Roger • January 31, 2006 7:29 PM

It seems quite unlikely that this is a genuine cryptogram. For a start, it is extremely short for any cryptogram meant to be anything but a puzzle, and quite short even for that. Further David Rayburn’s profession and the number of types of characters involved (53) suggests that if it is a cipher at all it is probably a modern computer based one, making it odd to find it handwritten.

My first thought was to agree that it’s a password list. Probably not even a “cheat sheet” so much as a simple list, because so many lines are roughly equal to typical password lengths. Plus it fits with what little we know about David Rayburn.

Two factors made me think twice though:
* Line “Mmg” is very short for a password;
* If these passwords were randomly generated from the set of all printable characters, then digits and punctuation marks are seriously under-represented, to the point of being statistically improbable.

However, the second of these issues resolves if we notice that ALL of the non-alphabetic characters appear in the two lines written sideways on the left and right edges of the page. Since these lines are written sideways rather than simply vertically, and since the characters in them do not align with the other rows, it strikes me that they have been written this way simply because the writer ran out of room. If that is the case, then they are also the last two entries. Additionally, they are both exactly 8 characters long, a very typical length for maximizing the strength of old style Unix passwords. So, it may be that if these are passwords, all the entries but the last two were generated by a random character generator which outputs only alphabetic characters, while the last two, intended to be extra strong, also allowed digits and punctuation marks.

Checking the stats again, this hypothesis matches: the distribution of symbols in the last two entries is similar to that expected by random selection from all characters. However, at this point by eyeball Mk I analysis I noticed another pattern, in the line “y&#7V$3?”. Its pattern of shifted and unshifted characters goes “.>>.>>.>”. Not impossible by chance alone, but made me wonder if it wasn’t generated by banging randomly on a keyboard. In this respect, it is also interesting to note:
* All but two symbols are from the top two rows of the keyboard (half of them from the top row), and the two exceptions are from the bottom row;
* All but one symbol is left of a line on the keyboard joining 7 to n. This is not quite the same as “left hand keys” for a touch typist, but pretty close;
* In the 8 symbols in this string, only 6 keys were used, the 7/& key and 3/# key being reused;
* That & is very close to y, and $ is very close to 3;
* That V on the bottom row is exactly halfway between 7 and $ on the top row;
In short, this does look an awful lot like the sort of distinctly non-random stuff you get when someone is trying to type randomly.

What about “d%K4q@h*”? It is also quite non-random, though not in quite the same way:
* The pattern of shifted and unshifted characters is “.>>..>.>” which is nearly identical to the previous one, except that q “should have been” capitalised;
* Every character but one comes from either the top row or “home row”.
* If we label the rows 1 (top), 2, 3 (“home”) and 4, then the pattern of rows is very regular: 31312131. Note that the obvious “error” in this pattern is the same character which disrupted the shift key pattern;
* Once again, there is a tendency to the left side of the keyboard, though a little weaker with 2 characters from the right side and one on the borderline;
* In terms of distances, we get d closish to %, big jump to K, 4 is right back to near %, then closish to q, @ right next to q, then big jump to h but it is very close to that K we had earlier, then * closish to h. Thus this kind of looks like a left hand sequence of small jumps partially overlapping with a right hand sequence of small jumps.

Once again, this “random” string is actually quite structured on a keyboard, although in a quite different way to the previous one. Actually, I would hypothesise that the string “y&#7V$3?” was generated by someone typing one-handed with his left hand whilst pressing the shift key with his right hand, while the string “d%K4q@h*” was generated by a touch typist trying to type randomly with both hands, but somewhat favouring the left hand. Question: was David Rayburn left handed?

Continuing the same analysis now with the purely alphabetic patterns, one finds that much the same thing happens for nearly all of them: each string consists of either one or two clusters of keys which are very close together on the keyboard, usually with the direction of movement within sequence being roughly fixed. The sequence of shift key usage is not totally predictable but differs a long way from randomness. For example, (unless we count running off one line and continuing on the next), from these 64 characters the longest sequence of consecutive shifted characters is 3, when we expect about 6, and the probability of it being as low as 3 (if chosen truly randomly) is about 0.006.

My conclusion is that most likely, all or at least most of these strings were generated by banging randomly on a keyboard, with the last two (sideways) strings intended to be “more random”. The typist is possibly left-handed, and there is some chance that two typists were involved, one of whom touch types while the other does not. Most likely, the strings are intended for use as high security passwords and have been written down as an aide-memoire, although of course it is also possible they are random junk intended to confuse an investigator.

Presumably, a genuine investigator or relative will have access to password protected systems used by David Rayburn, and may be able to test if any of these passwords work on them. On the other hand, as Rayburn was unemployed at the time of death, the passwords might also refer to a former employer’s systems. If still available, it might also be useful to check the web cache of any computers he used to determine if they may be website passwords.

Appendix: Machine readable version
The following version might help anyone else wanting to do an analysis. Please correct it if you see any errors. This list uses the assumption that the lines are mainly to distinguish between capital and lower case letters. Letters in parentheses were not on the lines, but written above the letter which they follow in this list. The two lines separated from the rest by a blank space are the two written sideways. The character on the second last line which gets butchered by Bruce’s HTML filter, should be an ampersand.

WjuPD
aXoRwis
Mmg
HkcFBfe
XnLoyuI
wAzQY
bUktPsq
AcZ(r)fiYzD
C(m)RVhXaZ
Ef(H)bdqarO

y&#7V$3?
d%K4q@h*

Roger • February 1, 2006 2:41 AM

@peri:
Sorry, I didn’t notice your transcription before I did my own. I just compared them, and find we disagree on just 2 letters; in both line 2 letter 1, and line 9 letter 6, you read “q” while I read “a”.

Going back over them, I still believe my version more likely to be correct, for the following reasons:
1. Look at the 3 “q” we agree on. Notice that all of them are formed with a very distinct hook (North American style) at the end of the descender? This is missing on the two disputed letters, which barely have a descender at all.
2. Look at the one “a” that we agree on, notice that the bow is very similar to the “q” next to it, but the descender stops much shorter, and obviously has no hook. The two disputed letters are the same, but the descenders are just a fraction longer — but not nearly as long as the “q”s, and no hooks.
3. Also, your transcription makes the frequency distribution much less flat, putting a single spike at “q”, with more than triple the average frequency. Mine makes it only double the average frequency and makes the whole thing look much more like a flat distribution with the typical random variations.

What do you think?

Roger • February 16, 2006 3:24 AM

Some have suggested that ‘Mmg’ is too short to be a password. It is indeed far too short to offer more than trivial security for any system which allows remote attacks, a high rate of guesses, or off-line attacks. Assuming that it is known to consist of only three characters, but like the other passwords (if that is what they are) it can be from any printing key on the keyboard, shifted or otherwise, then there are only 857,375 candidate passwords, which in typical offline attacks can be broken in a second, perhaps less.

However if off-line attacks are unavailable, and remote attacks are either unavailable or heavily rate-limited, a password of this strength can be adequate for many systems: if we can forbid off-line attacks and add a penalty for wrong guesses which limits the average rate to say, 1 per 5 minutes, then a three (random) character password will take an average of 4 years to attack.

Three systems of that type that come to mind are screen saver passwords (whether a PC, a PDA, or a cellphone), burglar alarm controllers, and ATM PINs. A password with 857,375 possible values is easily strong enough for a burglar alarm keypad, cellphone screensaver or ATM PIN (in fact 85 times stronger than typical ATM PINs), however these devices normally only use digits.

Consider a laptop or PDA screensaver, though. If you set a short timeout for maximum protection from local attackers, it will timeout quite a lot and will be somewhat inconvenient to enter a long password. On the other hand, attacking a screensaver password generally requires physical access to the box (unless it is already pwned, in which case it hardly matters), and is rate limited by human typing speed to somewhere around one attack per second for a few minutes and much slower thereafter. Further, the machine’s owner may be able to guarantee that the attacks can only occur in certain windows (e.g. whilst in the bathroom) because otherwise it is either in his presence or completely shutdown and requiring a strong password to boot. In this scenario, a 3 character password would be more than adequate against a casual attacker, and even adequate against a more determined attacker provided it was changed after about every two or three cumulative hours of exposure.

Further, note that if we take it as a cryptogram rather than a password list this causes even worse problems for those suggesting the line lengths are the lengths of the words, one per line, as indeed several cryptogram supporters have suggested (which would, however, usually indicate a very weak cipher, which this is not). The result of that thinking is word lengths of 5, 7, 3, 7, 7, 5, 7, 8, 7, 8, 8, 8, which are pretty typical lengths for passwords (apart from the minor aberration at 3), but is a distinctly odd distribution for English words: even in college-educated English writing, only about 20% of words are 7 or more letters in length. A run of 6 such long words in a row occurs perhaps once per 7,000 words in technical writing. And in a corpus I just scanned, the only examples of 9 words in a row with none shorter than five letters, were dot-point lists of technical words. In short there are far too many long words in this article for it to be likely to be English. (Question to Ken: did the alleged author speak any other languages?)

Finally, let’s apply Occam’s razor: the fellow was an (unemployed) network admin and computer user. Computer users, especially network admins, need some way to store passwords and writing them on a private scrap of paper is a common way to do so. He had his briefcase of private computer stuff nearby, it would almost be more surprising if a password list in some form (not necessarily paper) was not found. On the other hand, murderers only leave cryptograms at the crime scene in fiction. The one case that comes to mind involving murders and cryptograms is the Zodiac Killer — but in that case, the cryptograms were mailed by a very much live murderer specifically to taunt the police.

Roger • February 16, 2006 7:10 PM

@Fox Mulder:
“That is not true: in none of the references to this case it was stated that the guy was an ‘network admin’ or a even computer expert.”

It was in the first news reference once of us dug up, back on 30th January, and recently quoted again by NotMe, i.e. this:
http://www.boston.com/news/local/massachusetts/articles/2004/02/05/killings_suicide_baffle_authorities/
It says, among other things:
“Linda Rayburn listed her husband’s occupation as Internet technician on a town survey she filled out on Jan. 16, though police said Rayburn, a 1988 graduate of Hingham High School, had been unemployed and was seeking work.”

I have no idea if Linda’s statement was accurate but I have referred to it a couple of times and no-one else has questioned it, including the family friend who has posted to this blog. (I suppose “Internet technician” could also mean web developer, but that makes no difference to the point I was making.)

“Bottomline: we do not know for certain the weird note was even written by him and therefor we do not know if it even has to do with the case.”

Quite right. In fact, there is a bunch of stuff about “the case” that we (the readers of this blog) don’t actually know. However, unless the police are grossly incompetent [1], “the case” is already solved, and the putative cryptogram interesting only as a puzzle. I find it interesting to analyse its statistics and so forth, because that’s the kind of geek I am, but IMHO actually digging into the details of the case would indeed be — as several have already suggested — a terrific waste of time.

It is interesting, BTW, that you refer to this matter as “the case”: that is how “Ripperologists” refer to the murders by Jack the Ripper. Be careful you don’t become as obsessed!

1. For example, we take it as granted that they did all the necessary checks to confirm that David Rayburn hanged himself, rather than being strangled by someone else and then hanged. In such a serious matter as a triple homicide this would certainly include not only the autopsy but also such things as fingerprinting every article found near each of the bodies, blood spatter analysis, tissue-typing and perhaps DNA fingerprinting of blood found on the apparent murderer’s clothing, probably hand-writing analysis of notes, etc. If we can’t assume that the Boston police executed these sorts of procedures competently then we don’t really know anything much at all about the matter.

Roger • February 19, 2006 9:09 PM

@Chi_squared:

I’d like to see anyone explain how 3 of the lines in the note all just ‘happen’ to show up as distinct words of compiled code on data files on 3 seperate web sites that all have SOHO images files in common and ALL relate to ‘bitpix’

Simple: most of the ones you found in this way are quite short, so short they are almost certain to be found at random among the 170 terabytes of data which Google has indexed. Since they are not words in any human language they will not be found in human readable text pages, and since Google doesn’t usually make text indices of binary contents they won’t usually be found in images either — but this is only because Google excludes the binary contents of such files. However, the FTS files you found are semi-textual representations of binary data (in fact they appear to be not compiled code, but an unusual compressed image file format used in astronomy). The text at the start of the file fooled Google into indexing them, while the image binaries — in some sort of uuencoded type format — in the body of the file happened, by chance alone, to contain your strings.

The fact that quite a lot of your hits came from FTS files is firstly because only a few binary file types will (erroneously) get indexed in this way by Google, and secondly because the astronomers seem to have really large amounts of data available on the web in this format, and thirdly because the format is encoded in a manner (something like uuencode) such that a majority of bytes are alphabetic letters.

The chance of a given meaningless 5 letter sequence occurring in a random byte string of this type is about 1 in 40 million, so if they have much more than 40 MB of FTS files, it is very likely to occur. And it looks like they have MUCH more than 40 MB. In other words, finding random 5 letter strings in this way is not only totally unremarkable, it is so likely to occur that it would be surprising if it didn’t happen. In fact, here is a little experiment you can try: repeat your test, but instead of the strings from the note, use ones you make up yourself. For example, try this:
http://www.google.com/search?q=ABCDE+site%3Asohowww.estec.esa.nl
(242 hits)
http://www.google.com/search?q=KEMAU+site%3Asohowww.estec.esa.nl
(1 hit)
http://www.google.com/search?q=ZZZZZ+site%3Asohowww.estec.esa.nl
(857 hits)
Try it yourself, but use whatever 5 letter string you like.

Now a seven letter string like ‘EFBDQAR’ is slightly more surprising, since the chance of it occurring in a random 7 byte sequence of this type is about
1 in 40 billion. That starts to sound like very long odds, but actually it would not be so surprising if they had at least 40 GB of FTS files on their site, and actually it looks like they might. Actually, even that is pessimistic, because it is talking about the odds of finding it on one particular site, chosen in advance, when we really we only want to know the odds if it being found on some site anywhere.

And your fourth hit, ‘MMG’? C’mon, that’s only three letters. The odds of it occurring at random are so good that finding it on a site like that is totally meaningless.

So to summarise, I’m sorry, but what you’ve found are just patterns in the clouds.

Oh, and the pages that Dirk found are spam traps, by the way. They generate huge numbers of completely random strings and format them to look like email addresses, in order to “poison” the lists of email addresses which some spammers harvest with webcrawlers. In other words, anything you find on such a page is just random garbage, and any reasonably short random string has a high chance of being found on such a page by chance alone.

Roger • February 22, 2006 4:48 PM

@Svelte:

If it is a one time pad (possibly a stolen one from a military base long time past)

Military one time pads are either all digits, or all capital letters. Or rather were, they are rare today.

Which of you have a copy of the book titled “The Codebreakers” by David Kahn?

I have a copy of the 1974 edition if you want something looked up. But it’s back in print; why not buy a copy? Amazon and Books-a-Million both have it on special for under fifty bucks.