MYS0D7R6VX63T6S·Mystery · signal

Cicada 3301

Cicada 3301 · Public domain

First appeared: An image posted to 4chan in the first week of January 2012⁠[1]
Rounds: January 2012, January 2013, January 2014⁠[2]
Signing key: OpenPGP RSA 4096, fingerprint ending 181F 01E5 7A35 090F, created 5 January 2012⁠[3]
Physical clues: Posters and other artefacts in 8 countries and 11 US states by January 2014⁠[2]
Liber Primus: 58 page images in runes, with a key of 29 runes mapped to letters and primes⁠[5]
Self-description: An international group with no name, opposed to censorship and in favour of privacy (leaked 2012 email)⁠[2]
Peer-reviewed studies: One, in religious studies; none of the ciphers⁠[7]
Status: Unexplained
Questions: 0 of 4 answered

People Keith MartinInformation security academic, Royal Holloway, University of London Marcus WannerSolver in the 2012 round, interviewed by Rolling Stone

Catalog keyMYS0D7R6VX63T6S

In the first week of January 2012 an image appeared on 4chan, white text on black: "Hello. We are looking for highly intelligent individuals. To find them, we have devised a test. There is a message hidden in this image." It was signed 3301⁠[1]⁠[2]. Over the following month a chain of puzzles led solvers through hidden text in image files, classical ciphers, book codes, literary allusions, telephone numbers, GPS coordinates to posters on lampposts in several countries, and finally to a site on the Tor network that closed after a few visitors with the words "We want the best, not the followers"⁠[2]. The same thing happened in January 2013 and again in January 2014⁠[2].

Every message was signed with the same OpenPGP key, created on 5 January 2012, and the first signed message promised that all future messages would be signed with it⁠[3]⁠[4]. That makes the corpus unusually clean for an internet mystery: what Cicada said can be separated from imitations. Some finishers were contacted privately; one leaked email described the senders as "an international group" with no name, symbol or membership roll, united by the beliefs "that tyranny and oppression of any kind must end, that censorship is wrong and that privacy is an inalienable right"⁠[2].

The third round produced Liber Primus, a book written in runes, with a key that maps each of 29 runes to a letter and to one of the first 29 prime numbers⁠[5]. It remains the main open puzzle. The setters have never been identified. A cryptographer who looked at the puzzles judged that they test internet skills, general knowledge and lateral thinking more than cryptography⁠[6]; the one peer-reviewed article reads the project as a kind of online religion⁠[7]. Neither the puzzles nor the book have been the subject of a published cryptanalysis. Of the 4 questions on this site, 0 are answered. The most likely answer to “Who set the Cicada 3301 puzzles, and why?”, not yet confirmed: a private international group of privacy and anti-censorship technologists, recruiting like-minded people for….

Key questionsset by the editors

What does Liber Primus say, and can it be read from the published material alone?No answer ahead yet

Who set the Cicada 3301 puzzles, and why?Most likely: a private international group of privacy and anti-censorship technologists, recruiting like-minded people for…

All 4 questions

What happened

The 2012 round began with the 4chan image and a hidden line of text: "TIBERIVS CLAVDIVS CAESAR says" followed by a string that, shifted by four letters, gave a web address; the first page reached was a decoy⁠[1]. Later steps drew on a poem from a medieval Welsh manuscript and a William Gibson poem first issued on floppy disk, and moved into the physical world when GPS coordinates led to QR-code posters on lampposts in five countries, from Poland to Australia⁠[2]. A poster photographed in Warsaw shows the cicada emblem and a QR code⁠[8]. The trail ended at a Tor site; weeks later Cicada announced, "We have now found the individuals we sought... Thus our month-long journey ends. For now."⁠[8].

The first image, posted to 4chan in January 2012Cicada 3301, 2012. Public domainArtifact

A second round began on 5 January 2013, a year and a day after the first, with a new image on 4chan⁠[2]. The third began in January 2014 on a Twitter account used in 2013, with an image reading "Hello. Epiphany is upon you. Your pilgrimage has begun. Enlightenment awaits." Its hidden text, extracted with the OutGuess steganography tool, led through a book code keyed to Ralph Waldo Emerson's essay "Self-Reliance" to further Tor sites⁠[2]. The third round's material includes the runic book Liber Primus and an audio track, "The Instar Emergence"⁠[5]. An image posted in January 2016 to the same Twitter account is widely cited as Cicada's last new puzzle material⁠[9].

Timeline

Timeline

Squeezed where little happened. Each mark is a published claim, by how it stands:AcceptedMost likelyStill possibleDisputedRuled out

The accounts

The solvers are the witnesses. Marcus Wanner, a 15-year-old in Virginia in 2012, and a solver who gave his name only as Tekk described the first round to Rolling Stone: the image file opened in a text editor, the Caesar shift, the decoy, the collaboration in chat channels⁠[1]. Alex Hern of the Guardian tried the 2014 round himself and documented each step and the community's solutions⁠[2].

Cicada's own account of itself comes from one email leaked by a 2012 finisher, with the signature removed to protect the leaker; other recipients indicated the contents were genuine⁠[2]. It describes a group "drawn together by common beliefs" in freedom from censorship and the right to privacy. No finisher has publicly described what work, if any, followed.

What was recorded

The corpus is digital and mostly archived. The signing key is on public keyservers with its creation date and the user ID "Cicada 3301 (845145127)"⁠[3]. Liber Primus survives as 58 numbered page images, with a title page, a cover, a chapter image and the key, archived from liberprimus.org⁠[5]. The key, headed "Gematria Primus", lists 29 runes, each with a letter or letter pair (including TH, EO, NG, OE, AE, IA/IO and EA) and a prime from 2 to 109⁠[5]. The puzzle images, signed texts and community solutions for the three rounds are preserved by solver communities in wikis and code repositories, which this record could not reach.

The size of the operation is itself a datum. By January 2014 physical artefacts had appeared in 8 countries and 11 US states; the setters had bought phone numbers and paid for servers⁠[2].

The explanations

A private group of privacy-minded technologists is the explanation Cicada gave for itself, in the leaked email⁠[2]. It fits the puzzles' emphasis on anonymity tools, signed messages and the Tor network⁠[6], and the ideological content that the religious-studies reading analyses⁠[7]. It rests on the email's own word.

Recruitment by an intelligence agency was the press's favourite reading⁠[8]⁠[6]. Against it, Hern notes that GCHQ's own recruitment puzzles were openly branded and that a service would hardly hunt for staff on 4chan⁠[2]; Martin notes that the skills the puzzles test are more those of a capable internet user than of a cryptographer⁠[6].

A marketing or alternate-reality game was the first assumption of many players. Hern compares it with Microsoft's ILoveBees campaign, which ran three months and ended with a product; Cicada ran three years and sold nothing⁠[2]. A secret society, the most dramatic reading, is the one Martin dismisses as the least likely⁠[6].

Published claims

Published claims and their status

Year	Who	Claimed	Status	Reason
2014	Keith Martin⁠[6]	The puzzles test internet skills, general knowledge and lateral thinking more than cryptography, and a secret society is the least likely explanation.	Accepted	Hern's step-by-step account of the 2014 round turns on file tools, a book code and literary clues rather than hard ciphers⁠[2].
2014	James Vincent, The Independent⁠[8]	Cicada may be a recruitment tool for an intelligence service such as MI6, or for a Masonic group.	Disputed	Specialists argue a service would not recruit this way, and FOIA requests found no records at the FBI or CIA, but nothing rules it out⁠[2]⁠[10].
2014	Cicada 3301, in a leaked email published by Alex Hern⁠[2]	Cicada is an international group with no name, drawn together by opposition to censorship and belief in privacy.	Most likely	It fits the puzzles' focus on anonymity tools, but rests on one email whose signature was removed⁠[2]⁠[6].
2014	Alex Hern⁠[2]	Cicada is not a marketing game: such campaigns run for months and end with a product, and Cicada ran for years and sold nothing.	Most likely	No company or product has been tied to the puzzles in any source this record found; the case rests on that absence⁠[2].
2017	Toni Noble⁠[4]	Only messages that verify against the full fingerprint of Cicada's 2012 key are genuine, because the short key ID can be faked.	Accepted	The key is public with its 2012 creation date, so any message can be checked against it⁠[3].
2019	John Greenewald, The Black Vault⁠[10]	FOIA requests found no records on Cicada 3301 at the FBI or the CIA; the NSA released one 27-page document.	Accepted	The replies are published, though a no-records reply does not show an agency was uninvolved⁠[10].
2021	Filip Andjelkovic⁠[7]	Cicada's texts and community are a cyber-gnostic movement, framing spiritual enlightenment in terms of information freedom and privacy.	Still possible	It is a reading of the ideology in a peer-reviewed religious-studies journal, not a finding about who set the puzzles⁠[7].
2024	Thomas Schoenberger⁠[11]	Schoenberger founded Cicada 3301.	Still possible	No source this record found shows a message signed with Cicada's 2012 key that bears it out, the test Cicada set for its own messages⁠[4].

What would settle it

A message signed with the 2012 key that identifies the setters, or a finisher's documented account of what followed, would settle who and why⁠[3]. For Liber Primus, a published decipherment that reproduces from the page images, with the method stated and a test against random text, would settle what the book says. A frequency, index-of-coincidence and period analysis of the transcribed runes against the Gematria Primus values is the obvious first step and has not been published⁠[5].