Symbols

Ricky McCormick’s Cipher Notes: Two Pages Found in a Murder Victim’s Pocket

Decoder L 2026. 7. 28. 08:28
728x90
Symbols and Traces, My Case Investigation Record 50

Ricky McCormick Cryptographic Note
Two sheets of the pockets of the murder victim

On June 30, 1999, Ricky McCormick's body was found in a field in St. Charles County, Missouri. In the pocket were two sheets of paper mixed with letters, numbers and parentheses.

Figure 1. First password notes released by the FBI — Image:
From the conclusion of this record to
At present, it is most likely that it is an abbreviation and voice notation made by McCormick individuals to read rather than an elaborate password. It may be the key to murder, but it's dangerous to claim that you translated a place or a criminal with just the note itself.

Prologue: Recorded Night

After the night deepens, the data was spread on the desk. The first thing that caught my eye was not the answer, but the imbalance. Some scenes were as clear as photographs and some time zones were empty as a whole. People try to capture one clear scene and explain the whole thing, but I marked the empty section first. Mysteries arise because there are many clues, but they also arise because the distance between clues is too far.

The FBI's cryptographic analysis department and the American Cryptographic Association reviewed the notes, but could not confirm their intentions. The FBI publicly requested that another sample written in the same way was needed. It is still open whether the note is a code directly related to murder or an abbreviation for personal memory.

I deliberately read the famous hypothesis at the end. First of all, when we encounter the conclusion, it seems that all objects and symbols exist for that conclusion. Therefore, the timetable, place, object, and original text were organized first, and the witness and interpretation were placed in different compartments. The novel-like atmosphere was drawn from the cold texture of the actual record, not from a made-up secret.

Figure 2. Second password note released by the FBI — Image:

Case File: What I Could Believe

20313233343536373839404142434445464748495051525354555657585960616263646566212223242526272829303132333435363738394041424344454647484950515253545556
Number Confirmed Record Current Reliability
1 Ricky McCormick's body was found in St Charles County on June 30, 1999. High
2 Two handwritten notes came out of his pocket. The High
3 note contains elements that look like letters, numbers, brackets, and repetitive abbreviations. High
4 The FBI CRRU and external cryptographers reviewed it, but failed to decrypt it. Medium
5 The FBI is looking for a different sample of the same author for comparison. The author of the Medium

note, the timing of writing, the notation system, the relationship with murder, and the plain text were not disclosed.

Caution trap
'Unexplained' is not the same as 'supernatural', 'a huge conspiracy', and 'only this hypothesis is possible'. I didn't count the blanks as evidence.
Figure 3. Folded paper and pocket storage status — Image:

Scene Reconstruction: Finally, the place of the certain point

was changed to the actual movement, not the stage in your head. We divided the starting point, the last check point, and the location where the item was found and calculated the minimum time required in between. When the dramatic description of later generations was removed, small and specific elements such as sound and lighting, doors and roads, paper and ink, and the spacing of symbols came forward.

The person's mind was not fixed and the action was written first. The same behavior can be caused by fear, planning, error, and fatigue. If it is a code, the same symbol can be a sound, a word, a separator, and a meaningless sign. After writing down all possible roles, he erased the roles that conflict with other records one by one.

Clue 1. Ricky McCormick's body was found on June 30, 1999, in St. Charles County.

I split this sentence into three pieces first. It indicated who first checked, how close the confirmation was to the incident, and where the later interpretation was attached. Old events and codes turn into clearer stories than the original while being repeatedly cited. But clarity is not the same thing as accuracy. In my notes, I separated the direct record, the traces left by the object, and the reasoning of later generations into different colors.

This clue was then matched with the record, "Two handwritten notes came out of his pocket." It is not a good hypothesis if one hypothesis explains only the first sentence and avoids the second sentence. In particular, if you fail to pass the question, "What is the repetitive NCBE and SE series among word ends, places, and people's names?" the attractive explanation also lowered the score. I've seen clues that make the conclusion uncomfortable longer than clues that make the conclusion cool.

If you look at the clues this way, the case seems a little less dramatic. Instead, there is a boundary between how far it is clear and where it is imagined. That boundary is necessary to correct reasoning when new data are released. The most dangerous moment in the unwritten record is not when you make a false hypothesis, but when you turn the hypothesis into a sentence of fact.

Clue 2. Two handwritten notes came out of his pocket.

I split this sentence into three pieces first. It indicated who first checked, how close the confirmation was to the incident, and where the later interpretation was attached. Old events and codes turn into clearer stories than the original while being repeatedly cited. But clarity is not the same thing as accuracy. In my notes, I separated the direct record, the traces left by the object, and the reasoning of later generations into different colors.

This clue was then confronted with the record, "Notes contain elements that look like letters, numbers, brackets, and repetitive abbreviations." It is not a good hypothesis if one hypothesis explains only the first sentence and avoids the second sentence. In particular, if you fail to pass the question, "Is the line modulation and parentheses the result of semantic structure or paper space?" the attractive explanation also lowered the score. I've seen clues that make the conclusion uncomfortable longer than clues that make the conclusion cool.

If you look at the clues this way, the case seems a little less dramatic. Instead, there is a boundary between how far it is clear and where it is imagined. That boundary is necessary to correct reasoning when new data are released. The most dangerous moment in the unwritten record is not when you make a false hypothesis, but when you turn the hypothesis into a sentence of fact.

Figure 4. Accurate transcription of letters, numbers, and brackets — images:

Clue 3. Note contains elements that look like letters, numbers, brackets, and repetitive abbreviations.

I split this sentence into three pieces first. It indicated who first checked, how close the confirmation was to the incident, and where the later interpretation was attached. Old events and codes turn into clearer stories than the original while being repeatedly cited. But clarity is not the same thing as accuracy. In my notes, I separated the direct record, the traces left by the object, and the reasoning of later generations into different colors.

The clue was then confronted with the record, "FBI CRRU and external cryptographers reviewed it, but failed to decrypt it." It is not a good hypothesis if one hypothesis explains only the first sentence and avoids the second sentence. In particular, if you fail to pass the question, "Do McCormick's usual writing samples and spelling habits match the notes?" the attractive explanation also lowered the score. I've seen clues that make the conclusion uncomfortable longer than clues that make the conclusion cool.

If you look at the clues this way, the case seems a little less dramatic. Instead, there is a boundary between how far it is clear and where it is imagined. That boundary is necessary to correct reasoning when new data are released. The most dangerous moment in the unwritten record is not when you make a false hypothesis, but when you turn the hypothesis into a sentence of fact.

Clue 4. FBI CRRU and external cryptographers reviewed it, but failed to decrypt it.

I split this sentence into three pieces first. It indicated who first checked, how close the confirmation was to the incident, and where the later interpretation was attached. Old events and codes turn into clearer stories than the original while being repeatedly cited. But clarity is not the same thing as accuracy. In my notes, I separated the direct record, the traces left by the object, and the reasoning of later generations into different colors.

This clue was then matched with the record, "The FBI is looking for a different sample of the same author that can be compared." It is not a good hypothesis if one hypothesis explains only the first sentence and avoids the second sentence. In particular, if you fail to pass the question, "What is the repetitive NCBE and SE series among word ends, places, and people's names?" the attractive explanation also lowered the score. I've seen clues that make the conclusion uncomfortable longer than clues that make the conclusion cool.

If you look at the clues this way, the case seems a little less dramatic. Instead, there is a boundary between how far it is clear and where it is imagined. That boundary is necessary to correct reasoning when new data are released. The most dangerous moment in the unwritten record is not when you make a false hypothesis, but when you turn the hypothesis into a sentence of fact.

Clue 5. The FBI is looking for another sample of the same author for comparison.

I split this sentence into three pieces first. It indicated who first checked, how close the confirmation was to the incident, and where the later interpretation was attached. Old events and codes turn into clearer stories than the original while being repeatedly cited. But clarity is not the same thing as accuracy. In my notes, I separated the direct record, the traces left by the object, and the reasoning of later generations into different colors.

This clue was then matched with the record, "Ricky McCormick's body was found on June 30, 1999 in St Charles County." It is not a good hypothesis if one hypothesis explains only the first sentence and avoids the second sentence. In particular, if you fail to pass the question, "Is the line modulation and parentheses the result of semantic structure or paper space?" the attractive explanation also lowered the score. I've seen clues that make the conclusion uncomfortable longer than clues that make the conclusion cool.

If you look at the clues this way, the case seems a little less dramatic. Instead, there is a boundary between how far it is clear and where it is imagined. That boundary is necessary to correct reasoning when new data are released. The most dangerous moment in the unwritten record is not when you make a false hypothesis, but when you turn the hypothesis into a sentence of fact.

Figure 5. Frequency map showing repeat strings — Image:

Put three hypotheses on the same scale The

hypothesis was not evaluated as a cool sentence. The number of clues to be explained, the number of newly requested assumptions, and the degree to which they endure the opposite evidence were written, respectively. Even if one clue is fully explained, it is not a good hypothesis if the other records have to be discarded.

Hypothesis A. It is a schedule and address memo that mixes abbreviations and voice spelling of McCormick individuals.

This explanation has the advantage of accepting "Ricky McCormick's body was found on June 30, 1999 in St. Charles County" as a relatively small assumption. I assumed that this hypothesis was correct and walked time and space all over again. Each time people, objects, and symbols moved to the next location, they wrote down the actions and times they needed. There must have been a hidden assumption at the point where the sentence was cut off.

The biggest weakness is that "notes contain elements that look like letters, numbers, brackets, and repetition abbreviations." If you keep adding accomplices, coincidences, and lost things to keep the hypothesis alive, you can explain anything. However, such an explanation does not predict new clues. I only scored when two independent records pointed in the same direction, and I scored every time I called in a new exception.

117100118

So, whether or not to adopt this hypothesis as a conclusion was judged not by atmosphere but by cost. The number of clues to be explained, the number of newly requested households, and the degree to which they endure evidence against them are listed in the same table. Novel scenes were used to show the texture of facts, but not as evidence to fill in the blanks.

119101120

Hypothesis B. A simple alternative password for hiding transactions with local people.

121102122

This explanation has the advantage of accepting "two handwritten notes from his pocket" as a relatively small assumption. I assumed that this hypothesis was correct and walked time and space all over again. Each time people, objects, and symbols moved to the next location, they wrote down the actions and times they needed. There must have been a hidden assumption at the point where the sentence was cut off.

123103124

The biggest weakness is that it does not fully explain "the FBI CRRU and external cryptographers reviewed it but failed to decrypt it." If you keep adding accomplices, coincidences, and lost things to keep the hypothesis alive, you can explain anything. However, such an explanation does not predict new clues. I only scored when two independent records pointed in the same direction, and I scored every time I called in a new exception.

125104126

So, whether or not to adopt this hypothesis as a conclusion was judged not by atmosphere but by cost. The number of clues to be explained, the number of newly requested households, and the degree to which they endure evidence against them are listed in the same table. Novel scenes were used to show the texture of facts, but not as evidence to fill in the blanks.

127105128

Hypothesis C. It is a simulated character string in which the author is not macroscopic or a meaningful language.

129106130

This explanation has the advantage of accepting "notes contain elements that look like letters, numbers, brackets, and repetitive abbreviations" as a relatively small assumption. I assumed that this hypothesis was correct and walked time and space all over again. Each time people, objects, and symbols moved to the next location, they wrote down the actions and times they needed. There must have been a hidden assumption at the point where the sentence was cut off.

131107132

The biggest weakness is that "the FBI is looking for a different sample of the same author that can be compared." If you keep adding accomplices, coincidences, and lost things to keep the hypothesis alive, you can explain anything. However, such an explanation does not predict new clues. I only scored when two independent records pointed in the same direction, and I scored every time I called in a new exception.

133108134

So, whether or not to adopt this hypothesis as a conclusion was judged not by atmosphere but by cost. The number of clues to be explained, the number of newly requested households, and the degree to which they endure evidence against them are listed in the same table. Novel scenes were used to show the texture of facts, but not as evidence to fill in the blanks.

Figure 6. Compare Personal Abbreviations with Standard Passwords — Image:

Conclusions I abandoned

137111138

When I started the investigation, I was also drawn to the most famous explanation. It organized the case into one sentence and gave intention to everything. However, in contrast to the original record, each blank required a new coincidence. I erased the conclusion then and started again. Good reasoning is not about adding anything, but about removing unnecessary assumptions.

139112140

I assumed it was a personal abbreviation rather than a forced fit to a standard password list. In that case, the same meaning may appear in several spellings, and the memory unit may be repeated rather than the grammar. The irregularity of the actual notes fits this description, but cannot be verified without a comparative sample.

141113142

In particular, the details repeated on later articles and the Internet were separated from the source. Just because the same sentence appears in multiple places does not mean that there are multiple independent sources. We first checked the possibility that one error was duplicated. After this process, the case became less colorful, but the weight of the remaining clues increased.

Figure 7. Map of St. Louis and discovery fields — Image:

Anti-evidence: Sentence to destroy my reasoning

145116146

The investigation ends quickly if I gather data that upholds my conclusion. So I put the three most uncomfortable questions next to the conclusion.

147117148
  • What is the repetitive NCBE/SE series among word ends, places, and people's names
  • 150119151
  • Are the line modulation and parentheses the result of semantic structure or paper space
  • 152120153
  • Are McCormick's usual writing samples and spelling habits consistent with the notes?
155122156

These questions are not decorative. It is a switch that will change its conclusion when new data comes in. The ranking of the hypotheses changes immediately when directly linked information, such as the sighting source, preserved physical evidence, comparative samples from the same author, and independent dating. On the contrary, when the word "likely" increased, the ranking did not change.

Figure 8. FBI Password Analysis Workstation — Image:

Final Reasoning: I Reached

159125160
Judgment
At present, it is most likely that it is an abbreviation and voice notation made by McCormick individuals to read rather than an elaborate password. It may be the key to murder, but it's dangerous to claim that you translated a place or a criminal with just the note itself.
161126162

This conclusion is not a complete final judgment. The direction calls for the fewest assumptions in the currently disclosed records and explains the most clues at the same time. It is also clear that what comes out changes the conclusion. Reliable original records, verifiable legal science data, and independent evidence directly linking people and objects are needed.

163127164

I do not write that the case is closed. Instead, write down how far you can close it. That boundary is the result of this investigation. The fun of mystery is not that anything is possible. It's about finding out what you can throw away among the possible explanations.

Figure 9. Limit Without Comparative Handwriting Samples — Image:

Additional Survey Record 1. Redraw the timetable

167130168

The data was re-opened on the desk and the conclusion was hidden this time. "Ricky McCormick's body was discovered on June 30, 1999 in st. Charles County," he continued with a line of place and time, leaving only "Ricky McCormick's body. Unconfirmed sections were not filled by imagination but marked with blank squares. The larger the square, the lower the reliability of the hypothesis to pass through the section. On top of

169131170

, I posted the explanation, "It is a schedule and address memo that mixes McCormick's abbreviation and voice spelling." At first, everything seemed right, but a weak connection was revealed when the question, "What is the repeated NCBE and SE series of words, places, and people's names?" was substituted. Hypothesis has to endure the question. If you keep making new coincidences to avoid questions, you will create, not reasoning, from that moment on.

171132172

The results obtained in this section are not confirmed criminals or complete plain texts. Instead, it became clear which explanations required fewer assumptions, and what would flip the ranking if found. Even if the case is not completed, the scope of the investigation can be narrowed. This record is intended to leave that very narrow boundary.

173133174

Further investigation record 2. Disappeared link

175134176

Re-expanded the data on the desk and covered the conclusion this time. "Two handwritten notes came out of his pocket," he continued in a line of place and time, leaving only "two handwritten notes." Unconfirmed sections were not filled by imagination but marked with blank squares. The larger the square, the lower the reliability of the hypothesis to pass through the section.

177135178

On top of it, I posted an explanation saying, "It's a simple alternative password to hide local people and transactions." At first, everything seemed right, but when I substituted the question, "Is the line modulation and parentheses the result of semantic structure or paper space?" a weak connection was revealed. Hypothesis has to endure the question. If you keep making new coincidences to avoid questions, you will create, not reasoning, from that moment on.

179136180

The results obtained in this section are not confirmed criminals or complete plain texts. Instead, it became clear which explanations required fewer assumptions, and what would flip the ranking if found. Even if the case is not completed, the scope of the investigation can be narrowed. This record is intended to leave that very narrow boundary.

181137182

Further investigation record 3. The path of movement of objects

183138184

Re-expanded the data on the desk and covered the conclusion this time. "Notes include elements that look like letters, numbers, parentheses, and repetition abbreviations," he continued with the place and time in one line. Unconfirmed sections were not filled by imagination but marked with blank squares. The larger the square, the lower the reliability of the hypothesis to pass through the section. On top of

185139186

, I posted an explanation that "the author is not a McCormick or a simulated character string that is not a meaningful language." At first, everything seemed right, but when I substituted the question, "Do McCormick's usual handwriting samples and spelling habits match the notes," a weak connection was revealed. Hypothesis has to endure the question. If you keep making new coincidences to avoid questions, you will create, not reasoning, from that moment on.

187140188

The results obtained in this section are not confirmed criminals or complete plain texts. Instead, it became clear which explanations required fewer assumptions, and what would flip the ranking if found. Even if the case is not completed, the scope of the investigation can be narrowed. This record is intended to leave that very narrow boundary.

189141190

Further Survey Record 4. Opposite Hypothesis Night

191142192

I re-opened the material on the desk and covered the conclusion this time. "The FBI CRRU and external cryptographers reviewed it, but failed to decrypt it," he continued, leaving only one line of place and time. Unconfirmed sections were not filled by imagination but marked with blank squares. The larger the square, the lower the reliability of the hypothesis to pass through the section.

193143194

, I posted the explanation, "It is a schedule and address memo that mixes McCormick's abbreviation and voice spelling." At first, everything seemed right, but a weak connection was revealed when the question, "What is the repeated NCBE and SE series of words, places, and people's names?" was substituted. Hypothesis has to endure the question. If you keep making new coincidences to avoid questions, you will create, not reasoning, from that moment on.

195144196

The results obtained in this section are not confirmed criminals or complete plain texts. Instead, it became clear which explanations required fewer assumptions, and what would flip the ranking if found. Even if the case is not completed, the scope of the investigation can be narrowed. This record is intended to leave that very narrow boundary.

197145198

Further Survey Record 5. Distance between record and memory

199146200

I re-opened the material on the desk and covered the conclusion this time. The FBI is looking for a different sample of the same author for comparison, leaving only "The FBI is looking for a different sample of the same author." Unconfirmed sections were not filled by imagination but marked with blank squares. The larger the square, the lower the reliability of the hypothesis to pass through the section.

201147202

On top of it, I posted an explanation saying, "It's a simple alternative password to hide local people and transactions." At first, everything seemed right, but when I substituted the question, "Is the line modulation and parentheses the result of semantic structure or paper space?" a weak connection was revealed. Hypothesis has to endure the question. If you keep making new coincidences to avoid questions, you will create, not reasoning, from that moment on.

203148204

The results obtained in this section are not confirmed criminals or complete plain texts. Instead, it became clear which explanations required fewer assumptions, and what would flip the ranking if found. Even if the case is not completed, the scope of the investigation can be narrowed. This record is intended to leave that very narrow boundary.

205149206

Additional Survey Record 6. Range of Last Scene

207150208

The data was re-opened on the desk and the conclusion was hidden this time. "Ricky McCormick's body was discovered on June 30, 1999 in st. Charles County," he continued with a line of place and time, leaving only "Ricky McCormick's body. Unconfirmed sections were not filled by imagination but marked with blank squares. The larger the square, the lower the reliability of the hypothesis to pass through the section. On top of

209151210

, I posted an explanation that "the author is not a McCormick or a simulated character string that is not a meaningful language." At first, everything seemed right, but when I substituted the question, "Do McCormick's usual handwriting samples and spelling habits match the notes," a weak connection was revealed. Hypothesis has to endure the question. If you keep making new coincidences to avoid questions, you will create, not reasoning, from that moment on.

211152212

The results obtained in this section are not confirmed criminals or complete plain texts. Instead, it became clear which explanations required fewer assumptions, and what would flip the ranking if found. Even if the case is not completed, the scope of the investigation can be narrowed. This record is intended to leave that very narrow boundary.

Figure 10. Results table of murder clues and personal memo hypotheses — images:
Records and references

· FBI — Encyphered Note

216156217

· FBI Vault — Ricky McCormick

218157219

· FBI Story — Cryptanalysts and the open murder case

220158221

※ This article is a commentary in the form of personal survey records based on public records and reliable data. I have distinguished between confirmed facts and my reasoning, and I update my judgment when a new official announcement is made. External material images were edited for some color and composition according to the permitted licensing conditions, and each image source was shown in the caption.

728x90