Introduction

If you are into cryptology like me you probably agree that ciphers and codes become a lot more intriguing if their authors are infamous. The best-known examples are the letters sent to press and police between 1969 and 1970 by the Zodiac Killer. Even though the chances of actually decoding these ciphers are slim, people work tirelessly and achieve major breakthroughs, sometimes decades later. They share insights to work on something bigger than themselves and the author, joining the meticulous process of scientific analysis, motivated by the potential insights into the mind of a killer. Cryptoanalysis itself is fun, but moreover, a deciphered letter could lead to clues unknown to the police, possibly to the killer’s identity.

In the case of Robert Crimo III, the identity of the killer is pretty clear as he was apprehended only eight hours after his attack. Also known as “Awake the Rapper,” an unsuccessful YouTuber and game streamer, then 21-year-old Crimo perpetrated a mass shooting on July 4, 2022, during the Independence Day parade in Highland Park, IL, USA. He killed seven and wounded another forty-eight, for which he received seven consecutive life sentences and a couple thousand years on top. By now, he has vanished into the US prison system, his location unknown to deter conspiracists, copycats, and other freaks alike.

What remains, though, is a 28-page manifesto known as “Arcturus,” published as a book on Amazon on February 19, 2021. Besides the title, the author’s name “Robert Crimo,” and a signature Finnish Nazi symbol also used in his videos, it contains 27 pages consisting almost entirely of numbers. These are grouped in blocks of 86 × 38 = 3268 unigrams. At the end of pg. 2, one digit seems to have been replaced with an apostrophe (‘), which led people to speculate it may be a clue toward the decryption of the supposed cipher. Furthermore, pg. 10-18 and pg. 19-27 are identical to pg. 1-9, including the apostrophe. Therefore, I focused all my studies on just the first nine pages (29,412 unigrams). To give you an idea, here are the first thousand digits:

2390382085723830435612394023863284239834847382810234865746501012348765101847564378010101347568347502453764303287416273465671637647207164013857634762783400451732616173456834848393827263737848022081726378208376073865476187645287620101713822038376457168202010834567048365020101084765287649526784627643764782013829287364583914756370101704782659346104267834652038475634702983746502028762018010482746572634720108713465627382838945764774847249020108430130283028115902483576294875601745623773738293940287613790784380767801087140871342657474738297146501010410876571674637010827631802083746576382021375603808376457126602415876450183745602072641235324210874650834830392764503465747435545431349056762404042688957847447014587841656664329927653234523491027364018451170145308813745932098517341150410384512084586784504185714087478485010192928383288058457827475820284751645729781603875601337130158974238097540328957028934750838475574839202348571014501472560347561108475673204375601834709243764676458761475808437502983…

State of research

Immediately intrigued, I gathered what little information I found online. Starting in July 2025, three whole years after the incident, I was at a disadvantage because much of the content regarding Crimo has already been scrubbed from the internet. While I agree that this is necessary for legal reasons and to prevent a cult following, I am not particularly a fan of Google playing internet police and censoring results that concern Crimo or Arcturus. (Honestly, just use DuckDuckGo instead.) Thus, I had already spent two days on analyzing Arcturus before I found the in-depth analysis performed by David Oranchak. However, working on the cipher myself helped me not only to comprehend Oranchak’s clever work but also to confirm and expand upon his key findings:

• The frequency of unigrams ‘0’ to ‘9’ varies a lot. While you can expect a frequency of roughly 10% per digit in a uniform random sample, the digits ‘6’ and ‘9’ make up 13.4% and 6.0% of Arcturus, respectively. Moreover, these frequencies change from page to page, achieving the highest variance on pg. 8.

• The analysis of the bigrams ‘00’ to ‘99’ turns up even greater variance; for example, the most common bigram ‘76’ occurs 16 times more often than the least common bigram ‘44’. Generally, bigrams with digits that are only ±1 apart appear more frequently, while bigrams with identical digits are underrepresented.

• I also analyzed the first-order difference (FOD) of bigrams, i.e., the delta between each bigram, and found distinct spikes in the histogram for FODs of (0, 9, -9). This means that when split into bigrams, Arcturus features many consecutive identical bigrams, e.g., ‘1010’ or ‘6161’, but also many bigrams with a difference of ±9, e.g., ‘3746’ or ‘7465’. This initially led me to believe that Arcturus is somewhat cyclic, an observation also made by Oranchak, which indicates a repeating key like in Vigenère. In addition, small bigrams are rarely followed by large bigrams or vice versa, e.g., ‘0098’ or ‘9601’, which goes hand in hand with large FODs and decreased probabilities toward the edges of the histogram.

• Judging by Crimo’s videos and Twitter posts, he was obsessed with certain numbers, such as 23, 47, or 115, painting them onto his car and even tattooing them onto his face. I suppose this initially motivated actual or wannabe codebreakers (one and the same, really) to apply Crimo’s favorite numbers to the ciphertext in all kinds imaginable. There are many more clues, such as a word puzzle book for adults sold by the same seller on Amazon, or various interpretations of the word “Arcturus.” While I certainly find that fascinating, I believe it is misleading, which I will prove scientifically.

Ultimately, an article by Klaus Schmeh proved valuable twice; not only did it first call my attention to Arcturus, but one particular comment made me rethink everything my analysis had turned up so far:

Aims & Methods

If David Vierra’s conclusion were true, it would mean that Arcturus is not a cipher but only a meaningless stream of numbers manually typed by a very sick person. Hence, I decided to prove (rather wanting to disprove) this interpretation by conducting my own unbiased experiments. Google’s censoring efforts aside, my attempt to settle the debate once and for all would certainly be in the public interest.

Five key questions I asked myself were:

1. Which established parameters and tests should be used to compare Arcturus against reference cryptograms?
2. Which reference cryptograms should I include to compare Arcturus against?
3. How many people do I need for typing “random” numbers until it yields statistically meaningful results, and how to instruct them?
4. If Crimo typed Arcturus by hand, did he do it with the number row, the number pad, or a combination of both?
5. How consistent is Arcturus in itself, or in other words, could multiple authors have typed it?

The good news first: I can answer all of these questions in one single graphic. However, the somewhat sad news: you will still need to read the text. Let us start with the methods.

Tests & Parameters

After I dabbled a little in developing my own JavaScript application that let me picture and analyze the frequency of bigrams and their FODs, I decided on three fundamental tests often used in cryptology to calculate the difference between texts and their n-gram frequencies. As n-grams, I focused on unigrams ‘0’ to ‘9’, bigrams ‘00’ to ‘99’, and trigrams ‘000’ to ‘999’.

• Index of Coincidence (IoC): A measure of how “spiky” or uneven the unigram frequency is within a single text. Arcturus has an IoC of 0.104, which can be directly compared to the IoC of any other ciphertext. A low IoC generally points towards a high degree of randomness or a cipher being polyalphabetic. The percent error ε_IoC may be calculated to express the similarity between Arcturus and any ciphertext as a single parameter.
• Chi-squared test (χ²): A measure of how much the n-gram frequencies of one ciphertext deviate from any other ciphertext. A low score indicates that the n-gram frequencies are nearly identical, suggesting that both texts were created with the same method.
• Spearman rank (ρ_s): A test that compares the order of popularity of the n-grams between two ciphertexts, ignoring their exact frequencies. A score of +1 means that the n-grams are ranked in the same order of popularity, implying a strong structural similarity between the ciphertexts.

I used these three parameters to calculate a similarity score Σ for each ciphertext I investigated, so that a high value indicates a strong similarity between Arcturus and the respective ciphertext:

Reference cryptograms

To prove that Arcturus is either a true ciphertext or a manually typed sequence, I needed several of both before drawing any conclusions. Reference cryptograms can be divided into two classes: statistical and actual ciphertexts.

The statistical cryptograms are generated with a random distribution. The most fundamental is the uniform random distribution, which yields n-grams with equal frequencies. Other candidates worth considering are random number sequences based on the n-gram frequencies of Arcturus. Taking it a step further, a shuffled version of Arcturus features an identical set of unigrams but may yield vastly different frequencies for larger n-grams.

The actual cryptograms are generated based on classic and custom symmetric encryption methods. These may defy Kerckhoff’s principle by not relying on a key, but instead on being unknown to codebreakers. This is the most likely scenario if Crimo were to have used a self-made cipher, unless he used a combination of several classic encryption methods. I decided to include:

• ArcBoard, which I designed for the task. Specifically, a letter key on the keyboard can be identified by its row and column index, which (coincidentally!) can be represented by the number bar above and the number pad to the right. Including space characters for additional zeros, random choices in the respective rows of the number pad, and switches between row and pad for every letter yields a fun little homophonic substitution cipher, which is about as secure as leaving your credit card in the middle of Berlin Alexanderplatz.
• Pollux, which was previously investigated by Oranchak. It is basically Morse code, but I replaced dots with a random choice of (3, 6, 7), dashes with a random choice of (1, 4, 9), and spaces with a random choice of (0, 2, 5, 8), to allow for uneven unigram frequencies and include a pure homophonic substitution cipher.
• PolyCube, which I also custom-made to showcase the behavior of a polyalphabetic substitution cipher. In essence, a cube of size 3 x 3 x 3 = 27 is sequentially filled with the 26 letters of the English alphabet, leaving the center for the space character. Each letter of the plaintext can then be represented by its X,Y,Z-indices, which are (1,2,3), (4,5,6), and (7,8,9), respectively. Their order does not matter, so both (1,4,7) and (7,1,4) stand for the letter ‘A’. Shifting the cube’s indices by one (mod 10) for each letter introduces zeros into the cipher as well as the polyalphabetic component, somewhat equalizing the n-gram frequencies. This encryption method is the security equivalent of leaving your wallet at a bistro whose owner is a known gambler.
• Biblos, which I made to include something similar to a book cipher. As the word “bible” is derived from “βίβλος” (old-Greek for “book”), I used the book of all books to precompute all possible phrases of up to 100 characters length. A plaintext can then be expressed by short and long phrases from the bible, which in turn can be expressed by a 7-digit index and a 2-digit length. To reduce the number of consecutive zeros and introduce a polyalphabetic component, every eleven digits are added to the next eleven digits (mod 1E11), which can easily be reversed during decryption. Interestingly, the ciphertexts are only marginally longer than the plaintexts, but to be performant, Biblos requires an overhead of 151 MB. This cipher is approximately as secure as writing down what you did last summer on pg. 69 of a random hymnbook at church.

For the actual cryptograms, I encoded the manifesto of Ethan Miller, who killed two people and wounded two more in Bend, OR, USA, on August 28, 2022. Stricken with depression, I assume Crimo would have written something similar if Arcturus were an actual cipher.

Test subjects

After I had typed a couple of thousand digits, I decided to call upon friends and turn it into a contest. As external motivation, I promised the winner (i.e., the one with the highest similarity score Σ, i.e., the random number sequence closest to Arcturus), a small prize. However, as I wanted to interfere as little as possible, I only asked them to type between 4,000 and 30,000 random numbers on the number row of their home computer or laptop.

As it turns out, different people have different interpretations of the word “random,” in some cases producing sequences like ‘555555555555555’ because they thought it was for another art project of mine. Again, I decided to not interfere but hope that the statistical parameters were robust enough. Overall, I got 19 people to participate and produce a total of 142,745 digits, with an average of 7,513 and a standard deviation of 3,995. During analysis, all ciphertexts were cleaned of accidentally typed letters and symbols, a process I automized. However, due to his (presumably) low programming skills, it can be expected that Crimo did the cleaning manually, potentially adding or removing digits from the ciphertexts to eliminate patterns that seemed non-random to him. On a sample basis, these manual revisions affect the investigated cryptographic parameters only marginally.

Keyboard

To answer the question whether Crimo used the number row, the number pad, or a combination of both while producing Arcturus, I evaluated all three methods by typing ciphertexts between 4,992- and 30,160-digits length. For this, I used my Corsair Gaming Keyboard K70 (MX RGB Red), which like most mechanical keyboards features high precision and speed at the cost of a higher force needed to press down keys. My keyboard, just like the ones my test subjects used, has a German layout, which should have no impact on the study, though, as the number row and pad are arranged exactly like on US keyboards.

I did not do any research on what keyboard Crimo might have used, but since he was a gamer like me he might have used a similar mechanical keyboard. Nonetheless, I did some research into how the keys of mechanical keyboards degrade over time, thereby producing accidental double digits (which I observe on my own keyboard for the most commonly used vowels, e.g., ‘ee’ or ‘aa’). I tried to match the results with the number keys used in Call of Duty (Black Ops), which Crimo played often. Specifically, the number row is used for switching between the primary (‘1’) and the secondary (‘2’) weapon, as well as activating rewards for kill streaks. The number pad is not used at all in Call of Duty, which is unrelated to my assumption that Arcturus was most likely typed using the number row. Moreover, subject C brought to my attention that weapons can be switched by rotating the mouse wheel. This greatly decreases the importance of the number row in Call of Duty, making any wear of its keys undetectable. Since I found the results inconclusive, I decided not to show them here.

Results

Not to beat around the bush anymore, here are all my results in one neat table (click the image to maximize):

Authorship

To estimate the likelihood that Arcturus was typed by one and the same person, I analyzed each of the nine pages separately, which yielded IoC scores between 0.101 (-2.7% below Arcturus; nearly uniform random) and 0.112 (8.1% above Arcturus; some semblance to natural language). In direct comparison with the entire Arcturus ciphertext, all individual pages achieve low χ² and high Spearman ranks throughout, especially for bigrams. The comparably poor results for the Spearman ranks of unigrams were already evident by the page-wise varying unigram frequencies but do little to diminish the overall high similarity scores Σ, which range from 1.51 (pg. 8) to 2.37 (pg. 3). With an arithmetic mean of 1.95 and a standard deviation of 0.26, this strongly suggests that Arcturus was produced by one single author, especially considering that the IoC for the combined ciphertexts of all test subjects is as low as 0.102, which suggests a higher degree of randomness if multiple authors are involved.

Test subjects

Similar to the authorship analysis, the ciphertexts that were manually typed by the test subjects show a high variation of the IoC, ranging from 0.102 (subjects D, M, and S; slightly more random than Arcturus) to 0.118 (subject J). This means that only pg. 4 of Arcturus with an IoC of 0.101 is more random than any of the manually typed reference texts. The χ² and Spearman ranks show an even greater variance and are tendentially lower than for the individual Arcturus pages, which was to be expected as Crimo is not among my friends. On a side note, subject W asked me whether a high similarity score would mark him as a total psychopath; I take it with humor that he unknowingly achieved the highest similarity score Σ.

The test subjects’ similarity scores Σ range from -0.47 (subject B) to 1.72 (subject W), resulting in a range of 2.19, a mean value of 0.76, which is notably lower than that of Arcturus, as well as a standard deviation of 0.57, which indicates a 112% higher variance than the individual Arcturus pages. It is important to note that subjects W and H achieved higher similarity scores than Crimo writing pg. 8, which (admittedly) clashes with the single-author hypothesis but strongly indicates that Arcturus was typed manually. Combining all test subjects’ ciphertexts, maximum χ² and maximum Spearman ranks are observed in comparison to the individual ciphertexts. Hence, it can be concluded that manually typed ciphertexts on average yield a similar popularity of n-grams compared to Arcturus, but the exact n-gram frequencies deviate from subject to subject.

Some anomalies regarding the individual subjects are worth mentioning:

• Subject B achieved unusual unigram frequencies of 13.7% for ‘2’ and only 2.2% for ‘5’, yielding notably different distributions and low Spearman ranks as well as a similarity score of only -0.47.
• Subject C produced consecutive streams of identical numbers toward the end of his ciphertext.
• Subject H was the only subject I supervised. During the experiments, I reminded her once to avoid patterns and not to forget the ‘0’ key.
• Subject J initially misunderstood the task and typed random letters instead of numbers. After the mistake was noticed, he might have put less effort into typing as randomly as possible, which may explain the low similarity score Σ of 0.35.
• Subject M provided two sets of digits typed on separate days. Even though this decreased her similarity score Σ by about 0.1, I did not analyze the individual ciphertexts.
• Subject K accidentally used a combination of number row and pad keys, which explains the relatively low similarity score Σ of 0.75 despite good χ² values and an IoC almost identical to Arcturus.

Keyboard

Typing the 29,412(-3) digits for a ciphertext that has the same size as Arcturus took me about 45 minutes, which corresponds to a typing speed of 10.9 digits per second. I assure you, my hands were in pain afterwards. In fact, I gained key insights from this: it is downright impossible to keep your hands steady. I was constantly improving my typing, changing the rhythm to find the ideal sweet spot between high speed and high randomness. Crimo must have experienced something similar, which explains the relatively large variations between the individual pages of Arcturus.

With a similarity score Σ of 1.40, the ciphertext that was typed using only the number row resembles Arcturus most closely. The combination of number row and pad yields a similarity score Σ of 0.95, while the ciphertext written on the number pad yields a similarity score Σ of only 0.25, indicating an even weaker resemblance to Arcturus. Interestingly, the combination of number row and pad achieves the closest IoC at 1.04, which demonstrates that the IoC alone does not suffice to analyze ciphertexts. Generally, the χ² scores suggest that Arcturus was written on the number pad, but the very poor Spearman ranks for all n-grams are decisive in this case. My theory is that maintaining equal unigram frequency is easier while using the number pad, because the keys are mapped out in a way that is easier to oversee by the human eye compared to the number row. Overall, the similarity score Σ indicates that Arcturus was written using only the number row.

I will even go a step further and hypothesize that Crimo used pinky to thumb of his left hand on the keys ‘1’ to ‘5’, index finger to pinky of his right hand on the keys ‘6’ to ‘0’, alternating between ‘9’ and ‘0’ with the pinky, which explains the bias against ‘9’. Either that, or he used all ten fingers on all ten keys; but as a player of virtual and real-life FPS games, the index finger of Crimo’s right hand must have had at least some kind of muscle. From my experiences on guitar and electric bass, I know that the middle finger is the strongest, the index finger comes second, and the ring finger is pretty much useless. It does not come down to just force; the ring finger is simply less agile, which may also explain the lack of ‘9’s depending on how Crimo positioned his fingers on the keyboard. In all likelihood, he switched around a bit, becoming increasingly sloppier after pg. 6 because his fingers started to hurt.

On a side note, typing on the number row and pad simultaneously was by far the most fun of the three methods. It comes down to a coordination game between your left and right hand which also reminded me of playing the guitar. I encourage you to try it yourself, but please not in the comments.

Cryptographic reference texts

If you came here because you are into cryptology, this is likely the part you have been anticipating the most. Just because Arcturus so far bears strong resemblance to manually typed digit sequences, it does not mean that it cannot be an actual ciphertext, right? Well, let me convince you otherwise. With a χ² score of 0 and a Spearman rank of 1.0, the shuffled Arcturus ciphertext has unigram counts identical to the original. This is to be expected as the unigram frequencies remain the same after shuffling. However, both scores perform poorly for bigrams and trigrams compared to most manually typed ciphertexts because the characteristics introduced by human factor and keyboard ergonomics are flattened. Thereby, the high similarity score Σ of 1.80 only serves as a baseline to compare against other encryption methods, which perform comparably worse.

Similarly, the ciphertext that was auto-generated based on the unigram frequencies of Arcturus achieves slightly worse χ² and Spearman ranks, but very poor χ² scores for bigrams and trigrams, yielding a similarity score Σ of 1.01, which is close to the mean value of the cyphertexts typed by the human subjects. It should be noted that the IoC is not influenced by shuffling or generating new digits with the same unigram frequencies.

With an IoC of 0.1, the uniform random distribution serves as a lower baseline, achieving a similarity score Σ of -2.81, which is unsurprising due to the distinct n-gram frequencies of Arcturus. Similarly low IoC values are achieved by the Biblos and the PolyCube ciphers, which can be attributed to their polyalphabetic nature. With a comparably high Spearman rank and an overall score Σ of -1.41, Pollux is most similar to Arcturus, which may be attributed to its uneven unigram frequencies. For unigrams, Biblos achieves the lowest χ² of the investigated methods, but the differences are slim. The similarity scores Σ of the cryptographically generated ciphertexts remain low, reaching a minimum at -3.17 (PolyCube). Of course, I could investigate only a small subset of possible ciphers based on number streams, but it demonstrates that with increasing complexity, ciphers tend to resemble Arcturus much less than manually typed ciphertexts.

Conclusion

Within this study, I managed to produce ciphertexts that show very similar structures compared to the Arcturus cipher by Robert Crimo, which I based on established cryptologic tests and parameters. Multiple test subjects achieved high similarity scores without having received specific instructions on how to type numbers at random. In fact, this may be an excellent time to announce the winners (I still need to get these psychopaths some prizes):

🥇 Felix (subject W: +1.72)

🥈 Jette (subject H: +1.64)

🥉 Andreia (subject P: +1.33)

All fun and games aside, the strong deviations between Arcturus and actual ciphertexts of increasing complexity strongly indicate that Crimo typed it all by hand. As a matter of fact, subjects W and H accidentally produced ciphertexts that would fit better into Arcturus than its eighth page. If you are still a non-believer by now, I cannot help you anymore. If I managed to convince you, let me thank you for the opportunity.

Everything points toward Crimo being not only depressed and vile, but also not intelligent enough to use (let alone invent) an original cipher. He must have thought that analysts would wreck their brains for decades over his “unbreakable cipher,” just because he made himself infamous. Or he thought nothing at all. Therefore, I too encourage you to take Vierra’s comment to heart and not spend any more time on Arcturus. In the end, one thing is for sure: Crimo underestimated the power of science. Consequently, I am happy to apply my methods to further questionable ciphers in the future. For example, despite his low similarity score Σ, subject J gave me the idea to analyze letters, too. But first, let me dip my hands up to the wrists into an ice bucket.

Final thanks go out to the participants of my study: Andreia, Caspar, Daniel, Fabian, Felix, Jan-Niklas, Jette, Jonny, Kathy, Lars-Ole, Laura, Marc, Matthias, Malik, Marlene, Moritz, Nick, and Viktor.

← Return to “Cryptology”

← Return to “Science”