Kryptos: The Cipher in the CIA Courtyard
Abstract
Kryptos is a copper sculpture by artist Jim Sanborn, dedicated in the courtyard of CIA headquarters at Langley on November 3, 1990. Its S-shaped screen carries four encrypted messages totaling 869 characters. Three were solved within a decade, by an NSA team, a CIA analyst, and finally a computer scientist who went public in 1999. The fourth message, 97 characters known as K4, has resisted every professional and amateur attack for 35 years, surviving even its own creator’s attempt to sell the answer: when Sanborn auctioned the solution in 2025, two journalists found the plaintext by accident in his papers at the Smithsonian before the hammer fell. The sculpture stands where the world’s best-funded cryptanalysts pass it on the way to lunch.
The Commission
When the CIA built its New Headquarters Building in the late 1980s, it commissioned artwork for the grounds. Sanborn, a Washington sculptor with no cryptography background, won with a proposal for a monument to intelligence gathering, and was coached in cipher construction by Edward Scheidt, the retiring chairman of the CIA’s Cryptographic Center. Scheidt designed the encryption schemes; Sanborn introduced his own modifications and cut the letters into a curving copper screen that reads like a page of captured traffic. Around it he placed granite, quartz, and petrified wood; other pieces on the grounds carry Morse code fragments. Scheidt rated the hardest section’s difficulty at nine out of ten and expected the whole thing to fall within a few years.
Three Down
The first three passages fell roughly as designed. K1 and K2 are Vigenère-encrypted (the tableau for the cipher is cut into the sculpture’s other half, using the keyword KRYPTOS); K3 is a transposition cipher. K1 decrypts to a poetic sentence of Sanborn’s own (“Between subtle shading and the absence of light lies the nuance of iqlusion”, misspelling intended). K2 describes something buried, with coordinates near the sculpture, and ends with a reference the community got wrong for years: in 2006 Sanborn revealed he had dropped a letter X from the ciphertext, garbling the ending; the intended final words were “layer two”. K3 is a paraphrase of Howard Carter’s diary entry on opening Tutankhamun’s tomb in 1922, ending in the question “Can you see anything?”
The solving order says something about institutional secrecy. An NSA team quietly solved the first three passages in the early 1990s, a fact that stayed classified for two decades. CIA analyst David Stein solved them by hand in 1998, and his achievement was celebrated only inside the agency. The public learned everything in 1999, when computer scientist Jim Gillogly cracked the three passages with a computer and announced it, at which point the CIA and later the NSA disclosed their earlier internal solutions.
K4
The final 97 characters have consumed careers. A dedicated community (mailing lists, annual gatherings, thousands of claimed solutions mailed to Sanborn, who eventually charged a fee to review them) has attacked K4 since the 1990s. Sanborn released four plaintext anchors to keep the hunt alive: by 2020, solvers knew that positions 22–25 spell EAST, 26–34 NORTHEAST, 64–69 BERLIN, and 70–74 CLOCK. The BERLIN CLOCK hint sent a decade of effort toward the Mengenlehreuhr, Berlin’s set-theory clock; in November 2025 Sanborn clarified that he had meant the Weltzeituhr on Alexanderplatz. None of the anchors has produced the cipher’s method, and Scheidt and Sanborn have both said that even the full plaintext is designed to lead to a further riddle.
The Auction and the Smithsonian Accident
In August 2025, Sanborn, approaching 80 and tired of being K4’s help desk, announced that RR Auction would sell the solution itself: his handwritten plaintext and coding charts, with the buyer free to keep the secret or publish it. Before the sale closed, journalists Jarett Kobek and Richard Byrne noticed that the auction listing referenced coding charts held in Sanborn’s papers at the Smithsonian’s Archives of American Art, requested the publicly accessible boxes, and found taped-together scraps that revealed the K4 plaintext. They sent it to Sanborn rather than publishing; Sanborn confirmed the find, had the archive material sealed until 2075, and let the auction proceed. The archive sold in November 2025 for $962,500. As of this writing the plaintext remains unpublished and the cipher method unsolved: the community’s problem has shifted from “what does it say” to “how was it done”, which was always the more interesting question.