Solution to CIA’s Kryptos sculpture is found in Smithsonian vault | Hacker News Reader

Solution to CIA’s Kryptos sculpture is found in Smithsonian vault

nytimes.com

158 pointselahieh133 comments

So the central controversy in the story is whether the journalist fans should share the solution with the world or keep quiet for the auction.

Sanborn wants the money for medical reasons so he needs to maintain a high sale price.

The two fans want to share the solution with the world.

Presumably the winner of the auction will be buying a severely depreciating asset: the right to know but not disclose the solution. There are at least four people who have the solution and as soon as one of them shares it, its value goes to zero.

Maybe the “solution” to this meta problem is simple: auction it off to the public with a go fund me. As soon as it reaches $500k, publish the solution. That way everyone wins.

The whole thing got more complicated with the addition of lawyers, not less. I don’t see how the two fans violated any contracts with the artist or auction house since they never signed one. But of course lawyers will charge a ton for you to find out.

Feels like the central controversy is that Sanborn has to auction anything off for medical reasons.

True. The central problem described in the article is that he has cancer and doesn't want to go bankrupt from the medical bills.

I'm not a socialist and am broadly pro-capitalism, but for decades I've held a firm belief that healthcare should have a public option and people should have the ability to get high-quality medical care for $0, no matter how realistic that would be.

The father of universal healthcare by way of a state supported insurance system was Bismarck, who was far right by modern standards, and argued for it based on Christian morality, not socialism, though he was "accused" of being a "state socialist" over it, and embraced that label because it fit well with his struggle to limit the growing appeal of the actual socialists.

In European history, a lot of welfare reforms subsequently came down to Christian democrats (typically centre right to right by European standards) or cooperation between them and socialists and social democrats.

This just makes the US situation weirder - by the time socialists and trade unions gained much real power in Europe, universal healthcare was mostly already uncontroversial and settled or close to it as a result of the support of Christian groups on the right, with a couple of exceptions such as the UK, where the right wing rhetoric leading up to the NHS got pretty extreme.

Bismarck was afraid of workers unionizing and transformed a working healthcare system owned by workers into a state owned one. That move significantly reduced the utility of worker unions, which was the goal behind it.

A working healthcare system is dramatically overstating it, and his system - like the current German one - had relatively speaking low state involvement. The German system remains one of the least state controlled universal healthcare systems to this day.

I do agree with you that a lot of his motivation was to counter the socialists and unions though.

Though I'll note that already before Bismarck, the socialists largely didn't oppose state involvement - Marx famously lambasted the Gotha program of what became the SPD in part for their willingness to trust the state.

> True. The central problem described in the article is that he has cancer and doesn't want to go bankrupt from the medical bills.

What bills? He’s 79 so he’d have been on Medicare for the past 14 years. Sure there’s the Medicare premiums, but that’s peanuts.

You're deeply confused about the average American experience.

No, I’m deeply confused why he would have massive medical bills when he’s covered by Medicare. Medicare covers 80% of bills and Medigap plans cover the other 20%. I think some recent changes obviate their need too by capping the annual out of pocket to (I think) $2,000.

I don’t think he has any such bills. From the article:

> He has said he intends to use the proceeds to help manage medical expenses for possible health crises, and to fund programs for people with disabilities.

He doesn’t need the money to pay for some treatments for himself. He wants the money to give it away to others.

Tell us then, many of us are not Americans

My mom's insurance with medicare generally covers 80%, she gets to pay the leftover 20%. So uh bills with medicare is totally a thing.

My dad has medigap that covered all that

He pays like 140 a month extra for it though. But he had all his cancer treatments covered

guessing your father doesn't have cancer?

He had tonsil cancer but it's gone now.

What about maximum out of pocket maximums? All expenses are capped at like $15k per year right?

> capped at like $15k per year right?

That’s a lot of money for most retirees.

It’s not that much money considering the crazy amount of hospital time and advanced treatments administered. That’s 25% of the average annual salary in the United States and you should be able to pay that for once in a lifetime treatments.

> That’s 25% of the average annual salary in the United States

It's about 25% of the median annual full-time salary (but only ~70-75% of those employed in any given year are employed full-time for the whole year.)

More to the point, since salary doesn't tell you what people have lying around for emergencies, its more than double the median household total savings.

Even more to the point, population medians or avergaes for things like salary are not really applicable to subsets of the population like “retirees”.

I’m surprised how high the average wage is, but despite that, many have little in savings.

Around a third of Americans have less than $1000.

https://www.forbes.com/advisor/banking/savings/average-ameri...

Still, it’s good to keep in perspective during these discussions where it’s made to seem like people are being asked to pay millions for healthcare that were not really talking about bills that high.

I don’t think that matters - if you can’t afford $15k, the bill might as well be $10 million, as you still can’t pay.

Nonsense. You can go into debt for $15k. Plenty of places will give you that much even with terrible credit. No one is giving you $10 million.

Retirees in need of medical treatment without the resources to pay $15K out of pocket are probably not the subset of the population with the easiest access to significant credit.

for a majority of ppl on earth even

The simple reality is that advanced medical care is expensive.

Access to advanced medical care can either by gated by one person's wealth or by the average wealth of many people.

At the end of the day though, someone is paying and the only way to actually cost reduce is too have worse treatment.

> the only way to actually cost reduce is too have worse treatment.

So tell me, why is random blood work billed for over 400$? Just to analyze the sample?

Part of the problem is definitely inflated pricing and no real transparency.

Unless you need that rockstar surgeon for that super specialty treatment that only the US can offer, the US healthcare system is just overpriced, broken and a money grab

In most of the world, private treatment is far cheaper than equivalent private treatments in the US. To the point where even to a high cost location like London, it can be cheaper to fly to London from the US to have things done at a high end private hospital.

Medicare+Medicaid in the US costs about the same person taxpayer as NHS costs per UK taxpayer. The NHS could be better, but we get universal care for a similar price than what leaves most Americans still needing private care to have any cover at all.

That strongly suggests that the US could at a minimum do far better at providing cost effective care - both public and private.

> the only way to actually cost reduce is too have worse treatment.

This is absolutely incorrect in the American system. Insurance companies introduce massive amounts of overhead for little benefit. Every study comparing them to Medicare finds that Medicare is way more efficient.

Basic blood test should be $5. 99% of the more advanced ones shouldn’t cost more than $50.

Most medical care does not need to be advanced. It needs to be effective, but it doesn’t need to be expensive. It needs to be expensive to generate a hefty profit, though, especially when you have a serious condition - you then become a forced buyer and the market does what the market does with forced buyers without special regulations.

Or more effective treatment and not paying for ineffective ones. And less regulation and gatekeeping of which there’s a lot in the US (like needing insane levels of doctor oversight for buying medications)

> the only way to actually cost reduce is too have worse treatment

If you cut out profit motive, you can _definitely_ make it cheaper. Your statement is incorrect.

>the only way to actually cost reduce is too have worse treatment

but also the cost of treatments generally decreases with time, while the efficacy increases as techniques are refined, disseminated, etc.

The actual reason is that you'll have people going to see the doctor because their cheek's itchy (they're lonely, or clueless).

Mental health issues would ideally be addressed too.

This is such a minor concern in the grand scheme of things but the solution is empowering nurses and doctors.

there wouldn't be any way to compete with tax pre-paid $0 point of sale health care, so there would be no option. the term "public option" is a weasel word. there would be no private option because nobody is going to choose to pay out of pocket in addition to their taxes that already pay for care.

advocate for whatever but use honest terms. you're advocating for a single payer system and there's no evading that.

Fwiw, a lot of European healthcare has both a public and private option. You may pick the private options because they are "better" in some ways (e.g. more modern clinics, shorter waiting times, or sometimes just better care) which still leaves some wealth gap, but usually means no one goes bankrupt to cure cancer.

Usually the medical part of it all is strictly worse in the private sector (at least in my country) because the public system has a pretty strict competitive exam to get in, whereas profit driven private companies hire the cheapest doctor they can get.

Not everybody realizes that and they often fall for the single room in the hospital.

Shorter waiting times is definitely a thing though, especially for non life threatening conditions.

It's quite country dependent. For example in Hungary my understanding is that many doctors have both private and public practices, but private clinics often don't have expensive machines. Doctors in public hospitals are severely underpaid so they have strong incentives to move you to private practice.

In Italy doctors also have public and private roles but can practice privately in public hospitals, which is weird but was an attempt to avoid losing them to private clinics, for the same reason. You also have private clinics administering public healthcare with a minor markup paid by the patient, and the base rate paid by the state, which isn't a thing in Hungary for example.

It is in general for non-life threatening conditions that there's such competition tho, I agree.

In the UK a large proportion of the doctors are the same. Sometimes even using NHS operating theatres, or with NHS trusts running the clinics, as they are allowed to run for profit services to supplement their budgets...

The UK has both universal healthcare and private options that are far cheaper than the US.

Most universal healthcare systems coexist with private options paid separately. Some are provided by private healthcare providers, and then too tend to coexist with privately paid services.

It's silly to say "having options but you probably won't choose them" is the same as "no option".

There's probably a decent point nearby about subsidized (or tarriffed) work messing with the benefits of free market pressure but it isn't this silly overstatement.

> there would be no private option because nobody is going to choose to pay out of pocket in addition to their taxes that already pay for care

Every wealthy country besides Canada that provides public care is a counterpoint to this.

You realise that the impossible situation you describe is present in various places? Public and private healthcare systems existing in tandem.

You only rely on social security? No 401k for example?

Because that's the public option in retirement and you can have private options like 401k on top

Make the auction include the physical piece of art itself. Then you're buying a tangible and transferable asset. I think the CIA has enough money it can endeavor to replace it. What value does a cracked puzzle even have to them?

It always bothered me because cryptography isn’t the CIA’s thing. Spies and analysis are their thing. Code breaking is the NSA

Government agencies do not have cleanly separated roles. They tend to grow and agglomerate capabilities to maximally soak up budget allocation. NSA is primarily SIGINT.

Do I understand part of the complexity of the situation is that Kryptos is in some sense "crackable" (unlike real cryptography), and these two people sleuthed their way to the answer book without solving it? Which is not quite exactly the same thing as them independently working out a solution; it's more like a nicer and more legal version of breaking into the guy's house and stealing it out of his desk drawer?

Can we even determine if what they found is the key, or just the plaintext? The article mentions they recognized bits of plaintext (Berlin clock) in the archives.

Technically what they accomplished is a successful side channel attack.

"What we think intelligence agencies do" vs "what intelligence agencies actually do"

At the state level, it's a method that is in bounds.

I don't have an opinion! As a cryptography pentester, Kryptos has always kind of set my teeth on edge (Wikipedia had editors covering cryptography topics whose expertise was rooted in Kryptos puzzle-crypto). But one of the smartest people I know is also a Kryptos enthusiast so this is all very complicated for me.

Yes, but all things considered, that's outside the bounds of this cypher - which is why "we all" feel cheated.

Honestly, everything about this is really sad. I, like may of you guys, have followed this thing for years, for many others, decades.

Actual decryption effort group didn't get to decrypt (a small but faithful community), the creator needed the money for medical procedures that he really believed was coming in. The solution feels like we all go cheated out of something. Lawyers are now involved and the value of the solution is rapidly plummeting.

No one's winning because of a small mistake.

Can we talk about how broken America’s medical system is that folks make decisions based on medical issues or bills?

i guess cooking meth is not an option when you have a sculpture in cia hq

jokes aside, you would be responsible for single digit percentages of the global yearly production to make this kind of coin (after the cost of equipment, precursors, money laundering, and assuming bulk sales)

just isn't realistic

Here, I’ll give you this one for free: it’s called tortious interference. As the name suggests, it’s a tort, so you don’t need to sign a contact to be liable.

There would need to be (1) an existing valid contract, (2) knowledge by the defendants of it, (3) intentional and unjustified inducements by the defendants to break it, followed by (4) an actual breach that (5) caused damages.

Doesn't seem like that would fit here.

This seems like more of an ethical dilemma than a legal one.

> There would need to be (1) an existing valid contract,

Your (1) is false. You can damage a business relationship that doesn’t involve a signed contract.

“Tortious interference with business relationships occurs where the tortfeasor intentionally acts to prevent someone from successfully establishing or maintaining business relationships with others.” https://en.wikipedia.org/wiki/Tortious_interference

They aren't doing it with the intent to damage his business. They're just doing something they would have done anyway.

You can't claim tortious interference just because someone throws a wrench in your business plans. Sanborn has about as much of a case as Microsoft has against Linus Torvalds for creating Linux and hurting their sales of Windows. (I'll give you this one for free: none.)

> They aren't doing it with the intent to damage his business.

That’s arguable. They sent him an email concerned about the harm of disclosure with the upcoming auction. They then apparently got offended by the offer of money to sign an NDA which calls their future motives into question as they now had a beef with the guy.

Saying the actions themselves were not improper is also a defense, and could be perfectly viable even if they had beef with the guy.

"To be improper, interference must be wrongful by some measure beyond the fact of the interference itself, such as a statute, regulation, recognized rule of common law, or an established standard of trade or profession."

They don't need a defense: nobody has yet stated a claim!

It was claimed they committed copyright infringement and they admit to photographing his works as part of this discovery.

It actually being copyright infringement is questionable, but if so it would be improper behavior.

NAL but in copyright it’s not making a copy that’s problematic, it’s making that copy available to others. Anyone can take a picture of Mickey Mouse; one only has a problem when they start to sell it.

This cryptography solution is more akin to mathematics. And mathematics isn’t covered by the copyright law.

Civil penalties can be imposed when make a single copy without a fair use exception, this is why pre BitTorrent people got into trouble for downloading music for themselves. The government doesn’t care unless you get sued but they will enforce the lawsuit if you lose.

Criminal investigation and penalties occur with wide scale commercial distribution of copyrighted works.

They copped the actual message in its entirety not just a cryptographic formula. Further, his hand written notes may have creative expression even if the process itself isn’t protected by copyright. Similar to how software code is protected.

Would "personal research" qualify for a fair use exception?

In any case it would not seem reasonable for Sanborn to sue these two guys for "copyright infringement" when all they did was study his own works that he donated to the library for the others to study. This would probably tarnish his reputation forever.

Fair use isn’t so easily to determine based on individual criteria, you’re not allowed to copy a full book for personal research but to copy a paragraph is likely fine. Where exactly the line is drawn is what the courts decide after the fact, but let’s photograph everything and send them to someone else to read isn’t likely to qualify for fair use.

Also, he doesn’t need to be the person suing here. The auction house can sue based in part on a copyright breach because that’s not something they had permission to do even without owning the copyright. The idea is to separate fair from unfair competition, if your competitor is using slave labor that’s not something you’re allowed to do. It’s not directly impacting you but the indirect effects from such actions also matter.

Yep! That'd be a real claim. I hadn't seen that earlier.

That's not a tort in American law. In this country contractual arrangement is required for tortious interference.

There was a contract between the auction house and the artist.

However that’s not strictly required: “Wrongful interference in a business relationship occurs when there is no contract. The defendant attempts to disrupt the relationship, causing economic harm. If the defendant defames the business owner’s product, resulting in loss of business, that is tortious interference in the business.”

https://www.findlaw.com/smallbusiness/liability-and-insuranc...

Your cite is about interference of contract... interference of business relationship is not an American tort.

OK, but the interference still needs to be improper!

Agreed, though I’m not sure if it would be considered proper or improper here.

>Jim Sanborn planned to auction off the solution to Kryptos, the puzzle he sculpted for the intelligence agency’s headquarters. Two fans of the work then discovered the solution.

Gift link https://www.nytimes.com/2025/10/16/science/kryptos-cia-solut...

I like this comment:

Victor Wong writes,

“If they don’t have the method,” she said, “it’s not solved,” she said.

That does raise a philosophical point to the craft of intelligence gathering. Speaking as a professional librarian, I do applaud the use of ATI (access to information) to find the appropriate data -- it's akin to a WW2 unit capturing an Enigma codebook.

(for posterity: my use of quotemarks left something to be desired here - the quote 'that does..codebook' is Mr. Wong's quote, not my own. I got an uncharacteristically large number of upvotes from the comment above. I suspect had less to do with HNers' appreciation of library science, and more to their expressing appreciation of one's display of their professional bonafides, which I regret, in this case, are not my own to profess.) Although I wonder if HN's commenting system removed any addititional quotemarks I may have placed at the time.

As I see it it's a lesson about finding out things in the real world. It's even a little poetic that the people finding the solution are a pair of investigative journalists, digging up information that was technically already out there, rather than a puzzle solving cryptologist "breaking down the front door of the problem" so to say.

Kobek may actually have pulled that off once before, by the way. I'm pretty sure that his Zodiac killer candidate, Paul A. Doerr, will turn out to have been correct.

"Security is only as strong as the weakest link" and all that.

> “This is a problem everybody has been attacking as a STEM problem,” Mr. Kobek said in an interview, referring to the fields of science, technology, engineering and mathematics that underlie cryptography. Cryptographic science, he argued, could not solve Kryptos — “but library science could.”

I thought that, in light of this comment https://news.ycombinator.com/item?id=45621067, we're only a few days from seeing the solution. However, the auction now reads

> Upon being notified, the Smithsonian immediately sealed Sanborn's archives for 50 years to protect Sanborn's intellectual property rights.

Sanborn actually showed off some of his worksheets during a PBS interview years ago, which I assume are the same documents later given to the Smithsonian. At one point I looked into buying the B-roll footage to take a closer look at them, but I discovered enterprising Kryptos sleuths had already done so years before.

I see people upset about the solution being found "Through other means", but this is technically still in the spirit of the puzzle.

1. That is technically normal espionage practices, the CIA wouldn't be the CIA if they were only reliant on cryptography... (they'd be the NSA)

2. The solution to this puzzle would bring closure to at this point generations of curious people.

3. On the more technical side, it's been discussed that the potential method for decrypting K4 is more or less insolvable through normal patterns because Jim not being a cryptographer decided to use a multi stage encryption method which relies on knowing both (or multiple) keys with accuracy. The risk here with him not being a cryptographer is not realizing the how hard/impossible he might have made it.

4. I also like to believe as we culturally move through time the potential Keywords or transposition shift keys may dissolve away. For all we know he may have chosen a word that was colloquial to the 80's, CIA, Espionage...ect that has just dissolved with time.

I want to see the solution, I want to reiterate Jim was not a cryptographer and may have gone buck wild with his encryption.

Just throwing out some solution banter. I believe one layer of K4 is null cipher, but I think its screwed by a transposition of which I think the key is based off K0, or something to do with the lat-long coordinates.

Also when he says Berlin clock I think he means Kalendarplatz, this would make more sense as he is a sculpture artist who works with forces of nature.

My only other call out is he may have tied Kryptos into the north east area of the CIA, potentially linking it to the memorial gardens or the wall of the fallen officers.

I always thought it was kinda stupid that this puzzle was made for the CIA instead of NSA in the first place. Some other responders sound like they agree.

And as someone else said, this is exactly the sort of solution the CIA would come up with. So it should be considered in bounds.

"After careful consideration, we conclude that the puzzle doesn't exist."

https://imgur.com/gallery/fbi-cia-kgb-5koAv3H

Another Berlin clock, installed 1975:

https://en.wikipedia.org/wiki/Mengenlehreuhr

"side-channel attack" and it was super effective!

$9 hammer.

Recent and related:

The secret code behind the CIA's Kryptos puzzle is up for sale - https://news.ycombinator.com/item?id=44907366 - Aug 2025 (53 comments)

> Last week, Mr. Kobek and Mr. Byrne received an email from lawyers for RR Auction that threatened legal action if they published the text, citing copyright infringement and interference with contracts.

Shameful behavior.

Interview with the Smithsonian researchers here

https://zonamotel.substack.com/p/interview-kryptos-k4-uncove...

relevant to this discussion is an essay from James Mickens : https://www.usenix.org/system/files/1401_08-12_mickens.pdf

This essay is relevant to this situation because the threat model in James’ essay is almost the same way this cipher was decrypted.

It seems to me that if a puzzle has gone unsolved for 35 years despite many very skilled people trying hard to solve it... It is not actually a good puzzle?

Like, here - here's a code that no one will ever solve: ITIWKSMNDIWKD WJSIKWMWMSONQ

Turn that into a sculpture and put it outside the CIA.

Pretty sure I cracked it:

B-E-S-U-R-E-T-O-D-R-I-N-K Y-O-U-R-O-V-A-L-T-I-N-E

This is about the Kryptos cypher, it should be in the submission's title, cause people here know what it is mostly.

Thanks, we've put the HMTL doc title up there now.

Alt title from NYT header: Solution to CIA’s Kryptos Sculpture Is Found in Smithsonian Vault

not clickbaity enough. journos got mortgages to pay & the Sulzbergers need their dividends.

Wrong kind of clickbait headline for HN though, probably more interesting that it's about the kryptos sculpture.

They are guidelines, not rules, but the site guidelines here advise submitters to use the original title for linked articles: https://news.ycombinator.com/newsguidelines.html

And frankly a Kryptos solution is much more interesting than some arbitrary CIA secret!

Reply on news.ycombinator.com