The Encrypted Notes of Ricky McCormick

On June 30, 1999, the partially decomposed body of 41-year-old Ricky McCormick was discovered in a corn field in St. Charles County, Missouri. At first glance, the case appeared to be a grim but unremarkable homicide mystery: a man with health problems and a troubled background found dead far from home, with no obvious explanation for how he had arrived there.

The sheets

Yet investigators soon stumbled upon a detail that transformed the case into a cryptologic mystery. Hidden in McCormick’s trouser pockets were two handwritten sheets filled with strings of letters, numbers, dashes, and parentheses – notes that remain undeciphered to this day.

Ricky McCormick’s first encrypted note — Source: FBI

Ricky McCormick’s second encrypted note — Source: FBI

The discovery raised immediate questions. Were the notes encrypted messages? A personal shorthand? Random scribbles? Or perhaps instructions connected to a criminal activity? The text showed recurring combinations of capital letters, irregular formatting, and symbols that resisted conventional interpretation.

Ricky McCormick

McCormick himself added another layer of mystery. He had dropped out of school, reportedly struggled with literacy, and lived a precarious life in the St. Louis area. Family members later stated that he often wrote down strange-looking notes, although they strongly disputed the idea that he was capable of producing an elaborate secret code. His mother claimed that “the only thing he could write was his name,” while relatives suggested that his scribbles were closer to incomprehensible shorthand than deliberate encryption. The FBI, however, believed the notes could still contain meaningful information and treated them as potentially significant evidence.

The circumstances surrounding McCormick’s death only deepened the intrigue. He was last seen alive several days before his body was found, after visiting a hospital for ongoing respiratory problems. Investigators could not explain why he ended up in a rural area roughly fifteen miles from his residence, especially since he neither drove nor had easy access to transport to that location. Authorities were allegedly unable to determine a clear cause of death. As a result, both the homicide and the mysterious notes remained unresolved.

Publication

For more than a decade, the coded pages sat inside FBI files. Then, in March 2011, the agency made an unusual move: it released high-resolution images of the notes to the public and appealed for help. The FBI’s Cryptanalysis and Racketeering Records Unit (CRRU), assisted by outside experts including members of the American Cryptogram Association, had failed to crack the writing. Public codebreakers, amateur sleuths, and cryptography enthusiasts were invited to try their luck. The Bureau openly acknowledged that deciphering the text might reveal McCormick’s whereabouts shortly before his death – and perhaps even point toward a killer.

The response was immediate. Internet forums, cryptography communities, and amateur investigators proposed countless theories. Some interpreted the notes as geographic directions or drug-related instructions; others argued that the text represented a phonetic shorthand intelligible only to McCormick himself. Online discussions frequently return to one central question: was this actually a cipher at all? On forums devoted to mysteries and cryptanalysis, many commentators speculate that the writings may simply reflect an idiosyncratic personal notation rather than a deliberately concealed message.

Analysis

Here is a transcription of the first note:

(P1)
(MNDMUNEMRSE-N-STA-UNARE)  (AESM)
FRNENP?NSENPBSERCBBNSENPRSEINC
PRSE NMRSE OPREHLDULDNCBE(TFXLC TCXL NCBE)
AL-PRPPIT XLYPPIY NCBE MEKSEINCDRCBRNSEPRSE
WLD RCCBRNSE NT SSNENTXSE-CRSLE-CLTRSE WLD NCBE
ALWCP NCBETSMELRSERLSEURGLSNEASNWLDNCBE
(NOPFSE NLSRE NCBE) NTEGDDMNSENCURERCBRNE
(TENE TFRNE NCBRTSENCBE INC)
(FLRSE PQSE ONDE 71 NCBE)
(CDNSE PQSE ONSDE 74 NCBE)
(PRTSE PRSE ONREDE 75 NCBE)
(TF NBCMSPSOLEMRDELUSE TOTE WLDN WLDNCBE)
(194 WLD’S NCBE)(TRFXL)

This is the second note transcribed:

ALPNTE GLSE – SE RTE
VLSE MTSE-CTSE-WSE-FRTSE
PURTRSEONDRSEWLD NCBE
NWLDLRCMSP NEWLD STS MEXL
DULMT 6 TUNSE NCBEXE
(MUNSAISTEN MU NARSE)
KLSE-LRSTE-TRSE-TRSE-MKSEN-MRSE
(SAESNSE SE N MRSE)

NMNRCBRNSEPTE2PTEWSRCBKNSE
26 MLSE 74 SPRKSE 29KCNOB,OLE 175 RTRSE
35 GLE CLGSE UUNUTKEBKRSE PSESHLE
651 MTCSE HTLSE NCUTC TRQ NMRE
99.84.52 UNEPLSEUCRSEAOLTSENSKSENRSE
NSREONSE PUTSEWLD NCBE (3 XORL)

DNMSE NRSE 1N2 NTRLERC BANSENTSECRSNE
LSPNSENGSPSEMKSERBSGNCBENUXLR
MH CRE NMRE NCBE  1/2 MUNDDLSE
D-W-M-4 MPL XDRLX

The letters E, N, and S appear unusually often, while K, Q, X, and Z occur only rarely. This distribution appears broadly consistent with ordinary English. Such a pattern is consistent with a transposition cipher. Certain letter combinations recur with notable frequency: SE appears particularly often, while sequences such as WLD and NCBE are also repeated. No conventional cipher model has yet provided a satisfactory explanation.

Despite years of speculation, no consensus has emerged. The notes remain officially undeciphered, and McCormick’s death unsolved. Unlike many famous cryptograms, the puzzle offers no obvious key, no confirmed plaintext, and not even certainty that encryption is involved. More than twenty-five years after a dead man was found carrying two sheets of cryptic symbols, investigators and codebreakers alike still face the same unsettling possibility: the meaning may be hidden in plain sight – or perhaps lost forever.

Literature

Craig Bauer: Unsolved! The History and Mystery of the World’s Greatest Ciphers. Princeton University Press 2017

Back to Unsolved Crypto Mysteries

The Ohio cryptogram

On June 27, 1916, a man robbed the ticket counter of the Western Ohio Railway in Lima, Ohio. Brandishing a gun, he forced the ticket agent to hand over the contents of the safe, then fled with $265.

This ticket-counter robber left behind an encrypted message — Source: AI-generated

A few weeks later, the magazine Enigma, published by the National Puzzlers’ League, wrote:

The police department of Lima, O., is greatly puzzled over a cryptic message received in connection with the robbery of a Western Ohio ticket agent. Here it is: WAS NVKVAFT BY AAKAT TXPXSCK UPBK TXPHN OHAY YBTX CPT MXHG WAE SXFP ZAVFZ ACK THERE FIRST TXLK WEEK WAYX ZA WITH THX.

An encrypted message

This cipher and its accompanying true-crime story were uncovered by Dave Oranchak – one of the cryptanalysts behind the solution of a second Zodiac Killer case message – and later brought to wider attention by Nick Pelling on his Cipher Mysteries blog.

Nick identified two contemporaneous reports on the cryptogram in archived issues of the Lima Times Democrat. The ciphertext version printed there differs slightly from the one later published by the National Puzzlers’ League. Since the Enigma author likely relied on the newspaper account, the Lima Times Democrat version is the most reliable basis for analysis. Here it is:

Was nvlvaft by aakat txpxsck upbk txphn ohay ybtx cpt mxhg wae sxfp zavfz ack there first txlk week wayx za with thx

The Lima Times Democrat even published a solution of the cryptogram:

This solution of the Ohio cryptogram doesn’t make sense — Source: Lima Times Democrat

However, it is immediately clear that this solution is wrong. It is extremely unlikely that a monoalphabetic substitution cipher (MASC) produces half a dozen meaningful words (THERE, FIRST, WEEK, ….) within one or two encrypted sentences. Even if one applies the table only to the cryptic-looking words, no readable cleartext appears.

A bandit’s telegram?

It is not known to me what exactly the relationship between the cryptogram and the robbery is. The most likely explanation is that this message is a telegram. Telegraphy was quite popular in 1916, and encrypting a telegram was nothing unusual. Usually, a codebook was used for this purpose. In fact, the train station robbery cryptogram looks exactly like a codebook-encrypted message. The sender left a few less important words (WAS, BY, FIRST, THX, …) in the clear, while he looked up the others in a codebook.

If the train station robbery cryptogram really is a telegram it seems possible that the robber sent it immediately before or after the act. Perhaps, the telegraphy clerk informed the police after having realized that he had dealt with a criminal.

Here’s an example of a codebook page (alas, it’s not the one that was used for the train station robbery cryptogram):

Page of a codebook

Codebooks were not only used for encryption but also for shortening messages (as you see on the example page above, a codeword like EGEUZ may stand for a longer expression, like “not concerned in failure-s (of)”). For this reason, many codebooks were public and underwent no major changes for many years. If somebody wanted to use a public codebook for encryption, he often applied an additional cipher, for instance by adding the current date to every codeword used.

If the train station robbery cryptogram is actually codebook-encrypted I’m afraid, it can only be solved if somebody finds the codebook that was used.

Of course, it is not absolutely granted that the train station robbery cryptogram was encrypted with a codebook. Other encryption techniques used in the time of the First World War are possible, too.

In any case, solving this crypto mystery might shed some additional light on an unsolved crime, which happened over a century ago.

Literature

Klaus Schmeh: Codeknacker gegen Codemacher. 2007

John McVey’s codebook page

Satoshi Tomokiyo’s codebook page

Back to Ciphers and Crime

The Somerton Man and the Tamam Shud cryptogram

On November 30, 1948, an unknown man appeared at Somerton Beach, a stretch of coastline just outside the city of Adelaide, Australia. Despite the summer heat, he was dressed in a suit—something that, was not entirely uncommon in Australia at the time. The following morning, his body was found.

The Somerton Man

Soon, this person became known as the “Somerton Man.” At the time of his death, he was estimated to be between 40 and 45 years old. His appearance was well-groomed, his body fit, and his clothing of high quality. The Somerton Man carried no meaningful personal belongings—no identification documents, nothing that could reveal his identity. All labels had been carefully removed from his clothing.

The police were unable to identify the Somerton Man. No one seemed to be missing him. Nobody recognized the man, although his picture was shown in numerous newspapers, on many websites, and on television programs in Australia and elsewhere. Even the cause of death remained unclear. The circumstances suggested poisoning, although no trace of any toxin could be detected with the methods available at the time. It is possible that the Somerton Man took his own life—but murder or natural causes could not be ruled out either.

 

AI-generated pictures of the Somerton Man

A few weeks after his death, a suitcase was discovered in the luggage storage at Adelaide railway station. It appeared to belong to the deceased. However, its contents—consisting mainly of ordinary travel items—provided little help to investigators. At least one detail became clearer: the Somerton Man had been at the station. It is believed that he may have arrived in Adelaide on a night train. After leaving his suitcase in storage, he likely took a bus to Somerton Beach.

The Tamam Shud cryptogram

Several months after the death of the Somerton Man, investigators discovered another clue in the pocket of his trousers: a carefully folded slip of paper bearing the words “Tamam Shud.” Police quickly determined that the fragment had been torn from a copy of The Rubaiyat of Omar Khayyam by Edward FitzGerald. This 19th-century collection of poetry was, and still is, very popular in the English-speaking world.

The Somerton Man had this message (Tamam Shud cryptogram) in his possession, but threw it away before he died.

Following a public appeal, a witness came forward who had found a copy of the book. It had apparently been thrown through the open window of his parked car. The torn slip of paper found in the dead man’s pocket clearly originated from this very copy. On the inside of the back cover, investigators discovered a handwritten sequence of letters with no obvious meaning—possibly a coded message. It read as follows (with some letters not clearly identifiable):

MRGOABABD
MLIAOI
MTBIMPANETP
MLIABOAIAQC
ITTMTSAMSTGAB

To this day, the message, now known as the “Tamam Shud cryptogram,” remains a mystery. Was it meant to be found? After all, the book had been left in a place where it was almost certain to attract attention.

Analysis of the cryptogram

Numerous codebreaking experts and amateur cryptologists have examined the “Tamam Shud cryptogram.” So far, no one has been able to present a convincing solution. Could it be a—albeit very short—suicide note? Might it contain a clue pointing to a murderer? Or is it nothing more than meaningless scribbling?

In my view, the most plausible hypothesis is that the cryptogram consists of the initial letters of English words. This idea is supported by the distribution of letters, as demonstrated in 2009 by the Australian students Andrew Turnbull and Denley Bihari. Perhaps the abbreviated words form a sentence when expanded.

But what purpose would such a cryptogram serve? Many people write down initials as memory aids, for example when trying to memorize a text. Was the author of these lines attempting to memorize a poem? None of the verses in The Rubaiyat of Omar Khayyam match these initials, and no other poem fitting this pattern has been identified so far.

Some interesting observations come from the Austrian cryptology expert and author Peter Lichtenberger. Let us assume that the cryptogram consists of five lines (the crossed-out “X” is therefore disregarded). According to Lichtenberger, the first letter may simply be a scribble caused by a pen that did not initially work. After writing the first line, the author began a second, but then realized that more space was needed. He crossed it out and rewrote it further below (the second and fourth lines begin almost identically). The third line may have been derived in some way from the first, and the fifth from the fourth. Both the third and fifth lines also begin with what appears to be a scribble—perhaps because the writer paused to think, allowing the pen to dry slightly. But in what way were the third and fifth lines derived from the others? Was some form of encryption involved? No one knows.

Identification of the Somerton Man

In July 2022, the scientists Derek Abbott and Colleen Fitzpatrick announced that they had determined that the Somerton Man was Carl “Charles” Webb, an electrical engineer and instrument maker born on 16 November 1905, in Footscray, a suburb of Melbourne. Abbott claimed his DNA identification from strands of hair found in the plaster death mask made by South Australian Police in the late 1940s. Through investigative genetic genealogy, matches were found for descendants of two distant cousins of Webb, on both the paternal and the maternal side.

Unfortunately, nothing new has come to light about Carl Webb since this alledged identification. It remains unclear why nobody recognized Webb in the photograph of the Somerton Man, though this picture became very popular in Australia. There is no information explaining why Webb was in Adelaide, why he carried no identification, or how he died. No photograph of Carl Webb has ever been published, so it is not possible to check if he looked like the Somerton Man.

It is also unknown why Webb had the note later known as the Tamam Shud cryptogram in his possession and why he threw away a copy of The Rubaiyat of Omar Khayyam. Most of all, the Tamam Shud cryptogram remains unsolved.

Literature

Craig Bauer: Unsolved!: The History and Mystery of the World’s Greatest Ciphers from Ancient Egypt to Online Secret. Princeton University Press 2017

Gary Feltus: The Unknown Man: A Suspicious Death at Somerton Beach. Port Campbell Press 2017

Klaus Schmeh: Nicht zu knacken. Hanser 2012

Back to Ciphers and Crime