now wondering if these represent alternative readings of the letters _above_ them. That is, whilst transcribing an old, tattered copy he wasn't sure if the 3rd letter of line 7 was a k or an r, similarly line 8 letter 1 was either A or m, and line 9 letter 2 was either R or H. In the case of (k, r) and (R, H) it's obvious such confusion could arise on an indistinct copy, but (A, m) seems somewhat unlikely unless the old page was quite badly damaged. In any case, if this hypothesis is correct it suggests that those passwords were no longer in frequent use by Rayburn, or he would know which reading was correct.

Regarding folding: I have run the image through an image editor and played around with the contrast etc., and I now see three distinct folds. There is an obvious ridge fold running across the centre of the page, going through the fifth line. Much harder to see, at right angles to this first fold there is a ridge-and-valley fold starting near the P on the first line and going to the d on the bottom line. This fold was obviously made second. Finally, there is a ridge-and-valley fold at the bottom of the page, crossing the second fold, but with the two halves folded in the wrong directions and torn in the middle. This last fold is very rough and angled, and looks more like the edge of the page was roughly dog-eared over after the first two folds. At high contrast, one also sees lots of small creases radiating away from the main folds, enhancing the impression of rough handling. I am not certain if the page was folded before or after being written on, but the X which crosses the fold does look a little like the bottom of one leg was affected by it, hence perhaps folded before writing.

Regarding the page shape: I'm not sure the page is square. The image we have is cropped, and except for the tear at the centre of the bottom, the edge of the image is not the edge of the page. If my interpretation of the third fold is correct, the top of the page is only just above the top of the image, but I couldn't guess where the left and right edges are.

Regarding the "correction fluid": I played around with various contrast and enhancement settings, high magnification etc, trying to get more of a hint at what was under the liquid paper, and was surprised to discover that except for the one near the "%", these spots are almost perfectly uniform white patches, with almost no variation beyond some slight raggedness at the edge probably caused by JPEG artifacts. Furthermore the edges are surprisingly straight if we are looking at a brushed-on viscous fluid; and in the patch near the "@", we can make out a perfectly square block of erasure which doesn't resemble a brush stroke at all. In other words, these are perhaps not patches of correction fluid, so much as someone has erased these parts of the image.

A final comment: the penmanship is by and large pretty dreadful "printing" or "block lettering" (disclosure: so is my handwriting. Dreadful, that is. Comes from typing all day.) However, at high magnification I noticed that the word "Ampesand" [sic] underneath the ampersand, as well as being in much smaller letters is actually written cursively, and doesn't resemble the other lettering at all.

The capital letter 'I' is written with more emphasis and darker, heavier horizontal lines in the letter. This is a result of the writer's self-image. If you ask a mentally disturbed person to draw themselves, their drawing may show the anger that they feel by having heavier thicker lines. The letter 'I' shows this effect in miniature. Therefore, the writer was not merely writing a password list (there would be little emotion associated with such a list), but was writing with anger within himself.

The two eight character lines on the sides of the paper are not encrypted. These are the key to decryption. These charaters are not random, since they contain many more symbols from the top row of a keyboard than could occur randomly. Some people think that a password should non-alphanumeric characters, so an amateur cryptogram like this one might have a key that over-represented those characters.

y & # 7 V $ 3 ?
d % K 4 q @ h *

The ampersand character should display if a space is written after it; or one can use $amp; (ampersand then 'amp' then a semicolon).

The first six lines match the number of letters in 'Linda Rayburn and Michael Rayburn Berry', so again there are indications that this cypher is real.

@roger

I think I agree that I wrongly transcribed q as a twice. I also noticed the spike in numbers of lowercase q and should have found the error myself. Thanks!

Hello -
I am the one who e-mailed the cryptogram to Bruce. Thank you for posting it Bruce.
To answer the most common questions, the cryptogram was found in an open briefcase next to where he hung himself. There was a bunch of child pornography CD's in there and a bunch of new sex devices like velvet covered handcuffs.
The suicide note that the story refers to was on the kitchen table. It says "forgive me, it had to be this way". The other family members names are Pat, Jenn, Kristen. There was also Pat's husband Charlie.
Jenn, Kristen and Michael's last name is Berry. Not Rayburn. They also had 2 cats. Ozzie and Luke.
This is a copy of the original. I whited out the areas where friends were trying to decipher it. I didn't want to make it more confusing. The folds in the paper are also mine. The murderer was diagnosed Bi-Polar many years ago. My friend Linda was not told by him or his parents. He was a tech. junkie and loved Star Wars and music. There wasn't much of a investigaion because as far as the police were concerned....it was an "open and shut case". They had the murderer and the murder weapon. I understand that some may think I sent this as a hoax. I didn't. I was just hoping that someone may recognize this and say "I seen this type of cryptogram before".
The password scenerio may be something. There was also a laptop near the briefcase. As I said, the police didn't investigate all that much. They couldn't (or wouldn't) even narrow down the time-of-death to less than a 24 hour period.

Bruce is the only person I sent this to. I recently saw the cryptogram in my drawer and decided to pursue it a little bit. I appreciate everyone's time and effort.

Thank you,
Ken

@Ken

Can you tell us what the original dimensions of the paper are? Is it a typical 8.5 x 11 blank piece of copier/printer paper?

Has someone been able to check out the contents of the laptop, or accounts (email/web/cache) that the deceased maintained?

Israel Torres

Yes. The grid is about 4"x4". The paper was just about 6"x6". I don't have the original so I don't know if it was copy paper. I work with Jenn so I'll ask where the laptop is and let you know.

Thanks,
Ken

@Ken

Since you are in contact with Jenn please also inquire as to whether any of the deceased's remaining personal affects contain any of these types of "strings". It is very probable that this wouldn't be the first piece of paper with this type of information printed on it.

Israel Torres

I will check Israel.
I will try and get as much info as I can. Needless to say it's an emotional subject for Jenn. She was the one who found heir bodies. The 2nd anniversary is this Friday so it will be kind of normal to bring it up.

I knew the guy pretty well. In fact, I slept over their house the night before the murders because they had had a Superbowl party. I do think this may have something to do with his computer because he used to spend a lot of "alone" time on the computer. And the cryptogram symbols really are only found on a keyboard as far as I know.

Thanks,
Ken

@Ken

If you can, also find out if he was known to have any aliases or nicknames. If you would like to contact me privately please do so : email israel at israeltorres dot org.

Israel Torres

The child porn association makes a password list much more likely. A child-porn-swapping website is something he'd likely want a high security password for. But perhaps I'm overestimating the cloak-and-daggerness of aquiring this stuff - maybe you just need to find a Usenet server which is sufficiently lax in which groups it carries.

It would be interesting to do a forensic examination of the guy's hard drives, but I'm guessing this is no longer an option.

If I were keeping such a password cheatsheet, I'd have an extra layer of simple obfuscation - e.g. where the sheet says "HkcFBfe" the password is "bfCKhEF" (backwards from 3rd to last, change case.)

@Ken
Thanks for your answers (I assume you are the real deal. Your story gels with the public record.)

After reading your notes, I am more convinced than ever that we are looking at a password list. However, as Filias noted above, if David even did a simple trick like switching the case of the letters, or appending an 'x' to the end of every password, then we are pretty much stuffed.

What would help would be any nicknames or email addresses that David was known to use. But please don't post anything like this online, as you will be inviting trouble.

If anyone is progressing this, I would be interested to hear or help out (my email is attached to my message.) Otherwise, good luck with the search, and I hope you find what you are looking for.

Thank you Israel. And thank you Filias. I will be talking to Jenn tomorrow and will have more information.
I will see if the lap-top that he used is still around also.

Ken

Thank you too Dylan. A lot of great thoughts out there. I think the lap-top is the key to a lot of this. These passwords...if they are passwords... could also be protecting files on that computer. I will e-mail you and Isreal any additional information (nicknames, email addresses etc.) I get from Jenn.

Thanks everyone,
Ken

Obviously, the underscores and strike-throughs indicate when to physically rotate the page and which direction to "read" the letters.

If this a password list, couldn't half the items on the list be the user ids or sites and the other half the passwords.

Hi Ken,

I'd like to get a copy of "any additional information" at square@tasinet.gr whenever that surfaces (if it's allright with you)

Thanks,

t

I'm glad people are working on this problem.

Is there someone who can summarize the work/ideas so far, and suggest directions for further research?

The Rayburn Files

Information about the object in question:
It is handwritten.
The object pictured is a copy of the original.
There are areas that have correction fluid applied to them so as not to confuse the original contents.
The folds on the copy occurred after they were found not before.
The writing used appears to derive from a standard computer keyboard using alphanumeric and symbolic characters embedded within.
The rectangle drawn over the top two lines occurred after they were found not before.
The grid is about 4"x4".
The original paper media is about 6"x6" of unknown type.
It was found in an open briefcase near the deceased (suicide by hanging).
• The briefcase also contained “a bunch� of child pornography CD media.
• The briefcase also contained “a bunch� of “new sex devices� (e.g. velvet covered handcuffs�)

The other family member and involved names are:
Pat
Jenn Berry (Linda’s daughter – found the bodies)
Kristen Berry
Charlie (Pat’s husband)
Michael Berry (David’s stepson)
Linda Rayburn
David Rayburn

The family cats names are:
Ozzie
Luke

Information about the individual David Rayburn that committed this crime:
He was diagnosed with bi-polar disorder “many years ago�. (Linda Rayburn was not aware of this bi-polar diagnosis.)
He was a tech-junkie, loved Star Wars and music.
He was known to have a lot of “alone time� on the computer.

Information about the investigation:
To investigators it was an open and shut case, no need for further investigation into what this object pertained to.
The time of death was found to be within a 24 hour period.
A laptop was found near the open briefcase.

Information about the crime:
Feb. 2: Linda Rayburn, 44, and Michael Berry, 23, of Saugus (Massachusetts), both killed at home. According to police, Rayburn's husband, David Rayburn, killed his wife and stepson with a hammer. Their bodies were found in adjacent bedrooms. David Rayburn left a suicide note, went to the basement, and hanged himself.
http://www.janedoe.org/about/about_news_12_31_04.htm

Other news references include:
http://www.boston.com/news/local/massachusetts/articles/2004/02/05/killings_suicide_baffle_authorities/

Information about this research:
http://www.schneier.com/blog/archives/2006/01/handwritten_rea.html
Information provided by Ken.
More information may be made available by Ken’s findings.
It does not appear to be a hoax at this time.
The body of the message does not contain the same type of symbols the two perpendicular lines contain.
Various characters therein are shifted relative to the lines they are in.
Various characters therein are using upper and lower case.
It is suspected that this writing could be a secret message, a password list, a type of mnemonic device, or just psychotic-gibberish.
It does not appear to be of any type of simple rotation/shift schemes.

Questions pending:
Is the handwriting on this object from David Rayburn?
Did David Rayburn have any aliases or nicknames?
Were any of David Rayburn’s personal affects found to have similar writing?
Is the “circled d� at the bottom of the page a form of signature?
If this is a password list to computer related accounts/files/logins are they still valid?
Has any forensic analysis been done on the laptop found near the briefcase or on the briefcase itself as well as the remaining personal affects?

At this time it has yet to be determined whether this is a secret message, password list, mnemonic device or psychotic-gibberish.

This information will also be updated here as it is revealed.
http://www.israeltorres.org/The_Rayburn_Files.php

Israel Torres

Isn't it obvious that this isn't anything but a random note that some hoaxer put on the web? it's stupid

"Isn't it obvious that this isn't anything but a random note that some hoaxer put on the web?"

It isn't obvious to me. What makes it obvious to you?

Judging by the amount of child porn found, I wonder if he was distributing it or maybe making some of his own. It would be motive to kill the wife if she'd found out...and the child if he was a victim.

Handcuffs and other sex devices found with those kinds of images would indicate it wasn't a passive interest. He may have been acting on it, or planning to act. Had the items been used, or were they new?

I wonder if any camera or video equipment was also in the home and if anyone took a look at it.

What about the small m, h, and y notations below certain letters? Suppose you were jotting down names off your screen and you came to a letter you couldn't discern. You know like L's and I's, or O's and Zeros in certain fonts. You might record both what you think it is and what it could be to remind you to try both.

What are you expecting to find? The location of the arc of the covenant?

This discussion is pretty-much the definition of 'people with too much time on their hands'. (Yes, I'm one!)

A bunch of random strangers on the net are unlikely to understand the meanings that were in the person's head at the time, if it is even genuine, so you are starting from about 3 miles behind the starting line, and even if you construct something 'intelligible' from the letter, it will be devoid of actual meaning.

If the person wanted to communicate something, they would have just written, recorded or told it.

I am surprised and disappointed at Bruce for relaying the personal details of the deceased in this matter.

test

Here's my take so far. I'm going purely by the characteristics of the note and assuming that it is a cipher and not attributing intent or audience.

It's some variant of an OTP cipher. The 8 left and 8 right hand margin characters as the keys (or an encryption of the real keys) and they are repeatedly applied to 8 or 16 characters at a time.

KEYS
Most of the keys are all the numeric keys on the keyboard. I think that they are also encrypted--not with OTP, but some other simpler algorithm since OTP requires keeping the keys secret (ie, not written down with the message). Also, my guess is that the ? character is really a ? (ie, unknown or unwritten) for further secrecy. If it is a ?, then I figure that it may be guessed by figuring out the algorithm of the key or decoding the message. Another possibility is that it is an encrypted 8 character key that is decryptable by the other key.

ARITHMETIC
In order for decryption and encryption to happen with OTP, you need to find a way to assign numbers to the characters so that you can perform basic arithmetic for encoding and decoding. I tried the ASCII suggestion--it seems appropriate as it covers all the keys in the note and its known to most computer guys--but not much luck yet. Another number assignment mechanism could be EBCDIC or, perhaps, the thumbcode table--but these were far too esoteric, I think, so I didn't even go there.

CYPHERTEXT
64 characters encrypted with an OTP cipher variant that encrypts 8 or 16 characters at a time. My guess is that its decryption is a straight addition or subtraction with the key with some modulus arithmetic to produce 52 characters (for upper and lower case letters). It may not be straight mod 52--I tried this for a while but with no success--but, again, using the ASCII number assignment. The problem I had with ASCII is that there are characters in between upper and lower case letters so I couldn't do a straight modulus without including those characters.

I'm doing this stuff on my lunch break and I don't think I've explored this theory as much. Perhaps someone with more time on their hands can follow this trail and be more fruitful

Fathead

Given the nature of the perpetrator and the proximity to the laptop, I would suggest that these are ciphers for screen names for other disturbed individuals or maybe even Internet victims. Even if one had sufficient information to decode the names, the value to a prosecutor or the family seems negligible. My guess, there’s more data on that laptop that could point to a solution.

To the "doubters",
First things first - Ken is NOT a "hoaxer"! This is a genuine concern for him to try to get some consolation for his friend....

As some people have brought up - do you see this floating around the internet other than on this site???? The answer is NO! The ooooooooonly reason why you even see it HERE is because Ken was a close friend of Linda's and IS a close friend of Jenn's.

As for the "ark of the covenant", the "pot at the end of the rainbow" or "buried treasure"....... I only hope that you people who wrote such things NEVER, EVER, EVERRRRRRR experience such a senseless loss of a loved one.....

They know that there IS no "making sense" of what happened on that terrible night but the puzzle just added to the confusion of "WHY????"...

I only hope that Ken is the only one to have read all of the tasteless comments - which even he shouldn't have had to!!!

There are obviously SOME very intelligent people on this site and I wish the "others" would just leave THOSE people the space on here to give Ken an answer one way or the other... be it a password list or something else..

J

Bruce -

It looks like I stirred up a hornets nest. I didn't realize that there could be so many cruel people out there. The most unfortunate thing is that I think my friend Jenn found your web site. I know she has done Google searches with her mom's name in the past.
She hates me now. We haven't spoken all week. I can't really say I blame her. I had no right to have her family's name splattered all over the internet without consulting her first. I was only trying to help. I was hoping to get asnwers for her. I apologise for taking up your time.
Could you please take it all off of your web site? Even out of the archives?? The damage is done....Jenn and my friendship is over. I cannot see adding to it by leaving it out there.

Thanks,
Ken

First of all, I would like to thank the individuals who took the time to research this and help my friend Ken. I would also like people to know that this is not a hoax. This is the real thing.

This has been a tough 2 years trying to figure out what this Cryptogram means. Maybe I will never find out but it is nice to know people are out there willing to try.

As for the people who think that this is a "hoax" or "chain letter" and put disrespectful postings on this site, I do hope you never have to experience something like this. How would you feel having people make jokes about your mother and brother? It is NOT right. As Jeff stated, if you are not interested in this, why don't you leave space for others who are serious in helping?

Again, thanks to all for your comments. They are interesting.

Jenn

A bit too extreme and simple but it does convert into a nice FedEx tracking number. 8573 7757 8788. Even in the company format.

I feel sorry for the people that feel they need to make comments like some of the ones above.

If all you can do is call something like this a hoax or "spam" without first trying to validate your claim then you should not contribute to a post like this or any other.

I came into this posting wanting to help analyze the code above, now I kinda just feel annoyed and angry towards those people that feel they are better than everyone else and can joke about something like this.

i hope through the work of the people in here that may want to help that we can find an answer somewhere, but as the cliche goes "if you can't say anything nice don't say anything at all"

Personally if it was my decision I would ban your IPs, but it's not.

I think it's a password cheat-sheet.

I believe the passwords are read left to right, and that the four bits of information for each position -- lowercase, uppercase, line below, and line through -- indicate a fixed direction from the key to get the actual letter to enter.

The one line that makes me doubt this theory is the three character "password" in the third line.

"The one line that makes me doubt this theory is the three character "password" in the third line."

@zippy
This could also be a PIN (of sorts):
For example if you rot13 Mmg you get Zzt which could stand for ZERO ZERO TWO, ZERO ZERO THREE, ZERO ZERO TEN, etc.

Mmg could also be a mnemonic device for something like Mikemikegolf

Until something can be ruled in, it is difficult to rule anything out.

I would imagine that this could be made for humans that don't necessarily need to rely on computing something to understand its purpose or use.

Israel Torres

This might be an unnecessary comment but my take on this would be:

To short to be anything other than passwords, codes, etc (This only applies if the paper was the only one with strings of gibberish).

Could the capitalized letters be the beginning of new words or where to hit the spacebar? Like This For Instance
(This would pretty much exclude defined words since there are up to three capitalized letters in clots)

Those freefloating letters ( m r (?) H) Doesnt really resemble the characters nearby, thereby discrediting them as "alternatives". Take the m for instance, floating between A and a C.

The circled in d at the bottom of the page seem more "flowing" than the rest of the letters. For instance you (or at least I) can't detect pressure points, quite opposite to the other letters and symbols (but its early in the morning).
My point here being that its possible that the d was written by someone else.

Im wondering about the significance of the "sunken" capitalized O at the very end of the horizontal writing. If its true that the vertical lines were written in beforehand (which in itself would be odd if they werent different in some way, I mean, why start writing vertically if you have space left on the paper) this could be attributed to lack of space.

Was there anything written on the other side of the paper? If not, and space was an issue, why didnt he use that side to fill in stuff?

Just some random thoughts about the matter.

The only way to test the password theory would be to try each of those "passwords" against accounts that David used, but we don't know of any, do we? And even if they were passwords for email accounts or such, most of them would probably have been expired by now. So we cannot prove the password theory one way or the other. Our only hope is for some DVD-Jon to crack this!

The RHS could be an 8 character coded username, the LHS an 8 character coded password, and the stuff in the middle a message, or shorthand instructions having logged on to whatever site.

Bruce,
If you believed Ken when he sent you this note, then why didn't you honor his request on Feb. 9th to remove the note and article from your blog? Now you've told your whole CRYPTO-GRAM newsletter audience about it (on Feb 15th), which will only upset the victim's friends/family more. I wouldn't be surprised if someone in the media picks up this story. "Codebreakers Try to Solve Murderer's Puzzle".

My main complaint about the password theory is there doesn't seem to be any indication of what the passwords are to. Do we expect he simply remembered the first was amazon, second hotmail, third ebay, etc?

Also the whole paper has the look of being a copy, and of being written all at once. Neither of those properties are likely true of a password list.

I keep password lists, but I label them, and add to them gradually, and don't make copies.

Other passing observations:

I think he captioned the ampersand because it was drawn poorly and hard to recognize. That makes me think it was added late; if it was the first ink on the paper he would have discarded it and restarted.

The whole has the look of being a copy. He must have had notes. If it was encrypted by hand they might have been extensive, I do hope someone has looked for them.

I agree that the lines through some letters is simply used to distinguish upper and lower case.

I've worked lots of game cryptograms, and this one has very few short words.

Bruce/Ken:

Is the laptop still available or was it taken by the police as evidence? I ask because I am an experienced forensic analyst and would be willing to volunteer my services in reviewing the contents of the laptop, if an image of the hard drive could be obtained.

This probably is a copy of the original. If it *is* a password sheet, he's probably written it a few times on scrap pieces of paper.

I believe Ken said the paper was 6x6, which sounds like a scrap paper to me - and I know I've copied my password lists from post-it to notepaper to scrap paper hundreds of times as each wore out.

The other thing I thought of, aside from the interesting ideas already posted, is what if the horizontal lines corresponding with the vertical ones are supposed to be taken out, ie the horizontal lines corresponding with a symbol, like the ampersand, etc. are supposed to be taken out.

Or that they are supposed to be added to the beginning or end of the previous line, as in percent (p) and question mark (q) go to the end of the line, whereas ampersand (a), and sign (a) and dollar sign (d) go to the beginning of the line.

Perhaps we are all reading too much into this as well. It might be something so simple we ALL missed it - or its so complicated only his mental health professional might be able to solve it.

I'm sorry to make the following comments, but it is a mistake to take things at face value. I apologise if I'm wrong.

My comments concern the timing of things - at the point at which people are asking for proper evidence the relationship between Ken and Jenn seems to break down, so he can no longer get further evidence. Jenn then posts a reply which shows no emotion, but which gives no further information other than she finds the postings "interesting". She does not mention the laptop at all, or give any corroborating evidence.

There are good reasons why this could be genuine behavior, but it could equally point to a hoaxer. There are people out there who would like to make a fool out of Bruce and the people who visit this site.

is micheals first name charles?

Observations...

1) If it's a password list, why "sign" it with a circled "d" at the bottom.

2) If that's not a signature, what else might it be? It seems very deliberate.

3) Notice also that the signed "d" has a stylistic flair that the other lower-case "d" (in the upper left hand corner) does not. This is more evidence that it's a signature and not a random character.

4) Again, looking at the signature "d" it seems to have been written with a different pen. The ink fades on the left side of the circle, like a mark made by a traditional ballpoint pen when the stroke becomes lighter. But all the other marks on the page are made with a fiber-tip or heavy-flow ballpoint pen. Note the blots of ink at the end of many of the characters, and no faded strokes.

5) The text is tilted to the left, indicating the author was right-handed. Do we know this about the killer?

6) The dropped "O" in the last line is curious. There was ample room NOT to drop it, especially if the lines on the sides were written last. But even if they were in place already, the author seems to have intentionally dropped the "O". No other character does this, and it's also, interestingly, the last character of the main body, before the signature.

7) All of the non alpha-numeric symbols can be found on a keyboard above the numbers. Except the question mark in the lower right hand corner. That's also the only character of punctuation in the entire note. If these are random characters, it seems you'd have instances of many of the other keyboard character that surround the question mark on that side of the keyboard. But there are none.

8) He explicitly notes that the "&" is an ampersand. If this were a note exclusively for his own use, why would he do that? It seems clear enough that the author wouldn't have to describe it to himself, only to someone ELSE who was going to be looking at this and trying to make sense of it.

9) However, the captial "A" in ampersand does not match the capital "A" used elsewhere in the note. Note that the note's "A"'s are rounded, and the ampersand "A" is angular. Perhaps that was written later by someone trying to decipher the note.

You can't analyze the handwriting, the paper it was written on, or anything about strange techniques in spacing, characterization, lines, etc. because the original sender of this stated specifically in subsequent comments above that what you are looking at is hand-copied by him from the original.

This would mean that you can't analyze the dropped O at the very end (that would be a result of not enough space left on that line when copying).

It also could mean (would have to check with Ken on this) that the word "ampesand" was written by Ken and not by the murderer to indicate what that symbol was. It could also mean that the various dropped letters ("r", "m", and "H") were put there by Ken and not on the original.

I may be stating the obvious to those who just read through all the comments (like me), but for those who didn't bother to read all the way through, I wanted to point out that this is a hand-copy of the original and that you cannot analyze handwriting or specific uniques to the paper or style in which the letters/symbols are written.

Just a quick observation that this seems to me most likely not related to the murders ( lending to the password theory or the like ) I'm surprised no one's brought up that this would be a second suicide note which would be rather strange. Suicides connected with murders usually directly follow the murders, not leaving much time or focus for encrypting. If the fellow knew these passwords a quick look at this sheet no matter how it's encrypted would probably remind him ( just by length / case ), but as for decryption we're bound to be looking at somewhat random password info, making it a daunting task at best.

For all any of us know, these ARE passwords without encryption.

I've read all the comments for the first time, and I've a few observations - they may not actually mean anything, but here goes.

Regarding the lowest symbol, which seems to have been assumed to be a 'd' in a circle, the script is very different to the rest on the page. For instance, it is obviously formed from two discrete strokes, whilst most of the rest are seemingly done with one stroke. If it is a 'd', it is quite stylised. Equally, it could be an 'a' or a 'cl'. To my, admittedly untrained, eye it looks to be made by someone other than the person that wrote the main body.

The second comment concerns the figure that largely seems to be called an 'r'. There is at least as much chance that it is a 'v', or maybe even an 'L'. If you look at the 'L' on 5th line the downstroke also goes below the cross-stroke. If this is the case, the mystery letter was written at a different time to the rest, as it is slightly skewed anticlockwise.

Lastly, the 'L' and 'I' on the 5th line, the 'mystery letter' and the 't' on the same line, and possibly the 'h' on the 9th line all seem to have been written with more emphasis than the others. This could indicate that they have special meaning to the writer.

It is possible that the circle d on the bottom of the paper indicates it is part of a series.

I find it strange that every letter of the alphabet is used at least once. It would be very odd for someone to write a suicide note and use every letter so I do believe there is no straight substitution cypher that will work here. More likely, there is a solution based on overlaying the entire alphabet over an existing work. Any books or poems found on the scene?

I would not be suprised if the alphabet overlay was repeated, once uppercase and once lower case. That may explain the different cases. Then again, each uppercase may also signify the start of a new word.

I think the spaces (sometimes referred to as underscores) are just a way of noting the number of letters in what he was trying to say. Also, there is no way that many seven or eight letter words are used in such a short amount of space so the actual line distribution may be ignorable.

Not a huge crypto person, so I might sound like an ignorant hick here. Appologies in advance.