Cicada 3301: An Internet Mystery

Cicada 3301: An Internet Mystery


On the 4th of January, 2012, a user on 4chan
posted this image to the site’s infamous /b/ or random board. The anonymous author, who went by the four-digit
pseudonym 3301, challenged users to uncover a message hidden within the image. Unbeknownst to those who stumbled across it,
someone had just set in motion one of the most elaborate scavenger hunts the internet
has ever seen. Within minutes of the image being posted someone
discovered that by opening the file using a text editor an appended string of readable
text could be found. The string contained a cipher that, once deciphered,
formed a link to yet another image. At first this appeared to be a dead end but
using an application known as OutGuess users were able to extract hidden information embedded
within the first image. The extracted information lead to a subreddit
which in turn contained information about a book. The book along with a code could
then be used to uncover a phone number that, when called,
played this prerecorded message. By the following day, the initial image had
been reposed all over the internet. A growing community of armchair detectives
sought to unravel this elaborate puzzle but no one was quite sure what to make off it. What was the puzzle for? Who was behind it? What happens when you reach the end? Some naturally dismissed it as an elaborate
joke while others perceived its complexity as evidence against it being the work of a
mere troll. Before long, rumors began to circulate that
this could be the work of some secret society or intelligence agency with the intent of
recruiting individuals proficient in cryptography, steganography,
and other related fields. Of course, it was nothing but a rumor. The two missing numbers mentioned in the recording
proved to be the dimensions of the original image. After multiplying the width and height with
3301 and using the product as a web address, users were taken to a website. The website consisted of a countdown as well
as an image of a cicada. When the countdown reached zero, the page
was updated with a list of coordinates. The coordinates pointed to locations around
the globe. 14 locations in 5 different countries. It was now up to participants living near
the specified coordinates to rise from their comfortable armchairs and venture outside. Those who believed Cicada to be the work of an
organization now felt their beliefs had been justified. In their opinion, only some international
collective possessed the means and resources to create a scavenger hunt of this magnitude. This was not the work of your average troll. No, this had to be something else. At each location was a poster with the cicada
symbol and a QR code. …on the bike shelter over here. See I got it… I got it right there. You can see the corners, I just kinda ripped it off. The codes linked to an image, the image contained
a riddle, the riddle lead to a book, and the book lead to a website. But here, the puzzle took an unexpected turn. Only a select group of first arrivals to this website
were accepted into the final stage of the puzzle. The site eventually closed down with the message: “We want the best, not the followers.” The finalists were also warned not to collaborate
with others nor to share the details of this private stage of the puzzle. Well, given that we know this, it’s safe to
say that not everyone heeded that warning. But those who did presumably advanced through
the final stages before reaching the very end of the puzzle. After nearly a month of silence an image appeared
on the subreddit announcing the conclusion of the puzzle and, just like that, the hunt
was over. Cicada had supposedly found the
“highly intelligent individuals” they were looking for and whatever happened to them is a bit of a
mystery but more on that in a moment. The lack of an explanation was perceived by
many as confirmation that the puzzle had been nothing but a wild-goose chase intent on wasting
everyones time. After all, questions raised by the original
image remained unanswered. What was the puzzle for? Who was behind it? What happens when you reach the end? However, as it later turned out, this was
only the beginning. Whomever was behind this intricate game had
the foresight to include an authentication code known as a PGP signature
along with every clue. This allowed users to verify that an image
or message was actually from Cicada as opposed to some impostor seeking to derail or hijack
the puzzle. Cicada had repeatedly warned of such “false paths”
and insisted that any message lacking a valid PGP signature should promptly be disregarded. That’s why this image, posted exactly a year
and a day after the first, provoked such a frenzy. After a year of lackluster imitations, this
image finally matched the official PGP signature. Cicada was back and it was time for round two. The second puzzle was not too dissimilar from
the first. The image enclosed a message, the message
lead to a book, the book produced a link, and gradually the puzzle unfolded. At one point, a recording titled
The Instar Emergence was uncovered. Another clue lead to a cryptic Twitter account
which then lead to an image. The image proved vital to the progression
of the puzzle but the inclusion of this runic alphabet would remain a mystery for quite
some time. Much like the first puzzle the second swelled
into the physical world when a list coordinates compelled participants to, once again, take
to the streets in search of enigmatic posters. This time it was
8 locations in 4 different countries. But eventually the trail went cold once again. Another select group of first arrivals had
been accepted into a final private stage of the puzzle. Unlike the first puzzle the second did not
conclude with an official message from Cicada. The trail merely went cold and Cicada vanished
once more leaving us no closer to an explanation. However, this was still not the end. At the beginning of 2014
it was time for round three. Once again the image enclosed a message, the
message lead to a book, the book produced a link, and suffice it to say, it was more
of the same. Except, this time, the puzzle seemed to revolve
around a strange book. The book was titled Liber Primus, meaning
First Book in Latin, and was evidently written by Cicada. The runic alphabet uncovered in 2013 finally made
sense as the book was primarily written in runes. Even so, the meaning of the translated pages
were cryptic at best. The book consisted of various philosophical and
idealogical ideas and appeared to be their manifesto. Many have since compared the strange writings
to that of a cult. Nevertheless, the book also comprised a myriad
of clues and codes. For example, this page advised participants
to seek out a website on the deep web but the site remains undiscovered. Another page lead to a website containing
yet another recording titled Interconnectedness. However, a significant portion of the book
has yet to be translated. The runic text on some of the pages appear
to be obfuscated by layers of encryption that has yet to be decrypted. Of the 74 pages featuring runes, only 19 have
been successfully translated. As 2015 came and went without the launch of
a new puzzle, many came to suspect the Liber Primus had to be completed if Cicada was to return. This was more or less confirmed
at the beginning of 2016 when Cicada encouraged
a reexamination of the book. More than four years have now gone by with minimal
progress and near complete silence from Cicada. Questions raised by the original image have
gone ignored. What is the purpose of these puzzles? Who’s behind them? What happens when you reach the end? When the initial image appeared on 4chan back
in 2012 many assumed Cicada 3301 to be an alternate reality game designed by a corporation
to promote a new service or product. For example, Microsoft developed an elaborate
ARG back in 2001 to promote the film Artificial Intelligence and a similar viral marketing
campaign was used to promote the release of Halo 2. But the release of subsequent puzzles and
the complete lack of commercialization has more or less eliminated that possibility. If we choose to believe some of the leaked
information from the private end-stage of each puzzle than we do gain some insight into
who this group might be. For example, at the end of the first puzzle,
finalists supposedly received this email. In it, Cicada describe themselves as an international
group who believe that privacy is an inalienable right. The aim of each puzzle is to recruit
like-minded individuals in an effort to develop
privacy-conscious solutions. The email then concludes with three questions. The PGP signature, which would have confirmed
the authenticity of the email, was conveniently removed by the leaker. If a version with a valid signature does exists
online I was unable to find it. But regardless of it’s legitimacy, I find
this question a bit odd. It reads:
“Do you believe that information should be free?” Assuming the expected answer is yes then the
very first sentence… “DO NOT SHARE THIS INFORMATION!” …seems a bit hypocritical. While the idea of a secret society recruiting
individuals by means of elaborate cryptographic puzzles may seem a bit absurd or even conspiratorial,
it’s not entirely unfounded. Corporations and governments alike have employed
similar recruitment techniques since at least the second World War. In 2013, the British intelligence agency GCHQ
launched a recruitment program known as “Can You Find It?”. Participants had to decrypt a number of cryptograms
hidden across the internet and those who managed to solve the entire puzzle were offered a
prize or a position at the agency. Google did something similar with enigmatic
billboards back in 2004 and the US Navy launched a near-identical project in 2014. Okay, but then, what about the recruits? Why have we not heard from these chosen few? Well, we have. It’s just that separating a legitimate finalist
from an impostor is virtually impossible. In a 2015 interview with Rolling Stone, two
alleged winners of the first puzzle chronicled the events beyond the final stage. After receiving an email from Cicada they
were taken to a forum on the dark web. Here, they could communicate with some twenty
some odd recruits as well as a handful of established members of Cicada. They were told that Cicada 3301 had been founded
by a group of friends who shared common ideals about security, privacy, and censorship. The goal was to work as a collective to develop
software applications in line with that ideology. As friends recruited friends, this secret
society quickly expanded into a decentralized international organization. The recruits were then tasked with developing
software that fit the ideology of the group and members of Cicada would oversee their
progress. But without the allure of a puzzle to be solved,
the recruits quickly lost interest. By the end of 2012 all but one had left and
a few months later the site was gone. They never heard from Cicada again. One of the two winners, named Marcus Wanner, later
elaborated further in a video by YouTuber Nox Populi. Furthermore, Nox Populi himself claims to
be a winner of the second puzzle so I reached out to him and this is some of what he had
to say. After completing the final stages of the second
puzzle Nox Populi received an invitation to join Cicada 3301. However, he was not invited to a website but
was instead merely told to be patient. Then, around May of 2013, all communication
with Cicada abruptly ceased. This was around the same time as when the
website dedicated to the winners of the first puzzle was suddenly taken down. Nox Populi later contacted other winners of
the second puzzle to compare notes and their experiences were identical. In his own words: “All the stories were the same, we were invited
to join 3301, then something happened and silence followed a request for patience.” Nox Populi suppose that roughly five others
completed the second puzzle in contrast to the twenty-odd winners of the first. In regards to who or what Cicada is, Nox Populi
believes they could be a remnant of the cypherpunk movement of the late 80s and 90s. Essentially a small group of activists advocating
widespread use of strong cryptography and privacy-enhancing technologies but he admits
that there is no way to know for certain. If you want a far more comprehensive walkthrough
of these puzzles as opposed to my brief overview, Nox Populi has produced a number of videos
on his channel which I highly recommend. While these accounts cannot be verified they
do make for a very compelling argument as to what Cicada is. A group of anonymous developers seeking to
develop privacy-conscious applications by recruiting talented individuals via cryptographic
puzzles. Sure, it is not nearly as exciting as a shadow
government seeking world domination or any of the more fantastical theories but it is
certainly more plausible. You have to keep in mind that no part of these
puzzles would have required more than one person. The posters are often pointed to as evidence
that this must be the work of some international organization but I beg to differ. I mean, right now, I could use any number
of services to hire random persons around the globe to install posters for me. Although, given that no poster was located
more than an hour away from an airport leads me to believe that one or multiple persons
actually traveled to these locations. I mean, some of the posters were found within
walking distance of an international airport. The fact is that anyone with a disposable
income and enough time on their hands would be able to create the illusion of a vast secret
network spanning the globe. Not saying that is the case with Cicada 3301 but it is
nonetheless a possibility that cannot be discounted. With all of that being said, I personally
think a loose-knit group of privacy-minded hobby-cryptographers to be the most plausible
explanation. Cicada made their last public statement in
April of 2017, merely warning against disinformation, but the current status of the third puzzle
and the possibility of a fourth remains clouded in mystery.

Danny Hutson

53 thoughts on “Cicada 3301: An Internet Mystery

  1. There's still a potential solution to this, but the reward for the risk involved simply isn't there.

    The printing of a book, and payment of royalties, opens at least one member of this group to simple "lead pipe" solutions to cryptography.

    If there is a human who can tell you the information, in this case anyone working for the publishing service that was used with access to their payment records, the cryptography is only as strong as their kneecaps and lead pipes are cheap and easy to use.

    The thing that shut them down was probably a member of a US intelligence service checking in to make sure they weren't actually anyone dangerous, having used IRS records to track down those mentioned payments. No lead pipe needed, in this case.

  2. I wonder if they only ghost the people who solved the puzzle with outside help, and made up boring, bullshit stories to make those people go away, or if they really vanished. The people who solved it alone are the ones you'd really want mm.

  3. Finally finished all riddles, spent years of life, finds secret link…







    WE’RE NO STRANGERS TO LOVE

  4. NSA found Cicada 3301 and put him to work for them. Mandated end of playing little games.
    Just read the interview with the STUXNET team member, unless they have some die hard political views that place is heaven if you are best of the best, from pay to work conditions to work it self being extremely rewarding because the challenges are such that cannot be matched anywhere else.

  5. With these kinda ARGs I always assume that the creators are acting as the players too because some stuff is way too absurd for someone to stumble upon.

  6. "Cicadas emerge from the soil every 17 years to molt and mate. Other types come out every 13 years.

    The cicada's claim to fame is its singing. The high-pitched song is actually a mating call belted out by males. Each species has its own distinctive song that only attracts females of its own kind. … Cicadas are the only insects capable of producing such a unique and loud sound

    cicadas don't bite or sting; they do however pierce and suck. They might try to pierce and suck you, but don't worry, they aren't Vampires nor are they malicious or angry — they're just ignorant and think you're a tree

    cicadas may do native trees a favor by weakening or killing non-native ornamental trees, which compete for the native tree's food. The cicada's purpose in terms of people: Cicadas are a food source. Many people around the world eat cicadas, and not just “on a dare”, but as a delicacy or staple food

    The seven periodical cicada species are so named because, in any one location, all of the members of the population are developmentally synchronized—they emerge as adults all at once in the same year. This periodicity is especially remarkable because their life cycles are so long—13 or 17 years."

    I love Cicadas…. be patient.

  7. And those who do not heed warnings find themselves short. Always and forever. Read the "Cicada and the Cow". It's not about the puzzles anyway. It's about Liber Liber Primus. You will know them by their fruits.

  8. no one is even commenting about the lemmino puzzle in this video (at least not anymore). dope video, great puzzle. The amount of effort you put into this is damn impressive

Leave a Reply

Your email address will not be published. Required fields are marked *