Cicada 3301

Cicada 3301 is often referred to as the internet’s most elaborate and mysterious puzzle, one that often leaves cryptoanalysts and hackers scratching their heads. A sort of cross between a contest, job interview and highly complex puzzle, Cicada 3301 recurs each year, but no one knows who is behind it or what prize awaits the person who solves it.

The first internet puzzle appeared online on January 5, 2012, and two subsequent rounds were released on the same day of the following years. During the first year, Cicada 3301 started with a picture on 4Chan, along with the message: “Hello. We are looking for highly intelligent individuals. To find them, we have devised a test. There is a message hidden in this image. Find it, and it will lead you on the road to finding us. We look forward to meeting the few that will make it all the way through.” The message was simply signed 3301.

The ensuing puzzle provided focused heavily on data security, cryptography and steganography. The clues were scattered in locations all over the world – from the US to France and Poland, within various forms of communication including the internet, telephone, bootable Linux CDs, digital images, and physical paper signs. The clues have also referenced several books, poetry, artwork and music. Clues are always signed by the same cryptic private key to confirm authenticity.

Because of its nature, many have speculated that Cicada 3301 is a recruitment tool for a government intelligence agency. Some claim that it might be an Alternate Reality Game, while others believe that Cicada 3301 is a secret society with the goal of improving cryptography, privacy and anonymity. Since the clues revealed so far were found in a large number of locations quite distant from one another, Cicada 3301 is also believed to be well-funded. But no one really knows, given the fact that no company or individual has tried to take credit for it.

Over the years, very few individuals claimed to have cracked the highly complex final rounds and ‘won’ the contest, but they’ve never revealed their identities and the mysterious person/organisation behind Cicada 3301 has never verified these claims either. There was a rumor in 2012 that an e-mail was sent to individuals who had completed the puzzle, in which they were given a personality assessment. Upon passing this stage, the participants were supposedly recruited, but no one really knows if this is true either.

Swedish computer analyst and self-confessed ‘IT freak’ Joel Eriksson is one of the very few people who cracked the puzzle but never got to find out what was at the end of it all. When he saw the first image that was posted along with the message in 2012, he immediately recognized it as an example of digital steganography, which is the concealment of secret information within a digital file. The technique is commonly associated with criminal activities such as child pornography and terrorism.

When he recognized the photograph, Eriksson’s curiosity was aroused and he decided to give the game a shot – and within minutes he found a web address buried in the image’s code. To his surprise, the link led to the image of a duck with the message: “Whoops! Just decoys this way. Looks like you can’t guess how to get the message out.” By this point Eriksson was hooked.

So he tinkered with other variables and found another hidden message in the duck, linking to a Reddit message board, where strange symbols of dots and lines were being posted. Eriksson realized that these were Mayan numbers, so he translated them. He admitted that up until then, the puzzles did not involve any advanced skills, but then things began to get really interesting.

The puzzles slowly began to mutate in several different directions – hexadecimal characters, reverse-engineering, prime numbers, in which pictures of the cicada insect became a common motif. “I knew cicadas only emerge every prime number of years – 13 or 17 – to avoid synchronizing with the life cycles of their predators,” he said. “It was all starting to fit together.”

Eriksson explained that as word of the puzzle spread across the web, thousands of amateur codebreakers joined the hunt for clues. Several 4chan users in fact started decoding messages collectively, which was probably not what the organisation had intended. But Eriksson ploughed through the clues alone, even taking time off work to focus on the mysterious puzzle full time. At one point, a clue led to a phone number based in Texas, but it just led to an answering machine. But by multiplying the digits, he found a new prime number and a new website with a countdown clock and a huge picture of a cicada.

“It was thrilling, breathtaking by now,” Eriksson recalled. “This shared feeling of discovery was immense. But the plot was about to thicken even more.” When the countdown reached zero, at 5pm GMT on January 9 2012, it displayed 14 GPS coordinates around the world ranging from Seattle to Sydney. As amateur solvers across the world left their computers to investigate these locations, they found posters attached to lamps – again with the image of a cicada and a QR code.

“It was exhilarating,” Eriksson said. “I was suddenly aware of how much effort they must have been putting into creating this kind of challenge. When the QR codes were decoded, the hidden message pointed to a TOR address that allowed access to the deep web, which is the vast, murky portion of the internet that cannot be indexed by search engines. This part of the internet is estimated to be 5,000 times larger than the surface web, and believed to contain human-trafficking rings, black market drug markets and terrorist networks.

Unfortunately, the Cicada path ended rather abruptly in the deep web – after a certain number of solvers visited the address, it shut down with the message, “We want the best, not the followers.” That’s when the rumors started that a chosen few had received emails. Unfortunately, Eriksson wasn’t one of them. “It was my biggest anti climax – when I was too late to register my email at the TOR hidden service,” he said. “If my sleep-wake cycle had been different, I believe I would have been among the first.”

Interestingly, there was a new message from Cicada was posted on Reddit a few weeks later: “Hello. We have now found the individuals we sought. Thus our month-long journey ends. For now.” And then everything went quiet, ending just as abruptly as it had begun. Of course, Cicada 3301 released new puzzles in 2013 and 2014 with the message, “Hello again. Our search for intelligent individuals now continues.” But no new puzzle has appeared on January 5, 2015. No one is closer to knowing the source of it all, but Eriksson insists that that’s the beauty of it. “It is impossible to know for sure until you have solved it all.”