zodiac killer
Unsolved issues left behind by letters and passwords
▲ Cover of the incident – Unfolding the records
In the late 1960s, a murder in Northern California and letters sent to the press created the identity ‘Zodiac’. However, the stagnation did not lead to blindness.
Zodiac created strong characters through letters, but the chain of evidence between the characters and their real names was not complete.
Prologue: The night that broke records
When I laid out the case data on my desk, the first thing I noticed was not the correct answer but an imbalance. Some scenes were overly clear, and some time periods were completely blank. People try to explain the entire incident by focusing on one clear scene, but I instead marked the blank section first. Mysteries can arise because there are many clues, but they can also arise because the distance between clues is too great.
The events widely linked officially are the attacks of 1968-1969. A letter claiming to be the culprit was sent mixed with coded text, threats, and details of the crime.
I did not view this incident as confirming an already known conclusion. The records were arranged chronologically, the movement paths of objects were drawn separately, and sightings and interpretations were indicated in different colors. The most popular explanations were then deliberately reviewed last. Because when you first read a famous hypothesis, all the clues seem to exist for that hypothesis.
▲ On-site reconstruction — last confirmed movement route
Case Files: What I Could Believe
| number | confirmed record | current reliability |
|---|---|---|
| 1 | At least five dead victims are officially linked to the Zodiac case. | high |
| 2 | Some letters contained information that only law enforcement would know, but not all letters were verified to the same degree of authenticity. | high |
| 3 | The 408-character code was cracked by a civilian couple in 1969, but the culprits' names were not revealed. | middle |
| 4 | The FBI assisted the local investigation with handwriting, fingerprint, and code analysis. | middle |
The real name of the criminal, the scope of the real letter, the alleged additional crimes, and the reason for stopping the crime remain to be determined.
The sentence ‘It is not explained’ is not the same as the sentence ‘It is supernatural’ or ‘Someone intended it’. I didn't use the blank space as evidence.
▲ Timeline – Flow before and after the event
Reconstructing the Scene: Finally, a Certain Point
I changed the location where the incident took place to the actual route rather than the stage in my head. We divided the starting point, final confirmation point, and discovery location and calculated the time needed in between. In the process, several later dramatic depictions were omitted. Instead, the recorded sounds, weather, means of transportation, and locations of objects came to the fore. The novelistic atmosphere arose from the very texture of the facts. There was no need to add unidentified secret passageways or nameless accomplices.
When reconstructing the last scene, I did not determine the character's feelings. The same behavior can be caused by fear, planning, mistake, or fatigue. So, I wrote down the actions first and left the emotions to the extent possible. Thanks to this principle, events became less flashy but more concrete.
Clue 1. At least five dead victims are officially linked to the Zodiac case.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. But I immediately tried to confront the following record: “Some letters contained information that only investigative agencies would know, but not all letters were verified to the same degree of authenticity.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “If there had been no letter, would the cases have been tied to one culprit?” will ignore the rest of the records instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
▲ Key Clue 1 — Traces left by records
Clue 2. Although some letters contained information that only investigative agencies would know, the authenticity of all letters was not confirmed to the same degree.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. But I immediately tried it against the next record: “408-character code was cracked by a civilian couple in 1969, but the culprits were not named.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “Was the password a tool to hide information or a stage to attract attention?” ends up ignoring the rest of the record instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
▲ Key Clue 2 — Pieces that do not fit together
Clue 3. The 408-character code was cracked by a civilian couple in 1969, but the culprit's name was not revealed.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. But I immediately tried the next record: “FBI assisted local investigation with handwriting, fingerprint, and code analysis.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “Which does the culprit’s silence support more: death, imprisonment, or voluntary suspension?” ends up ignoring the rest of the record instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
▲ Key Clue 3 — Evidence that shakes the hypothesis
Clue 4. The FBI assisted the local investigation with handwriting, fingerprint, and code analysis.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. But I immediately tackled the next record: “At least five dead victims officially linked to Zodiac case.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “If there had been no letter, would the cases have been tied to one culprit?” will ignore the rest of the records instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
put three hypotheses on the same scale
Hypotheses were not evaluated in fancy sentences. We wrote down the number of explanatory clues, the number of new assumptions required, and the degree to which they can withstand contrary evidence. Even if one clue is completely explained, if the remaining three clues have to be discarded, it is not a good hypothesis.
Hypothesis A. An explanation that a single culprit created both the attack and the key letter.
The beauty of this explanation is that it makes relatively few assumptions: “At least five dead victims are officially linked to the Zodiac case.” I first assumed that this hypothesis was true and re-traced the event from beginning to end. Each sentence linked where and what the character saw, what judgment he made, and then moved to the next location. There was always a hidden assumption at the point where the connection was lost.
The biggest weakness is that it does not sufficiently explain “The 408-character code was cracked by a civilian couple in 1969, but the culprits’ name was not revealed.” If you keep adding exceptions to your hypothesis, you can explain anything, but such an explanation predicts nothing. I lowered the score of the hypothesis the moment there were more than two exceptions. Conversely, scores were increased only when two independent clues pointed in the same direction.
In the end, this hypothesis cannot be completely discarded, but it cannot be taken as a conclusion either. If you read the incident like a novel, the blank spaces will be filled in naturally. If you read it like an investigation record, the blank spaces remain. I chose the latter. Even if the blank space left is inconvenient, that inconvenience protects the scope of what the evidence can say.
Hypothesis B. An explanation that some letters or crimes are imitations or false claims.
The advantage of this explanation is that it makes relatively few assumptions: “Some letters contained information that only investigative agencies would know, but not all letters were confirmed to be authentic to the same degree.” I first assumed that this hypothesis was true and re-traced the event from beginning to end. Each sentence linked where and what the character saw, what judgment he made, and then moved to the next location. There was always a hidden assumption at the point where the connection was lost.
The biggest weakness is that it does not sufficiently explain that “the FBI supported local investigations through handwriting, fingerprint, and code analysis.” If you keep adding exceptions to your hypothesis, you can explain anything, but such an explanation predicts nothing. I lowered the score of the hypothesis the moment there were more than two exceptions. Conversely, scores were increased only when two independent clues pointed in the same direction.
In the end, this hypothesis cannot be completely discarded, but it cannot be taken as a conclusion either. If you read the incident like a novel, the blank spaces will be filled in naturally. If you read it like an investigation record, the blank spaces remain. I chose the latter. Even if the blank space left is inconvenient, that inconvenience protects the scope of what the evidence can say.
Hypothesis C. Explanation that the criminal was in the investigative network but could not be identified due to lack of physical evidence.
The advantage of this explanation is that it makes relatively few assumptions: “The 408-character code was cracked by a civilian couple in 1969, but the culprits’ name was not revealed.” I first assumed that this hypothesis was true and re-traced the event from beginning to end. Each sentence linked where and what the character saw, what judgment he made, and then moved to the next location. There was always a hidden assumption at the point where the connection was lost.
The biggest weakness is that it does not sufficiently explain that “at least five dead victims are officially linked to the Zodiac incident.” If you keep adding exceptions to your hypothesis, you can explain anything, but such an explanation predicts nothing. I lowered the score of the hypothesis the moment there were more than two exceptions. Conversely, scores were increased only when two independent clues pointed in the same direction.
In the end, this hypothesis cannot be completely discarded, but it cannot be taken as a conclusion either. If you read the incident like a novel, the blank spaces will be filled in naturally. If you read it like an investigation record, the blank spaces remain. I chose the latter. Even if the blank space left is inconvenient, that inconvenience protects the scope of what the evidence can say.
▲ Comparison of hypotheses – explanatory power and gaps
Conclusions I threw away
When I began my investigation, I too was drawn to the most popular explanation. It summed up events in one sentence and gave intention to every object. But when the data was collated, the explanation required a new coincidence for every blank space. I erased that conclusion and started again. Good reasoning is less about adding things and more about removing unnecessary assumptions.
The number of self-proclaimed victims in the letter is not the same as the official number of victims. The suspect theory must be based not on handwriting or circumstances alone, but on the time, place, and physical evidence of the crime.
In particular, details repeated in later testimonies and on the Internet were separated from the original records. Just because the same sentence appears in multiple places does not mean there are multiple independent sources. First, we checked the possibility that a single incorrect sentence was duplicated. After going through this process, the size of the case decreased, but the weight of the remaining clues actually increased.
▲ Counterevidence check — the conclusion I discarded
Final Reason: What I arrived at
Zodiac created strong characters through letters, but the chain of evidence between the characters and their real names was not complete.
This conclusion is not a completely definitive ruling. This is a direction that requires the fewest assumptions and simultaneously explains the most clues within the currently available records. It may be revised as new physical evidence emerges. However, it is also clear that the conclusion may change depending on what comes out. Reliable original records, verifiable forensic data, and independent evidence directly linking objects and people are needed.
I do not write that the case is closed. Instead, write down how far you can close it. That boundary is the result of this investigation. The fun of mystery is not that anything is possible. The goal is to find out which of the possible explanations can be discarded.
▲ Final judgment – explanation that requires the fewest assumptions
Additional Investigation Records 1. Redraw the timeline
At dawn, I opened the case sheet again. This time, the conclusion was obscured, leaving only the record: “At least five deceased victims are officially linked to the Zodiac incident.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put up the hypothesis, “An explanation that one culprit created both the attack and the key letter.” At first everything seemed to fall into place. However, a weak part of the explanation was revealed when asked the question, “If there had been no letter, would the cases have been tied to one culprit?” Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation record 2. The missing link
At dawn, I opened the case sheet again. This time, the conclusion was obscured, leaving only the record, “Some letters contained information that only investigative agencies would know, but the authenticity of all letters was not confirmed to the same degree.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put a hypothesis called “an explanation that some letters or crimes were imitations or false claims.” At first everything seemed to fall into place. However, when asked the question, “Was the password a tool to hide information or a stage to attract attention?” a weak part of the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation records 3. Witness distance
At dawn, I opened the case sheet again. This time, the conclusion was obscured, leaving only the record, “The 408-character code was cracked by a civilian couple in 1969, but the name of the culprit was not revealed.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put the hypothesis that “the culprit was in the investigative network, but could not be identified due to lack of physical evidence.” At first everything seemed to fall into place. However, when asked the question, “Which would the criminal’s silence support more: death, incarceration, or voluntary suspension?” a weak part of the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation record 4. The path the object took
At dawn, I opened the case sheet again. This time, the conclusion was obscured and only a record was written: “The FBI supported the local investigation through handwriting, fingerprint, and password analysis.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put up the hypothesis, “An explanation that one culprit created both the attack and the key letter.” At first everything seemed to fall into place. However, a weak part of the explanation was revealed when asked the question, “If there had been no letter, would the cases have been tied to one culprit?” Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation records 5. Temptation of false clues
At dawn, I opened the case sheet again. This time, the conclusion was obscured, leaving only the record: “At least five deceased victims are officially linked to the Zodiac incident.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put a hypothesis called “an explanation that some letters or crimes were imitations or false claims.” At first everything seemed to fall into place. However, when asked the question, “Was the password a tool to hide information or a stage to attract attention?” a weak part of the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional Investigation Record 6. Reconstruction of the final scene
At dawn, I opened the case sheet again. This time, the conclusion was obscured, leaving only the record, “Some letters contained information that only investigative agencies would know, but the authenticity of all letters was not confirmed to the same degree.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put the hypothesis that “the culprit was in the investigative network, but could not be identified due to lack of physical evidence.” At first everything seemed to fall into place. However, when asked the question, “Which would the criminal’s silence support more: death, incarceration, or voluntary suspension?” a weak part of the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
▲ End of investigation record — Questions still remaining
· FBI Archives — The Zodiac Killer
※ This article is a commentary in the form of a personal investigation record based on public records and reliable data. We distinguish between facts and inferences, and we update our judgments when new official announcements are made.