The Trinity Letters and the Architecture of Control
On July 31, 1969, three California newspapers - the Vallejo Times-Herald, the San Francisco Chronicle, and the San Francisco Examiner - each received a letter from the man who would later become known as The Zodiac Killer. The letters sent were predominantly the same, and with each letter, was included one-third of a cipher. When combined, the three cipher pieces formed what is known today as the 408-cipher or Z408. Donald and Bettye Harden would solve this cipher a week later, all except for the final eighteen characters, which remain unsolved today.
The mailing is usually treated as a dramatic public debut to capture the Bay Area attention and to instill fear. However, it is more useful in the long run to treat this episode as a designed system: a public strategy for forcing shared attention, and a private structure for ordering the pieces after the cipher is broken.
Equal footing, then concentration
By July 31st he had already attacked twice in the Vallejo area; once at Lake Herman on December 20, 1968, and then on July 5, 1969, at Blue Rock Springs. When he wrote, he included the obvious local paper but did not wait to commit a San Francisco murder to write to the San Francisco papers. In this single moment he put three competing newspapers on equal footing.
He also rejected what would have been simpler options for communicating. He could have sent one letter and one complete cipher to a single paper - The Vallejo Times-Herald. Had this been entirely about publicity, he could have sent one letter and a complete cipher to all three papers. Either scenario would have put a full, solvable ciphertext into public view without requiring the papers to deal with one another. Instead, he split the cipher so that no paper held the whole.
With this action he made sure that no single newspaper could publish a complete cipher alone. Each newspaper would have a partial stake in the story. To assemble the message for publication, the pieces must be brought together, which means the newspapers must work together and treat the mailing as one coordinated act.
After he mails the letters, the pattern changes. Most of the later authentic letters go to the San Francisco Chronicle. A smaller number end up going to the San Francisco Examiner. The Times-Herald drops out of the later mailing pattern. Once equal footing has done its work, he places all his concentration on the paper with the highest-visibility stage. The split cipher is the mechanism that turns three mailings into one coordinated event rather than three parallel publicity shots.
Strategic value and cryptanalytic value
The main job of the 408-cipher split is strategic. While the cipher was split equally, cryptanalytically, the pieces are not equal.
A single third of a homophonic substitution cipher is weak, but not entirely unsolvable, on its own. Having a second cipher piece helps, because it increases the available text and repetition. A third piece supplies still more text and repetition, which is what the Harden solution used; the full, combined, 408-cipher. They also used a high-probability crib - “KILL” and its related forms - which appears four times in the plaintext and helps open the substitution. A closer look shows that a solver can work largely between the first cipher section and the third cipher section with that crib, mapping symbols and recovering plaintext, and only need the middle third at the end of decryption for a single residual character. The outer third sections carry most of the solvable repetition; the middle section functions more as confirmation.
All three pieces are required to possess the full ciphertext; however, they are not equally required to drive the solution. Publicly the split forces collaboration; cryptanalytically the load is skewed. Whether he intended that unevenness remains open. The structural fact, however, stands.
The count system and order after solution
The cipher sections are most often shown today in an order that reflects earlier law-enforcement or newspaper convention: Times-Herald first, Chronicle second, Examiner third. Some researchers have argued that the newspapers' original reporting of the order should be accepted. Others argue that law-enforcement has it right. I believe the mismatch could have been built in from the start - not by the police or the press, but by The Zodiac Killer himself.
- Vallejo Times-Herald: 2
- San Francisco Chronicle: 5
- San Francisco Examiner: 3
In each of the three letters the word “cipher” appears a different number of times:
Under the conventional attribution of cipher sections to newspapers, the known error counts do not line up with those figures. If the sections assigned to the Times-Herald and the Examiner are switched, a one-to-one correspondence appears between the number of times “cipher” is written in each letter and the number of known errors in the associated sections. The Chronicle pair remains 5 and 5, and the final eighteen characters now sits with the third section that the revised pairing assigns to Vallejo.
Because the error side of the match depends on decryption, the correspondence cannot be used to assemble the cipher on day one. It functions after the fact. It ranks the three pieces - and therefore the three papers - according to a rule embedded in the letters themselves.
While solving the cipher recovers the plaintext from the symbols, assembling it in his intended sequence is a different job altogether: it assigns which piece, and which paper, is first, second, and third. The Harden solution can exist without his preferred newspaper order. The count system ranks the sections on its own. They are two separate jobs that show content and order are recovered by different steps.
Cipher, code, and steganography
In the Chronicle letter he wrote, "In this cipher is my idenity." In the August 4th letter to the Examiner, he asked whether the police were "having a good time with the code." Both statements were read, naturally enough, as references to the 408-cipher. Cryptography, as a discipline, is wider than that reading.
Cryptography proper (overt systems) includes transposition and substitution; the 408-cipher is a homophonic substitution cipher, and the 340-cipher is a combined substitution and transposition cipher. Steganography (covert systems) hides the very existence of a message. One branch of steganography, linguistic steganography, uses language and ordinary documents as carriers. Embedded are open codes, semagrams, counts, formatting, and structure that look innocent until a rule is known.
The trinity count system belongs to that second category of cryptography. Word frequency in the cover letters and error totals in the cipher thirds look like normal writing and normal cipher noise. However, their alignment is a hidden index. Until the cipher is solved and the counts compared, the order information is simply not visible.
The same habit of layered meaning appears elsewhere: using identity language in the Chronicle letter that promises disclosure while withholding it in the 408-cipher; a short cipher like the Z13 that creates expectation "My Name Is" without delivering verifiable content; the map and details that accompany the Z32 carry more of the load than the cipher itself.
“In this cipher is my idenity” need not point at the final eighteen characters as a name. The 408 plaintext is a self-portrait of power and pleasure, not a name or an identifier. Identity, for him, is how he structures attention - how he forces papers to collaborate, how he ranks cipher sections in private, how he keeps the public circling promises that never quite close. The letters themselves, as carriers of counts and framing language, are part of that system.
One numerical parallel remains: under a fixed counting rule, “Vallejo Times-Herald” is eighteen characters long, matching the length of the unsolved 18 characters of the cipher that the revised pairing places with that paper. It fits his habit of embedding meaning in overlooked places; it does not by itself decrypt that portion of the cipher.
Short ciphers and permanent attention
The same structure of expectation and non-delivery appears in the shorter ciphers. The Z13 is introduced by "My name is"; the Z32 by the claim that the map and the code together will show where a bomb is set. In each case a strong promise is paired with a string too short to yield confirmable, unique information of the kind promised. The result is permanent debate and zero verification - the environment in which he operates.
For the Z32, the working structure is in the map and the spatial relationships it supports (fixed starting point at Mount Diablo, magnetic declination, observable landmarks, trilateration among fixed points), with the thirty-two symbols acting as validation, emphasis, or distraction rather than as the sole source of the fix. For the Z13, a rhetorical reading in which the answer to “My name is” is simply “ME” treats the line as a taunt rather than a failed name-delivery - consistent with identity language used as control rather than disclosure. Whether or not any single proposed reading of the Z13 or Z32 is accepted, the pattern is the same: create an expectation, supply a cipher that cannot close it, keep public attention circling.
The trinity mailing is the long form of that pattern. The short ciphers are the compressed form. In both, ambiguity is not a failure of the system; it is part of the design.
What the system shows
Outwardly the July 31, 1969, mailing forces competing newspapers into a shared problem and creates a collective debut. Inwardly it carries an unequal cipher structure and a post-solution index that ranks the pieces and the papers. Solving the 408-cipher and recovering his order of the cipher sections are different tasks. The same mind that splits a cipher to force collaboration also embeds a quiet rule for reassembling it after someone else has done the work of decryption - and later uses short ciphers and strong promises to keep the public permanently engaged without permanent resolution.
Related Articles
3. Cryptography: Behind the Layers of the Zodiac Killer's Deception
4. 408 Cipher Revisited: Tracking the Pieces Through Language and Error
5. A Humorous, Self‑Referential Reading of the Z13
6. The Zodiac Killer Z32 Cipher and the Rule of Three
7. Ciphers of Control: How the Zodiac Orchestrated Obsession