An entry in Fortnightly Topic Challenge #31: Steganography (round 2)...

I found this in my Inbox today. I think someone is playing a prank, but ... well ... I'm really not sure! Puzzling friends, can you please take a look and see if you can tell what's up with this message?

Date :   08-JUN-2017
Dossier : RAND AL'THOR
Urgency: HIGH

Surveillance target "Rand al'Thor" is known to have a history of eclectic, sometimes suspicious Internet searches. Prior reports detailed searches which returned the names of politically unstable or democratically unfriendly nations including Azerbaijan, Bosnia and Herzegovina, Czech Republic, Kazakhstan, Kyrgyzstan, Uzbekistan ("Google Searches", REPORT 1503), Turkmenistan, Iran, China, Vietnam ("Google Searches", REPORT 1505), and Iraq ("Google Searches", REPORT 1612); multiple uses of online cryptography tools; and ongoing association with an online community ("Puzzling"), whose members use a wide variety of techniques to encipher or disguise information, as well as with other online communities focusing on other areas of interest (see "Stack Exchange", REPORTS 1411 through latest).

Our latest surveillance report echoes earlier ones. Target continues to be active in a community whose ostensible purpose is to ask and answer questions about science fiction and fantasy, but whose members include a number of other potentially subversive targets of interest in this investigation. Target is also active in other groups discussing Literature, Movies and TV. We note that activity in another community-of-interest, Programming Puzzles and Code Golf, remains largely non-existent; monitoring activity there will continue, but thus far has not been of concern.

We continue to observe conversations between target and other targets of interest. The name "Rand al'Thor" is a key figure in a well-known fantasy series, A Wheel of Time. Curiously, "Mithrandir" (aka Gandalf, a key figure in the Lord of the Rings series) is another target of interest, and both these targets interact frequently in more than one online community. For roughly the past half year, starting mid-November '16, these two "key figures" have had quite a bit of interaction; we may need to look for other notable literature figures that appear prominently in target's interactions. Given the communities they inhabit, the potential for clandestine exchange of information certainly exists, and there may well be a whole network of contacts concealed in plain sight. We recommend looking for other frequent contacts and placing them under watch as well, but (as always) great care must be taken to keep this surveillance secret — we could jeopardize the entire investigation if we manage to scare the targets off. One particular place to look is the aforementioned Programming Puzzles and Code Golf community, whose members have been increasingly observed chatting outside their usual room ("The Nineteenth Byte") with members of the Puzzling community (of which target is a high visibility member and still its highest reputation participant). We noted in our last report that Puzzling chat traffic has greatly increased lately, with much high-volume traffic consisting of the exchange of many "clues" and "answers" in short periods of time; this chatter seems to be consistent with wordplay games being hosted in those chat rooms, but we would remiss not to point out that, in modern browsers such as Chrome or Firefox, plugins might easily be in use which could encode intelligence data in these seemingly innocuous exchanges, and these two communities would be both capable of and enthusiastic about doing so. If this is happening under our noses, this entire surveillance investigation would be a total failure. Prudence demands we put resources on this promptly.

In our last report, we noted a dramatic drop-off in online traffic by target for nearly two weeks, and wondered if this might signal a sudden deep apathy with respect to online duties (see "Stack Exchange: Moderation", REPORT 1705). Our current report demonstrates this drop-off was temporary. As outlined at the close of the last report, we were commencing to set up physical surveillance on target from a nearby hotel; this was briefly put on hold when activity dropped off, but is now back in play. Starting with REPORT 1707 we will add an additional section detailing the results from this physical surveillance.

Please find the full surveillance report attached.


What is this message all about?


helpfulness level 0:

should really be something else, but that would be giving away too much.

helpfulness level 1:

Focus less on countries, more on capitals.
In retrospect this hint is perhaps more misleading than helpful, but it is technically a slight nod in the right direction.

helpfulness level 2:

Rand Al'Thor may be just the first of 9 people being watched ...

helpfulness level 3 (hintception):

Prior hint both asks two questions, and answers its own first question (in 3 different ways!)

helpfulness level 4:

The puzzle is a letter, made out of words.
The answer is a word, made out of letters.
Words to letters, letters to words,
Is this a hint or is it just absurd?

helpfulness level 5:

• The only thing important about cover letters like this are the letters themselves.
• Urgency is HIGH because there's a deadline!

helpfulness level 6:

• level 4+2: Letter → words → letters → words → letters → word.
• level 3+3: Listen, astute solvers, to  these words of  wisdom: examine every known solution  our ffao  made all year!

  • 12
    $\begingroup$ I have absolutely no comment on this puzzle. $\endgroup$ – Rand al'Thor Jun 8 '17 at 10:43
  • 3
    $\begingroup$ I don't have a clue where to start with this puzzle, but the surface is hilarious. $\endgroup$ – Deusovi Jun 8 '17 at 11:50
  • 6
    $\begingroup$ This is just too well done on the surface. Can't even start to concentrate on solving without bursting out in laughter. $\endgroup$ – Quintec Jun 10 '17 at 0:58
  • 2
    $\begingroup$ Not worthy of a partial answer in itself and I'm not sure it's even relevant, but in case it's useful to anyone: REPORT 1503, REPORT 1505 and REPORT 1612... $\endgroup$ – Alconja Jun 13 '17 at 2:51

The hints point to

this answer by ffao, involving the NATO phonetic alphabet.

From this, we can notice that

NATO phonetic alphabet letters are hidden in the text.

Uzbekistan ("Google searches", report 1503)
report echoes earlier ones
and Code Golf, remains
Gandalf, a key figure
mid-November '16
if we manage to scare the targets off
Code Golf community
browsers such as Chrome or Firefox
would be a total failure
a sudden deep apathy with respect to online duties
from a nearby hotel

These spell out the true meaning of the letter: steganography.


Hint 2 (continued)

The image found by @user37417 says a certain user might have a certain advantage in solving this puzzle. But according to hint 3 the image also hints at who that user might be in 3 different ways. I seem to have found them:

- The black text is written in color #020521, which happens to be my user ID.
- The other color used in the image is #005029, and 5029 in base 16 is 20521 in decimal.
- Less subtly, the background of the image is light green, or more accurately the color #00FFA0.

So I guess I should have an advantage here? I have no idea why, though! :)

  • $\begingroup$ you have experience with shady characters? you have experience spying on people? you made the email? :P $\endgroup$ – Quintec Jun 10 '17 at 20:50
  • 1
    $\begingroup$ puzzling.stackexchange.com/questions/31557/… Probably something to do with this or one of ur answers $\endgroup$ – bleh Jun 10 '17 at 23:20


Hint Level 2

Taking the italicized letters give -

enter image description here

  • $\begingroup$ I tried doing the same and forgot the URL prefix and wound up very confused. $\endgroup$ – feelinferrety Jun 13 '17 at 22:00


This is not a solution to the puzzle, but provides notes from its poser. This type of answer has been approved by the community.

Caution: This post may contain spoilers.


This was inspired by Fortnightly Topic Challenge #31: Steganography (round 2) - probably no surprise there. I had the idea to use the NATO alphabet but to conceal the letter names by splitting them up across different words (we've had a couple recent puzzles that did a similar thing). All I needed was something recognizable to spell ... and the choice of answer seemed entirely fitting, so I went with it.

Creative steps

I now knew what I wanted to spell out, so I knew what NATO alphabet words I needed to conceal. The first was "SIERRA" and, left on its own, would be entirely too conspicuous; "SIER" seemed like a reasonable word ending, though, so I looked at words with this ending. Of the available options, "DOSSIER" was the most promising. All I needed was a word to follow it, something with "RA..."

And then the puzzle more or less landed in my lap serendipitously.
Using the name "Rand al'Thor" gave me the right next letters, and gave me a theme for the surface reading of the puzzle: a dossier on PSE's resident leading rep-man and master riddler! By making the puzzle part of such a dossier I would even have an excuse to make allusions to code words, hiding information, etc. as part of what goes on at PSE: I could make a steganography puzzle about steganography, and put hints to steganography right in the plain text!

Logistical steps

The next letter was "TANGO". Splitting to "-TAN" and "GO..." was obvious, but what ends with -TAN? A bunch of former Soviet bloc nations, of course. I wonder ... did Rand al'Thor make any puzzles featuring country names? Hey, cool, he totally did - three of them! And "GO" ... Google! I could make part of the dossier entry about suspicious Google searches for these countries, and reference the puzzles their names were used in by mentioning prior supposed reports for those dates. Now my puzzle had a name, and its content had its heading and first paragraph, and the tone for the surface text of the puzzle was clearly established.

From that point it was about looking for ways to hide the remaining letters. ECHO was easy. GOLF and NOVEMBER looked like they'd be hard to conceal, but given we were talking about things Rand did online in general and on SE in particular, PPCG made the perfect cover for GOLF. "Gandalf" was perfect for ALFA, as it gave me another tie-in with key figures of literature and both Mithrandir and Rand's involvement in Literature SE. Mentioning mid-November '16 as the ostensible start of their association was probably not particularly accurate but it looked plausible, so the word could be "concealed in plain sight". For OSCAR, "to scare" seemed appropriate; having already roped Mithrandir into the investigation, bringing more people in but taking care not to scare them sounded good. ROMEO worried me until "Chrome" occurred to me, followed swiftly by "total fail" for the other ALFA; that part just wrote itself from there. Fitting "deep apathy" in for PAPA took a little more thought, but Rand's recent noticeable absence combined with some unfortunate goings-on in SFF gave a plausible cover story. The penultimate letter got to just be itself, as it worked in context.

For the final letter, there was no way to hide it and I wasn't able to come up with any way to use the word as itself in anything resembling natural language. But the dossier entry needed an author, so why not make it part of an agent code name! And, just so it wouldn't stand out like a sore thumb (and because I'd used "We" throughout the text), a second agent was needed ... for that one I had a little fun, with FOUR NO TRUMP being a bid in Bridge but also reading a bit like political commentary, adding one final fillip of distraction from the line before it.


The many activities and puzzles of Rand al'Thor gave me literally everything I needed to work with. His very name gave me my first letter. I wanted *istan countries, he had puzzles with them to spare. I needed Golf, he's got a PPCG profile. I need to link Gandalf in, they're both very involved in Literature. At every turn, when I thought of a way to conceal a NATO word, Rand's activity gave me what I needed to work it in. And finding (and mentioning!) all of these things I found just amped that wonderful we've-been-watching-you vibe up to 11.


After posting the puzzle, none of it ever changed; the only edits were to add the Hints.
I remembered there'd been a very recent puzzle that used NATO alphabet, so I knew I'd want to make a hint pointing at it. Because this is really a one-trick puzzle — once you hit on that aspect, solving would be very quick1 — I didn't want to come out and say "NATO", so finding a way to point at it while still preserving a little ambiguity was important. In ffao's recent answers I had just what I needed, so much of the hinting was first to point at ffao, and then to narrow it down to a short relevant interval.
I decided to make the hints additional pointers at steganography. I pointed at ffao by hiding his name and userid in the #hexcolors of an image, and then pointed at that image by embedding its tag steganographically in ... another message about Rand! (The imgur tag was again pure serendipity, starting with RA...) The last hint, narrowing things down to the final two weeks in May, was a final bit of steganographic fun; I like how it turned out.


This was a lot of fun to write. The way everything just dropped in my lap, it was more like finding a puzzle already written and waiting for me to discover the next bits. Admittedly, embedding a handful of NATO words into a long wall of text makes it easy to keep them hidden, but I was still afraid the five literally in plain sight — one of them in all caps right at the end of the puzzle! — would give the game away immediately.

I was thrilled with the reactions to this puzzle. It was fun to write, but even better was seeing people's great amusement at reading it. And even more better is that the hidden text stayed hidden for as long as it did, letting the hints play out to the anticipated/hoped-for end.
And in the end, the final hint that pointed at the NATO alphabet had exactly the effect expected. The puzzle indeed was very quickly solved.1

Congratulations to Deusovi for finding the trick to the puzzle, and nice job by all the folks who poked through the text finding the last of the hidden letters. This was fun — let's do it again real soon!

Thanks, and Keep On Puzzling!

1 ...17 minutes. That's all it took from "I'm thinking [...] NATO letters" to "it's just gonna spell [answer]". Nice job!!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.