One night in June 2001, Brian Patrick Regan drove out to Pocahontas State Park in Virginia and walked through the muggy darkness into the woods.

The former Air Force sergeant wore a backpack on his bearish 6’5″ frame; a sawed-off shovel handle stuck out of the top as he made his way along soft creek beds, avoiding hiking trails. Inside the pack was a night-vision monocle and a pile of classified material he had stolen from his longtime employer, the National Reconnaissance Office — the US agency that manages the nation’s spy satellites.

After he had walked about 10 minutes, Regan stopped and surveyed the tall oaks and maples. He lowered his pack, pulled out the shovel, and laid a plastic sheet on the ground. Then he began to scoop out a series of holes, carefully piling the dirt on the sheet so as to leave behind no sign of the dig. From his backpack he grabbed a stack of packages wrapped in garbage bags and placed one in each hole. The bags were stuffed with thousands of documents containing information about Libyan missile sites, Iraqi air defenses, and US spying operations in China and Iran. The material would have revealed exactly what the US knew about those countries. It was, Regan thought, the kind of information that could start a war.

He buried each parcel and packed up the leftover dirt in the plastic sheet. After filling each hole, he walked over to a nearby tree and hammered in some roofing nails. Then, using a GPS device, he captured the coordinates of each package and jotted them down. His work done for the night, the 38-year-old father of four trudged back to his car.

Two months later, on August 23, Regan told his supervisor he was heading off for a week’s vacation in Orlando with the wife and kids. Instead, at about 4 pm, he drove to Dulles Airport to catch a flight to Zurich, where he planned to meet with Iraqi and Chinese embassy officials and hoped to sell his trove to the highest bidder. After going through security, he boarded a crowded airport shuttle bus to get to his gate. As the doors were closing, an FBI agent named Steven Carr and one of his colleagues pushed their way through the crowd to the front of the bus and grabbed Regan.

When officials searched the aspiring spy, they found a paper tucked under the insole of his right shoe. On it were written the addresses of several Iraqi and Chinese embassies in Europe. In a trouser pocket they discovered a spiral pad in which Regan, who had been trained in cryptanalysis by the Air Force, had written 13 seemingly unconnected words — like tricycle, rocket, and glove. Another 26 words were written on an index card. In his wallet was a paper with a string of several dozen letters and numbers beginning “5-6-N-V-O-A- I …” And in a folder Regan had been carrying, they found four pages filled with three-digit numbers, or trinomes: 952, 832, 041, and so on. The spiral pad, the index card, the wallet note, and the sheets of trinomes: The FBI suddenly had four puzzles to solve.

Two days later, Carr’s group gathered with prosecutors and NRO agents in a conference room at the FBI’s Washington, DC, field office to try to decipher the cryptic jottings and notes. They began with one very good clue.

Regan had been under surveillance for months, after a foreign source passed on a letter from an unidentified US intelligence official offering to sell information. The letter was riddled with misspellings like “enprisioned” and “esponage,” which led the FBI to look for a bad speller within the intelligence community. Regan, who was dyslexic, became the prime suspect. He would later be known as the spy who couldn’t spell.

On the morning of his arrest, hidden cameras had photographed him at his desk as he browsed Intelink, the intelligence community’s private intranet, while scribbling in a spiral pad. From those photos and a log of his online activity, the agents surmised that the string of 13 words on the pad somehow related to the image of a Chinese missile site visible on his screen minutes after he logged in. Perhaps the words represented the coordinates of the site.

The first word was tricycle; the first digit of the latitude of the Chinese site was 3. Comparing the other words to the digits, Carr thought he saw a pattern. Words like post and tree that referred to tall, single objects might signify 1; motorcycle (two wheels) and switch (binary on-off positions) would be 2; weapon — evocative of a revolver with six chambers — could be 6. In encoding the coordinates, Regan seemed to have adopted a strategy frequently employed by dyslexics: using images to remember text.

Carr tested the theory with another document found in Regan’s wallet — a Post-it note with his Ameritrade account number, followed by “hand, tree, hand, car.” The group in the conference room watched as Carr dialed Ameritrade’s toll-free number from a speakerphone and punched in Regan’s account number. When prompted for the PIN, he entered 5154. “I gained immediate access,” Carr says.

They applied the same principle to the 26 words on the index card and decoded two other sets of coordinates. (Some terms were less obvious than others — Las Vegas represented 7, as in “lucky 7.”) These turned out to be locations of Iraqi surface-to-air missiles in the northern no-fly zone that had been imposed after the first Gulf War. Informing the Iraqis that the US knew about those systems meant they would be moved, making American planes patrolling the zone more vulnerable to attack. This did not sit well with Carr, a former military helicopter pilot.

Top

Secrets

When Brian Regan was arrested at Dulles Airport, he was carrrying papers containing different types of encrypted messages. To figure out what secrets he was selling and where they were hidden, investigators had to crack three kinds of codes.









Mnemonic Code FBI agents found a spiral pad and an index card on which were written seemingly random words like tree and glove. They realized that each image suggested a number — a common device used by dyslexics like Regan. Tripod, for instance, would be the number 3. The numbers turned out to be the coordinates for Iraqi and Chinese missile installations.

The Caesar Shift A scrap in Regan’s wallet contained a string of letters and numbers. FBI cryptanalyst Daniel Olson checked to see if the message was coded in an ancient method of enciphering used by Julius Caesar: He shifted all the letters forward in the alphabet one place at a time and eventually uncovered the addresses of several Swiss banks.

The Book Code Regan had also filled several pages with three-digit numbers, or trinomes. Olson suspected they pointed to words in a book — another venerable system. But which book and in what way? After his conviction, Regan revealed that he’d used his junior high yearbook — but he couldn’t recall how. Together he and Olson tried to crack the code.

As potentially valuable as these coordinates were, they were just a tease. Regan hoped to use them to impress his foreign partners and win their trust. According to letters found on his computer — addressed to Iraqi president Saddam Hussein, Libya’s Muammar Qaddafi, and others — the real promise was a huge stash of hidden material that he was offering for $13 million. The question now: Where had Regan hidden the stash? The agents figured that the key to finding it was in the other coded documents they’d seized at the airport — the alphanumeric string and the list of trinomes. They sent the documents to the National Security Agency, where cryptanalysts spent hundreds of hours on the two remaining puzzles. The result: nothing. Failure.

In a February 2002 report, the NSA admitted that its team of more than a dozen people had made almost no progress. And with code work mounting after the September 11 attacks, the report noted, analysts had less time to spend on the Regan papers. In a move that would begin one of the most unusual pursuits in the history of American code-breaking — one that would remain largely unreported until now — the job was assigned to a rising star in the FBI, a cryptanalyst named Daniel Olson.

Olson has a round, clean-shaven face, gray eyes, and blond hair. He talks fast and moves swiftly, as if his internal rhythm were just a little quicker than everyone else’s. In his office at the FBI Laboratory in Quantico, Virginia, the shelves are lined with videotapes of Hollywood thrillers involving code-breaking or the FBI: films like Manhunter and The Falcon and the Snowman . A display cabinet showcases relics of his profession, like a mechanical encoding device from World War II.

The son of a military man, Olson, now 40, joined the National Guard to pay for college and was eventually trained in code-breaking at the Goodfellow Air Force Base in San Angelo, Texas. In an intense 12-week course, he learned the intricacies of different ciphers and code systems, from those used in medieval wars to encryption schemes invented by Russian mathematicians during the 1920s and 1930s.

Cryptography is often a game of linguistic hide-and-seek, and the best players use a combination of disciplined logic and creative thinking. The first step in classic code-breaking is frequency analysis, which can help expose the rules that were used to convert the original message into gibberish. That’s because in every language, some letters and words — such as e and the in English — are used more often than others, and simple coding schemes often retain those patterns.

But a good code provides no statistical clues; the letters and numbers seem completely random. An example of such a system is the so-called onetime pad formerly used by KGB agents. Each spy had a pad with a unique key that specified how to translate a given text. For instance, the first word would be transformed by one number sequence, the second by a different number sequence, and so on. No statistical pattern would remain, because the letter e might be turned into m at one point in the message and t at another.

Other codes are based on a book — a novel or volume of history, for example — known to the sender and recipient. During the American Revolution, traitor Benedict Arnold wrote coded letters to the British Army in which each word was represented by a set of numbers indicating the page, line, and specific position where the word could be found in an agreed-upon book. To make codes even more difficult to crack, code makers sometimes mix junk — irrelevant words or letters — into the enciphered text, thus adding statistical noise to the signal.

Olson left active military duty in 1992 to finish college and began working with the FBI in 1997. By 2001, he had decoded hundreds of secret messages from prison gangs, drug traffickers, pimps, and gambling rings. His record was stunning, and his colleagues considered him just the man to tackle Regan’s gobbledygook.

It took Olson only a couple of weeks to decode the first puzzle, the note from Regan’s wallet that began “5-6-N-V-O-A-I …” It turned out to have been enciphered using a trick made famous by Julius Caesar in which all the characters in the message are shifted by a certain number of positions in the alphabet. Lining up the message on one end of a slide board, Olson shifted the letters by one place, then two places, and so on, checking the other end of the slide board each time to see if he got anything readable.

After 25 shifts down the alphabet — it would have taken just one shift in the opposite direction — the first line of text, “N-V-O-A-I-P-G …” resolved to “M-U-N-Z-H-O-F B-A-N-H-O-F -S-T-R,” which looked German. Shifting the numbers down one place as well, then doing an Internet search on the result, Olson found that it was the Zurich address for the Swiss bank UBS. The second line read out as Bundesplatz 2 in Bern, the location of another Swiss bank. Both were followed by a string of numbers that Olson eventually realized were the geographical coordinates of the two sites. When investigators later confronted Regan with the decoded addresses, he admitted that he had planned to have his clients hand him cash in the banks so he could deposit the money then and there.

But the final puzzle, the four pages of trinomes, continued to stump Olson. He could tell by certain patterns that they weren’t just random numbers; there was clearly a purpose at work. The first digit of each trinome could be any number from 0 to 9, the second was limited to 1 through 5, and the third was either 1 or 2. Regan had also rewritten some numbers and corrected others.

Olson suspected that it might involve a book code, and forensic experts at the lab examined a novel and a dictionary that Regan had with him at the time of his arrest. They looked for fingerprints to determine which pages he had touched most. They shined a special light on the pages to search for invisible ink. Olson focused on words that Regan had marked with a dot. Nothing made sense.

Meanwhile, Regan and his secrets were locked in a jail cell in Alexandria, Virginia, where he awaited trial. He knew that his legal fate would be sealed if the buried packages were found. So he tried to confuse the code-breaking effort, writing random three-digit numbers on papers and allowing them to be discovered by jail staff.

Olson wasn’t thrown off by the trick. He quickly saw that these scribblings were statistically different from the trinomes he was working on. But he also wasn’t any closer to cracking the code. He had filled entire notebooks working on possible solutions, practically memorizing the numbers in the process. He even had dreams filled with trinomes. His record was fabulous, but now he was struggling to solve perhaps the most important case of his career. He was going to need a partner — and a rather unlikely one at that.

Born into a blue-collar family, Brian Regan struggled to read and write in school. “Brian grew up feeling stupid, comparing himself to other kids because of the grades he got,” says David Charney, a psychiatrist who interviewed and counseled Regan in jail. Regan’s lumbering frame, social ineptitude, and slowness made him seem a bit like Lennie in Steinbeck’s Of Mice and Men.

He seemed to find confidence, though, when he joined the Air Force. As he climbed the ranks, he set about educating himself by listening to audiobooks borrowed from libraries. Obsessed with self-improvement, he wrote notes to himself that he scattered throughout his house and car. “Every day do a little studying towards your goal.” “Open mind to learn and grow.” “Repetition is the mother of skill.” He took courses in sociology and economics at community colleges.

In 1999, as Regan neared the 20-year service limit for officers of his rank, he was worried about money. With a wife still working on a nursing degree and four kids to send to college, his military pension would fall far short of his needs. He owed $116,000 on his credit cards, and he fretted that he wouldn’t find a civilian job.

Regan drifted into espionage almost by accident. One day, he came across a hidden locker at the office and wondered if he could make use of it. Soon he was squirreling away classified documents. “It was his self-invented retirement income,” Charney says.

When his trial began in January 2003, prosecutors, led by Patricia Haynes and James Gillis, cast Regan as a conniving traitor who deserved the death penalty. His own lawyers painted him as a bumbling misfit living out a spy fantasy. The lead defense attorney, Nina Ginsberg, cited spelling errors in the letters to Hussein and Qaddafi as evidence of a mind more childish than scheming. She suggested that the baffling papers with numbers were “meaningless documents intended perhaps to look like code.” That, she argued, was why no one had decoded them.

But the jury was persuaded by Olson’s analysis of the number strings, which showed that they clearly weren’t random. Regan was found guilty on three counts of attempted espionage and sentenced to life in prison.

The conviction meant that the mystery of the trinomes might finally be solved. In a deal with the government to protect his wife from charges and get himself out of solitary confinement, Regan agreed to help retrieve the hidden documents. It was good news for Olson: He had failed to crack the code himself, but at least he’d learn the solution.

On March 21, the day after Regan’s sentencing, Carr and other officials from the FBI, the National Reconnaissance Office, and the Department of Justice sat down to debrief Regan. Right away, he confessed that he had buried thousands of documents in state parks. His plan, he said, had been to offer the information to foreign governments. Once a deal had been struck, Regan would deliver the coordinates of the hiding places to his client, who would go dig them up. The scheme allowed him to avoid the riskiest part of espionage: the exchange.

There were 19 caches in all, he told the agents — 12 in Virginia’s Pocahontas State Park and seven in Maryland’s Patapsco Valley State Park. (The latter contained photos and CD-ROMs along with documents.) The trinomes that had frustrated Olson were the encrypted latitudes and longitudes of the 12 Virginia sites.

It turned out that the encryption had indeed been based on a book code — an NRO phone list. But there was no need to work it all out, Regan told the investigators. They only had to drive north on I-95 to exit 12A, walk up along the shoulder of the exit ramp, and dig up a plastic toothbrush container he had buried against the fence. On a piece of paper rolled up inside, they would find the 12 coordinates for the secrets buried in the Virginia park. He had written them in plain text and buried them in case he ever lost the encrypted pages. In the same container, investigators would find another paper with encoded coordinates for the Maryland sites.

Carr and his colleagues found the toothbrush container and quickly tracked down the Virginia packages. Each coordinate provided the location of a tree that Regan had marked on one side with a series of roofing nails. The package was buried on the opposite side. Within a couple of days, they had dug everything up.

The Maryland packages were another matter. Their locations were also encrypted by trinomes, and Regan revealed that the key to deciphering them was his school yearbook. But when Carr gave him the yearbook, he drew a blank. It had been three years since Regan invented the coding scheme, and he simply could not remember it. Carr believed him: After receiving a life sentence, there was no reason for Regan to play games. Olson was back on the case.

On an April morning in 2003, US marshals led Regan — handcuffed and dressed in a green prison jumpsuit — into a conference room in the basement of the Alexandria courthouse where his trial had been conducted.

The marshals unshackled Regan, and he sat down across from Carr and Olson. As always, he stared blankly ahead. On the conference table lay Regan’s personal copy of his yearbook: the 1977 edition from Mill Lane Junior High in New York, its green hardbound cover darkened by grime. Inside were rows and columns of mug shots of the graduating class with a name printed below each photo. Some kids were geeky-looking, some were freckled, some looked like Robert Plant wannabes. And there was the young Regan himself, with slightly droopy eyes, neatly combed hair, and a handsome smile. Some of his classmates had scrawled messages portraying him as a dolt. “Can’t believe you graduated!” one said.

Olson watched silently as Regan paged through the yearbook. The encrypted Maryland message lay on the table — a string of trinomes interspersed with two-digit numbers attached to an A like “13A” and “16A.” At the top of the page he had typed, “Number One.” This was a reference to his own picture in the yearbook, Regan guessed. But how that related to the trinomes, he had no idea. “He’d think and think; he’d start doing things on paper that I had already done — and get nowhere,” Olson says.

Shortly before lunch the pair focused on the alpha-numeral 13A, which appeared seven times in the message. Perhaps, they surmised, it appeared once for each of the seven buried packages. Olson thought about it, then counted 13 pictures forward from Regan’s. He came to a picture labeled “Mystery Man,” a photo of a student sporting a monster mask, on which Regan had written the name Frank. No other first name in the book began with F, and Olson suspected the letter was important. Perhaps it, and therefore all of the 13As, stood for “feet.”

That seemed right to Regan, and the discovery revealed the rule for decoding every one of the two-digit numbers attached to an A. They just had to count that number of places from Regan’s picture and take the first letter of the name of the person they landed on. Since 11A led to Cindy and 40A led to Donna, the sequence 11A 40A translated to “CD” — a compact disc. Soon they decoded other such sequences, converting them, for example, to “SP” for “small package” and “LP” for “large package.”

But even with part of the puzzle worked out, Regan still couldn’t remember how to interpret the nearly 200 three-digit numbers that made up the bulk of the message. One curious aspect was that the A-marked numerals stopped appearing about three lines before the end, leaving a long final string of three-digit numbers that didn’t seem as random as the ones above. “Think about it, Brian,” Olson said at the end of the grueling day. “Why did things change?”

The following Monday, Carr got a phone call from an officer at the prison: “Mr. Regan asked me to tell you that he has the solution.” It wasn’t clear when or how the breakthrough occurred. But the long brainstorming session with Olson and the solitude of his cell seemed to have unlocked Regan’s mind.

The numbers at the end of the message were neither junk nor code. They were coordinates — more precisely, the digits after the decimal point for each latitude and longitude, written in unencoded plain text. (The whole-number portion of the coordinates were unnecessary, since that would be the same anywhere in the park: 39 degrees north, -76 west.) Regan had thought that putting them in the message would be the equivalent of hiding them in plain sight. He remembered, too, how to decode the trinomes in the body of the document: You had to count the number of letters in names at specified positions, perform a couple of complex calculations, and then look up the final number on a conversion table consisting of a simple digit sequence that Regan had memorized. This would give you, among other things, the number of feet from the tree each package was buried. The scheme was inspired by Manhunter, a movie in which a serial killer known as the Tooth Fairy uses a book code to communicate with Hannibal Lecter.

Agents used the coordinates to locate the seven trees in Maryland that Regan had marked with roofing nails. With shovels and backhoes, they began to dig. Horseback riders wandered by, watching curiously. When a jogger asked about the work, Carr answered that it was an archaeology project. One person called the state park office to ask if they were building a Walmart.

They dug for weeks but failed to find a single package. “We could have put a Lincoln Continental into some of the holes we excavated,” Carr says. And so, one morning in late May, Carr and dozens of other federal agents and SWAT team members drove with Regan to Patapsco. It was drizzling. Regan stepped out of an SUV wearing red sweat pants and a poncho, one hand shackled to his waist. As he walked through the woods, stepping over fallen logs, he scanned the trees around him, occasionally squinting and scratching his stubble.

“I was scared that he’d toss himself into the river,” Carr says. But Regan calmly surveyed the scene, cocking his head now and then. Suddenly, he stopped and pointed at a spot more than 20 feet from one of the trees. “I buried it right there,” he said. Carr was skeptical. “I’m like, ‘Brian, I can’t remember what tree I peed on five minutes ago. How can you remember a spot you were at three years ago?'”

The agents dug 2 feet and struck gold: a package of compact discs. For three years, they had sat there inside a waterproof bag, a mother lode of military secrets noticed only by worms. It turned out that, unlike in Virginia, Regan had dug holes behind the tree opposite the tree with the nails in it. Soon the FBI had recovered all seven packages.

As they drove Regan back to prison, Carr and his colleagues stopped at a McDonald’s. Regan ordered a Quarter Pounder. The SWAT team guys urged him to take advantage of the opportunity, and Regan ended up eating three hamburgers.

But the law enforcement men were unable to bond with the convicted spy; Regan simply ate and stared quietly ahead. You could see why the kids at his junior high school had said he was lucky to graduate. How easy it was, Carr thought, to look at him and think that he was stupid. And how wrong.

Yudhijit Bhattacharjee (yudhijit@gmail.com) is a staff writer at Science.