On 4 January 2012, a plain white-on-black image appeared on the 4chan message board /b/. The text read:
"Hello. We are looking for highly intelligent individuals. To find them, we have devised a test. There is a message hidden in this image. Find it, and it will lead you on the road to finding us. We look forward to meeting the few that will make it all the way through. Good luck. 3301"
It looked exactly like the thousands of hoaxes posted to that board every week. It was not.
The first steps
Someone opened the image in a text editor, which is the standard first move for hidden data in image files. Appended after the image data was a block of text — a Caesar cipher, the simplest classical cipher there is, shifting each letter a fixed number of places.
Decoded, it produced a taunt and a reference to Tiberius Claudius Caesar, along with a string. The Tiberius reference was the hint: Claudius was the fourth Caesar, indicating a shift of four. Solving that gave a URL, which led to an image of a duck with the message "Whoops! Just decoys this way. Looks like you can't guess how to get the message out."
"Guess" and "out" were the clue. OutGuess is a real steganography tool for extracting data hidden inside images. Running it on the duck image produced a text file containing a Reddit link and a book code — a list of numbers referencing lines and characters in a text.
From there the puzzle escalated relentlessly. Over the following weeks it involved:
- Runes from the Anglo-Saxon futhorc alphabet, with their own consistent substitution scheme
- Book ciphers keyed to specific editions of William Gibson's unpublished poem Agrippa and to Mabinogion, a collection of medieval Welsh tales
- Numbers stations — shortwave radio broadcasts of spoken numbers used historically by intelligence services
- Hidden services on Tor requiring specific onion addresses
- A phone number in Texas which, when called, played a recorded message with further numbers
- Music files with data in the spectrogram
- MIDI files, prime numbers, and the mathematical constant e
The posters
The moment the puzzle stopped looking like one person's clever afternoon came in mid-January 2012. One clue produced a set of GPS coordinates — fourteen locations across the United States, Poland, France, Germany, Spain, South Korea, Japan, Australia, Russia, Hawaii and elsewhere.
Participants who travelled to those coordinates found physical posters taped to lampposts and walls: a picture of a cicada, a QR code, and the number 3301.
Whoever was running this had coordinated the placement of physical objects in fourteen countries on multiple continents, at the same time, anonymously. That single fact rules out most casual explanations. It requires either an organisation, or a group with willing contacts spread across the world, or a great deal of money.
The QR codes led to further Tor addresses, which eventually asked solvers for their email addresses. Those who reached the end reported being contacted privately and invited into a private forum with other finishers.
What happened inside
This is where the record thins out, and where it remains thin.
Finishers who spoke publicly said the private space contained tasks and discussion oriented around cryptography, privacy and the belief that individual privacy is an inherent right being eroded. Several said they were asked to work on projects, and at least one reported being asked to sign a non-disclosure agreement. Some described the group as focused on building privacy-preserving software. Others said very little happened at all and the private forum went quiet.
There is no verified account of what, if anything, the group actually produced. Everyone who has described the inside has described it second-hand or has declined to give specifics.
The sequels, and the signature
A second puzzle launched on 4 January 2013, exactly one year later. A third followed on 4 January 2014. Both were harder. Both were authenticated the same way: messages from Cicada 3301 were signed with a PGP private key.
That detail matters more than anything else in the story. PGP signatures cannot be forged without the private key. It means that every genuine Cicada communication across years can be cryptographically linked to the same holder of that key, and it means the many imitators who appeared afterwards could be dismissed conclusively.
In April 2017 a final signed message appeared, stating in effect that the group had been infiltrated by unsigned messages and warning that nothing unsigned should be trusted. After that, silence. Numerous puzzles have since claimed the Cicada name; none has carried a valid signature.
Theories about who ran it
- An intelligence agency recruiting cryptographers. The NSA, GCHQ and others have historically used public puzzles for recruitment, and Cicada's skill profile — steganography, classical and modern cryptography, radio, Tor — maps closely onto signals intelligence work. The counter-argument is straightforward: agencies do not need anonymous global lamppost posters, and the material was explicitly critical of surveillance and pro-privacy, which sits awkwardly with agency authorship.
- A privacy or cypherpunk collective. This fits the stated ideology, the technical taste, and the interest in recruiting rather than publicising. It is the most widely held theory among participants.
- A recruitment exercise by a private security firm or a group building an anonymity tool. Plausible, but no product has ever surfaced credibly attached to the name.
- An elaborate alternate reality game or art project. Fits the aesthetics; struggles to explain the multi-year commitment and the international logistics.
- A single wealthy individual with contacts abroad. Not impossible, but the coordination is demanding for one person.
No theory has been confirmed. In fourteen years no participant has produced verifiable evidence of the organisers' identity — which, for an internet mystery involving thousands of people, is itself remarkable. Internet secrets of this scale usually leak.
Why it holds up as a mystery
Most unexplained internet phenomena fail one of two tests. Either they turn out to be trivially explainable, or they are so vague that there is nothing to solve.
Cicada 3301 fails neither. The puzzles were real, solvable, and independently verified by hundreds of people working in public. The physical posters were photographed by unconnected strangers in different countries. The PGP signatures provide a cryptographic chain of authenticity that cannot be faked. And the central question — who built it, and for what — has never been answered.
It is one of the very few internet mysteries where the evidence is abundant and the conclusion is still missing.
Summary
Cicada 3301 was a series of cryptographic puzzles posted anonymously between 2012 and 2014, of a technical standard far above the usual internet puzzle, backed by physical posters placed simultaneously in fourteen countries and authenticated throughout with PGP signatures from a single unidentified key holder.
Some people solved it. Some were contacted. None of them has produced proof of who was on the other end. The last verified message was posted in 2017, and the key has been silent ever since.
The puzzles are still online. They have all been solved. The only unsolved part is the part the puzzles were designed to lead to.
Be the first to share a thought.