Petras Dominas’ encrypted notebooks

Petras Dominas was a dangerous criminal. He was born in Lithuania around 1929 and later worked as a typographer. He spoke several languages, including Lithuanian, German, English, Polish, and Dutch. His profession may have helped him develop an unusual sensitivity for symbols and their arrangement.

Little is known about his life before 1959. That year, he was convicted in Germany and sentenced to four years in prison. After his release, he soon returned to criminal activity. During 1963 and 1964, Dominas and his accomplices carried out a series of armed robberies in Germany and the Netherlands, mostly targeting jewelry stores. In September 1964, Dominas was arrested in Amsterdam, one day after another jewelry-store robbery.

 

The notebooks

In Dominas’ possession, the police found numerous encrypted notebooks. The first encrypted notes were reportedly discovered as early as 1959. More notebooks were later found in various hiding places associated with Dominas. In total, contemporary newspaper reports spoke of approximately twenty volumes.

The notebooks were ordinary school exercise books and ledgers. Their appearance was surprisingly innocent. Dominas decorated their covers with children’s drawings and pressed flowers, making them look more like harmless personal notebooks than the records of a professional criminal.

The manuscripts had been created over a long period, from approximately 1952 to 1964. The writing did not resemble any known alphabet. Investigators initially suspected that Dominas might have modified a form of shorthand. A specialist in stenographic systems from Eastern Europe was consulted, but could not make sense of the writing.

Other experts were brought in. A Jordanian merchant and court interpreter examined the symbols for possible connections with Arabic writing – to no avail. Members of the Jewish community in Düsseldorf were asked whether the script resembled Hebrew or related alphabets. It did not. An expert in invisible inks examined the material and found no evidence of chemical or secret-ink techniques.

The police even searched the libraries of prisons in which Dominas had been incarcerated, hoping to find books that might have inspired his system. Nothing turned up. At one point, investigators confronted Dominas with samples of his own secret writing and asked him to translate them. According to a contemporary report, his answer was essentially that the police would never find the code.

 

Solved by the ZfCh

Eventually, the case was referred to the German authority responsible for cryptographic work, the Zentralstelle für das Chiffrierwesen (ZfCh) in Bonn.

From today’s perspective, it is surprising that this agency was not contacted earlier. In the 1960s, however, even the police apparently did not know that the ZfCh existed at all, as it operated under the strictest secrecy. The ZfCh succeeded in deciphering Dominas’s secret writing.

During an internet search in 2015, I came across a Spiegel article about Dominas that also mentioned his secret writing. The article included an image showing a small excerpt from one of the encrypted pages. The image below is AI-generated and does not reproduce the original image from the Spiegel article.

My further research revealed that, although the Dominas case had been covered extensively in the media and the secret writing was frequently mentioned, virtually nothing was publicly known about the cipher itself.

Thanks to a tip from a person whom I unfortunately cannot name here, I submitted a request to the BND archives in 2023 for information about the Dominas cipher. After almost two years, I actually received two detailed PDF documents.

One of these PDFs is a 223-page collection of material. It includes Dominas’s handwritten descriptions of the cipher, a second treatise on his secret writing, and a list of cipher symbols and their meanings. The latter is essentially a cryptographic key.

The second PDF contains seventy pages of Dominas’s encrypted notes. These seventy pages probably represent only a small fraction of the approximately twenty notebooks that once existed.

 

Dieter Bäusch

As I learned from the material, a ZfCh employee named Dieter Bäusch was responsible for breaking the Dominas cipher. I had never come across this name before. Dieter Bäusch is not mentioned in the crypto literature that I am aware of.

Unfortunately, we do not know exactly how Bäusch broke the cipher. His surviving notes do not provide a complete account of the cryptanalytic process. He presumably performed a frequency analysis. This must have been difficult because of the enormous number of different symbols: there were more than one thousand. He probably also tried to guess words. This was made more difficult by the fact that there are no cleartext passages in the encrypted text.

Several possibilities had to be considered. Perhaps the system was homophonic, meaning that several symbols represented the same plaintext letter. Some symbols might also represent complete words or syllables rather than individual letters. In the end, both assumptions turned out to be correct.

Apparently, Bäusch compared encrypted passages that appeared to contain the same or similar plaintext. This allowed him to study the differences between corresponding ciphertext passages. Some passages occurred twice or even several times in the notebooks. Dominas may have copied sections of text as exercises while developing new symbols for his system.

As it turned out, the Dominas system was essentially a monoalphabetic substitution cipher in which a symbol could represent a single letter, a syllable, a combination of letters, a complete word, or a punctuation mark. There was no transposition, and capitalization was not relevant either.

 

A cipher that evolved

The system was not static. Dominas appears to have developed and modified it over many years. The earliest known version dates from around 1952. At this stage, the size and position of symbols were apparently irrelevant, while punctuation marks and numbers remained unencrypted.

Around 1959, Dominas changed the system substantially. Dot markings were largely abandoned, while the size and position of symbols became significant. Some symbols also received new meanings. After 1960, he added a few more symbols, although the basic system otherwise remained relatively stable.

Some symbols changed their meaning. Others were added or discarded. Some symbols differed only in size, position, or stroke thickness. And because Dominas apparently was the only person who ever used the system, there was little reason for him to make it completely consistent.

Interestingly, the number of symbols representing a letter does not appear to correspond to the letter’s frequency in German. The letter E, for example, has only two representations. The much less frequent letter D has four. These four symbols are rotated versions of the letter U. This suggests that Dominas was not primarily trying to construct a statistically balanced cipher. Geometric and aesthetic considerations appear to have played an important role.

 

What did Dominas write?

The encrypted notes are sometimes described as a diary. That description is misleading. The material available today shows that Dominas wrote several different kinds of texts. Some passages contain detailed accounts of criminal activities. Others concern his legal representation. There are also personal reflections, observations, and narrative fragments.

 

Open questions

The decipherment of Dominas’s secret writing answered one question, but left several others open:

  • How exactly did Dieter Bäusch break the system?
  • What do the remaining encrypted notebooks contain?
  • How many of Dominas’s original notebooks still exist?
  • And what happened to Dominas after his arrest and subsequent imprisonment?

I hope these questions can be answered one day.

 

Literature

Klaus Schmeh: The Encrypted Notes of Murderer Petras Dominas. HistoCrypt 2026

Back to Unsolved Crypto Mysteries

The Encrypted Notes of Ricky McCormick

On June 30, 1999, the partially decomposed body of 41-year-old Ricky McCormick was discovered in a corn field in St. Charles County, Missouri. At first glance, the case appeared to be a grim but unremarkable homicide mystery: a man with health problems and a troubled background found dead far from home, with no obvious explanation for how he had arrived there.

The sheets

Yet investigators soon stumbled upon a detail that transformed the case into a cryptologic mystery. Hidden in McCormick’s trouser pockets were two handwritten sheets filled with strings of letters, numbers, dashes, and parentheses – notes that remain undeciphered to this day.

Ricky McCormick’s first encrypted note — Source: FBI

Ricky McCormick’s second encrypted note — Source: FBI

The discovery raised immediate questions. Were the notes encrypted messages? A personal shorthand? Random scribbles? Or perhaps instructions connected to a criminal activity? The text showed recurring combinations of capital letters, irregular formatting, and symbols that resisted conventional interpretation.

Ricky McCormick

McCormick himself added another layer of mystery. He had dropped out of school, reportedly struggled with literacy, and lived a precarious life in the St. Louis area. Family members later stated that he often wrote down strange-looking notes, although they strongly disputed the idea that he was capable of producing an elaborate secret code. His mother claimed that “the only thing he could write was his name,” while relatives suggested that his scribbles were closer to incomprehensible shorthand than deliberate encryption. The FBI, however, believed the notes could still contain meaningful information and treated them as potentially significant evidence.

The circumstances surrounding McCormick’s death only deepened the intrigue. He was last seen alive several days before his body was found, after visiting a hospital for ongoing respiratory problems. Investigators could not explain why he ended up in a rural area roughly fifteen miles from his residence, especially since he neither drove nor had easy access to transport to that location. Authorities were allegedly unable to determine a clear cause of death. As a result, both the homicide and the mysterious notes remained unresolved.

Publication

For more than a decade, the coded pages sat inside FBI files. Then, in March 2011, the agency made an unusual move: it released high-resolution images of the notes to the public and appealed for help. The FBI’s Cryptanalysis and Racketeering Records Unit (CRRU), assisted by outside experts including members of the American Cryptogram Association, had failed to crack the writing. Public codebreakers, amateur sleuths, and cryptography enthusiasts were invited to try their luck. The Bureau openly acknowledged that deciphering the text might reveal McCormick’s whereabouts shortly before his death – and perhaps even point toward a killer.

The response was immediate. Internet forums, cryptography communities, and amateur investigators proposed countless theories. Some interpreted the notes as geographic directions or drug-related instructions; others argued that the text represented a phonetic shorthand intelligible only to McCormick himself. Online discussions frequently return to one central question: was this actually a cipher at all? On forums devoted to mysteries and cryptanalysis, many commentators speculate that the writings may simply reflect an idiosyncratic personal notation rather than a deliberately concealed message.

Analysis

Here is a transcription of the first note:

(P1)
(MNDMUNEMRSE-N-STA-UNARE)  (AESM)
FRNENP?NSENPBSERCBBNSENPRSEINC
PRSE NMRSE OPREHLDULDNCBE(TFXLC TCXL NCBE)
AL-PRPPIT XLYPPIY NCBE MEKSEINCDRCBRNSEPRSE
WLD RCCBRNSE NT SSNENTXSE-CRSLE-CLTRSE WLD NCBE
ALWCP NCBETSMELRSERLSEURGLSNEASNWLDNCBE
(NOPFSE NLSRE NCBE) NTEGDDMNSENCURERCBRNE
(TENE TFRNE NCBRTSENCBE INC)
(FLRSE PQSE ONDE 71 NCBE)
(CDNSE PQSE ONSDE 74 NCBE)
(PRTSE PRSE ONREDE 75 NCBE)
(TF NBCMSPSOLEMRDELUSE TOTE WLDN WLDNCBE)
(194 WLD’S NCBE)(TRFXL)

This is the second note transcribed:

ALPNTE GLSE – SE RTE
VLSE MTSE-CTSE-WSE-FRTSE
PURTRSEONDRSEWLD NCBE
NWLDLRCMSP NEWLD STS MEXL
DULMT 6 TUNSE NCBEXE
(MUNSAISTEN MU NARSE)
KLSE-LRSTE-TRSE-TRSE-MKSEN-MRSE
(SAESNSE SE N MRSE)

NMNRCBRNSEPTE2PTEWSRCBKNSE
26 MLSE 74 SPRKSE 29KCNOB,OLE 175 RTRSE
35 GLE CLGSE UUNUTKEBKRSE PSESHLE
651 MTCSE HTLSE NCUTC TRQ NMRE
99.84.52 UNEPLSEUCRSEAOLTSENSKSENRSE
NSREONSE PUTSEWLD NCBE (3 XORL)

DNMSE NRSE 1N2 NTRLERC BANSENTSECRSNE
LSPNSENGSPSEMKSERBSGNCBENUXLR
MH CRE NMRE NCBE  1/2 MUNDDLSE
D-W-M-4 MPL XDRLX

The letters E, N, and S appear unusually often, while K, Q, X, and Z occur only rarely. This distribution appears broadly consistent with ordinary English. Such a pattern is consistent with a transposition cipher. Certain letter combinations recur with notable frequency: SE appears particularly often, while sequences such as WLD and NCBE are also repeated. No conventional cipher model has yet provided a satisfactory explanation.

Despite years of speculation, no consensus has emerged. The notes remain officially undeciphered, and McCormick’s death unsolved. Unlike many famous cryptograms, the puzzle offers no obvious key, no confirmed plaintext, and not even certainty that encryption is involved. More than twenty-five years after a dead man was found carrying two sheets of cryptic symbols, investigators and codebreakers alike still face the same unsettling possibility: the meaning may be hidden in plain sight – or perhaps lost forever.

Literature

Craig Bauer: Unsolved! The History and Mystery of the World’s Greatest Ciphers. Princeton University Press 2017

Back to Unsolved Crypto Mysteries

The Ohio cryptogram

On June 27, 1916, a man robbed the ticket counter of the Western Ohio Railway in Lima, Ohio. Brandishing a gun, he forced the ticket agent to hand over the contents of the safe, then fled with $265.

This ticket-counter robber left behind an encrypted message — Source: AI-generated

A few weeks later, the magazine Enigma, published by the National Puzzlers’ League, wrote:

The police department of Lima, O., is greatly puzzled over a cryptic message received in connection with the robbery of a Western Ohio ticket agent. Here it is: WAS NVKVAFT BY AAKAT TXPXSCK UPBK TXPHN OHAY YBTX CPT MXHG WAE SXFP ZAVFZ ACK THERE FIRST TXLK WEEK WAYX ZA WITH THX.

An encrypted message

This cipher and its accompanying true-crime story were uncovered by Dave Oranchak – one of the cryptanalysts behind the solution of a second Zodiac Killer case message – and later brought to wider attention by Nick Pelling on his Cipher Mysteries blog.

Nick identified two contemporaneous reports on the cryptogram in archived issues of the Lima Times Democrat. The ciphertext version printed there differs slightly from the one later published by the National Puzzlers’ League. Since the Enigma author likely relied on the newspaper account, the Lima Times Democrat version is the most reliable basis for analysis. Here it is:

Was nvlvaft by aakat txpxsck upbk txphn ohay ybtx cpt mxhg wae sxfp zavfz ack there first txlk week wayx za with thx

The Lima Times Democrat even published a solution of the cryptogram:

This solution of the Ohio cryptogram doesn’t make sense — Source: Lima Times Democrat

However, it is immediately clear that this solution is wrong. It is extremely unlikely that a monoalphabetic substitution cipher (MASC) produces half a dozen meaningful words (THERE, FIRST, WEEK, ….) within one or two encrypted sentences. Even if one applies the table only to the cryptic-looking words, no readable cleartext appears.

A bandit’s telegram?

It is not known to me what exactly the relationship between the cryptogram and the robbery is. The most likely explanation is that this message is a telegram. Telegraphy was quite popular in 1916, and encrypting a telegram was nothing unusual. Usually, a codebook was used for this purpose. In fact, the train station robbery cryptogram looks exactly like a codebook-encrypted message. The sender left a few less important words (WAS, BY, FIRST, THX, …) in the clear, while he looked up the others in a codebook.

If the train station robbery cryptogram really is a telegram it seems possible that the robber sent it immediately before or after the act. Perhaps, the telegraphy clerk informed the police after having realized that he had dealt with a criminal.

Here’s an example of a codebook page (alas, it’s not the one that was used for the train station robbery cryptogram):

Page of a codebook

Codebooks were not only used for encryption but also for shortening messages (as you see on the example page above, a codeword like EGEUZ may stand for a longer expression, like “not concerned in failure-s (of)”). For this reason, many codebooks were public and underwent no major changes for many years. If somebody wanted to use a public codebook for encryption, he often applied an additional cipher, for instance by adding the current date to every codeword used.

If the train station robbery cryptogram is actually codebook-encrypted I’m afraid, it can only be solved if somebody finds the codebook that was used.

Of course, it is not absolutely granted that the train station robbery cryptogram was encrypted with a codebook. Other encryption techniques used in the time of the First World War are possible, too.

In any case, solving this crypto mystery might shed some additional light on an unsolved crime, which happened over a century ago.

Literature

Klaus Schmeh: Codeknacker gegen Codemacher. 2007

John McVey’s codebook page

Satoshi Tomokiyo’s codebook page

Back to Ciphers and Crime

The Somerton Man and the Tamam Shud cryptogram

On November 30, 1948, an unknown man appeared at Somerton Beach, a stretch of coastline just outside the city of Adelaide, Australia. Despite the summer heat, he was dressed in a suit—something that, was not entirely uncommon in Australia at the time. The following morning, his body was found.

The Somerton Man

Soon, this person became known as the “Somerton Man.” At the time of his death, he was estimated to be between 40 and 45 years old. His appearance was well-groomed, his body fit, and his clothing of high quality. The Somerton Man carried no meaningful personal belongings—no identification documents, nothing that could reveal his identity. All labels had been carefully removed from his clothing.

The police were unable to identify the Somerton Man. No one seemed to be missing him. Nobody recognized the man, although his picture was shown in numerous newspapers, on many websites, and on television programs in Australia and elsewhere. Even the cause of death remained unclear. The circumstances suggested poisoning, although no trace of any toxin could be detected with the methods available at the time. It is possible that the Somerton Man took his own life—but murder or natural causes could not be ruled out either.

 

AI-generated pictures of the Somerton Man

A few weeks after his death, a suitcase was discovered in the luggage storage at Adelaide railway station. It appeared to belong to the deceased. However, its contents—consisting mainly of ordinary travel items—provided little help to investigators. At least one detail became clearer: the Somerton Man had been at the station. It is believed that he may have arrived in Adelaide on a night train. After leaving his suitcase in storage, he likely took a bus to Somerton Beach.

The Tamam Shud cryptogram

Several months after the death of the Somerton Man, investigators discovered another clue in the pocket of his trousers: a carefully folded slip of paper bearing the words “Tamam Shud.” Police quickly determined that the fragment had been torn from a copy of The Rubaiyat of Omar Khayyam by Edward FitzGerald. This 19th-century collection of poetry was, and still is, very popular in the English-speaking world.

The Somerton Man had this message (Tamam Shud cryptogram) in his possession, but threw it away before he died.

Following a public appeal, a witness came forward who had found a copy of the book. It had apparently been thrown through the open window of his parked car. The torn slip of paper found in the dead man’s pocket clearly originated from this very copy. On the inside of the back cover, investigators discovered a handwritten sequence of letters with no obvious meaning—possibly a coded message. It read as follows (with some letters not clearly identifiable):

MRGOABABD
MLIAOI
MTBIMPANETP
MLIABOAIAQC
ITTMTSAMSTGAB

To this day, the message, now known as the “Tamam Shud cryptogram,” remains a mystery. Was it meant to be found? After all, the book had been left in a place where it was almost certain to attract attention.

Analysis of the cryptogram

Numerous codebreaking experts and amateur cryptologists have examined the “Tamam Shud cryptogram.” So far, no one has been able to present a convincing solution. Could it be a—albeit very short—suicide note? Might it contain a clue pointing to a murderer? Or is it nothing more than meaningless scribbling?

In my view, the most plausible hypothesis is that the cryptogram consists of the initial letters of English words. This idea is supported by the distribution of letters, as demonstrated in 2009 by the Australian students Andrew Turnbull and Denley Bihari. Perhaps the abbreviated words form a sentence when expanded.

But what purpose would such a cryptogram serve? Many people write down initials as memory aids, for example when trying to memorize a text. Was the author of these lines attempting to memorize a poem? None of the verses in The Rubaiyat of Omar Khayyam match these initials, and no other poem fitting this pattern has been identified so far.

Some interesting observations come from the Austrian cryptology expert and author Peter Lichtenberger. Let us assume that the cryptogram consists of five lines (the crossed-out “X” is therefore disregarded). According to Lichtenberger, the first letter may simply be a scribble caused by a pen that did not initially work. After writing the first line, the author began a second, but then realized that more space was needed. He crossed it out and rewrote it further below (the second and fourth lines begin almost identically). The third line may have been derived in some way from the first, and the fifth from the fourth. Both the third and fifth lines also begin with what appears to be a scribble—perhaps because the writer paused to think, allowing the pen to dry slightly. But in what way were the third and fifth lines derived from the others? Was some form of encryption involved? No one knows.

Identification of the Somerton Man

In July 2022, the scientists Derek Abbott and Colleen Fitzpatrick announced that they had determined that the Somerton Man was Carl “Charles” Webb, an electrical engineer and instrument maker born on 16 November 1905, in Footscray, a suburb of Melbourne. Abbott claimed his DNA identification from strands of hair found in the plaster death mask made by South Australian Police in the late 1940s. Through investigative genetic genealogy, matches were found for descendants of two distant cousins of Webb, on both the paternal and the maternal side.

Unfortunately, nothing new has come to light about Carl Webb since this alledged identification. It remains unclear why nobody recognized Webb in the photograph of the Somerton Man, though this picture became very popular in Australia. There is no information explaining why Webb was in Adelaide, why he carried no identification, or how he died. No photograph of Carl Webb has ever been published, so it is not possible to check if he looked like the Somerton Man.

It is also unknown why Webb had the note later known as the Tamam Shud cryptogram in his possession and why he threw away a copy of The Rubaiyat of Omar Khayyam. Most of all, the Tamam Shud cryptogram remains unsolved.

Literature

Craig Bauer: Unsolved!: The History and Mystery of the World’s Greatest Ciphers from Ancient Egypt to Online Secret. Princeton University Press 2017

Gary Feltus: The Unknown Man: A Suspicious Death at Somerton Beach. Port Campbell Press 2017

Klaus Schmeh: Nicht zu knacken. Hanser 2012

Back to Ciphers and Crime