MO MO - Ricky McCormick, 41, St Louis, 30 June 1999

[Adrian Harbinger]

WELCOME to WS Adrian Harbinger good first post.

I am thinking the same thing it looks to me like directions of some sort too...

Thanks.

 

[A_News_Junkie]

The first thing that jumps out at me is that the "words" are extremely long, as though each real letter would be represented by two or more coded letters. I know absolutely nothing about coding, but this is interesting.

Oh, and also, the numbers 71, 74 and 75 are interesting because they are all major freeways that run through southwestern ohio.

:seeya: Hi -- you must have grown up near Cincinnati too cause that grabbed my attention right away.
Map to show you all how close 71,75 (actually join in Cincinnati) and 74 all are to each other. Odd , eh?
http://www.artimis.org/segaccess1.html

 

[Adrian Harbinger]

dafishman and Adrian Harbinger, welcome to WS!

Thanks! This is a cool place.

 

[carbuff]

Hi everyone. I just joined here so please forgive me for interjecting what might be something of no consequence in this mystery. I only know what I am learning here, but this part of the code from the second paper caught my eye:




The reason it caught my eye is that it looks like directions that someone might jot down in an abbreviated form. For example: MLS = miles E74 = Rt 74 ...etc

I am way out of my league here, but I just wanted to throw it out there for thought. I caught this story online today and was intrigued. I just wonder if maybe Ockham's razor might be the one to shave this mystery. I dunno.

I also dunno why that link keeps going to a different place. At any rate, google map 'RT 74 Missouri'. Was it always that short?

When I went to look at some of the numbers in Googlemaps, I found out that
E173RT is "London E17 3RT, United Kingdom" -- a town called Waltham Forest, off A503 and A104.

 

[sfbaynancydrew]

I noticed the FBI is only taking snail mail. To compare handwriting perchance? Hmmm....

I do have to admit though that, looking at it more, it does look more code-like and less random. We need to know more about Ricky.

 

[txsvicki]

How strange. From looking at the ciphers it doesn't look like it would be that hard for someone to figure out if they had any previous examples. Just reading it, things that could be news channels jumped out at me. One group of letters was repeated, one looked like a date, one or two looked medical like dr. something and LPN. Another looked like a license plate number, but I think he's naming people. Mrs. E, divorced white male, --- executive, a nurse, possibly a private, etc.

 

[Whitehat]

Hello everyone!

I'm new to the forum, as you can tell by my post-count I'm certain. Earlier this evening, my wife brought the FBI article to my attention and printed out the writing so I could take a look at it. I just published an article on my wordpress about my observations, but first, I thought I would share a bit about myself since I am new.

I hold a degree in Information Technology specializing in computer networking technology. I'm currently a 4.0 student at a university which has been selected by the NSA for competition-based scholarship/internship through the Information Assurance and Security specialization. I am the Lead I.T. Consultant to the Director of the Victory Institute. I have a 15 month old son who is sharp as a whip and twin boys on the way. I like long romantic strolls in the moonlight and candle-lit dinners by the fireplace. Well, maybe not that last sentence, but in retrospect, I probably would have dinner like that if it was a New York strip steak. I cook a mean strip on an open-fire grill.

That's enough about me, I'll share some of what I wrote on my blog so that you all can get my observations on this.

At first glance, this appears to closely follow a typical transposition cipher. This would mean that we should consider the Nihilist cipher family. After some study though, I have been able to rule out Monom-Dinome cipher as Straddling Checkerboard ciphers are fairly weak and easily cracked. A savvy FBI agent could have probably deciphered it by hand with a pen and paper. Also, it is possible to crack a SCC with the wrong key!

I also noted the similarity to the output of a Rail Fence cipher and attempted an attack on the code using 2 to 8 rails with no success. Less likely was ROT, but just to say I did, I attempted a full-spectrum ROT and also turned up empty handed on that account.

One thing I have found interesting that is worthy of note, is the result of the frequency analysis I performed. Omitting numbers and special characters, I found that the letter frequency in the writing was unusually close to the baseline plaintext English frequency. Oddly enough, the letter “E” is the most frequently used letter in writing, which matches that of plaintext. The result of the combined frequency analysis is below:

A 11
B 33
C 43
D 30
E 132
F 10
G 7
H 8
I 8
J 0
K 13
L 51
M 28
N 86
O 12
P 29
Q 0
R 67
S 97
T 42
U 12
V 3
W 15
X 11
Y 2
Z 1

It’s interesting to note, however, that the letters “J”, and “Q” never occur in the writing. There are also several glaring repetitions, such as “NCBE” (which occurs a mind-blowing 15 times), and “PRSE”. Looking at the writing, the letter pair “SE” occurs with incredible frequency. This leads me to believe that character combinations could represent single characters because of the common occurrence of four-letter sequences, but as of yet, I have not attempted to attack the writing in this manner.

It is certainly possible that this is a valid encrypted message that can be decrypted, but it certainly raises questions. Some of the questions that come to my mind are: Why is the FBI still interested in this case when the victim allegedly had a long history of writing coded messages as a hobby or obsession? Why did a man who dropped out of school have three separate addresses in St. Louis? Could this man have had a mental disability or illness which resulted in gibberish writing (not uncommon)? Why would the FBI not consult with, or admit consulting with, the crypto guys at the NSA who are arguably the world’s best (no insult to the FBI intended)? How can the FBI seriously expect the public to be able to assist without any supporting information regarding the victims personal life or the critical circumstances surrounding the murder?

I have doubts of the face-value advertisement of the FBI and I must consider the possibility of an alterior motive, although the odds of figuring that out are about as good as being able to decipher these writings. In any case, I’m passing this along to everyone else and hopefully if there is something to find the I.T. community will discover it.

 

[bessie]

Great first post, whitehat. Thank you for your input.

FWIW, I've gone a little further with my attempt to color code repetitive letter groups. As you pointed out, "SE" appears quite frequently. I counted about 35 instances where the two letters are paired alone, and about 20 RSE's. I believe NCBE is a noun because it is written in possessive form ('s) in the last line of p.1.

[FONT=&quot](MND MKNEA RSE-N-S-M-KNARE) (ALSM)
TFRHENPINSE NPRSERCBBNSE NPRSEINC
PRSENMRSE PREHLDWLDNCBE(TFXLF TCXL NCBE)
AL-PRPPIT XLYPPIYNCBE MGKSEWCDRCBRNSEPRSE
WLDRCBRNSE NTSSHETXSE-CRSLE-CLTRSEWLDNCBE
ALWLDNCBETSME LRSERLSEURGLNEASNWLDNCBE
(NOPFSE NLSRE NCBE)NTEGDDMNSENCURERCBRNE
(TENE TFNE NCRTSENCBEING)
(FLRSEPRSE ONDE 71NCBE)
(CDNSEPRSE ONSDE 74NCBE)
(BRTSEPRSE ONREDE 75NCBE)
(TFNCMSP SOLE MRDELUSE TOTE WLDN1HLDNCBE)
(194 WLD’S NCBE)(TRFXL)


[/FONT][FONT=&quot]ALPNTE GLSE - SE ERTE
VLSE MTSE-CTSE-WSE-FRTSE
PNRTRSE ONDRSEWLD NCBEXC
NWLDZLRCMSPNEWLDSTSME XL DULMT6TUNSE NCBEXC
(MUNSAISTENMUNARSE)
KLSE-LRSTE-TRSE-TRSE-MKSEN-MRSE
(SAE6NSE SE NMBSE)
NMNRCBRNSEPTE2PTEWSREBKNSE
26MLSE 74SPRKSE 29KENOSOLE 173RTRSE
356LE CLGSEOUNUTKEDKRSE PSESHLE
651MTCSEHTLSENCUTCTRS NMRE
99.84.5 ZUNEPLSENCRSEADLTSENSKSENBSE
NSREONSE PVTSEWLDNCBE (3XORL)
NMSENRSEIN2NTRLERCBRNSENTSRCRBNE
LSPNSENGSPSEMKSEKBSEPCBEAVXLR [FONT=&quot]
[/FONT][FONT=&quot]HMCRENMREFCBE 1/2MUNDPLSE
D-W-M14HIL XDRLX[/FONT][/FONT]

 

[bessie]

Just wanted to add a big :Welcome1:to all of our new members here tonight.

 

[Whitehat]

Thank you, bessie.

Your representation of the coding is very helpful in highlighting what I consider to be a focus point.

(FLRSEPRSE ONDE 71NCBE)
(CDNSEPRSE ONSDE 74NCBE)
(BRTSEPRSE ONREDE 75NCBE)

These three are obviously related in some manner, so it doesn't suggest incoherent ramblings. All three have slight variations. As others have noted, the numbers are probably important because they do not appear often enough in the cipher to be considered an integral part of the code's key product. I believe that the numbers and special characters are exactly as they appear, although the numbers may have their own separate coding or abbreviation.

Also, very important in that area, are the variations of ONDE. If this is a true cipher, then I believe that these three lines are the ones that give us the most information. We have direct correlation, variation, numbers, letters, and formatting. This is where I get frustrated. I believe that this cipher does not use a typical cipher process. I think it's entirely possible that this man created his own personal coding system after decades of familiarity with known systems. This tells me that we would need to delve into his personal life at the time and find out what instances we might find similar formatting. I think that formatting is the key to figuring out what those three lines mean, and if we can figure that out, then the rest will fall into place.

 

[sfbaynancydrew]

Whitehat, what do you think of this? This man is claiming to have deciphered it. He posts in the comment section of the original article, I copied and pasted the entire comment if you can't find it or it gets deleted. I'd be happy to PM it to you.

It's in the top rated comments on yahoo and it goes on for much longer than this, I'll just cut and paste the first part:

First, how he solved it:
I started with breaking up CTSE-WSE-FRTSE

I then associated numbers to letters: A=1, B=2, etc. (I have now noticed people posting this on the thread so others are doing the same thing now, so I feel even more confident now)

Starting with CTSE
C=3
T=20
S=19
E=5
*Keep 3 because it is the first number and smallest* T-S=1
E-1=4 (See how I repeated that twice? That is the "law" of 2 and you'll see it again and again in this code, and its the reason he repeats letters twice in patterns.)

-------------------------
WSE; W=23, S=19, E=5
23-19=4 (the law of 2) add 4+4=8, then 19-5=14(the law of 2) 14/2=7
again...(the law of 2) You get two 7's....the answer is 877!
------------
Finally, I did it a 3rd time and got 314-877-6400


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
What he thinks it means:






On the page titled "NOTES", the first 2 lines:

ALPNTE GLSE - SE ERTE
VLSE MTSE - CTSE - WSE - FRTSE

This is an address and phone number for the Missouri Institute for Mental Health, which is located in St. Louis, MO where the man Ricky McCormick who was murdered on June 30 1999 is from, according to the FBI help request (I have yet to find any old articles that talk about the details of this murder btw)

Address & Phone confirmed with Yahoo Maps: 5400 - ARSENAL STREET - (314) 877-6400
----------------------------------------------------------------
The three lines underneath that address...so far I got from it "PO DEPUE" (if you take every letter within these 3 lines that proceed the letter "N":

PNRTRSE ONDRSE WLD NCBE
NWLD XLRCMSP NEWLD STS ME XL
DULMT6TUNSE NCBEXL

I Googled "podepue" and "missouri" and I got results for Susan Depue, Sr. Research Specialist at the Missouri Institute for Mental Health (Interesting huh?)

 

[sfbaynancydrew]

Cutting & Pasting old articles since there is no link to them:

AW & ORDER.(Metro)(Law & Order Column)
Article from: St Louis Post-Dispatch (MO) | July 1, 1999 | Anthony, Shane | Copyright
The partly decomposed body of a black man was found Wednesday afternoon by a woman driving along a path on the edge of a cornfield in the West Alton area. The man appeared to have suffered an injury to the head, officials with the St. Charles County Sheriff's Department said. Authorities are treating the death as suspicious.
Lt. Craig McGuire said the body is that of a black man whose age could not be determined immediately. He had been dead for about three days.
The Sheriff's Department has asked the Major Case Squad to …

LAW & ORDER.(News)(Law & Order Column)
Article from: St Louis Post-Dispatch (MO) | July 3, 1999 | Copyright
WEST ALTON
Man found near field may have died naturally
The Major Case Squad was wrapping up its investigation Friday into the death of Ricky McCormick, 41, whose body was found Wednesday near a cornfield off Highway 367 near West Alton.
Maj. Tom O'Connor said medical examiners had not been able to determine a cause of death, and the 18 people working the case had found no evidence of a crime. The squad was turning the investigation back to the St. Charles County Sheriff's Department.
A woman driving along a field road near Highway 367 west of West Alton discovered McCormick's body Wednesday afternoon. Officials have said McCormick suffered from chronic …
BODY FOUND IN FIELD NEAR WEST ALTON PUZZLES POLICE: NO CAUSE OF DEATH DETERMINED YET, BUT IDENTITY IS KNOWN. CASE IS TREATED AS A HOMICIDE.(St. Charles County Post)
Article from: St Louis Post-Dispatch (MO) | July 2, 1999 | Anthony, Shane | Copyright
Authorities know the identity of a man found dead near West Alton on Wednesday afternoon, but they have a lot of unanswered questions.
The body of Ricky McCormick, 41, who had addresses in St. Louis, Belleville and Fairview Heights, was found near a cornfield by a woman driving along a field road near Highway 367.
But how McCormick died and ended up where he did is still a mystery.
Maj. Tom O'Connor of the Major Case Squad said authorities were treating the suspicious death as if it were a homicide. A medical examiner has not been able to determine an exact cause of death yet. An initial medical examination found no obvious gunshot or knife wounds, …



Okay...the guy seems to have died of natural causes. WHY DOES THE FBI CARE ABOUT THIS SO MUCH?

Weird.

 

[Whitehat]

sfbaynancydrew,

Honestly, I think he's reaching a bit. What we have to be careful of, is seeing what we want to see. There are many different ways that we could pull words out of the text, but to be honest, the man's method is suspect. For example, he claims to have pulled out a name from the writing by taking the letters that occur before the letter "N", however, what happens when the first letter of the new line is an "N"? As for the string in which he managed to produce a phone number, he left out the fact that the string had an additional concatenation at the beginning. CTSE-WSE-FRTSE actually started with MTSE-, so he is conveniently leaving that part out because it invalidates his argument. Yes, I agree that pairs and a rule of two may be a common theme, but it doesn't give us lease to make sweeping assumptions. Using his same method on other parts of the text produces erratic results such as "EREEI".

In my opinion, he's reaching. I'll attempt to do some simple decoding later and see if I can do better. Good find.

 

[sfbaynancydrew]

Thanks whitehat. My first impression of it was that it wasn't clean enough to immediately jump out to me as legit.

I tried to follow the math, but my attention span is HORRID these days, so I thought I'd just see what someone who actually enjoys that part of it thinks.

Thanks for the input, I look forward to hearing more of your thoughts!

Oh and WELCOME, btw .

 

[bessie]

Whitehat, I agree those three lines are key. If you saw my earlier post, they are the lines I focused on first because they show such a definite pattern. I thought the first three letters in each line might be acronyms. After googling them several times over, however, I cannot find any similarities. So, they might indeed be code. The ONDE sequence is interesting in that the first has no separators. The second is separated by one letter, and the third by two. I don't know if that has any significance, but it stood out to me.

 

[Adrian Harbinger]

Wow, this is a really interesting thread. You guys are good!

 

[A_News_Junkie]

If you put in Ricky McCormick in here:
https://www.courts.mo.gov/casenet/cases/header.do

if any of the 32 records that I get come back to him, he led an "interesting" life --- :banghead:

Not posting any of them as I am not sure any belong to him.

 

[bessie]

Thanks for the link. If any of those cases are related to this Ricky McCormick, I think it is only the first six. One is a domestic case from 1987, and one criminal infraction (1994). Three are municipal ordinances and one is an eviction. Doesn't tell much except that he seemed to have financial problems and 1994 was a bad year for him.

Seven and eight have a middle initial of "C". Could be him, but they occurred within the same timeframe as the first six without a middle initial.

The remainder either occurred after his death, or as in the case of the last 18, the defendant's first case was in 1998, but the rest of the charges occurred after 1999.

 

[BloodshotEye]

Fascinating case; you guys really have me curious about this one.
Forgive me for not remembering exactly who posted what.

I completely agree with those who believe that some of these lines, are traveling directions. I went to Google Maps, and clicked on the state of Missouri. Click down to St. Louis. Select the most direct route to the 71. If one makes an assumption that Ricky starts in St. Louis, he could easily take highway 64 to Louisville, Indiana. There is where he would pick up highway 71 North. Use the Highway numbers, 71, 74, and 75, in the same order in which they appear in the note. Let it simply "guide" you, on the map. One seems to be headed due north, toward Dayton, Ohio. Further north, on 75, would be Toledo. Now reverse it, 75 south, is another way to head back to the 71. i.e., back to his starting point.

If one's objective was to go to 75 north, it begs the question, why the reference to the 74? It may be that it is Ricky's indication, that he must "pass" highway 74, and proceed to the 75. A kind of landmark. Or... he created a sort of "route" for himself, where he would exit off of the 74, and get back on. At that point, he would pick up Highway 75 again, and head north or south. Heading south, would take him back to the 71. His starting point.

I pluggged in the 71 NCBE, and used the compass direction notation: North, continue bearing East. This actually makes sense, if you are looking at the map. You must travel North East on the 71, to get to the 74.
Followed by 74, North, continue bearing East. This suggests that the "driver" should NOT exit on the 74, but continue bearing east. It suggests that the reference to the 74 is a landmark, not a designated exit.

More to follow...
Missed all of you, hope you are all well.
BSE

 

[Carmen29]

I think that line 8 on page 1 actually ends with "INC" not ING. think the parenthesis is in the way. i had to look close and also line 2 ends with INC. so i think this is more repetition...

also think the first part of line 2 says TFRNE... which repeats in line 8....TFRNE, i dont think its a scratched out R i think it says TFRNE line 8 and is the same word as line 2

when i first wrote this out i noticed all of the "SE". i was thinking SE was maybe used as a space, a way to separate words. or maybe just E's bc sometimes there is no SE. but you cant help notice patterns when you read this.