One evening in January last year, Joel Eriksson, a 34-year-old computer analyst from Uppsala in Sweden, was trawling the web looking for distraction when he came across a message on an internet forum. The message was in stark white type against a black background.
"Hello," it said. "We are looking for highly intelligent individuals. To find them, we have devised a test. There is a message hidden in this image. Find it, and it will lead you on the road to finding us. We look forward to meeting the few that will make it all the way through. Good luck."
The message was signed: "3301".
A self-confessed IT security "freak" and a skilled cryptographer, Eriksson's interest was immediately piqued.
Sleepily - it was late, and he had work in the morning - Eriksson thought he'd try his luck at decoding the message from 3301. After only a few minutes' work he'd got somewhere: a reference to "Tiberius Claudius Caesar" and a line of meaningless letters. Joel deduced it might be an embedded Caesar cipher - an encryption technique named after Julius Caesar, who used it in private correspondence. It replaces characters by a letter a certain number of positions down the alphabet. As Claudius was the fourth emperor, it suggested "four" might be important - and lo, within minutes, Eriksson found another web address buried in the image's code.
Feeling satisfied, he clicked the link.
It was a picture of a duck with the message: "Woops! Just decoys this way. Looks like you can't guess how to get the message out."
"It seemed like the challenge was a bit harder than a Caesar cipher after all. I was hooked," said Eriksson.
He didn't realise it then but he was embarking on one of the internet's most enduring puzzles; a hunt that has led thousands of competitors across the web, down telephone lines, out to several physical locations around the globe, and into uncharted areas of the "darknet". So far, the hunt has required a knowledge of number theory, philosophy and classical music. An interest in both cyberpunk literature and the Victorian occult has also come in handy, as has an understanding of Mayan numerology.
It has also featured a poem, a tuneless guitar ditty, a femme fatale called "Wind" who might or might not exist, and a clue on a lamppost in Hawaii. Only one thing is certain: as it stands, no one is entirely sure what the challenge - known as Cicada 3301 - is all about or who is behind it.
Depending on whom you listen to, it's either a mysterious secret society, a statement by a new political think tank, or an arcane recruitment drive by some quasi-military body. Which means, of course, everyone thinks it's the CIA.
For some, it's just a fun game, like a more complicated Sudoku; for others, it has become an obsession.
On the night of January 5 2012, after reading the "decoy" message from the duck, Eriksson began to tinker with other variables. Taking the duck's mockery as a literal clue, Eriksson decided to run it through a decryption program called OutGuess. Success: another hidden message, this time a link to another message board on the massively popular news forum Reddit. Here, encrypted lines from a book were being posted every few hours. But there were also strange symbols comprising several lines and dots - Mayan numbers, Eriksson realised. And, translated, they led to another cipher.
Until now, Eriksson would admit, none of the puzzles had really required any advanced skills.
"But then it all changed," he said. "Things started getting interesting."
Suddenly, the encryption techniques jumped up a gear. And the puzzles mutated in several directions: hexadecimal characters, reverse engineering, prime numbers. Pictures of the cicada insect became a common motif.
"I knew cicadas emerge only every prime number of years - 13, or 17 - to avoid synchronising with the life cycles of their predators," said Eriksson. "It was all starting to fit together."
The references became more arcane too. The book, for example, turned out to be The Lady of the Fountain, a poem about King Arthur taken from The Mabinogion, a collection of medieval Welsh manuscripts.
Later, the puzzle would lead him to the cyberpunk writer William Gibson - specifically his 1992 poem Agrippa, infamous for the fact that it was published only on a 3.5-inch floppy disk and was programmed to erase itself after being read once.
As word spread across the web, thousands of amateur code breakers joined the hunt for clues. Armies of users of 4chan, the anarchic internet forum on which the first Cicada message is thought to have appeared, pooled their collective intelligence - and endless free time - to crack the puzzles.
Within hours they'd decoded The Lady of the Fountain. The new message, however, was another surprise: "Call us," it read, "at telephone number 214-390-9608". By this point, only a few days after the original image had been posted, Eriksson had taken time off work to join the pursuit full-time.
"This was an unexpected turn," he recalled, "and the first hint that this might not just be the work of a random internet troll."
The number connected to an answering machine in Texas. The robotic voice told the solvers to find the prime numbers in the original image. By multiplying them together, they found a new prime and a new website: 845145127.com. A countdown clock and a huge picture of a cicada confirmed that they were on the right path.
But the plot was about to thicken even more. Once the countdown reached zero, at 5pm GMT on January 9, it showed 14 GPS coordinates around the world: locations in Warsaw, Paris, Seattle, Seoul, Arizona, California, New Orleans, Miami, Hawaii and Sydney. Sitting in Sweden, Eriksson waited as, around the globe, amateur solvers went out to investigate. One by one they reported what they'd found: a poster, attached to a lamppost, bearing the cicada image and a QR code (the black-and-white bar code that takes your smartphone to a website).
"It was exhilarating," said Eriksson. "I was suddenly aware of how much effort they must have been putting into creating this challenge."
For the growing Cicada community it was proof that this wasn't merely some clever neck-beard in a basement winding people up but actually a global organisation of talented people. But who?
One long, cautionary diatribe, left anonymously on the website Pastebin, claimed to be from a former Cicada member - a non-English military officer recruited to the organisation "by a superior".
Cicada, he said, "was a left-hand path religion disguised as a progressive scientific organisation" made up of "military officers, diplomats, and academics who were dissatisfied with the direction of the world". Their plan, the writer claimed, was to transform humanity into the Nietzschen Übermensch.
"This is a dangerous organisation," he concluded, "their ways are nefarious."
With no other clues, some assumed that the CIA, or a similar agency, was secretly trying to identify the world's most talented cryptologists with the intention of recruiting some of them.
When the QR codes left on the lampposts were decoded, a hidden message pointed the solvers towards The Onion Router, an obscure routing network that allows anonymous access to the "darknet", the vast, murky portion of the internet that cannot be indexed by standard search engines. I t's in these recesses that you'll find human-trafficking rings, black-market drugs and terrorist networks. And it was here that the Cicada path ended.
After a designated number of solvers visited the address, the website shut down with a terse message: "We want the best, not the followers." The chosen few received personal e-mails - saying what, none has said.
Eriksson, however, was not among them.
"It was my biggest anticlimax when I was too late to register," he said.
A few weeks later, a new message from Cicada was posted on Reddit. It read: "Hello. We have now found the individuals we sought. Thus our month-long journey ends. For now."
Except no. On January 4 this year, something new. A fresh image, with a new message in the same white text: "Hello again. Our search for intelligent individuals now continues." Analysis of the image would reveal another poem - this time from the book Liber Al Vel Legis, by the English occultist Aleister Crowley. From there, the solvers downloaded a 130Mb file containing thousands of prime numbers. And also an MP3 file: a song called The Instar Emergence by the artist 3301, which begins with the sound of - guess what - cicadas.
Analysis of that has since led to a Twitter account pumping out random numbers, which in turn produced a gematria: an ancient Hebrew code table, but this time based on Anglo-Saxon runes. This pointed the solvers back into the darknet, where they found seven new physical locations, from Dallas to Moscow to Okinawa, and more clues. But that's where, once again, the trail has gone cold. Another select group of "first solvers" has been accepted into a new "private" puzzle - this time, say reports, a kind of Myers-Briggs multiple-choice personality test.
We are no closer to knowing the source, or purpose, of Cicada 3301.
- January 4 2014: that's when the next set of riddles is due to begin appearing and maybe all will be revealed - but don't count on it.
