So it was about, call it, seven years ago, particularly stormy night in spring, and I received a message online from that one friend everyone kind of seems to have who finds these strangest things online and sends them to you. And it was this online radio station.

It was an online radio station. It played this sort of blare of sound which any of you who are radio enthusiasts might know as a copy of UVB sending for 76. And then the stern female voice began reading out numbers. Of course a few of us sat down to

try and work out some sort of meaning from these numbers. We thought despite the fact the message was obviously not intended for us we might try something out. And it was after all of my own attempts had failed miserably and I was watching the successes people were having with getting a word at a time and then full phrases out of these that I kind of understood

how much deeper crypto was than the sort of like children's puzzles and Mensa challenges I'd done as a kid that sort of thing. And that's one of my favorite things about cryptography. One of the things I really love is how varied the stories are from either the bizarre like my own to the mundane of why you

started looking into crypto seriously. And for an increasing number of people these days, uh, Cicada is actually one of those. It was an enormous media thing a few years after it came out. It's been just a ridiculous number of people that have come at least through our community looking into it.

It was called things like the hardest puzzle on the internet and the greatest internet mystery and things like that. So I'd like to talk a little bit about what was the draw? Like what did they do so successfully that it became something that most crypto puzzles online and there are many never really got which was this notoriety.

Unfortunately before I get into that I realize there's a lot of people who probably know a thing or two about Cicada, but really superficially you may have heard the name you may have heard these comments about it and might not know actually know that much about what it is. So I'm going to do a bit of overview first.

Cicada ran for three years once a year. It started quite simply there was an image posted online that would lead you through step after step of these different puzzles. They lasted roughly I would say two months each time and then they had a distinct finish before they would carry on a

new puzzle the next year. And now all of these were there wasn't a particular website for Cicada. There wasn't any one source you were going to. Each image each puzzle was a distinct thing posted on one place. It was a brand new user account with no history. There was no context given no source for these images which kind of added to the

mystery about it a little bit. It started with this image which meant many of you may be familiar with. This this image on its own it doesn't tell you really anything. It has some unverifiable claims about looking for people.

But despite how empty kind of this image is this was actually the first step in the puzzle. There was an appended like string of text at the end of the data for this image which would lead you on to the next steps. And that's how it carried forward. Each image each file would lead you to one website.

It had was often major social media or file hosting websites that sort of thing. And each one would have a singular image or file which would be your next puzzle to move forward. It began incredibly simply actually. The for example this one the appended text was just a caesar cipher.

They would move on into other very simple classical cryptography. There was book codes and columnar transposition that sort of thing. Uh so it there was a lot of uh first timers that were able to keep up with it for the first little while. Which let them kind of get really into it before the difficulty hit. Uh it would eventually get to doing things like more

modern cryptography. It was cracking a little bit RSA keys. Uh there was one point where you had to implement your own implementation of Diffie Hellman on a TCP server through Tor. Uh it was a whole bunch of uh more complicated things like that. One of the things that

carried through the entire time was this very efficient puzzle design. These singular images and singular files uh gave you an awful lot for how simple they looked. I'm gonna use this one as an example actually which is this was actually this image, nothing else about it, nothing about the user or anything like that. This was the solution to I think

three or four puzzles throughout the first year. It was uh just you kept having to come back and use this image that originally you thought had nothing going on in it at all. It had its appended text at the end of it. Uh it came out later that there was steganographically hidden information using software called Outguess in it. And way later on they were calling for a certain number of associated prime numbers which this

had if you looked into the data for it and the dimensions and that sort of thing. That sort of very efficient puzzle design would carry on to a frankly ridiculous degree. There's steps later on uh I think I have yeah I do. Where you started getting into things like this. Already just the image looks like a pretty hard puzzle right? It's not English

text so there's going to be some sort of substitution into English before you're even doing the cryptography step to figure out what all of this means. But it turned out that wasn't really enough. So as you can tell the hacks underneath they kind of abused one

feature of how jpeg files are read. That after the FFD9 it doesn't care what else is there. So they just kept appending new jpegs at the end of these. This one itself actually has three separate images in it. Later on they would take that a step further and they would start appending full text files between the FFD9 and the FFD8 of the next one. And you would just like start unpacking. You get this one image and unpack

six seven files each with their own puzzle all of these different steps. It got ridiculously complicated in this horrendously efficient package. Um another thing that they really stuck with throughout the design of it was the sort of idea that they always kept

consistent with where they started. I said stick in a graphic uh using outgas like a message using outgas earlier on. And that was sort of a thing where they gave that queue quite simply right at the beginning. And that would be because for the three years following every time they wanted to give you just a little bit more you'd be going back

to that. Uh there was a bunch of things like that. My particular favorite example was in 2013 when they gave the substitution for these runic characters actually. There was uh English character or multiple English characters uh runic symbol associated so you could do the back calculation. And then there was a number associated with as well. And

once we were starting to look at these we're like why is there a number associated? It turned out if you went a year previous and started looking at some of the very distinct phrases uh that they were using all of them added up to prime numbers through this thing that they wouldn't release for over a year after the fact. Somehow they

had designed from the first day all of their messages to be have something new in them once you got years into the puzzle and found something that was supposed to be unrelated. It was just beautifully designed to be honest. So of course one of the ongoing questions for a lot of people with Cicada is that's all great. That's uh that's

a fantastic puzzle. What happens next? Um so eventually you would reach a point in the puzzle where they decided that you know the the collaboration's wonderful, the individual intelligent people. So there was a solo round at the end of each year. You

would get to a point where you had to somehow provide them a unique way to contact you and every individual who got there actually got their own puzzle that had been designed specifically for them. If you took it and compared it to anyone else there would be no kind of consistency there. And of course then you would have to work

through your own solo one and getting of course to the end. Now when you got to the end uh the kind of current public knowledge of what that looks like uh was mostly popularized in an online article from uh that was a friend of mine was interviewed for,

his name is Marcus, uh he talked in Rolling Stone about his experiences in 2012 which was all of these different winners, all the people who got to the end were collected up and put together and tasked with working on code. They were told to write software that they felt somehow, like they designed it themselves, they picked their

project, but somehow enhanced the goals of the group, 3301 that had made these puzzles. Now those goals, kind of relevant to our theme here at DefCon this year is uh pretty much the importance of the right to privacy, the right to anonymity, as well as the freedom of information within that. So that's kind of my overview for today. Um

for what Cicada actually was, hopefully that gives a clear enough picture that I can now talk about it. There's two very disparate elements that I think really went into the success they had in both popularizing as well as keeping people working on it. Uh the

first of those that I'd like to talk about is the mystery. I mean that's the obvious one, right? I'm sure a lot of you here today who know about Cicada or are interested in it, and the question of who did it, why did they do it, why were they looking for

intelligent individuals, and the, that question really drove the early parts of the puzzle. Um there was a lot of people, uh myself included, who, the puzzle was kind of enough on its own, right? Like crypto puzzles are all over the internet and a lot of the time

they're really fun. So there's a certain group of people that would just dive into it because it was a new and very complicated crypto puzzle and that was kind of enough. There's this giant group of people, and I think it's still increasing now, years after Cicada was finished, who may or may not have been interested enough in the crypto

puzzle part of it, but desperately wanted to know the answer to that question, why? Why did they do this? Who are they? Those sorts of things. And despite the fact that they didn't necessarily have that much interest in the actual puzzle, they still dove through the steps like all the rest of us, they spent countless hours trying, working on

this just with that burning question of why. Now that idea of the mystery leading people to put a whole bunch of time into it, leading to the focus on your project, that's not unique to Cicada. Uh there's a lot of other media where they've had a lot of success with that. I think what I consider probably the closest example to that is um ARGs or

alternate reality games. If you're not familiar with that, they're usually by major corporations looking to have some sort of game, some sort of challenge or puzzle that will act as advertising for some media that they're going to put out often to kind of get people to try and be involved with their story before it comes out. Now these often

work very much like Cicada. They were puzzles, they were challenges, you would move forward, sometimes they used crypto and they lived or died often on the question of why, the mystery part of it. Uh I say live and die because many of them are very successful,

there's some fantastic examples of it. Many of them also, despite the just millions of dollars put in by these big companies, all of this effort and time and work would die out in popularity within the first few steps because they didn't keep the mystery going. They

were too obvious right at the bat who they were advertising for what the project was. Um I think the most recent example of that was uh there was a game No Man's Sky that tried one of these and it was obvious within two steps of what they were advertising for and everyone I know who does ARGs, who loves that sort of community, they got to that step and

said oh that's what it is bye and the community just tanked. So there's something so powerful about maintaining that mystery. Um ARGs while I think of course this is not by far the only thing to have used that very successfully. Uh if you're talking things

particularly like Cicada, there's a strong kind of group of people that are trying to correlation to these recruitment cut puzzles. This ability to keep people invested to the point that you can pick individuals out with the mystery. Uh the best examples of this are a few years after Cicada the Navy, the US Navy actually released their own puzzle in the style

of Cicada looking for recruitment. Uh my favorite example I think is Google. Google tried one of these a few years ago. As you were searching through Google usually if you were doing enough searches that were relevant to what they're looking to hire for right now, uh you'd

get this black bar in your search history and it would invite you into this kind of game. Uh the one I did it started as uh this sort of cryptography themed word puzzle thing and then into this it was a like terminal in your browser. It gave you a coding challenge and a

timer and every time you completed a coding challenge it would double the timer and give you a more complicated coding challenge. And this would go on and on and on until you reach to the end and they finally told you what why are you doing this right? And you'd get uh I don't know if you can read that it's a little small but it's would you like to share your answers with a recruiter? Now it's just not hard to apply to Google. You

can apply there's recruiters at events so there's sort of the question of why did they feel they needed to do this and uh it's an interesting thing that they considered this this idea that don't tell the person that you're trying to recruit them all the way until you

they've already proven themselves that they found so powerful they actually repeated it 2 or 3 times in subsequent years after this. They kept coming back to it despite that it's really it's not that complicated to send an application into Google but they were still finding the people they wanted through something so roundabout so unrelated like this. So there's a bit of a question of why. What is the actual power there? Now there's a

really interesting paper it came out of the uh University of Toronto that tried to measure levels of excitement in the brain with various things and they found sort of an unintended result. Um they were testing positive they were testing negative and they

found that there was this large like certain large group of people for whom the unknown had a higher level of excitement in the brain than either the positive or the negative stimulus. Uh it was a sort of interesting unintended thing of like we've all heard the

ridiculous power of the fight or flight response right? You have the the nervous reaction you have the panic that sort of thing and like I don't need to tell anyone the kind of highs you would feel in a positive reaction when you're excited about something like that but there was still all of these people for whom the unknown was somehow

overpowering it that that sort of curiosity and trepidation we feel when we're faced with something that we don't understand came overpowered things like the animalistic fight or flight response. It's kind of strangely powerful. Cicada I feel took this even a step

further. Obviously the unknown has this pull on all of us um but there's this sort of I'll say crypto and the unknown crypto and a mystery have this ridiculously long history. There's so many times throughout cryptos history that the the sense of an unknown the

sense of a mystery in it it felt important right? I don't need to talk that much about World War II cryptography where knowing the answer to an unknown could save thousands of lives uh European history when groups like the Masons were trying not to be interrupted in what they were doing and some of their encrypted text are just being decrypted now they

worked so hard on it and Cicada really pulls on that they have all of this theming which is sort of esoterism and sort of trying to evoke this idea of the long history of importance in a mystery in cryptography so we've got this pull from the mystery anyway and then this historical context of what if this recruitment really matters what if there's

something important at the end of this and that went to be just powerful enough to get the all of us media attention. So the other side of it that the other strategy they used I think is worth talking about is as far as you can go in the opposite direction uh

and that's the uh the gamification of cryptography this idea of crypto and crypto challenges as this fun game and again nowhere near unique to Cicada uh long history of crypto as games uh in here at the crypto village actually one of the best examples was

Edgar Allen Poe he ran this contest sort of thing where if you could provide him a puzzle for he couldn't crack there was a reward and this went on for I think years and would ultimately lead in him writing the gold bug book which is obviously the name of the

puzzle that the crypto village uses now um and I mean uh there's also things like Bach uh taking his names of his loved ones and second graphically hiding them in the notes or his puzzle cannons which was sort of a game where he'd write two thirds of a cannon and challenge his students and his peers to try and figure out what his design was

and finish the cannon. So let's talk Cicada let's talk why that's so effective in pulling people in. Now for new players for new people to cryptography there's this this very

simple kind of structure to it right it's like a game it starts incredibly simplistically it teaches you a few things then it ups the complexity right it's almost got a video game style structure of teaching you mechanics and moving up into more complicated things um

this has this unique effect of getting newer users to understand the tools that they're going to need to get further uh this was used I think most importantly by Cicada in their introduction of PGP I'm sure all of you know what PGP is for a lot of people getting into Cicada if they don't know anything about crypto they don't know anything

about internet privacy that sort of thing they may not know what PGP was so very early on uh Cicada taught these people how to use key servers how to use uh you know generate their own use public and private keys and that would end up really important not only because Cicada would then sign with their PGP key everything they ever

said again after that point for years but also they felt it was an important enough idea that they wanted anyone who touched their puzzle to have to understand it and I think that has more to do with their their goals their listed anonymity, privacy, freedom

of information ideas than it has to do with actually signing their messages um this sort of structure though of starting simply it's not just to teach that right there's there's going to be a point it increases in difficulty you know you may be able to get

away with you come to a new thing you've kind of muddled through it but every new player will get lost eventually and I think that's an important part of their design as well uh there's sort of this idea in learning of the known unknowns where until you kind of know what you don't know learning it is quite difficult and uh I'm going to take an

example here of this message this is one where they lost quite a few people even though it's a fairly simple classical crypto kind of cipher now the idea was this was columnar transposition was the solution to this but I'll what I could yes I'll lose my

notes but I think that's okay I'll do it long enough for everyone to read it if that's alright I'm going to go back I'm going to go back because I don't want to lose these notes but there we go uh so it's got this interesting thing of you arrive at this

you've tried all of your classical ciphers you you know you might try your visionaries your well known ones and for so many people they got to this and didn't know what to do but cicada had set this up in a way that this provided them enough

information that they knew what they had to go learn right like this almost gave them search terms for going and teaching themselves and that's a theme that would come through all of cicada they always made sure that when you were stumped you were given everything you needed to teach yourself the skills that you would need to move forward and for a lot of people myself included that was very important for moving

forward I did not have all of the skills I needed when I started it was this fantastic teaching tool I mean this it's got only plain text it's like only English text they're capitalized they're in rows and columns and searching those things would lead you to columnar transposition which would then lead you to teach yourself how to get

past that of course that's all for inexperienced people in cryptography cicada is obviously not really for uh inexperienced people in its design right in how they talk about it but there's a lot of benefits to the structure this kind of gamey structure to people who have been in cryptography for a long time I'll give an example of myself uh

there was this one piece of the puzzle that was based entirely around the exclusive or function now I knew the exclusive or function I'd seen it used in you know stream ciphers that sort of thing I I knew of it I've even used it a few times um cicada

decided to go a little above and beyond uh how they used this thing and they were using all of these features that mathematically are part of the function but in my typical uses of it had never uh seen it's sort of this associativity and commutativity that are just intrinsic by the the math of it so what they did is they used the fact that those are

the case they had they gave us this file it was about five different files all exclusive or together and then throughout the rest of that year they would give you a piece at a time like one full file from it or two of them exclusive or together and just by like piecing these together by doing oh well if I exclusive or the two that are together

into the four I get two back and then I just need to find one file to get the original and they sort of taught you that sort of math based way of dealing with exclusive or until you got all of these files out which were all very important as you moved along and I personally had never seen anything even sort of uh like that um teaching yourself

something new isn't really the only benefit though of seeing it in a new light I'm gonna go with a kind of historical example I'm not sure how many of you are aware of the uh he was a scientist uh he was named Mendeleev and he was early early chemistry and quite

famously he had this love for this Russian kind of version of solitaire like cards and while he was working early chemistry uh he'd made himself a deck of cards that were all of the elements that they discovered so far and one morning he was waiting for a train and decided to play solitaire with his cards of chemistry instead and came to some

starting realizations about how you could lay them out how the structures worked and that actually became the basis for the current uh a bunch of the current uh things that would work up to the periodic table not only that but it from watching the patterns through it at the time he was able to predict a number of elements that hadn't been

discovered yet just because of the patterns he found through that and that's that I this idea of gamification forcing us out of the context of how we might professionally use these tools and we have no idea what we might discover from something like that um that's

one half of it for experienced users uh I think the other half I'm gonna quote I think it was originally Durant that said we we are what we repeatedly do excellence then is pure habit there's this idea that while it's a game while it's not important in any

measure there's something personal to be gained by trying it anyway and Cicada obviously is not the only one working on this uh the NSA puts out a ton of different sort of challenges and puzzles some of them only internally to their own agents who they already know are quite practiced at all of these things because they're of the opinion

that forcing the sort of gamified practice of it is important for keeping skills they do a biweekly internal cryptography challenge they do uh public online logic and math puzzle and they've been doing this for years and quite happy with the effects of it so that's sort of a thing that I think is important for people to understand about gamified

crypto one last thing about the game part of it which is I think probably the most important for me and it's the social structures there's something about a game that creates communities right when you're working through something like Cicada you don't

you get stumped by something you're you're really excited about something that you've solved and you don't want to just keep that to yourself so Cicada almost unintentionally create formed these groups of people who all found each other working on it and we're all excited to talk about it and this had all sorts of unintended kind of consequences one of the important ones I think is the longevity of them

Cicada's been quiet now for 3 or 4 years and all of these communities all of these thousands of people that have come together are still present they're still helping each other they're still there when I uh joined these communities right at the start I

didn't think I had anything to learn and I was very wrong but um all of these experience experience cryptographers that were hanging out there taught me all of these things as I tried to move forward and then I reached this point at the end of that where I was like well now I can't leave cause some of them might be leaving some of them are drawn around all the time what if they don't new people coming in don't have that

which led me to stick around and be that for newer people I've since watched those newer people get to that point and be that for the next generation and somehow this community despite the game being over is growing and it's had far reaching consequences I've seen so many people who started day one no idea about crypto didn't know

what a caesar cipher is who in those years those 6 years since Cicadas started they've gone to school for computing or math they've got specialization degrees in cryptography and many of them are now out in the world writing cryptography software which was as you saw from the 2012 that was the goal of Cicada originally is get

people caring about writing the privacy software and this community that's lasted forever after they were done is now becoming that over these years that they've actually been entirely quiet and I think that's incredibly important and is just an intrinsic feature of

games I think that's gamification of crypto makes that kind of naturally so the last kind of thing I would like to get into about Cicada I think is the most important actually for the topic of the convention which is the idea of 1983 the idea that we're all being

watched is privacy dead so in our specific community you know we've got the a wiki a wiki of all of the different solutions we've got subreddits IRC channels that sort of thing the last count I did I think we've seen about 40 or 50 thousand unique IP addresses

just to our little community and we're by no means the only one and I mean I showed you all the media hype about it BBC New York Times Business Insider Rolling Stone all had these articles but people really cared about Cicada really cared about who had made this now it's been six years they spent three years pouring stuff onto the internet

and in all of that time we still don't know who they are which is interesting all of these people who in our community have all tried to figure out who it is all these investigative journalists for their respective newspapers have tried from foyer

requests and things like that were reasonably convinced that the major intelligence agencies have taken a look and somehow they're still in touch with each other and it's entirely anonymous so I think that's important to talk about how that is and the answer is disturbingly simple it's there's not some sort of great secret that Cicada has and I

think that's what's so important about it they made a new user account for every email every account like a site they were going to do they did all of their connections through some anonymizing software usually Tor and like these probably sound quite

familiar if you've ever heard anything from the EFF or any other like the Tor group anyone working on privacy software these are the basic strategies that they're telling you you could stick with and I think it's really important that Cicada is this example of

just following what we have what the strategy we have and more importantly just using the software we already have is actually enough somehow these adversaries to privacy are actually being defeated by the work we've done right now and that's the opposite of the message you hear so often that privacy is dead that's a hopeful message there's still a

lot of work to be done on this kind of software the threats are always increasing in severity and so thus the software must be but I think there's not enough good clear examples of it working I think they're really important for that they've of course had a few

unintended side effects therein one of the main ones is that by nobody knowing who they are for so long there are a lot of people who would like to say that they are them there's imitators coming out of the woodworks in the intervening time since there were Cicada puzzles there's now more content online claiming to be Cicada and making fake

versions than there ever was combined from Cicada and so that's sort of an interesting sacrifice for the privacy that most of us will never have to really interact with most of us wouldn't know that we haven't achieved that level of anonymity that they are and have become public enough that that's an important thing to people that being said they

still have set themselves up their PGP signature right at the start their claim that they're going to sign everything they ever do that still allowed them to maintain no this is our identity though we're entirely anonymous and I think that's the strength of the

software that we've set up right now is you can perfectly maintain your identity maintain that your words are your own while nobody knows who you are and that's frankly a wonderful thing that that's even possible I think that's a really important point

I just skipped a slide but it was obvious I think that is for now all I have to say about them actually thank you all very much and I hope you enjoyed it I'll be doing I think a few questions if anyone has any and I'm definitely open to them alright thank you Knox