Handwritten Real-World Cryptogram

I get e-mail, occasionally weird e-mail. Every once in a while I get an e-mail like this:

I know this is going to sound like a plot from a movie. It isn’t. A very good friend of mine Linda Rayburn and her son Michael Berry were brutally murdered by her husband…the son’s stepfather.

They were murdered on February 3rd, 2004. He then hung himself in the basement of their house. He left behind a number of disturbing items.

However, the most intriguing is a cryptogram handwritten on paper utilizing letters, numbers and symbols from a computer keyboard. Linda’s daughter Jenn was the one who found the bodies. Jenn is a very good friend of mine and I told her I would do everything within my power to see if this cryptogram is truly a cryptogram with valuable information or if it is a wild goose chase to keep us occupied and wondering forever what it means.

I have no idea if any of this is true, but here’s a news blip from 2004:

Feb. 2: Linda Rayburn, 44, and Michael Berry, 23, of Saugus, both killed at home. According to police, Rayburn’s husband, David Rayburn, killed his wife and stepson with a hammer. Their bodies were found in adjacent bedrooms. David Rayburn left a suicide note, went to the basement, and hanged himself.

And here is the cryptogram:

The rectangle drawn over the top two lines was not done by the murderer. It was done by a family member afterwards.

Assuming this is all real, it’s a real-world puzzle with no solution. No one knows what the message is, or even if there is a message.

If anyone figures it out, please let me know.

Posted on January 30, 2006 at 10:15 AM409 Comments


Donald January 30, 2006 10:46 AM

This seems to be the usual chain letter which likes to reference a real-world incident. Referencing real-world incidents is an attempt to fool the reader.

It seems to show security folks who do not work in corporate security and a day-to-day basis can easily get caught as well.

Right, Bruce?

Tim R January 30, 2006 10:56 AM

Hoax or no hoax, you must admit the challenge of it all is tempting. The skeptic in me says that the solution, if it exists, reveals that the whole thing is just a ruse. The intellectual in me says, “Bring it on”.

p January 30, 2006 10:57 AM


I have never received a chain letter that contained a cryptogram. I wish I did, it would make spam much more fun.


Mike January 30, 2006 11:04 AM

Surely deciphering this would be easier with a lot more background information not to mention the other items to begin to peice all this together?

This just seems more like someone mentally ill who has murdered people and tried to leave some kind of film-plot type legacy, or a bizarre chain mail …

Corey Mutter January 30, 2006 11:14 AM

@p (re: spam would be more fun)

I’d hate to spend the time to decrypt the cryptogram in an e-mail, only to find it says “Be sure to drink your Ovaltine”…

Eric January 30, 2006 11:20 AM

At the very least it would be helpful to know about David Rayburn’s background.

Did you have an interest in cryptography? Is he known to have read books on cryptography, and if so, which ones? Was he mathematically inclined? Was he more of an artistic type of person? Is there reason to believe he was schizophrenic?

Alun Jones January 30, 2006 11:22 AM

I wonder what’s under the white-out on the left-hand side of the page? The shapes don’t look like mere scanner artefacts.

Also, note that the boxed letters have the same number of letters as the name of the protagonist, David Rayburn (or his wife, Linda Rayburn).

Decryption could be complicated by the spelling – note that “ampersand” is mis-spellde.

Bill P. Godfrey January 30, 2006 11:27 AM

Are those white marks on the side of the page? Looks like someone has tippex-ed out a few symbols.

(Or have my eyes just gone funny?)

Drawing the rectangle seems a very strange thing to do. Anyone know why?

Kevin January 30, 2006 11:38 AM

The “white out” areas are probably where somebody did a simple decoding of non-alphabet symbols, then erased their work. I’m guessing this was done by a family member.

I’d echo the comments of others – mor context could really help… A forensics analysis of the original (indicating, for example, whether the lines or letters were written first; which letters were written with rapid vs. slow strokes of a pen; etc.) might reveal something about the cipher method used. A history of the author and his knowledge of cyphers/cryptology would be especially handy.

Davi Ottenheimer January 30, 2006 11:42 AM

I’d find out more about the perp’s habits before proceeding. If he had just completed three marathon sessions of “Close Encounters” or similar sci-fi, this could be nothing more than an attempt to connect with a world he had invented, which has no meaning in ours. He clearly wasn’t thinking rationally, so it has to help to get some background on the purpose of the writing. There should be a plethora of related evidence to dis/prove a worthwhile context (unlike a 1,000 year old puzzle). Maybe those are just the passwords he used to login to his computer.

weenerdog January 30, 2006 12:23 PM

Odd that it seems to be overdetermined; more symbols used to specify fewer (presumably) alpha-numerics… or some sort of ASCII character permutation?

Emmanuel Pirsch January 30, 2006 12:24 PM

Maybe he’s not the one who wrote this letter.

Maybe he is the one who decrypted it… With the knowledge of the plain-text, he quickly erased what he scribbled on the paper… Went crazy and we know the rest of the story!

Phil January 30, 2006 12:45 PM

Seeing the circled “a” at the bottom of the page I think it might be only the first of several pages. I would be interested to know if this was the only page found.

Yvan Boily January 30, 2006 12:53 PM


I think it is more interesting that only certain characters are offset below the line for lower-case characters.

There are (super|sub)script characters between the last four lines; are these significant?

Is the last character of the last line offset to a new line significant?

I agree that it would be an interesting challenge to try and solve this, but there may not be enough information on hand to solve the puzzle, especially considering mentally stable individuals usually don’t kill their family and then commit suicide.

Then again, the geniuses I know would be considered unstable….

MikeJ January 30, 2006 1:13 PM

Just guessing here… that last character on the bottom might be a lowercase ‘d’ for david, i.e., a signature.

Perhaps this is based on an 8×8 grid. He seems to have selected 64 characters for his alphabet – 26 upper and lowercase letters, upper and lowercase numerals 3,4,5,7, and 8, the question mark, and one other that appears unused (maybe the ‘/’, the lower-case question mark?). He might have skipped ‘6’ because the caret looks too much like a V.

So, maybe the two vertical strings of eight chars describe how his 8×8 grid is scrambled. Just a thought…

Ed T. January 30, 2006 1:15 PM

I think I have seen this before. it is a special message, which translates as follows:

“This message is from the NSA. While illegally spying on Al Quaeda terrorists and US residents communicating with them on orders from our god, the Great One Who is Named ‘W43of9’, we noticed that your PC has been accessing illegal web sites. Please provide us your PayPal userid and password, along with all your credit card numbers and PINs, at the following link: (link removed). Now, issue the following command on your PC – format c:\ /q/u”, and then go down to your local DHS office and turn yourself in.

Resistance is Futile. You Will Be Assimilated.

Have a Nice Day :)”


cw January 30, 2006 1:18 PM

It is interesting that symbols and numbers (%4@*&7#3?) appear on the sides, but not in what appears to be the body on the message.

Yvan Boily January 30, 2006 1:19 PM


given the sample of the writing, and the “a” characters on lines 2, 9, and 10, I think that is a more likely a “d”, not an “a”. The tie on the circled letter is clearly a separate stroke, which is not consistent with the other letters.

That said, the circled letter is not consistent with the other letters on the page, and as a result may have been a notation that was added by someone else.

MikeJ January 30, 2006 1:25 PM

My mistake – he’s using the ‘@’, suggesting that the numeral 2 is also used. That’s enough characters to give him his 64 letter alphabet. Dunno what that question mark is all about…

Lou the troll January 30, 2006 1:38 PM

Anyone check this against recently (relative to the incident that is) published 8×8 puzzles? Maybe it’s something innocent that he was working on and unrelated to the event.

Lou the troll

another_bruce January 30, 2006 1:40 PM

first of all, bruce schneier should query the sender, not so much to gather context for solving this, but just to establish his bona fides. was this thing actually found at the murder scene, and how do we know this?
i squinted at it for a minute. eight characters on each side of the text, oriented perpendicularly, all seeming to come from the top line of the keyboard (not counting function keys), the suggestion that they operate on the text somehow would be even stronger if there were eight lines of text instead of at least ten (eleven if you count the dropped o at the end). weenerdog’s suggestion of an ascii permutation is plausible.
starting from the other end, what could this fellow possibly want to tell us that he would resort to crypto, and the related question of what could he possibly tell us that would be worth our time to figure out?
“i killed them because…..”
here’s a quarter, call someone who cares.
“the treasure is located…..”
there would have to be a foundation laid that this guy knows where the bearer bonds/solid gold pre-columbian artifacts/money from the armored car heist is.
whatever story this is is a story in only 64 characters of principal text, not counting the three tiny letters between characters in the lower left corner, which suggests that a nutball is trying to screw around with people’s heads.

lkv January 30, 2006 1:42 PM

There is an interesing detail: the digit 7 in the left column is crossed. It’s not usual thing for an American to do…

Anonymous January 30, 2006 1:54 PM

@lkv : I wouldn’t say it’s that’s anything of note, beyond establishing a handwriting match with his previous correspondence.

Steve Golf January 30, 2006 1:57 PM


I’m not a trained cryptanalyst, so it may be nonsense what I’m writing, but perhaps it could help mentioning about some things:
– the lines don’t have the same length;
– the line lengths in the horizontal ones are (5, 7, 3, 7, 7, 5, 7, 8, 7, 8) – perhaps an unlikely sequence for continuous text, but perhaps not for single words
– the max. line length is 8 chrs.
– there are 10 horizontal lines plus two vertical ones
– the vertical lines both have 8 characters
– the upper-case letters are not striked out
– four Characters are not on a line: m, r, H and the encircled one
– Special chars and numbers are only used in the side rows
– “&” ist the only char with its Name written beneath
– the first 5 lines keep the column order, the others seem a bit squeezed. this may be beacuse the two outer text lines were written first
– the last char (O, lower right) ist out of line, but not due to space limitations (would easily have fitted in line)
– the notice seems unlikely to be written hastily, as the “q” are carefully drawn – but the “*” and the “?” are not so carefully written

hope this helps a bit

RonK January 30, 2006 2:07 PM


I rather doubt that it decodes to “the treasure is located…” (or at least would lead you to a real treasure) since economic problems seem to have had some part in this guy becoming unhinged…

Assuming that the cryptogram does have some connection with the murders and suicide.

Kevin Davidson January 30, 2006 2:08 PM

The cryptogram may be deciperable, but the context won’t fly. The Boston Globe article about the murder/suicide mentions nothing about the note being cryptic, they said:

“MacKay said the suicide note made no mention of financial troubles.”

That sounds like they were able to read it. If there were a juicy angle (“undecipherable note”) then the newspaper would surely have played it up.

steve Golf January 30, 2006 2:15 PM

@Kevin Davidson

true, but only if they had a look at the note, and haven’t asked someone (“does it say sth about fin. probs?” “no” – ok, unlikely) and if there wasn’t another note.


Filias Cupio January 30, 2006 2:26 PM

Several people have noted that lowercase letters have a line through the middle, but not uppercase.

I don’t think this is cryptographically significant – it is just a way of disambiguating characters such as w and W.

RC January 30, 2006 2:28 PM

Based on the number of letters in each word, and the circustances surrounding the note, I suggest that the first few words are:


After that, I think that the note breaks from the one word per line rule. Given the above assumptions, the note might be decipherable.

Donald January 30, 2006 2:32 PM

Hello, and thank you for reading this letter. You see, there is a starving little boy in Baklaliviatatlaglooshen who has no arms, no legs, no parents, and no goats. This little boy’s life could be saved, because for every time you pass this on, a dollar will be donated to the Little Starving Legless Armless Goatless Boy from Baklaliviatatlaglooshen Fund.

However, if you solve the attached cryptogram it will lead him to his family’s lost fortune. Hist story is covered here: http://www.goatse.blah/virus.pif

Oh, and remember, we have absolutely no way of counting the emails sent and this is all a complete load of bull. So go on, reach out. Send this to 5 people in the next 47 seconds.

Oh, and a reminder – if you accidentally send this to 4 or 6 people, you will die instantly.

Thanks again!!

jeroenr January 30, 2006 3:02 PM

I’d say… the horizontal lines were drawn first, because he knew how many letters per word he needed to write, then he started to code the words and filled in a letter on each _ (maybe because the coding he used forced him to write the letters down in a different order than the original text). I think the characters written sideways are the key.

Andrew January 30, 2006 3:09 PM

Snopes returns nothing relevant on the words: cryptogram, Rayburn, code, coded message.

Google likewise turns up nothing helpful in solving or confirming the message origins.

Jackson January 30, 2006 3:15 PM

I was thinking the vertical lines were drawn first. All of the lines slant upwards. On the horizontal part, the first letter starts right next to the left horizontal line. But if you look at the end of each line, the bottom rows go further out to the right. The writer had extra room there because the vertical line on the right side slanted up when it was written…

Jackson January 30, 2006 3:17 PM

Clarification – meant to say “on the horizontal part, the first letter starts right next to the left vertical line.”

Joe January 30, 2006 3:20 PM


Since this was an e-mail, did you receive the “handwritten” cryprogram via jpeg format attached to the e-mail?

Fathead January 30, 2006 3:24 PM


I guess the comment that the rectangle was added later on was indicated in the e-mail (just as the indicator that the characters were keyboard keys)?

Marion January 30, 2006 3:26 PM

May or may not be significant, but both of the vertical lines have the same pattern to the first four characters. 1) lowercase letter 2) character 3) uppercase letter 4) number. Characters 5-8 don’t fit that pattern though, so it may just be coincidence.

jeroenr January 30, 2006 3:29 PM

Clarification to my prev post:

“the horizontal lines were drawn first”
should be read as:
“the lines where drawn before the letters were written,”

D January 30, 2006 3:30 PM

The lower-case letters written half-way below their lines seem to be unimportant– looks like an indicator that says “yes, this is lower-case”. There would potentially be confusion with the author’s ‘k’ and ‘c’ letters without this indicator. Also, there’s a letter ‘s’ that could be a ‘5’, except that it’s written in this lower-case letter style.

Assuming this was authored by the murderer, then the crime is that of a deeply sick individual rather than someone who was depressed over a weekend — he took plenty of time to plan his actions including enciphering a complex note.

Based on this [highly speculative] assumption, and other information, I’m on board with the hoax theory. Seems to me the police would have mentioned a “cryptic note” sooner, wvwn if they couldn’t release it to the public. However I do believe there’s a message here … but probably a dissappointingly bland one.

Alex January 30, 2006 3:51 PM

This piece of paper looks like a hangman game. Maybe he was playing hangman with himself and lost.

Kevin January 30, 2006 3:52 PM

Filias – good catch. Which brings about an interesting point: the lines were almost certainly filled in prior to the letters.

One must imagine, then, that whatever this note was (a mysterious cryptogram or a meager password cheatsheet) – it originally looked like a large “hangman” puzzle before the letters were filled in.

Perhaps he was a bad hangman player, and took the game a bit too literally


That said, I would wager my money on this being a password cheatsheet. The ex-internet professional probably carried around this sheet of pseudo-random characters with his own personal mnemonic system for gererating new and old passwords from it. The characters are too high in entropy and too uniformly distributed to be a simple substitution cipher – and if it is a more advanced subst cipher, then there’s too little information to crack it via statistical methods.

grif January 30, 2006 3:56 PM

I counted the characters of the “body” of the message (i.e. the part that is not written on the side) and excluding the fifth character in the line that starts with Efbd… because I was unable to identify it – I also excluded the super-/subscripts:
(A, 2), (B, 1), (C, 1), (D, 2), (E, 1), (F, 1), (H, 1), (I, 1), (L, 1), (M, 1), (O, 1), (P, 2), (Q, 1), (R, 2), (U, 1), (V, 1), (W, 1), (X, 3), (Y, 2), (Z, 1), (a, 3), (b, 2), (c, 2), (d, 1), (e, 1), (f, 3), (g, 1), (h, 1), (i, 2), (j, 1), (k, 2), (m, 1), (n, 1), (o, 2), (q, 1), (r, 1), (s, 2), (t, 1), (u, 2), (w, 2), (y, 1), (z, 3)

Note that it spans both the upper and lower case alphabet pretty evenly.

Koray Can January 30, 2006 3:58 PM

If this is the only cipher text found in that household with these, this can be something like a simple encryption scheme that he and his girlfriend in highschool had invented years ago. It shouldn’t be difficult to crack provided that the deceased didn’t misspell anything or misapply the transformations.
To be honest, it looks bogus to me.

Intrigued13 January 30, 2006 4:07 PM

These could, indeed be passwords. Notice that there are 12 lines in total and this could have been the ‘cheat sheet’ to remember them.

Or maybe this was written in octal?

another_bruce January 30, 2006 4:13 PM

the uppercase “i” at the end of the fifth line seems unique in that the upper and lower bars of this “i” are broader, suggesting the stylus may have traced back and forth over this part of the sheet several times; everything else there appears to be the product of a single trace.
i don’t know if this is significant. it doesn’t look like he was changing another character to “i”. there might have been a subconscious emphasis on writing the pronoun which represents the writer, more so than if the “i” actually represented some other letter.
we need vanna white to come in here and turn over two or three of those to help us!

steve golf January 30, 2006 4:28 PM

question: as we don’t have many ciphertext and very little Information about the structure and content of the cleartext, the only breakable ciphers would be very simple ones as for more complex ones the unicity distance would exaggerate our ciphertext length, wouldn’t it?


ed January 30, 2006 4:58 PM

Don’t anybody blurt the answer:

How many people who use the construct “s/?/?/” when correcting their text know that construct’s origin?

I’ve been seeing it more and more frequently, so I’m wondering if people are just copy-catting or if they’ve actually used the construct in question.

Please, don’t take insult to my wondering!

Knowler Longcloak January 30, 2006 5:01 PM

I may be totally off here, but it looks like a recitation cheat sheet.

It is a method for helping you remember a long passage by writing down the first letter of each word. You put the capital letters in as capital letters to help you remember the difference between proper names and the beginning of sentences (i.e. where to pause).

ac January 30, 2006 5:12 PM

Ed (ha!),

I would imagine most do–I’ve only ever seen it on techie forums, and it’s a minority even there. I’d say it’s rare enough that people actually know what they’re doing.

Of course, I usually use s/tyop/typo/g — otherwise I might not correct all of the errors!

Jon January 30, 2006 6:23 PM

s/?/?/ is extremely common in web programming, and web programming is huge. I would expect that most people know the context.

Jon January 30, 2006 6:26 PM

I would also agree that it looks like a password cheatsheat on first glance. Does anyone know if that fist with the profile of the guy who left it?

Nick Lancaster January 30, 2006 7:38 PM

Why does it need to be anything? This is the myth of the dying clue, that Rayburn managed to leave behind some cryptic clue or insight that has puzzled investigators for over a year.

And, given the chain-letter dissemination approach, we have no confirmation of Rayburn having left this note. (I would expect some mention of ‘a suicide note filled with cryptic symbols.’) If it were a family member looking to solve a cryptogram, wouldn’t it make more sense to be posted on the web, with an archive of comments? And if privacy were a concern – that is, the message were to reference family matters, why distribute it in a chain letter?

If it is a password cribsheet, it does not seem to make sense. I would imagine that investigators had already checked Rayburn’s bank accounts, even computer(s) for any protected files.

For all we know, it’s a secret mandate of death from the Jovian High Command.

Filias Cupio January 30, 2006 8:47 PM

@Knowler: It doesn’t look like a recitation cheat sheet to me – half the letters are uppercase, distribution is very different from first-letters-of-English-words, where we’d expect lots of Ss.

@Ed: I can think of four programs which use s/././, I’ve frequently used two of them and occasionally another (when emacs is missing.) Are you using a subtle pseudonym here?

Filias Cupio January 30, 2006 9:05 PM

OK, here are the case-insensitive frequencies of initial letters of words of a substantial English text (Pride and Prejudice, plus the Project Guttenburg boilerplate, as I was too lazy to remove it.) Given the source, some letters, such as D, E and M, are liable to be overrepresented.

A: 13848
B: 6190
C: 4834
D: 3929
E: 3423
F: 4236
G: 1876
H: 10641
I: 8684
J: 584
K: 686
L: 3114
M: 6861
N: 3504
O: 7254
P: 3214
Q: 253
R: 2497
S: 9549
T: 16348
U: 1057
V: 885
W: 9185
X: 0
Y: 2393
Z: 1

Tim R January 30, 2006 9:07 PM

@grif: “I counted the characters of the “body” of the message (i.e. the part that is not written on the side) and excluding the fifth character in the line that starts with Efbd… because I was unable to identify it – I also excluded the super-/subscripts:
(A, 2), (B, 1), (C, 1), (D, 2), (E, 1), (F, 1), (H, 1), (I, 1), (L, 1), (M, 1), (O, 1), (P, 2), (Q, 1), (R, 2), (U, 1), (V, 1), (W, 1), (X, 3), (Y, 2), (Z, 1), (a, 3), (b, 2), (c, 2), (d, 1), (e, 1), (f, 3), (g, 1), (h, 1), (i, 2), (j, 1), (k, 2), (m, 1), (n, 1), (o, 2), (q, 1), (r, 1), (s, 2), (t, 1), (u, 2), (w, 2), (y, 1), (z, 3)”

Looks like Scrabble tiles to me, except, I think Q is worth more than that.

Josh-Daniel January 30, 2006 11:52 PM

What is the possibility that this might be a rotating cypher? Not as in “ROT-##” but as in potentially each line is encoded differently, based in the line before or based on the verticals.

Joe Mason January 31, 2006 12:17 AM

Why does everyone call this a “chain letter” type distribution? Crypto-Gram takes up 2 of the top 3 Google hits for “cryptogram”, and scanning the column for a bit reveals that sometimes Bruce posts items sent in by readers, so he’s obviously not averse to unsolicited mail. Sounds like a pretty well-targetted one-off mail to me.

Nick Lancaster January 31, 2006 1:41 AM

@ Joe Mason:

The ‘chain-letter’ attribution is perhaps premature, but fits with the ‘close friend of victim’ reference, plus the appeal for help. While it falls short of ‘send this to everyone you know,’ it isn’t far removed from ‘school project’ style chain-letters (surveys, touring cartoons, etc.).

Still, I find it odd that no wide mention of the cipher was made (i.e., it didn’t show up in the newspaper). If it were the suicide note, it would be retained by the police, not the family. (Which could account for some of the artifacts on the image, possibly from a poor photocopy/scan/fax.)

In the short story, ‘The Pointing Finger,’ Isaac Asimov has a character express his distaste and innate distrust of the ‘dying clue’ – that someone who is dying (or, in this case, in a frame of mind to commit murder/suicide) produces a clue that takes healthy minds days, if not weeks, to unravel.

If this is just a piece of paper from Rayburn’s belongings, and not the actual suicide note or portion thereof, then assuming it is connected to the murder is a bit of a stretch.

The context is important, yet we have none. Was it in Rayburn’s pocket? In his car? At home? Received in the mail the next day? What was Rayburn’s condition in terms of medication? Did he hold opinions about space aliens or secret conspiracies that might be involved?

It’s not like ‘Hey, the Germans are transmitting these signals on a regular basis,’ and we can follow traffic patterns as well as land an educated guess as to the content.

tomtomclub January 31, 2006 3:06 AM

Without being able to authenticate the original sender’s identity it is hard to believe that this is not a fake. If I were the sender with serious intention I would have provided some mechanism for feed-back inside the message body (for if people pass it on). Whom shall I tell if I solved the puzzle?

So Bruce, do you know the sender, do you have a reply address? Or was it just a test…

And, don’t the authorities, FBI, CSI or whoever have the specialsts for such a job? Anyway, looks rather psychotic to me, that note.

Alex Young January 31, 2006 4:46 AM

Josh: It’s got to be. At least, I find it extremely unlikely that each character is encoded with the same key. Why? There are no symbol pairs. It’s quite unlikely for that to happen in a 64-character message. I’m sure someone’s got the exact statistics handy 🙂

peri January 31, 2006 6:56 AM

Raw transcription (assuming O is final letter in last line):


Grouped transcription:

d%K 4q@h* y&#7 V$3?

WjuP DqXo Rwis MmgH
kcFB feXn Loyu IwAz
QYbU ktPs qAcZ fiYz
DCRV hXqz Efbd qarO
16 Characters used in the two vertical lines:

64 Characters used in the horizontal lines:

42 Unique characters used in the horizontal lines:

Unique characters used throughout:


Josh H January 31, 2006 8:42 AM

The white-out is interesting. It appears to annotate the symbols going down the sides. This is a bit forced, but the white-out adjacent to the $ looks a lot like an ‘M’. If we trace that up in alphabetical order, we get the somewhat ‘J’-ish symbol next to the #, all the way up to the possible ‘A’ next to the %. This doesn’t really make sense, but I thought I’d throw it out there.

JD January 31, 2006 8:59 AM

I go along with the guess it’s a password cheat sheet. How many of us use a simple encryption scheme on the passwords we write down? When the plaintext is essentially random garbage (i.e., good passwords), even a rudimentary cryptosystem is mighty hard to crack.

Jim Hyslop January 31, 2006 9:36 AM

The CIAC maintains a fairly comprehensive list of known email hoaxes, chain letters, etc. A search at their Hoaxbusters web site (http://hoaxbusters.ciac.org/HBSearch.html) doesn’t find any relevant hits on Rayburn, suicide, nor crypto.

So I would venture to say that the email Bruce received is either genuine, or a fairly new hoax that hasn’t made it onto the CIAC site yet.

jammit January 31, 2006 11:04 AM

I’m going to tread in waters I have no business going into. I keep hearing of a suicide note. Were there two messages, one suicide and one crypto? How many modifications have been made to the crypto? Already a box has been added, and there seems to be whiteout on it. We can’t be sure the whiteout was added after the message like the box. The only thing I can add is if there were two messages, perhaps this crypto one is a cypher for the plaintext note. Maybe info is hidden in the plaintext. Right now I think we can all agree there is some data missing. Even an easy sustitution (a=1, b=2) would be difficult, or impossible, if a few sheets were missing.

fjen.dll January 31, 2006 11:32 AM

Perhaps the vertical columns represent a key in some sort of keyboard typing pattern. The first column includes the letters ‘d’ ‘k’ ‘g’ and ‘h’. If you examine a keyboard, those keys represent, in order, your left middle finger, right middle finger, left index finger, right index finger. These keys are all on either side of the “home” keys (the keys with the little nubs on them). Haven’t gone any farther than this, but it’s another angle to look at.

David Harmon January 31, 2006 11:54 AM

Regarding the use of s/foo/bar/g, it’s been a ‘Net idiom since at least the late 80’s when I came around. Of course, back then the net was still mostly techies and semi-techies, and UNIX was a major factor in its growth. I rarely use it “publically”, precisely because it’s an “in-joke” that many readers won’t understand.

Cher January 31, 2006 11:58 AM

“He left behind a number of disturbing items.” Would be good to have some idea of what those disturbing items were. Also if these items (including the cryptogram) were actually a part of the crime scene, or if they happened to be discovered later among his posessions. It seems unlikely that it was at the crime scene or that it has anything to do with the crime.

Also interesting is that the box that was supposedly drawn later by a different person appears that it might have been done with the same pen. Would need the original to determine that, but the color, width, and quality of the line matches the rest of the note. Wonder if the pen pressure is also the same.

Also how do we know he was the author of the cryptogram? Has a handwriting analysis been done? Where exactly was the note found?

I agree with jammit that it also makes a difference that we do not know what all might have been added later. Perhaps the floating v, m, and H were also added later by someone attempting to decrypt it. And did the author use the whiteout, or did someone else use it later?

Just a few things to consider.

ed January 31, 2006 2:14 PM

@ac, Filias:

Pseudoynm? Yeah, my real name is Stuart Earl Dangerfield.

Are was it Peter Ebert Roger Longfellow?
Maybe it was Violet Imes?

I’m sure there’s plenty of other names I could be, but which one came first?

The reason I asked the original question was that I was seeing it on gaming bulletin boards, used by people that I would think had no experience using it based on some of the questions they asked. shrug I guess this is really the wrong forum to ask in if I were expecting a “no, I don’t know what it is” answer.

Well, it’s a joke that will never get old in my book.

D January 31, 2006 2:56 PM

@ed, et al.

s/this/that/[g] is in some way related to regular expressions. Anyone who uses regex has probably gained experience with this particular construct. I was unable to find an historical timeline or any such beast.

Personally, I learned it while experimenting with Violet Imes in my late teens. I still visit with her occassionally. What a woman…

Leadhyena Inrandomtan January 31, 2006 4:04 PM

 This looks more to me like a good case of graphomania to me, like that professor in Proof. I wouldn't doubt that he has tons of hidden notebooks stashed away with similarly indecipherable text. I say indecipherable because it looks like he made up a code in his head so complicated that it is indistinguishable from noise, and that it probably didn't make sense when he made it up, much like other people who suffer from that condition. I think that one would learn more from the psychoanalysis of the murderer what the message means than an analysis of the scribblings that make up the message.

RC January 31, 2006 4:20 PM

i think the reason for the horizontal lines is that he used transposition in the cipher. If it was merely a substitution cipher, he would not need the lines as place holders.

Cheburashka January 31, 2006 4:36 PM

I would hope Bruce and us readers could do better on this than we have…

What do people make of the odd “m” and “H” that are off-line?

James Turner January 31, 2006 7:20 PM

No one is questioning the man’s sanity. He is clearly insane because he’s murdered his family with a hammer and sane poeple do not do this. Anyone who has a friend or family member with profound Schizophrenia or Bi-Polar disorder will tell you that people with mental health issues can create nonsense like this as part of their delusion. The note’s meaning may only be that this poor guy was totally gone.

Roger January 31, 2006 7:29 PM

It seems quite unlikely that this is a genuine cryptogram. For a start, it is extremely short for any cryptogram meant to be anything but a puzzle, and quite short even for that. Further David Rayburn’s profession and the number of types of characters involved (53) suggests that if it is a cipher at all it is probably a modern computer based one, making it odd to find it handwritten.

My first thought was to agree that it’s a password list. Probably not even a “cheat sheet” so much as a simple list, because so many lines are roughly equal to typical password lengths. Plus it fits with what little we know about David Rayburn.

Two factors made me think twice though:
* Line “Mmg” is very short for a password;
* If these passwords were randomly generated from the set of all printable characters, then digits and punctuation marks are seriously under-represented, to the point of being statistically improbable.

However, the second of these issues resolves if we notice that ALL of the non-alphabetic characters appear in the two lines written sideways on the left and right edges of the page. Since these lines are written sideways rather than simply vertically, and since the characters in them do not align with the other rows, it strikes me that they have been written this way simply because the writer ran out of room. If that is the case, then they are also the last two entries. Additionally, they are both exactly 8 characters long, a very typical length for maximizing the strength of old style Unix passwords. So, it may be that if these are passwords, all the entries but the last two were generated by a random character generator which outputs only alphabetic characters, while the last two, intended to be extra strong, also allowed digits and punctuation marks.

Checking the stats again, this hypothesis matches: the distribution of symbols in the last two entries is similar to that expected by random selection from all characters. However, at this point by eyeball Mk I analysis I noticed another pattern, in the line “y&#7V$3?”. Its pattern of shifted and unshifted characters goes “.>>.>>.>”. Not impossible by chance alone, but made me wonder if it wasn’t generated by banging randomly on a keyboard. In this respect, it is also interesting to note:
* All but two symbols are from the top two rows of the keyboard (half of them from the top row), and the two exceptions are from the bottom row;
* All but one symbol is left of a line on the keyboard joining 7 to n. This is not quite the same as “left hand keys” for a touch typist, but pretty close;
* In the 8 symbols in this string, only 6 keys were used, the 7/& key and 3/# key being reused;
* That & is very close to y, and $ is very close to 3;
* That V on the bottom row is exactly halfway between 7 and $ on the top row;
In short, this does look an awful lot like the sort of distinctly non-random stuff you get when someone is trying to type randomly.

What about “d%K4q@h*”? It is also quite non-random, though not in quite the same way:
* The pattern of shifted and unshifted characters is “.>>..>.>” which is nearly identical to the previous one, except that q “should have been” capitalised;
* Every character but one comes from either the top row or “home row”.
* If we label the rows 1 (top), 2, 3 (“home”) and 4, then the pattern of rows is very regular: 31312131. Note that the obvious “error” in this pattern is the same character which disrupted the shift key pattern;
* Once again, there is a tendency to the left side of the keyboard, though a little weaker with 2 characters from the right side and one on the borderline;
* In terms of distances, we get d closish to %, big jump to K, 4 is right back to near %, then closish to q, @ right next to q, then big jump to h but it is very close to that K we had earlier, then * closish to h. Thus this kind of looks like a left hand sequence of small jumps partially overlapping with a right hand sequence of small jumps.

Once again, this “random” string is actually quite structured on a keyboard, although in a quite different way to the previous one. Actually, I would hypothesise that the string “y&#7V$3?” was generated by someone typing one-handed with his left hand whilst pressing the shift key with his right hand, while the string “d%K4q@h*” was generated by a touch typist trying to type randomly with both hands, but somewhat favouring the left hand. Question: was David Rayburn left handed?

Continuing the same analysis now with the purely alphabetic patterns, one finds that much the same thing happens for nearly all of them: each string consists of either one or two clusters of keys which are very close together on the keyboard, usually with the direction of movement within sequence being roughly fixed. The sequence of shift key usage is not totally predictable but differs a long way from randomness. For example, (unless we count running off one line and continuing on the next), from these 64 characters the longest sequence of consecutive shifted characters is 3, when we expect about 6, and the probability of it being as low as 3 (if chosen truly randomly) is about 0.006.

My conclusion is that most likely, all or at least most of these strings were generated by banging randomly on a keyboard, with the last two (sideways) strings intended to be “more random”. The typist is possibly left-handed, and there is some chance that two typists were involved, one of whom touch types while the other does not. Most likely, the strings are intended for use as high security passwords and have been written down as an aide-memoire, although of course it is also possible they are random junk intended to confuse an investigator.

Presumably, a genuine investigator or relative will have access to password protected systems used by David Rayburn, and may be able to test if any of these passwords work on them. On the other hand, as Rayburn was unemployed at the time of death, the passwords might also refer to a former employer’s systems. If still available, it might also be useful to check the web cache of any computers he used to determine if they may be website passwords.

Appendix: Machine readable version
The following version might help anyone else wanting to do an analysis. Please correct it if you see any errors. This list uses the assumption that the lines are mainly to distinguish between capital and lower case letters. Letters in parentheses were not on the lines, but written above the letter which they follow in this list. The two lines separated from the rest by a blank space are the two written sideways. The character on the second last line which gets butchered by Bruce’s HTML filter, should be an ampersand.



Dylan January 31, 2006 9:32 PM

This was my thinking too.

When I tried typing all these items in on my keyboard, the keystrokes were arranged in the sort of groupings I am familiar with from making up passwords by randomly typing stuff on the keyboard.

Other thoughts:
The O could be a sometimes-used suffix for the last password (or a reminder of sorts.)
The other small notations could indicate the usage of the password (eg H for Hotmail.)
The last two entries (written sideways) are most recent ones, probably for a system that didn’t accept simple alpha passwords.

I guess he carried this with him, and added to it as necessary.

Dylan January 31, 2006 11:27 PM

Actually looking at it again, I think the whole lot has been transcribed from another piece of paper. The dashed underlines are uniformly slanted the same way, and the paper is square in dimension and then folded in half and half again (with a small overlap) so I figure this is a pocket copy of the passwords.

The square paper would also explain why the two passwords with non-alphas didn’t fit on the paper.

Israel Torres February 1, 2006 2:31 AM

All in all, it really looks like a worn password list to me. I am interested to know if the fold in the paper existed when found or made later. There is no mention of the dimensions of the artifact to explain if it is a pocket-sized piece of paper or something kept in a binder – also there is no mention to where this artifact was found as it was only mentioned to be “one of the disturbing items left behind??? (by the deceased) – for all we know this could have been found in a storage facility far from the crime scene.

I think it is unlikely that someone went to such trouble to encode a message to appear like a password list.

Israel Torres

Roger February 1, 2006 2:41 AM

Sorry, I didn’t notice your transcription before I did my own. I just compared them, and find we disagree on just 2 letters; in both line 2 letter 1, and line 9 letter 6, you read “q” while I read “a”.

Going back over them, I still believe my version more likely to be correct, for the following reasons:
1. Look at the 3 “q” we agree on. Notice that all of them are formed with a very distinct hook (North American style) at the end of the descender? This is missing on the two disputed letters, which barely have a descender at all.
2. Look at the one “a” that we agree on, notice that the bow is very similar to the “q” next to it, but the descender stops much shorter, and obviously has no hook. The two disputed letters are the same, but the descenders are just a fraction longer — but not nearly as long as the “q”s, and no hooks.
3. Also, your transcription makes the frequency distribution much less flat, putting a single spike at “q”, with more than triple the average frequency. Mine makes it only double the average frequency and makes the whole thing look much more like a flat distribution with the typical random variations.

What do you think?

Roger February 1, 2006 3:22 AM

I tend to agree it is probably transcribed. For one thing, the formation of some of the letters generally give an impression of having been written hastily (although could just be generally careless handwriting), and for another some repeated letters are formed with the same idiosyncrasies each time they appear (e.g. A, R, q but see above re q and a) while others get much sloppier further into the page (e.g. D, r, f). Also, looking at the three letters which don’t sit on base lines — the ones I rendered as (r), (m) and (H) — I am now wondering if these represent alternative readings of the letters above them. That is, whilst transcribing an old, tattered copy he wasn’t sure if the 3rd letter of line 7 was a k or an r, similarly line 8 letter 1 was either A or m, and line 9 letter 2 was either R or H. In the case of (k, r) and (R, H) it’s obvious such confusion could arise on an indistinct copy, but (A, m) seems somewhat unlikely unless the old page was quite badly damaged. In any case, if this hypothesis is correct it suggests that those passwords were no longer in frequent use by Rayburn, or he would know which reading was correct.

Regarding folding: I have run the image through an image editor and played around with the contrast etc., and I now see three distinct folds. There is an obvious ridge fold running across the centre of the page, going through the fifth line. Much harder to see, at right angles to this first fold there is a ridge-and-valley fold starting near the P on the first line and going to the d on the bottom line. This fold was obviously made second. Finally, there is a ridge-and-valley fold at the bottom of the page, crossing the second fold, but with the two halves folded in the wrong directions and torn in the middle. This last fold is very rough and angled, and looks more like the edge of the page was roughly dog-eared over after the first two folds. At high contrast, one also sees lots of small creases radiating away from the main folds, enhancing the impression of rough handling. I am not certain if the page was folded before or after being written on, but the X which crosses the fold does look a little like the bottom of one leg was affected by it, hence perhaps folded before writing.

Regarding the page shape: I’m not sure the page is square. The image we have is cropped, and except for the tear at the centre of the bottom, the edge of the image is not the edge of the page. If my interpretation of the third fold is correct, the top of the page is only just above the top of the image, but I couldn’t guess where the left and right edges are.

Regarding the “correction fluid”: I played around with various contrast and enhancement settings, high magnification etc, trying to get more of a hint at what was under the liquid paper, and was surprised to discover that except for the one near the “%”, these spots are almost perfectly uniform white patches, with almost no variation beyond some slight raggedness at the edge probably caused by JPEG artifacts. Furthermore the edges are surprisingly straight if we are looking at a brushed-on viscous fluid; and in the patch near the “@”, we can make out a perfectly square block of erasure which doesn’t resemble a brush stroke at all. In other words, these are perhaps not patches of correction fluid, so much as someone has erased these parts of the image.

A final comment: the penmanship is by and large pretty dreadful “printing” or “block lettering” (disclosure: so is my handwriting. Dreadful, that is. Comes from typing all day.) However, at high magnification I noticed that the word “Ampesand” [sic] underneath the ampersand, as well as being in much smaller letters is actually written cursively, and doesn’t resemble the other lettering at all.

RC February 1, 2006 7:18 AM

The capital letter ‘I’ is written with more emphasis and darker, heavier horizontal lines in the letter. This is a result of the writer’s self-image. If you ask a mentally disturbed person to draw themselves, their drawing may show the anger that they feel by having heavier thicker lines. The letter ‘I’ shows this effect in miniature. Therefore, the writer was not merely writing a password list (there would be little emotion associated with such a list), but was writing with anger within himself.

The two eight character lines on the sides of the paper are not encrypted. These are the key to decryption. These charaters are not random, since they contain many more symbols from the top row of a keyboard than could occur randomly. Some people think that a password should non-alphanumeric characters, so an amateur cryptogram like this one might have a key that over-represented those characters.

y & # 7 V $ 3 ?
d % K 4 q @ h *

The ampersand character should display if a space is written after it; or one can use $amp; (ampersand then ‘amp’ then a semicolon).

The first six lines match the number of letters in ‘Linda Rayburn and Michael Rayburn Berry’, so again there are indications that this cypher is real.

peri February 1, 2006 7:32 AM


I think I agree that I wrongly transcribed q as a twice. I also noticed the spike in numbers of lowercase q and should have found the error myself. Thanks!

Ken February 1, 2006 8:17 AM

Hello –
I am the one who e-mailed the cryptogram to Bruce. Thank you for posting it Bruce.
To answer the most common questions, the cryptogram was found in an open briefcase next to where he hung himself. There was a bunch of child pornography CD’s in there and a bunch of new sex devices like velvet covered handcuffs.
The suicide note that the story refers to was on the kitchen table. It says “forgive me, it had to be this way”. The other family members names are Pat, Jenn, Kristen. There was also Pat’s husband Charlie.
Jenn, Kristen and Michael’s last name is Berry. Not Rayburn. They also had 2 cats. Ozzie and Luke.
This is a copy of the original. I whited out the areas where friends were trying to decipher it. I didn’t want to make it more confusing. The folds in the paper are also mine. The murderer was diagnosed Bi-Polar many years ago. My friend Linda was not told by him or his parents. He was a tech. junkie and loved Star Wars and music. There wasn’t much of a investigaion because as far as the police were concerned….it was an “open and shut case”. They had the murderer and the murder weapon. I understand that some may think I sent this as a hoax. I didn’t. I was just hoping that someone may recognize this and say “I seen this type of cryptogram before”.
The password scenerio may be something. There was also a laptop near the briefcase. As I said, the police didn’t investigate all that much. They couldn’t (or wouldn’t) even narrow down the time-of-death to less than a 24 hour period.

Bruce is the only person I sent this to. I recently saw the cryptogram in my drawer and decided to pursue it a little bit. I appreciate everyone’s time and effort.

Thank you,

Israel Torres February 1, 2006 11:06 AM


Can you tell us what the original dimensions of the paper are? Is it a typical 8.5 x 11 blank piece of copier/printer paper?

Has someone been able to check out the contents of the laptop, or accounts (email/web/cache) that the deceased maintained?

Israel Torres

Ken February 1, 2006 12:46 PM

Yes. The grid is about 4″x4″. The paper was just about 6″x6″. I don’t have the original so I don’t know if it was copy paper. I work with Jenn so I’ll ask where the laptop is and let you know.


Israel Torres February 1, 2006 1:11 PM


Since you are in contact with Jenn please also inquire as to whether any of the deceased’s remaining personal affects contain any of these types of “strings”. It is very probable that this wouldn’t be the first piece of paper with this type of information printed on it.

Israel Torres

Ken February 1, 2006 1:48 PM

I will check Israel.
I will try and get as much info as I can. Needless to say it’s an emotional subject for Jenn. She was the one who found heir bodies. The 2nd anniversary is this Friday so it will be kind of normal to bring it up.

I knew the guy pretty well. In fact, I slept over their house the night before the murders because they had had a Superbowl party. I do think this may have something to do with his computer because he used to spend a lot of “alone” time on the computer. And the cryptogram symbols really are only found on a keyboard as far as I know.


Israel Torres February 1, 2006 3:13 PM


If you can, also find out if he was known to have any aliases or nicknames. If you would like to contact me privately please do so : email israel at israeltorres dot org.

Israel Torres

Filias Cupio February 1, 2006 3:49 PM

The child porn association makes a password list much more likely. A child-porn-swapping website is something he’d likely want a high security password for. But perhaps I’m overestimating the cloak-and-daggerness of aquiring this stuff – maybe you just need to find a Usenet server which is sufficiently lax in which groups it carries.

It would be interesting to do a forensic examination of the guy’s hard drives, but I’m guessing this is no longer an option.

If I were keeping such a password cheatsheet, I’d have an extra layer of simple obfuscation – e.g. where the sheet says “HkcFBfe” the password is “bfCKhEF” (backwards from 3rd to last, change case.)

Dylan February 1, 2006 5:07 PM

Thanks for your answers (I assume you are the real deal. Your story gels with the public record.)

After reading your notes, I am more convinced than ever that we are looking at a password list. However, as Filias noted above, if David even did a simple trick like switching the case of the letters, or appending an ‘x’ to the end of every password, then we are pretty much stuffed.

What would help would be any nicknames or email addresses that David was known to use. But please don’t post anything like this online, as you will be inviting trouble.

If anyone is progressing this, I would be interested to hear or help out (my email is attached to my message.) Otherwise, good luck with the search, and I hope you find what you are looking for.

Ken February 1, 2006 5:09 PM

Thank you Israel. And thank you Filias. I will be talking to Jenn tomorrow and will have more information.
I will see if the lap-top that he used is still around also.


Ken February 1, 2006 5:16 PM

Thank you too Dylan. A lot of great thoughts out there. I think the lap-top is the key to a lot of this. These passwords…if they are passwords… could also be protecting files on that computer. I will e-mail you and Isreal any additional information (nicknames, email addresses etc.) I get from Jenn.

Thanks everyone,

Dave Zatz February 1, 2006 5:17 PM

Obviously, the underscores and strike-throughs indicate when to physically rotate the page and which direction to “read” the letters.

Neal February 2, 2006 9:09 AM

If this a password list, couldn’t half the items on the list be the user ids or sites and the other half the passwords.

Israel Torres February 2, 2006 2:17 PM

The Rayburn Files

Information about the object in question:
It is handwritten.
The object pictured is a copy of the original.
There are areas that have correction fluid applied to them so as not to confuse the original contents.
The folds on the copy occurred after they were found not before.
The writing used appears to derive from a standard computer keyboard using alphanumeric and symbolic characters embedded within.
The rectangle drawn over the top two lines occurred after they were found not before.
The grid is about 4″x4″.
The original paper media is about 6″x6″ of unknown type.
It was found in an open briefcase near the deceased (suicide by hanging).
• The briefcase also contained “a bunch??? of child pornography CD media.
• The briefcase also contained “a bunch??? of “new sex devices??? (e.g. velvet covered handcuffs???)

The other family member and involved names are:
Jenn Berry (Linda’s daughter – found the bodies)
Kristen Berry
Charlie (Pat’s husband)
Michael Berry (David’s stepson)
Linda Rayburn
David Rayburn

The family cats names are:

Information about the individual David Rayburn that committed this crime:
He was diagnosed with bi-polar disorder “many years ago???. (Linda Rayburn was not aware of this bi-polar diagnosis.)
He was a tech-junkie, loved Star Wars and music.
He was known to have a lot of “alone time??? on the computer.

Information about the investigation:
To investigators it was an open and shut case, no need for further investigation into what this object pertained to.
The time of death was found to be within a 24 hour period.
A laptop was found near the open briefcase.

Information about the crime:
Feb. 2: Linda Rayburn, 44, and Michael Berry, 23, of Saugus (Massachusetts), both killed at home. According to police, Rayburn’s husband, David Rayburn, killed his wife and stepson with a hammer. Their bodies were found in adjacent bedrooms. David Rayburn left a suicide note, went to the basement, and hanged himself.

Other news references include:

Information about this research:
Information provided by Ken.
More information may be made available by Ken’s findings.
It does not appear to be a hoax at this time.
The body of the message does not contain the same type of symbols the two perpendicular lines contain.
Various characters therein are shifted relative to the lines they are in.
Various characters therein are using upper and lower case.
It is suspected that this writing could be a secret message, a password list, a type of mnemonic device, or just psychotic-gibberish.
It does not appear to be of any type of simple rotation/shift schemes.

Questions pending:
Is the handwriting on this object from David Rayburn?
Did David Rayburn have any aliases or nicknames?
Were any of David Rayburn’s personal affects found to have similar writing?
Is the “circled d??? at the bottom of the page a form of signature?
If this is a password list to computer related accounts/files/logins are they still valid?
Has any forensic analysis been done on the laptop found near the briefcase or on the briefcase itself as well as the remaining personal affects?

At this time it has yet to be determined whether this is a secret message, password list, mnemonic device or psychotic-gibberish.

This information will also be updated here as it is revealed.

Israel Torres

bobette February 2, 2006 2:49 PM

Isn’t it obvious that this isn’t anything but a random note that some hoaxer put on the web? it’s stupid

Bruce Schneier February 2, 2006 2:54 PM

“Isn’t it obvious that this isn’t anything but a random note that some hoaxer put on the web?”

It isn’t obvious to me. What makes it obvious to you?

Mike B February 2, 2006 4:28 PM

Judging by the amount of child porn found, I wonder if he was distributing it or maybe making some of his own. It would be motive to kill the wife if she’d found out…and the child if he was a victim.

Handcuffs and other sex devices found with those kinds of images would indicate it wasn’t a passive interest. He may have been acting on it, or planning to act. Had the items been used, or were they new?

I wonder if any camera or video equipment was also in the home and if anyone took a look at it.

Neal February 2, 2006 5:07 PM

What about the small m, h, and y notations below certain letters? Suppose you were jotting down names off your screen and you came to a letter you couldn’t discern. You know like L’s and I’s, or O’s and Zeros in certain fonts. You might record both what you think it is and what it could be to remind you to try both.

test February 2, 2006 9:37 PM

What are you expecting to find? The location of the arc of the covenant?

This discussion is pretty-much the definition of ‘people with too much time on their hands’. (Yes, I’m one!)

A bunch of random strangers on the net are unlikely to understand the meanings that were in the person’s head at the time, if it is even genuine, so you are starting from about 3 miles behind the starting line, and even if you construct something ‘intelligible’ from the letter, it will be devoid of actual meaning.

If the person wanted to communicate something, they would have just written, recorded or told it.

I am surprised and disappointed at Bruce for relaying the personal details of the deceased in this matter.


Fathead February 3, 2006 12:52 PM

Here’s my take so far. I’m going purely by the characteristics of the note and assuming that it is a cipher and not attributing intent or audience.

It’s some variant of an OTP cipher. The 8 left and 8 right hand margin characters as the keys (or an encryption of the real keys) and they are repeatedly applied to 8 or 16 characters at a time.

Most of the keys are all the numeric keys on the keyboard. I think that they are also encrypted–not with OTP, but some other simpler algorithm since OTP requires keeping the keys secret (ie, not written down with the message). Also, my guess is that the ? character is really a ? (ie, unknown or unwritten) for further secrecy. If it is a ?, then I figure that it may be guessed by figuring out the algorithm of the key or decoding the message. Another possibility is that it is an encrypted 8 character key that is decryptable by the other key.

In order for decryption and encryption to happen with OTP, you need to find a way to assign numbers to the characters so that you can perform basic arithmetic for encoding and decoding. I tried the ASCII suggestion–it seems appropriate as it covers all the keys in the note and its known to most computer guys–but not much luck yet. Another number assignment mechanism could be EBCDIC or, perhaps, the thumbcode table–but these were far too esoteric, I think, so I didn’t even go there.

64 characters encrypted with an OTP cipher variant that encrypts 8 or 16 characters at a time. My guess is that its decryption is a straight addition or subtraction with the key with some modulus arithmetic to produce 52 characters (for upper and lower case letters). It may not be straight mod 52–I tried this for a while but with no success–but, again, using the ASCII number assignment. The problem I had with ASCII is that there are characters in between upper and lower case letters so I couldn’t do a straight modulus without including those characters.

I’m doing this stuff on my lunch break and I don’t think I’ve explored this theory as much. Perhaps someone with more time on their hands can follow this trail and be more fruitful


Noid February 3, 2006 1:13 PM

Given the nature of the perpetrator and the proximity to the laptop, I would suggest that these are ciphers for screen names for other disturbed individuals or maybe even Internet victims. Even if one had sufficient information to decode the names, the value to a prosecutor or the family seems negligible. My guess, there’s more data on that laptop that could point to a solution.

Ken's friend Jeff February 8, 2006 9:05 PM

To the “doubters”,
First things first – Ken is NOT a “hoaxer”! This is a genuine concern for him to try to get some consolation for his friend….

As some people have brought up – do you see this floating around the internet other than on this site???? The answer is NO! The ooooooooonly reason why you even see it HERE is because Ken was a close friend of Linda’s and IS a close friend of Jenn’s.

As for the “ark of the covenant”, the “pot at the end of the rainbow” or “buried treasure”……. I only hope that you people who wrote such things NEVER, EVER, EVERRRRRRR experience such a senseless loss of a loved one…..

They know that there IS no “making sense” of what happened on that terrible night but the puzzle just added to the confusion of “WHY????”…

I only hope that Ken is the only one to have read all of the tasteless comments – which even he shouldn’t have had to!!!

There are obviously SOME very intelligent people on this site and I wish the “others” would just leave THOSE people the space on here to give Ken an answer one way or the other… be it a password list or something else..


Ken February 9, 2006 6:24 AM

Bruce –

It looks like I stirred up a hornets nest. I didn’t realize that there could be so many cruel people out there. The most unfortunate thing is that I think my friend Jenn found your web site. I know she has done Google searches with her mom’s name in the past.
She hates me now. We haven’t spoken all week. I can’t really say I blame her. I had no right to have her family’s name splattered all over the internet without consulting her first. I was only trying to help. I was hoping to get asnwers for her. I apologise for taking up your time.
Could you please take it all off of your web site? Even out of the archives?? The damage is done….Jenn and my friendship is over. I cannot see adding to it by leaving it out there.


Jenn February 9, 2006 12:23 PM

First of all, I would like to thank the individuals who took the time to research this and help my friend Ken. I would also like people to know that this is not a hoax. This is the real thing.

This has been a tough 2 years trying to figure out what this Cryptogram means. Maybe I will never find out but it is nice to know people are out there willing to try.

As for the people who think that this is a “hoax” or “chain letter” and put disrespectful postings on this site, I do hope you never have to experience something like this. How would you feel having people make jokes about your mother and brother? It is NOT right. As Jeff stated, if you are not interested in this, why don’t you leave space for others who are serious in helping?

Again, thanks to all for your comments. They are interesting.


Worker February 10, 2006 10:58 AM

A bit too extreme and simple but it does convert into a nice FedEx tracking number. 8573 7757 8788. Even in the company format.

kinnell February 11, 2006 12:39 PM

I feel sorry for the people that feel they need to make comments like some of the ones above.

If all you can do is call something like this a hoax or “spam” without first trying to validate your claim then you should not contribute to a post like this or any other.

I came into this posting wanting to help analyze the code above, now I kinda just feel annoyed and angry towards those people that feel they are better than everyone else and can joke about something like this.

i hope through the work of the people in here that may want to help that we can find an answer somewhere, but as the cliche goes “if you can’t say anything nice don’t say anything at all”

Personally if it was my decision I would ban your IPs, but it’s not.

zippy February 11, 2006 4:00 PM

I think it’s a password cheat-sheet.

I believe the passwords are read left to right, and that the four bits of information for each position — lowercase, uppercase, line below, and line through — indicate a fixed direction from the key to get the actual letter to enter.

The one line that makes me doubt this theory is the three character “password” in the third line.

Israel Torres February 12, 2006 12:15 AM

“The one line that makes me doubt this theory is the three character “password” in the third line.”

This could also be a PIN (of sorts):
For example if you rot13 Mmg you get Zzt which could stand for ZERO ZERO TWO, ZERO ZERO THREE, ZERO ZERO TEN, etc.

Mmg could also be a mnemonic device for something like Mikemikegolf

Until something can be ruled in, it is difficult to rule anything out.

I would imagine that this could be made for humans that don’t necessarily need to rely on computing something to understand its purpose or use.

Israel Torres

Lore February 13, 2006 12:42 AM

This might be an unnecessary comment but my take on this would be:

To short to be anything other than passwords, codes, etc (This only applies if the paper was the only one with strings of gibberish).

Could the capitalized letters be the beginning of new words or where to hit the spacebar? Like This For Instance
(This would pretty much exclude defined words since there are up to three capitalized letters in clots)

Those freefloating letters ( m r (?) H) Doesnt really resemble the characters nearby, thereby discrediting them as “alternatives”. Take the m for instance, floating between A and a C.

The circled in d at the bottom of the page seem more “flowing” than the rest of the letters. For instance you (or at least I) can’t detect pressure points, quite opposite to the other letters and symbols (but its early in the morning).
My point here being that its possible that the d was written by someone else.

Im wondering about the significance of the “sunken” capitalized O at the very end of the horizontal writing. If its true that the vertical lines were written in beforehand (which in itself would be odd if they werent different in some way, I mean, why start writing vertically if you have space left on the paper) this could be attributed to lack of space.

Was there anything written on the other side of the paper? If not, and space was an issue, why didnt he use that side to fill in stuff?

Just some random thoughts about the matter.

evrgr8 February 13, 2006 2:20 AM

The only way to test the password theory would be to try each of those “passwords” against accounts that David used, but we don’t know of any, do we? And even if they were passwords for email accounts or such, most of them would probably have been expired by now. So we cannot prove the password theory one way or the other. Our only hope is for some DVD-Jon to crack this!

Dave February 15, 2006 8:22 AM

The RHS could be an 8 character coded username, the LHS an 8 character coded password, and the stuff in the middle a message, or shorthand instructions having logged on to whatever site.

Mike February 15, 2006 11:04 AM

If you believed Ken when he sent you this note, then why didn’t you honor his request on Feb. 9th to remove the note and article from your blog? Now you’ve told your whole CRYPTO-GRAM newsletter audience about it (on Feb 15th), which will only upset the victim’s friends/family more. I wouldn’t be surprised if someone in the media picks up this story. “Codebreakers Try to Solve Murderer’s Puzzle”.

AlanB February 15, 2006 11:14 AM

My main complaint about the password theory is there doesn’t seem to be any indication of what the passwords are to. Do we expect he simply remembered the first was amazon, second hotmail, third ebay, etc?

Also the whole paper has the look of being a copy, and of being written all at once. Neither of those properties are likely true of a password list.

I keep password lists, but I label them, and add to them gradually, and don’t make copies.

Other passing observations:

I think he captioned the ampersand because it was drawn poorly and hard to recognize. That makes me think it was added late; if it was the first ink on the paper he would have discarded it and restarted.

The whole has the look of being a copy. He must have had notes. If it was encrypted by hand they might have been extensive, I do hope someone has looked for them.

I agree that the lines through some letters is simply used to distinguish upper and lower case.

I’ve worked lots of game cryptograms, and this one has very few short words.

Ian February 15, 2006 11:39 AM


Is the laptop still available or was it taken by the police as evidence? I ask because I am an experienced forensic analyst and would be willing to volunteer my services in reviewing the contents of the laptop, if an image of the hard drive could be obtained.

Concetta February 15, 2006 2:25 PM

This probably is a copy of the original. If it is a password sheet, he’s probably written it a few times on scrap pieces of paper.

I believe Ken said the paper was 6×6, which sounds like a scrap paper to me – and I know I’ve copied my password lists from post-it to notepaper to scrap paper hundreds of times as each wore out.

The other thing I thought of, aside from the interesting ideas already posted, is what if the horizontal lines corresponding with the vertical ones are supposed to be taken out, ie the horizontal lines corresponding with a symbol, like the ampersand, etc. are supposed to be taken out.

Or that they are supposed to be added to the beginning or end of the previous line, as in percent (p) and question mark (q) go to the end of the line, whereas ampersand (a), and sign (a) and dollar sign (d) go to the beginning of the line.

Perhaps we are all reading too much into this as well. It might be something so simple we ALL missed it – or its so complicated only his mental health professional might be able to solve it.

regretful doubter February 15, 2006 2:37 PM

I’m sorry to make the following comments, but it is a mistake to take things at face value. I apologise if I’m wrong.

My comments concern the timing of things – at the point at which people are asking for proper evidence the relationship between Ken and Jenn seems to break down, so he can no longer get further evidence. Jenn then posts a reply which shows no emotion, but which gives no further information other than she finds the postings “interesting”. She does not mention the laptop at all, or give any corroborating evidence.

There are good reasons why this could be genuine behavior, but it could equally point to a hoaxer. There are people out there who would like to make a fool out of Bruce and the people who visit this site.

Jeff February 15, 2006 2:44 PM


1) If it’s a password list, why “sign” it with a circled “d” at the bottom.

2) If that’s not a signature, what else might it be? It seems very deliberate.

3) Notice also that the signed “d” has a stylistic flair that the other lower-case “d” (in the upper left hand corner) does not. This is more evidence that it’s a signature and not a random character.

4) Again, looking at the signature “d” it seems to have been written with a different pen. The ink fades on the left side of the circle, like a mark made by a traditional ballpoint pen when the stroke becomes lighter. But all the other marks on the page are made with a fiber-tip or heavy-flow ballpoint pen. Note the blots of ink at the end of many of the characters, and no faded strokes.

5) The text is tilted to the left, indicating the author was right-handed. Do we know this about the killer?

6) The dropped “O” in the last line is curious. There was ample room NOT to drop it, especially if the lines on the sides were written last. But even if they were in place already, the author seems to have intentionally dropped the “O”. No other character does this, and it’s also, interestingly, the last character of the main body, before the signature.

7) All of the non alpha-numeric symbols can be found on a keyboard above the numbers. Except the question mark in the lower right hand corner. That’s also the only character of punctuation in the entire note. If these are random characters, it seems you’d have instances of many of the other keyboard character that surround the question mark on that side of the keyboard. But there are none.

8) He explicitly notes that the “&” is an ampersand. If this were a note exclusively for his own use, why would he do that? It seems clear enough that the author wouldn’t have to describe it to himself, only to someone ELSE who was going to be looking at this and trying to make sense of it.

9) However, the captial “A” in ampersand does not match the capital “A” used elsewhere in the note. Note that the note’s “A”‘s are rounded, and the ampersand “A” is angular. Perhaps that was written later by someone trying to decipher the note.

Jill February 15, 2006 2:53 PM

You can’t analyze the handwriting, the paper it was written on, or anything about strange techniques in spacing, characterization, lines, etc. because the original sender of this stated specifically in subsequent comments above that what you are looking at is hand-copied by him from the original.

This would mean that you can’t analyze the dropped O at the very end (that would be a result of not enough space left on that line when copying).

It also could mean (would have to check with Ken on this) that the word “ampesand” was written by Ken and not by the murderer to indicate what that symbol was. It could also mean that the various dropped letters (“r”, “m”, and “H”) were put there by Ken and not on the original.

I may be stating the obvious to those who just read through all the comments (like me), but for those who didn’t bother to read all the way through, I wanted to point out that this is a hand-copy of the original and that you cannot analyze handwriting or specific uniques to the paper or style in which the letters/symbols are written.

Broken February 15, 2006 3:07 PM

Just a quick observation that this seems to me most likely not related to the murders ( lending to the password theory or the like ) I’m surprised no one’s brought up that this would be a second suicide note which would be rather strange. Suicides connected with murders usually directly follow the murders, not leaving much time or focus for encrypting. If the fellow knew these passwords a quick look at this sheet no matter how it’s encrypted would probably remind him ( just by length / case ), but as for decryption we’re bound to be looking at somewhat random password info, making it a daunting task at best.

poloman February 15, 2006 3:16 PM

I’ve read all the comments for the first time, and I’ve a few observations – they may not actually mean anything, but here goes.

Regarding the lowest symbol, which seems to have been assumed to be a ‘d’ in a circle, the script is very different to the rest on the page. For instance, it is obviously formed from two discrete strokes, whilst most of the rest are seemingly done with one stroke. If it is a ‘d’, it is quite stylised. Equally, it could be an ‘a’ or a ‘cl’. To my, admittedly untrained, eye it looks to be made by someone other than the person that wrote the main body.

The second comment concerns the figure that largely seems to be called an ‘r’. There is at least as much chance that it is a ‘v’, or maybe even an ‘L’. If you look at the ‘L’ on 5th line the downstroke also goes below the cross-stroke. If this is the case, the mystery letter was written at a different time to the rest, as it is slightly skewed anticlockwise.

Lastly, the ‘L’ and ‘I’ on the 5th line, the ‘mystery letter’ and the ‘t’ on the same line, and possibly the ‘h’ on the 9th line all seem to have been written with more emphasis than the others. This could indicate that they have special meaning to the writer.

dogface February 15, 2006 3:27 PM

I find it strange that every letter of the alphabet is used at least once. It would be very odd for someone to write a suicide note and use every letter so I do believe there is no straight substitution cypher that will work here. More likely, there is a solution based on overlaying the entire alphabet over an existing work. Any books or poems found on the scene?

I would not be suprised if the alphabet overlay was repeated, once uppercase and once lower case. That may explain the different cases. Then again, each uppercase may also signify the start of a new word.

I think the spaces (sometimes referred to as underscores) are just a way of noting the number of letters in what he was trying to say. Also, there is no way that many seven or eight letter words are used in such a short amount of space so the actual line distribution may be ignorable.

Omestes February 15, 2006 3:39 PM

Not a huge crypto person, so I might sound like an ignorant hick here. Appologies in advance.

I don’t understand the point of the notations under the actual text. They don’t seem to be, as previously suggested, notations refering to services. I say this because they are completely clustered at the bottom half of the document, the top half is completely free. I understand the “ampersand” one, of course, but the lowercase “r”, “m”, and “h”. The “r” (doubtfully a “y”) also is doubly odd, in that it does not match the main body of letters, it seems more hasty and sloppy.

Also, if the side lines were over-run from the main body (as suggested once above) then why are they the only locations to have non-alpha charaters? Also, why are they of uniform length (8), when the main text does not seem to conform to a length.

It looks, also, like the text breaks into 3 distinct paragraphs (almost). Perhaps it could be a note, I am not willing to give that up for the password list theory yet.

Also, I would, mostly out of curiosity, know why the family blocked the top two lines? Did these have some form of signifigance, to part them from the rest of the text?

To pick-nits, the “white out” does seem to be too clear (white out is viscious), and too defined. It looks like a digital brush. But I might be wrong. I should white out a paper, and scan it, to see if the effect matches.

And to the doubters… What does it matter, it might be a hoax, and it might not. If it is, then it was a fun intellectual exercise, if it isn’t then we’d be doing something good for the family, AND getting a fun puzzle. Seems win win, and better to tackle as real, since the benefits of the latter out-weight the priors skepticism.

Clifton February 15, 2006 3:47 PM

Something rang a bell in my memory about early 2004 and news stories involving child porn arrests, so I did a Google news search for “February 2004 child pornography”.

It looks like February 2004 is when a major Federal investigative group began serving warrants and making arrests on subscribers to some child pornography services, arising from an investigation into the Regpay credit card processor headquartered in Belarus. Apparently by January 2004 the credit card processor had been shut down and its records seized. If Mr. Rayburn was a subscriber to some child porn service, and was tipped off to planned searches and thought he might be next, this could have been the immediate trigger for the murders and suicide. This might indirectly support the password theory.

Here are a few URLs relating to other prosecutions arising from the investigation: http://www.kansascitykansan.com/articles/2006/02/13/news/local/news2.txt

Against this is that this makes a long chain of suppositions, and that the first reference I can find to an actual warrant being served is February 19 2004. It’s not inconceivable though that there were other arrests or searches before that or some other source of early warning (e.g. some distributor posting a warning to their subscribers.) This is not an area I know much of anything about (other than past efforts to expunge CP groups from my newsservers) so I have no idea how plausible any of this is.

MikeB February 15, 2006 4:03 PM

The guy’s computer may show which websites he went to. Get the last IP his 2004 laptop used, and ask Google what he was doing. With his IP, ask some of these embedded webhit tracking companies if they have logged any traffic from that IP his last weeks. These days, password-quality rejectors are the most infuriating things to deal with – you must have >6 chars, mixed case, without repeats, a digit, and a non alpha-numeric. I like the guess these may be passwords. Maybe this is a tool to create acceptable passwords which can be written down beforehand & can work the first time. (The short lines could be usernames, which can usually be short.)

MichaelB February 15, 2006 4:27 PM

Interesting discussion. The password list is a good theory but, as stated above, a 3-character password – even a 3-character PIN – would be rare indeed. 4 characters is the shortest I’ve ever seen. Secondly, if they’re passwords, why are all the special characters and numerals in the left and right strings while not a single one in the rest of the list? He would have two very strong passwords along with several weaker ones and one really weak one (Mmg). Third, passwords are frequently tied to usernames so either he used the same username on every account (this does not seem likely as many usernames on the web are just your email address while others require a shorter string you choose yourself) or he was able to match passwords to usernames and accounts by memory or another reference sheet. Also seems unlikely. Lastly, why does an IT savvy guy write down his encrypted passwords to begin with? Much less trouble to type them into a Word doc and password protect that don’t you think?

Those factors make it look more like a code to me than a password list. But if it is a code, it must be pretty complex and hard to imagine it being a clue that he expected anyone to decypher.

I’ll keep thinking. Thanks for the discussion.

jzb February 15, 2006 4:28 PM

Given the lack of repeating characters, except the third line (Mmg) – I would suggest this is actually a paragraph. Each letter or symbol representing a word or thought. Also, since the “cryptogram” was found with child porn I would also wager it was to remember something that would have otherwise been incriminating. I know this sounds obvious but would explain the appearance of the page.

URLs, people, addresses of child obsessions, phone numbers, or perhaps a journal of an exploit.

Hope this was helpful.


Fox Mulder February 15, 2006 4:37 PM

Maybe a stupid question, but was this note considered to be “a suicide note” ? If so: why? If not: what was the real suicide note? I.e.: are there 2 notes, the ‘real’ suicide note, and this note?

Also as going for a explanation or motive: was it ever considered that his wife found out he was into child pornography? If she found out maybe that was what triggered this drama.

Also, given the fact that child pornography was found at the murder scene I find it very unlikely and negligent that the police at least not tried to find out the origins of the material (what if he made some of it himself?). Since it is very likely he got the material from the Internet the laptop (btw: did he own any other computers?) would have been really another prime subject for criminal investigation.

Also I consider it unlikely that this ‘code’ will ever be cracked unless investigation is done into the laptop contents. Unless he was some IT guy (which so far I see no prove of – one newspaperclipping describes him as ‘an unemplyed veteran’) it is not very likely he was covering all his (digital/computer) tracks very well.

It might also support the theory here that the code is actually a bunch of passwords (for instance is any references are found to password protected websites, e-mail, chat etc. etc.).

If he really was bi-polar (instead of having other psychological problems from being abused himself as a child – which might explain his interest in child porn) this also could very well be some random doodling and not any code at all.

Who knows. It is a lot of speculating and it sure makes one heck of an intruiging case.

oops February 15, 2006 4:42 PM

This is not from the killer; it is to the killer from his controller/handler. And the prerequisite information for decryption is not provided. Most likely it’s a trigger. But that just raises more questions for you all, don’t it?

Andrew February 15, 2006 5:39 PM

Okay this seems like a classic key based encryption to me. Here is my reasoning:
there are 64 dashes, of the 64 characters touching the dashed lines 32 of them are strike-through and lowercase and the other 32 are mixed uppercase and lowercase but ontop of the line. There are 8 characters for each of the vertical rows, the first character of the left vertical row is ontop of the line. The first character of the right side verticle row is strike-through. Maybe the left verticle row is the key for the characters on top of the lines and the right side row for the characters that are strike-through?
These numbers seems like too much of a coincidence, since they are all multiples of 8, to be a random password list. He was an “internet technician” who I am sure was aware of various encryption methods. I’m still unsure about how to use the letters that are not touching a line but my guess is that using the verticle columns as keys is the best approach to solving this.

RMiller February 15, 2006 6:28 PM

I don’t think anyone suggested this idea, but it popped into my head while messing around with the cryptogram.

What are the chances that this was a word game copied from something like Games Magazine? It reminds me a bit of some of the more difficult puzzles you might see out there. The letters off of a line (y, m, h) remind me of where one might place a letter when trying to figure it out, or possibly when a few letters are provided as clues. Also, if transcribing something in this format, one might place all the dashes first before copying in the ciphertext. The word ‘ampersand’ would make more if this was copied from something that did not have any personal context. And finally, though less likely due to the consistency of placement, if I were looking at what I was copying instead of where I was writing, I may place a letter halfway through a line simply by not looking exactly where I was writing.

I don’t think this explains what it is, and unless someone remembers seeing it as a word game we’ll never know if this is the case. Considering where and under what circumstances it was found, a transcription of a word puzzle does not quite make a lot of sense. But we shouldn’t forget that this could be just about anything.

TJ February 15, 2006 6:37 PM

Just because something looks like a suicide doesn’t mean it was. What the police say may mean little (e.g. Bobby Fuller). There’s no obvious motive so far. There was a party the day before; no signs of any tension or unhappiness reported; bipolar doesn’t mean murderous.

The child pron, on the other hand, may have provided a motive to someone else.

Deciphering this piece of paper may have little to do with understanding what happened … which is what friends and relatives are after. Everyone who uses the net has a list of passwords.

Jor February 15, 2006 8:27 PM

Hi, i just thought i would give my ideas…

its possible that this note is the outcome of multiple encryptions done over eachother.. or also, it could be that the letters on the lines, could signify a different type of encryption, or different ‘operation’ that must be done to that character…

also, i think that the letter circled at the bottom of the text, could be some sort of key to solve one of the verticle, or both of the verticle lines, and that, in turn could be the key to decrypt the rest….

anyway, its all speculation of what it could be. Cause i have, thought of interesting and creative ways to encrypt text, so he might have as well, and come up with random, and interesting techniques…


OldManSteve February 15, 2006 10:06 PM

I don’t have the programming know-how to do this anymore (nor the compilers), but what if the vertical sides encode a key? Take them as a 16-byte key of ASCII/Hex/Octal values – try right(concat)left and left(concat)right – and then use it to decrypt the string of the ASCII/Hex/Octal values of the ‘body’. PGP? Other popular encryption scheme? Something else? Like I said, I don’t have the stuff to try it, but no one has posted that they have tried it.

I’d try concatenating the ASCII codes (decimal or hex or oct), adding them, and even multiplying them, then decoding the resultant string(s). One of the problems is that the (supposed) body is so short. Multiplying the body by the key (character-by-character, line-by-line or whole body) would change that.

The underscores and strike-outs might signify 7- and 8- bit ASCII (yes, all the 8 bits would be 0xxx), same as 3- or 4-digit representations. They might indicate encoding (ASCII/Hex/Octal) Try all permutations.

You might/probably need to subtract 32/0x020/040oct in either or both the key and the body. The key and body might be in different encodings.

Geeze I wish I had kept up with coding Q&D stuff.

Anybody out there up for a little coding? If I still had my old 16-bit Turbo Pascal (yes, I’m THAT OLD), I’d have already done it, but… well, now I’m old and tired, and I just don’t do that stuff any more.

John February 15, 2006 11:06 PM

My theory is that the email was a plant by a foreign security service to distract a large percentage of security professionals for an average of 54 minutes each, thus decreasing our overall security readiness.

X. February 15, 2006 11:19 PM

Did anyone check the laptop for common encryption utilities like truecrypt?

For some reason I get stuck on the sides being a password for an encryption utility

If you fudge a letter in a ciphered cryptogram text, it is pretty obvious what it should be during the decryption process.

The fact that it was important enough to clarify that the character was an & and not an 8 suggests it was vital not to screw it up.

I had experiences with porn encryption and hiding from an ex-coworker that had a high degree of effort put into the whole thing.

I think a forensic analysis of the hard drive is in order. Even if the answer isn’t there, I will bet my left thumb that there are at least clues.

Brad February 15, 2006 11:42 PM

The floating characters (r, H and m) are written in a different script than the rest of the note (look at the difference between the m on the Mmg line and the one written between AcZ… and CRV…) — it seems that these were written by someone else while decoding (possibly looking for a simple subsitution cypher?). Probably the same for the “Amperand” [sic]. Seems like they can be safely ignored.

Anonymous February 15, 2006 11:53 PM

Was there a suspected accomplice?
Was he ever accused of inappropriate behvior with a girl or woman? Was any of the pornography homemade?

Uncle Foobar February 16, 2006 12:50 AM

So i cranked up some Cradle of Filth on pandora.com, grabbed this jpeg in preview to make it bigger, and took my crack.

i have some commonalities with the murderer (i’ll spare the details/shit i can’t find my hammer) and i’ll try to apply my mindset.

First: the heavy I. It strikes me for some reason.

Second: password lists; he had to have learned this method if true/had no good tools like keychain.

The google ip, if they have that depth, might be a good path to follow. I have a bit of a background in typeography as well, and the double letter structures also ring a bit.

You need to erase the erronious box/make a photoshop version/let people have a non visual there; the box is hard to mentally detract.

(make both available though)

the other thing; wasn’t the Zodiac killer all symbols and crypts? was there research to this effect done?

The mindhunter aspect of this makes me wonder if this person in a calculating state intended anything from this, or if speculation on pw list rings true.

why draw lines under letters? did he know the lettercount before-hand? Is this a final or a workpiece…


Israel Torres February 16, 2006 1:03 AM

“You need to erase the erronious box/make a photoshop version/let people have a non visual there; the box is hard to mentally detract.

(make both available though)”
@Uncle Foobar

I’ve made this available here:

In regards to the Zodiac – Rayburn’s note appears to be very different from the Zodiac’s ciphers (both in visual appearance and cryptographic implementation). Zodiac’s methods of cryptographic implementation have been researched again and again with the majority never being solved:
“Of the four cryptograms the Zodiac sent to newspapers, only one was solved.”

Israel Torres

Uncle Foobar February 16, 2006 1:55 AM

“You and #7 V money 3 ?”

i guess it’s common enough to have passwords with punctuation at the end of them; it’s just stupid policy though if one fears password cracking.

Foob the Inner*&Outerboy

Uncle Foobar February 16, 2006 2:05 AM

who the frack doesn’t know what an amperstand is? why be explicit here, if it is a password, unless it’s child.porn culture for file trading.


Uncle Foobar February 16, 2006 2:18 AM

(i’m up early and this puzzle has intrigued me; i should put it aside for a while)

The mechanical aspects of creating whatever this is: draw five lines, fill in five letters, fill to bottom of page.

rotate page counter-clock, lines, letters

fill in last (d % K…).

Kiddie Porn: was he a simple addict, a collector, a producer; where did he fit in the food chain?

Does the laptop have a WiFi card?

I’m thinking the Patriots fan and Star wars references are Canards and of no value to this.


Dirk February 16, 2006 3:15 AM

On the left vertical line, two lowercase letters (“d” and “h”) do not have a line in the middle, but are on top. So the “these lines are to distinguish lowercase from uppercase” conclusion is not proven. Nobody noticed?


Roger February 16, 2006 3:24 AM

Some have suggested that ‘Mmg’ is too short to be a password. It is indeed far too short to offer more than trivial security for any system which allows remote attacks, a high rate of guesses, or off-line attacks. Assuming that it is known to consist of only three characters, but like the other passwords (if that is what they are) it can be from any printing key on the keyboard, shifted or otherwise, then there are only 857,375 candidate passwords, which in typical offline attacks can be broken in a second, perhaps less.

However if off-line attacks are unavailable, and remote attacks are either unavailable or heavily rate-limited, a password of this strength can be adequate for many systems: if we can forbid off-line attacks and add a penalty for wrong guesses which limits the average rate to say, 1 per 5 minutes, then a three (random) character password will take an average of 4 years to attack.

Three systems of that type that come to mind are screen saver passwords (whether a PC, a PDA, or a cellphone), burglar alarm controllers, and ATM PINs. A password with 857,375 possible values is easily strong enough for a burglar alarm keypad, cellphone screensaver or ATM PIN (in fact 85 times stronger than typical ATM PINs), however these devices normally only use digits.

Consider a laptop or PDA screensaver, though. If you set a short timeout for maximum protection from local attackers, it will timeout quite a lot and will be somewhat inconvenient to enter a long password. On the other hand, attacking a screensaver password generally requires physical access to the box (unless it is already pwned, in which case it hardly matters), and is rate limited by human typing speed to somewhere around one attack per second for a few minutes and much slower thereafter. Further, the machine’s owner may be able to guarantee that the attacks can only occur in certain windows (e.g. whilst in the bathroom) because otherwise it is either in his presence or completely shutdown and requiring a strong password to boot. In this scenario, a 3 character password would be more than adequate against a casual attacker, and even adequate against a more determined attacker provided it was changed after about every two or three cumulative hours of exposure.

Further, note that if we take it as a cryptogram rather than a password list this causes even worse problems for those suggesting the line lengths are the lengths of the words, one per line, as indeed several cryptogram supporters have suggested (which would, however, usually indicate a very weak cipher, which this is not). The result of that thinking is word lengths of 5, 7, 3, 7, 7, 5, 7, 8, 7, 8, 8, 8, which are pretty typical lengths for passwords (apart from the minor aberration at 3), but is a distinctly odd distribution for English words: even in college-educated English writing, only about 20% of words are 7 or more letters in length. A run of 6 such long words in a row occurs perhaps once per 7,000 words in technical writing. And in a corpus I just scanned, the only examples of 9 words in a row with none shorter than five letters, were dot-point lists of technical words. In short there are far too many long words in this article for it to be likely to be English. (Question to Ken: did the alleged author speak any other languages?)

Finally, let’s apply Occam’s razor: the fellow was an (unemployed) network admin and computer user. Computer users, especially network admins, need some way to store passwords and writing them on a private scrap of paper is a common way to do so. He had his briefcase of private computer stuff nearby, it would almost be more surprising if a password list in some form (not necessarily paper) was not found. On the other hand, murderers only leave cryptograms at the crime scene in fiction. The one case that comes to mind involving murders and cryptograms is the Zodiac Killer — but in that case, the cryptograms were mailed by a very much live murderer specifically to taunt the police.

Choog February 16, 2006 4:04 AM

I would say this was written for the writers own reference and not as a final letter. The ampersand comment, assuming it was written by the writer of the note, is there purely for his own reference, not as a reference for an audience. If it was aimed as a last note, it doesn’t make sense that he would have added a comment like that.

A password list is a distinct possibility.

Dirk February 16, 2006 5:58 AM

I thought some more about the lines. There are, imho, some reasons why I think these lines are NOT for distinguishing upper and lowercase characters:
first, there are some lowercase characters (d, i, h, o) that appear both underlined and with the line through them; second: if someone did this to be absolutely SURE he wouldn’t make a mistake later,this is not a good method: for instance, there are two uppercase “E’s” one of which we could easily interprete as an “F” because of the line .

poloman February 16, 2006 7:58 AM

A couple more observations.

It has not been stated by anyone with knowledge of the facts whether the laptop belonged to David. Could it have been a way of moving the child stuff between a group of people. That way the paper could have been a list of passwords to get into various bits of it, either copied from an original, or maybe even the original itself. The other handwriting could therefore conceivably be someone else in the ring of users. (Okay, I know there are easier ways of passing round dodgy material, but its worth mentioning!) We need some information about whether the latop was David’s and whether he lent it out to friends.

Taking that supposition further, had it been dropped off during the party the night before, and was there something he found on the laptop that drove him to the murder/suicide? (Assuming he did it – it is unlikely the police investigation looked for signs of anyone else’s involvement, so I have to go along with that supposition for now.)

poloman February 16, 2006 8:03 AM

I’ve just been back to Ken’s first posting – there were a “bunch” of child-stuff CDs with the laptop. Could the list be encryption codes for the CDs? My earlier idea about stuff being passed around a ring of people then makes a bit more sense than the laptop scenario. So, my question is: did the number of CDs match the number of lines on the paper? Any chance of the information, Ken or Jenn?

monk.e.boy February 16, 2006 8:53 AM

Perhaps the passwords unlock email accounts or a private weblog or unencrypt some files any of which may be a longer suicide note.

I keep plenty of personal stuff sprinkled around the internet that isn’t hidden as such, but I doubt a family member would ever find it.

If I emailed a suicide note to myself, then write my email passwords on my hand, would anyone put two and two together?


Brizmo February 16, 2006 9:42 AM

I’ve believe this to be a password list. That said:

People with an obsession will obsess about all things relating to said obsession. The reality is, he couldn’t look at child porn all day, but he’d think about it and the objects related to it. If he had multiple passwords, he’d enjoy copying them from random post-its onto a master sheet, enjoy re-encoding the entire list mutliple times when he found better ciphers. Such focus would also mean that older password lists were likely double shredded, burned and buried, but finding one with an older, less complicated cipher could be the only key. I know more evidence is 99.9% unlikely.

Speaking of keys, the vertical lines were written 1st (dashes, then filled in)and are most likely the key(s). He’d then begin writing the horizontal passwords and, when discovering the dwindling space, compress the horizontal spacing of the last 4 lines, even dropping the “0” down to it’s own line.

I reiterate this because I think the “0” is important. He could’ve fit the “0” on the same line with the rest, but it would’ve meant touching the “0” to the right-vertical character set or squashing it to make it thinner, giving the line an uneven, smooshed apearance – uneven with the rest of the sheet. Instead, he chose to give the “0” it’s own space equal to the negative space that surrounds the other characters. The crypto was spatially minded.

This establishes a likelihood of a physical key within the code. Since none was found, I’d assume the keyboard. For example, at some point when decoding, we’d have to go “left one key.” Also, this type of cipher when combined with a mathematical one results in a curiously even usage of characters and could explain the uncanny distrubution of strikethrough and non.

The code is seeming harder and harder to crack with each post. Discovering and using the PDA/screensaver code as a key sure would be nice. Oh, and one more thing: how hard is it to remember 10 passwords that you’ve obsessed over and over and ov…?

rnmnrm February 16, 2006 10:26 AM

Seems like a list of someone else’s passwords. Like he was trying to figure out his wife’s or stepson’s email password. This is the final sheet, where he compiled them. The dual letters are where he’s still unsure, and hasn’t had a chance to find out.

Andrew February 16, 2006 11:28 AM

Since there are no symbols or numbers in the main/horizontal coding area I tend to think that the the letter corresponds to a number 1-52, 1 being ‘A’ and 52 being ‘z’, or the reverse. I still think the vertical columns are the keys and are probably correspond to their respective ASCII code. Using this method I came up with the first line equaling “Sagaz”. At first I was excited that I was getting vowels and actually spelling out a word (saga) but then the ‘z’ threw me for a loop. So on to the next attempt.

poloman February 16, 2006 11:37 AM

@ Andrew

Don’t write off “sagaz” as a word. A quick Google search comes up with quite a lot of hits, including one for a “deviant art” website (though a cursory glance at it shows it to be quite tame).

NotMe February 16, 2006 11:51 AM

found these and thought they may be of some use for background

The Boston Globe

February 5, 2004, Thursday ,THIRD EDITION


LENGTH: 628 words


BYLINE: By Mac Daniel and Diane Allen, Globe Staff and Globe

SAUGUS – In the short time neighbors on Saugus Avenue knew David G.
Rayburn, the only surefire thing they knew about the unemployed
veteran was that he was a Patriots fan.

The burly and bald Rayburn was often decked out in Patriots gear,
and he told neighbors that he attended the Patriots playoff game
against the Tennessee Titans. On Sunday, Rayburn and his family
hosted a Super Bowl party at their house. It was a quiet evening on
the narrow dead-end street, some neighbors said.

Twenty-four hours later, Saugus police said, Rayburn took a
hammer and killed his wife and stepson as they slept. Police called
it a vicious and baffling murder-suicide.

After leaving a brief suicide note on the kitchen table, police
said, Rayburn, 34, went to the basement and hanged himself with a nylon rope.

The bodies were discovered Tuesday night when Rayburn’s
stepdaughter, Jennifer M. Berry, went to the house after her mother
did not meet her earlier in the day.

Neighbors said Berry, who lives in Lynn, ran out of the house around
8 p.m. screaming, “My mother, my mother,” before collapsing nearby.

Police said Linda M. Rayburn, 44, and Michael E. Berry, 23, her son
from a previous marriage, were found in beds in adjacent bedrooms.
Neither appeared to have struggled before they died, an indication
they were asleep at the time of the attacks, police said.

Joel Berry, Michael and Jennifer’s father, would not comment last
night when reached by phone.

Linda Rayburn listed her husband’s occupation as Internet technician
on a town survey she filled out on Jan. 16, though police said
Rayburn, a 1988 graduate of Hingham High School, had been unemployed
and was seeking work.

The couple had been living in an affordable housing complex in East
Boston prior to moving to Saugus six months ago, according to
management at the complex.

They and Michael Berry moved into the gray duplex owned by Linda’s
cousin, Lucille Polito, in August after the couple had fallen on
hard times, neighbors said.

Polito could not be reached for comment yesterday.

Despite the brief suicide note, investigators said they were puzzled
about the motive behind the three deaths. They said they want to
interview relatives and friends, including those who attended Sunday’s party.

Police said there were no restraining orders taken out by anyone at
the house, no calls to police, and no trouble.

“There’s no history at all,” said Police Chief James. J. MacKay.
“Nothing has been reported to us, from the courts or from the neighbors there.”

MacKay said the suicide note made no mention of financial troubles.

“Yes, we certainly are puzzled,” MacKay said. “There’s no indication
as to what motivated this person to commit these murders.”

Neighbors were equally stunned. “They’re just quiet, quiet people,”
said Rosa Freni, who lives across the street from the duplex.

Ray Coakley, who lives next door, said the most contact neighbors
had with David Rayburn was “a friendly wave, a friendly hello.”

“Everything seemed really normal over there,” he said. “To think
that it was happening while we were here. . . . There was no noise, nothing.”

Across the street, neighbor Frank Morrissey said the Rayburns were
often grilling on their side porch.

“You never ever thought there was an issue over there,” he said. “No
slamming of doors, no yelling, no screeching tires. Nothing. But no
one knew them. I guarantee, no one knew them.”

Management at Brandywyne Village in East Boston said that the
Rayburns left the complex in August in good standing and that there
were no troubles reported while they were there.

Boston voting records indicate that all four members of the family –
David and Linda Rayburn and her children – lived in the apartment at the time.

The Boston Herald

February 5, 2004 Thursday ALL EDITIONS


LENGTH: 454 words

HEADLINE: Suicide note leaves motive for Saugus killings a mystery

BYLINE: By Tom Farmer

An unemployed Saugus man who was about to be tossed out of his house
because of financial strife beat his wife and stepson to death with
a sledgehammer while they slept before hanging himself, sources said yesterday.

David Rayburn, 34, killed his wife, Linda Rayburn, 44, and her son,
Michael Berry, 23, sometime Monday night, investigators believe.
Leaving a suicide note on the kitchen table before hanging himself
in the basement, Rayburn expressed remorse for the murders, but did
not explain why he committed them, sources said.

“It was very brief,” one source said of the suicide note. “It
basically said he was sorry and some other things but not why he did it.”

Saugus police Chief James MacKay said the bodies were found about 8
p.m. Tuesday in the gray duplex at 4 Saugus Ave. by Linda Rayburn’s
daughter, Jennifer Berry, 21, who made a hysterical 911 call to police.

MacKay said it appears the mother and son were killed in their sleep
Monday night because they were found in their beds. Saying Linda
Rayburn and her son died from “severe blunt trauma,” MacKay would
not identify the murder weapon. Sources told the Herald it was a sledgehammer.

None of the victims had criminal records and MacKay said there was
no history of restraining orders or police responses to the home.

“We’re certainly puzzled,” MacKay said. “There’s no indication why
he committed these murders.”

Sources said interviews with relatives revealed David Rayburn had
been asked to vacate the home because of his inability to find a job.

The family had recently moved to the Saugus duplex from East Boston.
Although the Rayburns had a small Super Bowl party Sunday night,
none of the neighbors along the street knew the couple.

“They just moved here, but no one knew them,” said a woman who lives
across the street. “I never even had a conversation with them.”

A man who lived two doors down from the Rayburns in East Boston said
the couple mostly kept to themselves and he never saw any signs of
violence in their relationship.

“They were very quiet,” said the man who did not want to be
identified. “It didn’t seem like he bothered anyone here. She was
very pleasant. She used to give my wife cigarettes.”

The East Boston neighbor described David Rayburn as a burly man
while calling his wife “gorgeous. She was half his size. She was
very pretty,” he said.

Linda Rayburn had another daughter, Kristen Berry, 25. Her
ex-husband was reportedly flying to Boston yesterday from out of state.

MacKay said Jennifer Berry told police the family was supposed to
meet during the day Tuesday but she did not hear from her mother and
stepfather. The daughter found the bodies when she went to the home
to check on them.

phil February 16, 2006 11:52 AM

Maybe I’m reaching here, but in Mass, we pronounce Saugus (where the murder occurred) as Sagaz.

Just an idea… or, should I say, “idear”.

Robert February 16, 2006 12:04 PM

Does this help?

model fashion woman asian WAZQy | http://haffa.static.net/uk/only/private/asian-woman-fashion-model.html

(linking to google text cache since I don’t know [don’t really want to know] what else might be on the page).

Passwords on this page do appear to be “strong-random”, and me doing some re-formatting, I come up with the following keyboard charts (missing characters not found in original text indicated by underscores):

_ @ # $ _ % & * _ _
_ _ 3 4 _ _ _ _ _ _

Q W E R _ Y U I O P
A _ D F _ H _ K L
Z X C V B _ M ?

q w e r t y u i o _
a s d f g h j k _
z _ c v b n m _

Other google searches, most link to spam-bots, spam-traps, etc. (again, indications of deliberately random characters) One did link to a component of a PN03 / GameCube / Action Replay code … might that be related?

wAzQY /



Mmg February 16, 2006 12:39 PM

seems Hoaxish to me. Especially when I see Ken whine about Jenn’s estrangement and then see Jenn make the very next post and never set the record straight about her level of anger for Ken.

Nate Austin February 16, 2006 12:48 PM

I keep a similar list at home:

vCTbFPFQciYmWC Zk&TnDUgljJ&jb
AkwardwarjraiN AkwardhSrdraiN
4UFG548CQ2QZGf 1n#%jWLEqj5ZBf
vCTbFPFQcxYmWC Zk&TnDUgljJ&jb

They are just codes for the game Animal Crossing. Did anyone invovled own any video games? Could be making mountains out of molehills.

Fox Mulder February 16, 2006 1:12 PM

[quote]Finally, let’s apply Occam’s razor: the fellow was an (unemployed) network admin and computer user.[/quote]

That is not true: in none of the references to this case it was stated that the guy was an ‘network admin’ or a even computer expert.

All I can find in the newspaper clippings is “he was an unemployed veteran”. So My guess is he was in the first Gulf War?

This I think is an important angle: what exactly did he do? For instance: was he a communications guy? If so: then he must have been familiar with crypthography.

Come to think of it: can anyone actually tell us what his general knowlegde of computers was?

My point being: if he was just an average computer ‘luser’ the note seems way over the top to me. Most people I know are very dumb when it comes to managing passwords.

Which means that maybe the note was not from him?

I would like to compare the handwriting on this note with the ‘actual’ suicide note.

The fact that the note was near him doesn’t mean it was his. Even it it was in his pocket or wallet: a comparison of handwriting would need to be done.

Bottomline: we do not know for certain the weird note was even written by him and therefor we do not know if it even has to do with the case.

For all we know he could have found it somewhere, was intruiged by it (like all of us are) and brought it home.

Fox Mulder February 16, 2006 1:20 PM

For the first time I see another new piece of (unconfirmed!) information bt NotMe:

[quote]An unemployed Saugus man who was about to be tossed out of his house
because of financial[/quote]

I wonder if this is true or just some addition made up by the reporter in question: financial troubles are also a wellknown ‘stressor’ as far as motive goes.

Who done it February 16, 2006 2:35 PM

Anyone know what bank he used? It looks like passwords generated by my bank or some crap porn site, a little more info and we could access his online banking or have a free wank.

smersh February 16, 2006 3:23 PM

could ‘Sagaz’ be a phoneticization of a certain pronunciation of the town “Saugus”? (I mean, if he was from Boston, it could be more likely than the guy knowing a Spanish/Latin-root word for clever)

-Maybe you could use words and terms common to his life to crack it? Hobbies, past times, relatives, friends, acquaintances, old coworkers, favorite sports teams, athletes, hometown, street, favorite books, creative misspellings based on accents (like a boston accent?), chat or net abbreviations like: 1337, pr0n, ltr, rofl, etc., exposure to diff. languages/cultures, anything he would remember more easily than the distant; maybe build up a theoretical dictionary/lexicon specific to this man?

If he was ex-military, what training did he receive when he was there?

Oh, well; wtvr.

Andrew February 16, 2006 3:39 PM

I don’t think Sagaz is important because using the same decryption scheme I got complete jibberish for the next line.

down under February 16, 2006 5:10 PM

I was wondering whether lowecase letters above the line like the d mean to substitute it with a letter above it on the keyboard and ones like the t which is mostly below it mean a key below while the others mean the actual letter….

informed February 16, 2006 5:27 PM

gamecube post is correct. this is a big damn waste of time, and offensive to anyone connected with the families. let it go.

poloman February 16, 2006 6:00 PM

I think I have to agree with “informed”, “gamecube”, and “regretful doubter”. On balance, there is too little information forthcoming for this to be taken seriously beyond this point. Unless/until someone who claims to know more about this (Ken/Jenn) comes forward with something useful, it is nothing more than an academic exercise, and I’ve plenty of those to keep me occupied.

Jon, Doctor of the Sun February 16, 2006 7:02 PM

Looks like triple DEC to me. The two sideways strings would be the two required 8-byte keys, but without the correct last byte on the first key (currently a question mark) you would not be able to decrypt. If you want to try brute forcing it by trying every possibility (more time than I have), here is a link to a zip file which contains an ANSI C++ version and an ANSI C version of a triple DES decrypter/encrypter. Both should work on any platform, but use the C version if your platform has no compiler.

A neat tool, wish I could take credit for it, but it is the work of a coder named Martyn Brown. Good luck.

Roger February 16, 2006 7:10 PM

@Fox Mulder:
“That is not true: in none of the references to this case it was stated that the guy was an ‘network admin’ or a even computer expert.”

It was in the first news reference once of us dug up, back on 30th January, and recently quoted again by NotMe, i.e. this:
It says, among other things:
“Linda Rayburn listed her husband’s occupation as Internet technician on a town survey she filled out on Jan. 16, though police said Rayburn, a 1988 graduate of Hingham High School, had been unemployed and was seeking work.”

I have no idea if Linda’s statement was accurate but I have referred to it a couple of times and no-one else has questioned it, including the family friend who has posted to this blog. (I suppose “Internet technician” could also mean web developer, but that makes no difference to the point I was making.)

“Bottomline: we do not know for certain the weird note was even written by him and therefor we do not know if it even has to do with the case.”

Quite right. In fact, there is a bunch of stuff about “the case” that we (the readers of this blog) don’t actually know. However, unless the police are grossly incompetent [1], “the case” is already solved, and the putative cryptogram interesting only as a puzzle. I find it interesting to analyse its statistics and so forth, because that’s the kind of geek I am, but IMHO actually digging into the details of the case would indeed be — as several have already suggested — a terrific waste of time.

It is interesting, BTW, that you refer to this matter as “the case”: that is how “Ripperologists” refer to the murders by Jack the Ripper. Be careful you don’t become as obsessed!

  1. For example, we take it as granted that they did all the necessary checks to confirm that David Rayburn hanged himself, rather than being strangled by someone else and then hanged. In such a serious matter as a triple homicide this would certainly include not only the autopsy but also such things as fingerprinting every article found near each of the bodies, blood spatter analysis, tissue-typing and perhaps DNA fingerprinting of blood found on the apparent murderer’s clothing, probably hand-writing analysis of notes, etc. If we can’t assume that the Boston police executed these sorts of procedures competently then we don’t really know anything much at all about the matter.

Roger H. February 16, 2006 8:00 PM

Perhaps the circled letter d at the bottom was written on the original by police detectives / investigators as they were labeling evidence from the crime scene?

Israel Torres February 16, 2006 8:21 PM

@Roger H.

I do not think anything suspected to be evidence in a case is supposed to be tampered with. If anything they would have made a copy of the document before writing on it.

From reading the news articles as well as Ken’s messages it doesn’t really appear that they know about this note or even considered it in their investigation. For some reason readers of this blog are confusing the suicide note found in the kitchen with this mystery-note. They are not one in the same. It really doesn’t even seem they were interested in David Rayburn or his activities post-mortem: They found the sledgehammer to be the murder weapon and all the bodies were accounted for.

Israel Torres

goboard February 16, 2006 9:39 PM

Okay, this took me a couple of hours but I think I’ve figured it out.

This is a simple substitution cypher, with pseudo-acrostics, and random symbols used to try and confuse anyone who found it. It may have been a personal code that he used as he secretly struggled with his urges.

You find the keybase using a keyboard “shift.” Look at a standard keyboard. Every number has a punctuation symbol above it. In the cypher, each symbol equals the number below it.

Duplications are purposely obscured, and each line in the key is 8 spaces long in order to try and hide matching pairs of letters and numbers. Turn the page clockwise, and read bottom to top. Notice that the whiteout marks skip every other space; they probably hide ink marks indicating the subsitutions in the spaces above them as he initially created the key.

d = %, k = 4 (duplicates $), q = @, h = *
y = &, #(duplicates h) = 7, V = $, 3 = ?

The last symbol 3=? is filler to bring the line spacing to 8 (it is discarded in the final decryption). An alternate possiblity is that 3=? could equal #(or “H”), or “O”(written in next to it later). Most likely, the “O” was written in to make the space between the first “D” and the last “d” symmetrical (4 spaces each). So the key translates:

d = 5(%), k = 4, q = 2(@), h = 8(*)
y = 7(&), H(#) = 7, V = 4($), 3 = #(H, O)

Most of the message spacing is 7-8 spaces. Eight spaces is one byte long, the basis for hexidecimal programming. David would have been familiar with this length, and used it as a metaphor for his own life. In places where the line spacing wasn’t exact, David began adding filler letters, either below or at the end of the lines. The line-spacing follows:


In other words, this is a rough draft of a cypher-in-progress. It is 67 spaces long, which divides into 33.5 x 33.5 . He couldn’t get the spacing to work out evenly to form a perfect square. The reason for trying to construct a square grid of letters would be to hide word-length. In this case, the word-length is not important, but what is important are the total number of spaces and letters between substitutions which would also need to be hidden.

The lines mark the spaces as he counted them out. Writing letters struck-through with the lines prevents reading them as numbers, or vice-versa. For instance, “b” could be confused with a “6,” or a “z” with a “2”. This seems written as a habit of someone who uses password-letter subsitition on computers, e.g. fR34k for “freak.” He didn’t want to get the ampersand confused with anything, so he wrote it out underneath. Notice the line through the “7” in the key, the habit of someone who either knows Spanish or the use of strikethroughs to avoid confusing letters and numbers. Significant letters are capitalized.

In order to solve the cypher, you count forward and backward sequentially through the lines. So, if you start with “d,” in the first line you count backwards 5 and forwards 5. In this case, David started by counting “D” (the initial of his first name) as 1 and “W” as five. He realized his mistake and thereafter counted from the base-letter as zero. So, “(D)aXoRw” is 5 spaces. he used Kathy’s initial next (“K”). The rest of the letters appear to be more-randomly chosen, or may have a more-obscure significance.

Proceed through the cypher counting forward and backward. In instances where letters are written underneath one another, I counted both by one and by two letters. Then I assembled the total number of letters beneath each letter-key and looked for signficant letters associated with each occurance of the base-letter. I included letters written underneath one another as one letter-unit. In other instances, there appeared to be no standard method of encryption: most of the resulting message reads sequentially, until the last several lines. The message reads, “WHAM BAM ONCE IF BY (SEX, RED, DIE) D(avid).”

There also seems to be an acrostic formed from the last several letters, such that it might read
as “RED SEX ID(“identification” or primal “id”),” “DIE IS SEX,” or “DIE RED.”

.. R ..
I D ..

What this appears to be is a message from a man who was twisted by his compulsions, trying to understand and hide the shame and turmoil of his personal life. It shows that he was very ill and was paranoid enough to encrypt his fantasies as a hidden meaning for his life, something that he found ultimately, unavoidably irresistable.




W j u P D
aX o R w i s
M m g
H k c F B f e
X n L o y u I
w A z Q Y
b U kr t P s q
Am c Z f i Y z D
C RH V h X a z
E f b d q a r O


D= _, w
D= Z, hX
d= a, _



k= M, f
k= QY, sq



Q= A, b
q= P, Amc
q= b, r



H= o, n,
H= cZ, ef
h= if, q

“once if”


y= B, Y
Y= y, sq
Y= sq, hX

By sX(s-)


H= R, X
H= Zf, Ef
h= iY, d

Xe(-ex) REd Eid(die)


V= zD, z




H?= M, F
H?= zD, hX
h?= cRH, z



o?= D, i
o?= x, (I)


goboard February 16, 2006 9:43 PM


I see a few factual errors, but nothing that throws it off much. Oh well, this was a preliminary effort.

goboard February 16, 2006 9:50 PM

I’ll keep an eye on this post. Obviously, I doubt the cypher was a hoax. Hopefully, if it helps the family get some closure, then so much the better. Regardless, the whole situation is very sad. From the message I decrypted, it would appear definitely premeditated and bordering on insanity.

Israel Torres February 17, 2006 12:20 AM


Just an observation regarding your assessment:
Often the main reason someone encrypts something is to hide a clear message. However your assessment unravels into an even more cryptic message (which could now be qualified as a passphrase instead of just a set of passwords). If someone tries hard enough they may be able to read into anything (e.g. The Bible Code series). There are a lot of assumptions that are going on only because they must be assumed since the factual data is not present (nor may ever be). Let’s not be premature with our conclusions because they may not be concluding.

Israel Torres

Johnny February 17, 2006 6:47 AM

Dont know if any of this helps..

D = Do ?
% = Person / Percent –
K = OK
4 = For
@ = At –
h = Ache ? Eight?
* =
& = And
7 =
V = We
$ =
3 = Free
? =
( ord nedanför)
2 = To
y = Why

goboard February 17, 2006 7:50 AM

Well, anybody else have an idea, then feel free to try and do better? I’m not assuming that I’m right. But I gave you a plausible (or potentially plausible) option.

I don’t think it has to be that difficult to a be possible solution. The fact that it could lead to a terse or unusual message doesn’t mean that it couldn’t have personal signficance. Frankly, I think the hypothetical message is creepy.

As far as I see it, the cypher has a psychological significance detailing the state of mind of its creator. And you’ll notice that paired-letters written below each other, along with the significant use of capital letters act as markers for the text, and seem to indicate that the creator wanted to make the cypher work, force-fit it. Because if the cypher could work, then maybe his life would, too.

But how do you know he wasn’t inspired by some sort of equidistant letter spacing, like the Bible Code? Besides, this is in the space of only a few letters. The Bible Code stuff sometimes skips dozens of letters (or more), and frankly I think it’s a poor analogy.

I mean, basically, it looks more like a decoder ring written out linearly. All this talk of password stuff is too complicated to make sense on a personal level.

Think of it from his point-of-view: his life was too hidden and simultaneously uncontrolled to make sense. Organizing personal urges into a working code would help him structure and make sense of his own nature. It’s what kept him balanced, if he wrote out what was inside himself that scared him the most, regardless if it had to do with his online perversion or not.

Andrew February 17, 2006 8:10 AM

Has anyone tried doing a standard RSA type decryption? For instance a the verticle columns can be interpreted as an 8 bit number where symbols are equal to 0 and letters or numbers are equal to 1 (for the left side it would be 1011101 = 193)? So you would decrypt by raising the letter to the power of the first key and modulus of that number with the second? Nah, actually that would take too much work mathematically to do by hand.

Israel Torres February 17, 2006 10:13 AM


Even if you knew him personally you really can’t try and explain what his point of view is, was or could have been. Reaching to make your conclusions the way you are certainly isn’t helping anyone.

Israel Torres

Fathead February 17, 2006 12:48 PM

I like goboard’s initial assumptions–I think it’s on the right track. Not yet there on his conclusions, though. I have a feeling that the methodology is simpler than what he’s currently described.

But I think that he should continue pursuing using his initial methodology. I think that it’s the best one we have so far.

Massimo February 17, 2006 2:27 PM

Just so that no one else waste their precious time on this method (I couldn’t get anything out of it anyway): I took the grouped transcription (as in peri’s comment on January 31, 2006 06:56 AM) top-to-bottom, inclusive the two vertical rows and stuffed the sequence into a hex editor. Then I looked at the hex values without finding anything particular.

So I took the binary string from this sequence instead and looked at it. Nothing particular there either.

Then I stuffed this sequence into a graphics programme and replaced the zeros with space and the ones with “solid pixels” to see if any pattern emerged. But alas no pattern of any sort. Not even a “pixel image” of some kind, even though I tried to stretch and squeeze the “image” around for a bit.

Now perhaps the initial sequence was wrong, I don’t know but I didn’t feel like spending more time with it. Now you know this method has been tried out, anyway… (^_^)

goboard February 17, 2006 3:49 PM

@ torres

Geez, sorry for not helping. So tell me, what have you found? roll-eyes

You say I’m overreaching (and I’ll grant that), but how else do you expect to begin identifying things? Either I’m really off-target, or I’ve said something to make you uncomfortable?

In any case, I appreciate the opportunity to try and help. Out of respect for the situation, I’ll refrain from further comment.

Fox Mulder February 17, 2006 3:54 PM


You’re right about the tech stuff! I was to fast and overlooked that one.

But still: he might not ever have worked as such and might just have been calling himself that or wanting to be one.

But I agree: this might mean he was knowlegable about computer and thus needed some way to hide his passwords.

As to the case itself: I have no idea how thorough the investigation was. My impression however, is that they did not do much to find a motive. But that is understandable because it was a muder/suicide case.

To clarify:
I have no doubt that Rayburn killed his wife and stepson and then hung himself.

However: the questions that remain (for me) are:

1) is/was the note his? (only a handwriting comparison would show that)
2) is/was it at all tied to the case (i.e. motive)
3) What are the origins of the child porn: why does it seem the police did not look into that? It might have given them inside info on (not so much on Rayburn) the trafficing an such of the material. Heck it might prevent other innocents to be saved!

You see, I’m sure the second is actually probably more important to those who were left behind. Unless it’s the codes to a Swiss bank account and all they want is money – but that is not the case I believe: they want to know if the note had any meaning in the sense that it can shed light on the whole case and provide them with a motive – or a hint of a motive and what that some closure.

Also I would be inclined to tell them to send it to the FBI (or any ex-FBI person with a background in cryptography and profiling!) and have then have a crack at it!

In fact I am going to forward the whole deal to John Douglas. Maybe he has something interesting to say about it.

Israel Torres February 17, 2006 3:58 PM


I am studying this from many perspectives and theories as is most everyone still interested in this artifact. However, I am not one to speak out of order and without consequence.

Israel Torres

SHADE February 17, 2006 4:12 PM

I have no clue as to cryptograms and such so I bring nothing of relevance to this disscussion, that said it looks to me as if this is a phone number in Steelville, MO.

jp February 17, 2006 11:18 PM

Just some ideas: I could be on a wrong track.

-Assume nothing is a mistake. If this is a death note, He’d be sure everything is correct.
-letters on the sides are keys, not Acronyms. and you have to use those keys to decrypt the body text.
-Assume all spelling is correct, maybe one mistake. no phonetic stretching.
-not rolling substituion, but direct substitution. Or it would be almost impossible to decrypt.
-not 8×8 (2 dimensional), but 63+3 = 66 (1 dimensional), which is the same as number of chapters in the Bible. Was he religious? maybe, just a coincidence?

-Side Keys have a pattern
-d % K 4 – q @ h * – y & # 7 – V $ 3 ?
-4 5 11 4 – 17 2 8 8 – 25 7 3 7 – 22 4 3 ?
-by treating everything as a number
-in group 1, position 1 and 4 coincide.
-in group 2, position 3 and 4 coincide.
-in group 3, position 2 and 4 coincide.
-in group 4, position 4 and 4 coincide for anything, thus it is “?”. this makes some sense to me since “?” was an oddball char.
So, actual group is 1 3 2 4,
so, keys would be
4 5 11 – 25 7 3 – 17 2 8 – 22 4 3
5 11 4 – 25 3 7 – 17 2 8 – 22 4 3.


5 11 4 – 17 2 8 – 25 3 7 – 22 4 3 — if deleting duplicates, but keeping the order.

-Each line is a word
-not xor, computer ASCII oriented.
-Captialization means someting since he was really careful to distingush. – Possibly a direction, so (G,1) = K, and (g,1) = f.

First Letters of Bible Chapters


Fox Mulder February 18, 2006 6:18 AM


If you – and others for that matter – have nothing intelligent to add, please refrain from these utterly unintelligent remarks.

stego man February 18, 2006 8:32 AM

A few observations which don’t seem to have been made so far:

  • The strikethru chars are intriguing. They seem deliberate; never for a capital. So…
  • The placement of non-strikethru lower case (more common at the beginning, then three at end) suggests punctuation or padding.
  • There are three (not four) alphabets: upper, lower and strikethru (ie. no caps strikethru).
  • The frequency count of chars suggests a deliberate attempt to smooth the distribution. (Used 43 of 52 upper/lower case in 64 chars). This could mean some form of cumulative cipher. Or it could be two or three ciphers are in use and he picked the one to avoid duplicates – with upper/lower case indicating which cipher to use.
  • The final O could be a signature ‘D’, or a sign-off ‘X’ (kiss).
  • The three char line could be a wrap, ie an 11 char line.
  • Note that ? is on the same keyboard ‘vertical line’ as zero. This could map y to 6; V to 4; d to 3 etc. -> 67374430 35841268.

Finally, I think that if this is a cipher then it would have to be encrypted and decrypted with mental arithmetic – we are looking for simple tricks not complex algorithms.

Good luck to all.

Hamas February 18, 2006 8:51 AM

I read most of the insane comments on this site and Im surprised "JESUS WAS A BLACK MAN" wasnt one of the posts.
People! You need to get out and take in some fresh air!

Ganzfeld February 18, 2006 1:29 PM

I’m surprised nobody has mentioned the most obvious explanation. It is a list of file and/or directory names, and the vertical lines are the passwords.

The style of the directory names is very similar to the random ( 8 letter ) directory names you get in the ‘userdata’ directory. That none of the lines are more than 8 characters supports this. It’s highly unlikely to be a coincidence that most of the lines are 7 or 8 characters. This suggests part of a file system….and NOT encrypted words.

I would suggest that the 3 and 5 line items are directories, and the 7 and 8 line items are their respective sub-directories, or file names within those directories.

So the whole thing would be a list of directories on a server somewhere, and the passwords to them.

Ganzfeld February 18, 2006 1:56 PM

Actually, I suspect that the vertical lines are in reality all one 16 character password. That would make more sense, and be a much tougher password to crack. The rest of the text is then directories and file names…..I’d say 3 directories and 7 file names. The ‘floating’ letters are probably annotations of file content.

jp February 18, 2006 7:03 PM

We can either think of it as either
1) gibberish, password, filename, ip address, URL, phone number, where we would need another device(his computer) to solve this, or
2) everything needed is on this paper.

I am assuming it would be the latter.
It could be a password list since the word length is little longer than typical english sentence, where we would have more 2 or 3 letter-long words.

Dirk February 19, 2006 4:39 AM

The ampersand might be annotated to remind him that sometimes this character is not represented right when transmitted over the internet (html, email and such) and gets substituded by a square. So we could assume that these lines were meant to be emailed?

Chloroform February 19, 2006 4:51 AM

It seems Ken waited a prompt stable hint concerning the solution of the letter from this forum and since We couldn’t come up with it, He abandoned us.

Ganzfeld February 19, 2006 7:02 AM

I think it’s highly unlikely to be a password list. Nobody in their right mind uses a password of just 3 characters, and even 5 characters is not that secure. It seems a bit of an oxymoron to suggest that someone went to all the trouble of creating this document for security……only to leave the final result about as insecure as it gets !

I also think it is unlikely to be a message. What are the chances that half the words in a 10 word sentence just happen to be 7 characters long ?

The length of the lines, and the fact that most are either 7 or 8 characters is to my mind the biggest clue. The whole thing reeks of file and directory structure. That would best explain why there are so many lines the same length.

There’s also a major clue in the ‘floating’ letters. I think the one below the ‘k’ is actually the letter ‘L’……it follows the same style of the other letter ‘L’ of having the downward stroke extend too far. This would give the floating letters as L, M, and H. And to my mind, that is Low, Medium, and High. Could be a reference to file resolution.

Ganzfeld February 19, 2006 7:56 AM

Here’s my theory :

Somewhere out there, there is ( or was ) a server with lots of illicit stuff in possibly hundreds of directories. Clearly, nobody is going to call their accessable directories things like ‘illicit_pics’. They will give them totally random meaningless names.

The characters vertically down the side of the paper are a 16 character password, probably for the server itself. 16 characters would be pretty secure. The rest is simply a list of favourite directories and sub-directories. So the whole thing would have a structure like this :

……bUktPsq (L)ow
……AcZfiYzD (M)edium
……CRVhXqz (H)igh

I would imagine the whole thing probably started as an orderly file system with 7 character directory names, and they then got moved to directories with shorter names that are probably mnemonics of some sort.

Nobody would have the feintest idea what any of this was for, or even what server it was on, so the owner of the note would feel quite safe carrying it about.

Chi_Squared February 19, 2006 10:18 AM

You’r all wrong ! Allow me to at least partially unravel the mystery !

Three of the lines of seemingly gibberish nonsense, WAZQY, WJUPD, and EFBDQAR all…….for some reason……show up in a Google search under web sites for either Nasa or JPL, particularly in ‘fts’ ( file text search ) files. Check for yourself on Google, and you will come up with these for each of the three lines in the note.


In every single case, its in an FTS file……and in every single case it is related to the SOHO Solar Observatory mission ! Surely that cannot be a coincidence….three lines of the note having a single thing in common.

It is clearly programming code of some sort. As I’m only familiar with SQL and database programming, I have no idea what sort of code it is.

Chi_Squared February 19, 2006 11:30 AM

WAZQY only appears on 48 distinct web sites……….one of which is :


A site about the SOHO data, and the text says it is to do with ‘bytes per bitpix’

WJUPD only appears on 23 distinct web sites…..one of which is :


Yet another site on the SOHO data…..and yet again, the site is about ‘bitpix’ !

And EFBDQAR only appears on ONE web site. And guess what ?


……it’s our old friend the SOHO mission again !

The chances of 3 lines of utterly random characters all having a common connection within a ( total ) list of just 72 web sites has to be astronomical.

I’d say this is as good a clue as one is going to get as to what the note is all about. Looks to me like coding for images. It’s probably compiled code ( which is often gibberish ) rather than source code.

Dirk February 19, 2006 11:47 AM

Not bad. Take a look at this:


The line: “wazqy” led me there: in the google cache this page had a “odyhurj@wazky.net’ entry, but the page seems to have been updated since.

It’s interesting to know that this page is not visible from the homepage of this site, but there’s the same “solar” reference:


I apologize to this guy if he has nothing at all to do with this matter, which we must absolutely assume in the first place, of course. But the cipher looks similar.

Chi_Squared February 19, 2006 12:31 PM


I think the connection with SOHO is purely that it tells us that the note is most likely lines of compiled code, probably image processing code. I doubt there’s some bizarre Nasa connection.

One would need to know what the pre-compiled version of the lines are. Who knows……maybe THAT has a message in it ! Many computer languages, such as SQL, uncompile back to bog standard English words. So this note could be a crafty case of not so much using encryption but simply using the compiled ‘gibberish’ from some programming language.

It could be that the lines down the side are simply a way of hinting that the whole thing IS only solvable on a computer……a sort of way of saying ” hey, dummies, get your PCs out to solve this “

Israel Torres February 19, 2006 2:03 PM

It seems very unlikely that a code that could only be interpreted by a machine would be hand written on paper. Not only would it be simpler to print it out if it were to be created as a physical artifact, it would also be inconvenient to re-enter by hand – allowing room for typos and other common typing mistakes. Why even print it in the first place since this could easily be hidden among the millions of free sites out there or even as a random blog entry, forum, message board, bulletin board, saved e-mail, somewhere out there. If this was meant to be hidden from prying eyes it wouldn’t have been printed in the first place.

It also seems unlikely that this is part of a file structure because a simple directory scan would show this to be out of place with the average directory structure name. Hiding in plain sight would support that if it was to be a directory structure it would have common and likely directory names like “system???, “temp???, or even the usage of GUIDs that are commonly seen in a file system and ambiguous for immediate determination.

There isn’t any evidence supporting it couldn’t be a password list – everyone that objects to it appears to use the “Mmg???, “3 character??? excuse. Many must not be familiar with enforced 3 digit security codes that are also used in various places such as password recovery, PINs, credit cards, captcha verification. Some systems that use these require something be entered as additional security. There is also a possibility it is part of another string of letters above or below it.

In fact no one is sure if these strings of letters are ordered from top to bottom, bottom to top, reversed, reversed in alternation, or any other order the mind can contrive. For all we know it could be encoded in diagonal angles.

Here is really the only fact we as a whole have found so far: As of now it has been 21 days since this blog entry was published and no viable solutions have been found, or proposed. All we have come up with are thoughts about what it could be without any factual assurance whatsoever. It could be a lot of things, but in reality it is only one thing that it was used for if anything at all. Whatever it is we still don’t know.

Israel Torres

Svelte February 19, 2006 5:39 PM

Dear Sir,

Much more information would be required for a person to even begin to attempt to try and solve this puzzle. State, County, Street, Zip Code, Dates of Birth, Full Names, Images of All Concerned, etc., etc. Please see below:

“Feb. 2: Linda Rayburn, 44, and Michael Berry, 23, of Saugus, both killed at home. According to police, Rayburn’s husband, David Rayburn, killed his wife and stepson with a hammer. Their bodies were found in adjacent bedrooms. David Rayburn left a suicide note, went to the basement, and hanged himself.”

If such detailed additional information can be provided it should be posted on your web site in fairness to all concerned.

Most Sincerely,


Chi_Squared February 19, 2006 6:47 PM

@Israel Torres

Well….I’d like to see anyone explain how 3 of the lines in the note all just ‘happen’ to show up as distinct words of compiled code on data files on 3 seperate web sites that all have SOHO images files in common and ALL relate to ‘bitpix’

But I will now produce the defining evidence……a FOURTH line……MMG……also has such a link, one that even tells us what MMG means. Multi Media Gallery. Do a search on MMG and BITPIX…..and lo and behold almost every single one of the web sites that comes up is on the subject of bitpix images…..from SOHO ! Indeed, the very first site listed is


Which was the same site I mentioned above that the WJUPD line is found on, and once again it is in a .fts file !

So we now have FOUR of the lines on the note all clearly linked to bitpix images from SOHO.

It is surely straining credulity to the utmost limit to believe that 4 out of 10 random lines of characters would purely by chance all just ‘happen’ to appear as coded words on SOHO bitpix files !

Anonymous February 19, 2006 7:23 PM

@ X^2: Unless SOHO project produces a great large amount of files like that. Wich is the case.

Israel Torres February 19, 2006 7:38 PM


Just because Google gives you “results” do not make it a solution to the issue at hand. It simply isn’t how the world works.

Since we all are not sure what should be eliminated all things are considered. However, all will not lead to the conclusion.

If this is a puzzle it will either be solved wholly or it will not be solved at all. There is no middle ground since such middle ground cannot exist in a puzzle with finite pieces. The pieces must fit, or it is not a puzzle.

We have no idea whether or not there are many parts to this note that would involve solving it. All we have is this one page. For all we know this could have been part of the seed for a real hidden message that is even yet to be revealed in the future or ever. Even if it is a secret message we have no idea if it is in English or using the English language.

All we can do is take the note at its face value (a bunch of letters and symbols) and try to have it make sense. Once it does make sense beyond a shadow of a doubt only then can it be thought to be solved. We are certainly nowhere near that point at this time.

Israel Torres

Ganzfeld February 19, 2006 8:30 PM


With all due respect, you have made a major booboo, especially for someone with a name derived from statistics.

The chances of repeating a 5 letter sequence are actually 26 to the power of 4 ( 1 in 459,000 ) in this case, as the files are over 1mb in size and you are thus bound to get at least one instance of the first letter of the sequence. So on average you most certainly would expect to find at least one instance of almost any 5 letter sequence ( even a totally random one ) in a file that size, and those files are nothing but sequences of letters.

The chances for a 7 letter sequence are one in 308 million. Sounds a lot, but there are over 100,000 such files. The wonder is not that you matched 4 of the lines, but that you didn’t match all of them !!

A gallant effort, but in the end you’ll find it is exactly what you would expect by chance and there really is nothing whatever in your claims.

But it does illustrate very well how easy it is to get carried away with pet theories and lose track of the wood for the trees.

Roger February 19, 2006 9:09 PM


I’d like to see anyone explain how 3 of the lines in the note all just ‘happen’ to show up as distinct words of compiled code on data files on 3 seperate web sites that all have SOHO images files in common and ALL relate to ‘bitpix’

Simple: most of the ones you found in this way are quite short, so short they are almost certain to be found at random among the 170 terabytes of data which Google has indexed. Since they are not words in any human language they will not be found in human readable text pages, and since Google doesn’t usually make text indices of binary contents they won’t usually be found in images either — but this is only because Google excludes the binary contents of such files. However, the FTS files you found are semi-textual representations of binary data (in fact they appear to be not compiled code, but an unusual compressed image file format used in astronomy). The text at the start of the file fooled Google into indexing them, while the image binaries — in some sort of uuencoded type format — in the body of the file happened, by chance alone, to contain your strings.

The fact that quite a lot of your hits came from FTS files is firstly because only a few binary file types will (erroneously) get indexed in this way by Google, and secondly because the astronomers seem to have really large amounts of data available on the web in this format, and thirdly because the format is encoded in a manner (something like uuencode) such that a majority of bytes are alphabetic letters.

The chance of a given meaningless 5 letter sequence occurring in a random byte string of this type is about 1 in 40 million, so if they have much more than 40 MB of FTS files, it is very likely to occur. And it looks like they have MUCH more than 40 MB. In other words, finding random 5 letter strings in this way is not only totally unremarkable, it is so likely to occur that it would be surprising if it didn’t happen. In fact, here is a little experiment you can try: repeat your test, but instead of the strings from the note, use ones you make up yourself. For example, try this:
(242 hits)
(1 hit)
(857 hits)
Try it yourself, but use whatever 5 letter string you like.

Now a seven letter string like ‘EFBDQAR’ is slightly more surprising, since the chance of it occurring in a random 7 byte sequence of this type is about
1 in 40 billion. That starts to sound like very long odds, but actually it would not be so surprising if they had at least 40 GB of FTS files on their site, and actually it looks like they might. Actually, even that is pessimistic, because it is talking about the odds of finding it on one particular site, chosen in advance, when we really we only want to know the odds if it being found on some site anywhere.

And your fourth hit, ‘MMG’? C’mon, that’s only three letters. The odds of it occurring at random are so good that finding it on a site like that is totally meaningless.

So to summarise, I’m sorry, but what you’ve found are just patterns in the clouds.

Oh, and the pages that Dirk found are spam traps, by the way. They generate huge numbers of completely random strings and format them to look like email addresses, in order to “poison” the lists of email addresses which some spammers harvest with webcrawlers. In other words, anything you find on such a page is just random garbage, and any reasonably short random string has a high chance of being found on such a page by chance alone.

Roger February 19, 2006 9:56 PM


Here is really the only fact we as a whole have found so far: As of now it has been 21 days since this blog entry was published and no viable solutions have been found, or proposed.

You may choose to disagree, but I believe that we found something else (on the 2nd day after it was published): that the stats are poor matches both for strong modern algorithms and for classical algorithms, but are extremely good matches for the pseudo-random sequences produced by a human being trying to type “at random”, something which is fairly well known to produce quite nonrandom patterns. In fact I think that from these strings one can even identify that the typist was probably left-handed.

In other words, I am about 85 ~ 90% sure that these sequences were produced by banging on the keyboard “randomly” and do not have any other internal meaning. I can only think of four reasonably plausible reasons why someone might bang on the keyboard at random and then write down the result:
1. to generate a strong seed for a PRNG for some sort of simulation or otherwise repeatable test;
2. to generate “strong” raw encryption keys;
3. to generate strong passwords or similar programmatic keys; or
4. to generate something which resembles a ciphertext, as a joke or game.
However, option 1 seems unlikely because the volume of material is nearly an order of magnitude more than is required for that application, and also because the typist deliberately changed technique for the last two items. Also, option 2 is put in doubt by the 3 and 5 character strings (if we assume that each line is in fact a separate item): three and five character passwords, as you mention, are suitable for passwords in certain restricted circumstances, but are NEVER strong enough for encryption keys. However, it might remain possible that some were passwords, and others encryption keys. So, option 3 or option 4. I know which I think more likely, but don’t care to state it because I am not quite certain.

A minor aside:

For all we know it could be encoded in diagonal angles.

Certainly things could be upside down, back-to-front etc. Indeed such things are quite plausible as an additional minor form of obfuscation in case the list fell into the hands of another. However, I don’t think that more elaborate geometries (such as diagonals or the complex grids someone else mentioned) are likely for the simple reason that the positioning of the characters is too careless, and such alignments become ambiguous within at most three letters.

jp February 20, 2006 1:56 AM

I would like to know everyone’s opinion on 3 things.

1) What does “?” mean in the right-side-text? All other letters are either alpha, num, or shift+num. “?” doesn’t belong to any of them.

2) What are the significants of the off-line letters? “r”, “m”, “H” ? Are these mistakes? intentional?

3) Why is “O” at the end of the text mis-aligned?

Israel Torres February 20, 2006 2:40 AM

Since the free floating letters do not correspond to a line there is no definite location they are represented to. This means no one is for sure if these letters go above, below, before, after any letter they are orbiting. If they are ignored it can be viewed as follows (accounting for the right-most perpendicular string being on top since they are written in a relative fashion as if turning the note to the left would allow you to read them “normally???):

y & # 7 V # 3 ?

W j u P D
a X o R w i s
M m g
H k c F B f e
X n L o y u I
w A z Q Y
b U k t P s q
A c Z f i Y z D
C R V h X a z
E f b d q a r O

d % K 4 q @ h *

With this view you can see that both of these perpendicular strings are of the same length (8). The character “y” directly lines up with “d”, and “?” directly lines up with “*”.

The same count corresponds as:


It has been discussed that the free floating letters could also account for mnemonic hints.

The entire grid appears to be misaligned in its relative spacing, as if sketched without knowing the count ahead of time in this particular copy. It is also possible due to this uncertainty and sloppiness it was added as an afterthought – at the same time meaning to be spaced as not to be confused. Otherwise it could mean a lot of things such as “the end” both literally and figuratively. O == Omega (versus Alpha).

The fact of the matter is that no one knows for sure at this moment in time, so really any visible anomaly could be attributed to anything and everything.

Israel Torres

MOTH February 20, 2006 4:26 AM

hi guys ^_^ this is all very interesting to read. just wanted to chime in and give you a bit of encouragement. youre all doing a great job i hope you crack this thing. just try to work together and stay positive. GOOD LUCK!

JacktheRaptor February 20, 2006 7:21 AM

anyone of ur peepz ever seen Mercury Rising? Thats what happened… The guy was a unemployed Internet nerd right? So he found out about a secret code, and got whacked by the CIA. (Probably CIA caus they lie to everyone in America…)

Anonymous February 20, 2006 8:56 AM

Maybe it would help if you knew if this David was a complete retard, or some genius… If he was an idiot I’d say it doesn’t mean anything…
So, what was he like?

frank February 20, 2006 11:05 AM

ok I think it’s a hoax…
humanity deciphered cuneiform writing and much other different and hard languages..
Dont tell me FBI, or what ever agency, can’t find out what this means, or FBI don’t have the resources to figure this out…

Ganzfeld February 20, 2006 12:05 PM

It could just be a list of laundry/dry cleaning numbers for all anyone knows.

At least whey they cracked the Rosetta stone, or deciphered the Enigma code, they knew what they were looking at, and that it was an encryption problem. This note could be absolutely anything. As others have said above, without a context I suspect it is all but impossible to give a definitive answer. One could spend years trying to ‘crack’ it, only to find it is laundry numbers.

Svelte February 20, 2006 3:09 PM

Analysis of Main Text area only (excludes vertical sides):

Three main problems exist with this puzzle.

  1. That an accurate judgment cannot be made as to whether or not some letters are what they may appear to be (fifth line down, second character over may either be an “n??? or a small capital “A??? and seventh line down, below the third character over [“k???] is what appears to be either a “v??? or an “r??? but most probably a “v??? based upon hand writing of other large case “V??? characters).
  2. The other problem is with determining whether or not the characters have actually been placed either “above???, “on??? or “below??? such drawn lines. Here are the lower case letters that may be interpreted either above or on a line: “a???, “a???, and “a???.
  3. Since this puzzle is reportedly obtained from a crime scene and authorities have much more information available to them it is not really a fair endeavor for anyone not being availed same such information as they might have. This is true also for other forms of intelligence gathering. One must be supplied with all known information relevant to the problem.

In a handwritten note of only 84 characters (again, of the main text only) it is virtually impossible for all 26 letters of the English Language Alphabet to be used (Unless it was intentionally done).

Examining this puzzle I see that this is verified in the following manner:

Upper Case Only: A(2) B C D E F H I L M O P(2) Q R(2) U V W X(3) Y(2) Z (Total Count = 26 with 20 characters used and 6 not used).

Lower Case (above line only): a(2) e g i o q r [ questionable location] (Total Count = 27 with 18 characters used and 8 not used).

Lower Case (on line only): a* b(2) c(2) d f(3) i j k(2) m n o q s(2) t u(2) w(2) y z(2) [* questionable location] (Total Count = 27 with 18 characters used and 8 not used).

Other/Questionable Characters: d h K q V Y (Total Count = 6 with 6 characters used and 20 characters not used).

Vertical Sides: Although there is little doubt that these vertical sides may hold the “key??? to the puzzle I see no reason to continue this examination without additional background information as explained above.

Israel Torres February 20, 2006 3:59 PM

I am not sure why many are persistent on requiring more background information to find a solution – what you see is what you get.

In the beginning we appeared to have a few key characters that supplied us with some preliminary information likely to get more parties interested enough to put forth more effort now which are no longer publicly involved for whatever reason they need not explain.

At this stage we can’t even determine whether this is a secret message, a list of passwords, mnemonic devices, or psychotic gibberish. Further requests would only be warranted if a discovery that indeed it was a message that mentioned key words that weren’t making sense to us.

Included in the things we don’t know include but are not limited to the following:
– Did David Rayburn write this? — It is possible that this isn’t even his note. For all we know he could have picked it up on the street. There is no supporting evidence that he was interested in cryptography or that even more of these notes in attempts to practice this are still or ever were around.
– Is this related to the crime scene at all? — It is very likely since this was found deep within the belongings and not blatantly exposed (as it was explained it was inside the briefcase) that it was something not relevant to any of the suspicious situations involved in the crimes committed.

It seems that the bulk of interested readers are trying to use methods of investigation not readily available for a crime committed over 2 years ago instead of pursuing this cryptographically. The interest shouldn’t be on the forensics involved/applied but really only focused strictly on the note itself. There is no mystery as far as law enforcement investigations have been publicly pursued. For them it wasn’t about this message found within the belongings of David Rayburn. Instead it was about putting all the pieces together and closing the case in a court of law. The original posting for this entry was to solve the note not the crime. Confusing the two only leads to more questions that won’t help solve whatever this note may be or contain (if anything at all).

Regardless of time, many of us will continue to be interested in finding out what this is and whether or not it will one day reveal a solution.

Israel Torres

svelte February 20, 2006 4:11 PM

Dear Israel Torres,

You are very, very wrong, in my opinion. The problem provided in its cold, hard state, is without additional information that others have and know. The puzzle was provided to us in a manner that was both incomplete and without additional information availed to those that presented it to us here on the Internet.

By that I mean that they, obviously, have much more information about the item that we are examining.

A date of birth, an address, the exact location, the exact date of the reported act and many other factors are additional clues.

Such clues are not provided to us and it is extremely important for us to know all of the available facts so as to decipher the code provided.

I do not agree with you. I will use this example to back up my diffrences with you regarding this problem.

If I were copying code from somewhere (as I use to do) it would be preferable for me to know where the signal was coming from.

If I did not realize that I would have no means to know what language our translators and analysists would need to utilize in order for them to decode the recieved message.

Therefore, in my opinion, all available knowledge is imperitive so as to have the best edge to break the code.

To do otherwise is to inefficiently labor at a task that may turn out to be a total waste of time.

Most Sincerely,


informed February 20, 2006 4:39 PM

you all have already wasted a great deal of time. you have been given false, misleading and incomplete information – led to believe this was some secret message, when, in fact, it was left along with numerous other objects, papers, etc. which had nothing to do with pornography or anything else which arouses the morbid curiosity. the original poster was obviosly not very bright – if he had been, he never would have posted private family information without permission – all over the internet – without contemplating what that would mean for all of those left behind with unspeakable grief…the original poster’s offensive and careless act has caused more pain than any of you could comprehend. he gave you a document with writings, markings, etc. on it that were not on the original. you have no idea who the writer was and many of you have made horrible jokes and passed judgement on people and subjects without any reasonable amount of information – to be fair, you never should have been presented with the issue in the first place.

Israel Torres February 20, 2006 4:52 PM

Of course any factual information provided by these parties would be helpful. It would certainly make proving a solution to this in a timely fashion less questionable. It is likely there is even an answer sheet somewhere with correlations pertaining to the solution rotting away just out of our grasp. However these are luxuries that we do not have available to us for undisclosed reasons and must make due. You certainly cannot be stating that because there is no further information all brain activity must cease. We already have a lot more information than a lot of strange writings come with… and they get solved through means that we are aware of and even discover new methods in the process. If this note was indeed an English secret message using basic mono-alphabetic substitution we wouldn’t be having this conversation.

Israel Torres

informed February 20, 2006 5:04 PM

to israel: if you had the capacity to truly understand my message, we wouldn’t be having this conversation. it would all stop here. are you a computer or a human? if at all possible, look within.

Israel Torres February 20, 2006 5:22 PM


You have the capability to contact me privately: israel [at] israeltorres [dot] org …As of now you are just words on an anonymous public forum in which you clearly do not wish to identify yourself to the public. You may contact me, identify yourself, and your request – such information will be kept private.

Israel Torres

Svelte February 20, 2006 6:05 PM

Dear Torres and Infomed,

My objective is not really to get into a debate with either of you but that does not mean that I am opposed to exchanging information and knowledge with each of you.

My objective is to provide information to help all of us break the “puzzle” that has been provided to us here on this web site.

In all honesty, as I see it, the information provided is incomplete and if this is, in all honesty, a murder case, then the investigators that have viewed first hand, the so-called encrypted hand-written message most certainly have been availed much more information that what has been provided to us.

Therefore, once again, I contend that we are not being given the proper amount of information to help to solve this puzzle (case).

Throwing such challenges to me as this is simply a cryptic message and should be taken only as such is totally naive.

That is absolutely lutecrous because such a comment completely ignores the fact that others have more information than what has been provided to us and if they were provided with such information and could not solve it how could you and I solve it minus what they know?

To do otherwise would be like asking me to break the Japanese Code without knowing it was from Japan.

With Utmost Honesty and Respect, I am…


Ganzfeld February 20, 2006 7:18 PM

@ Israel Torres

“I am not sure why many are persistent on requiring more background information to find a solution”

Because we have no idea whatever as to what this note actually is. We don’t even know for certain whether it isn’t just a hoax. And I’m sorry, but anyone who remembers the John Titor case will know just how some love nothing better that a good hoax. Thousands still believe, to this day, that John Titor was a time traveller.

I do not suggest it could be a hoax to in any way denigrate the original sender. It is more that it is simply another possibility to add to a very long list. And that list exists precisely because we have absolutely NO information as to context.

As I’ve said above, this whole thing could be nothing more than a list of dry cleaning tags. Imagine that you came across a similar sized piece of German Enigma code from the war……but you had no idea what it was. In the absence of that knowledge you would not have the one vital piece of information that Turing had……..that the thing WAS a code. For all you know, it could be Lord Lucan’s Swiss bank account numbers !

And that is the real problem here. Not what does it say, but what exactly is it in the first place ! In the absence of the latter, it is extremely unlikely that one can ever definitively establish the former.

The alternatives here are not between cracking the ‘code’ and not cracking the code. They are between having some idea what the note is and having no idea what the note is. And I’m struggling to see how we ever get beyond the latter.

One point I would make, though. I think it highly unlikely that anyone would go to all the bother of creating a code for so short a ‘message’. Pure psychology is the best clue here. Generally when killers leave coded messages, it is in the form of taunting messages before they are caught. And the killer leaves no doubt that the thing IS a message. I cannot see any killer going to all the bother of creating a coded message, and then ommiting any clue that it IS actually a message ! One would surely want people to pick it up and not just think it’s a list of laundry tags. Indeed, the fact that it has been 2 years since the murders and it is only now being looked into is THE best possible indication that it is not a coded message.

Ganzfeld February 20, 2006 7:38 PM


“ok I think it’s a hoax…
humanity deciphered cuneiform writing and much other different and hard languages..
Dont tell me FBI, or what ever agency, can’t find out what this means, or FBI don’t have the resources to figure this out…”

Well that’s the one thing that really truly puzzles me in all this. No indication has been given that this note HAS actually been seen by the FBI……which I find mighty strange ! One would have thought that if this was a suspected murder note…..the FBI would have long since been all over it.

But I don’t see any indication from the sender or their friends that the FBI has ever viewed the document. It’s a vital piece of information that Ken has ommited.

If the FBI have not looked at the note, the immediate question is why not, if the sender thinks it may be pertinent to the murder case ! And if the FBI have looked at the note, why are we not being told their conclusions ?

It is surely a pretty straightforward question. Has the FBI seen this document or not ? And if not…..why not ?

Israel Torres February 20, 2006 8:19 PM

“And if not…..why not ?”

There is no proof that this note has anything to do with the crimes committed. It was simply discovered within the Rayburn’s personal affects sometime after the crime. Ken mentioned above as far as law enforcement is concerned the crime has been solved. No one can even be sure this artifact is related in any way to this incident.

Israel Torres

Ganzfeld February 20, 2006 8:45 PM

@Israel Torres

“There is no proof that this note has anything to do with the crimes committed. It was simply discovered within the Rayburn’s personal affects sometime after the crime”

No, that certainly is NOT the way it is presented in the original email at the top of this page. We read of ‘disturbing items’ being left behind……and that this ‘cryptogram’ is ‘the most intriguing’ of them. Even that it may have ‘valuable information’ on it !

Now excuse me…..but those sure ain’t the words of someone who has just found some odd little note and wonders out of curiousity what it means. The implication is fully there that the note may have a connection with the crime. It is as good as stated. Why else has this alleged ‘cryptogram’ been sent ??

What is more, I increasingly fully agree with Svelte that it almost seems as if there is vital information being deliberately witheld. And whether this note has ever been seen by the FBI is one such piece of information. I cannot see how anyone can claim the note may have ‘valuable information’, and yet at the same time never have been viewed by the FBI.

Angel February 20, 2006 11:52 PM

Call John Langdon from Da Vinci Code. He’ll help (he is actually a real person who does this stuff for a living)

Fox Mulder February 21, 2006 6:03 AM

Guys, I still want to stress that so far, we have no means of confirming in any way that:

  • the note is real
  • the note belonged to Rayburn
  • the note was written by Rayburn

Unless we have any (documented) prove of this, it is utterly useless in my idea trying to crack a code that might not even be a code.

Passerby February 21, 2006 10:05 AM

I am among the skeptics, and presume a hoax until the authenticity of this “note” or “list” is established.

Until proven otherwise, I assume that the item was created by the person who sent it to Bruce, not by Rayborn, and that neither the item nor the sender has any original relationship to Rayborn, the Rayborn/Berry family, or the homicides.

If the puzzle is such a hoax, why was it submitted only to Bruce and this forum? One speculative possibility is that the sender harbors envy or a grudge, as might be the case with an aspiring cryptographer whose work has been condemned here as “snake oil.” What sweeter revenge than to stump the experts here with a “message,” perhaps encrypted with his/her own rejected system?

Svelte February 21, 2006 10:28 AM

Error Correction (lower case above line only):

In a handwritten note of only 84 characters (again, of the main text only) it is virtually impossible for all 26 letters of the English Language Alphabet to be used (Unless it was intentionally done).

Examining this puzzle I see that this is verified in the following manner:

Upper Case Only: A(2) B C D E F H I L M O P(2) Q R(2) U V W X(3) Y(2) Z (Total Count = 26 with 20 characters used and 6 not used).

Lower Case (above line only): a(2) e g i o q r [ questionable location] (Total Count = 8 with 7 characters used and 19 not used).

Lower Case (on line only): a* b(2) c(2) d f(3) i j k(2) m n o q s(2) t u(2) w(2) y z(2) [* questionable location] (Total Count = 27 with 18 characters used and 8 not used).

Other/Questionable Characters: d h K q V Y (Total Count = 6 with 6 characters used and 20 characters not used).

Svelte February 21, 2006 2:08 PM


Let us start with our objective of breaking down this code.

My first contribution is as follows:

Most probably “A = E”

a = e
A = e
A = e
a = e
a = e

This is the letter that has been most frequently used and has the most association with other letters.

Assuming that this is our best character to start with I would appreciate productive input for the best consonant and the next three vowels.

I am sure that Mr. Schneier has already done something similar to this attempt so perhaps he might wish to participate with us in our endeavor.

Svelte February 21, 2006 3:46 PM

Tentatively, let us consider “Z” to represent “A” and thus:

Z = A

This is based upon the understanding that the most frequent digraphs are “ea” and consequently, even if we are wrong at this stage we have another step to consider and subsequently accept or reject upon further analysis.

a = e
A = e
z = a
A = e
Z = a
z = a
a = e
Z = a
a = e

Additional assistance from anyone would be appreciated because, as I see it, this is a joint effort by us all.

jp February 21, 2006 4:16 PM

I dont believe it’s 1-to-1 mapping, since English words just don’t have that even distribution.

It could be many-to-1 mapping. such that t -> a, and z->a. where it could be helped by bruting, and comparing to a dictionary.

But, I would like to use all of the given informaion, as much as possible.

Why did he use both upper and lower case letters, and mixed and used them evenly and randomly, and made sure capitalizaion does not get confused using lines?

What are those side keys?

My guess is that it is 8×8 grid. and key for each letter is made by combining the key.
so, the key for the first letter “W” would be made by combining “d” and “y” somehow(?), and key for the second letter “j” is made by “d” and “&”. and so on.
But, I haven’t found any good method to creating the key yet.

If you look at


3 “z” are aligned on the column 8, which might mean the keys for these letters are the same, and they could all be “e”.

Another odd thing about his cryptogram is that “” is not a regular ““, but *, with an extra line. This might be a personal thing, but everyone I know who are in computer field uses a regular 3 line ““. So, I am assuming this guy is not a true “geek”. Does any of you use 4 lined ““?

Svelte February 21, 2006 4:29 PM

Now, let us consider a possible consonant; that being the letter “N” and compare it to the letter “D” and see what we might come up with.

Again, tentatively, D = N, so let us look at this one:

D = n
a = e
A = e
z = a
A = e
Z = a
z = a
D = n
a = e
Z = a
d = n
a = e

Again, I am requesting assistance from fellow participants as I do not really think that I can solve this puzzle without help from other participants.

I’ll continue to do so on my own if necesary, however.

Israel Torres February 21, 2006 4:49 PM

I have created a tool that allows you to play with monoalphabetic substitution in a more sane fashion – it is available for download on my site here:


For example your last assessment (04:29 PM)would be saved and loaded using the key:

with this string:

It ignores case and anything non-alphabetic. Which is very similar to the technique you are currently using. 🙂

Israel Torres

Svelte February 21, 2006 4:58 PM

Dear Israel Torres,

Please just put your input here on the posting board as I do not want to be diverted from what I am attempting to do. I ask only that you input here what you may have to offer rather than off this screen.

This should be a joint effort so do please submit any and everything that you know and have to offer so that we may “tweek” it.

I’m not claiming to have found the solution…I’m only attempting to formulate one with the help of you and other associates here on this posting board.

I’m going to oppose any diversions as best as I can and stay here on this posting board with my submissions and continue to request help from you and others.



K February 21, 2006 6:20 PM

It would be interesting to know how many times the original was folded. Has anybody attempted printing out a copy and folding it different ways to see if a more obvious pattern or clue presents itself?

Also, Ken mentioned in his original email to Bruce that the note contains characters from a keyboard. What is Ken’s background – that he would pick up on this fact, and be sure to distinctly point it out immediately?

Hoax or not, I have a suspicion that it is solveable.

Israel Torres February 21, 2006 7:30 PM


Since we know the fold in the center is from Ken’s admitted doing without further mention of prior folds, along with the fact that the scanned image does not maintain any indication that it was folded (due to lack of texture markings) may be enough to prove that this paper was not used in this way. Since we see the white out marks on the paper as well as the rectangle we would also easily see folds. However that doesn’t stop an overlapping piece of paper with allotted slots from being placed on top as is also seen attempted on occasion when trying to hide a key from a message. Regardless folding would be just one more thing to try if anyone has a chance to do it and report their findings.

Ken also mentioned that the reasons the areas were “whited out??? were because friends were trying to decipher it. This at least correlates that Ken has enough understanding to take it to friends and get it further looked at, or vice-versa (thus having prior discussion of this on one level or another). One may surmise that his approach isn’t that of a salted veteran since he didn’t mention a lot of things that most of us would in trying to explain what the audience was seeing at the time of the initial post, or even a follow-up post.

He also mentioned the rectangle marking enveloping WjuPD aXoRwis could have been a first glance attempt in putting together a possibility that these letters could some how be representing David Rayburn or Linda Rayburn because they contain the same number of characters respectively. However using these letters in direct substitution does not give coherent positive results

Lastly, it can only be considered solvable if there indeed is something in there to solve. That also is yet to be determined.

Israel Torres

Israel Torres February 22, 2006 2:13 AM

I added a few more features (letter frequency display and chart):

Tested String (ignores floating r,m,H):
(– MD5 of tested string: D6D57CE1A367525B65A6AD3901EBA3FA)

Letter Frequency:
A 5 N 1 Spaces 0
B 3 O 3 Other 0
C 3 P 2
D 3 Q 3
E 2 R 3
F 4 S 2
G 1 T 1
H 2 U 3
I 3 V 1
J 1 W 3
K 2 X 3
L 1 Y 3
M 2 Z 4

Attempt using inital rectangle seen on the original page:

WjuPD aXoRwis

WjuPD aXoRwis

Here is an attempt using the letter “ETAOIN SHRDL…” frequency:

I’ve been moving back and forth with polyalphabetic substitution using upper case as one alphabet and lower case as the other. Initially it didn’t look promising (this example using the names involved):
e a l c drb La

          h     e B y

R ri iy n n uMar

I’ve also tried Xor, caesar, rot13, rot47, reverse, and combinations here and there. (Most of the functions available on FTard Decoder Ring). It is day 24 and it still seems like day 1. Only time will tell if it is a standalone secret message in English.

Israel Torres

Chloroform February 22, 2006 3:45 AM

Guys, if Ken doesn’t appear again, at least Bruce should be here to answer some questions. But where are they?

MrReality February 22, 2006 11:49 AM

Sitting @ home laughing at all of you fools!
Ken / Jenn are one in the same, a little sick troll.

dogface February 22, 2006 1:34 PM

Okay, the fact that every letter of the alphabet is used in addition to a number of symbols leads me to believe the message has a letter to word ratio. Somewhere there is a either a list of words or a book or other material from which this is based. My guess is the author wrote out each letter and symbol near the corresponding words.

That’s why the need to put spaces for the words. One would write, thinking the sentence and putting spaces instead. Then, you would go back and find the corresponding letters for each word. This would also explain the multiple letters for some spaces in that perhaps an alternate word could be used there. Putting the sentences together based on a list of existing words would take work and some creativity.

There must be a favorite poem or book or love letter or something from which this is based.

Svelte February 22, 2006 4:20 PM

And, guess what guys?

If it is a one time pad (possibly a stolen one from a military base long time past) would any of you be able to confidently state that it could be broken?

I’m still working on my insane methodology, however.

Cheer for Now!

Svelte February 22, 2006 4:23 PM


Which of you have a copy of the book titled “The Codebreakers” by David Kahn?

If any of you have this book I would appreciate hearing back from you.



Svelte February 22, 2006 4:31 PM

The Point Is:

All codes can not be broken.

Nevertheless, I am willing to work with others having a degree of intelligence and persistence, in an attempt to solve this particular challenge.

With Best Regards,


Roger February 22, 2006 4:48 PM


If it is a one time pad (possibly a stolen one from a military base long time past)

Military one time pads are either all digits, or all capital letters. Or rather were, they are rare today.

Which of you have a copy of the book titled “The Codebreakers” by David Kahn?

I have a copy of the 1974 edition if you want something looked up. But it’s back in print; why not buy a copy? Amazon and Books-a-Million both have it on special for under fifty bucks.

Svelte February 22, 2006 6:07 PM

Roger that Roger!

Look up page 99 of the original work and provide to me the last paragraph.



Svelte February 22, 2006 6:24 PM

Dear All,

I see a great degree of egotism taking place here with fellow posters.

I do not wish to instigate more fervor between one another. Rather, I would prefer to find a few good participants to work with me.

If we find one or more of you to be much more intelligent than the rest of us so be it and I’m happy with that so long as each and every participant attempts to help and work with us towards finding a solution to the problem presented on this site.

I could care less about how smart you think you are…only in what you can provide as a team member to help us solve the challenge presented to us here on this web site.

All the rest, as far as I am concerned, is nothing more than a load of self-satisfying egotism and I have no interest in that.

Please, Please, Please …if any of you are serious about attempting to solve this problem do submit what you might have that will actually contribute towards a solution.

All other “negative” contributions will simply be ignored by me, and hopefully, other serious participants.

Thank you and…

Most Sincerely,


Svelte February 22, 2006 8:24 PM

Dear Roger,

Roger that but I do not agree that one time pads were strictly only letters or numbers from my experience.

Perhaps, during much earlier times they might have been but, as with most any and everything, methods are improved upon.

I really doubt, very much, that one time pads were exclusively only letters or numbers.

Your blog messages is posted below for reference:


If it is a one time pad (possibly a stolen one from a military base long time past)

Military one time pads are either all digits, or all capital letters. Or rather were, they are rare today.

Which of you have a copy of the book titled “The Codebreakers” by David Kahn?

I have a copy of the 1974 edition if you want something looked up. But it’s back in print; why not buy a copy? Amazon and Books-a-Million both have it on special for under fifty bucks.

Posted by: Roger at February 22, 2006 04:48 PM

Ganzfeld February 23, 2006 7:45 AM

I’m doing a statistical analysis of the data, and I already have firm evidence that the letters are NOT random as has been suggested by many. There are several quite significant statistical variations from chance. Not what you’d expect from a purely random series of letters.

I guess someone had to be sad enough to spend the day doing this. I’ll post my completed findings a bit later.

peri February 23, 2006 7:48 AM

“this is a hand-copy of the original ”

I am unclear where you believe you saw someone say this is a hand copy? The person who sent this to bruce says “This is a copy of the original.” Am I missing something?

“My guess is that it is 8×8 grid. and key for each letter is made by combining the key.”

Given all the information available that sounds like the most likely place to start. The tricky part is figuring out what alphabets are used for the pair of keywords. At a minimum the domain of the keywords has to have 16 elements since he used exactly that many unique symbols. I also have arguments for 52 (‘impedence’ matching), 64 (base-64), 80 (keyboard bounding box) element alphabets.

@Svelte and Israel Torres
You should really consider jp’s last post since he makes a strong argument that monoalphabetic substitution is unlikely in this case. You should also consider the lengths the author went to in order to be able to distinguish upper and lower case. If the author did not believe he could ignore case then you are unlikely to find the solution by doing so.

Passerby February 23, 2006 8:46 AM

I (modestly) suggest discretion.

Assuming that the item contains meaningful, encoded information, and that the code it is soluble, it would seem irresponsible to publish the solution without knowing the document’s true (as opposed to represented) origin, purpose and significance.

If I were an expert intent on pursuing a solution (and I am neither), I would work privately — alone or with trusted associates — and would communicate any successes directly to Bruce, as he originally requested, not to the world at large. (Yes, that implies trusting Bruce, which I think entails minimal risk. :))

Ganzfeld February 23, 2006 8:48 AM

OK. Here’s where a bit of statistical analysis shows something really interesting. The letters are FAR from being random.

Let me explain why.

We can assign every letter of the alphabet a number……from 1 to 26. We’d expect half the letters in a 64 letter random sample to have values below or equal to 13, and half to have values above it. Which is precisely what we get overall……BUT, starting with the letters in MMG we have 10 letters in a row that are in the lower range !

You try tossing a coin and have it come up heads 10 times in a row within 64 tosses. The odds against chance are about 1 in 150. Not what you’d expect by chance ( unless you regularly bet on 150/1 odds horses ).

But it gets even more interesting. We can further divide the alphabet into 4 groups. They can’t be exactly equal, but let us make group 1 be a -f ( 6 letters ), group 2 be g – m ( 7 letters ), group 3 be n – s ( 6 letters ), and group 4 be t – v ( 7 letters ).

And here is the actual distribution within those groups…..with the first value being the actual number and the number in brackets being what you would expect by chance in a 64 letter random sample :

1 = 20 (14.77)
2 = 12 (17.23)
3 = 14 (14.77)
4 = 18 (17.23)

As you can see, groups 3 and 4 approximate the average……but groups 1 and 2 are decidedly skewed ! Group 1 has almost 50% more letters in it than you’d expect by random chance, and group 2 has almost 50% less.

That clearly shows that this is not just a random collection of 64 letters. There is a definite skew towards letters at the start of the alphabet.

Israel Torres February 23, 2006 10:49 AM

Is there a reason you are ignoring the casing and/or symbols? If this is indeed a note and not just a list of passwords, mnemonic devices, or gibberish there would be serious consideration into accounting for the usage of upper case and lower case letters when thinking about distribution. Not only can it help with defeating frequency analysis by using non-vital characters for padding to make the distribution more even, it also can easily confuse those that are trying to use 1:1 relationships.

Accountability for this message being posted on the Internet follows “the chain of responsibility.??? There is no such thing – it is on the Internet! A simply amazing conclusion especially in the way you mention to implicitly trust the same entity that put it out there (which may not have been the intention of the original submitter (Ken)).

If you have read this thread in its entirety you would see that I also do not think this is a monoalphabetic substitution cipher – or really anything other more than a password list Most that are still interested are keeping to themselves, or have simply retired this notion by maintaining that it is a password list. I am simply attempting to disprove Svelte’s persistent theories, as well as any other theories that this is a secret message. No one else (until now) is posting publicly so there is less to disprove.

Lastly I am not sure why readers are maintaining that this is a message, especially in a grid-like form. There is no accounting for padding because the grid is not padded and thus very difficult to contain in such a fashion. See example below:




Israel Torres

Passerby February 23, 2006 11:34 AM

@ Israel Torres

The “message” — its genesis unknown — is on the Internet, the solution (if there is one) is not. Your logic invites the mildly amazing conclusion that if I find your encrypted list of most-secret passwords or accounts and post it on the Internet (perhaps representing it to be something else), you will happily engage in deciphering it for me, and publicly at that.

Whether Bruce’s publication of the item was a betrayal of the sender’s trust we do not know (at least I do not). But the publication is a fait accompli. You appear to imply that if Bruce did betray a trust, or is not to be trusted with a discovered solution, it follows that the entire world is to be trusted. Now there is a truly amazing conclusion. 🙂

Israel Torres February 23, 2006 12:02 PM

No one knows whether or not the solution is on the Internet. It very well could be. Concluding otherwise would be quite illogical.

Besides you certainly wouldn’t find my encrypted list of most-secret passwords because such a thing could not exist. Believing otherwise also is illogical.

In regards to trust and this particular scenario you have set up, full disclosure keeps everyone honest. I also find it amazing in how you are assuming a solution, if found and has not already been found (on or off the Internet) would be posted on the Internet. Discussing the process to solve something is not the same as providing the solution itself.

It can all be summed in as: Think what you may, but there are plenty that think otherwise.

Israel Torres

Anonymous February 23, 2006 12:50 PM

@ Israel Torres

You will help me with Jane Doe’s or W. Gates’s encrypted accounts, then, regardless of how I may have come by them?

Of course I cannot prove the negative proposition that Jane’s or W.’s lists have not been posted, decrypted, elsewhere on the Internet. You should therefore have no reservations about publishing them, given the mere possibility (without evidence) of redundance. Eminently logical.

Full disclosure (by …?) keeps everyone (?!) honest. Not logical at all, but a dangerous postulate!

I am happy to have amazed you yet again. Recall that my original suggestion for discretion did not assume that you (or anyone) would publish a solution; I simply proposed caution in that respect.

Even I can discern that discussing the process by which a solution might be arrived at is not the same as providing the solution itself. A successful process would, on the other hand, provide a modicum of assistance.

That many others might disagree with me is not a fair summary of the issue.

d&#383 February 23, 2006 2:49 PM

Let’s just assume this is a CRYPTOGRAM. And, work from this assumption.

Or, you won’t get anywhere.

And , no conspiracy theory please.

For those who are actually working to decrypt(Svelte, IT, peri), I think the decryption routine should be easy enough to be done in the head.

Keep it simple, and keep up the good work 😉

peri February 23, 2006 4:14 PM

“There is no accounting for padding…”
@Israel Torres

I suspect the lack of <pre> tags has led you to overlook the perfect square the horizontal lines can make with their 64 (or 8 squared) letters. Look again with the added spacing at the perfect (ie no padding) grid:

       d         %         K         4         q         @         h         *

y  |   W         j         u         P         D         a         X         o
&  |   R         w         i         s         M         m         g         H

 |   k         c         F         B         f         e         X         n

7  |   L         o         y         u         I         w         A         z
V  |   Q         Y         b         U         k         t         P         s
$  |   q         A         c         Z         f         i         Y         z
3  |   D         C         R         V         h         X         a         z
?  |   E         f         b         d         q         a         r         O

Just the letter count of 64 is intriguing alone when you consider all the non-square numbers the count might have been:

49 = 7×7
64 = 8×8
81 = 9×9

So for messages with a letter count between 49 and 81 there are 3 squares and 30 non-squares and thus a square count happens only about 10% of the time — which is certainly intruiging. It is much more intriguing to find two 8 letter words from a different alphabet written using a different orientation.

Svelte February 23, 2006 4:32 PM

Dear Ganzfeld,

I agree with what you said copied and pasted below. I see a pattern both with the entire contents as well as each segmented version (Upper Case, Lower Case, on line and below line).

I’m doing a statistical analysis of the data, and I already have firm evidence that the letters are NOT random as has been suggested by many. There are several quite significant statistical variations from chance. Not what you’d expect from a purely random series of letters.

I guess someone had to be sad enough to spend the day doing this. I’ll post my completed findings a bit later.

Posted by: Ganzfeld at February 23, 2006 07:45

Keep Up the Good Work, Ganzfeld and the rest of you, too. This is not something to be taken so seriously that one would want to copyright it.

It’s just a fun puzzle challenge and nothing more (even considering the story associated with it).



Svelte February 23, 2006 5:17 PM

Dear Roger,

You wrote back to me:


If it is a one time pad (possibly a stolen one from a military base long time past)

Military one time pads are either all digits, or all capital letters. Or rather were, they are rare today.I have a copy of the 1974 edition if you want something looked up. But it’s back in print; why not buy a copy? Amazon and Books-a-Million both have it on special for under fifty bucks.<

I replied back to you, Roger:

Roger that Roger!

Look up page 99 of the original work and provide to me the last paragraph.



Posted by: Svelte at February 22, 2006 06:07 PM

Dear Roger,

I’ll give you twenty four hours to reply.

Roger that, Roger!


Posted by: Svelte at February 22, 2006 06:10 PM

Never heard back from you, Roger.

Therefore, I reply to you, once again, that one time pads were very sophisticated for their time…and did, indeed, utilize both alphabetic and numeric code incorporation.

I know this from having served in the USAFSS. I’ve seen one time pads while serving in that branch.

You did not respond to my request that you look up the reference on page 99 of the “Codebreakers” and therein lies the beginning methodology of how to break down codes in a fundamental manner.

Now, I do realize that this is an old work and I have the original hardback copy of that book but it is still, never-the-less, a fundamental means to examine a cryptic message, at least initially.

This is what I have been doing. Others, as I have requested, will carry on my small contribution and eventually we will, I am sure, in a joint effort, as our host has requested, find a solution.

With Best Regards,


peri February 23, 2006 5:52 PM

“my request that you look up the reference on page 99 of the “Codebreakers””

A google book search for “Codebreakers 99” (http://books.google.com/books?ie=UTF-8&q=Codebreakers+99&btnG=Search) turned up a link to that text which has the two following references:

  1. A. Hodges, ‘Alan Turing: The Enigma’ (London: Hutchinson, 1983)
  2. G. Welchman, ‘The Hut Six Story’ (London: Allen Lane, 1982; Penguing, 1984)

However if you are interested in a “fundamental means to examine a cryptic message” then I would suggest the text ‘Basic Cryptanalysis: Dept of the Army Field Manual No. 34-40-2’ which is freely available online (http://www.umich.edu/~umich/fm-34-40-2/).

Svelte February 23, 2006 6:28 PM

Thanks, DF!

Your wrote:

“Let’s just assume this is a CRYPTOGRAM. And, work from this assumption.

Or, you won’t get anywhere.

And , no conspiracy theory please.

For those who are actually working to decrypt (Svelte, IT, peri), I think the decryption routine should be easy enough to be done in the head.

Keep it simple, and keep up the good work 😉

Posted by: dſ at February 23, 2006 02:49 PM”

I especially appreciate your statement:

“I think the decryption routine should be easy enough to be done in the head.”

That is a very fundamental and powerful statement!


Israel Torres February 23, 2006 6:48 PM


Ah formatting is worth a thousand words! Thank you for shedding light on this.

We can then also take in consideration the following using this 8 character variable set:









… of which I have quickly ran both the 8 character chunks as well as the 80 concatenated character string through a few filters(e.g. base64), text rotations, xor routines (using the symbol sets against the inner alphabetic characters). (note: had to encode some of the ampersands with “&+amp” to format correctly on this blog.

Israel Torres

Roger February 23, 2006 7:30 PM


Look up page 99 of the original work and provide to me the last paragraph.

As I already noted, I have the 1974 edition, which has different pagination to the 1967 edition, sorry.

I’ll give you twenty four hours to reply.

Will you indeed. I don’t necessarily check this blog everyday, and I don’t check every thread every day. And I certainly don’t take orders when offering to do someone a favour.

Therefore, I reply to you, once again, that one time pads were very sophisticated for their time…

One time pads are not sophisticated at all. The complete theory behind them could have be completely understood at least as early as the seventeenth century and probably by the Ancient Greeks. In comparison to modern ciphers the idea is very simple, which is probably why they fascinate beginners.

and did, indeed, utilize both alphabetic and numeric code incorporation. I know this from having served in the USAFSS. I’ve seen one time pads while serving in that branch.

I’ve also encountered them in the service, but never seen one that had letters and digits on the same pad. However, I’ll take your word for it that they might exist for some special purpose. Nevertheless, the point is they definitely did not include mixed case letters nor punctuation marks, both of which would have greatly increased the error rate for manual ciphering, and also slowed down and caused errors and other serious problems in both vox and morse sending. (Quick, what’s the morse for ‘&’, and what’s strange about it? Too easy for you? Then what’s the morse for ‘#’? How about lower-case letters, either in morse or the phonetic alphabet?) The slight increase in information density from having a slightly larger alphabet would be more than offset by these serious disadvantages.

Others, as I have requested, will carry on my small contribution and eventually we will, I am sure, in a joint effort, as our host has requested, find a solution.

I already finished and published my analysis. Ganzfeld, I think, is very close to arriving at the same conclusion.

Svelte February 23, 2006 7:49 PM

Dear Roger,

Thank You for your reply!

That’s just fine as I did interject and respond just a few minutes prior to the 24 hours that I requested of you!

No problem, Sir! And, since we both seem to agree that Ganzfeld (not you or even me) may have found a means to break this particular code (I see no actual evidence of this at this time of my post, however) then all for the good of our objective!

Let us see the completed and deciphered solution before we come to such conclusion, ok?

Your Friend,


Israel Torres February 23, 2006 7:56 PM

I’ve played with a lot of encryption programs out there past and present. Does anyone recall a program that could supposedly be used to create this block of data? – Something where as two keys would be entered involving symbolic characters and it would generate the 64 character block? I’ve tried overlapping xor characters and xor strings a few different ways without any coherent results. For example xor d and y and then xor the result with W, etc. Since we are now assuming this is a message we can include that either this was very simple to be done non-programmatically, or a program was used to generate this. It is very possible that David found a cheap piece of shareware out there that is keeping this message scrambled.

Israel Torres

Svelte February 23, 2006 8:07 PM

Dear Roger,

One time pads, as I remember, incorporated both alphabetic and numeric lists on a pad consisting of a duplicate copy.

The user of such one time pads had no choice but to copy them as shown on the pad.

Because they were, indeed, “one time” pads they would only be used once and they were one of the best means of transmitting information over the air at the time that they were used (and probably similar versions are still being used today).

I really doubt that your claim of Greeks or other earlier nationals being able to decipher them would be a very good argument, in all honesty.

We are discussing the former 20th century and not pre-Christianity times, in all due respect, Sir.

Our military personnel copied sucy one-time pads as shown on such pads and then did with them what they were instructed to do.

This would, inevitably be, destruction by way of our pulp machines or other destructive devices as used at any one of our particular locations.

The one-time pad was one of the very best methods of transmitting vital information between our security forces during the 1960’s through the 1970’s and, most probably, are very usable even today!

With all due respect, I am,

Most Sincerely,


Svelte February 23, 2006 8:26 PM

Ok, I guess that I will have to go back to work on this one since I see not immediate results upcoming from you guys.

Expect continued input from me by the beginning of next week.

With Best Regard to all,


jp February 23, 2006 8:49 PM

@Svelte, wrote “Thanks, DF!”
it’s not DF, but still me, upside down.
dſ is my bipolar evil twin. 😉

JP February 23, 2006 10:16 PM

Perl Script to do the math for you.
compiled == badd. Script == good.

How to Use:?
Copy and Paste into a file: solve.pl
and run “perl solve.pl”
Tweak it as you like.
Some of the method are already coded, but not used. Comment and Uncomment to switch between methods.

##@input = qw(WjuPDaxoRwismmgHkcFBfexnLoyuIwAzqybUktPsqAcZfiyzDCRVhxazEfbdqarO);

@input = qw(W j u P D a x o R w i s m m g H k c F B f e x n L o y u I w A z q y b U k t P s q A c Z f i y z D C R V h x a z E f b d q a r O);

print “input is \n@input \n\n”;

print “input to number \n”;
foreach $thischar (@input){
$val = ord(lc $thischar) – ord(“a”) + 1;
$code[$counter] = $val;
##print “thischar is $thischar and int value is $val , and counter is $counter \n”;
print “$val “;
print “\n\nnumber back to alpha\n”;
##@code contains numbers

foreach $thisval (@code){
##print “this val is $thisval \n”;
$thischar = chr($thisval + ord(“a”) -1);
print “$thischar “;




##########key gen########################
#@key2 = qw(25 7 3 7 22 4 3 0);
#@key1 = qw(4 5 11 4 17 2 8 8);
@key2 = qw(36 7 3 17 64 4 13 70);
@key1 = qw(53 5 48 14 31 2 56 8);

#foreach $i (@key1){

$index2 =0;

foreach $j (@key2){

$mykey[$index1*8 + $index2] = ($i) * ($j);





#@mykey = (@key1, @key2, @key1 , @key2 , @key1 , @key2 , @key1 , @key2);

@filter = qw(1 0 0 1 1 0 1 0 1 0 0 0 1 0 0 1 0 0 1 1 0 0 1 0 1 0 0 0 1 0 1 0 1 1 0 1 0 0 1 0 0 1 0 1 0 0 1 0 1 1 1 1 0 1 0 0 1 0 0 0 0 0 0 1);
$counter = 0;
$counter1 = 0;
$counter2 = 0;
foreach $thisval (@filter){
if ($thisval ==1){
$mykey[$counter] = $key1[$counter1%8];
$mykey[$counter] = $key2[$counter2%8];

print “\n\n my key is \n”;
foreach $thiskey (@mykey){
print “$thiskey “;

#for ($i=0; $i<26; $i++){
#$counter =0;
#foreach $thisresult (@mykey){

# if ($thisresult != 0 ){

$modval = ($thisresult-1+ $i)%26;

##print “befoer mod is $thisresult, aftermod is $modval “;

$thischar = chr($modval+ ord(“a”) );

print “$thischar “;


#print “\n\n”;

print “\n\napplyitn the keys\n”;

################APPLYING KEY##################
@filter = qw(1 0 0 1 1 0 1 0 1 0 0 0 1 0 0 1 0 0 1 1 0 0 1 0 1 0 0 0 1 0 1 0 1 1 0 1 0 0 1 0 0 1 0 1 0 0 1 0 1 1 1 1 0 1 0 0 1 0 0 0 0 0 0 1);

$counter = 0;
foreach $thisval (@code){
if ($filter[$counter] == 1){
$result[$counter] = $thisval – $mykey[$counter];
$result[$counter] = $thisval – $mykey[$counter];
print “thiscode val $thisval apply $mykey[$counter] = $result[$counter]\n”;
##print “index is \n”;

print “\n”;

#@filter = qw(1 0 0 1 1 0 1 0 1 0 0 0 1 0 0 1 0 0 1 1 0 0 1 0 1 0 0 0 1 0 1 0 1 1 0 1 0 0 1 0 0 1 0 1 0 0 1 0 1 1 1 1 0 1 0 0 1 0 0 0 0 0 0 1);
#$counter =0;
#foreach $thisresult (@result){

$result[$counter] = $thisresult * ($filter[$counter] -1)* -1;

#$result[$counter] = $thisresult * $filter[$counter];




##the last answer is wraped 26 times

for ($i=0; $i<26; $i++){
$counter =0;
foreach $thisresult (@result){
# if ($thisresult != 0 ){
$modval = ($thisresult-1+ $i)%26;
##print “befoer mod is $thisresult, aftermod is $modval “;
$thischar = chr($modval+ ord(“a”) );
print “$thischar “;
print “\n\n”;

Anonymous February 24, 2006 9:11 AM

I agreed with Israel Torres’s comment that ignoring case is misleading but liked your methodology. The following version of your analysis with case should show that given such a small sample the letters are very evenly distributed when compared with English. While the groups ‘WXYZ’ and ‘abc’ are somewhat skewed it is not by very much given the small sample size of 64. Furthermore, there are no equivalents ciphertext of clumps of letters — all ciphertext letters appear exactly 1, 2 or 3 times. However, most of the long runs in English come from the most frequent english letters ETNORIAS — the english clumps are as large as 11 for a. Also notice that the ciphertext is evenly distributed among lowercase and uppercase while there are only two uppercase english letters. All this taken together suggests the distribution is very close to random — which means the ciphertext hides letters frequencies well.



Ciphertext Groups of 3 and 4:

abc, def, ghi, jklm, nop, qrs, tuv, wxyz


English Groups of 3 and 4:

abc, def, ghi, jklm, nop, qrs, tuv, wxyz


peri February 24, 2006 9:57 AM

I forgot to add my name to that last statistics post… sorry. Any errors are mine.

@Israel Torres

I had not considered mixing in the upper and lower case stuff with the symbol stuff. It seems unlikely to me to be productive but it might work.

What I (and jp) had in mind was using the two keys as selectors for entries in the grid. If you look back at my formatted grid you should see that you may select entries with the pair (d,$) which would give you q because the d is over the q and the $ is beside it. Furthermore, you might select a pair using an entry from the grid. For example if we pick the entry U (there is only one) then it is selected by the pair (4,V) — 4 is over it and V is beside it. Picking entry R (there are two) would give us two locations in the grid specified by the pairs (d,&) and (K,3). The example jp gave in his post is “combining “d” and “y” somehow(?).” (which is the pair (d,y)) which select the first W because the d is above it and the y is beside it.

I should mention that one might need to rewrite my example with d%K4q@h* on the side and y&#7V$3? on the top to find a solution.

I looked at your code but did not understand what you think it does. I did notice it ignores case which is probably a bug?

jp February 24, 2006 11:41 AM


nothing is a bug. but, it’s a feature. like M$ says.
“lc”(lowercase) ignores case, but “@filter” brings back the “case”ness.

peri February 24, 2006 4:14 PM

@Israel Torres

As you said — “formatting is worth a thousand words!” Great job.

“nothing is a bug”

I took your word for it and looked at your code again. Here is the terse version as I understand it:

input = { WjuPDaxoRwismmgHkcFBfexnLoyuIwAzqybUktPsqAcZfiyzDCRVhxazEfbdqarO }
filter = { 1001101010001001001100101000101011010010010100101111010010000001 }
code[i] = lowercase(input[i]) – ‘a’ + 1
key2 = { 36 7 3 17 64 4 13 70 }
key1 = { 53 5 48 14 31 2 56 8 }
mykey[i] = filter[i] ? key1[j++%8] : key2[k++%8]
result[i] = code[i] – mykey[i]

I understand you are folding values into @mykey from @key1 or @key2 depending on the case of input. How did you choose the values for @key1 and @key2? How would you assign a number for non-alphabetic letters like ‘%’ and ‘&’?

Svelte February 24, 2006 6:29 PM

Bug/s or not…

I expect you guys to have a solution before I go on my vacation starting Monday, February 27, 2006.

If not, expect “da bat” to be back with added fervor!

Consider this, gentlemen…

If you were working in a United States Government Security environment, would any you (including me) have the convenience of so much time to break such a simple code?

Time is imperative and we have not been utilizing our time in a very efficient manner, now have we?

Get on it with guys!

Your friendly bat (about to take R & R),


jp February 24, 2006 7:19 PM


key2 = { 36 7 3 17 64 4 13 70 }
key1 = { 53 5 48 14 31 2 56 8 }

There are many ways to make the keys.
But, there are only few ways to explain “?” since it’s not in a normal alpha, num, shift-alpha range.
So, I am putting them in 10 by 8 grid, from the keyboard arrangement.
!@#$%^&*() = 1 -10
1234567890 = 11 – 20
QWERTYUIOP = 21 – 30 and so on.

Key = 80 key space
Crypt = 52 key space

plain text = 26 key space

Infinite possibility

Anonymous February 24, 2006 7:28 PM


“If you were working in a United States Government Security environment”, you dont get to take a vacation till you solve.

peri February 25, 2006 10:57 AM

“10 by 8 grid, from the keyboard arrangement”

That is the 80 element “keyboard bounding box” I was referring to in an earlier post. I started concentrating on the 16 element assumption because I was initially rather skeptical that the keyspace could be so large because so many characters in the pair of keywords comes from the top row:

. @ # $ % . & * . .
. . 3 4 . . 7 . . .
. . . . . . . . . .
q . . . . y . . . .
. . . . . . . . K .
. . d . . h . . . .
. . . V . . . . . ?
. . . . . . . . . .

However after considering it I think it fits nicely with Roger’s hypothesis that the keyword pairs (at least) were likely generated by someone banging on a keyboard.

Interestingly a quick preview at the statistics of the grid elements only using the order QWERTY instead of ABCDEF shows serious skewing so I am going to look into that more.

Israel Torres February 25, 2006 12:59 PM

“…the keyword pairs (at least) were likely generated by someone banging on a keyboard.”

I am not sure how everyone else bangs on a keyboard, but I find it difficult to accept this scenario because there are shifted characters in which would require the banging action to include deliberate and alternating simultaneous shift key presses – it is mechanically unsuitable for ‘random’ “banging”.

Israel Torres

peri February 25, 2006 1:13 PM

(best viewed in a fixed font. Try vi, emacs, notepad or similar)

Before presenting the following data it might be useful to point out that there are no repeated digraphs in the horizontal letters and thus the following data applies to both monographic and digraphic distributions.

The following text is a series of statistical analyses done for subgroups using an alphabet comprised of uppercase followed by lowercase. It shows the distribution is skewed by a preference for lowercase letters. Furthermore, it shows a moderate preference for the subgroup ‘abcdef’ and a severe prejudice against ‘hijklm’.


64*(52/52) = 64

AABCDDEFHILMOPPQRRUVWXXXYYZaaabbccdefffghiijkkmnooqqrsstuuwwyzzz (64)
A-Z, a-z

64*(26/52) = 32

aaabbccdefffghiijkkmnooqqrsstuuwwyzzz (37)
A-M, N-Z, a-m, n-z

64*(13/52) = 16

aaabbccdefffghiijkkm (20)
nooqqrsstuuwwyzzz (17)
A-F, N-S, a-f, n-s,

64*(6/52) = 7.38

aaabbccdefff (12)
nooqqrss (8)

G-M, T-Z, g-m, t-z

64*(7/52) = 8.62

HILM (4)
ghiijkkm (8)
tuuwwyzzz (9)

The following text is a series of statistical analyses done for subgroups using an alphabet comprised of letters as they are found on a QWERTY keyboard ordered first top to bottom, then left to right, then upper to lower. It shows the distribution is skewed by a slight preference for the upper row. Furthermore, it shows a moderate preference for lowercase on the middle row and a moderate prejudice against uppercase on the middle row.


64*(52/52) = 64


64*(20/52) = 24.62

QWERRYYUIOPPqqwwertyuuiioo (26)


64*(18/52) = 22.15

AADDFHLaaassdfffghjkk (21)


64*(14/52) = 17.23

ZXXXCVBMzzzccbbnm (17)

64*(10/52) = 12.31

qqwwertyuuiioo (14)


64*(9/52) = 11.07

aaassdfffghjkk (14)


64*(7/52) = 8.62

zzzccbbnm (9)

Humans are notoriously bad at picking uniformly distributed sequences and so it is very unlikely that a human chose the horizontal letters.

From this conclusion follows that all the horizontal characters were not picked out as suggested by the second half of Roger’s analysis.

Furthermore, this conclusion certainly counts against any password list theory because human generated passwords should be less uniformly distributed. Password list supporters are therefore urged to take some (10?) of their most recently used passwords, strip any non-alpha characters and apply the QWERTY analysis and compare the resulting distribution.

Israel Torres February 25, 2006 1:37 PM

“…this conclusion certainly counts against any password list theory… ”

I still have to disagree with this being a discounted possibility (I still haven’t pulled away from the password theory); granted for now we are flowing the with secret message thing because it is really the only thing we can actually work with. The reason I disagree is from personal experience in creating lists that look just like this for the purposes of passphrases. (In fact if I found this laying somewhere in my notes before seeing it online I would have figured it was one of my lists that I forgot to shred) As likely as there is always an exception to any rule, I know I am an exception so there must also be more exceptions.

We must consider this because we really don’t know the background of whom (be it David or the originator of this character generation) it is we are trying to fit into a mold. If they “understand” the techniques used in cryptanalysis they surely would put their best effort into confuse and defeat the average observations. I know do. 😉

I am concerned that we are cutting corners too quickly by trying to fit this into a mold suited for average users and communications solely based on statistics. If we start discounting too many things too quickly we are going to sustain Day 1 syndrome where whatever progress we have made still takes us no further than Day 1. I understand we are doing this independently and hope everyone is trying whatever they think is best in terms of branching – I just don’t want everyone to follow a specific theory until we have seriously locked into something that looks very promising. In essence we are still in a searching phase.

Israel Torres

jp February 25, 2006 4:21 PM


Thanks for the excellent statistical analysis.

So, Keys and Cypertext are both top heavy, which strengthens the assumption that QWERTY keyboard arrangement might be used to encode/decode since it would be easier to apply “$” (move 4 keys to the right), than to apply “r” (move 4 keys to the right and down 4 keys).

However, i would like to bring out the point that the normal English would be also top heavy since 4 of 5 vowel are in the top row.

Another theory

Could those 3 floating letters be decoded text? Maybe, he wanted to make sure he coded correctly, and made sure by decoding some. maybe, he wanted to give us some clue? But, I can’t explain why he used both capitalization.

Does anyone know what a suicide note would look like?
Does it start with “sorry”?
Does it start with “David Rayburn was”?
Since I could not find a template on my MS Words (j/k), What are the usuals?

peri February 25, 2006 5:02 PM

“alternating simultaneous shift key presses”
@Israel Torres

Do you mean (%,K) and (&,#)? I suppose that does count against the banging theory. However I think only enough to make it less of a wildly banging and more of a slow determined banging. I think the vertical pair still seems somewhat like the non-uniform distribution I would expect from a manmade sequence.

“I still have to disagree with this being a discounted possibility…”
@Israel Torres

The statistics were mostly motivated by my desire to better understand how the horizontal and vertical parts fit together. The password list thing was just a sidebar for those who might find it useful or interesting. It is my opinion the password list theory is moot because it seems to me untestable.

“4 of 5 vowel are in the top row”

Great point. Now that I think about it 2 of 8 of the most frequent list of english letters (generally given as ETNORIAS) are on the top row.

As for those floating letters — I have been hoping I can ignore them without consequence. Perhaps when I find a system that seems likely to encode/decode and try to solve without success I might start worrying about them.

As for the suicide note question. I have been suspecting this paper in his briefcase could have been there for years before he died. I have a cryptogram laying around from about 3 years ago when I made it. I keep thinking that if I died today you might be (wrongly) misled into thinking it had something to do with my death.

Ganzfeld February 25, 2006 5:21 PM

“Furthermore, it shows a moderate preference for the subgroup ‘abcdef’ and a severe prejudice against ‘hijklm’.”

Erm……isn’t that just exactly what I said in my analysis in my post 2 days earlier ?

peri February 25, 2006 5:53 PM

“isn’t that just exactly what I said in my analysis in my post 2 days earlier ?”

First I should point out that I wrote ‘hijklm’ when I should have written ‘HIJKLM’.

Your analysis ignored information about case. So your results reflected the groups ‘ABCDEFabcdef’ and ‘HIJKLMhijklm’.

My analysis shows skewed distributions in ‘abcdef’ and (as my summary should have read) ‘HIJKLM’. However, my analysis also shows that the groups ‘ABCDEF’ and ‘hijklm’ are NOT skewed.

So the answer is my results agree with your results but are not identical.

jp February 25, 2006 8:06 PM


Correction- “2 of 8” of the most frequent list of english letters (generally given as ETNORIAS) –> “5 of 8” of the most frequent list

@ken – We know Ken is no longer keeping up, but, I am asking him anyways.

In which war, did he serve? and how long? Did he pick up any new foreign language? We need Ken’s help on what David was like. Was he a hard-core Star Trek fan? This could be in that “startrek language”. Was he taking medicine to treat Bipolar? (even though I dont think it was serious since it says about 1% of population has this disorder. http://www.nimh.nih.gov/publicat/bipolar.cfm) it could be a list of mecidine he is taking.

Since I am stuck, I am just throwing lots of random ideas.
And I am stilling looking for the sample suicide notes, preferably from those who works at those field.

Chloroform February 26, 2006 2:40 PM

@jp: those 3 floating letters are possibilities for the letters just above them. I think the quote “this is a copy of the ariginal” means that the image is a scan of a manual copy of the original. The copyer tried to mime the overall layout, and the origial letters, and I can imagine that the original letters were hardly readable here and there. That’s why he wrote ampersand below the ampersand. furthermore the heavily written I could be started as a T.

Another thing: a simple printed letter (character) table, such as the classic ASCII code table could served as a tool for the encoding.

Chloroform February 26, 2006 3:14 PM

I won’t paste long codebraking trial examples, but some simple statistics.

The message uses capital letters, small letters, some numbers and some non-alphanumerical characters. The number of characters used in the document is 52.

There are 26 Capital letter in the english alphabet:


The document excludes the following ones:

The document excludes the following small letters:

Interesting, but they are both five.
Also interesting, that the document uses exactly TEN non-alphabetic characters:


Israel Torres February 26, 2006 8:09 PM

“The rectangle drawn over the top two lines was not done by the murderer. It was done by a family member afterwards.”
Posted on January 30, 2006 at 10:15 AM

“This is a copy of the original. I whited out the areas where friends were trying to decipher it. I didn’t want to make it more confusing. The folds in the paper are also mine.”
Posted by: Ken at February 1, 2006 08:17 AM

It is unclear as to who exactly wrote the note in the first place – we aren’t even sure this is David’s writing. We won’t know other than what we have been explained above as to further modifications (such as the declaration under the ampersand symbol). From Ken’s quote above it appears that any modifications that occurred happened on the copy and were removed – all except the rectangle.

It appears you are telling us that this note was completely transposed from the original. – This is also a possibility depending on what “original” means. Ken did not state if this was a photocopy or a manual transposition of the original-original note. If this was a manual transposition it could explain the lines – which could have been done purposely by the “transposer” (whomever that may have been) and not by David. In this case now we cannot even be sure it was transposed correctly.

— Another mystery to add to the pile.

Israel Torres

Israel Torres February 27, 2006 4:11 AM

“The document excludes the following ones: GJNST”, “… jlpvx”

Here is another coincidence regarding these letters:
GJNST -> rotated 8 right / 18 left
-> ORVAB which is an anagram for “BRAVO”

jlpvx -> rotated 11 right / 15 left
->yaekm which is an anagram for “am key”

another thing to consider is the ASCII values in ascending/descending order:
(left– ASCII VALUES 33 – 126 –right)

Israel Torres

Svelte February 27, 2006 2:26 PM

Dear All,

I Must admit to failure on my attempts to figure this one out, guys. Once I got a neck ache I decided to stop (at least for now)!

I did learn a few things, however. It is interesting to note that I can not help but wonder if the creator of this very short puzzle was, in fact, attempting to break another original puzzle.

The several letters underneath other letters seem to indicate this to me. Ironically, the letter “H” under the letter “R” on the ninth horizontal line and located at the second position there seems odd because it is one of the most used consonants in the alphabet.

This leads me to suspect that the creator of this puzzle page may have been adding those few letters as an attempt to replace the one above them.

Additionally, with very little doubt, I suspect that the letter “A” (and “a”) represents the letter “E” (“e”).

I wonder if the creator of that puzzle page just might have attempted to convey that:

k = v
A = m
R = H

…and, I might add, on the last line of characters, the fifth letter over could very well be an “a” instead of a “q” and the small letter below such “a” could be a “v” rather than the extension of a “q”.

I see a slight break under the line for that character.

With so few characters in the main text, either 67 or 68 (depending upon whether the “q” is a “q” and not an “a” with a “v” below it) and even considering the additional characters on both sides (an additional 16) for a total of 83 (or 84/85) characters, I see no real chance of my solving this highly jinxed puzzle!

Added to the fact that the author created such difficult factors as upper case, lower case, letters on lines, letters below the lines and even lines at all not to mention the other really weird factors on both sides of the puzzle…I resign!

I will check back every now and again to see how you guys might be doing out of curiosity, however!

Good Luck!


Svelte February 27, 2006 3:04 PM

Dear All,

One other small contribution that I would like to offer that may or may not be helpful, in my humble opinion, is as follows:

There is a possibility that the reason for all of those upper and lower cases as well as the online placements and the under the line placements could be indications of either dropping or adding by one character.

Example: If the letter “A” actually represents an encrypted letter then the “lower case” of that letter might mean to drop down (or up) one character so as to designate either a “B” or a “Z”.

Using the letter “A” again, I will attempt to demonstrate what I mean:

There are two upper case “A” letters, two lower case “a” letters and one lower case “a” letter on the line for a total of five “A” letters.

Perhaps, just perhaps, the two lower case letters may represent the next letter down from “A” and actually be representative of “B” and, again, perhaps, once again, the lower case “a” letter on the line may represent the next lower case on (“b”).

Then once all such shifts are made the analysis would proceed by shifting those lower cases on the line to lower case above the line and subsequently shift the lower case to a regular capital (standard) letter above the line.

Therefore, again, as example:

Capital above line lower above line lower on line

A (2) a (2) a (1) (3 from “Z/z”) would equal:

B (5) b (1), etc.

Again, it is the upper, lower case shifts and the on the line placements (not to mention the many other erradic placements) that really screw decipherment up on this jinxed puzzle.

With Best Regards,


peri February 27, 2006 4:21 PM


That was an astute insight. However I believe you are incorrect as the second horizontal letter is a ‘j’. I count 21 uppercase letters used and 22 lowercase letters used.

lucid March 1, 2006 3:24 AM

Hello to everyone. I just read about this from the Crypto-gram newsletter and it interested me. After reading all (yes, all) messages in this blog, it leads me to two conclusions (of which I could be hopelessly wrong), but to share my view nonetheless.

(a) It could be a “message ID” of an email, I think the ‘@’ and Israel’s formatting somehow made me look at that as a possibility. It could be referring to an email received from an anonymous source and he was trying to track it down and copied it out for his records. The “&” is also significant because sometimes “s” is also written in a way that closely resembles the “&” and he made a specific note of it to remind himself.

(b) The other possibility that hit me is of course what most people here have also noticed of the number of characters. This could also represent “post-data”. E.g. When you log into Hotmail for instance using your username and password, then if you notice the ‘location bar’ will present a long string of characters in alpha-numeric, #$% etc. and also different cases.

Just thoughts that ran through my mind.

Svelte March 1, 2006 7:14 PM

Dear Lucid,

Makes sense to me since it partially confirms what I’ve been contemplating and suggesting (that this guy, or whomever created the little note), was attempting to break another puzzle.

Thank You for your input!

da bat

Susse March 5, 2006 2:17 PM

Let’s say I have a theory that converts all letters, numbers and symbols into numeric form.

Is there an online numeric cryptogram solver that I can cut/paste my numeric data and just click a button for a solution?

gary March 5, 2006 2:43 PM

i dont think its crypt per say, but it looks like a tormented soul who learned of adultery somehow having to do with a friend at local police, maybe was involved in betraying one of the man or womans trust of the couple. and im not into satanic symbols but i thin he is referencing that either he or his wife had committed adultery and that the partner they chose had some kind of satanic hold over them , that even though they wantedto break free from it they couldnt. then it looks like he is professing his love for this woman he was about to kill and did not want to but an outside force was consuming him and this is what it wanted. was there sex involved after the murder? almost as if he craved her love and did not want to but had to and new that somehow for the sake of more and more innocent people becoming involved in this discovered cycle of somekind of satanic influence, he thought he had to end the cycle and hoped that those he loved could forgive him. i am no psychic , but this jumped out of me , and i am fairly intuitive sometimes and downright dumb others, but i really think this was the major gist of what was intended by a very troubled soul for some reason are another. as to how i came to this conclusion i am really not sure but i think the 2 side lines refers to completing the cycle and the % is just a way of saying he hoped he was doing the right thing for those he loved as for the rest i think it was pretty much just using the first letter and combinations of using 2 letters 4 certain symbols, and putting some words together diffeent ways,i did not look at any other clues or read the other comments but i do feel that my analysis is somewhere close

gary March 5, 2006 2:53 PM

oh yes i also got the feeling that somehow or another he new of another couple murdered because of what he perceived as an evil force

gary March 5, 2006 3:13 PM

it also looks like the short line toward the center of the main part of the text is where he was trying to express that before the outside force consumed him he was crazy in love with all of his family and hoped someone would understand and forgive him i dont want to write any names because they are not clear but not saying any names but i really dont want to say the feeling that i get about the top line because i am no way psychic psychic just this jumped at me,( but without naming names it looked like he thought someone he trusted and i dont feel they were very close to the family was responsible for whatever was consuming him. was he you know a very good man?before ?

gary March 5, 2006 3:17 PM

well i have looked at this and all i can , as for my hypothesis that he was somehow trying to end the cycle , i am not really getting that he is trying to blame anyone , but that he thinks what he is doing will end this force. and i also get the feeling he was correct. please forgive me if i am wrong , i am no expert , just a simple soul , and this caught my aattention, hope this may be of help to those troubled

Susse March 5, 2006 4:59 PM

Gee Gary, you are a little scary, there.

I ask this again, lest my post get lost among those bizarre posts of evil theory.

I have a theory, after converting all the letters, numbers and symbols into a basic numeric form.

Is there an online numeric cryptogram solver that I can just cut/paste my numeric code in to, and then just click a button for a solution?

even if you do’t agree with my technique, what’s the url of such a site?

Israel Torres March 6, 2006 1:44 AM


Are you looking for a particular type of cipher to be solved? For example is your numeric code a form of substitution (22 = 1), rotation (1=1+13), encoding conversion (98 = a), or something completely different? Which numeric ranges are you dealing with?

Israel Torres

jp March 6, 2006 4:46 PM

wow, Bruce is around. Hi, Bruce. If you can contact Ken, can you ask him some questions about David? “In which war, did he serve? and how long? Did he pick up any new foreign language? Was he a hard-core Star Trek fan? This could be in that “startrek language”. Was he taking medicine to treat Bipolar?”

@gary, thanks for the horror movie plot. I am not particularly a fan of horror movie, but Hollywood might buy ur idea. satanic posession with real world cryptogram. historically, cryptograms have always been linked with demons.

@susse, most of simple substitution can be done with IT’s program, or tweak the perl script above to fit ur taste.

basically, no one is posting anymore since we ran out of how these letters might be encrypted, or how the keys are arranged. If you have any idea(like it is using Keyboard arrangement, or ASCII hex code, foreign language keyboard arrangement), please share. If you need a custom script, or program, some of us can help, I think.

Is anyone trying plain-text attack?

Andrew March 7, 2006 12:20 PM

I’ve writen some of my own perl code to decrypt this and I am still getting gibberish using the verticle lines as keys, either as two keys of length 8 or one of length 16. I have also tried doing various permutations of addition and subtraction for 2^64 permutations, although I am having some difficulty getting the code to work properly for this. My question right now is are there any other numbered character sets that might be in standard use other than ASCII or base64? Base64 does not include symbols so I ruled that out and ASCII decimal representation has given nothing so far. I could try ‘A..Z’,’a..z’,’1..10′,’!@#$&*?’ as base69 but that doesn’t seem to make much sense to me. Any helpful ideas? I’ll post the perl code when I get back home, for anyone that might want it.

jp March 7, 2006 7:42 PM

summary so far:

CypherText space= 26 * 2 (capitalization matters)
arrangement = by each line(left to right, right to left) or 8×8 grid. and 3 odd chars
distribution = too random.

Key Space = 26 (if counting % = E = 5), or 80 (if keyboard arrangment !@#$%^&*()123… or 1234567890!@#$… or !1QqAaZz@2..) or 10 (if counting 1=q=a=z=! 2=w=s=x=@)
arrangement = 8×8 grid, or 16, or 8 + 8 interleaved, (right side first or left side first)
distribution = number and symbol heavy.

Algorithm = +, -, * then mod, ROT13, keyboard arrangment move(wrap around by line, or column, or whole), different algo for upper and lower case, different algo for vowel and consonant, different algo for first 13 letters, and last 13 letters. or combinations of these: upper vowels – use key from the left, lower vowel – use the key from the right, and so on.

PlainText space = 26
arrangment = by each line
distribution = English letters (most likely no numbers or symbols)

Svelte March 8, 2006 6:22 PM


Are we degenerating here now?

I see two modes of attempts and methods to decipher the message that I have already admitted to not be able to break:

  1. True Codebreaking and decipherment
  2. Computer Hackers.

In my opinion, please correct me if I am wrong, the two are not the same.

Most Sincerely,

Da Bat

Fox Mulder March 9, 2006 3:16 PM

Someone mentioned in the Mindhunter forum that he observed the following:

As far as the alphabet goes..In capitol letters

There are NO G’s

Maybe that has any bearing?

Svelte March 9, 2006 7:37 PM

Dear Fox Mulder,

Anything could have a bearing (meaning/clue).

Your contribution is welcomed.

Yet, You must realize, as most of the rest of us do, that observation offers no assistance with the lower case letters, the letters on the lines as well as those below the lines and on the vertical sides.

Thanks for your contribution.

da Bat,


Dave H. Crusoe March 15, 2006 3:50 PM

What if this IS a plaintext? What if it’s a letter mixed into random nonsensical jumble? For instance, if I look at it phoenetically, I see a couple words: “I”, “Was”, perhaps “Love”.

In addition, there seem to be repeating, non-standard letters repeating near the end: q’s and z’s, which could be mental acts of desperation, not crypto-randomness.

Maybe we’re looking for far into the letter, when really it’s much simpler? -d!

Dave H. Crusoe March 15, 2006 4:26 PM

Hey all,

Again, I wonder if the guy didn’t take the time to encrypt his message. After all, wouldn’t he want people to read his confession? Seems so, to me.

And, the actual content seems to be a plaintext message with some junk scrambled within. After removing some letters, this seems to appear:

“PD is kmmg here. Lovu. I was [either @ or hurt]… [the ending, seems to end by asking a question]…


… Thoughts?

Israel Torres March 16, 2006 2:35 AM

@Dave H. Crusoe
“After all, wouldn’t he want people to read his confession? ”

What confession? His suicide note was found in the kitchen. His belongings were found on his person. It is difficult to believe David was hiding anything at the time of his suicide with the information we have received or that has been made public.

Out of all the possibilities this sheet of characters “could be” in the end there is only one it was used for which remains to be determined indefinitely.

In terms of how things work: People make shadows, shadows don’t make people.

Israel Torres

jp March 16, 2006 4:29 PM


“What if it’s a letter mixed into random nonsensical jumble? ” – I assumming there is no noise in the message. there aren’t that many letters on the paper. To get any message delivered, to maximize the information content, random nonsensical jumble is undesired.

“After all, wouldn’t he want people to read his confession? ” – yes, I totally agree, but not about the confession part. I am not sure this is a confession. whatever it is, he wanted someone to decrypt….or not.

“near the end: q’s and z’s, ” are aligned if you put into 4 letters groups. It could be an indication what some grid type encryption is used.

Steven April 5, 2006 12:55 PM

Given that each of the letters relates to a key on a computer keboard, perhaps it is nothing more complicated than font substitution

renee April 15, 2006 9:05 AM


Rob Daniels April 17, 2006 11:25 AM

Does anyone else find it odd that the police did not seize this item as evidence? Instead they gave it to the family who drew a rectangle around the first two columns. They have destroyed the evidentiary value if they altered the document in any way. I am not buying any of this. Even though the suspect is dead it would have been seized. Even on a simple and obvious suicide we seize notes and other pertinent documents. This whole thing reeks of bovine defecation.

Fox Mulder April 26, 2006 5:21 AM

@Rob: as I understand it, it was treated as evidence but returned to those involved because the police did not consider it ‘evidence’.

Logically speaking: for them it was a open & shut case since the murder was solved and the perp killed himself. So in short: they had no reason whatsoever to investigate the note (it contained gibberish to them anyway).

Fox Mulder May 1, 2006 4:47 AM

Some peeps are now posting in several forums (and here) calling it a hoax and saying they are close to the family involved.

My question is: have they contacted Bruce Scheier and revealed themselfes, or are they hoaxers?

Has it been established if this is a hoax or not?

Bruce Schneier May 1, 2006 8:07 AM

I have been in contact with the person who initially sent me the e-mail. I have not been in contact with the family.

Based on the interactions, though, I believe that this is real. It could be a hoax, but I do not think it is.

What are the URLs of the sites claiming that this is a hoax?

Fox Mulder May 1, 2006 8:53 AM

@Bruce Schneier:

Bruce, this has all turned into a wild goose chase with people all over the place claiming to be close to the people involved etc. etc.

I just have 1 request: contact the Saugus Police Department Chief James MacKay and ask him if there where 2 notes or not?

In my humble opinion you should do this since your post started all this! Also: if YOU are the source telling people here what the answer was YOU got it at least will come from a source we can trust!! If anyone else here claims that he/she called it will be once again open for debate (imho).

This would definately put and end to this thing.

So please call them and let us know!


Renee May 2, 2006 6:35 AM


Think May 2, 2006 2:53 PM


Why are you affraid of anyone looking at this cryptogram? If it happened in my family I would seek as much insight and understanding to the events as I could find. If someone helped me with that I wouldnt be name calling and hostile.

Alessandro May 10, 2006 5:14 PM

I agree with Think. If something like this happened to my family, I would be pursuing every avenue to discover what happened to them. I would hardly call the people investing time and thought into trying to discover the truth ‘ratarded’.

friend May 14, 2006 2:19 PM

I know that there are lots of people out there who have doubts about the whole cryptogram message, assuming it is a message. I am someone that is related to a woman who was married to David prior to his marriage to Linda. There were two notes found, 1 was a suicide note and the other was the cryptogram. Whether the cryptogram has anything to do with the murder is something that will probably never be known. The police would have no reason to include this in their report because they felt it has no importance to the crime. i just wanted to say that the evidence is true and if anyone wants to believe it or not is their own perogative.

Fox Mulder May 18, 2006 12:59 AM

Once again I can only say @Bruce Schneier:

Contact the Saugus Police Department Chief James MacKay and ask him if there where 2 notes or not?

In my humble opinion you should do this since your post started all this! If anyone else here claims that he/she called the police it will be (once again) open for debate.

It would definately put and end to this thing.

So I urge you: please call them and let us know.

Since you’re a public figure yourself I think it comes with some responsability as well.


Ganzfeld May 29, 2006 9:48 AM

As far as I am concerned, it is all a hoax until the following questions are answered. I have gathered a list of a whole bunch of anomalies that need explaining before one even considers what the note is about :

1) The alleged ‘cryptogram’ that is shown is a copy. Where is the original ? Ken says ” I recently saw the cryptogram in my drawer and decided to pursue it a little bit “. Was that version in the drawer the original ? And the note being stuffed away and forgotten in a drawer does not really tie up with Jenn saying that ” It’s been a tough 2 years trying to figure out what the cryptogram means ” !
2) Why was a handwritten copy sent ? Just how hard is it to make a photocopy ?
3) Did the police ever see the note ? If not, why not. And if they did….what did they say about it ?
4) Why does Jenn say ” It’s been a tough 2 years trying to figure out what the cryptogram means ” ? What other attempts have been made in those 2 years ? And have they involved the FBI ?
5) If the parties who know about the note believe it MAY have some relevance to the murder…..as is clearly implied in Ken’s posts….why are they posting it to a security web site rather than expressing those concerns to the FBI ?
6) Ken says that the killer ” left behind a number of disturbing items “…..and then in the very next post of his he says the police regarded it as ” an open and shut case “. However, if Ken does not believe it was an ‘open and shut case’….he has never stated any reasons why.
7) I am puzzled by Jenn’s post in which she says she is determined ” to find out what this cryptogram means “. WHY….if it was an ‘open and shut case’ ?
8) Clearly, a number of people exist who ( apparently ) believe that there is MORE to the murder than meets the eye. And these are people who claim to be friends, relatives, etc, of the murderer.
So one has to ask the most pertinent question of all : If the police regarded it as an ‘open and shut case ‘ WHY have these people spent ‘ a tough 2 years ‘ agonising over some note ??

Ganzfeld May 29, 2006 10:35 AM


“The police would have no reason to include this in their report because they felt it has no importance to the crime”

Sorry….but this line of reasoning is exactly what I address in my previous post. The whole BASIS of Ken sending the note ( if you read his posts ) is that he DOES believe it has relevance to the crime. He quite specifically is asking whether the note contains ‘valuable information’ pertinent to the crime.

It is equally as clear from Jenn’s posts that she has similar sentiments. I mean…..nobody would spend ‘ a tough 2 years’ agonizing over a list of dry cleaning tags….would they ?

You see…..I just find it extremely bizarre that the very same people who go out of their way to assert that the police found the whole thing ‘ an open and shut case ‘ are the same people who you’d expect to know MOST about the case….and they DO think there is more to it. WHY? On the basis of what could be no more than a list of laundry tags ! You have to ask whether the note is good enough reason in itself to suspect something……or whether something is ALREADY suspected and the note is the sought after confirmation. A world of difference…eh ?

I have loads of little scraps of paper next to my PC…..which to any outsider would contain seemingly truly weird stuff. Anyone who did not know that I was playing the PC game ‘Oblivion’ would be shocked ( if I suddenly died of a heart attack) to find notes saying things like ‘ Go to Anvil and kill xxxxx ‘…….and ‘ xxxxx can turn you into a vampire ‘. No doubt some blog somewhere would be receiving emails arguing that I was secretly into some demonic cult.

Of course…..those closest to me would know about my gaming activities and no such rumours would ever get started. One would have to ALREADY be highly suspicuous that there was more to things to turn bizarre scrawlings into anything more than that.

Jenn June 1, 2006 11:56 AM

@ Ganzfeld

I have been watching this site form months now, reading what people have written.

I would like to clear a few things up. When Ken posted the message, i didn’t know about it. Had i known, i would have told him NOT to do it. It is my family’s business, not the whole worlds. Not to mention that there is too much personal information floating around the world now (family names, etc.). I have come to realize that after two years i will probably never know what the note means. However, I do appreciate the time and effort people have been spending on this.

As for your comments in regard to “It’s been a tough 2 years trying to figure out what the cryptogram means” i think if you walked in your house one day and saw your family murdered, you would do everything in your power to figure out the reasoning for it. Who knows if the cryptogram is even related to what happened but you would sure as hell try anything to find out what happened. Based on the other findings in the house (which i will not get into) i was not sure if this was related or not. I have tried to contact a number of people online seeking help but no one was comfortable with getting involved in this. I would like to find out what this note means as it might clarify WHY he did what he did to my brother and mother.

Jenn June 1, 2006 12:00 PM

@ Ganzfeld

In response to your posting
“Of course…..those closest to me would know about my gaming activities and no such rumours would ever get started. One would have to ALREADY be highly suspicuous that there was more to things to turn bizarre scrawlings into anything more than that.”

This may be the case w/ your family but obviously i was not close to him. Had i been, i would have known that he was a sick person and would have kept him away from my family.

Ganzfeld June 9, 2006 8:20 AM


I think it highly unlikely that anyone would construct an elaborate code just to hold a single message of 64 characters or so. What is more, anyone leaving a deliberate code would also leave some indication that it WAS actually a code. It would be sort of defeating the whole object of the excercise if the note got thrown away as just a list of laundry tags. Simple logic dictates that it is not a cryptogram

And despite the claims of some….I simply do not accept that it is a list of passwords. Nobody creates a 3 character password.

It is MUCH more likely that the note contains a list of files or directories. In Unix, directory names are case sensitive.

The one clue that we DO have….which I pointed out but which seems to have been missed by many…..is the letters L,M, and H between the lines. I take it what appears to be ‘L’ is actually that letter, as it has the same style as the other ‘L’ in the note.

To my mind…..L, M, and H is obviously Low, Medium, and High. MANY Unix commands ( such as ‘st’…a command for llisting tape devices ) actually have L, M, and H as their parameters….and this also applies to commands for Unix security. Indeed, certain security software such as Nessus and Sussen ( which is made by MMG Software…..note the ‘MMG’ in the note ) have an extra ‘0’ for zero level….so the levels are 0, L,M,H ( and there is an extra ‘C’ for critical ).

Well……there you have ( beneath each of the last 4 lines in the note ) 0,L,M, and H. You have a reference to MMG, which is security software that uses precisely those notations. And you have 8 lines of what are very likely case sensitive directory names.

RENEE June 24, 2006 1:09 PM



RENEE June 24, 2006 1:16 PM



Jenn June 27, 2006 3:44 PM

Hi Renee,

I appreciate what you are saying about my family. It is so true. This is Jenn though. I will send you a separate email.

Anonymous June 27, 2006 3:46 PM

@ Ganzfeld

Thank you for your input. Unfortunately, i am not computer savvy but will definitly look into this. I do agree that it is not a list of passwords. As you state nobody creates a three letter password.

informed July 4, 2006 12:53 PM

“michael could hardly stand him”… uh, could that be because dave was the only one who let him know that it was not enjoyable to live with a junky continuously stealing the rent money…his wedding band, and so many other things? only a complete idiot would believe that dave did this horrible act by some sort of SANE CHOICE. anyone who actually KNEW dave knows that he was in way over his head with this crew… when this was combined with mental illness (which was clearly in some sort of remission for years – and which his wife did, in fact, know about) with the life of living with a lieing, manipulative, heroin addict, an entire family in denial, ignorance, lack of compassion and support from the people who were most in contact with him… it was a recipe for DISASTER. none of this, of course is an excuse…. there are no excuses, only reasons. dave is not sizzling in hell, because God doesn’t create mental illness and then let you suffer in hell. we all beg of you to stop the discussions about this. everyone connected to the family – on both sides – is suffering with intense grief. and sadly, some are so consumed with ignorance and anger, that they will never really find peace in their own lives…. don’t give them a forum to post their poison. let them believe what they want, because they don’t really want to learn the truth. just let this go, stop the questions, answers and all the speculation. let them rest in peace, as i, and every person who who TRULY knew dave, know they ALL are now.

sandmime July 6, 2006 7:45 PM

Looks like a musical notation code. Take the letters and depending where they are on the musical scale (over, under, intersected by lines) apply that to the keyboard.

and then delete the whole thing.

No, it just looks musical is all. Bad music, but music.

I feel bad for this family: both the survivors and the dead. Must have been hell. Must still be hell.

Sometimes it is better to NOT leave a note, okay?

Hector Torvisque July 12, 2006 10:56 AM

Bruce, if the code is ever cracked, will you update the main page or article – at the moment I check the comments here every once in a while.

alan hutchinson September 21, 2006 2:53 AM

I have made several crypto algorithms
ranging from vigeneres type to
more difficult. In fact I have made
cryptos which can not be cracked
by an “attacker”
Realize this is an outragious statement.
heres a sample of a crackable crypto

io uac okz bo qdg i dgbo q i pq cf p

Logan September 27, 2006 11:33 AM

a brief nod to everyone Hi. I’ve been following this thread for about six months now, my own copy of the code tacked on my wall. Cryptography is something of a hobby of mine, and I thought perhaps there might be something there… But as time has passed, I have come to the tentative conclusion that it is probably not a true cryptogram. It is true that the message is not easily read, and might therefore seem to be encoded… But someone mentioned something that I think is worthwhile to look into. Obviously, this man was not right in the head at the time when all of this occurred. Can we truly expect this to be a rational message? And if it is the ramblings of a crazy person, how can any sane person understand it? Now I am more in my field. As a state-certified schizophrenic (and working on my psychology degree), I know something about being in a deranged state of mind. So, I took a look at the cryptogram at five in the morning on two days of zero sleep, and asked myself what it would say if I had written it. It made an eerie kind of sense – the sidebars were either a personal identification symbol-stream, or the web address(s) of some site. The rest of the message reads roughly like this:


How can the fool be free
It’s not like you and I
was crazy.
But you know the best question
No one asked of why the deed
made me grab the hang-
if anybody cared.

There’s really no logic to how the cryptogram morphs into that, but try it yourselves. To a crazy person, it makes sense.

However, it is logical to assert at this point that if the message is NOT a traditional cryptogram, then any person’s interpretation could be as possible as anyone else’s. Religious interpretation, psychological interpretation, hacker or social scientist interpretation… Everything is as plausible as anything else. I just happen to suppost this theory. Because people who kill other people and themselves are generally not thinking logically. And it’s easier to communicate with a non-logical part of yourself through writing. Just putting it out there.

an old friend October 2, 2006 8:37 PM

first of all i was just thinking of my friend Mike and googled his name and found this site…..to whoever called him a “junkie” I have some choice words for you but I will refrain…..I would like to just share some kind words about a great kid…..he had a smile that lit up the room…..he always could make you laugh.(i’ll always remember freshman year…science with Loftus) he was the kind of friend I could go years with out seeing and bump into him and it seemed like it was highschool all over again and nothing had changed……god bless you Mike, you are sadly missed…you were taken from us unfairly and to soon………always in our hearts and prayers……XOXOXO

oh, and to the “name caller” if he hated living with a “junkie” so much why not leave? Was divorce not an option? His only option was to take 2 people out of this world by no choice of their own? Is he GOD…Mike may have had problems, but he was a good soul…..and those who knew him understand why that “COWARD” took him in his sleep…..because my friend Mike would have taken him out first!

renee October 5, 2006 8:32 AM

u know somethin? im sick of everyone on here who can sit there calling mike names… to the one who said mike stole the wedding ring and was a “junkie”… u can call mike watever u want but i can guarentee u didnt KNOW him cause if u did, u wouldnt of said the things u did about him… u prolly knew OF him but definately didnt KNOW him…mike is NOTHING like you try to make him sound.. and id appreciate it if everyone just stopped talking about all of this… im sick of it!! just please stop now.. stop

noelle October 6, 2006 10:23 AM

The Berry family will always have a place in my heart -we were all confused kids with out direction- we made some mistakes & yes I was there for all of them -call Mike a junkie, call me one too. I know we fucked up, we all made some big mistakes. Michael tried, he tried to get clean. I know in my heart of hearts -the effort he put in & what can else can you do besides try? That kid ran from his demons & we all had demons – was he a product of his environment? we all grew up in a tough place. I don’t know what went wrong, but I do know Linda never gave up on him or her girls – she had an open door and an open heart for all her kids friends too – I remember life before David- on everette st – life was simple then,Jenn, you were so little & I do remember how much you love your brother, no matter where we were, some how you always popped up. I’m so sorry this happened. Mike’s one of my dearest friends & 2 1/2 years later I can hardly deal with any of this – you & your sister are always in my thoughts & prayers. Jenn, I won’t put any of your family’s business out there – but do know this- we all made mistakes in the past, there’s no explanation why any of this happened – people are going to come up with all kinds of bullshit reasons trying to make sense of it all they are going to use things in the past to offer up feeble explanations & the reality is that there is no reasoning to what happened. Jenn please try to hold onto how much they love you. Noone’s families were perfect- but your mom never let go of you kids, she tried her best. & well, Mike, yeah he had some problems, but that kid had a heart of gold- I have a lot of love for your family & I have nothing but fond memories & I know a part of me died the day Mike did, there’s an emptiness within- you are alot stronger than I could ever be. I hope people will stop throwing salt on your open wounds because some wounds never heal

Diego October 16, 2006 11:24 AM

I think that this letter may have a second part to it because at the bottom there is an encircled A which may be part A of a sequence of letters. the characters on the side go from a letter to a number (example: K! which would be K1) it is as if it is a game of battleship and the letters in the middle are the ships, you have to find the meanings befroe they make any sense. Also if there was anything else at the scene, a paper perhaps; the letters may be the ones that need to be crossed out to make the letter mean anything (Example: say you have a sentance, and the letters on the letter are K,T,R,E, you would cross out those letters in the sentence). The letters in the handwritten piece may be the beginnings of an actual word.
This is all I have to say, hope it may help.

kristen B January 2, 2007 2:10 PM

This is Jenn’s sister, Kristen. It was my mother and brother who were killed also. I only found out about this site this past Halloween and haven’t been able to check it out til now since my comp is broken and I don’t know much about them to fix it. I am the one personally who found the cryptogram. It was written on the back of an envelope to hold a computer CD. If you notice how all the lines are written you can tell it’s the perfect size. It looks as though he went all the way down and when he ran out of room he wrote down the sides. I am the one who also made lots of copies for family and close friends hoping they could help out with it, but to no avail. I’m telling you this because it pissed me off to no end reading all the ignorant comments written on here. The line drawn around the top 2 lines WAS ALREADY THERE WHEN I FOUND IT. They also have the exact amont of lines to spell out my mother’s 1st and last name. the next few lines have enough letters to spell out my name, michael’s name, Jen’s name(since a lot of people do spell it with 1 n), and as well as my son and Michael’s child’s name. After that I have no clue. And maybe he circled the top 2 lines because my mother was the most important person to him. This was not the suicide note. I found it after the investigation, if you could call it that. I know they said it was an open and shut case since they had the murderer but it stilled seemed as though they would want to check things out a little more seeing as though it was a double murder-suicide. The cops found out about everything I found through a third party and even though they didn’t consider it related to the case they still confiscated it all since it was illegal, including his home computer. There was never any laptop found. At this point I think it was either password codes or just a symptom of his bipolar in which it will never be decoded, but that doesn’t mean I don’t want to keep trying. To have something like this happen so suddenly and with no reason why makes you want to find out every possible thing you can that might give you a shred of insite and closure, and until any of you go through something like this you need to keep your ignorant comments to yourself cause you have no idea what it is like to lose oyur family, and even more, in such a brutal way. This site had me literally shaking to the core and I only hope that one day my brother’s daughter doesn’t have to read this bullshit about her father that she didn’t get a long enough chance to know. And I’m not talking to those of you who are strangers, I’m talking to those of you who knew them and are writing these comments. I pretty sure I know who you are “informed” and I think it’s pretty pathetic that you have to lash out at my brother. By now you should be used to the comments about Dave and have grown a thick skin to them. Nobody deserves what happened to them and I think it’s pretty pathetic to put the blame on the victim, which in all reality, is exactly what he was. As for you Renee, where the HELL do you get get off putting your 2 cents in about my brother and sister. Maybe youshould get your facts straight before you open that ugly ass mouth of yours. My brother couldn’t stand you!!!!! You were a crazy ass stalker bitch!! Your comments were just as hurtful as the others. Don’t disrespect my family by being ignorant and a trash mouth. So, thank you everyone who genuinely tried to help out and as for the rest of you -“Karma is a BITCH!!!!”

Aunt Shannon January 19, 2007 1:52 PM

To all who are SINCER in trying to Help
I thank you for your time and paitence in trying to decifer the “code” that was found. To the Rest of you IGNORANT PIECES OF SHIT who think all of this is a Hoax – Go to Hell and find some other site to cry on and leave the nasty comments to yourself. I just found out about this blog New Years weekend from Kristen and do applaud those who are TRUELY trying to help Jenn and Kris make some sort of sence to this evil demonds notes.
I love you girls and do wish we can start a new relationship. Jenn what you have heard about us in Texas is NOT true, PLEASE GIVE US A CHANCE.

Nana Jackie January 22, 2007 9:26 PM

Bloging can be painful to many innocents. Please, folks, put this to rest; for goodness sake, this family is still in mourning & some of us will be for months or years to come. When a Mother, Father, Brother, Sister, Daughter, Son, Daughter-in-law or Grandchild dies; so dies a piece of the survivors’ heart. In cases of such brutal faultless deaths such as WE have experienced, recovery is much slower, if ever. Additionally, the mysteries surrounding this senseless tradegy add to the healing process. Those of you who do not know, the “coded” note is not the only unknown. If any of you REALLY want to help, concentrate on decoding the note, which was found exactly as published on this site……and pray for Linda’s and Michael’s family as well as for David’s family; after all, David performed the deed, not his parents or siblings. My daily prayer is to receive notice that someone, somewhere, will be given the insight to translate the message on that envelope so we can have total closure.
K&J, remember I love you both, very much, and am here for you. Nana

Star June 9, 2007 1:25 PM

Im sorry for what happened. I am young almost 15yr old eventually I wish to become a detective of some sort and solve the Zodiac killer from the 1960’s and I will try to solve this cypher as well!!!

lab December 25, 2007 8:35 AM

this message was created from 3 different existing encryption methods. to solve the script use the algorithm of the strongest method and build it ON the other two. when a child plays with the Lego, the child uses his/her own imagination, which in fact aren’t imaginary pictures but mixture of his/her actual being of state. that mixture consist everything that happened with him/her in this life. the details, which weren’t searched/analyzed by the authorities could recoup or fill the holes of the investigation result. in many occasions the reason couldn’t be connected to the perpetrator’s daily life but it could be connected to a story from his/her past. start from the very beginning of the investigation. parallel, find that 3 methods and when you found it put the message on a 4 dimensional net and start decrypting as a Rubik’s cube moves.

John Willemse February 28, 2008 9:37 AM


What are you talking about? Do you have any grounds for your arguments? A 4 dimensional net? Rubik’s Cube?

@everyone else:

I’ve been playing around with this for a little while now and it looks like a homophonic substitution to me. More frequently used letters are substituted by more than one ciphertext letter. I’ll update as necessary if I find something.


Mister E Nigma March 28, 2008 2:37 AM

If you circle the last letter in the first line to the second to the last letter in the next line(the lines that are surrounded by the rectangle,) and the last letter in the third line you will see the word spelled out is “DIE”
I also using this method found the words “Joey” and “Mcoy.”
Do you know anyone by the name Joey Mcoy?

CompletelySane May 15, 2008 4:54 PM

ok, I agree that being able to find out what the cryptogram really means would be an interesting thing to do. But this doesn’t relate to very many of you, so why do you care? The only people who should be so passionate about it are the family and such. Everyone else is just wasting their time. I can’t believe I wasted mine reading through half of those comments.

random googling June 28, 2008 9:48 PM

MMG could stand for: marketingmetrixgroup. The company, was busted a few years back for sending out adware under the file name: Super young hotty gets fu**** (according to:http://www.vitalsecurity.org/2005/06/180-solutions-go-to-pieces.html). They are also linked to the Spazbox IRC Network, that hosted “secret” IRC communications including child porn. Maybe they are old secret IRC channels or ways to get to the “underground” as the article I read put it… Just a thought…

Rivers D'Arcie September 24, 2008 7:44 PM

I’m very good with these. I’ve bookmarked the site, and will blow this up and analyze it in photoshop.

Kristen, Sorry for your loss, I mean absolutely NO disrespect being intrigued by this.

Broken_Memories(aka Jaime Kemp) March 13, 2009 10:25 AM

I don’t know if this has any consolation (especially seeing as how this thread is roughly 4 to 5 months old now,

and most of the work occurred three years ago).

I noticed a pattern (that might only work on my laptop keyboard, I’m not sure).

First there are some boundaries i should list. You can only travel from one key to one that is touching it

(horizontal or has at least half or so of the key above or below it). I guess that’s just one. Oh well.

Now take the strings on the sides. The first string d%K4q@h*. Now using the method mentioned above, find

how many keys are between d and %…i found the shortest route was 3 keys. Then the route between % and

K…i got 5. From K to 4 i got 6. From 4 to q i got 3. From q to @ i got 1. From @ to h i got 6. From h to * i got 3.

So adding up all of these 3 + 5 + 6 + 3 + 1 + 6 + 3 = 27

Now on to the second string. Using the same method. y&#7V$3?. From y and & i got 1. From & and # i got 4.

from # to 7 i got 4. From 7 to V i got 4. from V to $ i got 3. From $ to 3 i got 1. From 3 to ? i got 10. adding these

up. 1 + 4 + 4 + 4 + 3 + 1 + 10 = 27

Now count all Upper case letters of the main body.
There(listed from left to right, and down) is W, P, D, X, R, M, H, F, B, X, L, I, A, Q, Y, U, P, A, Z, Y, D, C, R, V,

X, E, O. Which is also, ding ding, you got it…27. Coincidence, most likely…but its so boring that way. I want to

think its a clue.

As for other things, i don’t know any of the computer programing stuff, so i can’t go there. I took a term of c ++

but that’s it.

Thinking about it mathematically and along with the fact that the code could be slightly tweaked from a normal

plug and chug thing. I think its plausible that there could be a few of the characters on the map portraying to

one real character. Mathematically it makes sense, because multiple x values can equal y, but only one y can

stand for a single x value. Its the same here. Multiple characters on the map can equal one real character

output. But its implausible to think that multiple outputs could come from a single map character. I hope that

makes sense, i know it does to me…but my terminology may throw some people off since for the most part I’m

making it up.

I also attempted at spelling out the side bars. the first d%K4q@h*, spelling something like. d/dee, %/percent,

K/kay, 4/(four or for), q/(cue or queue), @/at, h/(h or ache or eight), */(this was hard, ass to risk, i don’t know

this ones hard to spell, of course there’s always asterisk). Then using the formed words i try to make sense of it.

It sounds to me at the beginning like “the person” then maybe, “came for you”, then “at eight”, the last part

doesn’t really fit with its “as to risk”

The second bar y&#7V$3?. y/why, &/(and, or an/am person), #/(this ones hard, either pound, number), 7/seven,

V/(ve, we, or the), $/(dollar, money), 3(three, free), ?/(question, or in my opinion is simply a question mark

ending a question). I suppose all this could be read as “why” “am person number seven” “the money free?”
I really don’t know on this one.

Help is much appreciated. I know not many people have been posting lately but i read through all the posts and

it seemed like a few people had some solid bases for a beginning. But sadly it was years ago before i even found

this web site. But i am here now, to enter my input. And i hope to be of assistance in this matter. If i don’t see

anybody else responding, i am going to make it clear now, that i intend to solve this puzzle. If it is the last thing i

try to do. So if its not here, then i will find some place else. Hopefully some place that already knows about it. I

dont mean disrespect in any shape of form by that. Its just that, with my personality, now that I’ve stumbled

upon this little puzzle, i won’t be able to not think about it till its either solved, or i forget about it completely.

The later is rather rare though. It all comes down to how this plays out really.

As for the family, i am sorry for anything you have suffered through. I am sorry that something as real and

close as this to you, has become a mere puzzle to people like me. I am sorry that i didn’t know you, or the rest

of the people involved. To be honest i want to be able to know EVERYONE. I want to know everyone from

before, during, and after my time. I think everybody has problems, myself included, and under the correct care

of friends and family, those problems can be worked on or mended almost completely. For sure there is no way

to erase a seed that deep in our minds, but it can be repressed and out grown by the love given to us by the

important people in our lives.

That is all i really have to say, I am sorry.

Jenn July 1, 2009 3:50 PM

I just want to take a minute to thank everyone who has taken the time and effort in trying to solve this mystery/puzzle.

It does sadden me to know that I will probably NEVER know the answer to this or even know why he murdered my mother and brother but I do find some comfort in knowing that the murderer is not a free man and will NEVER have the chance to harm another person.

All I can say is that my mother and brother were the best people a person could ever know. Even after 5 years I still think about them everyday.

So Thank You to all who has put in the effort in trying to decode this puzzle.

Pat July 30, 2009 1:08 PM

2 days ago I did a search for David Rayburn as I was hoping to reconnect. I could not believe what I had found. The first thing that came to mind was why? Then came disbelief. This was not the David Rayburn I knew or went to Junior High and High School with or who I last visited in East Boston back in 1999. I came to this site for some possible answers. At this point point I am still in disbelief and deeply saddened. My prayers and sympathies go out to the families.

John August 1, 2009 6:28 AM


Hey Jenn, its your cousin John. I am sitting in Iraq right now, my friend here was just commenting on a movie he saw A Haunting in Conneticut. it reminded me of this incident so i looked up the story to show him. i was surprised to find this blog. It has been too long since i have seen or heard from you. i hope all is well. I too think about Michael and Linda alot. you should email me, John.Adams35@us.army.mil
it sure would be nice to hear from you.

just an observation October 4, 2009 9:54 PM

Maybe i am a freak, but the deliberate use of upper and lower case characters and use of keyboard symbolism I would guess to be a major clue… My first thought was of a font called webdings.. which uses pictures for characters and has a different picture for an uppercase M and a lower case m which would be why the strike through was important. My webdings font produced nothing but pretty pictures… I also have no idea what fonts he had on his comp (or laptop), but i would venture to guess that if you had access to the computer and typed in the message carefully following the upper and lower case he layed out then selected the text and cycled through all of his fonts you may find the message he was trying to get across. the same can be applied to the symbols & (i couldnt draw it or spell it either) is simply an uppercase 7 i know its a guess, but you got anything better?

Skeptic October 27, 2009 12:21 AM

It’s such an old thread, so this may be pointless, but I have several observations.

  1. The statistical methods used above are meaningless as the number of characters is too low. We can’t tell if there is a skew or not. All we can say is that there is a very even spread of the letters.
  2. Some, if not all, of the commenters claiming to be relatives are imposters. They could even be the same person, or a small number of people.
  3. The message is so short and has so many characters that:
    a) if it really is a code, it’s likely too short for cryptographic techniques to break
    b) we can’t tell if it is a code

Given that the purported author killed his family and himself, he was obviously disturbed. On the principle of occam’s razor, out of all the theories above the two that I think most likely are:
1. keyboard bashing with roughly alternating use of the shift key
2. meaningless pseudo-random letters

As was said much earlier, it’s not possible to “partially” break a code so small – either you completely break it or you don’t break it. A partial break is easily attributed to the human brain’s ability to find patterns in anything.

anon February 9, 2010 2:43 AM

Just a observasion and this is now 4 years old it looks like..

What are the erased markings on the sides of the image?

There are 7 white spaces which look to be something written and white-out’d or erased, something is there and with cryptography it all matters, especially with written. Four on the left, three on the right.

The bottom of the page also has ‘a’ circled, looks like a page reference, it is the only thing that is out of place also. Weird to write a message and have a footer on it after killing your family.

Bozemoto September 8, 2010 3:26 AM

There are 64 characters horisontally and 16 vertically. 64/16=4 something binary is relevant.

Also if you make the capital letters into dots and the small characters into lines WjuPDqXoRwis becomes “ad a cow” in morse.

also there is an xor in there which is a binary operator.

sarah April 15, 2012 10:07 AM

the first 3 letters in the box if u blend the letter sounds it sounds like ‘would you’

the 3 net letters sound like ‘put a’

would you put a ……….

email me if u have a mystery

Leave a comment


Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.