Decode the letters from a criminal organization

Question

Last Saturday (2018-12-08), the Brazilian police caught those letters written by the bosses of a big Brazilian criminal organization in jail intended to be delivered to their men in the streets. The police decoded them and the local press published the decoded plaintext. It says something about killing prosecutors and other people from Brazil's judiciary system with the intend to avoid prisoners' transfers.

Note 1: Differently from most puzzles posted here, this is a real letter from a real police case. The decoded text and even the encryption and decryption scheme and keys were already published by the local press.

Note 2: If the police could decode it quickly, surely people from this community would also be able to do so. This should be a fun puzzle for this community nevertheless. So, you should explain how you solved it instead of just googling for the solution or for the keys. The police solved it without googling for the decoded text nor the encryption key, so should you.

Note 3:vOriginally, when I posted this (see the edition history, if interested), the local press had not yet published the decoded text, although it already claimed that the police solved it. And I didn't knew yet at the time what was the solution nor how to reach it (now I do).

Hint 1:

The encryption and decryption is simple and can be done by hand using only pen and paper.

Hint 2:

The plaintext is in Portuguese (and feature several typos and slangs), so don't rely in methods that assume that the plaintext message would be English.

Hint 3:

The decoded text is significantly smaller that the encoded text.

Hint 4:

The cryptography is symmetric and is based in a letter substitution scheme.

Hint 5:

Being both symetric and based on a letter substitution scheme doesn't imply a 1-to-1 mapping. The reason is simple: To encode a letter (say 'A'), you might replace all the 'A's in the plain-text for 'XYZ' in the encoded text.

Click the image to see it in full resolution.

Answer 1

I think the messages read:

RESTRITA

PRIMEIRAMENTE NOSSO FORTE E LEAL ABRACO A TODOS VCS PREST A ATENCA

O TODOS VCS DARESTRITA ESSA MISSAO E DE EXTR EMA POIS SE O AMIGO AQU I FOR PARA FEDERAL ESS A SITUACAO TEM QUE SER COLOCADA NO CHAO DE QUALQU ER FORMA

OS AMIGOS QUEREM INFO RMACOES TODA SEMANA ?A RA ###### SABER SE VOCE S ESTAO CHEGANDO COM A SINTONIA COM LE'ALDA DE JA DEMONSTRADA EM OUTRAS DA FAMILIA

INFELIZMENTE A CARONA NAO DEU CERTO EXISTE TRAIDORES NO MEIO #### DE NOIS MAS ESSES NA MELH OR HORA VAO TER A RESPO STA ALTURA

---

SALVE IRS DA RUA ESPERO QUE ESTA ENCONTRE TODOS COM SAUDE APEZAR DO LHMGAR DO PEDIDO QUE FOI FEITO PRA LEVANTAR A CAMINHADA DO FRANGO ESSE QUE MORA NA MESMA QUEBRADA DE VOCEIS TA NA MAO TUDO OS ENDERECO QUE ELE VAI TA MAPEADO ELE MORA NA LAUS MESMO E FICA A SEMANA TODA POR LA DENTRO DA PRA FAZER ELE HORA QUE QUI SER NOIS JA TEM O CARRO OS ORARIO TUDO DELE OUTRO SALVE DO FRANGO JAPONEIS E UM POUCO MAIS CONPLICADO MAIS DA PRA FAZER TAMBEM ORA QUE QUISER O QUE TA PEGANDO E QUE A CIDADE DELE E BEM MAIOR QUE * PRA DAR O BALAO DEPOIS E MAIS DIFICIL MAIS OS IRS TAO NESSA PEGADA O DE * DA PRA FAZER ORA QUE VCS FALA QUE E A ORA E NOIS

(VCS and the * (OP) seem to be names. Especially the hand-written message has several unusual word splits, for example info—rmações. I can't parse the question mark, and that word is in a crease in the paper. The transcription has a few minor errors, usually an S instead of the digit 5. But the transcription is invaluable, so many thanks to S.M. for providing it!)

The code is ...

... a substitution cipher, where two or three letters or digits represent a letter. Portuguese has letters many accented letters and also a cedilla, but these are rendered as unaccented or as plain C. (That's why I've posted the decoded message in all caps: In some languages, capital letters lose their accents.)

       A   B   C   D   E   F   G   H   I   J   L   M
      9C  X1 854  P2  CK  M5 723  8A  XT 148  K9  V8

       N   O   P   Q   R   S   T   U   V   X   Z   *
      W2  A3  B5  D2 659  4M  G3  HN  F7  NT 491  OP

All three-character codes are digits only and all two-letter codes have at least one letter, so that helps splitting the encoded words. Other than that, I can't see a pattern to the codes.

How did I decode it?

The key insight, that was also found by others, was that there are no single-letter words, although Portuguese has several (a, o, e, é, ...). There are no three-letter words (não, com, ...), either.

That could mean that each letter is encoded by two characters, but there are five 5-letter words, and more words with an odd number of letters after that.

The first step is to identify two-character codes by looking at two-character and four-character codes. Replacing them with a wildcard lets us identify further codes of two and three characters. Some of the replacements are errors, because they occur between two real codes. Fix them, rinse and repeat.

(Discard what looks like a date, "MG/AG/GMAH", and the "(A)"; they don't seem to be part of the body text and can mislead.)

We now have a substitution cipher. That's usually a job for quipqiup.com, but unfortunately that works for English text only. So it's a job for letter frequencies and statistics as collected in this helpful guide. Fortunately, the most frequent three- and two letter words, que and de, fit. The most frequent letter a also fits.

It's mix-and-match after that. With some household Portuguese (bastardized Spanish, really) and with the help of Google tanslate, I finally got the answer. I didn't try to make sense of it, but it looks Portuguese enough, I guess. :)

Answer 2

Partial answer:

Right off the bat you can look at the top part of the first letter and MG/AG/GMAH looks like it's in a date format, with GMAH probably being 2018, which means AG is 12 and MG is 02, which gives 02/12/2018. By that logic, it also means that every A = 1, G = 2, H = 8 and M = 0 for the rest of the text.

Assumption:

There are some patterns that appear often, such as "9C" and "D2HNCK", among others. I would take a wild guess and say that 9C could be "DE" (of), which is a common portuguese preposition. It could be other common word though, like "OU" (or) or "SE" (if).

Assumption #2:

There's too many very long words, and not one single letter word, so maybe there's "doubled" words or combined with other letters to maybe make criss-cross sentences.

Also, here's the transctipted text from both (don't think there's any need to hide it as a spoiler):

Left (since it's handwritten I may have misinterpreted certain characters): 659CK4MG3659XTG39C - MG/AG/GMAH

B5659XTV8CKXT6599CV8CKW2G3CK W2A34M4MA3 MSA3659G3CK CK K9CK9CK9 9CX16599C854A3 9C G3A3P2A34M

F78544M, B5659CK4MG3 9C 9CG3CKW28549C

A3 G3A3P2A34M F78544M P29C659CK4MG3659XTG39C, CK4M4MM9C V8XT4M4M9CA3 CK P2CK CKNTG3659 CKV89C, B5A3XT4M 4MCK A3 9CV8XT723A3 9CD2HN XT MSA3659 B59C6599C MSCKP2CK6599CK9, CK4M4M(?) 9C 4MXTG3HN9C8549CA3' G3CKV8 D2HNCK 4MCK659 854A2K9A38549CP29C W2A3 8548A9CA3 P2CK D2HN9CK9D2HN

CK659 M5A3659V89C.

A34M 9CV8XT723A34M D2HNCK659CKV8 XTW2M5A3 659V89C854A3CK4M G3A3P29C 4MCKV89CW29C 359C(?) 6599C ###### 4M9CX1CK659 4MCK F7A3854CK(?) 4M CK4MG39CA3 8548ACK7239CW2P2A3 854A3V8 9C 4MXTW2G3A3W2XT9C 854A3V8 K9CK9CK9P29C P2CK 1489C P2CKV8A3W24MG36599CP29C CKV8 A3HNG36599C4M P29C M59CV8XTK9XT9C

XTW2MSCKK9XT491V8CKW2G3CK 9C 8549C659A2W29C W29CA3 P2CKHN 854CK659G3A3, CKNTXT4MG3CK G36599CXTP2A3659CK4M W2A3 V8CKXTA3 #### P2CK W2A3XT4M, V89C4M CK4M4MCK4M W29C V8CKK98A A3659 8AA36599C F79CA3 G3CK659 9C 659CK4MB5A3 4MG39C 9CK9G3HN6599C.

Right:

4M9CK9F7CK XT6594M P29C 659HN9C (A) CK4MB5CK659A3 D2HNCK CK4MG39C CKW2854A3W2G3659CK G3A3P2A34M 854A3V8 4M9CHNP2CK 9CB5CK4919C659 P2A3 K9HM7239C659. P2A3 B5CKP2XTP2A3 D2HNCK M5A3XT M5CKXTG3A3 B56599C K9CKF79CW2G39C659 9C 8549CV8XTW28A9CP29C P2A3 M56599CW2723A3, CK4M4MCK D2HNCK V8A36599C W29C V8CK4MV89C D2HNCKX16599CP29C P2CK F7A3854CKXT4M G39C W29C V89CA3. G3HNP2A3 A34M CKW2P2CK659CK854A3 D2HNCK CKK9CK F79CXT G39C V89CB5CK9CP2A3. CKK9CK V8A36599C W29C K99CHN4M V8CK4MV8A3 CK M5XT8549C 9C 4MCKV89CW29C G3A3P29C B5A3659 K99C P2CKW2G3659A3. P29C B56599C M59C491CK659 CKK9CK 8AA36599C D2HNCK D2HNXT 4MCK659, W2A3XT4M 1489C G3CKV8 A3 8549C659659A3, A34M A36599CG59XTA3, G3HNP2A3 P2CKK9CK. A3HNG3659A3 4M9CK9F7CK. P2A3 M56599CW2723A3 1489CB5A3W2CKXT4M CK HNV8 B5A3HN854A3 V89CXT4M 854A3W2B5K9XT8549CP2A3, V89CXT4M P29C B56599C M59C491CK659 G39CV8X1CKV8 A36599C D2HNCK D2HNXT4MCK659. A3 D2HNCK G39C B5CK7239CW2P2A3 CK D2HNCK 9C 854XTP29CP2CK P2CKK9CK CK X1CKV8 V89CXTA3659 D2HNCK OP, B56599C P29C659 A3 X19CK99CA3 P2CKB5A3XT4M CK V89CXT4M P2XTM5XT854XTK9, V89CXT4M A34M XT6594M G39CA3 W2CK4M4M9C B5CK7239CP29C. A3 P2CK OP P29C B56599C M59C491CK659 A36599C D2HNCK F78544M M59CK99C D2HNCK CK 9C A36599C. CK W2A3XT4M.

(there still may be some mistakes here, if you spot any please do edit my answer)