The strongest claim the FBI has ever committed to paper about the Ricky McCormick notes is one sentence, written in 2002, and it is more careful than the case's reputation. An examiner in the Bureau's Racketeering Records Analysis Unit reported that "Notations on the submitted documents have characteristics indicating the presence of an encrypted message, however, all efforts to decrypt the message have been unsuccessful" (FBI Laboratory, Report of Examination, lab number 011126008 LQ, 12 March 2002).
Characteristics indicating the presence of. Not "this is a Vigenere", not "this is a transposition", not any named system at all. Eleven pages of that laboratory file are public through the Bureau's own reading room, and reading them beside the 2011 appeal shows where the confident version of this story came from, and where it ran ahead of the paperwork.
Key Takeaways
- The notes did not reach the FBI Laboratory until 13 November 2001, more than two years after they were recovered.
- Thirteen days later the examination was postponed indefinitely, in writing, because of the September 2001 attacks.
- There is no cryptanalytic working and no candidate solution in the released file: three short laboratory reports, an evidence receipt, a postponement letter and two letters from the sheriff's department.
- The 2009 physical examination found no indented writing and no watermarks.
- No released FBI document names a system. In the Bureau's own four-step method that is step two, and as of its last public statement the unit had not got past it.
How long did the Ricky McCormick notes take to reach the FBI Laboratory?
Two years, four months and two weeks. The lab records the specimens as received on 13 November 2001, against a St. Charles County Sheriff's Department case opened in 1999.
Its covering letter is in the file, and is dated the day after the specimens arrived, which is ordinary enough for evidence hand-carried or couriered ahead of its paperwork. Writing on 14 November 2001 under Sheriff Douglas Saulters, a St. Charles County detective set out what the department knew: "Ricky was found in a field in a remote portion of northern St. Charles County on June 30, 1999. He was badly decomposed and it is estimated that he had been there for a period of 3-5 days. There was nothing to indicate that the individual was killed on site."
Three details in that paragraph rarely survive into retellings. The recovery date is the date a body was found, not the date of death. The scene was not where he died. And the wound is described with a hedge the file never removes: "Because of the wound to the neck, it is surmised that he was killed by a cut to his throat."
The same letter is the origin of the request itself. "The requested color prints are of the coded notes found in the victim's trouser pockets," the detective wrote. "It is hoped that these notes my provide a clue as to how Ricky met his demise." The typing error is in the original.
Then the file stops. On 26 November 2001 the Information and Evidence Management Unit wrote back to the detective to confirm a phone call: "the examination of the submitted evidence will be delayed for an indefinite period due to the terrorist incidents in New York City, Pennsylvania and Virginia." The notes had arrived at Quantico nine weeks after 11 September 2001, and went to the back of a queue that had just been rebuilt around something else. The examination report is dated 12 March 2002.
What the FBI lab wrote down about the Ricky McCormick notes
Thin is the word for the released file, and that is itself worth knowing before anyone goes looking for answers in it. There is no worked analysis, no frequency table, no shortlist of candidate plaintexts. What survives is a stack of correspondence, two letters from the sheriff's department and three reports of examination. Laid out by date, the substantive pages read like this.
| Date |
Unit |
What it recorded |
| 12 March 2002 |
Racketeering Records Analysis |
Characteristics indicate an encrypted message; decryption unsuccessful |
| 22 December 2008 |
FBI Laboratory |
Evidence resubmitted by the sheriff's department and inventoried |
| 4 August 2009 |
Questioned Documents |
No indented writing, watermarks or physical characteristics indicating source |
| 20 December 2010 |
Cryptanalysis and Racketeering Records |
"All attempts to decipher the symbols contained in Q3 were unsuccessful" |
Q3 is the laboratory's own label for one of the submitted specimens, carried forward from the first examination to the last.
Two things in that table are easy to walk past.
The first is the unit name. The 2002 report is issued by the Racketeering Records Analysis Unit. The 2010 report on the same evidence, in the same file, is issued by the Cryptanalysis and Racketeering Records Unit. The team that first looked at these pages was not yet the codebreaking unit the case is now attached to.
The second is the 2009 questioned-documents examination, which is a null result and a useful one. Examiners look at a suspect document for the impressions left by writing on a sheet above it, for papermaker's marks, for anything tying the sheet to a place or a batch. They found none of it. What they did record is that the hand printing "may be suitable for comparisons with known writing" if investigators ever produced writing from "any logical suspect(s)". The physical object had nothing left to give; only a name to compare it against would move it.
What "we cannot get past step two" actually rules out
Eight days before it published the appeal, the Bureau published its own account of how manual codebreaking works, and set out four steps: determine the language, determine the system, reconstruct the key, then reconstruct the plaintext (FBI, "Breaking Codes to Stop Crime", 21 March 2011). It taught the method with a worked example, Nffu nf bu uif qbsl bu oppo, which resolves to "Meet me at the park at noon" once you see that every character has moved one place along the alphabet. That is a plain shift cipher, the simplest kind of substitution, and the FBI chose it because it is the shortest possible demonstration of all four steps succeeding in order.
Set that framework against what the unit chief, Dan Olson, told the Riverfront Times in 2012: "We cannot get past step two."
Step two is determining the system. Not the key, not the message: the kind of thing the document is. The FBI's public position has never been that the Ricky McCormick notes are an unsolved substitution or an unbroken transposition, because naming either would mean step two had been completed. Its position is narrower and stranger, and Olson said it plainly in the 2011 appeal: "This is a cipher system we know nothing about."
Two things sharpen that rather than soften it. The 2002 sentence predates the published framework by nine years and came out of a differently named unit, so it is not evidence that the examiner had those four steps in mind. And step one was not the obstacle: the Riverfront Times account of the method names the language in this case as English, so the unit cleared the first step and stopped at the second. Across nine years and two unit names, no report in the released file names a system.
Olson was equally clear about what he had ruled out. "The characters are not random," he told the Riverfront Times. "There are many E's, for example, that could be used as a spacer. There are many characteristics that suggest it could be solved, many patterns. The problem is we don't know why it is not solvable." And, on the possibility of gibberish: "We look at a lot of things that are gibberish, arbitrary strikes on a keyboard. This is not that case."
That is a real distinction, and it is the distinction the case turns on. A document can carry statistical structure without anyone being able to say what generated it. Structure is evidence that something is going on. It is not proof of a system, and no released page names one.
One caution on our own reading of the 2002 sentence. Nothing in the released file offers a second cryptanalysis report to compare it against, so these pages cannot show that the Bureau writes differently when it has identified a system. That phrasing is consistent with deliberate hedging and equally consistent with standard laboratory language for a negative result. What holds either way is the absence of a named system, not the tone of one sentence.
How rare is an unbroken case like this?
Rare enough that the unit keeps a shortlist. Olson told the Riverfront Times that the FBI examines hundreds of suspected codes each year, and that after setting aside the ones judged to be nonsense, roughly 1 percent of those it categorises as solvable go unbroken. Around fifteen of the twenty analysts then on staff had worked the case. In September 2009 the unit took the problem outside, presenting it to about 25 amateur cryptographers at the American Cryptogram Association's annual convention in Niagara Falls, Ontario. Nothing came back.
At the time of that reporting the notes ranked third on the unit's list of top unsolved cases, behind the 1969 Zodiac cipher and a threat letter sent to a public agency the Bureau would not name. All three are pen-and-paper work, which is the only kind this unit takes: the FBI described it in 2011 as the only law enforcement unit anywhere dealing exclusively with manual rather than digital codebreaking.
The 2011 appeal is worth reading for its tone as much as its content. "We are really good at what we do," Olson said, "but we could use some help with this one." There was no reward attached, and the Bureau asked for ideas by post, to an address it printed in full: FBI Laboratory, Cryptanalysis and Racketeering Records Unit, 2501 Investigation Parkway, Quantico, VA 22135. More than 7,000 public theories arrived. By the following year they had produced seven or eight conversations between Quantico and the local detectives, and no arrests.
Who wrote the Ricky McCormick notes, and can anyone show it?
This is the part of the story where the sources stop agreeing, and it deserves to be reported as a dispute rather than resolved by preference.
Olson's position did not move between the 2011 appeal and the 2012 interview, and no FBI statement since has revisited it. "I have every confidence that Ricky wrote the notes," he said. "They are done in more of a format of something written to oneself than something written to someone else." He pointed to circles drawn around some segments, which he read as items ticked off a list.
The version that circulates most widely, and the one the Bureau's appeal reflects, is that McCormick had used a private shorthand since childhood. His family's account is hard to square with it. Interviewed by the Riverfront Times in 2012, his mother, Frankie Sparks, said her son could barely write: "The only thing he could write was his name." His cousin Charles recalled that he "couldn't spell anything, just scribble". Relatives told the paper they had learned about the notes from a television news broadcast twelve years after the death, and that what they had described to investigators was not code but occasional scribbling that Ricky himself called writing.
Elonka Dunin, an amateur cryptographer who has spent many hours on the pages and lives near where the body was found, began by agreeing with Olson that the notes look private rather than performative. After reading more about McCormick's background she changed her mind: "I don't think McCormick wrote these notes. Perhaps he was a courier."
The 2009 questioned-documents report is the only part of the file that could settle it, and it says exactly what it can and cannot do. The hand printing may be suitable for comparison. Nobody has produced the known writing to compare it against.
Murder, or a death nobody could classify?
The FBI's 2011 appeal states without qualification that McCormick "had been murdered and dumped in a field". The records underneath it are more guarded.
Pathologists at the St. Charles County Medical Examiner's Office worked from about 72 pounds of remains and ruled the cause of death "undetermined", as the Riverfront Times reported. The Major Case Squad of Greater St. Louis was activated the same day and still publishes its own entry for the case: report #318, classification "Suspicious Death", a woman who saw a body while driving on Route 367, and deputies responding to the 14000 block of Highway 94 North near West Alton at about 1:12pm. The sheriff's own letter to Quantico surmised a cut throat rather than asserting one.
None of that means the FBI is wrong. Investigators had reasons the autopsy could not supply, including a stretch of bottomland that had been used to leave bodies before. But it does mean that the two firmest-sounding statements in the public version of this case, that a man was murdered and that he left a cipher, are both stronger than the documents that support them. The notes are unsolved. Whether they are a code is a separate question, and the FBI's own file has never answered it.
Frequently asked questions
Are the Ricky McCormick notes definitely a code?
Not in the sense the retellings mean. The Bureau has repeatedly said they are encrypted: its 2010 report records that attempts to "decipher the symbols" failed, and its unit chief called them "a cipher system we know nothing about". What no released FBI document does is name the system. In the Bureau's own four-step method, identifying the system is step two, and Dan Olson said in 2012 that the unit could not get past it. Encrypted and identified are different claims, and only the first has ever been made.
What is in the FBI file that was released?
Eleven pages, and none of them contain cryptanalysis. The release holds three reports of examination, being the 2002 cryptanalysis report, the 2009 questioned-documents report and the 2010 report recording that attempts to decipher the symbols were unsuccessful. Around them sit two letters from the St. Charles County Sheriff's Department, an evidence-receipt letter and the 2001 letter postponing the work. Anyone hoping the file contains the Bureau's working, or a partial answer, will not find either.
Why did it take until 2002 for the FBI to examine the notes?
The evidence reached the FBI Laboratory on 13 November 2001, and on 26 November the Bureau wrote to the sheriff's detective to say the examination would be "delayed for an indefinite period due to the terrorist incidents in New York City, Pennsylvania and Virginia". The report was issued on 12 March 2002. The two-year gap before that submission is a matter for the local investigation, and the released file does not explain it.
How many documents did the FBI actually examine?
More than the two pages the public knows. The 2002 report lists facsimile copies, colour photographs and the originals of two pages from the trouser pocket. When the sheriff's department resubmitted evidence in December 2008, the same specimen label covers a larger set, described as six documents in the 2010 cryptanalysis report and as seven in the 2009 questioned-documents report. The file does not reconcile the two counts.
Has anyone ever claimed to solve them?
Claims have circulated since the notes were published, and the FBI has confirmed none of them. Its 2011 appeal asked for method rather than answers, saying the unit wanted to see how the code is solved even if the contents turned out to be a grocery list or a love letter. Olson's own view was that a solution exists and cannot be forced: "Can it be solved? Yes, I am absolutely confident. But you can't just will it."
Sources
- FBI Records: The Vault, Ricky McCormick, Part 01 (Final), eleven pages of FBI Laboratory correspondence and reports, lab numbers 011126008 LQ and 081215003 PF, dated 14 November 2001 to 20 December 2010. vault.fbi.gov/ricky-mccormick
- FBI, Help Solve an Open Murder Case, Part 2, 29 March 2011, the Bureau's public appeal, with the quotations from Dan Olson and the postal address for submissions. fbi.gov
- FBI, Breaking Codes to Stop Crime, Part 1, 21 March 2011, the four-step method and the worked shift-cipher example. fbi.gov
- Christopher Tritto, Code Dead: Do the encrypted writings of Ricky McCormick hold the key to his mysterious death?, Riverfront Times, 14 June 2012, for the medical examiner's finding, the American Cryptogram Association presentation, the caseload figures and the family interviews. riverfronttimes.com
- Major Case Squad of Greater St. Louis, Report #318, Ricky C. McCormick, its own published case entry, recording the activation date, the location, the time of discovery and the classification. majorcasesquadstl.org
Three laboratory reports across nine years, and a system nobody has named. If you want to see what step two looks like when it succeeds, the cipher identifier does it on the classical ciphers, and the rest of the unbroken codes are one click away.
