Monday, July 24, 2006

The 212-796-0735 Craigslist Mystery

Back in the days of the Cold War, spies found ingenious and unusual ways to communicate with each other, hiding their communications in plain sight, whether encrypted or not. For instance, an intelligence agent/spy might contact his case officer/handler by placing an ad in the personals section of the local newspaper. This practice was glamorized on the Hollywood big screen in the movie "Red Dragon". From his maximum security prison cell, Hannibal Lector used the method of placing ads in a tabloid newspaper in order to send tips to a fellow serial killer on the loose. This practice seems to continue today, but in a more modern and very real way...via Craigslist.org

On May 8, the following personal ad appeared on the Internet classified ad site Craigslist. (It has since been removed.)

--------------------------------------------------
new york craigslist > manhattan > missed connections >
For mein fraulein
Mein Fraulein, I haven’t heard from you in a while. Won’t you call me?
212 //// 796 //// 0735
--------------------------------------------------

If you actually called the number, you would have heard this prerecorded message (MP3). It's a head scratcher that's keeping National Security Agency analysts occupied. Each block of numbers is repeated twice. Below I have transcribed them only once for clarity. You will notice it contains an unusually high number of zeros. This is sure to test the decryption skills of even the best of us.

Group 415
01305 60510 12079 04606 50100
93000 08203 90130 94069 01207
81080 17028 01706 90220 73038
01401 70150 15073 00402 00680
12013 12510 00540 04091 01401
30150 86022 09608 10660 02082
05507 00020 00000 02208 30290
08022 01200 40710 13065 02709
40190 29014 02200 80020 11083
07300 30260 19000 00700 00000
86


Several days later around May 12, Craigslist pulled the ad, but the number remained up and running. Hackers, phone phreaks and other curiosity seekers flooded the number with calls. That's when some more of the details behind the number began coming out and it caught the attention of US Government, in particular Homeland Security. The number is a VoIP setup from a small provider yet to be identified, but the wholesaler is a company called RNK Telecom. The account was prepaid and the flood of calls it received quickly depleted the account balance. Now the number gives nothing but a busy signal. Many questions remain, even though that the number seems to be no longer functioning. Who put the ad on Craigslist? What is the encrypted message and what does it mean? Is this all some sort of elaborate prank? Or could it be a viral marketing scheme of some type? Or the most frightening issue, could this be a form of communication terrorists are using to plot another US attack?

The Craigslist posting is typical of how intelligence agents might communicate in hostile countries where they are actively trying to evade the country’s intelligence services. What makes this situation even more bizarre is that since May, there have been 2 other follow-up posts! This one came on May 29...

The telephone number 415-704-0402 is registered to Pac-West Telecomm, another VoIP wholesaler. Although this doesn't tell who retailed the number, or to whom. The recording is much like the first number. It starts with some music, reads groups of numbers, each group read twice, ends with more music. The same pattern again.

--------------------------------------------------
s.f. bayarea craigslist > san francisco > missed connections >
For Mein Fraulein
Mein Fraulein,
You must call me again soon.
///415///704///0402///
--------------------------------------------------


Group 617
06107 80020 21085 00601 30690
06079 01201 50240 07006 01601
70690 95000 01702 40050 14024
00908 70220 67089 07401 00820
10086 07801 30240 04016 02707
30130 15006 09306 91120 20084
00000 00210 03070 03107 60490
65023 02706 70000 07016 01201
7


The latest, a 3rd number was posted on June 10. It's a shorter message than the previous 2, but still follows the same basic pattern. This telephone number is owned by Global Crossing, a wholesaler of VoIP and other telecommunications services. The VoIP retailer is still unknown.

--------------------------------------------------
atlanta craigslist > missed connections >
For Mein Fraulein
Mein Fraulein,
I hear the weather in the South is good this time of year. Won’t you call me?
///678///248///2352///
--------------------------------------------------


Group 134
00300 30020 79087 02202 50150
75031 06501 00110 67027 06607
90640 21079 02107 90000 72018
06501 60000 12008 06801 90180
15088 03108 40730 29024 02500
60760 79013 01107 70950 07071
01806 9070


Craigslist was founded in the mid-90s in San Francisco, CA. Now can you guess what I'm doing in SF this week? A copy of these messages has been sent up the chain of command in the US Military and at this time is labeled as "classified". No further information will be released, but you are free to take a crack at decrypting the mystery messages yourself. And if you find anything, please let me know because this isn't easy!

No comments:

Post a Comment