The new cryptographers

Sometimes, in one of the thousands of cipher solutions David Oranchak was studying, he would see whole words stand out from the garbled alphabetic noise and wonder: Is this the one?

Oranchak, a Roanoke-based software developer and a 1997 computer engineering graduate of Virginia Tech, had been working with Australian applied mathematician Sam Blake and Belgian warehouse operator and programmer Jarl Van Eycke to produce and examine the solutions since March 2020.

The hope was that in one of them, the trio would find the message sent by the self-described Zodiac, the man responsible for five murders committed in the San Francisco Bay Area from December 1968 to October 1969. Published by the San Francisco Chronicle on November 12, 1969, the cipher was the second of four the Zodiac had written for the police, the papers, and the public, and along with his identity, it had gone unsolved for more than half a century.

Oranchak, Blake, and Van Eycke had produced their cipher solutions in several steps broken up between them: Blake rearranged the second cipher's 340 symbols in 650,000 ways, moving them around in unique patterns using a technique known as transposition in cryptography, the age-old practice of making and breaking codes. He sent the variations in batches to Oranchak, who fed them through a program Van Eycke had designed to decrypt the symbols into plain English text.

While a handful of the solutions Oranchak sifted made him pause, none made him stop. He would set a few aside and keep moving through the thousands left, until December 3, 2020. 

Two phrases jolted him: “HOPE YOU ARE TRYING TO CATCH ME.” “THE GAS CHAMBER.” The second made Oranchak think back to October 22, 1969, a moment in Zodiac history he had once read about. That morning, a man claiming to be the killer had called into a live television show, “A.M. San Francisco,” to speak to host Jim Dunbar and attorney Melvin Belli.

“I don’t want to go to the gas chamber,” the caller told Dunbar and Melli. He said he didn’t want to be hurt. “You’re not going to the gas chamber,” Dunbar responded as the pair tried to coax information out of the caller, whose claim on the Zodiac's identity was later disproved by police.

The second cipher went out a few weeks later. Perhaps the real Zodiac had something to say about the show or his impersonator, Oranchak thought. After he spotted the two phrases, Oranchak pulled out a smaller first section of the text, locked the phrases in place, and ran the program again.

Then, he was on his feet. “THAT WASNT ME ON THE TV SHOW,” read the further unraveled lines of text.

“That's when I knew — oh my god, this is it,” Oranchak said. “Holy crap.”

Oranchak, Blake, and Van Eycke had combined their skills in programming and mathematics and their interest in traditional cryptography to comb through the “garbage and nonsense” in most of the solutions, as Oranchak later described it, as well as “false positives” that gave them pause. When they finally decoded the cipher completely with a few more steps, the message revealed was still mostly garbage and nonsense: The Zodiac disavowed the call on Dunbar’s show and claimed, as he had in his first cipher, that his victims would serve as “slaves” in his afterlife, or “paradice.” The FBI’s cryptanalysis unit confirmed its validity.

Like the first cipher, the message didn’t reveal any information that clearly identified its creator. The team never really believed it would, Oranchak said.

To him, their work went beyond the content of the message. After spending 14 years in total trying to solve the Zodiac's second cipher, both on his own and alongside others, Oranchak views his entire experience as a long trip not to one man's dark internal world, but to the infinite world of cryptography itself.

At the end of it, Oranchak has come to believe that bringing in and combining computing skills and technologies can push the practice forward, giving today's cryptographers new tools to unlock some of our oldest secrets.

When Oranchak began to work on the second cipher, known online as the 340 cipher or Z340, he assumed it would be similar to the first one — the 408.

The first was a homophonic substitution cipher, meaning that it built on a basic substitution cipher. The latter matches one symbol to only one plaintext letter, while the former assigns multiple symbols to a single letter, shrouding the more obvious patterns that could give away where high-frequency letters like e’s and l’s might appear. Though the technique made the 408 harder to solve, the cipher was decoded within a week of its release to the public (which occurred under the Zodiac’s threat of a murderous rampage if it went unpublished).

 Donald Harden, a high school history and economics teacher who dabbled in cryptography, solved the cipher with his wife Bettye in about 20 hours. In the message they revealed, the Zodiac described his urges with a glaring intent to disturb. Oranchak detailed the Hardens’ process in his YouTube series, “Let’s Crack Zodiac.” With single letter frequencies invisible, he explained in Episode 3, the Hardens looked for double symbols like LL, saw a recurring group of four symbols that could be “KILL,” and with Bettye’s intuition about the writer, guessed the first line: “I like killing.” They tried various combinations in trial and error, by hand, to fill in the rest.

The second cipher was shorter, had more symbols, and seemed resistant to pen and paper decryption. “The cipher really attracted me because I knew that it was unsolved,” Oranchak said. “It had been unsolved for decades. It had a big target on its back for a long time.”

Knowing of the technique used in the first cipher, Oranchak started writing programs to solve it with homophonic substitution in mind. The first programs he wrote were hill climbers, which applied a substitution key with the objective of finding a message written in English. They used optimization to shape the key, little by little. The programs produced partial solutions with a few formed words, but nothing that made real sense.

Doubling down on partial solutions is an easy trap to fall into, Oranchak said. Over time, as Zodiac code breakers from computer science, cryptography, and true crime fan realms detected patterns, rearranged symbols, and found words in their own ways, he saw some produce partial solutions, then massage the gobbledygook to make more words and fit the final product to a Zodiac-resemblant message.

He was tempted by partial solutions, too. “I used to get really excited about seeing those partial solutions, because sometimes they look like real messages that the killer could have put in there,” Oranchak said. “They'd be words that he would mention, like 'killing' or 'murder' or 'victims.' It’s really easy for those kinds of words to appear by chance. That’s a way that you can kind of go down the wrong path by not understanding the big picture of what's going on with the cipher.” 

He compares the effect to seeing faces in clouds. To avoid that chase and solve the cipher, Oranchak tried to focus more on what cryptography itself is for — why ciphers are made. They hide order in chaos, he said. You shouldn’t have to reshape your solution at random to finish it. Patterns and rules are followed to create ciphers, and so they should be followed to crack them. 

“That's the reward in math and science,” Oranchak said. “You're equipped with the tools to divide order and chaos. You can figure out answers to questions. Not everything. But every once in a while, you'll get a glimpse of something true. And you can prove that it’s true. That’s what I faced throughout these years with the cipher. I was trying to figure out what was true about it, because so many people were getting caught up in things that weren't true.”

Oranchak met both Van Eycke and Blake online. Blake had seen one of his YouTube videos in 2020 and commented on it, and Oranchak and Van Eycke had been exchanging ideas since 2014. The three were brought together by their overlapping thoughts on what was making the cipher hard to crack.

They had the suspicion that the Zodiac had applied one or more transpositions — a standard, centuries-old cryptography technique — to the cipher before applying substitution. If that was true, there were many possibilities for the patterns he chose. Transpositions can go in columns, spirals, and countless other manipulations. Those patterns can go in multiple directions. A cipher can be split into multiple sections, and its myriad patterns, going in myriad directions, can apply differently to individual sections, thus rapidly sprouting thousands of head-spinning possibilities. Columns here, spirals there.

Blake’s use of Mathematica enabled the team to capture a large chunk of the potential transpositions applied. Oranchak calls the approach “buckshot.” “It's just kind of brute-force-based,” he said. “It's like an educated guess. We think there's some kind of transposition going on. So let's take a shotgun with 650,000 pellets and try to shoot the cipher down. It’s kind of crude and it took a long time.” 

Using the optimization method of simulated annealing, Van Eycke’s program then enabled the team to work through the variations at a more rapid pace than that of trial and error by hand.

When the team unlocked “HOPE YOU ARE TRYING TO CATCH ME” and “THE GAS CHAMBER,” Oranchak took a closer look at the solution, and the transposition methods applied. He saw that Blake had split the cipher into three sections — the first two were nine lines long, the third, two lines long — and had rearranged each section in a diagonal pattern. 

“THAT WASN’T ME ON THE TV SHOW” appeared after Oranchak broke Blake's variation up and ran just the first section through the program with the phrases locked in. A few more steps helped the trio unlock the cipher entirely, including creating a substitution key from the deciphered first section, which held all 63 of the cipher’s symbols, and applying it to the other two sections, as well as finding a small error the Zodiac had made in applying his own diagonal pattern to the second section. Fixing it instantly resolved lingering misspellings. In applying their key to the last section, they found it had a separate pattern: specific words went in reverse.

With multiple sections, transpositions, and substitution involved, the cipher rates at about a 7 or 8 out of 10 in difficulty to decipher to Oranchak, based on what he knows about cryptography. “It was probably fairly simple for him to make it,” he said. “But working that in reverse is more complicated, because you have to figure out: How do you rearrange it back to the way it was?”

As an engineering student at Virginia Tech, Oranchak learned a basic but useful lesson for a multi-year undertaking like his work on the 340 cipher: to finish what he started. A few weeks before the team solved the cipher, Oranchak gave a virtual lecture for the National Security Agency’s National Cryptologic Museum. “Even if we don’t solve the 340 or if the solution isn’t that useful, trying to solve it has kind of been its own reward,” he said at the time. “Cryptography research continuously improves when there are big targets like this, because it motivates people to come up with better ways to do cryptography. So my advice is to keep trying.”

With the verified solution in hand, his perspective is still the same. “I think about, if we hadn't solved it, is it worth spending decades of your life working on something like this?” Oranchak said. “For me, it has been, because I've met a lot of interesting people, we shared a lot of interesting ideas, we created new software to help investigate the problem, and that might help other people. It's been interesting to explain cryptography concepts to people that aren't familiar with cryptography, and it's made my knowledge of it better. Even without a solution to the 340, that's all been very positive for me. So to actually have the solution, now it's just icing on the cake.”

Photos by Peter Means, animation courtesy David Oranchak