It’s perhaps the most enigmatic and intriguing thing on the internet, which promises an “epiphany” when you solve it. No one knows who sets it or what the prize is at the end, but Cicada 3301 has posted mysterious, extremely difficult puzzles for three years in a row, in an attempt to recruit and enlighten the best cryptanalysts from the public.

What is Cicada 3301

The first Internet puzzle started on January 5, 2012 and ran for approximately one month. A second round began exactly one year later on January 5, 2013, and a third round was set up in 2014 as well. Claiming to seek “highly intelligent individuals,” the Cicada 3301 puzzle challenged visitors to find a secret message hidden in the image that accompanied it.

OK, this is probably getting pretty weird by now – what exactly is Cicada 3301? Even the name is cryptic – an insect, and an apparently meaningless prime number, what does it all mean? We don’t know, and few people in the world do. They just post things like this:

“Hello. We are looking for highly intelligent individuals. To find them, we have devised a test. There is a message hidden in the image. Find it, and it will lead you on the road to finding us. We look forward to meeting the few who will make it all the way through. Good luck.”

These are not your everyday “spend an afternoon solving them” puzzles. These are highly difficult, highly cryptic puzzles.  To understand just how hard they are, you need to look at the complexity of each clue that leads to successive parts of the puzzle–all which need to be completed in order to solve the Cicada mystery. Each message leads to a puzzle, each puzzle more difficult than the last.

Maybe the first thing that comes to mind is – isn’t it all just a hoax? Couldn’t it all be just a very elaborate internet troll, having a laugh making all these people work through his puzzles? That’s highly unlikely. Throughout the testing, multiple clues have required participants to travel to various places to retrieve the next clue – the places include several locations in the US, as well as Australia, Granada (Spain), Moscow (Russia), Okinawa (Japan), Warsaw (Poland), and Paris (France). These clues appeared virtually at the same time, suggesting an organized project. Furthermore, the complexity of the puzzles, and the variety of mediums they were posted on suggests a resourceful organization, willing to spend lots of money to their end – so not an internet troll. The mentioned mediums included telephone, original music, bootable Linux CDs, digital images, physical paper signs, and pages of unpublished cryptic books.

Could it be a top notch organization, like the CIA, or MI6, or some other organization? They certainly have the resources for it, but that’s also very unlikely. While these organizations do conduct unconventional ways to recruit people from the the general population, they always make this public. They announce the competition, they announce what it’s for, it’s a very different procedure.

The other plausible is that banks working on cryptocurrency are behind Cicada, but that’s also unlikely, due to the nature of the puzzles. The puzzles are all … rebellious, advocating (more or less subtly) a right to privacy, a fight against a 1984-like controlling system, pretty much the opposite of what you’d expect from banks. Speaking of the puzzles…

The Cicada puzzles

The first puzzle was posted in 2012, initially on one of 4chan’s boards, which is arguably one of the best places you’d expect something like this to pop up. The first image said:

“Hello. We are looking for highly intelligent individuals. To find them, we have devised a test.

“There is a message hidden in this image.

“Find it, and it will lead you on the road to finding us. We look forward to meeting the few that will make it all the way through.

“Good luck.”

It was signed “3301”. Joel Eriksson, a 34-year-old cryptosecurity researcher and developer from Sweden, is one of the few known people to have almost solved it all the way through. To crack the code hidden in the first picture, he used a steganography software to extract a message encoded with a shift cipher – each letter corresponds to another letter. After he decoded the cypher, it led him to an URL with the image of a duck.

Here, another steganographic approach revealed a hidden book code of a list of two numbers separated by a colon. The book then led to a Reddit address with Mayan numerals on the top of the page. Things were starting to get trickier and trickier. He noticed that several posts published by a user seemed to consist of encoded text, which could be decoded with the code from the book. After working through this code, he was led to two different images, which also contained hidden messages, ultimately leading him to a phone number in Texas. Calling the phone number led to a voicemail that read:

“Very good. You have done well. There are three prime numbers associated with the original final.jpg image. 3301 is one of them. You will have to find the other two. Multiply all three of these numbers together and add a .com to find the next step. Good luck. Goodbye.”

After he did the math, he reached a URL which told him to come back at a certain time. When he did, the URL revealed a series of numbers, which were GPS coordinates to telephone poles in countries around the world, including in Spain, Russia, America, France, Japan, and Poland. Of course, it’s not possible to travel all around the world and look for codes, so he had to rely on the help of other people working on the Cicada puzzles. As it turns out, the GPS coordinates yielded QR codes which lead to another two images, inside of which were more hidden text, including text from what Eriksson found was the William Gibson poem Agrippa, which was only released on 3.5 inch floppies.

Using the same code from the previous book which he used on Reddit, he went through another series of puzzles (including a poem from a collection of medieval Welsh manuscripts), and he was led to a website on the Tor network – which was the last stop, the ultimate destination of the riddles. But the timing was wrong. Cicada 3301 sniffed out that people across the world were collaborating to solve the problems, and only the quickest ones to reach it were rewarded. Shortly afterwards, it was blanked, and replaced with the statement “We want the best, not the followers.” That year, Cicada was over.

Eriksson was disappointed – especially as he started working on the puzzles one week later than everybody else.

“It was quite disappointing,” Eriksson says. “Especially considering that the people who registered in time were mostly ones that had not actually solved much of the puzzles themselves. People were sharing solutions and collaborating a bit too much.”

However, the fact that he got to the last stage all by himself, and almost one week quicker than anybody else is remarkable; and he also learned a lot about Cicada in the process.

“Getting a phone number to call after solving one of the pieces of the puzzle was the first hint that this might not just be the work of a random Internet troll. This was definitely an unexpected turn,” Eriksson says. “The plot thickened even more when receiving a number of GPS coordinates. I also can’t help but to notice that the locations in question–USA, Poland, France, South Korea, and Australia–are all places with some of the most talented hackers and IT security researchers in the world.”

He too believes that whoever is behind the Cicada organization, it’s not something like the CIA or NSA, or any bank or financial enterprise. He too mentions that in the process of solving the riddles, he found many references and clues suggesting that the organization is extremely different in nature.

“It is most likely an underground organization, not related to any government or intelligence agency,” he says. “Based on the references in their challenges–the Agrippa poem by William Gibson, The Marriage of Heaven and Hell by William Blake, The Book of The Law by Aleister Crowley–and their constant references to prime numbers and the like, they are likely intellectual, anti-establishment, ideologically driven and they seem to be valuing logical/analytical thinking highly. They seem to share a lot of ideology with the cryptoanarchy movement, and old-school hackers.”

Most people expected it to be a one time thing, but on January 5 2013, exactly a year and a day after the first posting, a new image was uploaded onto 4chan’s /b/ message board.

“Hello again. Our search for intelligent individuals now continues,” it began.

The puzzles were different, but similar in nature, the references were different, and similar in nature, and just like the first time, the final URL was closed shortly before it was opened – deeming only the very first ones as winners. For people who had failed 2 years in a row, there was nothing left to do except for wait for the 2014 challenge – which came.

Rather than an image posted on 4chan, the 2014 Cicada puzzles started on a Twitter feed which had been involved in 2013’s hunt. Again, they shared a cryptical image, and the nature of the contest seemed to be identical. There’s a really good article in The Guardian, where one editor describes his attempt, and ultimate failure, at solving all the puzzles.

The only piece of half-reliable information we have about who or what Cicada is and what they want comes from a leaked email from one of the ‘winners’ of the 2012 challenge. It reads:

“You have all wondered who we are,” it reads in part, “and so we shall now tell you. We are an international group. We have no name. We have no symbol. We have no membership rosters. We do not have a public website and we do not advertise ourselves. We are a group of individuals who have proven ourselves, much like you have, by completing this recruitment contest, and we are drawn together by common beliefs. A careful reading of the texts used in the contest would have revealed some of these beliefs: that tyranny and oppression of any kind must end, that censorship is wrong and that privacy is an inalienable right.”

My thoughts on Cicada

If this is indeed true, then there is one organization (sort of), which seems very congruent with Cicada: Anonymous. Anonymous is a very odd phenomenon, a loosely associated international network of activist and hacktivist entities. A website nominally associated with the group describes it as “an internet gathering” with “a very loose and decentralized command structure that operates on ideas rather than directives” – but they usually like to keep a low profile, popping up only when they really want to.

They’ve done some good things, and some bad things, that’s not the point of discussion here. The thing is, they too stand for the right to privacy, fighting against tyranny and oppression; they too are an international underground organization who don’t advertise themselves, and have proven themselves through numerous actions. To say that there is any connection between Cicada and Anonymous is quite a leap, and there is nothing more than half-reliable circumstantial evidence to that, but there definitely are some similarities between the two.

So we are now left with the question: is it a good thing that a mysterious, rebellious organization who claims to protect rights and fight tyranny is gathering some of the world’s brightest minds through a series of enigmatic puzzles every year? I’m not sold here. I don’t like the way most websites handle my personal data nowadays. I dislike the fact that Facebook is using my personal data as a product, I dislike that Google shows different things based on your history, I dislike the fact that everyone is trying to shove “targeted ads” down my throat. There is no privacy on the internet, even when theoretically and legally, there should be. Whoever is doing this is obviously highly intelligent, resourceful, and is gathering more and more likewise people, so they have every chance to accomplish big things.

Do I want an underground organization protecting my privacy? Sure, why not – the “traditional” system clearly failed us on this one. Do I somewhat doubt their well intentions? Yes, for sure. I don’t know what their end game is. They imply it’s positive, but we have no reason to think one way or another. But perhaps the most important question is: Can they end up doing more wrong than right, even if they have good intentions? I don’t have an answer to that, but I have a feeling we may find out pretty soon. After all, it’s been three years since they’ve recruiting people.

The other thing which is tempting to connect Cicada with is Bitcoin. Bitcoin is a peer-to-peer payment system introduced as open source software in 2009 – you could call it a virtual currency, although it does not meet the generally recognized definition of money; the US government calls it a decentralized currency. In the past couple of years, Bitcoin has grown by a factor of over 100, in the past 2 years, fluctuating massively in short periods of time, making some people very rich, and making others lose a lot of money. It was developed by the alias Satoshi Nakamoto – whose identity is not known. Some people believe that it is actually not a man, but a group of people, due to the massive and ingenious work that was put into bitcoins (starting to see the pattern?).

Bitcoins are not backed up in gold or any other commodity, but they are created as a reward for payment processing work in which users who offer their computing power verify and record payments into a public ledger. Keeping Bitcoins free and autonomous requires a lot of top notch work, especially as they grow more and more. Him/they would need talented people to work, and would also probably like to keep the whole operation low profile, controlling it and keeping it away from the mainstream media until the time is ripe. You’d also want people of a certain psychological profile, which could be communicated and represented through the allusions in the puzzles. They would also have the resources and the motivation to do something of this scale, so it seems to fit very well.

Or maybe it’s something else – maybe it’s an evil organization, maybe it’s aliens, or a fanatical religious group, I don’t know. I’ve tried my best to come up with answers, and that’s the best I got. I guess, all we have left to do is to wait and see if Cicada 3301 will make a return next year, and keep an eye out. Many people expected Cicada 2014 to be the biggest and final one – we’ll see.