WEBVTT 1 00:00:02.439 --> 00:00:04.919 You're listening to Killer in the Code Solving the Black 2 00:00:05.000 --> 00:00:09.320 Dahia and Zodiac cases. I'm Michael Connelly and this is 3 00:00:09.400 --> 00:00:13.640 chapter four. Today we're going to sit down with the 4 00:00:13.679 --> 00:00:18.079 professional codebreakers that were brought in to independently backcheck a 5 00:00:18.160 --> 00:00:22.960 major breakthrough in these two infamous cases, but then proceeded 6 00:00:23.000 --> 00:00:25.559 to come up with two major breakthroughs of their own, 7 00:00:26.559 --> 00:00:30.280 and in the process found the digital evidence that may 8 00:00:30.359 --> 00:00:34.280 solve another cold case. If I was writing this as 9 00:00:34.280 --> 00:00:37.679 a novel, it would definitely be a page turner. And 10 00:00:37.759 --> 00:00:40.280 that's sort of my task today to try to take 11 00:00:40.320 --> 00:00:43.759 this highly technical story and turn it into everyday language 12 00:00:43.920 --> 00:00:48.759 that any listener can follow and understand. I'll do my best. 13 00:00:51.280 --> 00:00:55.079 This all began with cold case consultant Alex Baber cracking 14 00:00:55.119 --> 00:01:00.200 the Holy Grail of Zodiac ciphers, the Z thirteen, so 15 00:01:00.359 --> 00:01:04.560 named because it had only thirteen digits, making it previously 16 00:01:04.719 --> 00:01:09.680 believed to be unbreakable. Z thirteen is also known as 17 00:01:09.719 --> 00:01:13.719 the My Name Is cipher because the Zodiac boasted that 18 00:01:13.760 --> 00:01:17.359 he had put his name into the code. Efforts to 19 00:01:17.400 --> 00:01:21.200 break it were unsuccessful for fifty plus years until Baber 20 00:01:21.280 --> 00:01:24.959 came along and used a combination of AI aided data 21 00:01:25.000 --> 00:01:29.480 crunching and legwork to weed through seventy one million names 22 00:01:29.519 --> 00:01:34.599 and narrow it down to one. Marvin Merrill, also known 23 00:01:34.640 --> 00:01:38.680 as Marvin Margolis, one of the top suspects in the 24 00:01:38.760 --> 00:01:43.840 nineteen forty seven murder of Elizabeth Short, better known as 25 00:01:43.879 --> 00:01:49.359 the Black Dahlia. Baber put together a team of investigators 26 00:01:49.400 --> 00:01:51.760 to help him look for evidence that would support his 27 00:01:51.920 --> 00:01:54.920 findings and lead to the solving of the cases that 28 00:01:55.000 --> 00:01:58.680 have fascinated people for decades. When I was asked to 29 00:01:58.760 --> 00:02:00.840 join the team, the first thing I did was look 30 00:02:00.879 --> 00:02:05.400 for the kind of professional cryptographer that would independently confirm 31 00:02:05.519 --> 00:02:10.280 or condemn Baber's work. If the entire investigation was going 32 00:02:10.319 --> 00:02:13.599 to be built on Baber's claim to have broken Z thirteen, 33 00:02:14.520 --> 00:02:18.599 I had to make sure that claim was legitimate. I 34 00:02:18.639 --> 00:02:21.840 reached out to Ed Georgio, who spent thirty years with 35 00:02:21.919 --> 00:02:25.280 the National Security Agency and is the only man in 36 00:02:25.319 --> 00:02:29.159 the agency's history to hold both chief codebreaker and chief 37 00:02:29.199 --> 00:02:34.120 code maker positions. Georgio, in turn, brought in two other 38 00:02:34.280 --> 00:02:38.960 veteran cryptographers, Patrick Henry and Rich Rozanouski to conduct a 39 00:02:39.000 --> 00:02:42.960 peer review of his work. Together, the three code breakers 40 00:02:43.000 --> 00:02:46.400 have nearly one hundred years of experience, mostly working on 41 00:02:46.479 --> 00:02:50.120 classified projects for the NSA or its British counterpart, the 42 00:02:50.199 --> 00:02:55.520 Government Communications Headquarters. All three are still active in cybersecurity 43 00:02:55.560 --> 00:02:59.840 and sleuthing. As reported in episode one of the podcast, 44 00:03:00.039 --> 00:03:04.120 the Cryptography Team confirmed the work Baber did in arriving 45 00:03:04.159 --> 00:03:08.599 at the name Marvin Merrill hidden in the Z thirteen code. 46 00:03:08.719 --> 00:03:12.039 In the Los Angeles Times, Giorgio called Baber's work the 47 00:03:12.080 --> 00:03:16.000 greatest sluice story ever told, and as he continues work 48 00:03:16.039 --> 00:03:18.719 on the case, he is not backing down. 49 00:03:18.960 --> 00:03:21.680 Believes that this was a monumental discovery. 50 00:03:22.159 --> 00:03:25.479 The world of cryptology is a mystery in itself. It's 51 00:03:25.599 --> 00:03:30.120 populated by mathematicians and cyber experts that speak their own language. 52 00:03:30.639 --> 00:03:33.520 Sometimes what they say is as hard to decipher as 53 00:03:33.560 --> 00:03:37.360 the codes they make or break. But the confirmation of 54 00:03:37.400 --> 00:03:40.560 Baber's breaking of the Z thirteen is based on several 55 00:03:40.639 --> 00:03:45.400 steps that identify the Zodiac's methodology and keywords that in 56 00:03:45.439 --> 00:03:47.639 a way act like the passwords we use on our 57 00:03:47.639 --> 00:03:52.719 computers and phones and websites in everyday life. Each step 58 00:03:52.840 --> 00:03:57.159 successfully take and reduce the possibility of error in Baber's work, 59 00:03:57.479 --> 00:04:00.520 and closed in on Marvin Merrill as the only name 60 00:04:00.879 --> 00:04:02.520 that finally fit the cipher. 61 00:04:02.919 --> 00:04:05.719 There are many people out there who correctly claim that 62 00:04:05.800 --> 00:04:09.199 you could make this cipher decrypt to any name you like. 63 00:04:09.680 --> 00:04:13.840 That's not quite true, but it's it's not strictly incorrect. 64 00:04:14.719 --> 00:04:17.759 That was at Georgio again. I sat down with him 65 00:04:17.759 --> 00:04:20.759 and a member of his team, Patrick Henry, to discuss 66 00:04:20.800 --> 00:04:26.240 their work on the case. Let's start with the original 67 00:04:26.279 --> 00:04:29.279 code maker. In this case, that would be the Zodiac. 68 00:04:30.240 --> 00:04:32.560 He wrote many catch me if you can letters to 69 00:04:32.600 --> 00:04:36.720 the newspapers in the sixties and seventies. For these included 70 00:04:36.800 --> 00:04:40.680 ciphers starting with the Z four oaid. Once again, the 71 00:04:40.800 --> 00:04:44.519 numbers in these code names reflects the number of characters 72 00:04:44.560 --> 00:04:48.680 in the cipher. It is standard knowledge in cryptography that 73 00:04:48.759 --> 00:04:51.480 the longer a cipher is, the better chance there is 74 00:04:51.839 --> 00:04:55.360 that it can and will be broken. The four OA 75 00:04:55.519 --> 00:04:58.680 code was presented in a grid. It was sent in 76 00:04:58.720 --> 00:05:02.319 three parts to three different newspapers. Most of it was 77 00:05:02.360 --> 00:05:05.319 broken within a week by a pair of school teachers. 78 00:05:06.360 --> 00:05:09.279 Not only was it long, but it was designed using 79 00:05:09.319 --> 00:05:13.800 only a substitution methodology, meaning that letters were replaced by 80 00:05:13.959 --> 00:05:18.920 numbers or symbols or other letters. By studying the frequency 81 00:05:18.959 --> 00:05:22.439 of these characters and noting double letters and other anomalies, 82 00:05:22.959 --> 00:05:26.759 a de encryption map could be arrived at that translated 83 00:05:26.800 --> 00:05:30.079 each character in the cipher's grid to the correct letter 84 00:05:30.319 --> 00:05:34.480 in the alphabet. There was an eighteen character tale to 85 00:05:34.519 --> 00:05:37.040 the four to H eight cipher that was not broken, 86 00:05:37.399 --> 00:05:40.399 but we will get to that later in the episode. 87 00:05:41.759 --> 00:05:45.600 Possibly because his first cipher was so easily broken, the 88 00:05:45.720 --> 00:05:49.399 Zodiac made a second cipher, the so called Z three forty, 89 00:05:49.680 --> 00:05:54.439 much tougher. He used a substitution code with a permutation, 90 00:05:55.319 --> 00:05:58.319 which means the characters were shuffled in some way after 91 00:05:58.360 --> 00:06:02.439 the substitution process. Giorgio said it seems clear to him 92 00:06:02.439 --> 00:06:05.879 that the Zodiac stepped up his game with Z three forty. 93 00:06:06.480 --> 00:06:09.040 He probably thought it would be hard to break, if 94 00:06:09.079 --> 00:06:13.319 not secure, but it was broken. That taught him a lesson. 95 00:06:13.959 --> 00:06:16.639 The lesson it taught him was, I need a permutation, 96 00:06:17.399 --> 00:06:20.240 and I'm going to use the knights tour. And that's 97 00:06:20.240 --> 00:06:23.480 what he did, and it went unsolved for fifty years, 98 00:06:23.720 --> 00:06:26.839 and I worked on it myself fifty years ago. 99 00:06:27.199 --> 00:06:30.399 The Z three forty was also a grid cipher. It 100 00:06:30.480 --> 00:06:32.800 finally was broken just a few years ago by a 101 00:06:32.800 --> 00:06:37.560 team of mathematicians and cryptology enthusiasts. They identified the use 102 00:06:37.639 --> 00:06:41.000 of the knight's tour chess move as the permutation in 103 00:06:41.079 --> 00:06:45.639 the cipher. This permutation required shuffling the characters and the 104 00:06:45.680 --> 00:06:48.199 grid in the way a knight is moved on a 105 00:06:48.279 --> 00:06:53.040 chess board that is two squares vertically or horizontally, followed 106 00:06:53.040 --> 00:06:57.399 by one square to the right. In late nineteen sixty nine, 107 00:06:57.680 --> 00:07:03.480 the president of the American Cryptogramociation publicly belittled the Zodiac's 108 00:07:03.480 --> 00:07:06.800 code making skill and challenged him to put his name 109 00:07:06.839 --> 00:07:09.920 in a cipher, expressing doubt that he ever would dare 110 00:07:10.040 --> 00:07:13.839 to do it, but he was wrong. On April twentieth, 111 00:07:13.920 --> 00:07:18.319 nineteen seventy, the Zodiac's third cipher, the Z thirteen, arrived 112 00:07:18.319 --> 00:07:22.399 at the San Francisco Chronicle, with the Zodiac boldly claiming 113 00:07:22.680 --> 00:07:25.399 that he put his name into the thirteen character string 114 00:07:25.439 --> 00:07:30.519 of symbols and letters. By keeping it under fifteen characters. 115 00:07:30.560 --> 00:07:35.360 The Zodiac most likely believed it was unbreakable. Most of 116 00:07:35.399 --> 00:07:38.319 the manuals and literature on code of the day told 117 00:07:38.399 --> 00:07:43.680 him so, but nevertheless, the Zodiac used two coding methodologies 118 00:07:44.000 --> 00:07:49.040 to double down and make sure we will get into 119 00:07:49.040 --> 00:07:51.680 the construction in a minute, but I just wanted to 120 00:07:51.759 --> 00:07:54.959 mention that the Zodiac's last known cipher came in a 121 00:07:54.959 --> 00:07:58.600 few months later, the Z thirty two cipher, which we 122 00:07:58.720 --> 00:08:02.000 talked about in episode three. We'll also have more to 123 00:08:02.040 --> 00:08:06.000 say about that later in the episode. When Ed Giorgio 124 00:08:06.079 --> 00:08:08.720 and his team took up the task of backtracking the 125 00:08:08.720 --> 00:08:12.920 work of Alex Baber, they were chiefly concerned with two things. 126 00:08:13.240 --> 00:08:15.959 The first was to learn how Baber broke the code 127 00:08:16.279 --> 00:08:20.079 and what methods he used to do it. The second 128 00:08:20.199 --> 00:08:23.000 was to put themselves in the Zodiac's shoes and learn 129 00:08:23.079 --> 00:08:26.199 what methods he had used to compose the cipher in 130 00:08:26.240 --> 00:08:29.720 the first place. In a way, these were two separate 131 00:08:29.759 --> 00:08:33.840 investigations that would wrap around each other like a double halix. 132 00:08:35.480 --> 00:08:38.320 There were outside factors that had to be considered at 133 00:08:38.320 --> 00:08:43.519 the start, namely, how did the Zodiac learn cryptology? Baber 134 00:08:43.639 --> 00:08:48.000 believed that the Zodiac's code making had origins in military 135 00:08:48.039 --> 00:08:50.720 code work. This was not a new concept, and the 136 00:08:50.799 --> 00:08:54.679 Georgio team thought the same. We discussed this in chapter 137 00:08:54.759 --> 00:08:58.480 three of the podcast. But here was cryptographer Patrick Henry 138 00:08:58.519 --> 00:09:01.240 with a refresher on the materials that would have been 139 00:09:01.279 --> 00:09:05.559 available to someone encrypting messages in the late nineteen sixties. 140 00:09:06.679 --> 00:09:09.679 The book that I believe would have been the most 141 00:09:10.039 --> 00:09:16.000 readily available was by Helen Gaines, and it's called Cryptanalysis, 142 00:09:16.240 --> 00:09:20.080 A Study of Ciphers and a Solution. And you can 143 00:09:20.159 --> 00:09:24.000 see on the cover a sort of grid based cipher 144 00:09:24.279 --> 00:09:29.360 right there the Army Field Manual on Basic Cryptography, which 145 00:09:29.440 --> 00:09:33.600 was actually published in nineteen fifty after the war. So 146 00:09:34.159 --> 00:09:37.559 it's not clear that he would have had access to 147 00:09:37.639 --> 00:09:43.240 that specifically, but other materials similar materials may have been 148 00:09:43.600 --> 00:09:45.120 available to him. 149 00:09:45.360 --> 00:09:49.039 Henry also mentioned a book originally published in nineteen sixteen 150 00:09:49.120 --> 00:09:52.960 called Manual for the Solution of Military Ciphers by Parker 151 00:09:53.080 --> 00:09:57.600 hit In his investigation, Alx Baber spent two years working 152 00:09:57.639 --> 00:10:01.679 on Z thirteen and trying to identif the methodology used 153 00:10:01.720 --> 00:10:06.559 in the encryption. It was obviously a substitution cipher, but 154 00:10:06.639 --> 00:10:09.840 there was also a permutation that needed to be identified. 155 00:10:11.039 --> 00:10:14.120 Though the cipher was presented by the Zodiac on one 156 00:10:14.200 --> 00:10:17.200 line in the letter to the Chronicle, Baber noted that 157 00:10:17.279 --> 00:10:21.840 the other three Zodiac codes were grid ciphers. He decided 158 00:10:21.879 --> 00:10:24.320 to take Z thirteen and put it on a grid 159 00:10:24.799 --> 00:10:27.799 that is Instead of keeping it on one line, he 160 00:10:27.919 --> 00:10:31.120 broke it into two rows of seven characters with the 161 00:10:31.200 --> 00:10:34.279 addition of a blank or a knull to make sure 162 00:10:34.360 --> 00:10:39.799 there would be seven columns with two characters each. That 163 00:10:39.879 --> 00:10:43.360 move by Baber eventually broke things open when he was 164 00:10:43.399 --> 00:10:48.240 able to identify the methodology use. The seven columns were 165 00:10:48.279 --> 00:10:51.559 shuffled first, and then each letter was replaced in the 166 00:10:51.600 --> 00:10:56.240 substitution scheme. Baber then spent nine months using an AI 167 00:10:56.360 --> 00:10:59.320 program to weed through all the names that fit with 168 00:10:59.360 --> 00:11:05.200 the permutation until there was one name left, Marvin Merrill. 169 00:11:05.360 --> 00:11:08.639 The Georgio team followed the same path and confirmed what 170 00:11:08.759 --> 00:11:12.480 Baber had done. They found that the Z thirteen encryption 171 00:11:12.639 --> 00:11:16.720 method was a variation on the methodology used in the 172 00:11:16.759 --> 00:11:18.720 other zodiac ciphers. 173 00:11:19.759 --> 00:11:23.759 I know it's a difficult concept, but the permutation that 174 00:11:23.799 --> 00:11:28.559 Alex gave us we believe is correct in part because 175 00:11:29.039 --> 00:11:33.159 the method of encryption is very consistent with his prior 176 00:11:33.559 --> 00:11:39.159 methods of encryption, and what Patrick just said about the 177 00:11:39.240 --> 00:11:41.519 games book that tells you this is the way to 178 00:11:41.559 --> 00:11:41.879 do it. 179 00:11:44.360 --> 00:11:46.279 If this was a movie, this is where the story 180 00:11:46.320 --> 00:11:50.159 would suddenly pivot and pick up speed ed and Patrick 181 00:11:50.200 --> 00:11:53.399 and Rich the x NSA. Guys didn't leave it there. 182 00:11:53.440 --> 00:11:57.879 With the confirmation of Alex Baber's methodology and solution, they 183 00:11:57.919 --> 00:12:02.399 went from code breaking to code making. They started thinking 184 00:12:02.440 --> 00:12:05.000 like the zodiac and how you would have composed the 185 00:12:05.120 --> 00:12:09.000 Z thirteen cipher. Every book in text and primer on 186 00:12:09.120 --> 00:12:13.080 code making, including those mentioned, already tells you to start 187 00:12:13.120 --> 00:12:16.080 with a keyword that can be used to compose as 188 00:12:16.159 --> 00:12:20.279 well as unravel the cipher. A word with at least 189 00:12:20.360 --> 00:12:23.240 six to eight letters that can be numbered in order 190 00:12:23.519 --> 00:12:27.639 of their appearance in the alphabet. The resulting number becomes 191 00:12:27.639 --> 00:12:32.919 the permutation key or the substitution key. For example, if 192 00:12:32.960 --> 00:12:36.000 you have your message in a grid with say four columns, 193 00:12:36.360 --> 00:12:39.279 you want a keyword that is at least four characters long. 194 00:12:39.840 --> 00:12:42.919 So say you use the word flag as your keyword. 195 00:12:43.919 --> 00:12:47.080 You start by placing F above the first column, L 196 00:12:47.159 --> 00:12:50.600 above the second column, A above the third, and G 197 00:12:50.759 --> 00:12:54.559 above the fourth. Then you sort the columns to put 198 00:12:54.600 --> 00:12:59.320 the letters of the keyword in alphabetical order, which with 199 00:12:59.600 --> 00:13:04.120 the word flag would be A, F, G, L. The 200 00:13:04.200 --> 00:13:07.639 A originally started above the third column, but A comes 201 00:13:07.679 --> 00:13:10.519 before all the others in the alphabet, so that third 202 00:13:10.600 --> 00:13:13.480 column gets re arranged to be in the first position. 203 00:13:13.840 --> 00:13:17.279 The first column F would be the next letter in 204 00:13:17.360 --> 00:13:20.960 the keyword to come alphabetically, So the F column moves 205 00:13:21.000 --> 00:13:24.080 into the second position, followed by the G column, and 206 00:13:24.120 --> 00:13:28.399 then finally the L column. You have now shuffled the columns. 207 00:13:29.159 --> 00:13:34.080 Cryptographers then typically converts such a keyword into numbers. The 208 00:13:34.159 --> 00:13:38.240 keyword flag, for example, would have a numerical of two 209 00:13:38.399 --> 00:13:42.159 four one three, again by sorting the letters of the 210 00:13:42.200 --> 00:13:45.240 word flag according to the order they come in in 211 00:13:45.320 --> 00:13:48.960 the alphabet. The A comes first, so it gets assigned 212 00:13:49.000 --> 00:13:51.799 the number one, and F is the second, so it 213 00:13:51.879 --> 00:13:55.240 gets to number two. G gets number three, and the 214 00:13:55.320 --> 00:13:58.240 fourth letter alphabetically is L, so it gets a four. 215 00:13:58.919 --> 00:14:02.399 So F L A G becomes two four one three. 216 00:14:03.399 --> 00:14:06.039 It's complicated, and I hope I have explained it clearly. 217 00:14:06.639 --> 00:14:09.039 But you can go to our website to find links 218 00:14:09.039 --> 00:14:12.600 to sites that further explaining this permutation, which is often 219 00:14:12.639 --> 00:14:19.159 referred to as a Columner transposition with his Z thirteen code. 220 00:14:19.159 --> 00:14:22.720 The permutation key, if it could be discovered, would reveal 221 00:14:22.759 --> 00:14:26.200 the correct order of the seven shuffled columns, and that, 222 00:14:26.279 --> 00:14:31.559 of course, would further confirm Baber's solution. Patrick believed that 223 00:14:31.679 --> 00:14:36.000 the sophistication of the Zodiac ciphers indicated that demand behind 224 00:14:36.039 --> 00:14:39.679 them would have used a key, so he started looking 225 00:14:39.720 --> 00:14:40.080 for it. 226 00:14:42.399 --> 00:14:46.559 Patrick was convinced that the permutation wasn't random and spent 227 00:14:46.759 --> 00:14:50.960 days reverse engineering it. And I said to myself, geez. 228 00:14:50.759 --> 00:14:53.960 He's probably going down a dead death, and he kept saying, 229 00:14:54.000 --> 00:14:56.600 I mean no, there's got to be some way. He 230 00:14:56.679 --> 00:14:59.960 came up with the permutation and Patrick stuck it out 231 00:15:00.039 --> 00:15:01.919 out tried every combination. 232 00:15:02.919 --> 00:15:05.639 So I had moved on I would I didn't do that. 233 00:15:06.039 --> 00:15:08.799 So it just shows how what the value of a 234 00:15:08.879 --> 00:15:09.360 team is. 235 00:15:10.240 --> 00:15:13.399 The bottom line is Patrick found it. You turn a 236 00:15:13.480 --> 00:15:16.480 key to unlock a door. Patrick found that the keyword 237 00:15:16.519 --> 00:15:21.080 that unlocked the door when Z thirteen was Elizabeth. And 238 00:15:21.120 --> 00:15:23.679 by the way, you can only use a letter once 239 00:15:23.879 --> 00:15:26.799 in a permutation key. So it became clear that the 240 00:15:26.879 --> 00:15:30.919 Zodiac had dropped the first D in Elizabeth. 241 00:15:30.679 --> 00:15:33.159 After an AHA moment, definitely. 242 00:15:34.159 --> 00:15:38.799 So Alex recovered the permutation and Patrick figured out how 243 00:15:38.840 --> 00:15:42.240 it was generated in the first place. It was generated 244 00:15:42.279 --> 00:15:46.039 by a standard scheme using the keyword Elizabeth. 245 00:15:46.840 --> 00:15:52.159 That's something that really lends weight to this solution being correct. 246 00:15:52.600 --> 00:15:58.480 It's not just an anagram of the ciphertext that you 247 00:15:58.600 --> 00:16:02.799 then apply it septstitute to and get a random name. 248 00:16:03.320 --> 00:16:11.440 It's a very structured reordering using the kinds of permutations 249 00:16:12.240 --> 00:16:18.080 that were used in standard reference works. They all start with, okay, 250 00:16:18.159 --> 00:16:21.480 here's how to make a substitution. Now here's how to 251 00:16:21.519 --> 00:16:27.080 make a permutation, which is commonly called a columnar transposition, 252 00:16:27.759 --> 00:16:32.360 and then a discussion of okay, well we want to 253 00:16:32.440 --> 00:16:35.960 combine these two in order to get a cipher that's 254 00:16:36.000 --> 00:16:38.159 really resistant to announce us. 255 00:16:39.759 --> 00:16:42.960 It was a stunning discovery Marvin Merrill. It used the 256 00:16:43.039 --> 00:16:45.960 name of the black Dahlia as the keyword to a 257 00:16:46.080 --> 00:16:51.279 zodiac cipher. It was another irrefutable connection between the cases. 258 00:16:51.840 --> 00:16:57.639 All three parts of the crypto investigation came together, methodology, keyword, 259 00:16:58.200 --> 00:16:58.879 and solution. 260 00:16:59.639 --> 00:17:03.039 So when people out there assert, hey, you can make 261 00:17:03.120 --> 00:17:06.200 this decrypt to any name you want, they are correct. 262 00:17:06.400 --> 00:17:09.400 But can you make it decrypt to something that has 263 00:17:09.480 --> 00:17:12.880 all these other attributes, like we had prior knowledge that 264 00:17:12.920 --> 00:17:15.960 this was a suspect, like we had prior knowledge of 265 00:17:16.000 --> 00:17:19.160 the encryption system, like we had prior knowledge that this 266 00:17:19.599 --> 00:17:21.279 was this person called Elizabeth. 267 00:17:21.680 --> 00:17:22.960 You can't, You just can't. 268 00:17:22.759 --> 00:17:26.079 Put all those three things together and come up with 269 00:17:26.119 --> 00:17:30.279 the answer. Excuse me, come up with a believable answer. 270 00:17:31.039 --> 00:17:34.640 You have to take all three as a package. The 271 00:17:34.680 --> 00:17:39.200 first thing is the suspect's name. The second thing is what. 272 00:17:39.319 --> 00:17:42.599 Actual encryption method was used? All right, not what the 273 00:17:42.640 --> 00:17:47.079 answer was, what was the method. So we think that 274 00:17:47.240 --> 00:17:51.559 his method looks very much like his prior methods. It 275 00:17:51.759 --> 00:17:55.680 also the method is well informed by the gains text. 276 00:17:56.559 --> 00:18:01.599 The third thing is, hey, a keyword actually generates the permutation, 277 00:18:02.319 --> 00:18:06.319 and what is that keyword? That keyword is Elizabeth. Oh 278 00:18:06.359 --> 00:18:09.640 my god. We've got great prior evidence in favor of that. 279 00:18:09.960 --> 00:18:13.279 So what we see in the cipher text that crazy 280 00:18:13.480 --> 00:18:19.400 thirteen long sequence is a precise mapping. From that, all 281 00:18:19.440 --> 00:18:22.079 of those three assumptions have to be correct to. 282 00:18:22.079 --> 00:18:26.880 Get at every stage in the way from the Z 283 00:18:27.119 --> 00:18:33.240 thirteen to Marven Merrill. We have a believable, clausible method 284 00:18:33.519 --> 00:18:36.599 to get from one to the other. And they all 285 00:18:36.680 --> 00:18:39.759 kind of make sense, and they all hang together. And 286 00:18:40.559 --> 00:18:43.279 generally that is not the kids Like if you have 287 00:18:43.440 --> 00:18:47.839 a one of the other thousands of names that could 288 00:18:47.920 --> 00:18:52.480 fit in terms of having the right number of repeats 289 00:18:52.519 --> 00:18:57.480 in them, they won't necessarily match this permutation method with 290 00:18:57.640 --> 00:19:02.359 any permutation, and if they do, the permutation keyword might 291 00:19:02.440 --> 00:19:07.000 not be believable. And if they do, the name might 292 00:19:07.640 --> 00:19:11.359 end up being something that isn't the name of a 293 00:19:11.440 --> 00:19:14.279 real life person or a real dead person in this case. 294 00:19:14.400 --> 00:19:17.640 And if they do, then you end up with a 295 00:19:17.680 --> 00:19:21.480 substitution that has no known structure to it. But at 296 00:19:21.480 --> 00:19:24.640 every stage in this we have structure. We have a 297 00:19:24.759 --> 00:19:30.039 sort of a method of construction that is believable, matches 298 00:19:30.079 --> 00:19:36.920 what was commonly described in texts and was and sort 299 00:19:36.960 --> 00:19:41.319 of build in our confidence that this is the right solution. 300 00:19:43.119 --> 00:19:46.440 I asked Georgia or Henry why they thought the Zodiac 301 00:19:46.440 --> 00:19:49.559 would use a keyword that, if discovered, could connect him 302 00:19:49.680 --> 00:19:50.640 to another case. 303 00:19:51.759 --> 00:19:55.640 I think he would. He was trying to leave clues, 304 00:19:55.880 --> 00:20:00.000 and he was trying to make it sort of tantalife 305 00:20:00.200 --> 00:20:05.240 sing but hard, and so that when somebody did finally 306 00:20:05.279 --> 00:20:07.839 come up with the solution, they would be able to 307 00:20:07.880 --> 00:20:11.359 see how it was constructed and what the keyword was 308 00:20:11.519 --> 00:20:15.880 and it wasn't just something made at random. 309 00:20:16.079 --> 00:20:20.279 The keyword discovery galvanized the cryptography team because they now 310 00:20:20.440 --> 00:20:23.279 understood that if the Zodiac used a keyword for the 311 00:20:23.400 --> 00:20:27.440 Z thirteen codes permutation. Then he most likely used a 312 00:20:27.480 --> 00:20:32.799 keyword for the substitution scheme as well. Once again they 313 00:20:32.799 --> 00:20:36.680 were back in the zodiac shoes, figuring out what steps 314 00:20:36.720 --> 00:20:37.519 he would have taken. 315 00:20:38.400 --> 00:20:41.119 I think he would have started with the writing his 316 00:20:41.240 --> 00:20:45.400 name in the grid and thinking what do I do next? Okay, 317 00:20:45.440 --> 00:20:48.960 I do a permutation. So I'll come up with a keyword. 318 00:20:49.480 --> 00:20:53.079 Use the keyword to make a permutation. All right, I'm 319 00:20:53.119 --> 00:20:56.920 going to use Elizabeth. And so he used Elizabeth and 320 00:20:56.960 --> 00:21:02.759 then reordered the letters. Now, just reordering the letter is 321 00:21:02.839 --> 00:21:05.359 not going to be anywhere and it is secure enough. 322 00:21:05.480 --> 00:21:09.480 So you have to have a substitution as well. And 323 00:21:09.519 --> 00:21:12.559 how do you come up with the substitution. We don't 324 00:21:12.680 --> 00:21:15.480 know how he came up with the substitutions, but his 325 00:21:15.680 --> 00:21:21.279 earliest ciphers, we do believe that he used a keyword 326 00:21:21.680 --> 00:21:24.799 for the substitution in Z thirteen. 327 00:21:25.720 --> 00:21:28.240 Having brought in late to Patrick's belief that there was 328 00:21:28.279 --> 00:21:31.960 a permutation keyword, ed dove headlong into the search for 329 00:21:32.039 --> 00:21:35.960 a keyword to the substitution scheme in Z thirteen. He 330 00:21:36.039 --> 00:21:38.720 worked at night and day, and on Thanksgiving morning, he 331 00:21:38.880 --> 00:21:42.799 was once again back in front of the computer. Earlier, 332 00:21:42.839 --> 00:21:46.240 he had identified the exact mapping of symbols to letters 333 00:21:46.319 --> 00:21:49.000 in the code. He now had to find the keyword 334 00:21:49.279 --> 00:21:53.359 that corresponded to it. An exhaustive search came up with 335 00:21:53.599 --> 00:21:58.759 nineteen possibilities. Most of these words were nouns, verbs, and 336 00:21:58.839 --> 00:22:05.279 adjectives ascending, freighter, and cherished. Only three of the nineteen 337 00:22:05.319 --> 00:22:11.720 words were recognizable as names, Siegfried, Frederico, and Scherry Joe 338 00:22:12.599 --> 00:22:16.599 with Sherry spelled unusually with a C, and Joe without 339 00:22:16.640 --> 00:22:20.519 an E. The names and words meant nothing to Georgio. 340 00:22:20.720 --> 00:22:23.359 He fed them into an AI program and asked if 341 00:22:23.400 --> 00:22:26.519 any of the words on the list held any significance 342 00:22:26.839 --> 00:22:31.200 in either the Zodiac or Black Dahia cases. The answer 343 00:22:31.279 --> 00:22:35.759 was immediate. Cherry Joe Bates was murdered in Riverside, California, 344 00:22:35.799 --> 00:22:39.440 in nineteen sixty six and thought by many to be, 345 00:22:39.720 --> 00:22:43.640 but never officially declared by police, to be a victim 346 00:22:43.640 --> 00:22:44.519 of the Zodiac. 347 00:22:45.599 --> 00:22:47.960 So this was kind of the second AHA moment. 348 00:22:49.920 --> 00:22:52.640 Cherry Joe Bates was an eighteen year old college dudent 349 00:22:52.680 --> 00:22:56.240 at Riverside Community College. She was murdered on the night 350 00:22:56.279 --> 00:23:01.160 of October thirtieth, nineteen sixty six. Shortly after leaving the 351 00:23:01.200 --> 00:23:06.079 school's library, her car had been disabled, and she walked 352 00:23:06.079 --> 00:23:08.400 off with a man promising to give her help and 353 00:23:08.400 --> 00:23:12.960 a ride home. She was slashed and stabbed during a struggle, 354 00:23:13.240 --> 00:23:18.160 and her body was found the next morning. Police determined 355 00:23:18.160 --> 00:23:21.799 that the distributor on her Volkswagen's engine had been disconnected, 356 00:23:22.079 --> 00:23:27.720 which indicated her murder was premeditated. In the weeks that followed, 357 00:23:27.759 --> 00:23:31.359 police and local newspapers received a variety of letters from 358 00:23:31.359 --> 00:23:35.240 her alleged killer. Most were proven to be hoaxes, but 359 00:23:35.359 --> 00:23:38.839 one so called confession letter was determined to be from 360 00:23:38.880 --> 00:23:43.039 the actual killer because of the details it provided, including 361 00:23:43.119 --> 00:23:46.799 that he had pulled the middle wire on the Volkswagen's distributor. 362 00:23:48.240 --> 00:23:51.599 Police also recovered a wooden desk from the library with 363 00:23:51.799 --> 00:23:55.000 references to Sherry Joe's murder written on it. This was 364 00:23:55.039 --> 00:23:58.599 also determined to have been the work of the real killer. 365 00:24:00.079 --> 00:24:04.039 Three years later, with the murder unsolved, Riverside detectives noted 366 00:24:04.079 --> 00:24:06.799 the similarities to what was happening up in the Bay 367 00:24:06.880 --> 00:24:11.000 area with the so called Zodiac killer. He too had 368 00:24:11.039 --> 00:24:14.000 a pension for reaching out to newspapers and threw them 369 00:24:14.079 --> 00:24:18.599 to the police. The Riverside detectives met privately with their 370 00:24:18.640 --> 00:24:23.039 Bay Area counterparts to compare the cases, but the possible 371 00:24:23.079 --> 00:24:27.039 connection between the cases was not exposed publicly until late 372 00:24:27.160 --> 00:24:31.480 nineteen seventy, when the San Francisco Chronicle reporter Paul Avery, 373 00:24:31.839 --> 00:24:34.480 later to be portrayed by Robert Downey Junior in the 374 00:24:34.480 --> 00:24:39.039 movie Zodiac, broke the story. There were several intriguing connections 375 00:24:39.079 --> 00:24:42.119 between the cases, including the use of similar words and 376 00:24:42.240 --> 00:24:45.680 duplicate misspellings in the letters from the Zodiac and the 377 00:24:45.759 --> 00:24:50.240 Riverside Killer, For example, both used the word twitch in 378 00:24:50.279 --> 00:24:54.279 their writing, both misspelling it the same way. In a 379 00:24:54.319 --> 00:24:57.880 newspaper interview with Sherry Joe's father a year after the murder, 380 00:24:58.279 --> 00:25:01.079 he spoke of their loneliness in his life since losing 381 00:25:01.119 --> 00:25:04.680 her and could only refer to her killing as quote 382 00:25:04.960 --> 00:25:09.559 this thing that happened. Two years later, but before the 383 00:25:09.599 --> 00:25:14.000 possible connection between the cases were revealed publicly, the Zodiac 384 00:25:14.160 --> 00:25:17.519 said in a letter to the San Francisco Chronicle, I 385 00:25:17.599 --> 00:25:21.319 get awfully lonely when I am ignored, so lonely I 386 00:25:21.359 --> 00:25:28.920 could do my thing. While there were many other similarities, 387 00:25:29.400 --> 00:25:34.200 there were things that didn't quite fit the specific targeting 388 00:25:34.279 --> 00:25:37.759 of Sherry Joe, as opposed to the seemingly randomness of 389 00:25:37.799 --> 00:25:42.680 the Zodiac killings, the distance between Riverside and the Bay Area, 390 00:25:43.119 --> 00:25:47.119 the fact that the Riverside confession letter was tight and 391 00:25:47.160 --> 00:25:51.680 all the Zodiac communications were handwritten. Though in the years 392 00:25:51.680 --> 00:25:56.079 that followed the FBI investigated the possible links between the cases, 393 00:25:56.200 --> 00:25:59.599 the investigations were never fully and officially combined when the 394 00:25:59.599 --> 00:26:06.000 different seemed to outweigh the similarities. The team investigating Marvin 395 00:26:06.039 --> 00:26:10.519 Merrill believes they are now inextricably linked because the zodiaci's 396 00:26:10.640 --> 00:26:14.960 Cherry Joe has a keyword in composing the Z thirteen cipher, 397 00:26:15.440 --> 00:26:18.680 at least four months before the San Francisco Chronicle and 398 00:26:18.759 --> 00:26:22.519 Paul Avery broke the story that the cases might be linked. 399 00:26:23.640 --> 00:26:26.319 This is veteran homicide detective Rip Jackson. 400 00:26:27.440 --> 00:26:32.880 That's a mind boggling fact that would rivet any detective 401 00:26:32.920 --> 00:26:36.440